| |
| |||||||
Log-Analyse und Auswertung: akamaihd Infizierung - blockiert FBWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
30.08.2014, 01:25
| #1 |
| |  akamaihd Infizierung - blockiert FB Hallo liebes Trojaner-Board, habe soeben festgestellt, dass sich Facebook bis auf die oberste Zeile mit Suchfeld nicht weiter aufbaut. Habe dann gesehen, dass bei no-script "akamaihd.net" mit drinsteht. Genialerweise hab ichs dann temporär erlaubt und no-script somit nutzlos gemacht, die größte Fehlerquelle sitzt halt immernoch vorm PC... Facebook funktionierte dann wieder einwandfrei, akamaihd ist mittlerweile blockiert und ich habe bis auf FB (noch) keine weiteren Probleme damit, also nicht wie von anderen Nutzern dargestellt nervige Popups oder ähnliches. Bin dann auf diesen Thread gestoßen: http://www.trojaner-board.de/128018-...maihd-net.html Habe dann die dort geschilderten Schritte durchgeführt und mich bei OTL sogar dazu hinreißen lassen, auf "Bereinigung" zu klicken. Wie ich Regel 1 des Trojaner-Boards entnehmen konnte hab ich auch hier voreilig gehandelt und mir so vielleicht unnötig das Leben schwer gemacht, aber das wird man sehen. Hier also die Logfiles: Malwarebytes Anti-Rootkit hat keine Probleme entdecken können, da spar ich mir den Log AdwCleaner 1/2 Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 30/08/2014 um 01:23:15
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Ghost - GHOST-PC
# Gestartet von : C:\Users\Ghost\Downloads\adwcleaner_3.308.exe
# Option : Suchen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Datei Gefunden : C:\Users\Ghost\AppData\Roaming\Mozilla\Firefox\Profiles\ye5tjacp.default\user.js
Ordner Gefunden : C:\Program Files (x86)\Softonic
Ordner Gefunden : C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf
Ordner Gefunden : C:\Users\Ghost\AppData\Local\Temp\OCS
Ordner Gefunden : C:\Users\Ghost\AppData\LocalLow\Softonic
Ordner Gefunden : C:\Users\Ghost\AppData\Roaming\OpenCandy
Ordner Gefunden : C:\Users\Ghost\AppData\Roaming\pdfforge
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gefunden : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gefunden : HKCU\Software\OCS
Schlüssel Gefunden : HKCU\Software\Softonic
Schlüssel Gefunden : HKCU\Software\SoftonicToolbar
Schlüssel Gefunden : [x64] HKCU\Software\OCS
Schlüssel Gefunden : [x64] HKCU\Software\Softonic
Schlüssel Gefunden : [x64] HKCU\Software\SoftonicToolbar
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{CA0167C2-6295-41B8-9BDA-704B2F5E4CD9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\S
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Softonic.dskBnd
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Softonic.dskBnd.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Softonic.SoftonicHlpr
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\Softonic.SoftonicHlpr.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\SoftonicApp.appCore
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\SoftonicApp.appCore.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc.1
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gefunden : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gefunden : HKLM\SOFTWARE\Google\Chrome\Extensions\elchiiiejkobdbblfejjkbphbddgmljf
Schlüssel Gefunden : HKLM\SOFTWARE\InstallIQ
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gefunden : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Softonic
Schlüssel Gefunden : HKLM\SOFTWARE\Softonic
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gefunden : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Wert Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{5018CFD2-804D-4C99-9F81-25EAEA2769DE}]
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
Einstellung Gefunden : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page] - hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=10&cc=&mi=ac1f85d00000000000006cf04972bb0d
Einstellung Gefunden : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs] - hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=ac1f85d00000000000006cf04972bb0d
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\Ghost\AppData\Roaming\Mozilla\Firefox\Profiles\ye5tjacp.default\prefs.js ]
Zeile gefunden : user_pref("extensions.Softonic.admin", false);
Zeile gefunden : user_pref("extensions.Softonic.aflt", "OC");
Zeile gefunden : user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
Zeile gefunden : user_pref("extensions.Softonic.autoRvrt", "false");
Zeile gefunden : user_pref("extensions.Softonic.cntry", "DE");
Zeile gefunden : user_pref("extensions.Softonic.dfltLng", "de");
Zeile gefunden : user_pref("extensions.Softonic.dfltSrch", true);
Zeile gefunden : user_pref("extensions.Softonic.dnsErr", true);
Zeile gefunden : user_pref("extensions.Softonic.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,3224935090,2597085128,182856413[...]
Zeile gefunden : user_pref("extensions.Softonic.excTlbr", false);
Zeile gefunden : user_pref("extensions.Softonic.ffxUnstlRst", false);
Zeile gefunden : user_pref("extensions.Softonic.hdrMd5", "");
Zeile gefunden : user_pref("extensions.Softonic.hmpg", true);
Zeile gefunden : user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=ac1f85d00000000000006cf04972bb0d");
Zeile gefunden : user_pref("extensions.Softonic.id", "ac1f85d00000000000006cf04972bb0d");
Zeile gefunden : user_pref("extensions.Softonic.instlDay", "16026");
Zeile gefunden : user_pref("extensions.Softonic.instlRef", "MOY00621");
Zeile gefunden : user_pref("extensions.Softonic.lastB", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=ac1f85d00000000000006cf04972bb0d");
Zeile gefunden : user_pref("extensions.Softonic.lastVrsnTs", "");
Zeile gefunden : user_pref("extensions.Softonic.newTab", true);
Zeile gefunden : user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=ac1f85d00000000000006cf04972bb0d");
Zeile gefunden : user_pref("extensions.Softonic.pnu_base", "{\"newVrsn\":\"229\",\"lastVrsn\":\"229\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"false\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");
Zeile gefunden : user_pref("extensions.Softonic.prdct", "Softonic");
Zeile gefunden : user_pref("extensions.Softonic.prtnrId", "softonic");
Zeile gefunden : user_pref("extensions.Softonic.rvrt", "false");
Zeile gefunden : user_pref("extensions.Softonic.sg", "{smplGrp}");
Zeile gefunden : user_pref("extensions.Softonic.smplGrp", "none");
Zeile gefunden : user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
Zeile gefunden : user_pref("extensions.Softonic.storage\\mpvfloatingwindmutex", "Sun Nov 17 2013 17:00:03 GMT+0100");
Zeile gefunden : user_pref("extensions.Softonic.tlbrId", "opencandy2013");
Zeile gefunden : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=ac1f85d00000000000006cf04972bb0d&q=");
Zeile gefunden : user_pref("extensions.Softonic.vrsn", "1.8.21.14");
Zeile gefunden : user_pref("extensions.Softonic.vrsnTs", "1.8.21.142:07:20");
Zeile gefunden : user_pref("extensions.Softonic.vrsni", "1.8.21.14");
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [11900 octets] - [30/08/2014 01:23:15]
########## EOF - C:\AdwCleaner\AdwCleaner[R0].txt - [11961 octets] ##########
Code:
ATTFilter # AdwCleaner v3.308 - Bericht erstellt am 30/08/2014 um 01:24:32
# Aktualisiert 20/08/2014 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Ghost - GHOST-PC
# Gestartet von : C:\Users\Ghost\Downloads\adwcleaner_3.308.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Program Files (x86)\Softonic
Ordner Gelöscht : C:\Users\Ghost\AppData\Local\Temp\OCS
Ordner Gelöscht : C:\Users\Ghost\AppData\LocalLow\Softonic
Ordner Gelöscht : C:\Users\Ghost\AppData\Roaming\OpenCandy
Ordner Gelöscht : C:\Users\Ghost\AppData\Roaming\pdfforge
Ordner Gelöscht : C:\Users\Ghost\AppData\Local\Google\Chrome\User Data\Default\Extensions\elchiiiejkobdbblfejjkbphbddgmljf
Datei Gelöscht : C:\Users\Ghost\AppData\Roaming\Mozilla\Firefox\Profiles\ye5tjacp.default\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\elchiiiejkobdbblfejjkbphbddgmljf
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escort.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortApp.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escorTlbr.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\escort.escortIEPane.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\S
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Softonic.dskBnd
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Softonic.dskBnd.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Softonic.SoftonicHlpr
