Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Verschlüsselungs-Trojaner Log-Files (https://www.trojaner-board.de/117338-verschluesselungs-trojaner-log-files.html)

proce3d 14.06.2012 17:46
Verschlüsselungs-Trojaner Log-Files
 
Hallo,

bei mir erscheint seit heute auch das Bild und mein PC ist komplett gesperrt. Im Anhang befinden sich die gewünschten Log-Files.

kira 15.06.2012 22:36
Hallo und Herzlich Willkommen! :)

Bevor wir unsere Zusammenarbeit beginnen, [Bitte Vollständig lesen]:
Zitat:
  • "Fernbehandlungen/Fernhilfe" und die damit verbundenen Haftungsrisken:
    - da die Fehlerprüfung und Handlung werden über große Entfernungen durchgeführt, besteht keine Haftung unsererseits für die daraus entstehenden Folgen.
    - also, jede Haftung für die daraus entstandene Schäden wird ausgeschlossen, ANWEISUNGEN UND DEREN BEFOLGUNG, ERFOLGT AUF DEINE EIGENE VERANTWORTUNG!
  • Charakteristische Merkmale/Profilinformationen:
    - aus der verwendeten Loglisten oder Logdateien - wie z.B. deinen Realnamen, Seriennummer in Programm etc)- kannst Du durch [X] oder Sternchen (*) ersetzen
  • Die Systemprüfung und Bereinigung:
    - kann einige Zeit in Anspruch nehmen (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst
  • Ich empfehle Dir die Anweisungen erst einmal komplett durchzulesen, bevor du es anwendest, weil wenn du etwas falsch machst, kann es wirklich gefährlich werden. Wenn du meinen Anweisungen Schritt für Schritt folgst, kann eigentlich nichts schief gehen.
  • Innerhalb der Betreuungszeit:
    - ohne Abspräche bitte nicht auf eigene Faust handeln!- bei Problemen nachfragen.
  • Die Reihenfolge:
    - genau so wie beschrieben bitte einhalten, nicht selbst die Reihenfolge wählen!
  • GECRACKTE SOFTWARE werden hier nicht geduldet!!!!
  • Ansonsten unsere Forumsregeln:
    - Bitte erst lesen, dann posten!-> Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten?
  • Alle Logfile mit einem vBCode Tag eingefügen, das bietet hier eine gute Übersicht, erleichtert mir die Arbeit! Falls das Logfile zu groß, teile es in mehrere Teile auf.

Sobald Du diesen Einführungstext gelesen hast, kannst Du beginnen:)
Zitat:
Wenn ein System kompromittiert wurde, ist das System nicht mehr vertrauenswürdig
Eine Neuinstallation garantiert die rückstandsfreie Entfernung der Infektion - Lesestoff: "Hilfe: Ich wurde das Opfer eines Hackerangriffs. Was soll ich tun?" - Säubern eines gefährdeten Systems
Falls du doch für die Systemreinigung entscheidest - Ein System zu bereinigen kann ein paar Tage dauern (je nach Art der Infektion), kann aber sogar so stark kompromittiert sein, so dass eine wirkungsvolle technische Säuberung ist nicht mehr möglich bzw Du es neu installieren musst::

Für Vista und Win7:
Wichtig: Alle Befehle bitte als Administrator ausführen! rechte Maustaste auf die Eingabeaufforderung und "als Administrator ausführen" auswählen
Auf der angewählten Anwendung einen Rechtsklick (rechte Maustaste) und "Als Administrator ausführen" wählen!

1.
Zitat:
Achtung wichtig!:
Falls Du selber im Logfile Änderungen vorgenommen hast, musst Du durch die Originalbezeichnung ersetzen und so in Script einfügen! sonst funktioniert nicht!
(Benutzerordner, dein Name oder sonstige Änderungen durch X, Stern oder andere Namen ersetzt)
Fixen mit OTL
  • Starte die OTL.exe.
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Kopiere folgendes Skript (also - nach dem "Code", alles was in der Codebox steht! - (also beginnend mit :OTL und am Ende [REBOOT] ohne "code"!) :
Code:
:OTL
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = http://de.msn.com/?ocid=iehp
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
FF - prefs.js..extensions.enabledItems: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.8.20100713041928
FF - prefs.js..keyword.URL: "http://search.babylon.com/?babsrc=SP_ss&mntrId=f6d576f5000000000000000000000000&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q="
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\proce3d\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\proce3d\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\proce3d\AppData\Roaming\12016 [2012.06.14 14:58:35 | 000,000,000 | ---D | M]
[2012.04.19 00:06:40 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.04.19 00:06:40 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.04.19 00:06:40 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.04.19 00:06:40 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.04.19 00:06:40 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.04.19 00:06:40 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {30F9B915-B755-4826-820B-08FBA6BD249D} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\tbsoft.dll (Conduit Ltd.)
O4 - HKLM..\Run: [twgmbkdqgvfugtt] C:\ProgramData\twgmbkdq.exe ()
O4 - HKCU..\Run: [{E6BA4696-6CED-9645-49B5-CFD2A97B175E}] C:\Users\proce3d\AppData\Roaming\Riqyar\iqyga.exe File not found
O4 - HKCU..\Run: [twgmbkdqgvfugtt] C:\ProgramData\twgmbkdq.exe ()
O4 - HKCU..\Run: [Userinit] C:\Users\proce3d\AppData\Roaming\appconf32.exe ()
O4 - HKCU..\Run: [Ytxiuhicic] C:\Users\proce3d\AppData\Roaming\Etehi\yzco.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{132ef500-9126-11e0-935f-0021850ecb47}\Shell - "" = AutoRun
O33 - MountPoints2\{132ef500-9126-11e0-935f-0021850ecb47}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O33 - MountPoints2\{3305f9c0-1a24-11e1-a4b9-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{3305f9c0-1a24-11e1-a4b9-806e6f6e6963}\Shell\AutoRun\command - "" = F:\SETUP.EXE

:Files
C:\ProgramData\twgmbkdq.exe
C:\Users\proce3d\AppData\Roaming\appconf32.exe
C:\ProgramData\ezyulomvbqybqup
C:\Users\proce3d\AppData\Roaming\12016
C:\Users\proce3d\AppData\Roaming\12015
C:\Users\proce3d\AppData\Roaming\12014
C:\Users\proce3d\AppData\Roaming\12001.001
C:\Users\proce3d\AppData\Roaming\xmldm
C:\Users\proce3d\AppData\Roaming\kock
C:\Users\proce3d\Desktop\fjtwv9ko.exe
C:\ProgramData\gpcfiojmnekgcid
C:\ProgramData\twgmbkdq.exe
C:\ProgramData\funwibco.exe
C:\Users\proce3d\0.16546581949506778.exe
C:\Users\proce3d\AppData\Roaming\AcroIEHelpe139.dll
C:\Users\proce3d\AppData\Roaming\BAcroIEHelpe139.dll
C:\Users\proce3d\AppData\Roaming\BAcroIEHelpe.dll

ipconfig /flushdns /c

:Commands
[REBOOT]

2.
Lade Dir Malwarebytes Anti-Malware Lade Dir Malwarebytes Anti-Malware → von hier herunter
  • Installieren und per Doppelklick starten.
  • Deutsch einstellen und gleich mal die Datenbanken zu aktualisieren - online updaten
  • "Komplett Scan durchführen" wählen (überall Haken setzen)
  • wenn der Scanvorgang beendet ist, klicke auf "Zeige Resultate"
  • Alle Funde in der Quarantäne verschieben
  • Poste das Ergebnis hier in den Thread - den Bericht findest Du unter "Scan-Berichte"
eine bebilderte Anleitung findest Du hier: Anleitung

3.
Um festzustellen, ob veraltete oder schädliche Software unter Programme installiert sind, ich würde gerne noch all deine installierten Programme sehen:
  • Download den CCleaner herunter
  • Software-Lizenzvereinbarung lesen, falls irgendeine Toolbar angeboten wird, bitte abwählen!-> starten -> Falls nötig, auf "Deutsch" einstellen.
  • starten-> klick auf `Extras` (um auf deinem System installierte Software zu anzeigen)-> dann auf `Als Textdatei speichern...`
  • ein Textdatei wird automatisch erstellt, poste auch dieses Logfile (also die Liste alle installierten Programme...eine Textdatei)

4.
erneut einen Scan mit OTL:
  • Doppelklick auf die OTL.exe
  • Vista und Windows 7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen.
  • Oben findest Du ein Kästchen mit Ausgabe.
    Wähle bitte Standard-Ausgabe
  • Unter Extra-Registrierung wähle bitte Benutze SafeList.
  • Mache Häckchen bei LOP- und Purity-Prüfung.
  • Klicke nun auf Scan links oben.
  • Wenn der Scan beendet wurde werden zwei Logfiles erstellt.
    Du findest die Logfiles auf Deinem Desktop => OTL.txt und Extras.txt
  • Poste die Logfiles in Code-Tags hier in den Thread.

5.
► Welche Art und Weise wurden die Daten (Eigene Dateien wie Bilder, Dokumente, Musik etc) bereits verschlüsselt? Kannst Du ein Beispiel nennen? Dateiändung wurden zugefügt (z.B "locked- .wxyz"), oder nach einem Zufallsprinzip besteht ein Dateiname aus Groß und Kleinbuchstaben (wie z.B QsEEUTODXNVqyssQ) andere?
Nämlich manche Varianten lassen sich entschlüsseln, andere wieder leider nicht..

Zitat:
Damit dein Thread übersichtlicher und schön lesbar bleibt, am besten nutze den Code-Tags für deinen Post:
→ vor dein Log schreibst Du (also am Anfang des Logfiles):[code]
hier kommt dein Logfile rein - z.B OTL-Logfile o. sonstiges
→ dahinter - also am Ende der Logdatei: [/code]
** Möglichst nicht ins internet gehen, kein Online-Banking, File-sharing, Chatprogramme usw
gruß
kira