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Softonic.SoftonicHlpr.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\SoftonicApp.appCore.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\srv.SoftonicSrvc.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Extension Compatibility\{74F475FA-6C75-43BD-AAB9-ECDA6184F600}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{09C554C3-109B-483C-A06B-F14172F1A947}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{7ABBFE1C-E485-44AA-8F36-353751B4124D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{44B50C01-4993-48E2-ADEE-D812BAE2E9A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A3E2F089-DDBB-4CBF-B06C-5D44DA316ED3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{A5679AB0-C59E-49E7-83C4-5289F844A6E0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{CA0167C2-6295-41B8-9BDA-704B2F5E4CD9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{11D9E165-B8C1-4734-A56C-BC4FCACA966B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4E1E9D45-8BF9-4139-915C-9F83CC3D5921}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{B15F118E-AF21-45E8-A809-29FDD7362565}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{D7EE8177-D51E-4F89-92B6-83EA2EC40800}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{25A3A431-30BB-47C8-AD6A-E1063801134F}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5018CFD2-804D-4C99-9F81-25EAEA2769DE}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{E87806B5-E908-45FD-AF5E-957D83E58E68}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9CF034EA-7B46-48D3-8895-8A14B32AE445}
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{25A3A431-30BB-47C8-AD6A-E1063801134F}]
Wert Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar [{5018CFD2-804D-4C99-9F81-25EAEA2769DE}]
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{087CDC12-0A11-4D1D-8DCF-44185D7C3496}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{088BF3A9-6AE8-47B9-A3FB-26262F236C79}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2AC7B9EB-3881-4EB9-8DEE-0A731A309FDE}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{349C0469-ACDD-49DF-9B3E-0D82E7C7DC4D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{41226591-6F7A-4082-B63A-67FE4A0CF7A6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55D69CD1-6715-4C40-BF05-9519AC4DC6E6}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66C8FD57-54C4-4D4F-BC95-DCCC763B410A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{717BAE33-7061-4279-8AE5-6C13BC8AF3F9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{84F06F7A-F811-48D7-8B34-3F4145183D8F}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{88F6D55F-AA3F-4003-BE69-4AC1998D6492}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8DBCDED5-08AD-41A2-9BBC-235D84F4FE06}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A0F66203-1A86-4812-9603-A57E09A4D7A3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{BC39D1B3-4471-41C1-AACA-E097FAF4B7AA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DEB85542-1311-4EC6-8A32-5372EB27FC94}
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\SoftonicToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\InstallIQ
Schlüssel Gelöscht : HKLM\SOFTWARE\Softonic
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Softonic
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Installer\UserData\S-1-5-18\Components\08121C32A9C319F4CB0C11FF059552A4
***** [ Browser ] *****
-\\ Internet Explorer v11.0.9600.17239
Einstellung Wiederhergestellt : HKCU\Software\Microsoft\Internet Explorer\Main [Start Page]
Einstellung Wiederhergestellt : HKLM\SOFTWARE\Microsoft\Internet Explorer\AboutURls [Tabs]
-\\ Mozilla Firefox v31.0 (x86 de)
[ Datei : C:\Users\Ghost\AppData\Roaming\Mozilla\Firefox\Profiles\ye5tjacp.default\prefs.js ]
Zeile gelöscht : user_pref("extensions.Softonic.admin", false);
Zeile gelöscht : user_pref("extensions.Softonic.aflt", "OC");
Zeile gelöscht : user_pref("extensions.Softonic.appId", "{7ABBFE1C-E485-44AA-8F36-353751B4124D}");
Zeile gelöscht : user_pref("extensions.Softonic.autoRvrt", "false");
Zeile gelöscht : user_pref("extensions.Softonic.cntry", "DE");
Zeile gelöscht : user_pref("extensions.Softonic.dfltLng", "de");
Zeile gelöscht : user_pref("extensions.Softonic.dfltSrch", true);
Zeile gelöscht : user_pref("extensions.Softonic.dnsErr", true);
Zeile gelöscht : user_pref("extensions.Softonic.dpkLst", "3654782829,1334533236,1121012847,231756876,1895130307,603719297,4288797614,3754950497,426401714,3046281807,752626116,1657571787,3224935090,2597085128,182856413[...]
Zeile gelöscht : user_pref("extensions.Softonic.excTlbr", false);
Zeile gelöscht : user_pref("extensions.Softonic.ffxUnstlRst", false);
Zeile gelöscht : user_pref("extensions.Softonic.hdrMd5", "");
Zeile gelöscht : user_pref("extensions.Softonic.hmpg", true);
Zeile gelöscht : user_pref("extensions.Softonic.hmpgUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=ac1f85d00000000000006cf04972bb0d");
Zeile gelöscht : user_pref("extensions.Softonic.id", "ac1f85d00000000000006cf04972bb0d");
Zeile gelöscht : user_pref("extensions.Softonic.instlDay", "16026");
Zeile gelöscht : user_pref("extensions.Softonic.instlRef", "MOY00621");
Zeile gelöscht : user_pref("extensions.Softonic.lastB", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=13&cc=&mi=ac1f85d00000000000006cf04972bb0d");
Zeile gelöscht : user_pref("extensions.Softonic.lastVrsnTs", "");
Zeile gelöscht : user_pref("extensions.Softonic.newTab", true);
Zeile gelöscht : user_pref("extensions.Softonic.newTabUrl", "hxxp://search.softonic.com/MOY00621/tb_v1/?SearchSource=15&cc=&mi=ac1f85d00000000000006cf04972bb0d");
Zeile gelöscht : user_pref("extensions.Softonic.pnu_base", "{\"newVrsn\":\"229\",\"lastVrsn\":\"229\",\"vrsnLoad\":\"\",\"showMsg\":\"false\",\"showSilent\":\"false\",\"msgTs\":0,\"lstMsgTs\":\"0\"}");
Zeile gelöscht : user_pref("extensions.Softonic.prdct", "Softonic");
Zeile gelöscht : user_pref("extensions.Softonic.prtnrId", "softonic");
Zeile gelöscht : user_pref("extensions.Softonic.rvrt", "false");
Zeile gelöscht : user_pref("extensions.Softonic.sg", "{smplGrp}");
Zeile gelöscht : user_pref("extensions.Softonic.smplGrp", "none");
Zeile gelöscht : user_pref("extensions.Softonic.srchPrvdr", "Search the web (Softonic)");
Zeile gelöscht : user_pref("extensions.Softonic.storage\\mpvfloatingwindmutex", "Sun Nov 17 2013 17:00:03 GMT+0100");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrId", "opencandy2013");
Zeile gelöscht : user_pref("extensions.Softonic.tlbrSrchUrl", "hxxp://search.softonic.com/MOY00621/tb_v1?SearchSource=1&cc=&mi=ac1f85d00000000000006cf04972bb0d&q=");
Zeile gelöscht : user_pref("extensions.Softonic.vrsn", "1.8.21.14");
Zeile gelöscht : user_pref("extensions.Softonic.vrsnTs", "1.8.21.142:07:20");
Zeile gelöscht : user_pref("extensions.Softonic.vrsni", "1.8.21.14");
-\\ Google Chrome v
*************************
AdwCleaner[R0].txt - [12114 octets] - [30/08/2014 01:23:15]
AdwCleaner[S0].txt - [11636 octets] - [30/08/2014 01:24:32]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [11697 octets] ##########
Code:
ATTFilter OTL Extras logfile created on: 30.08.2014 02:12:39 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ghost\Downloads
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17239)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,50 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 54,74% Memory free
3,69 Gb Paging File | 1,64 Gb Available in Paging File | 44,37% Paging File free
Paging file location(s): c:\pagefile.sys 200 1024 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 111,69 Gb Total Space | 23,09 Gb Free Space | 20,67% Space Free | Partition Type: NTFS
Drive D: | 195,31 Gb Total Space | 23,38 Gb Free Space | 11,97% Space Free | Partition Type: NTFS
Drive E: | 736,20 Gb Total Space | 16,53 Gb Free Space | 2,25% Space Free | Partition Type: NTFS
Drive F: | 5,12 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: GHOST-PC | User Name: Ghost | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0EB5F642-B834-42C6-B3DD-17B5F58803BF}" = rport=139 | protocol=6 | dir=out | app=system |
"{1114943D-7038-482D-8A6F-250A7D4AA591}" = rport=137 | protocol=17 | dir=out | app=system |
"{18F63DDF-A8CE-4D15-A4C4-03365AC6B260}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{1BC177C3-414A-4047-96F6-611889895F90}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1F612299-6C53-4DF3-9B02-6D9CB9F54A84}" = lport=137 | protocol=17 | dir=in | app=system |
"{26087584-9788-45F5-8714-19E76B19EC19}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{292EB93A-411E-47FE-B4AE-1F843B253F5D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2B535559-62AE-4EAA-95FE-700AAC665EBB}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2E3E07C9-A2FE-4838-8F8F-0A7494190093}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{506F9F68-4D17-4A23-A2AD-EA4F404C5134}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{58448B4C-76D8-43F4-A0D9-865B4E525E67}" = lport=138 | protocol=17 | dir=in | app=system |