proce3d 16.06.2012 12:33
1. Hier die OTL-Textdatei nach dem Fix:
Code:
  ========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File C:\Programme\softonic-de3\tbsoft.dll not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ not found.
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File C:\Programme\softonic-de3\tbsoft.dll not found.
HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Prefs.js: {635abd67-4fe9-1b23-4f01-e679fa7484c1}:2.1.8.20100713041928 removed from extensions.enabledItems
Prefs.js: "hxxp://search.babylon.com/?babsrc=SP_ss&mntrId=f6d576f5000000000000000000000000&tlver=1.4.19.19&instlRef=sst&ss=1&affID=17395&q=" removed from keyword.URL
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ not found.
File C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ not found.
File C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll not found.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=3\ not found.
File C:\Users\proce3d\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll not found.
Registry key HKEY_CURRENT_USER\Software\MozillaPlugins\@tools.google.com/Google Update;version=9\ not found.
File C:\Users\proce3d\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll not found.
File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\proce3d\AppData\Roaming\12016 not found.
File C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml not found.
File C:\Program Files\mozilla firefox\searchplugins\bing.xml not found.
File C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml not found.
File C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml not found.
File C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml not found.
File C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File C:\Programme\softonic-de3\tbsoft.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}\ not found.
File de3\tbsoft.dll not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{30F9B915-B755-4826-820B-08FBA6BD249D} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{30F9B915-B755-4826-820B-08FBA6BD249D}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065}\ not found.
File de3\tbsoft.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\twgmbkdqgvfugtt not found.
File C:\ProgramData\twgmbkdq.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{E6BA4696-6CED-9645-49B5-CFD2A97B175E} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6BA4696-6CED-9645-49B5-CFD2A97B175E}\ not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\twgmbkdqgvfugtt not found.
File C:\ProgramData\twgmbkdq.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Userinit not found.
File C:\Users\proce3d\AppData\Roaming\appconf32.exe not found.
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\Ytxiuhicic not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{132ef500-9126-11e0-935f-0021850ecb47}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{132ef500-9126-11e0-935f-0021850ecb47}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{132ef500-9126-11e0-935f-0021850ecb47}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{132ef500-9126-11e0-935f-0021850ecb47}\ not found.
File G:\LaunchU3.exe -a not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3305f9c0-1a24-11e1-a4b9-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3305f9c0-1a24-11e1-a4b9-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{3305f9c0-1a24-11e1-a4b9-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{3305f9c0-1a24-11e1-a4b9-806e6f6e6963}\ not found.
File F:\SETUP.EXE not found.
========== FILES ==========
File\Folder C:\ProgramData\twgmbkdq.exe not found.
File\Folder C:\Users\proce3d\AppData\Roaming\appconf32.exe not found.
File\Folder C:\ProgramData\ezyulomvbqybqup not found.
File\Folder C:\Users\proce3d\AppData\Roaming\12016 not found.
File\Folder C:\Users\proce3d\AppData\Roaming\12015 not found.
File\Folder C:\Users\proce3d\AppData\Roaming\12014 not found.
File\Folder C:\Users\proce3d\AppData\Roaming\12001.001 not found.
File\Folder C:\Users\proce3d\AppData\Roaming\xmldm not found.
File\Folder C:\Users\proce3d\AppData\Roaming\kock not found.
File\Folder C:\Users\proce3d\Desktop\fjtwv9ko.exe not found.
File\Folder C:\ProgramData\gpcfiojmnekgcid not found.
File\Folder C:\ProgramData\twgmbkdq.exe not found.
File\Folder C:\ProgramData\funwibco.exe not found.
File\Folder C:\Users\proce3d\0.16546581949506778.exe not found.
File\Folder C:\Users\proce3d\AppData\Roaming\AcroIEHelpe139.dll not found.
File\Folder C:\Users\proce3d\AppData\Roaming\BAcroIEHelpe139.dll not found.
File\Folder C:\Users\proce3d\AppData\Roaming\BAcroIEHelpe.dll not found.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\proce3d\Desktop\cmd.bat deleted successfully.
C:\Users\proce3d\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
OTL by OldTimer - Version 3.2.48.0 log created on 06162012_114322
2. Malwarebytes-Log
Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.16.01

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 8.0.7601.17514
proce3d :: PROCE3D-PC [Administrator]

Schutz: Aktiviert

16.06.2012 11:49:06
mbam-log-2012-06-16 (11-49-06).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 417533
Laufzeit: 1 Stunde(n), 15 Minute(n), 44 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|LicenseValidator (Trojan.Proxy) -> Daten: C:\Users\proce3d\AppData\Roaming\Identities\{B8D7BAFF-E633-4719-9C3B-1E42277FB8E6}\LicenseValidator.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 2
C:\Users\proce3d\Desktop\Programme\Phoenix\Phx_data\Res\EmuCfg.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\proce3d\Desktop\Programme\Phoenix\Phx_data\Res\GCFMgr.exe (Trojan.Agent) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)
3. CCleaner alle Programme
Code:
Adobe AIR        Adobe Systems Inc.        18.04.2012                2.5.1.17730
Adobe Flash Player 11 ActiveX        Adobe Systems Incorporated        04.05.2012        6,00MB        11.2.202.235
Adobe Flash Player 11 Plugin        Adobe Systems Incorporated        13.06.2012        6,00MB        11.3.300.257
Adobe Reader X (10.1.3) - Deutsch        Adobe Systems Incorporated        13.04.2012        121,2MB        10.1.3
Avira AntiVir Personal - Free Antivirus        Avira GmbH        18.04.2012        61,8MB        10.2.0.707
Blender        Blender Foundation        18.04.2012                2.60a-release
Borland Delphi 7        Borland Software Corporation        26.12.2010        141,3MB        7.0
CCleaner        Piriform        22.05.2012                3.19
Counter-Strike(TM)        Valve        28.06.2011        1.145MB        1.0.0.0
DAEMON Tools Lite        DT Soft Ltd        18.04.2012                4.45.4.0314
Darkfall        Aventurine        26.12.2011        113,1MB        1.0.48
Der Herr der Ringe Online v03.05.01.8027        Turbine, Inc.        12.03.2012                03.05.01.8027
Diablo III        Blizzard Entertainment        12.06.2012                1.0.2.9991
Diablo III Beta        Blizzard Entertainment        20.04.2012                0.2.0.7162
Dota 2                18.04.2012               
Dropbox        Dropbox, Inc.        01.06.2012                1.4.7
Free YouTube to MP3 Converter version 3.10.9.908        DVDVideoSoft Ltd.        14.09.2011        42,4MB       
Garena 2010        Garena Online Pte Ltd.        18.04.2012                2010
Google Chrome        Google Inc.        24.06.2011                19.0.1084.56
ICQ7.2        ICQ        13.10.2010                7.2
IDroo 1.0.0.154        Iteral Group Ltd        18.04.2012                1.0.0.154
Java(TM) 6 Update 31        Oracle        25.03.2012        95,1MB        6.0.310
Java(TM) 7 Update 2        Oracle        03.01.2012        99,1MB        7.0.20
Lazarus 0.9.12                18.04.2012                0.9.12
Malwarebytes Anti-Malware Version 1.61.0.1400        Malwarebytes Corporation        15.06.2012        18,0MB        1.61.0.1400
Microsoft .NET Framework 1.1                18.04.2012               
Microsoft .NET Framework 4 Client Profile        Microsoft Corporation        18.04.2012        38,8MB        4.0.30319
Microsoft .NET Framework 4 Client Profile DEU Language Pack        Microsoft Corporation        18.04.2012        2,94MB        4.0.30319
Microsoft .NET Framework 4 Extended        Microsoft Corporation        18.04.2012        52,0MB        4.0.30319
Microsoft .NET Framework 4 Extended DEU Language Pack        Microsoft Corporation        18.04.2012        10,7MB        4.0.30319
Microsoft .NET Framework 4 Multi-Targeting Pack        Microsoft Corporation        29.03.2011        83,5MB        4.0.30319
Microsoft ASP.NET MVC 2        Microsoft Corporation        29.03.2011        0,47MB        2.0.50217.0
Microsoft ASP.NET MVC 2 - DEU        Microsoft Corporation        29.03.2011        25,00KB        2.0.50331.0
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools        Microsoft Corporation        29.03.2011        2,25MB        2.0.50217.0
Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU        Microsoft Corporation        29.03.2011        2,07MB        2.0.50331.0
Microsoft Games for Windows - LIVE Redistributable        Microsoft Corporation        04.05.2011        31,3MB        3.5.88.0
Microsoft Games for Windows Marketplace        Microsoft Corporation        04.05.2011        6,04MB        3.5.50.0
Microsoft Help Viewer 1.0        Microsoft Corporation        18.04.2012        3,97MB        1.0.30319
Microsoft Help Viewer 1.0 Language Pack - DEU        Microsoft Corporation        18.04.2012        1,95MB        1.0.30319
Microsoft Office 2003 Web Components        Microsoft Corporation        09.05.2012        49,8MB        12.0.6213.1000
Microsoft Office File Validation Add-In        Microsoft Corporation        15.09.2011        7,95MB        14.0.5130.5003
Microsoft Office Language Pack 2007 - German/Deutsch        Microsoft Corporation        18.04.2012                12.0.6612.1000
Microsoft Office Professional Plus 2007        Microsoft Corporation        18.04.2012                12.0.6612.1000
Microsoft Office Visio Professional 2007        Microsoft Corporation        18.04.2012                12.0.6612.1000
Microsoft Silverlight        Microsoft Corporation        09.05.2012        307MB        4.1.10329.0
Microsoft Silverlight 3 SDK - Deutsch        Microsoft Corporation        29.03.2011        32,8MB        3.0.40818.0
Microsoft SQL Server 2008        Microsoft Corporation        18.04.2012               
Microsoft SQL Server 2008 Browser        Microsoft Corporation        29.03.2011        8,00MB        10.1.2531.0
Microsoft SQL Server 2008 Native Client        Microsoft Corporation        29.03.2011        3,24MB        10.1.2531.0
Microsoft SQL Server 2008 R2 Data-Tier Application Project        Microsoft Corporation        29.03.2011        14,1MB        10.50.1447.4
Microsoft SQL Server 2008 R2 Management Objects        Microsoft Corporation        29.03.2011        17,1MB        10.50.1447.4
Microsoft SQL Server 2008 R2 Transact-SQL Language Service        Microsoft Corporation        29.03.2011        5,41MB        10.50.1447.4
Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework        Microsoft Corporation        29.03.2011        0,37MB        10.50.1447.4
Microsoft SQL Server Compact 3.5 SP2 DEU        Microsoft Corporation        29.03.2011        3,69MB        3.5.8080.0
Microsoft SQL Server Database Publishing Wizard 1.4        Microsoft Corporation        29.03.2011        10,2MB        10.1.2512.8
Microsoft SQL Server System CLR Types        Microsoft Corporation        29.03.2011        2,55MB        10.50.1447.4
Microsoft SQL Server VSS Writer        Microsoft Corporation        29.03.2011        1,81MB        10.1.2531.0
Microsoft Sync Framework Runtime v1.0 SP1 (x86) de        Microsoft Corporation        29.03.2011        0,82MB        1.0.3010.0
Microsoft Sync Framework SDK v1.0 SP1 de        Microsoft Corporation        29.03.2011        30,0MB        1.0.3010.0
Microsoft Sync Framework Services v1.0 SP1 (x86) de        Microsoft Corporation        29.03.2011        2,06MB        1.0.3010.0
Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) de        Microsoft Corporation        29.03.2011        0,58MB        2.0.3010.0
Microsoft Team Foundation Server 2010-Objektmodell - DEU        Microsoft Corporation        18.04.2012                10.0.30319
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053        Microsoft Corporation        22.10.2010        0,25MB        8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable        Microsoft Corporation        12.03.2012        2,38MB        8.0.56336
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17        Microsoft Corporation        13.10.2010        0,23MB        9.0.30729
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148        Microsoft Corporation        13.10.2010        0,58MB        9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974        Microsoft Corporation        29.03.2011        0,58MB        9.0.30729.4974
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161        Microsoft Corporation        15.06.2011        0,59MB        9.0.30729.6161
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219        Microsoft Corporation        29.11.2011        15,0MB        10.0.40219
Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319        Microsoft Corporation        15.06.2011        26,0MB        10.0.30319
Microsoft Visual F# 2.0 Runtime        Microsoft Corporation        29.03.2011        5,82MB        10.0.30319
Microsoft Visual F# 2.0 Runtime Language Pack - DEU        Microsoft Corporation        29.03.2011        1,30MB        10.0.30319
Microsoft Visual Studio 2005 Tools for Applications - ENU        Microsoft Corporation        18.04.2012               
Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools        Microsoft Corporation        29.03.2011        35,3MB        10.0.30319
Microsoft Visual Studio 2010 Tools for Office Runtime (x86)        Microsoft Corporation        18.04.2012                10.0.31119
Microsoft Visual Studio 2010 Ultimate - DEU        Microsoft Corporation        18.04.2012                10.0.30319
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU        Microsoft Corporation        18.04.2012                10.0.30319
Microsoft Visual Studio Macro Tools        Microsoft Corporation        18.04.2012                9.0.30729
Microsoft Visual Studio Macro Tools - DEU Language Pack        Microsoft Corporation        18.04.2012                9.0.30729
Microsoft WSE 3.0 Runtime        Microsoft Corp.        25.01.2012        0,92MB        3.0.5305.0
Minecraft Note Block Studio version 3.1.1        David Norgren        30.01.2012        8,96MB        3.1.1
mIRC        mIRC Co. Ltd.        16.11.2011                7.22
Mount&Blade Warband                18.04.2012               
Mozilla Firefox 12.0 (x86 de)        Mozilla        11.05.2012        41,8MB        12.0
Mozilla Maintenance Service        Mozilla        11.05.2012        0,21MB        12.0
MSXML 4.0 SP2 (KB954430)        Microsoft Corporation        22.10.2010        35,00KB        4.20.9870.0
MSXML 4.0 SP2 (KB973688)        Microsoft Corporation        22.10.2010        1,33MB        4.20.9876.0
MSXML 4.0 SP2 Parser and SDK        Microsoft Corporation        17.01.2011        36,00KB        4.20.9818.0
Netzmanager        Deutsche Telekom AG        18.04.2012                1.07
NVIDIA Drivers        NVIDIA Corporation        18.04.2012                1.4
NVIDIA PhysX        NVIDIA Corporation        03.11.2010        119,9MB        9.09.0203
OpenOffice.org 3.2        OpenOffice.org        20.10.2010        379MB        3.2.9502
Pando Media Booster        Pando Networks Inc.        18.04.2012        5,47MB        2.6.0.2
Portal 2                22.04.2011               
Skype Click to Call        Skype Technologies S.A.        25.10.2011        14,4MB        5.6.8442
Skype™ 5.5        Skype Technologies S.A.        25.10.2011        17,0MB        5.5.124
softonic-de3 Toolbar        softonic-de3        18.04.2012                6.2.3.0
SolidWorks 2011 SP02        SolidWorks Corporation        18.04.2012                19.2.0.49
StarCraft II        Blizzard Entertainment        18.04.2012                1.1.2.16755
Steam        Valve Corporation        28.06.2011        42,3MB        1.0.0.0
Sweet Home 3D version 3.3        eTeks        03.08.2011        98,9MB       
TeamSpeak 2 RC2        Dominating Bytes Design        18.04.2012                2.0.32.60
TeamSpeak 3 Client        TeamSpeak Systems GmbH        18.04.2012               
TinyCAD 2.80.03        TinyCAD        18.04.2012                2.80.03
Unterstützungsdateien für Microsoft SQL Server 2008-Setup        Microsoft Corporation        29.03.2011        30,1MB        10.1.2731.0
Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU        Microsoft Corporation        29.03.2011        11,2MB        4.0.8080.0
VLC media player 1.1.11        VideoLAN        18.04.2012                1.1.11
Warcraft III                18.04.2012               
Warcraft III: All Products                06.11.2011               
Warkeys 1.18.1.0b                18.04.2012                1.18.1.0b
Web Deployment Tool        Microsoft Corporation        29.03.2011        4,55MB        1.1.0618
Windows Live ID Sign-in Assistant        Microsoft Corporation        15.11.2010        5,52MB        6.500.3165.0
Windows Media Player Firefox Plugin        Microsoft Corp        28.03.2011        0,29MB        1.0.0.8
WinRAR                18.04.2012               
XSplit        SplitMediaLabs        30.11.2011        39,0MB        1.0.1109.2301
4. erneuter OTL-Scan
OTL Logfile:
Code:
OTL logfile created on: 16.06.2012 13:23:34 - Run 2
OTL by OldTimer - Version 3.2.48.0    Folder = C:\Users\proce3d\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,75 Gb Available Physical Memory | 58,26% Memory free
5,99 Gb Paging File | 4,59 Gb Available in Paging File | 76,60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 445,76 Gb Total Space | 261,07 Gb Free Space | 58,57% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 19,99 Gb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: PROCE3D-PC | User Name: proce3d | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.06.14 17:12:37 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\proce3d\Desktop\OTL.exe
PRC - [2012.05.24 20:39:22 | 027,112,840 | ---- | M] (Dropbox, Inc.) -- C:\Users\proce3d\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2012.04.11 11:54:22 | 003,672,384 | ---- | M] (DT Soft Ltd) -- C:\Programme\DAEMON Tools Lite\DTLite.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.04.04 15:56:38 | 000,462,408 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.11.10 17:30:05 | 014,000,128 | ---- | M] (Deutsche Telekom AG) -- C:\Programme\Netzmanager\netzmanager.exe
PRC - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe
PRC - [2011.06.30 13:02:52 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.06.24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011.04.29 08:09:46 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2011.02.25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010.11.12 21:45:05 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.01.14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Programme\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009.09.25 20:57:38 | 000,245,248 | ---- | M] () -- C:\Programme\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe
PRC - [2009.08.18 12:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2009.08.18 12:29:22 | 000,183,152 | ---- | M] (Microsoft Corporation) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2009.03.30 03:25:26 | 043,010,392 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe
PRC - [2008.07.10 02:49:44 | 000,098,840 | ---- | M] (Microsoft Corporation) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.06.07 10:14:43 | 000,441,880 | ---- | M] () -- C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
MOD - [2012.06.07 10:14:42 | 003,922,456 | ---- | M] () -- C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
MOD - [2012.06.07 10:13:27 | 000,553,496 | ---- | M] () -- C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\libglesv2.dll
MOD - [2012.06.07 10:13:26 | 000,117,784 | ---- | M] () -- C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\libegl.dll
MOD - [2012.06.07 10:13:16 | 000,134,696 | ---- | M] () -- C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\avutil-51.dll
MOD - [2012.06.07 10:13:15 | 000,250,408 | ---- | M] () -- C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\avformat-54.dll
MOD - [2012.06.07 10:13:14 | 002,375,720 | ---- | M] () -- C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\avcodec-54.dll
MOD - [2012.05.10 22:16:18 | 001,358,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.WorkflowServ#\439862b007b2dd84127ff35af476f5ad\System.WorkflowServices.ni.dll
MOD - [2012.05.10 22:15:57 | 001,707,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel#\ed560b26f2f86b3f07b7f6d384f92275\System.ServiceModel.Web.ni.dll
MOD - [2012.05.10 22:11:39 | 001,083,392 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\2ce8210219c7123610072357358df470\System.IdentityModel.ni.dll
MOD - [2012.05.10 22:11:37 | 017,478,656 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\107779ca2708d2b31b2e1560e47f6d15\System.ServiceModel.ni.dll
MOD - [2012.05.10 22:11:21 | 002,347,008 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\72a24b45e11d64eb2bc840aae9419ba5\System.Runtime.Serialization.ni.dll
MOD - [2012.05.10 22:11:21 | 000,256,000 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\9e7bf69d97febe4ed1a288c787e5d9ca\SMDiagnostics.ni.dll
MOD - [2012.05.10 22:10:01 | 001,051,136 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Management\9b2f17fb61b7197f2a04108f5d1a1cc6\System.Management.ni.dll
MOD - [2012.05.10 22:09:30 | 002,297,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\dfd33f59a5803a3c73cf408362e6e0b7\System.Core.ni.dll
MOD - [2012.05.10 22:02:28 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll
MOD - [2012.05.10 22:02:16 | 011,833,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\1a690902e9a6293de228c16fab21e2f7\System.Web.ni.dll
MOD - [2012.05.10 22:02:07 | 000,628,224 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.EnterpriseSe#\168755d010e5a96ac940b0ddd27616a4\System.EnterpriseServices.ni.dll
MOD - [2012.05.10 22:02:07 | 000,627,200 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Transactions\80fae9f16f80075535e72458ef293f7a\System.Transactions.ni.dll
MOD - [2012.05.10 22:02:06 | 006,611,456 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll
MOD - [2012.05.10 22:01:57 | 014,340,608 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\07f019692c382d588d3c6cb2da2a9ec5\PresentationFramework.ni.dll
MOD - [2012.05.10 22:01:43 | 012,433,408 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\90555968565afd59bce4b0974e9903bd\System.Windows.Forms.ni.dll
MOD - [2012.05.10 22:01:36 | 001,590,784 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\69f6e582cb79f107c61308b468c1a215\System.Drawing.ni.dll
MOD - [2012.05.10 22:01:33 | 012,237,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\2d1fd350e9bc62ce659e5cbcfd555796\PresentationCore.ni.dll
MOD - [2012.05.10 22:01:23 | 003,347,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll
MOD - [2012.05.10 22:01:18 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll
MOD - [2012.05.10 22:01:14 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll
MOD - [2012.05.10 22:01:13 | 007,967,232 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll
MOD - [2012.05.10 22:01:05 | 011,492,864 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll
MOD - [2011.03.30 17:45:10 | 000,029,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\Microsoft.VisualStudio.Diagnostics.ServiceModelSink\3.0.0.0__b03f5f7f11d50a3a\Microsoft.VisualStudio.Diagnostics.ServiceModelSink.dll
MOD - [2010.11.13 02:02:21 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
MOD - [2010.11.05 03:58:05 | 002,927,616 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll
MOD - [2010.03.15 11:28:22 | 000,141,824 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2009.09.25 20:57:38 | 000,245,248 | ---- | M] () -- C:\Programme\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe
MOD - [2009.07.14 10:47:20 | 000,110,592 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\PresentationCore.resources\3.0.0.0_de_31bf3856ad364e35\PresentationCore.resources.dll
MOD - [2009.07.14 10:47:20 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Runtime.Serialization.resources\3.0.0.0_de_b77a5c561934e089\System.Runtime.Serialization.resources.dll
MOD - [2009.07.14 10:47:15 | 000,167,936 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Xml.resources\2.0.0.0_de_b77a5c561934e089\System.Xml.resources.dll
MOD - [2009.07.14 10:47:15 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Configuration.resources\2.0.0.0_de_b03f5f7f11d50a3a\System.Configuration.resources.dll
MOD - [2009.06.10 23:23:19 | 000,261,632 | ---- | M] () -- C:\Windows\assembly\GAC_32\System.Transactions\2.0.0.0__b77a5c561934e089\System.Transactions.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012.06.14 11:19:38 | 000,257,224 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.05.22 22:21:51 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.05.12 15:34:15 | 000,129,976 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011.10.24 09:53:38 | 002,565,632 | ---- | M] (Deutsche Telekom AG) [Auto | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Netzmanager_Service.exe -- (Netzmanager Service)
SRV - [2011.10.12 11:41:14 | 001,044,816 | ---- | M] (Flexera Software, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011.10.12 11:41:14 | 000,079,360 | ---- | M] (SolidWorks) [On_Demand | Stopped] -- C:\Programme\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe -- (SolidWorks Licensing Service)
SRV - [2011.07.20 06:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.06.30 13:02:52 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.04.29 08:09:46 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.01.08 08:17:46 | 000,087,336 | ---- | M] (Dassault Systèmes SolidWorks Corp.) [On_Demand | Stopped] -- C:\Programme\SolidWorks Corp\SolidWorks\swScheduler\DTSCoordinatorService.exe -- (CoordinatorServiceHost)
SRV - [2010.11.20 14:17:56 | 001,121,792 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2009.08.18 12:29:22 | 001,529,728 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.07.21 04:04:00 | 000,047,128 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe -- (MSSQLServerADHelper100)
SRV - [2009.07.14 03:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 03:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.03.30 03:25:26 | 043,010,392 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe -- (MSSQL$SQLEXPRESS) SQL Server (SQLEXPRESS)
SRV - [2009.03.30 03:23:32 | 000,254,808 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe -- (SQLBrowser)
SRV - [2009.03.30 03:23:24 | 000,366,936 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE -- (SQLAgent$SQLEXPRESS) SQL Server-Agent (SQLEXPRESS)
SRV - [2008.07.10 02:49:44 | 000,098,840 | ---- | M] (Microsoft Corporation) [Auto | Running] -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe -- (SQLWriter)
SRV - [2006.10.26 14:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
SRV - [2005.09.23 07:01:16 | 002,799,808 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe -- (msvsmon80)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Program Files\Garena\safedrv.sys -- (GGSAFERDriver)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (a2srvy84)
DRV - [2012.04.04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.11.29 02:48:10 | 000,428,088 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sptd.sys -- (sptd)
DRV - [2011.06.30 13:02:53 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.06.30 13:02:53 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.11.20 14:30:15 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 14:30:15 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 14:30:15 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 11:14:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 11:14:41 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.09.16 17:02:33 | 000,035,040 | ---- | M] (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) [Kernel | On_Demand | Running] -- C:\Programme\Netzmanager\NMInfraIS2\Driver\TelekomNM3.sys -- (TelekomNM3)
DRV - [2009.12.08 21:24:26 | 000,048,128 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Programme\Microsoft Visual Studio 10.0\Team Tools\Performance Tools\VSPerfDrv100.sys -- (VSPerfDrv100)
DRV - [2009.07.15 01:54:00 | 009,557,216 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009.07.14 01:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.14 00:54:15 | 001,311,232 | ---- | M] (NXP Semiconductors) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Ph3xIB32.sys -- (Ph3xIB32)
DRV - [2009.07.14 00:02:53 | 000,657,408 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2009.07.14 00:02:50 | 000,211,456 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\e1e6032.sys -- (e1express) Intel(R)
DRV - [2009.05.11 10:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2009.03.30 03:09:28 | 000,239,336 | ---- | M] (Microsoft Corporation) [File_System | Disabled | Stopped] -- C:\Windows\System32\drivers\RsFx0103.sys -- (RsFx0103)
DRV - [2009.03.18 17:35:40 | 000,026,176 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi)
DRV - [2006.11.30 16:18:18 | 000,027,416 | ---- | M] (X10 Wireless Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\x10ufx2.sys -- (XUIF)
DRV - [2005.11.03 16:40:07 | 000,063,488 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfvfs02.sys -- (sfvfs02) StarForce Protection VFS Driver (version 2.x)
DRV - [2005.08.10 14:44:04 | 000,050,688 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\System32\drivers\sfdrv01.sys -- (sfdrv01) StarForce Protection Environment Driver (version 1.x)
DRV - [2005.05.16 15:20:39 | 000,006,656 | ---- | M] (Protection Technology) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\sfhlp02.sys -- (sfhlp02) StarForce Protection Helper Driver (version 2.x)
DRV - [2004.06.25 11:44:54 | 000,331,008 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\snpstd.sys -- (snpstd)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope =
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache =
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 6A C6 1C E5 A0 6B CB 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope =
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.update: false
FF - prefs.js..browser.search.update: false
FF - prefs.js..extensions.enabledItems:
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.5
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:5.6.0.8442
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA}:6.0.31
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_257.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\proce3d\AppData\Roaming\12016
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.05.12 15:34:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 12.0\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.04.19 00:06:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\extensions\\{184AA5E6-741D-464a-820E-94B3ABC2F3B4}: C:\Users\proce3d\AppData\Roaming\12016
 