"{60E00684-084E-4159-AD6B-ABF3EBBCFA51}" = rport=10243 | protocol=6 | dir=out | app=system |
"{64C2B7CE-C9D0-485B-8925-E4CF79CC0D17}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{66AC5B41-916E-4C41-9B37-E803FD6BE033}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6BEB2501-527E-47EA-A177-F8EF9335AE54}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{6DF3C1A3-DA03-44E8-A1F7-7D095172E8C1}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{70429967-E4A4-4956-86AF-D10FFB935D88}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{76B564EE-79F4-495B-BC8F-96AE8D6FA789}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{81A2510F-D1FE-41F2-A456-7EB56B402869}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{8A095444-14B3-4070-ABCE-99E6C4F89602}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{8F54196C-8A98-4C05-8B48-F10B01B049F4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A80EA605-EAA3-4D4C-AFD1-ED86AA56B209}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B53C8FC2-7834-4BE1-A1E4-4BED49DA8A77}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B932A622-C666-4A50-949F-660F51AC6765}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{B9F4146E-F98E-4587-B9C6-CC92CB468517}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{CB9E6951-AFDA-4C28-94C3-73063C319653}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{D23B8D8D-38AD-4D90-A873-A451446D5ADD}" = lport=445 | protocol=6 | dir=in | app=system |
"{D6E414BB-C41F-4B33-BD1A-BF2D543180FB}" = rport=445 | protocol=6 | dir=out | app=system |
"{DEC456D8-9DE0-46E4-8153-BA5E5D9D9EFB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{DFE0779A-AFF4-45A7-A328-286FBF9223DE}" = lport=139 | protocol=6 | dir=in | app=system |
"{EE309939-3304-48C4-824C-24A6B170E86B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F877A10A-484B-4532-9218-40B3F0BEA88F}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FA351345-1A8E-4DA3-A62D-FF6BCAD6A3F1}" = rport=138 | protocol=17 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0017E3A8-3674-4374-AF26-694242F963B0}" = protocol=6 | dir=in | app=c:\users\ghost\appdata\roaming\icqm\icq.exe |
"{0670E3D7-7D61-4FC6-B850-75FC5AA6B8BF}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 1942\bf1942.exe |
"{0D7568A7-197B-4281-8FB7-C32E9994495F}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{140376AB-7748-4070-95A3-978EBB264085}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{149A42DB-AAB3-46BE-82F3-AC87F9585EFD}" = protocol=17 | dir=in | app=e:\steam\bin\steamwebhelper.exe |
"{155B6E1F-64B5-4069-B7E5-03869D5FBF17}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{16DC99EA-C6A9-4893-A8DF-4EECD7D2263F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{1882D0A9-1E72-4B0E-9968-59444E86C6A2}" = protocol=6 | dir=in | app=e:\steam\bin\steamwebhelper.exe |
"{1A6A674B-567A-4978-9A85-927ADB0DE35E}" = protocol=6 | dir=in | app=e:\steam\steam.exe |
"{332CC556-2F38-4C77-A87D-27C203BD83E5}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{37D5D284-55E8-4FC3-A592-8ABCFD9E2D07}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\fistful of frags\sdk\hl2.exe |
"{3B63E405-45EA-41F4-9CB5-945F222C0278}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{3BAEAE9D-E96C-40DD-8889-5DD15E6E5CB8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3C07E9F5-B767-41B9-B51E-CE49A5745BAA}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{409AE43A-3857-4821-97A6-674C0493111A}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{448B6FBB-DDE1-4D9F-AB17-9530E7844CA9}" = protocol=17 | dir=in | app=c:\users\ghost\appdata\roaming\icqm\icq.exe |
"{44C6BE9A-11DE-4F20-BD8A-DEB35FE1447A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{4E251D65-D987-4C2F-8975-4C14F8A1E117}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\counter-strike source\hl2.exe |
"{51AF3B07-1D55-4CF2-98F0-8604E603173A}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{526A0938-DB57-4A06-971E-F3E9A158DC73}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{52C4B025-4E18-4831-A245-AB0D7DCDEDDE}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\loadout\loadout.exe |
"{6283BCC9-9B02-4047-A5EB-570998FCEDAB}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{65D788D7-DBC0-448B-8BCF-5BBDBC917A55}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{683B951B-0ADC-4F4A-A0CF-4EAE20741293}" = protocol=6 | dir=out | app=system |
"{68F10D75-5119-4C7A-B5D0-2F979354CA44}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{71D84DC6-D203-4E4B-9A46-33EE801665EE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{77E5B756-FADC-4AAB-B774-438D876F2472}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{792C23C7-5AC3-41B5-B61A-961510E3B583}" = protocol=17 | dir=in | app=c:\windows\syswow64\dlcfcoms.exe |
"{888DACFB-FB3C-4031-910A-D5E22D165794}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\fistful of frags\sdk\hl2.exe |
"{8FC7272B-EF11-4679-941F-00923F0B80A3}" = protocol=6 | dir=in | app=c:\windows\syswow64\dlcfcoms.exe |
"{99D4AB99-6A25-49D6-B443-1F53D58CE4B7}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 1942\bf1942.exe |
"{9C65F827-27E5-496E-BEFA-EB99EE883E72}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{B778CF3B-5439-48A0-B948-A4DA873DF95B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BCA0F1C9-DD63-4B65-8085-0657CCDC503E}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\team fortress 2\hl2.exe |
"{D27E0F06-B0FB-4DCF-B848-8307A6DD5EA7}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\counter-strike global offensive\csgo.exe |
"{E2161B69-EAC4-489E-89BE-D9C95B0503E6}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\counter-strike source\hl2.exe |
"{EC2477EA-D334-4B17-975F-ACD0DBA927C4}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\team fortress 2\hl2.exe |
"{ECC7DDA8-A5DF-4830-BD82-01E9E6FCAA8E}" = protocol=17 | dir=in | app=e:\steam\steam.exe |
"{EF41717C-E42D-4CF6-80FE-28F67AD8E1CA}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F3523A7A-6DBD-435B-A162-287B5D3AF2EC}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\loadout\loadout.exe |
"{F537C688-A121-440D-A5F3-BA43C638A8BC}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{04438EF6-8E71-4A7A-A5B4-D6535D83B157}C:\users\ghost\desktop\far cry 2\bin\farcry2.exe" = protocol=6 | dir=in | app=c:\users\ghost\desktop\far cry 2\bin\farcry2.exe |
"TCP Query User{1E41B190-489B-4A08-8370-13D004033C4E}E:\spiele\cs halflife\hl2.exe" = protocol=6 | dir=in | app=e:\spiele\cs halflife\hl2.exe |
"TCP Query User{25F2C936-E714-4F8F-8ED4-922EFEDAD9C4}E:\spiele\warcraft 3\war3.exe" = protocol=6 | dir=in | app=e:\spiele\warcraft 3\war3.exe |
"TCP Query User{55BC37D7-2C80-4AC3-80C5-D4CA81C87822}E:\spiele\cod\codmp.exe" = protocol=6 | dir=in | app=e:\spiele\cod\codmp.exe |
"TCP Query User{5DADDD61-A547-419C-8A6C-6FDDF0885DF8}E:\spiele\flatout2\flatout2.exe" = protocol=6 | dir=in | app=e:\spiele\flatout2\flatout2.exe |
"TCP Query User{891CAA7B-33A5-4135-B24D-10DCE9B8059E}E:\spiele\ut portable\unrealtournament.exe" = protocol=6 | dir=in | app=e:\spiele\ut portable\unrealtournament.exe |
"TCP Query User{9C275F60-5211-4CB8-BA1D-2E6886104A07}D:\chivalry medieval warfare\binaries\win32\udk.exe" = protocol=6 | dir=in | app=d:\chivalry medieval warfare\binaries\win32\udk.exe |
"TCP Query User{D3F6663D-F30D-47D0-87EE-6C369CB118EA}C:\users\ghost\documents\candisoft\load.exe" = protocol=6 | dir=in | app=c:\users\ghost\documents\candisoft\load.exe |
"TCP Query User{D5A98C9B-1CDC-4720-AD74-20966D7A113C}C:\users\ghost\desktop\age of empires_moritz\empires2.exe" = protocol=6 | dir=in | app=c:\users\ghost\desktop\age of empires_moritz\empires2.exe |
"TCP Query User{F57F97E0-4F95-491C-A100-01DE99712AAF}C:\users\ghost\desktop\blubvolley\blubvolley.exe" = protocol=6 | dir=in | app=c:\users\ghost\desktop\blubvolley\blubvolley.exe |
"UDP Query User{0D08F39C-2D8C-4A3F-A41E-3A9B28948D8A}C:\users\ghost\desktop\far cry 2\bin\farcry2.exe" = protocol=17 | dir=in | app=c:\users\ghost\desktop\far cry 2\bin\farcry2.exe |
"UDP Query User{1AAFB1B4-3C8E-4F0F-95EC-1912C23FE962}C:\users\ghost\desktop\blubvolley\blubvolley.exe" = protocol=17 | dir=in | app=c:\users\ghost\desktop\blubvolley\blubvolley.exe |
"UDP Query User{20D7806A-A265-4E44-9258-8CA7CD0DBE8F}E:\spiele\cod\codmp.exe" = protocol=17 | dir=in | app=e:\spiele\cod\codmp.exe |
"UDP Query User{3994FF8F-8A45-4A7A-AB05-23FDF0065721}E:\spiele\cs halflife\hl2.exe" = protocol=17 | dir=in | app=e:\spiele\cs halflife\hl2.exe |
"UDP Query User{3D755F86-2A78-4977-9738-A00D84386EAD}C:\users\ghost\documents\candisoft\load.exe" = protocol=17 | dir=in | app=c:\users\ghost\documents\candisoft\load.exe |