[2011.01.19 23:42:19 | 000,000,000 | ---D | M] (No name found) -- C:\Users\proce3d\AppData\Roaming\mozilla\Extensions
[2012.05.20 20:15:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\proce3d\AppData\Roaming\mozilla\Firefox\Profiles\s362heke.default\extensions
[2012.05.20 20:15:23 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\proce3d\AppData\Roaming\mozilla\Firefox\Profiles\s362heke.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2011.09.15 20:01:33 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\proce3d\AppData\Roaming\mozilla\Firefox\Profiles\s362heke.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2012.04.22 02:34:11 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\proce3d\AppData\Roaming\mozilla\Firefox\Profiles\s362heke.default\extensions\ffxtlbr@babylon.com
[2012.04.19 00:06:45 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2011.10.26 20:12:26 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
File not found (No name found) -- C:\USERS\PROCE3D\APPDATA\ROAMING\12016
[2012.05.12 15:34:15 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.01.04 20:03:52 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011.01.06 09:46:10 | 000,258,560 | ---- | M] (Dassault Systèmes SolidWorks Corp.) -- C:\Program Files\mozilla firefox\plugins\npEModelPlugin.dll
 
========== Chrome  ==========
 
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\proce3d\AppData\Local\Google\Chrome\Application\19.0.1084.56\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\proce3d\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: Microsoft\u00AE Windows Media Player Firefox Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\np-mswmp.dll
CHR - plugin: Java Deployment Toolkit 6.0.300.12 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
CHR - plugin: Java(TM) Platform SE 7 U2 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: EModel scriptable Plugin (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npEModelPlugin.dll
CHR - plugin: Google Update (Enabled) = C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll
CHR - Extension: YouTube = C:\Users\proce3d\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\proce3d\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: AdBlock = C:\Users\proce3d\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.36_0\
CHR - Extension: Google Mail = C:\Users\proce3d\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Microsoft-Webtestaufzeichnung 10.0-Hilfsprogramm) - {DDA57003-0068-4ed2-9D32-4D1EC707D94D} - C:\Programme\Microsoft Visual Studio 10.0\Common7\IDE\PrivateAssemblies\Microsoft.VisualStudio.QualityTools.RecorderBarBHO100.dll (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [snpstd] C:\Windows\vsnpstd.exe ()
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - Startup: C:\Users\proce3d\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\proce3d\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\proce3d\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\My_AutoWarkey_Script.lnk = C:\Programme\Warkeys\AutoWarkey\AutoHotkey\AutoHotkey.exe ()
O4 - Startup: C:\Users\proce3d\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Netzmanager.lnk = C:\Programme\Netzmanager\netzmanager.exe (Deutsche Telekom AG)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\proce3d\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_6CE5017F567343CA.dll/cmsidewiki.html File not found
O8 - Extra context menu item: I&zvozi v Microsoft Excel - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Programme\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000005 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000006 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1629F533-1A17-4BAA-9236-510542340332}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{4BF7A733-3B08-429E-9C3D-512BFEE4AF36}: DhcpNameServer = 192.168.43.1
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.06.16 12:23:31 | 000,000,000 | ---D | C] -- C:\Program Files\CCleaner
[2012.06.16 11:47:04 | 000,000,000 | ---D | C] -- C:\Users\proce3d\AppData\Roaming\Malwarebytes
[2012.06.16 11:46:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.16 11:46:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.16 11:46:57 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.16 11:46:57 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.14 17:47:09 | 000,000,000 | ---D | C] -- C:\Windows\Minidump
[2012.06.14 17:26:42 | 000,000,000 | ---D | C] -- C:\_OTL
[2012.06.14 17:12:34 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\proce3d\Desktop\OTL.exe
[2012.06.14 16:48:06 | 000,000,000 | ---D | C] -- C:\Users\proce3d\AppData\Local\Macromedia
[2012.05.30 16:44:10 | 000,000,000 | ---D | C] -- C:\Users\proce3d\AppData\Roaming\Help
[2012.05.21 13:24:33 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012.05.21 13:24:33 | 000,000,000 | ---D | C] -- C:\Program Files\Diablo III
[1 C:\Users\proce3d\Documents\*.tmp files -> C:\Users\proce3d\Documents\*.tmp -> ]
[1 C:\Users\proce3d\AppData\Roaming\*.tmp files -> C:\Users\proce3d\AppData\Roaming\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.06.16 13:30:00 | 000,001,100 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.06.16 13:28:17 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.16 13:28:17 | 000,016,704 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.16 13:20:59 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.06.16 13:20:41 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.16 13:20:36 | 2414,481,408 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.16 13:11:00 | 000,001,128 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2312803641-919243086-1854456094-1001UA.job
[2012.06.16 12:43:03 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.16 12:23:34 | 000,000,965 | ---- | M] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.06.16 11:46:59 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.16 11:29:10 | 000,458,128 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.06.16 10:52:29 | 000,772,612 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.16 10:52:29 | 000,726,230 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.16 10:52:29 | 000,177,294 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.16 10:52:29 | 000,149,510 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.06.14 18:45:05 | 000,032,258 | ---- | M] () -- C:\Users\proce3d\Desktop\logfiles.zip
[2012.06.14 17:47:03 | 309,940,100 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.06.14 17:12:37 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\proce3d\Desktop\OTL.exe
[2012.06.14 16:46:53 | 000,000,080 | ---- | M] () -- C:\Users\proce3d\AppData\Roaming\blckdom.res
[2012.06.14 11:19:38 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.06.14 11:19:38 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.06.13 23:49:59 | 000,001,076 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-2312803641-919243086-1854456094-1001Core.job
[2012.06.12 13:13:02 | 000,002,409 | ---- | M] () -- C:\Users\proce3d\Desktop\Google Chrome.lnk
[2012.06.02 19:04:53 | 000,001,053 | ---- | M] () -- C:\Users\proce3d\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2012.05.21 13:40:56 | 000,001,165 | ---- | M] () -- C:\Users\Public\Desktop\Diablo III.lnk
[1 C:\Users\proce3d\Documents\*.tmp files -> C:\Users\proce3d\Documents\*.tmp -> ]
[1 C:\Users\proce3d\AppData\Roaming\*.tmp files -> C:\Users\proce3d\AppData\Roaming\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.06.16 12:23:34 | 000,000,965 | ---- | C] () -- C:\Users\Public\Desktop\CCleaner.lnk
[2012.06.16 11:46:59 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.14 18:01:24 | 000,032,258 | ---- | C] () -- C:\Users\proce3d\Desktop\logfiles.zip
[2012.06.14 17:47:03 | 309,940,100 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.06.11 03:22:37 | 000,000,080 | ---- | C] () -- C:\Users\proce3d\AppData\Roaming\blckdom.res
[2012.05.21 13:24:33 | 000,001,165 | ---- | C] () -- C:\Users\Public\Desktop\Diablo III.lnk
[2011.12.08 16:16:24 | 001,101,824 | ---- | C] () -- C:\Windows\System32\vorbis.dll
[2011.12.08 16:16:24 | 000,385,090 | ---- | C] () -- C:\Windows\System32\libtiff.dll
[2011.12.08 16:16:24 | 000,331,776 | ---- | C] () -- C:\Windows\System32\SDL_ttf.dll
[2011.12.08 16:16:24 | 000,229,376 | ---- | C] () -- C:\Windows\System32\SDL_mixer.dll
[2011.12.08 16:16:24 | 000,196,608 | ---- | C] () -- C:\Windows\System32\smpeg.dll
[2011.12.08 16:16:24 | 000,187,392 | ---- | C] () -- C:\Windows\System32\libPNG.dll
[2011.12.08 16:16:24 | 000,169,443 | ---- | C] () -- C:\Windows\System32\jpeg.dll
[2011.12.08 16:16:24 | 000,126,976 | ---- | C] () -- C:\Windows\System32\libpng12.dll
[2011.12.08 16:16:24 | 000,094,720 | ---- | C] () -- C:\Windows\System32\libpng1.dll
[2011.12.08 16:16:24 | 000,077,824 | ---- | C] () -- C:\Windows\System32\zlib1.dll
[2011.12.08 16:16:24 | 000,053,760 | ---- | C] () -- C:\Windows\System32\zlib.dll
[2011.12.08 16:16:24 | 000,040,960 | ---- | C] () -- C:\Windows\System32\SDL_image.dll
[2011.12.08 16:16:24 | 000,032,768 | ---- | C] () -- C:\Windows\System32\vorbisfile.dll
[2011.12.08 16:16:24 | 000,024,576 | ---- | C] () -- C:\Windows\System32\SDL_net.dll
[2011.12.08 16:16:24 | 000,024,576 | ---- | C] () -- C:\Windows\System32\ogg.dll
[2011.12.07 23:37:08 | 000,258,048 | ---- | C] () -- C:\Windows\System32\SDL.dll
[2011.12.07 21:29:59 | 001,849,344 | ---- | C] () -- C:\Windows\System32\Qt4Pas5.dll
[2011.11.07 14:35:00 | 000,080,732 | ---- | C] () -- C:\Windows\War3Unin.dat
[2011.06.02 02:30:01 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe
[2011.05.26 12:54:06 | 000,051,270 | ---- | C] () -- C:\Users\proce3d\AppData\Roaming\room_v3.dat
[2011.05.24 23:36:52 | 000,046,742 | ---- | C] () -- C:\Users\proce3d\AppData\Roaming\room.dat
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.03.11 16:29:01 | 000,007,640 | ---- | C] () -- C:\Users\proce3d\AppData\Local\Resmon.ResmonCfg
[2011.03.02 13:02:44 | 000,000,095 | ---- | C] () -- C:\Users\proce3d\AppData\Local\fusioncache.dat
[2010.12.30 22:23:49 | 000,000,997 | ---- | C] () -- C:\Windows\eReg.dat
[2010.11.05 02:42:56 | 000,000,000 | ---- | C] () -- C:\Users\proce3d\AppData\Local\Temptable.xml
[2010.10.23 13:02:58 | 000,000,000 | ---- | C] () -- C:\Windows\eDrawingOfficeAutomator.INI
[2010.10.21 17:54:19 | 000,000,162 | ---- | C] () -- C:\Windows\ODBC.INI
[2010.10.14 16:27:51 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
 