"UDP Query User{44393A86-574A-499C-9DC0-A54E9E3F259C}C:\users\ghost\desktop\age of empires_moritz\empires2.exe" = protocol=17 | dir=in | app=c:\users\ghost\desktop\age of empires_moritz\empires2.exe |
"UDP Query User{463F233F-AC30-4D18-8023-2F1457D51D81}E:\spiele\ut portable\unrealtournament.exe" = protocol=17 | dir=in | app=e:\spiele\ut portable\unrealtournament.exe |
"UDP Query User{6570F855-4E81-4BAF-9FCA-7D277C14B042}E:\spiele\flatout2\flatout2.exe" = protocol=17 | dir=in | app=e:\spiele\flatout2\flatout2.exe |
"UDP Query User{711DF2C6-4636-4638-82B9-7DACBFE951E6}D:\chivalry medieval warfare\binaries\win32\udk.exe" = protocol=17 | dir=in | app=d:\chivalry medieval warfare\binaries\win32\udk.exe |
"UDP Query User{C0195CAF-3649-46D6-B08D-7E47C3ED9BAD}E:\spiele\warcraft 3\war3.exe" = protocol=17 | dir=in | app=e:\spiele\warcraft 3\war3.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{034B6AC8-DCF6-585B-2AFD-3FF0D4A559BB}" = AMD Accelerated Video Transcoding
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{086D343F-8E78-4AFC-81AC-D6D414AFD8AC}_is1" = Core Temp 1.0 RC6
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{30921AC4-6875-F7DF-B48B-2BB68C000BB6}" = AMD Media Foundation Decoders
"{37FCE154-7F59-74F0-3A35-BF503CEB230B}" = AMD Catalyst Install Manager
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6C676266-91E4-DC71-E661-13494AC29A3E}" = ccc-utility64
"{7DEBE4EB-6B40-3766-BB35-5CBBC385DA37}" = Microsoft .NET Framework 4.5.1
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031" = Microsoft .NET Framework 4.5.1 (Deutsch)
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.1
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 311.06
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.11.3
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C513739C-5F16-37B5-9ACF-99925FF1C1F3}" = Microsoft .NET Framework 4.5.1 (DEU)
"{CB1032F6-1108-30C7-01C9-C0C132D13BEE}" = AMD Fuel
"{CE52672C-A0E9-4450-8875-88A221D5CD50}" = Windows Live ID Sign-in Assistant
"{D3DE00DF-4EFB-8013-3E93-D735E69CAF6A}" = AMD Drag and Drop Transcoding
"{E9FA781F-3E80-4399-825A-AD3E11C28C77}" = MSVCRT110_amd64
"CCleaner" = CCleaner
"GIMP-2_is1" = GIMP 2.8.10
"REAPER" = REAPER (x64)
"Sandboxie" = Sandboxie 3.66 (64-bit)
"VLC media player" = VLC media player 2.1.4
"WinRAR archiver" = WinRAR 5.00 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00F14E5B-E07A-2A1E-6788-580773CE1486}" = CCC Help English
"{00F9DB8C-65D7-4D47-AB5F-F698EE38580D}" = Windows Live UX Platform
"{064A929A-4DE8-40CF-A901-BD40C14E4D25}" = PDF Architect
"{07AAB66E-4718-422D-9218-4AFB3C922A71}" = Photo Gallery
"{0A036215-0A8D-6FBE-7EA3-7AED4F9E162A}" = CCC Help Turkish
"{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}" = OpenOffice 4.0.1
"{10AE4FDC-32F9-4E56-8EE1-10629DD11C4E}" = Avira
"{15A05AAA-37E7-D516-5BE9-C960C2170403}" = CCC Help Czech
"{1D6432B4-E24D-405E-A4AB-D7E6D088CBC9}" = Windows Live Photo Common
"{21E9850E-58C2-FA88-D5AD-B64D253B8F82}" = CCC Help Thai
"{25A7270E-1B63-DFD1-ACBC-88852A305398}" = CCC Help Chinese Traditional
"{28164BD8-81EA-639A-85E9-E659E3EE6DA7}" = Catalyst Control Center InstallProxy
"{29AE3F9F-7158-4ca7-B1ED-28A73ECDB215}_is1" = Samsung Magician
"{2E69E784-F84A-9A18-7D8E-4EB8504EEE1E}" = CCC Help Danish
"{362614E4-9ABB-E7A7-CDDC-239AB168060A}" = CCC Help Japanese
"{41BF4A3B-D60A-4E92-883F-C88C8C157261}" = Fotogalerie
"{41C61308-6CFD-4D54-AB6A-7136ED08A18E}" = Windows Live Communications Platform
"{4745F6F8-09DA-CC39-EC19-0E8D764CF2B7}" = CCC Help Chinese Standard
"{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}" = Google Earth
"{4FA31DE2-B613-24BB-1738-B655C00B1C9D}" = CCC Help Hungarian
"{58771CF6-F212-CC4D-61B1-45CC70B6375C}" = CCC Help Dutch
"{5BE7BD06-512B-43bf-AD78-3BD2A5F5F7B3}" = Battlefield 1942™
"{659CB81C-B54E-4DF1-B618-F35777393A54}" = Windows Live Installer
"{66233218-CA57-4AB2-BA43-A97AA4635960}" = Windows Live Essentials
"{6D5CE5F1-CBB0-9ED4-1A1E-91DDCD6225FD}" = CCC Help Italian
"{707210B0-29F1-C550-BA96-6ECDA245CF24}" = CCC Help Spanish
"{70C91B91-61E8-4D06-86D6-A9DCC291983A}" = Movie Maker
"{812B956B-37AB-24B9-4527-78A6D3ECE7F8}" = CCC Help Korean
"{82809116-D1EE-443C-AE31-F19E709DDF7A}" = AMD USB Filter Driver
"{83293709-B863-0EF6-00DA-B026D486E8B5}" = CCC Help Polish
"{87DABDEA-47A4-4182-AA7C-2C90DAAE3117}" = Photo Common
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{88B2ABCF-9C00-47C1-8FC4-369B98845DD7}" = Catalyst Control Center - Branding
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{911904DE-EBB6-BC8E-D5BD-762B7DB42C46}" = CCC Help Greek
"{9903011B-5F1D-A2A1-8078-EE62B3324CCE}" = CCC Help Portuguese
"{9A7F1628-2126-34A5-852D-2B93328BCF3F}" = CCC Help German
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C27ADE1-EAFB-4BB7-9FE3-5DD9BA9A3DD2}" = Crashday
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.08) - Deutsch
"{AE6C422B-DADB-D547-411C-E9E56DF03D16}" = CCC Help Russian
"{B09567CC-E43F-10F1-752D-549AC7FB0C43}" = CCC Help Finnish
"{B158F76F-76AB-4115-A4F0-4C6EF6956093}_is1" = VirtualDubMOD 1.5.10.3 US
"{B170B91D-E8E3-A6A3-D129-D8E36FEA8A0B}" = CCC Help Norwegian
"{B2611F8A-EFE7-4E88-875D-19F0EFAE87E4}" = Windows Live PIMT Platform
"{BD96ABD3-D1D4-5513-6C60-11476D6DCFC5}" = Catalyst Control Center Localization All
"{C39C7876-4D21-8A38-0A42-B5C8858EC6C7}" = CCC Help French
"{CDC1AB00-01FF-4FC7-816A-16C67F0923C0}" = Windows Live SOXE
"{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"{D1893000-EA77-493C-8DDD-E262436E959B}" = Windows Live SOXE Definitions
"{D4236B82-213F-679E-09A2-9AEB5EF4CADC}" = Catalyst Control Center Graphics Previews Common
"{DADC7AB0-E554-4705-9F6A-83EA82ED708E}" = Realtek Ethernet Diagnostic Utility
"{DD67BE4B-7E62-4215-AFA3-F123A800A389}" = Movie Maker
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{e67154a7-9cc5-4167-b782-f3982bc6c70d}" = Avira
"{EBBD4FE6-91DA-C397-6D56-FE85DBF24FCF}" = AMD VISION Engine Control Center
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F7963BA0-EE1C-11D4-9FA5-00A0C9E6A342}" = Commandos 2: Men of Courage
"{FC071B45-4A5F-408F-92F8-4D9D693E866F}" = Windows Live UX Platform Language Pack
"{FCEFDA6B-63CD-BB17-B845-478A42E24D39}" = CCC Help Swedish
"Adobe Flash Player Plugin" = Adobe Flash Player 14 Plugin
"AIDA64 Extreme Edition_is1" = AIDA64 Extreme Edition v1.00
"Audacity_is1" = Audacity 2.0.5
"Avira AntiVir Desktop" = Avira Free Antivirus
"DAEMON Tools Ultra" = DAEMON Tools Ultra
"Dell Color Printer 725" = Dell Color Printer 725
"Easy-Shutdown" = Easy-Shutdown 1.3
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"Fraps" = Fraps (remove only)
"Free WebM Video Converter_is1" = Free WebM Video Converter version 5.0.45.716
"Hard Disk Sentinel_is1" = Hard Disk Sentinel PRO
"HD Tune Pro_is1" = HD Tune Pro 5.50
"InstallShield_{D0A05794-48C2-4424-A15A-9F20FCFDD374}" = Call of Duty(R) 2
"Mozilla Firefox 31.0 (x86 de)" = Mozilla Firefox 31.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PokerStars.eu" = PokerStars.eu
"Secure Eraser_is1" = Secure Eraser
"SpeedFan" = SpeedFan (remove only)
"Steam App 208090" = Loadout
"Steam App 240" = Counter-Strike: Source
"Steam App 265630" = Fistful of Frags
"Steam App 730" = Counter-Strike: Global Offensive
"TrueCrypt" = TrueCrypt
"WinLiveSuite" = Windows Live Essentials
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"ICQ" = ICQ 8.1 (build 6337)
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 19.08.2014 21:39:10 | Computer Name = Ghost-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x517f39a1 Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x6c8 Startzeit der fehlerhaften Anwendung: 0x01cfbbb6646116e9
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
c80e690d-280a-11e4-9997-6cf04972bb0d
Error - 21.08.2014 11:40:48 | Computer Name = Ghost-PC | Source = Application Hang | ID = 1002
Description = Programm firefox.exe, Version 31.0.0.5310 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1608 Startzeit:
01cfbd56348fc309 Endzeit: 5 Anwendungspfad: C:\Program Files (x86)\Mozilla Firefox\firefox.exe
Berichts-ID:
825abb0e-2949-11e4-81be-6cf04972bb0d
Error - 23.08.2014 03:29:46 | Computer Name = Ghost-PC | Source = .NET Runtime | ID = 0
Description =
Error - 23.08.2014 10:42:55 | Computer Name = Ghost-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x517f39a1 Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x6e8 Startzeit der fehlerhaften Anwendung: 0x01cfbc58be5f3514
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
c4233af9-2ad3-11e4-81be-6cf04972bb0d
Error - 26.08.2014 20:24:08 | Computer Name = Ghost-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x517f39a1 Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x6dc Startzeit der fehlerhaften Anwendung: 0x01cfbfa637bfe23d