========== LOP Check ==========
 
[2012.01.25 18:03:39 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\.minecraft
[2011.12.08 19:19:45 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\Blender Foundation
[2012.04.15 17:59:17 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\DAEMON Tools Lite
[2011.12.27 20:58:08 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\Darkfall
[2012.03.07 17:30:56 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\DassaultSystemes
[2012.06.16 13:21:32 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\Dropbox
[2011.09.15 20:01:38 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\DVDVideoSoft
[2011.09.15 20:01:32 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.11.12 17:29:50 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\EDrawings
[2012.03.20 19:03:55 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\Etehi
[2011.01.31 12:26:11 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\gamesport
[2012.06.13 16:42:39 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\ICQ
[2011.12.24 17:46:53 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\Mount&Blade Warband
[2010.10.21 21:46:38 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\OpenOffice.org
[2011.12.01 22:18:28 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\SplitMediaLabs
[2012.05.30 14:59:20 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\TeamViewer
[2012.03.14 00:44:05 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\Tekou
[2012.04.24 15:45:35 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\TS3Client
[2012.03.20 18:14:29 | 000,000,000 | ---D | M] -- C:\Users\proce3d\AppData\Roaming\Xeesy
[2012.05.22 22:16:51 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 1305 bytes -> C:\Users\proce3d\Documents\Ryanair_Buchungsbestätigung_-_Nicht_vergessen_Sie_müssen_online_einchecken_und_Ihre_Bordkarte_ausdrucken.eml:OECustomProperty

< End of report >
--- --- ---
OTL Logfile:
Code:
OTL Extras logfile created on: 16.06.2012 13:23:34 - Run 2
OTL by OldTimer - Version 3.2.48.0    Folder = C:\Users\proce3d\Desktop
 Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,00 Gb Total Physical Memory | 1,75 Gb Available Physical Memory | 58,26% Memory free
5,99 Gb Paging File | 4,59 Gb Available in Paging File | 76,60% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 445,76 Gb Total Space | 261,07 Gb Free Space | 58,57% Space Free | Partition Type: NTFS
Drive D: | 19,99 Gb Total Space | 19,99 Gb Free Space | 100,00% Space Free | Partition Type: FAT32
 