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
752bc322-2d80-11e4-8a14-6cf04972bb0d
Error - 27.08.2014 13:39:42 | Computer Name = Ghost-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x517f39a1 Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x6dc Startzeit der fehlerhaften Anwendung: 0x01cfc1d5fa258817
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
201b827a-2e11-11e4-a127-6cf04972bb0d
Error - 28.08.2014 21:24:07 | Computer Name = Ghost-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x517f39a1 Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x6e0 Startzeit der fehlerhaften Anwendung: 0x01cfc29deac16b2c
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
2b508cc7-2f1b-11e4-9e38-6cf04972bb0d
Error - 29.08.2014 18:25:29 | Computer Name = Ghost-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x517f39a1 Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x698 Startzeit der fehlerhaften Anwendung: 0x01cfc38398f34faa
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
6187bb23-2fcb-11e4-a2c3-6cf04972bb0d
Error - 29.08.2014 19:24:56 | Computer Name = Ghost-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x517f39a1 Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x704 Startzeit der fehlerhaften Anwendung: 0x01cfc3dd3298d88c
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
af9ddbf0-2fd3-11e4-a2d7-6cf04972bb0d
Error - 29.08.2014 19:33:35 | Computer Name = Ghost-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Fuel.Service.exe, Version: 1.0.0.0,
Zeitstempel: 0x517f39a1 Name des fehlerhaften Moduls: Device.dll, Version: 4.1.0.0,
Zeitstempel: 0x4f55e10b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00000000000033c1
ID
des fehlerhaften Prozesses: 0x6f8 Startzeit der fehlerhaften Anwendung: 0x01cfc3e088e7e8e0
Pfad
der fehlerhaften Anwendung: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
Pfad
des fehlerhaften Moduls: C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Device.dll
Berichtskennung:
e4f88865-2fd4-11e4-ac43-6cf04972bb0d
[ System Events ]
Error - 01.02.2014 14:28:23 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 02.02.2014 08:12:40 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 02.02.2014 14:58:07 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7011
Description = Das Zeitlimit (30000 ms) wurde beim Warten auf eine Transaktionsrückmeldung
von Dienst lmhosts erreicht.
Error - 03.02.2014 02:00:03 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 03.02.2014 05:31:37 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 03.02.2014 20:48:29 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 04.02.2014 07:23:57 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 04.02.2014 19:59:21 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
Error - 05.02.2014 07:19:58 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
cdrom
Error - 05.02.2014 19:47:00 | Computer Name = Ghost-PC | Source = Service Control Manager | ID = 7034
Description = Dienst "AMD FUEL Service" wurde unerwartet beendet. Dies ist bereits
1 Mal passiert.
< End of report >
Code:
ATTFilter OTL logfile created on: 30.08.2014 02:12:39 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Ghost\Downloads 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.11.9600.17239) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,50 Gb Total Physical Memory | 1,92 Gb Available Physical Memory | 54,74% Memory free 3,69 Gb Paging File | 1,64 Gb Available in Paging File | 44,37% Paging File free Paging file location(s): c:\pagefile.sys 200 1024 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 111,69 Gb Total Space | 23,09 Gb Free Space | 20,67% Space Free | Partition Type: NTFS Drive D: | 195,31 Gb Total Space | 23,38 Gb Free Space | 11,97% Space Free | Partition Type: NTFS Drive E: | 736,20 Gb Total Space | 16,53 Gb Free Space | 2,25% Space Free | Partition Type: NTFS Drive F: | 5,12 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS Computer Name: GHOST-PC | User Name: Ghost | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2014.08.30 02:12:09 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Ghost\Downloads\OTL.exe PRC - [2014.08.29 14:25:11 | 001,868,976 | ---- | M] (Adobe Systems, Inc.) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_14_0_0_179.exe PRC - [2014.08.05 10:38:38 | 000,430,160 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe PRC - [2014.08.05 10:38:21 | 000,751,184 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe PRC - [2014.08.05 10:38:21 | 000,430,160 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe PRC - [2014.08.04 14:20:42 | 000,161,584 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe PRC - [2014.08.04 14:20:40 | 000,149,296 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe PRC - [2014.07.23 19:26:18 | 000,275,568 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe PRC - [2014.06.22 17:27:16 | 000,230,792 | ---- | M] (Google Inc.) -- C:\Program Files (x86)\Google\Update\1.3.24.15\GoogleCrashHandler.exe PRC - [2013.12.21 08:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2013.11.14 10:35:42 | 000,723,192 | ---- | M] (Disc Soft Ltd) -- C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe PRC - [2013.09.18 15:54:33 | 028,698,984 | ---- | M] (ICQ) -- C:\Users\Ghost\AppData\Roaming\ICQM\icq.exe PRC - [2013.05.10 05:48:09 | 000,164,864 | ---- | M] (Microsoft Corporation) -- C:\Program Files (x86)\Windows Media Player\wmplayer.exe PRC - [2013.04.08 19:44:12 | 001,320,496 | ---- | M] (pdfforge GmbH) -- C:\Program Files (x86)\PDF Architect\HelperService.exe PRC - [2013.04.08 19:43:36 | 000,799,280 | ---- | M] (pdfforge GmbH) -- C:\Program Files (x86)\PDF Architect\ConversionService.exe PRC - [2013.02.26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe PRC - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe ========== Modules (No Company Name) ========== MOD - [2014.08.29 14:25:11 | 017,048,240 | ---- | M] () -- C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll MOD - [2014.08.04 14:20:40 | 000,139,056 | ---- | M] () -- C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll MOD - [2014.08.04 14:20:34 | 000,052,472 | ---- | M] () -- C:\Users\Ghost\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll MOD - [2014.07.23 19:26:17 | 003,800,688 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll MOD - [2014.03.01 06:46:27 | 000,260,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsForm0b574481#\1ab52f8951c2ab97592ec25830dd5165\WindowsFormsIntegration.ni.dll MOD - [2014.03.01 06:45:59 | 002,997,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.IdentityModel\1e5e19d119e04b93da3d45153abd60fd\System.IdentityModel.ni.dll MOD - [2014.03.01 06:45:57 | 019,693,056 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.ServiceModel\24bf0c88c0465485f4b842df043b3f45\System.ServiceModel.ni.dll MOD - [2014.03.01 06:45:25 | 000,018,944 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio49d6fefe#\47e7fc401facd4a5d3f2237f16948f36\PresentationFramework-SystemXml.ni.dll MOD - [2014.03.01 06:45:24 | 000,016,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio84a7b877#\af02d03484578dbc357d1df8d1b6fd01\PresentationFramework-SystemData.ni.dll MOD - [2014.02.28 14:18:24 | 018,813,440 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio5ae0f00f#\a4b45c44490c75bc2fb22780e7ef087d\PresentationFramework.ni.dll MOD - [2014.02.28 14:18:22 | 000,223,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Serv759bfb78#\f4354d6580fbb745c0c8acba382a7b84\System.ServiceProcess.ni.dll MOD - [2014.02.28 14:18:20 | 001,889,792 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\3fe705796c6a41d4889d9001d1c56af8\System.Xaml.ni.dll MOD - [2014.02.28 14:18:19 | 012,894,208 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\f4f6ee0df2aa4189bf36e6335cb92761\System.Windows.Forms.ni.dll MOD - [2014.02.28 14:18:16 | 007,409,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data\6bbed231aec6fd82547e09474da0b2f9\System.Data.ni.dll MOD - [2014.02.28 14:18:14 | 011,025,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\a74542efbeb46445949a39026c501132\PresentationCore.ni.dll MOD - [2014.02.28 14:18:13 | 002,542,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Data.Linq\7e73e63cf4b8efdf41900b9576489e61\System.Data.Linq.ni.dll MOD - [2014.02.28 14:18:12 | 002,825,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runteb92aa12#\f6d7bb59f318c130d68816a89335d05e\System.Runtime.Serialization.ni.dll MOD - [2014.02.28 14:18:11 | 001,644,544 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\5cd2aee5e7c07227c694d89219688ab3\System.Drawing.ni.dll MOD - [2014.02.28 14:18:10 | 000,806,400 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Servd1dec626#\34b53ecafa1d7ccc7ca961d722b5d983\System.ServiceModel.Internals.ni.dll MOD - [2014.02.28 14:18:10 | 000,122,880 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\SMDiagnostics\78652b7fa68ee058bff6a118c657f565\SMDiagnostics.ni.dll MOD - [2014.02.28 14:18:08 | 006,990,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\dce99d8de14d8a015313db98c72552ee\System.Core.ni.dll MOD - [2014.02.28 14:18:07 | 007,662,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\bada32953bb6b16a53d653eae23d78dc\System.Xml.ni.dll MOD - [2014.02.28 14:18:06 | 003,950,080 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\acf97bfe2a931d4a47253b26b7218991\WindowsBase.ni.dll MOD - [2014.02.28 14:18:05 | 000,470,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\Presentatio1c9175f8#\75f8bc4cf08030c4a53b6d5e0ae20046\PresentationFramework.Aero.ni.dll MOD - [2014.02.28 14:18:04 | 000,976,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\bbc48ec4245e502ae19b0601d3799c9e\System.Configuration.ni.dll MOD - [2014.02.28 14:18:03 | 010,060,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\ff26cc03e6d57d8abd13b990332e67c6\System.ni.dll MOD - [2014.02.28 14:17:59 | 000,147,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Numerics\4c8a153aa66fcd62db6fff269a2ef2b4\System.Numerics.ni.dll MOD - [2014.02.28 14:17:58 | 016,953,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\ce5f61c5754789df97be8dc991c47d07\mscorlib.ni.dll MOD - [2013.09.18 15:54:33 | 000,851,456 | ---- | M] () -- C:\Users\Ghost\AppData\Roaming\ICQM\ICQ\dll\YLUSBTEL.dll ========== Services (SafeList) ========== SRV:64bit: - [2014.07.25 15:00:25 | 000,111,616 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\IEEtwCollector.exe -- (IEEtwCollectorService) SRV:64bit: - [2013.04.29 23:25:22 | 000,361,984 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service) SRV:64bit: - [2012.11.16 22:44:58 | 000,238,080 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility) SRV - [2014.08.29 14:25:11 | 000,262,320 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc) SRV - [2014.08.14 00:30:50 | 000,833,728 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2014.08.05 10:38:38 | 000,430,160 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2014.08.05 10:38:24 | 001,021,008 | ---- | M] (Avira Operations GmbH & Co. KG) [Disabled | Stopped] -- C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2014.08.05 10:38:21 | 000,430,160 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2014.08.04 14:20:40 | 000,149,296 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe -- (Avira.OE.ServiceHost) SRV - [2014.07.23 19:26:17 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance) SRV - [2014.03.21 00:49:18 | 000,067,224 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2013.12.21 08:04:16 | 000,065,432 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2013.11.14 10:35:42 | 000,723,192 | ---- | M] (Disc Soft Ltd) [On_Demand | Running] -- C:\Program Files (x86)\DAEMON Tools Ultra\DiscSoftBusService.exe -- (Disc Soft Bus Service) SRV - [2013.09.11 22:21:54 | 000,105,144 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2013.04.08 19:44:12 | 001,320,496 | ---- | M] (pdfforge GmbH) [Auto | Running] -- C:\Program Files (x86)\PDF Architect\HelperService.exe -- (PDF Architect Helper Service) SRV - [2013.04.08 19:43:36 | 000,799,280 | ---- | M] (pdfforge GmbH) [Auto | Running] -- C:\Program Files (x86)\PDF Architect\ConversionService.exe -- (PDF Architect Service) SRV - [2013.02.26 00:32:22 | 001,260,320 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService) SRV - [2013.01.18 08:14:20 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2012.07.17 15:14:44 | 002,292,480 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2012.03.22 12:14:30 | 000,097,552 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Programme\Sandboxie\SbieSvc.exe -- (SbieSvc) ========== Driver Services (SafeList) ========== DRV:64bit: - [2014.07.01 15:45:43 | 000,117,712 | ---- | M] (Avira Operations GmbH & Co. KG) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2014.06.03 19:44:24 | 000,130,584 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2013.11.17 03:07:20 | 000,029,696 | ---- | M] (Disc Soft Ltd) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\dtscsibus.sys -- (dtscsibus) DRV:64bit: - [2013.10.13 19:31:41 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\truecrypt.sys -- (truecrypt) DRV:64bit: - [2013.10.07 13:17:10 | 000,028,600 | ---- | M] (Avira Operations GmbH & Co. KG) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr) DRV:64bit: - [2012.11.16 23:08:32 | 011,922,944 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag) DRV:64bit: - [2012.11.16 23:08:32 | 011,922,944 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag) DRV:64bit: - [2012.11.16 21:39:12 | 000,359,936 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap) DRV:64bit: - [2012.05.14 08:12:30 | 000,096,896 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService) DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec) DRV:64bit: - [2011.09.29 11:30:34 | 000,646,248 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167) DRV:64bit: - [2011.09.16 09:12:58 | 000,032,360 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtVlan620.sys -- (RTVLANPT) DRV:64bit: - [2011.08.17 11:04:34 | 000,171,008 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsux64.sys -- (nmwcdnsux64) DRV:64bit: - [2011.08.17 10:04:28 | 000,012,800 | ---- | M] (Nokia) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nmwcdnsucx64.sys -- (nmwcdnsucx64) DRV:64bit: - [2011.06.15 15:11:20 | 000,058,472 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (TEAM) DRV:64bit: - [2011.06.15 15:11:20 | 000,058,472 | ---- | M] (Realtek Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\RtTeam60.sys -- (RTTEAMPT) DRV:64bit: - [2011.06.15 15:11:20 | 000,027,136 | ---- | M] (Realtek ) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\RtNdPt60.sys -- (RtNdPt60) DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata) DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata) DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD) DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64) DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs) DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2) DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor) DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv) DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv) DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a) DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir) DRV:64bit: - [2009.05.04 18:30:28 | 000,016,440 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\AtiPcie.sys -- (AtiPcie) DRV:64bit: - [2009.04.03 06:39:58 | 000,034,872 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\usbfilter.sys -- (usbfilter) DRV - [2012.03.22 12:14:28 | 000,163,480 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Programme\Sandboxie\SbieDrv.sys -- (SbieDrv) DRV - [2012.03.05 16:04:30 | 000,053,888 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\amd64\aoddriver2.sys -- (AODDriver4.1) DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.giga.de/software/ [binary data] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 1E D4 3D 9C 6E B4 CE 01 [binary data] IE - HKCU\..\SearchScopes,DefaultScope = IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{B7940154-5736-4D69-AD15-CF22E78A6FF8}: "URL" = hxxp://search.softonic.com/MOY00621/tb_v1?q={searchTerms}&SearchSource=4&cc=&mi=ac1f85d00000000000006cf04972bb0d&r=149 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Ecosia" FF - prefs.js..browser.search.selectedEngine: "Ecosia" FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "www.ecosia.de | de.gopro.com/daily-giveaway" FF - prefs.js..extensions.enabledAddons: %7B73a6fe31-595d-460b-a920-fcc0f8843232%7D:2.6.8.38 FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:31.0 FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_14_0_0_179.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.7: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.1: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.2: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.1.4: C:\Program Files\VideoLAN\VLC\npvlc.dll (VideoLAN) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_14_0_0_179.dll () FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3528.0331: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.24.15\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\FFPDFArchitectConverter@pdfarchitect.com: C:\Program Files (x86)\PDF Architect\FFPDFArchitectExt [2013.11.15 00:53:26 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 31.