Computer Name: PROCE3D-PC | User Name: proce3d | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{062D60DB-4162-4072-8570-E45620157DEC}" = lport=57165 | protocol=6 | dir=in | name=pando media booster |
"{0E538A21-092A-475C-A153-533A3A694ECA}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{216D9DED-ADF5-4C00-ABC8-F901675EABCE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2448CD09-A1AB-4748-8D04-B66A9537AC4C}" = rport=139 | protocol=6 | dir=out | app=system |
"{25172906-6225-46A7-BFAF-AC23F4DD4063}" = lport=139 | protocol=6 | dir=in | app=system |
"{2ACA8A01-E3EF-47B5-AC55-2E4469D19919}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{32C18568-C6E4-41B8-9972-587D9D9525AB}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{32C9E506-1F2F-4F1E-B950-2E1C26CD158A}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{55CF036D-05B7-4ACE-8FEC-DDCF9B6CF0E8}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{57CC7476-3703-4CE9-AC32-2444EC798F39}" = lport=57012 | protocol=6 | dir=in | name=pando media booster |
"{58F5E68B-D30F-4504-B966-C789B814B815}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{60931988-4733-4780-A09C-6A00369805C3}" = lport=445 | protocol=6 | dir=in | app=system |
"{66469922-F44F-4922-B2F0-82E418B7C68D}" = lport=57012 | protocol=6 | dir=in | name=pando media booster |
"{68207EC9-3A13-4A60-9A57-B6AF4D3F4601}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{71B58594-0B3D-4D7B-8EC1-8E29053A6DEE}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{7A3771BD-3BFB-4AAA-9D97-DF0489E10550}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7A7FD992-160A-49FE-A102-594C40C3EA98}" = lport=57012 | protocol=17 | dir=in | name=pando media booster |
"{8480C1FD-B08E-4EAF-848E-2CE899973300}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{88343BE5-8663-42DD-B055-5F5B2B0BA9F6}" = rport=137 | protocol=17 | dir=out | app=system |
"{8CA61ED2-00E3-4BC1-BDC9-274BE95E7A42}" = lport=57012 | protocol=17 | dir=in | name=pando media booster |
"{A08CEE15-C719-45CA-AFCF-6419A5C0C93F}" = rport=445 | protocol=6 | dir=out | app=system |
"{A77AB15E-3E1B-4431-851E-CAE178271553}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B281AF19-895D-4675-B2D7-495F64AF1574}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{BF1C0843-5533-4AA7-AB2E-212447585EED}" = lport=57165 | protocol=17 | dir=in | name=pando media booster |
"{C18E4602-9A7A-4322-9634-96B396003B15}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{D66B2411-E972-4365-9147-84D4C2330FCA}" = lport=137 | protocol=17 | dir=in | app=system |
"{E35AE067-B07A-42C3-B756-15D6415B3B0D}" = rport=138 | protocol=17 | dir=out | app=system |
"{E6A3A395-8234-4F6C-A80C-25B767B7032E}" = lport=6004 | protocol=17 | dir=in | app=c:\program files\microsoft office\office12\outlook.exe |
"{F0C12ED1-9ECC-48A7-B72D-AF2B27B8F0FF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F8ED441F-0936-4E2E-9C1A-431D95CC2B34}" = lport=138 | protocol=17 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{014BC8DA-B25F-45AF-8CAA-CD7DEE12FF80}" = protocol=17 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{0209668E-F626-4EA1-960E-9724C0046922}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{02DA1F55-9C6F-4605-84AB-F6776861F983}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{03237D75-4C15-4727-BED3-AFAF54B78202}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"{06D91848-CA01-4F7C-9719-80110E8D7ED4}" = protocol=6 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3.exe |
"{08BFAA63-7517-4DF9-9B04-8B6A899FB89C}" = protocol=17 | dir=in | app=c:\program files\microsoft games\age of empires iii\age3.exe |
"{0E5AFE67-C93A-4F64-A749-C88EBB96316F}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{1001F37F-C1BF-487E-BA97-00B96D99D4D5}" = protocol=6 | dir=in | app=c:\program files\diablo iii beta\diablo iii.exe |
"{12AA49C4-BA2E-4D4D-A183-9E93341531AF}" = protocol=6 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\gtaiv.exe |
"{1D45F26E-9055-4C37-BD62-F8D115D5D4B5}" = protocol=6 | dir=in | app=c:\program files\solidworks corp\solidworks\photoview\photoview360_cl.exe |
"{22298C91-D3CD-4C67-B7C6-B5719222BF65}" = protocol=6 | dir=in | app=c:\program files\turbine\the lord of the rings online\turbineinvoker.exe |
"{2251BF2F-6730-4378-BE7C-7DB76256D3B3}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"{27CD7F2A-3A31-4F64-9638-0C58B1F56DE8}" = protocol=17 | dir=in | app=c:\users\proce3d\desktop\minecraft.exe |
"{28120A0F-FF9B-4180-B512-B84A6DE7E845}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\christian9235\counter-strike\hl.exe |
"{2D0408DA-38D7-4556-810D-94F2B2E7A157}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{2F25B2C5-DFF1-4E13-BA63-F1379D21DB29}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe |
"{317F3A0D-74E4-4EB6-95EC-158A3AEB72D4}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{35EBBC47-866E-40C9-9567-F5A7904DC8E9}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{3849FA86-5B2D-409D-856B-07F4E2AB98B4}" = protocol=6 | dir=in | app=c:\users\proce3d\appdata\roaming\dropbox\bin\dropbox.exe |
"{3B5EC8A7-A044-47FC-80F1-33D08618A26A}" = protocol=17 | dir=in | app=c:\users\proce3d\appdata\roaming\dropbox\bin\dropbox.exe |
"{3BCB2919-E6BE-4326-AE24-0585E79F7743}" = protocol=17 | dir=in | app=c:\users\proce3d\desktop\lotroeu_enedwaith_de_downloader.exe |
"{3DE66CE4-4701-4E53-AF95-34A71C09CB58}" = protocol=17 | dir=in | app=c:\program files\dragon age\bin_ship\daorigins.exe |
"{4047440F-5099-4925-B25D-C012C1AC468F}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.649\agent.exe |
"{487E2388-5ED8-44B9-8485-3673C6BEE750}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{4CF00565-E04F-49E4-A115-D3F77FC7696F}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{548E14DE-1B73-4B14-A1D1-FAD32BB836B5}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{5A4D9CFD-8BCD-423D-8504-5F9B37FD7583}" = protocol=17 | dir=in | app=c:\program files\diablo iii beta\diablo iii.exe |
"{603316B4-D5F0-4612-9957-CC539B15CFF0}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{61385186-1408-4E88-AE4D-C7B7A741352B}" = protocol=17 | dir=in | app=c:\program files\solidworks corp\solidworks\photoview\photoview360_cl.exe |
"{629CE7FC-E38F-4187-93F7-6642A81BE186}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{7100C9A7-92F6-4980-89ED-83F56B8DC477}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{721B697D-8DBE-40F2-BB9A-E27BAB99A492}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{7482D5B0-1775-47F6-87A7-B08318932B9B}" = protocol=6 | dir=in | app=c:\program files\dragon age\bin_ship\daorigins.exe |
"{7606B425-090D-4F7D-A96C-420C9380EC47}" = protocol=6 | dir=in | app=c:\program files\dragon age\daoriginslauncher.exe |
"{7743FE7C-327B-43F2-BC63-FBC5F8C2340E}" = protocol=6 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"{7D7279A8-E6D9-4128-BD9D-E1234678E6DD}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{7D763AA2-341F-4FF9-9BB9-DF3BA58284CF}" = protocol=6 | dir=in | app=c:\program files\solidworks corp\solidworks\photoview\photoview360.exe |
"{7DA2FED5-4AFA-421C-A5C4-C25686213F0C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{8016AB2F-5B97-4CB3-9A5A-10E94340C0CC}" = protocol=6 | dir=in | app=c:\users\proce3d\desktop\lotroeu_enedwaith_de_downloader.exe |
"{877EAF3F-2CCD-4C4E-BC06-D555D8AF4F86}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{89A4925B-03D4-4B38-89B4-8360237CE019}" = protocol=6 | dir=in | app=c:\program files\solidworks corp\solidworks\swscheduler\dtscoordinatorservice.exe |
"{8B29EFCF-FE5B-4235-9453-328A2C503BA5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{8E924A8B-D59F-4BA0-8222-92F7D0D53B2A}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{92B38C8F-40A7-42A6-A8FD-D71D7E592D72}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{970B7211-34E7-457E-8C76-7A63E0007D30}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{99406352-8904-4911-A496-96B6E28F126F}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\christian9235\counter-strike\hl.exe |
"{A05B9706-9955-4485-B96C-EBD74E6B200C}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\christian9235\counter-strike\hl.exe |
"{A1CB45D9-E762-4DF7-ABAB-F3A64C9EBAF5}" = protocol=6 | dir=in | app=c:\program files\dragon age\bin_ship\daupdatersvc.service.exe |
"{A31AAA4D-286A-4058-8ABF-4F8915EB99A5}" = protocol=17 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\gtaiv.exe |
"{A8973B56-8302-4517-81FD-FE8925E20566}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe |
"{A981AC89-D741-4BFC-B075-4B4DAB7544AA}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\christian9235\counter-strike\hl.exe |
"{AA35638C-86AA-48C3-8323-C35D62811072}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{AAA9EAD7-9F0A-4EED-BA8A-0718EDBC5106}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{AC9304B7-EAE9-419A-A3DD-E1B9033A6DC2}" = protocol=17 | dir=in | app=c:\program files\solidworks corp\solidworks\swscheduler\dtscoordinatorservice.exe |
"{AF796DA7-EDBD-48CE-8850-7CD8F9B9A0AC}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\christian9235\counter-strike\hl.exe |
"{B48E4BB6-819C-4CFE-9144-92DA21FF80BA}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe |
"{B990B0AD-909C-4469-ACDC-F565A1D379C5}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{BFC24F3F-3BF9-4FEC-9337-C56D30D7BC35}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\dota 2 beta\dota.exe |
"{C29EDA6C-D714-4EB5-A2C4-B5F510C36B63}" = protocol=17 | dir=in | app=c:\program files\turbine\the lord of the rings online\turbineinvoker.exe |
"{CA6E0CE3-AAD2-45B2-82BE-0D9CBD6806FE}" = protocol=17 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"{CCAEC6BD-5A23-4D3B-ABB8-7851827425BA}" = protocol=17 | dir=in | app=c:\program files\solidworks corp\solidworks\photoview\photoview360.exe |
"{D086F889-A78D-4CBF-A768-F8BD0B038B1F}" = protocol=6 | dir=in | app=f:\neu\lan\cs cracked\cs1.6 lan version\hl.exe |
"{D11B8E19-8952-4CD6-9C98-CC020E58A132}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.649\agent.exe |
"{D1B2F507-2BB8-4884-BE06-222D30246868}" = protocol=17 | dir=in | app=c:\program files\dragon age\bin_ship\daupdatersvc.service.exe |
"{D589814C-C221-4589-89B3-7B48CEEE24B1}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{D950A8DD-9A84-46FF-8DC7-D95C90741EA8}" = protocol=6 | dir=in | app=c:\users\proce3d\desktop\minecraft.exe |
"{DF34D76C-9D80-4ACC-88C5-3B1ED802FEE9}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{E1C1E303-10FE-4A70-83FB-D9C03DB904A2}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{E568AD56-E50A-4A69-A4C1-67D9800A3DA3}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\christian9235\counter-strike\hl.exe |
"{E5D004CC-820D-488D-AF38-ED2F939D9352}" = protocol=17 | dir=in | app=c:\program files\dragon age\daoriginslauncher.exe |
"{E867E4F6-F59F-4143-8F08-2560F713B671}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\dota 2 beta\dota.exe |
"{EA14795C-530A-4077-A5AE-1BA8D6F514D4}" = protocol=6 | dir=in | app=c:\program files\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{EB41CC55-F30E-4B20-ABCB-A796723EE4BA}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe |
"{F3ACC1BB-BED9-47F8-A31A-C6157DE8E870}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{F4E59A3F-C809-467A-94EE-FD5752D48E44}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{FBE79980-8C87-4609-83A9-F0A883D280ED}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{FC1FC5ED-648D-46FD-8F29-932AC8A46F2C}" = protocol=17 | dir=in | app=f:\neu\lan\cs cracked\cs1.6 lan version\hl.exe |
"TCP Query User{02603CB5-2CFC-4832-BDDF-4C7D0D33BF2E}C:\program files\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files\warcraft iii\war3.exe |
"TCP Query User{0977041F-C19C-4CE2-9E71-0046E4F6B00A}C:\program files\hamachi\hamachi.exe" = protocol=6 | dir=in | app=c:\program files\hamachi\hamachi.exe |
"TCP Query User{0FB87C70-0067-4B51-866C-7990B2BFA47B}C:\program files\garena\garena.exe" = protocol=6 | dir=in | app=c:\program files\garena\garena.exe |
"TCP Query User{11722D8E-A6E3-4108-9DE8-3B3900EC83BE}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"TCP Query User{1AC6D338-AD65-40B0-BD43-FA8BF2B0AE9F}C:\program files\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files\warcraft iii\war3.exe |
"TCP Query User{1DDB9FCB-C5FE-4FC3-9532-189AF10A0E2A}C:\program files\turbine\der herr der ringe online\lotroclient.exe" = protocol=6 | dir=in | app=c:\program files\turbine\der herr der ringe online\lotroclient.exe |
"TCP Query User{1F703C71-193B-4601-B4FB-3FB75B37BE88}I:\lan\cs cracked\cs 1.6 cracked\cstrike.exe" = protocol=6 | dir=in | app=i:\lan\cs cracked\cs 1.6 cracked\cstrike.exe |
"TCP Query User{209CCF65-9AE3-4CF8-BE15-2AA4087642A4}C:\users\proce3d\appdata\local\temp\rar$ex06.012\gproxy.exe" = protocol=6 | dir=in | app=c:\users\proce3d\appdata\local\temp\rar$ex06.012\gproxy.exe |
"TCP Query User{2101C6E7-5686-4FD9-8AD5-E4223581E3DA}C:\users\proce3d\desktop\programme\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\users\proce3d\desktop\programme\mirc\mirc.exe |
"TCP Query User{256CEA24-DDF3-4BA7-BE96-6EC1E6CD0288}C:\users\proce3d\desktop\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\users\proce3d\desktop\mirc\mirc.exe |
"TCP Query User{2E80D3A1-0480-4673-91D0-D9635651D50B}C:\windows\system32\taskhost.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskhost.exe |
"TCP Query User{37553AFE-1198-4DFD-9CDD-C17353B648F9}F:\neu\lan\cs cracked\cs1.6 lan version\hl.exe" = protocol=6 | dir=in | app=f:\neu\lan\cs cracked\cs1.6 lan version\hl.exe |
"TCP Query User{47D77699-0128-4913-B591-26615C3D2E50}C:\users\proce3d\desktop\gproxy\gproxy.exe" = protocol=6 | dir=in | app=c:\users\proce3d\desktop\gproxy\gproxy.exe |
"TCP Query User{4C158F99-B30E-4AE4-8834-86B3730BC92C}C:\users\proce3d\lan\cs cracked\cs 1.6 cracked\cstrike.exe" = protocol=6 | dir=in | app=c:\users\proce3d\lan\cs cracked\cs 1.6 cracked\cstrike.exe |
"TCP Query User{4D500A76-44ED-47A0-8714-9F3877E2919A}F:\neu\lan\warcraft 3 lan version\war3.exe" = protocol=6 | dir=in | app=f:\neu\lan\warcraft 3 lan version\war3.exe |
"TCP Query User{4FA2C8F0-D6CF-442A-B737-919EEFD480D1}C:\windows\system32\java.exe" = protocol=6 | dir=in | app=c:\windows\system32\java.exe |
"TCP Query User{51D17B3B-4F88-40E8-87D3-FB8315EA2874}C:\users\proce3d\desktop\programme\gproxy\gproxy.exe" = protocol=6 | dir=in | app=c:\users\proce3d\desktop\programme\gproxy\gproxy.exe |
"TCP Query User{5667AB67-DFA4-4935-A698-286A17C97239}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{72B9FDFC-DD7E-498A-9BAA-1E11FD655CF6}C:\windows\system32\taskhost.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskhost.exe |
"TCP Query User{77E7AF36-FD6E-4AC1-B4CA-5A62DCA7F145}C:\program files\steam\steamapps\common\dota 2 beta\dota.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\dota 2 beta\dota.exe |
"TCP Query User{86E3BE2A-F0CC-4607-BE6D-3AA5419147DE}C:\program files\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"TCP Query User{88F4F728-09C5-461B-9E09-6AA5F8A2493D}C:\users\proce3d\desktop\ranked gaming client\rgc.exe" = protocol=6 | dir=in | app=c:\users\proce3d\desktop\ranked gaming client\rgc.exe |
"TCP Query User{8CF73791-9332-4DA8-BBEB-53E61462014A}I:\lan\cs cracked\cs1.6 lan version\hl.exe" = protocol=6 | dir=in | app=i:\lan\cs cracked\cs1.6 lan version\hl.exe |
"TCP Query User{986FDBF7-DA09-47AC-80E4-EAAB91A92AE2}C:\users\proce3d\lan\cs cracked\cs1.6 lan version\hl.exe" = protocol=6 | dir=in | app=c:\users\proce3d\lan\cs cracked\cs1.6 lan version\hl.exe |
"TCP Query User{9C974432-7059-461E-A831-B953234E9EA3}C:\program files\diablo iii\diablo iii.exe" = protocol=6 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"TCP Query User{A0B8BB39-5913-4DE3-B8FD-C85DF72A5505}C:\program files\dotalicious gaming client\client.exe" = protocol=6 | dir=in | app=c:\program files\dotalicious gaming client\client.exe |
"TCP Query User{A8B57E73-614A-4FD5-89EA-DD4EB0CFA253}C:\users\proce3d\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\proce3d\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{AF559AFD-9730-4A10-A95E-4228940CDEB1}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"TCP Query User{D867B751-B949-48E8-A3D2-714D80FEF65C}C:\program files\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"TCP Query User{E3FE3FC7-9D43-42A6-A892-971A52B239D8}C:\program files\funcom\age of conan\ageofconan.exe" = protocol=6 | dir=in | app=c:\program files\funcom\age of conan\ageofconan.exe |
"TCP Query User{E85FEC86-6FF3-47CE-B450-24A967046AE7}C:\program files\funcom\age of conan\conanpatcher.exe" = protocol=6 | dir=in | app=c:\program files\funcom\age of conan\conanpatcher.exe |
"TCP Query User{E96BF7E9-3367-4806-AE58-7509F6782DF7}C:\program files\starcraft ii\versions\base16755\sc2.exe" = protocol=6 | dir=in | app=c:\program files\starcraft ii\versions\base16755\sc2.exe |
"UDP Query User{054544A4-2AAB-4481-8B25-624B9202523C}C:\windows\system32\taskhost.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskhost.exe |
"UDP Query User{0A23D8DC-8F1C-47AF-B944-60513789FB90}C:\users\proce3d\desktop\programme\gproxy\gproxy.exe" = protocol=17 | dir=in | app=c:\users\proce3d\desktop\programme\gproxy\gproxy.exe |
"UDP Query User{0AE4C496-76D7-471D-9474-D8B5C0772F35}I:\lan\cs cracked\cs1.6 lan version\hl.exe" = protocol=17 | dir=in | app=i:\lan\cs cracked\cs1.6 lan version\hl.exe |
"UDP Query User{12DC40BA-65DA-4A52-B70F-AD10EB5A0A91}C:\users\proce3d\lan\cs cracked\cs 1.6 cracked\cstrike.exe" = protocol=17 | dir=in | app=c:\users\proce3d\lan\cs cracked\cs 1.6 cracked\cstrike.exe |