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 31.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 31.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 31.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.09.18 14:59:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\Extensions [2014.08.30 01:02:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\ye5tjacp.default\extensions [2014.08.28 18:58:31 | 000,000,000 | ---D | M] (Avira Browser Safety) -- C:\Users\Ghost\AppData\Roaming\mozilla\Firefox\Profiles\ye5tjacp.default\extensions\abs@avira.com [2014.08.30 01:02:11 | 000,539,715 | ---- | M] () (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\firefox\profiles\ye5tjacp.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi [2014.07.23 18:31:48 | 000,967,685 | ---- | M] () (No name found) -- C:\Users\Ghost\AppData\Roaming\mozilla\firefox\profiles\ye5tjacp.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2013.09.18 15:14:31 | 000,002,434 | ---- | M] () -- C:\Users\Ghost\AppData\Roaming\mozilla\firefox\profiles\ye5tjacp.default\searchplugins\ecosia.xml [2014.07.23 19:26:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions [2014.07.23 19:26:18 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd} O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (PDF Architect Helper) - {3A2D5EBA-F86D-4BD3-A177-019765996711} - C:\Program Files (x86)\PDF Architect\PDFIEHelper.dll (pdfforge GmbH) O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor) O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [Avira Systray] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKCU..\Run: [DAEMON Tools Ultra Agent] C:\Program Files (x86)\DAEMON Tools Ultra\DTAgent.exe (Disc Soft Ltd) O4 - HKCU..\Run: [icq] C:\Users\Ghost\AppData\Roaming\ICQM\icq.exe (ICQ) O4 - Startup: C:\Users\Ghost\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\AIDA64 Extreme Edition.lnk = C:\Program Files (x86)\FinalWire\AIDA64 Extreme Edition\aida64.exe (FinalWire Ltd.) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E38948E7-B227-4A47-8B8D-0DE78583355F}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2011.10.06 17:01:16 | 000,000,044 | R--- | M] () - F:\autorun.inf -- [ CDFS ] O33 - MountPoints2\{4b039559-205d-11e3-a4eb-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{4b039559-205d-11e3-a4eb-806e6f6e6963}\Shell\AutoRun\command - "" = D:\Setup\rsrc\autorun.exe O33 - MountPoints2\{4b039559-205d-11e3-a4eb-806e6f6e6963}\Shell\dinstall\command - "" = D:\Directx\dxsetup.exe O33 - MountPoints2\{6f2b6b1b-2b99-11e4-8a14-6cf04972bb0d}\Shell - "" = AutoRun O33 - MountPoints2\{6f2b6b1b-2b99-11e4-8a14-6cf04972bb0d}\Shell\AutoRun\command - "" = J:\autorun.exe O33 - MountPoints2\{8112342e-9e1e-11e3-84c4-6cf04972bb0d}\Shell - "" = AutoRun O33 - MountPoints2\{8112342e-9e1e-11e3-84c4-6cf04972bb0d}\Shell\AutoRun\command - "" = F:\Setup.exe -- [2011.10.06 17:01:18 | 000,355,920 | R--- | M] (Valve Corporation) O33 - MountPoints2\{81123433-9e1e-11e3-84c4-6cf04972bb0d}\Shell - "" = AutoRun O33 - MountPoints2\{81123433-9e1e-11e3-84c4-6cf04972bb0d}\Shell\AutoRun\command - "" = I:\SETUP.EXE O33 - MountPoints2\{81123438-9e1e-11e3-84c4-6cf04972bb0d}\Shell - "" = AutoRun O33 - MountPoints2\{81123438-9e1e-11e3-84c4-6cf04972bb0d}\Shell\AutoRun\command - "" = L:\noautorun.exe O33 - MountPoints2\{d7af9356-4f07-11e3-92e2-6cf04972bb0d}\Shell - "" = AutoRun O33 - MountPoints2\{d7af9356-4f07-11e3-92e2-6cf04972bb0d}\Shell\AutoRun\command - "" = F:\Setup.exe -- [2011.10.06 17:01:18 | 000,355,920 | R--- | M] (Valve Corporation) O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2014.08.30 01:23:36 | 000,536,576 | ---- | C] (SQLite Development Team) -- C:\Windows\SysWow64\sqlite3.dll [2014.08.30 01:22:42 | 000,000,000 | ---D | C] -- C:\AdwCleaner [2014.08.30 01:08:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2014.08.30 01:07:49 | 000,128,728 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys [2014.08.30 01:07:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable) [2014.08.30 01:07:24 | 000,092,888 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys [2014.08.30 01:07:23 | 000,000,000 | ---D | C] -- C:\Users\Ghost\Desktop\mbar [2014.08.26 22:54:17 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Local\Disc_Soft_Ltd [2014.08.26 04:59:33 | 000,000,000 | ---D | C] -- C:\Users\Ghost\Desktop\Unterichtsaufnahmen [2014.08.18 21:19:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2014.08.18 21:19:51 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2014.08.07 10:26:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\DVDVideoSoft [2014.08.07 10:26:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\DVDVideoSoft [2014.08.07 10:26:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\DVDVideoSoft [2014.08.07 10:25:58 | 000,000,000 | ---D | C] -- C:\Users\Ghost\AppData\Roaming\DVDVideoSoft [2014.08.07 09:13:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Package Cache [2014.08.06 11:33:54 | 000,000,000 | -HSD | C] -- C:\Users\Ghost\AppData\Local\EmieUserList [2014.08.06 11:33:54 | 000,000,000 | -HSD | C] -- C:\Users\Ghost\AppData\Local\EmieSiteList [2014.08.06 11:25:51 | 000,000,000 | ---D | C] -- C:\ProgramData\ATI [2014.08.06 11:25:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\AMD AVT [2014.08.06 11:25:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\AMD VISION Engine Control Center [2014.08.05 22:20:53 | 000,000,000 | ---D | C] -- C:\Users\Ghost\Desktop\blubVolley ========== Files - Modified Within 30 Days ========== [2098.01.06 21:35:14 | 002,118,201 | ---- | M] () -- C:\Users\Ghost\Desktop\PICT0004.JPG [2014.08.30 02:07:36 | 000,092,888 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys [2014.08.30 01:41:24 | 000,022,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2014.08.30 01:41:24 | 000,022,752 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2014.08.30 01:38:22 | 001,620,612 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2014.08.30 01:38:22 | 000,699,416 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2014.08.30 01:38:22 | 000,654,254 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2014.08.30 01:38:22 | 000,149,556 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2014.08.30 01:38:22 | 000,122,126 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2014.08.30 01:34:29 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2014.08.30 01:34:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2014.08.30 01:32:28 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2014.08.30 01:19:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2014.08.30 01:07:49 | 000,128,728 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys [2014.08.29 14:20:18 | 000,296,192 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2014.08.20 18:22:13 | 000,012,204 | ---- | M] () -- C:\Users\Ghost\Documents\Unbenannt 1.odt [2014.08.20 15:40:27 | 000,058,853 | ---- | M] () -- C:\Users\Ghost\Documents\Unbenannt (7).wma [2014.08.20 14:49:02 | 000,054,363 | ---- | M] () -- C:\Users\Ghost\Documents\Unbenannt (6).wma [2014.08.20 14:47:56 | 000,117,223 | ---- | M] () -- C:\Users\Ghost\Documents\Unbenannt (5).wma [2014.08.20 14:47:35 | 000,072,323 | ---- | M] () -- C:\Users\Ghost\Documents\Unbenannt (4).wma [2014.08.20 14:43:58 | 000,058,853 | ---- | M] () -- C:\Users\Ghost\Documents\Unbenannt (3).wma [2014.08.20 14:43:20 | 000,094,773 | ---- | M] () -- C:\Users\Ghost\Documents\Unbenannt (2).wma [2014.08.20 14:41:37 | 000,063,343 | ---- | M] () -- C:\Users\Ghost\Documents\Unbenannt.wma [2014.08.18 21:19:56 | 000,001,137 | ---- | M] () -- C:\Users\Public\Desktop\Avira.lnk [2014.08.08 10:22:04 | 008,117,802 | ---- | M] () -- C:\Users\Ghost\Desktop\Mein Film2.mp4 [2014.08.08 10:07:53 | 012,446,134 | ---- | M] () -- C:\Users\Ghost\Desktop\Mein Film.mp4 [2014.08.07 22:15:28 | 003,980,506 | ---- | M] () -- C:\Users\Ghost\Desktop\output.mp4 [2014.08.04 18:15:52 | 000,010,949 | ---- | M] () -- C:\Users\Ghost\Documents\Eidesstattliche Erklärung.odt [2014.08.04 18:10:56 | 000,015,478 | ---- | M] () -- C:\Users\Ghost\Documents\Zweites FOS Zeugnis 1980.odt ========== Files Created - No Company Name ========== [2014.08.20 18:22:11 | 000,012,204 | ---- | C] () -- C:\Users\Ghost\Documents\Unbenannt 1.odt [2014.08.20 15:40:26 | 000,058,853 | ---- | C] () -- C:\Users\Ghost\Documents\Unbenannt (7).wma [2014.08.20 14:49:02 | 000,054,363 | ---- | C] () -- C:\Users\Ghost\Documents\Unbenannt (6).wma [2014.08.20 14:47:56 | 000,117,223 | ---- | C] () -- C:\Users\Ghost\Documents\Unbenannt (5).wma [2014.08.20 14:47:34 | 000,072,323 | ---- | C] () -- C:\Users\Ghost\Documents\Unbenannt (4).wma [2014.08.20 14:43:58 | 000,058,853 | ---- | C] () -- C:\Users\Ghost\Documents\Unbenannt (3).wma [2014.08.20 