"UDP Query User{2A84EE46-D119-4AFD-91A6-CE72D0A947EA}C:\program files\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"UDP Query User{2F1FA47C-7C87-4F48-ABDB-9711EEAD0CD5}C:\program files\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files\warcraft iii\war3.exe |
"UDP Query User{413DEA06-CC9B-4F02-A968-5DD83A4EF9CA}C:\users\proce3d\appdata\local\temp\rar$ex06.012\gproxy.exe" = protocol=17 | dir=in | app=c:\users\proce3d\appdata\local\temp\rar$ex06.012\gproxy.exe |
"UDP Query User{42C044BA-63D4-4A23-97E7-C1B1DE0BBD56}F:\neu\lan\warcraft 3 lan version\war3.exe" = protocol=17 | dir=in | app=f:\neu\lan\warcraft 3 lan version\war3.exe |
"UDP Query User{511006A0-0B9A-4CDB-86C8-CC28127D0916}C:\windows\system32\taskhost.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskhost.exe |
"UDP Query User{62C91D82-668D-4C40-A0BA-9A329E8C95F1}C:\program files\garena\garena.exe" = protocol=17 | dir=in | app=c:\program files\garena\garena.exe |
"UDP Query User{6967455D-790D-4759-B255-F5B119FA39D4}C:\program files\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files\warcraft iii\war3.exe |
"UDP Query User{69F3EF75-27CC-43EE-BC70-E1F95B2DBACA}C:\windows\system32\java.exe" = protocol=17 | dir=in | app=c:\windows\system32\java.exe |
"UDP Query User{6C11A182-CDDF-4206-A738-CA18F0790D07}C:\users\proce3d\desktop\programme\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\users\proce3d\desktop\programme\mirc\mirc.exe |
"UDP Query User{6E459C35-0CDF-4516-BDCE-276D2FCA53D0}C:\program files\funcom\age of conan\ageofconan.exe" = protocol=17 | dir=in | app=c:\program files\funcom\age of conan\ageofconan.exe |
"UDP Query User{73A6B222-D8C7-4F7F-9D71-269C555FD22E}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"UDP Query User{A0E114FD-9A09-4EC7-AD57-27EB4CF098F5}I:\lan\cs cracked\cs 1.6 cracked\cstrike.exe" = protocol=17 | dir=in | app=i:\lan\cs cracked\cs 1.6 cracked\cstrike.exe |
"UDP Query User{A2CA11E9-4BBB-456A-911A-8BCFE5BBE5A2}C:\program files\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\java.exe |
"UDP Query User{A37A5631-26ED-4034-98BC-418334538D4D}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{A42186ED-7BBD-4486-BAA7-80834865B2BD}C:\users\proce3d\desktop\gproxy\gproxy.exe" = protocol=17 | dir=in | app=c:\users\proce3d\desktop\gproxy\gproxy.exe |
"UDP Query User{B1B6CF9E-014E-44E4-90CE-A09D2AB4C788}C:\users\proce3d\lan\cs cracked\cs1.6 lan version\hl.exe" = protocol=17 | dir=in | app=c:\users\proce3d\lan\cs cracked\cs1.6 lan version\hl.exe |
"UDP Query User{B3A8B956-5808-497E-BA51-0C1CECCB4CCF}C:\program files\starcraft ii\versions\base16755\sc2.exe" = protocol=17 | dir=in | app=c:\program files\starcraft ii\versions\base16755\sc2.exe |
"UDP Query User{B9E06824-5DD7-4CF2-850E-AEE42BE547A6}C:\program files\funcom\age of conan\conanpatcher.exe" = protocol=17 | dir=in | app=c:\program files\funcom\age of conan\conanpatcher.exe |
"UDP Query User{BB66B720-7314-40D7-BDB7-6D8BF5D4135A}C:\users\proce3d\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\proce3d\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{BCB32FC7-838B-482D-A909-1C199FC7D8EA}C:\program files\steam\steamapps\common\dota 2 beta\dota.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\dota 2 beta\dota.exe |
"UDP Query User{BEA1DFFE-89FF-4D7F-96CD-F87F9CADE5D4}C:\program files\turbine\der herr der ringe online\lotroclient.exe" = protocol=17 | dir=in | app=c:\program files\turbine\der herr der ringe online\lotroclient.exe |
"UDP Query User{C54B745F-CCBD-4F1E-A64C-D271740DDBB9}C:\program files\dotalicious gaming client\client.exe" = protocol=17 | dir=in | app=c:\program files\dotalicious gaming client\client.exe |
"UDP Query User{DE1419C6-6EE5-4106-8964-F2EED13DCB50}C:\users\proce3d\desktop\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\users\proce3d\desktop\mirc\mirc.exe |
"UDP Query User{EFB89524-3D1A-4FC2-AB08-8C97ADD03512}C:\programdata\battle.net\agent\agent.998\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"UDP Query User{F16CCC5B-4F80-4973-B369-FFE36B782906}F:\neu\lan\cs cracked\cs1.6 lan version\hl.exe" = protocol=17 | dir=in | app=f:\neu\lan\cs cracked\cs1.6 lan version\hl.exe |
"UDP Query User{FADA8547-4CCA-42EE-A21C-267CD5EEFB14}C:\users\proce3d\desktop\ranked gaming client\rgc.exe" = protocol=17 | dir=in | app=c:\users\proce3d\desktop\ranked gaming client\rgc.exe |
"UDP Query User{FD4DF0E4-087D-4FAD-BF5F-BE4BECB86512}C:\program files\hamachi\hamachi.exe" = protocol=17 | dir=in | app=c:\program files\hamachi\hamachi.exe |
"UDP Query User{FDA7147E-B752-43F3-AFC5-687D6652A2BC}C:\program files\diablo iii\diablo iii.exe" = protocol=17 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{035400A4-29BD-3723-BEED-E2718A68CDE0}" = Microsoft Visual Studio 2010 Office Developer Tools (x86)
"{03A4C6A1-26E9-4DDB-81D9-B332E5BB10AD}" = Microsoft Sync Framework SDK v1.0 SP1 de
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0F37D969-1260-419E-B308-EF7D29ABDE20}" = Web Deployment Tool
"{1570DE88-A78A-37FD-8A05-92620D160CCA}" = Microsoft Visual Studio 2010 Office Developer Tools (x86) Language Pack - DEU
"{1803A630-3C38-4D2B-9B9A-0CB37243539C}" = Microsoft ASP.NET MVC 2
"{1C2B3CEA-482E-4453-B3E2-C9731337828A}" = Microsoft SQL Server 2008 Native Client
"{1C4551A6-4743-4093-91E4-1477CD655043}" = NVIDIA PhysX
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217002FF}" = Java(TM) 7 Update 2
"{31C3C6EA-E991-405F-A3AA-2C070CCCC47C}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools - DEU
"{33AE9E89-47C9-4A0D-9E9D-BDD6966A3804}" = Microsoft SQL Server 2008 RsFx Driver
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{40416836-56CC-4C0E-A6AF-5C34BADCE483}" = Microsoft ASP.NET MVC 2 - Visual Studio 2010 Tools
"{4135C790-0387-36D7-9C2A-1B09A5900460}" = Microsoft Visual Studio 2010 Ultimate - DEU
"{41A01180-D9FD-3428-9FD6-749F4C637CBF}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"{43B74FAB-FB58-447D-8D3A-5F638AF36FD1}" = Netzmanager
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{477415F5-93DA-46AA-85C5-640047825995}" = Microsoft SQL Server 2008 Database Engine Shared
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A6F34E2-09E5-4616-B227-4A26A488A6F9}" = Microsoft SQL Server 2008 Common Files
"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{5242B252-01BB-4F2E-BBF4-5C01BC3B6619}" = Microsoft SQL Server 2008 R2 Data-Tier Application Project
"{5454083B-1308-4485-BF17-1110000D8301}" = Grand Theft Auto IV
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5BD39911-A12F-4562-98BA-A6E03E3370B1}" = Microsoft SQL Server 2008 Database Engine Services
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{67C6633B-5A12-4955-A5E4-98D703F9AFA3}" = SolidWorks eDrawings 2011 SP02
"{681F4E9F-34E0-36BD-BF2C-100554E403A5}" = Microsoft Visual F# 2.0 Runtime Language Pack - DEU
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6A86554B-8928-30E4-A53C-D7337689134D}" = Microsoft Visual C++ 2010  x86 Runtime - 10.0.30319
"{6B1A1AD8-301F-46A8-9AB3-816AD02EE752}" = XSplit
"{6CDEAD7E-F8D8-37F7-AB6F-1E22716E30F3}" = Microsoft Visual Studio Macro Tools
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{729A3000-BC8A-3B74-BA5D-5068FE12D70C}" = Microsoft Visual F# 2.0 Runtime
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7BEC151D-ADA9-3EA9-9273-99BA82881971}" = Microsoft Visual Studio 2010 SharePoint Developer Tools
"{85725958-E3A1-4D0F-862B-4CE4EDC71A5E}_is1" = Minecraft Note Block Studio version 3.1.1
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8EAA9D70-C912-3708-92DD-0CCC26F386E1}" = Microsoft Visual Studio 2010 Performance Collection Tools - DEU
"{90120000-0011-0000-0000-0000000FF1CE}" = Microsoft Office Professional Plus 2007
"{90120000-0011-0000-0000-0000000FF1CE}_PROPLUS_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0015-0424-0000-0000000FF1CE}" = Microsoft Office Access MUI (Slovenian) 2007
"{90120000-0015-0424-0000-0000000FF1CE}_PROPLUS_{DE6F6651-39D5-44FA-96FD-647D5B3A3093}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0424-0000-0000000FF1CE}" = Microsoft Office Excel MUI (Slovenian) 2007
"{90120000-0016-0424-0000-0000000FF1CE}_PROPLUS_{DE6F6651-39D5-44FA-96FD-647D5B3A3093}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0017-0407-0000-0000000FF1CE}" = Microsoft Office SharePoint Designer MUI (German) 2007
"{90120000-0017-0407-0000-0000000FF1CE}_OMUI.de-de_{2733AA87-26FC-41B0-9D2F-3092345BC370}" = Microsoft Office SharePoint Designer 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0424-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (Slovenian) 2007
"{90120000-0018-0424-0000-0000000FF1CE}_PROPLUS_{DE6F6651-39D5-44FA-96FD-647D5B3A3093}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0424-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (Slovenian) 2007
"{90120000-0019-0424-0000-0000000FF1CE}_PROPLUS_{DE6F6651-39D5-44FA-96FD-647D5B3A3093}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0424-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (Slovenian) 2007
"{90120000-001A-0424-0000-0000000FF1CE}_PROPLUS_{DE6F6651-39D5-44FA-96FD-647D5B3A3093}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0424-0000-0000000FF1CE}" = Microsoft Office Word MUI (Slovenian) 2007
"{90120000-001B-0424-0000-0000000FF1CE}_PROPLUS_{DE6F6651-39D5-44FA-96FD-647D5B3A3093}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_OMUI.de-de_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_PROPLUS_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}_VISPROR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_OMUI.de-de_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_PROPLUS_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}_VISPROR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_OMUI.de-de_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}_VISPROR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_OMUI.de-de_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_PROPLUS_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}_VISPROR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-041A-0000-0000000FF1CE}" = Microsoft Office Proof (Croatian) 2007
"{90120000-001F-041A-0000-0000000FF1CE}_PROPLUS_{9DECF714-4963-48E2-924A-B9075485AF6B}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0424-0000-0000000FF1CE}" = Microsoft Office Proof (Slovenian) 2007
"{90120000-001F-0424-0000-0000000FF1CE}_PROPLUS_{8FF4ED5D-9EA1-4EC5-8F10-767E1705310C}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-002C-0424-0000-0000000FF1CE}" = Microsoft Office Proofing (Slovenian) 2007
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0424-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (Slovenian) 2007
"{90120000-0044-0424-0000-0000000FF1CE}_PROPLUS_{DE6F6651-39D5-44FA-96FD-647D5B3A3093}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0054-0407-0000-0000000FF1CE}" = Microsoft Office Visio MUI (German) 2007
"{90120000-0054-0407-0000-0000000FF1CE}_VISPROR_{3CB0380B-0413-4C44-A63B-DCD6369EAF4E}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_OMUI.de-de_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}_VISPROR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0424-0000-0000000FF1CE}" = Microsoft Office Shared MUI (Slovenian) 2007
"{90120000-006E-0424-0000-0000000FF1CE}_PROPLUS_{455248D4-FBA8-4C55-AB56-3F209028D7B5}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A4-0409-0000-0000000FF1CE}" = Microsoft Office 2003 Web Components
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0100-0407-0000-0000000FF1CE}" = Microsoft Office O MUI (German) 2007
"{90120000-0100-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0101-0407-0000-0000000FF1CE}" = Microsoft Office X MUI (German) 2007
"{90120000-0101-0407-0000-0000000FF1CE}_OMUI.de-de_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In
"{91120000-0051-0000-0000-0000000FF1CE}" = Microsoft Office Visio Professional 2007
"{91120000-0051-0000-0000-0000000FF1CE}_VISPROR_{CE144BF4-4950-4CDB-A5F7-CCE1888F49CB}" = Microsoft Office Visio 2007 Service Pack 3 (SP3)
"{91F54E1D-804A-46D8-A56C-53EA9C4B3177}" = Microsoft Silverlight 3 SDK - Deutsch
"{929F5BFC-60F0-34EC-A50B-2001AAC03D56}" = Microsoft Team Foundation Server 2010 Object Model - DEU
"{92C5C058-E941-47C3-B7E8-38A79C605969}" = Microsoft SQL Server 2008 R2 Transact-SQL Language Service
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AA2D735-3375-42D4-9A61-3FFEF82599D6}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C3B8582-A72A-4835-8903-877A834407BB}" = Microsoft SQL Server 2008 R2-Datenebenenanwendungs-Framework
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A51B8787-B1C1-4A24-856C-D79BD4F6ADFC}" = SolidWorks 2011 German Resources
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AC41D924-8C68-4BD5-A7A1-0AE4176C31A6}" = Crystal Reports for Visual Studio
"{AC524B17-B82D-414A-B2E2-C38DC4ABF5C9}" = Darkfall
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{ACE28263-76A4-4BF5-B6F4-8BD719595969}" = Microsoft SQL Server Database Publishing Wizard 1.4
"{B5153233-9AEE-4CD4-9D2C-4FAAC870DBE2}" = Microsoft SQL Server 2008 Database Engine Services
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{C965F01C-76EA-4BD7-973E-46236AE312D7}" = Sql Server Customer Experience Improvement Program
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D074DC76-F6C9-440E-A1D0-1DE958417FDB}" = Microsoft SQL Server VSS Writer
"{D0D3BFE5-5215-41BD-B82E-81D7FB6A9166}" = SolidWorks 2011 SP02
"{D481EA96-2313-4A7C-98EE-710D1AF884AC}" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"{D6A6CFAD-CD86-482B-90D1-6FCC4E252ACD}" = Microsoft Sync Services for ADO.NET v2.0 SP1 (x86) de
"{DB0AF767-7CC7-4E4D-B6BE-A200F20A2FB1}" = Microsoft Sync Framework Runtime v1.0 SP1 (x86) de
"{DBE8431C-CF9A-38C3-B42D-28B6FCE1EA3B}" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU
"{DF5A03CC-D5AA-43D8-B948-D9903F2AF94A}" = Counter-Strike(TM)
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4E9CBC9-1CF5-48E3-AF6F-1AB44A856346}" = Microsoft ASP.NET MVC 2 - DEU
"{EAF7B35C-DCBE-4032-9ABF-C35C43D07124}" = Microsoft Sync Framework Services v1.0 SP1 (x86) de
"{EC66418E-DAA2-36D5-809E-40BEC94E622A}" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F3494AB6-6900-41C6-AF57-823626827ED8}" = Microsoft SQL Server 2008 Database Engine Shared
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FF6F95A4-E59B-45C8-BEA8-0BDC8D9CAB51}" = Microsoft SQL Server 2008 Common Files
"12bbe590-c890-11d9-9669-0800200c9a66_is1" = Der Herr der Ringe Online v03.05.01.8027
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"Blender" = Blender
"CCleaner" = CCleaner
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo III" = Diablo III
"Diablo III Beta" = Diablo III Beta
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.9.908
"Garena" = Garena 2010
"IDroo" = IDroo 1.0.0.154
"Lazarus_is1" = Lazarus 0.9.12
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft SQL Server 10" = Microsoft SQL Server 2008
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008
"Microsoft Team Foundation Server 2010 Object Model - DEU" = Microsoft Team Foundation Server 2010-Objektmodell - DEU
"Microsoft Visual Studio 2005 Tools for Applications - ENU" = Microsoft Visual Studio 2005 Tools for Applications - ENU
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86)" = Microsoft Visual Studio 2010 Tools for Office Runtime (x86)
"Microsoft Visual Studio 2010 Tools for Office Runtime (x86) Language Pack - DEU" = Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x86) Language Pack - DEU
"Microsoft Visual Studio 2010 Ultimate - DEU" = Microsoft Visual Studio 2010 Ultimate - DEU
"Microsoft Visual Studio Macro Tools" = Microsoft Visual Studio Macro Tools
"Microsoft Visual Studio Macro Tools - DEU Language Pack" = Microsoft Visual Studio Macro Tools - DEU Language Pack
"Mount&Blade Warband" = Mount&Blade Warband
"Mozilla Firefox 12.0 (x86 de)" = Mozilla Firefox 12.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"Netzmanager" = Netzmanager
"NVIDIA Drivers" = NVIDIA Drivers
"OMUI.de-de" = Microsoft Office Language Pack 2007 - German/Deutsch
"Postal 2_is1" = Portal 2
"PROPLUS" = Microsoft Office Professional Plus 2007
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"SolidWorks Installation Manager 20110-40200-1100-200" = SolidWorks 2011 SP02
"StarCraft II" = StarCraft II
"Steam App 570" = Dota 2
"Sweet Home 3D_is1" = Sweet Home 3D version 3.3
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TinyCAD" = TinyCAD 2.80.03
"VISPROR" = Microsoft Office Visio Professional 2007
"VLC media player" = VLC media player 1.1.11
"Warcraft III" = Warcraft III
"Warkeys" = Warkeys 1.18.1.0b
"WinRAR archiver" = WinRAR
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"mIRC" = mIRC
"Warcraft III" = Warcraft III: All Products
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 26.09.2011 05:40:33 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:33 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:33 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:33 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:33 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:33 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:33 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:33 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:34 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
Error - 26.09.2011 05:40:34 | Computer Name = proce3d-PC | Source = Microsoft-Windows-CAPI2 | ID = 4107
Description = Fehler beim Extrahieren der Drittanbieterstammliste aus der automatischen
 Aktualisierungs-CAB-Datei bei <hxxp://www.download.windowsupdate.com/msdownload/update/v3/static/trustedr/en/authrootstl.cab>.
 Fehler: Ein erforderliches Zertifikat befindet sich nicht im Gültigkeitszeitraum
 gemessen an der aktuellen Systemzeit oder dem Zeitstempel in der signierten Datei.
.
 
[ OSession Events ]
Error - 05.04.2011 13:14:21 | Computer Name = proce3d-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 7011
 seconds with 60 seconds of active time.  This session ended with a crash.
 
Error - 05.04.2011 17:53:53 | Computer Name = proce3d-PC | Source = Microsoft Office 12 Sessions | ID = 7001
Description = ID: 0, Application Name: Microsoft Office Word, Application Version:
 12.0.6545.5000, Microsoft Office Version: 12.0.6425.1000. This session lasted 5656
 seconds with 1380 seconds of active time.  This session ended with a crash.
 
[ System Events ]
Error - 16.06.2012 05:39:27 | Computer Name = proce3d-PC | Source = Application Popup | ID = 875
Description = Treiber sfvfs02.sys konnte nicht geladen werden.
 
Error - 16.06.2012 05:39:27 | Computer Name = proce3d-PC | Source = Application Popup | ID = 875
Description = Treiber sfdrv01.sys konnte nicht geladen werden.
 
Error - 16.06.2012 05:39:43 | Computer Name = proce3d-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem
 Fehler beendet:  %%-2147014847
 
Error - 16.06.2012 05:40:18 | Computer Name = proce3d-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  sfdrv01  sfvfs02
 
Error - 16.06.2012 07:19:51 | Computer Name = proce3d-PC | Source = Service Control Manager | ID = 7016
Description = Der Dienst "NVIDIA Display Driver Service" hat einen ungültigen aktuellen
 Status gemeldet: 32
 
Error - 16.06.2012 07:20:29 | Computer Name = proce3d-PC | Source = Application Popup | ID = 875
Description = Treiber sfvfs02.sys konnte nicht geladen werden.
 
Error - 16.06.2012 07:20:29 | Computer Name = proce3d-PC | Source = Application Popup | ID = 875
Description = Treiber sfdrv01.sys konnte nicht geladen werden.
 
Error - 16.06.2012 07:20:45 | Computer Name = proce3d-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde mit folgendem
 Fehler beendet:  %%-2147014847
 
Error - 16.06.2012 07:21:10 | Computer Name = proce3d-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  sfdrv01  sfvfs02
 
Error - 16.06.2012 07:29:15 | Computer Name = proce3d-PC | Source = VDS Basic Provider | ID = 33554433
Description =
 
 
< End of report >
--- --- ---

[/Code]

5. Meine Dateien wurde noch nicht verschlüsselt, es wurde nur mein Bildschrim gesperrt.

kira 16.06.2012 21:08
Zitat:
lan\cs cracked\cs1.6 lan version\hl.exe
-> Forumregel!


Alle Zeitangaben in WEZ +1. Es ist jetzt 16:40 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131