14:43:20 | 000,094,773 | ---- | C] () -- C:\Users\Ghost\Documents\Unbenannt (2).wma [2014.08.20 14:41:37 | 000,063,343 | ---- | C] () -- C:\Users\Ghost\Documents\Unbenannt.wma [2014.08.19 00:23:53 | 002,118,201 | ---- | C] () -- C:\Users\Ghost\Desktop\PICT0004.JPG [2014.08.08 10:21:25 | 008,117,802 | ---- | C] () -- C:\Users\Ghost\Desktop\Mein Film2.mp4 [2014.08.08 10:07:00 | 012,446,134 | ---- | C] () -- C:\Users\Ghost\Desktop\Mein Film.mp4 [2014.08.07 22:15:10 | 003,980,506 | ---- | C] () -- C:\Users\Ghost\Desktop\output.mp4 [2014.08.07 09:13:43 | 000,001,137 | ---- | C] () -- C:\Users\Public\Desktop\Avira.lnk [2014.08.05 23:20:05 | 000,699,996 | ---- | C] () -- C:\Users\Ghost\Desktop\02082012305.jpg [2014.08.05 23:19:43 | 000,954,955 | ---- | C] () -- C:\Users\Ghost\Desktop\20072012269.jpg [2014.08.04 18:15:50 | 000,010,949 | ---- | C] () -- C:\Users\Ghost\Documents\Eidesstattliche Erklärung.odt [2014.08.04 18:10:54 | 000,015,478 | ---- | C] () -- C:\Users\Ghost\Documents\Zweites FOS Zeugnis 1980.odt [2014.08.03 20:40:04 | 000,950,820 | ---- | C] () -- C:\Users\Ghost\Desktop\VID-20140606-WA0001.mp4 [2014.08.03 20:40:04 | 000,832,835 | ---- | C] () -- C:\Users\Ghost\Desktop\VID-20140607-WA0001.mp4 [2014.05.20 14:31:12 | 000,009,063 | ---- | C] () -- C:\Users\Ghost\AppData\Local\recently-used.xbel [2014.03.11 21:55:04 | 000,000,286 | ---- | C] () -- C:\Windows\game.ini [2014.03.10 11:21:49 | 001,224,704 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfserv.dll [2014.03.10 11:21:49 | 000,991,232 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfusb1.dll [2014.03.10 11:21:49 | 000,696,320 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfhbn3.dll [2014.03.10 11:21:49 | 000,684,032 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfcomc.dll [2014.03.10 11:21:49 | 000,643,072 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfpmui.dll [2014.03.10 11:21:49 | 000,585,728 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcflmpm.dll [2014.03.10 11:21:49 | 000,537,480 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfcoms.exe [2014.03.10 11:21:49 | 000,434,176 | ---- | C] () -- C:\Windows\SysWow64\dlcfutil.dll [2014.03.10 11:21:49 | 000,421,888 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfcomm.dll [2014.03.10 11:21:49 | 000,413,696 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfinpa.dll [2014.03.10 11:21:49 | 000,397,312 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfiesc.dll [2014.03.10 11:21:49 | 000,385,928 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfih.exe [2014.03.10 11:21:49 | 000,323,584 | ---- | C] ( ) -- C:\Windows\SysWow64\DLCFhcp.dll [2014.03.10 11:21:49 | 000,274,432 | ---- | C] () -- C:\Windows\SysWow64\DLCFinst.dll [2014.03.10 11:21:49 | 000,221,184 | ---- | C] () -- C:\Windows\SysWow64\dlcfinsb.dll [2014.03.10 11:21:49 | 000,181,128 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfppls.exe [2014.03.10 11:21:49 | 000,163,840 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfprox.dll [2014.03.10 11:21:49 | 000,159,744 | ---- | C] () -- C:\Windows\SysWow64\dlcfins.dll [2014.03.10 11:21:49 | 000,131,072 | ---- | C] () -- C:\Windows\SysWow64\dlcfjswr.dll [2014.03.10 11:21:49 | 000,106,496 | ---- | C] () -- C:\Windows\SysWow64\dlcfinsr.dll [2014.03.10 11:21:49 | 000,094,208 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfpplc.dll [2014.03.10 11:21:49 | 000,086,016 | ---- | C] () -- C:\Windows\SysWow64\dlcfcub.dll [2014.03.10 11:21:49 | 000,073,728 | ---- | C] () -- C:\Windows\SysWow64\dlcfcu.dll [2014.03.10 11:21:49 | 000,036,864 | ---- | C] () -- C:\Windows\SysWow64\dlcfcur.dll [2014.03.10 11:21:48 | 000,381,832 | ---- | C] ( ) -- C:\Windows\SysWow64\dlcfcfg.exe [2014.03.10 11:21:48 | 000,069,632 | ---- | C] () -- C:\Windows\SysWow64\dlcfcfg.dll [2013.11.17 03:12:53 | 001,593,956 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2013.09.22 09:18:32 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2012.11.16 22:01:08 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat [2012.11.16 22:01:08 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat ========== ZeroAccess Check ========== [2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64 [HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64 "" = C:\Windows\SysNative\shell32.dll -- [2014.06.25 04:05:42 | 014,175,744 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2014.06.25 03:41:30 | 012,874,240 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64 "" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both [HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] ========== LOP Check ========== [2013.09.22 23:23:45 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\ASCOMP Software [2014.08.20 15:20:21 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Audacity [2013.11.17 19:45:40 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\DAEMON Tools Ultra [2014.08.07 10:26:44 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\DVDVideoSoft [2013.11.12 18:58:06 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Hard Disk Sentinel [2013.09.22 22:48:09 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\HD Tune Pro [2013.09.18 16:18:44 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\ICQ-Profile [2013.09.18 15:54:33 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\ICQM [2013.09.26 22:15:31 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\OpenOffice [2013.12.25 00:59:14 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\openvr [2014.02.28 14:15:30 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\Origin [2014.01.29 22:46:20 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\PDF Architect [2014.01.21 18:08:11 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\REAPER [2013.10.13 22:29:17 | 000,000,000 | ---D | M] -- C:\Users\Ghost\AppData\Roaming\TrueCrypt ========== Purity Check ========== ========== Files - Unicode (All) ========== [2013.10.06 19:49:51 | 099,477,982 | ---- | M] ()(C:\Windows\SysWow64\???N) -- C:\Windows\SysWow64\ᨨ옳N [2013.10.06 13:49:48 | 099,477,982 | ---- | C] ()(C:\Windows\SysWow64\???N) -- C:\Windows\SysWow64\ᨨ옳N [2013.10.05 03:17:30 | 099,319,274 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\ꮧ䗅ˆ [2013.10.04 21:17:31 | 099,319,274 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\ꮧ䗅ˆ [2013.10.04 12:54:20 | 099,176,917 | ---- | M] ()(C:\Windows\SysWow64\???) -- C:\Windows\SysWow64\팥 [2013.10.04 12:54:20 | 099,176,917 | ---- | C] ()(C:\Windows\SysWow64\???) -- C:\Windows\SysWow64\팥 [2013.10.03 22:44:31 | 099,160,839 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\ᔁ〿˜ [2013.10.03 22:44:31 | 099,160,839 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\ᔁ〿˜ [2013.09.30 21:24:42 | 098,541,442 | ---- | M] ()(C:\Windows\SysWow64\???¥) -- C:\Windows\SysWow64\鲁¥ [2013.09.30 21:24:42 | 098,541,442 | ---- | C] ()(C:\Windows\SysWow64\???¥) -- C:\Windows\SysWow64\鲁¥ [2013.09.27 22:42:40 | 098,286,374 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\〤孁™ [2013.09.27 16:42:40 | 098,286,374 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\〤孁™ [2013.09.26 21:49:01 | 098,009,570 | ---- | M] ()(C:\Windows\SysWow64\???) -- C:\Windows\SysWow64\㪻ල [2013.09.26 15:49:03 | 098,009,570 | ---- | C] ()(C:\Windows\SysWow64\???) -- C:\Windows\SysWow64\㪻ල [2013.09.25 21:32:50 | 097,858,179 | ---- | M] ()(C:\Windows\SysWow64\???¡) -- C:\Windows\SysWow64\怚¡ [2013.09.25 21:32:50 | 097,858,179 | ---- | C] ()(C:\Windows\SysWow64\???¡) -- C:\Windows\SysWow64\怚¡ [2013.09.24 20:20:05 | 097,540,783 | ---- | M] ()(C:\Windows\SysWow64\???R) -- C:\Windows\SysWow64\恽钉R [2013.09.24 20:20:05 | 097,540,783 | ---- | C] ()(C:\Windows\SysWow64\???R) -- C:\Windows\SysWow64\恽钉R [2013.09.23 12:59:09 | 098,646,441 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\썽킫’ [2013.09.23 12:59:09 | 098,646,441 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\썽킫’ [2013.09.20 19:05:21 | 098,487,876 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\™ [2013.09.20 13:05:19 | 098,487,876 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\™ [2013.09.20 00:38:47 | 098,428,185 | ---- | M] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\␆듫– [2013.09.20 00:38:47 | 098,428,185 | ---- | C] ()(C:\Windows\SysWow64\????) -- C:\Windows\SysWow64\␆듫– [2013.09.19 12:38:50 | 098,352,290 | ---- | M] ()(C:\Windows\SysWow64\???²) -- C:\Windows\SysWow64\牮厴² [2013.09.19 12:38:47 | 098,352,290 | ---- | C] ()(C:\Windows\SysWow64\???²) -- C:\Windows\SysWow64\牮厴² < End of report > Das Problem mit Facebook besteht weiterhin. Vielen Dank für eure Hilfe, ich hab einige Dinge, die ich nur über Facebook regeln kann und das ziemlich zeitnah tun muss, wäre echt super wenn das bald wieder klappt. mfG Zoot |
Baum-Darstellung