GVU Trojaner - OTL Logs
Hallo,
also ich habe mir gestern den GVU Trojaner eingefangen und habe mich dann etwas schlau gemacht wie ich den entfernt bekomme, habe dann die Anleitung hier befolgt --> http://www.trojaner-board.de/112119-...entfernen.html
Der GVU Trojaner ist nun weg, aber um sicher zu gehen soll ich noch einmal die Logs hier reinstellen
Soo einmal den vollständigen Malwarebytes Anti-Malware Log : Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org
Datenbank Version: v2012.06.29.06
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8080.16413
*** :: ***-PC [Administrator]
Schutz: Aktiviert
29.06.2012 12:21:30
mbam-log-2012-06-29 (13-47-18).txt
Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 404648
Laufzeit: 1 Stunde(n), 25 Minute(n), 30 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 5
HKCR\CLSID\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{20C28584-8F10-4D92-987C-0A1008E2435A} (Trojan.Agent) -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F99BD4F5-D402-4c21-A8BC-510830B6BE37} (Trojan.Banker) -> Keine Aktion durchgeführt.
Infizierte Registrierungswerte: 2
HKCU\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon|Shell (Hijack.Shell.Gen) -> Daten: C:\Users\***\AppData\Roaming\w6j6rt45jtuhdre5.exe -> Keine Aktion durchgeführt.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run|Userinit (Trojan.Agent) -> Daten: C:\Users\***\AppData\Roaming\appconf32.exe -> Keine Aktion durchgeführt.
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)
(Ende)
Die gefundenen Malwares hab ich entfernt und hab dann OTL gestartet !
Und hier einmal der OTL Log: Code:
OTL logfile created on: 29.06.2012 13:53:49 - Run 2
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\***\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8080.16413)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,87 Gb Total Physical Memory | 0,99 Gb Available Physical Memory | 52,87% Memory free
3,74 Gb Paging File | 2,78 Gb Available in Paging File | 74,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 677,54 Gb Total Space | 632,87 Gb Free Space | 93,41% Space Free | Partition Type: NTFS
Drive D: | 20,00 Gb Total Space | 13,54 Gb Free Space | 67,68% Space Free | Partition Type: NTFS
Computer Name: ***-PC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Programme\Opera\opera.exe (Opera Software)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Programme\Adobe\Reader 10.0\Reader\reader_sl.exe (Adobe Systems Incorporated)
PRC - C:\Programme\Microsoft Security Client\msseces.exe (Microsoft Corporation)
PRC - c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
PRC - C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\PrintIsolationHost.exe (Microsoft Corporation)
PRC - C:\Programme\Brother\Brmfcmon\BrMfcMon.exe (Brother Industries, Ltd.)
========== Modules (No Company Name) ==========
MOD - C:\Programme\Brother\BrUtilities\BrLogAPI.dll ()
========== Win32 Services (SafeList) ==========
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (NisSrv) -- c:\Programme\Microsoft Security Client\NisSrv.exe (Microsoft Corporation)
SRV - (MsMpSvc) -- c:\Programme\Microsoft Security Client\MsMpEng.exe (Microsoft Corporation)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (uxddrv) -- F:\uxddrv86.sys File not found
DRV - (MBAMSwissArmy) -- C:\Windows\System32\drivers\mbamswissarmy.sys (Malwarebytes Corporation)
DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation)
DRV - (NisDrv) -- C:\Windows\System32\drivers\NisDrvWFP.sys (Microsoft Corporation)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://dsl-start.computerbild.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://dsl-start.computerbild.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7F 3D 7D 63 78 54 CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_3_300_262.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
O1 HOSTS File: ([2009.06.10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [MSC] c:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4 - HKCU..\Run: [Azzei] C:\Users\***\AppData\Roaming\Umoce\vyuxp.exe ()
O4 - HKCU..\Run: [bC4lJzJAS4eHdGa] C:\Users\***\AppData\Roaming\w6j6rt45jtuhdre5.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O13 - gopher Prefix: missing
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} hxxp://download.divx.com/player/DivXBrowserPlugin.cab (Reg Error: Key error.)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {C8BC46C7-921C-4102-B67D-F1F7E65FB0BE} https://battlefield.play4free.com/static/updater/BP4FUpdater_1.0.66.2.cab (Battlefield Play4Free Updater)
O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{273B9F28-C4E5-45B4-97FB-AC18D4606B99}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\ms-itss {0A9007C0-4076-11D3-8789-0000F8105754} - C:\Programme\Common Files\microsoft shared\Information Retrieval\msitss.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found
O20 - HKCU Winlogon: UserInit - (C:\Users\Nuri Ayiz\AppData\Roaming\w6j6rt45jtuhdre5.exe) - File not found
O20 - HKCU Winlogon: UserInit - (C:\WINDOWS\System32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{aa2528c8-2ca7-11e1-a24f-6c626d05b73c}\Shell - "" = AutoRun
O33 - MountPoints2\{aa2528c8-2ca7-11e1-a24f-6c626d05b73c}\Shell\AutoRun\command - "" = G:\CD_Start.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2012.06.29 12:16:12 | 000,040,776 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.06.29 12:16:12 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Malwarebytes
[2012.06.29 12:16:08 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.06.29 12:16:01 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.06.29 12:16:00 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2012.06.29 12:16:00 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012.06.29 11:51:51 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Nuri Ayiz\Desktop\OTL.exe
[2012.06.29 11:44:57 | 000,000,000 | ---D | C] -- C:\Kaspersky Rescue Disk 10.0
[2012.06.28 14:01:55 | 000,000,000 | ---D | C] -- C:\ProgramData\F4D55F3B0079246B0142EF0FB4EB23C1
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Umoce
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Ifboe
[2012.06.28 14:01:47 | 000,000,000 | ---D | C] -- C:\Users\Nuri Ayiz\AppData\Roaming\Edygc
[2012.06.23 19:09:51 | 002,422,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012.06.23 19:09:51 | 000,045,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012.06.23 19:09:31 | 000,577,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012.06.23 19:09:31 | 000,088,576 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012.06.23 19:09:31 | 000,035,864 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012.06.23 19:09:20 | 000,171,904 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012.06.23 19:09:20 | 000,033,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012.06.15 09:37:41 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.06.14 10:17:38 | 002,343,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2012.06.14 10:17:37 | 000,129,536 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpcorekmts.dll
[2012.06.14 10:17:37 | 000,058,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdpwsx.dll
[2012.06.14 10:17:36 | 000,008,192 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\rdrmemptylst.exe
[2012.06.01 16:35:31 | 000,162,304 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2012.06.01 16:35:31 | 000,161,280 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2012.06.01 16:35:31 | 000,130,560 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2012.06.01 16:35:31 | 000,110,592 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2012.06.01 16:35:31 | 000,076,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2012.06.01 16:35:31 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2012.06.01 16:35:31 | 000,064,512 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.06.01 16:35:31 | 000,048,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2012.06.01 16:35:30 | 003,695,416 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2012.06.01 16:35:30 | 001,426,432 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.06.01 16:35:30 | 000,580,096 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.06.01 16:35:30 | 000,434,176 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012.06.01 16:35:30 | 000,367,104 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.06.01 16:35:30 | 000,356,664 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.06.01 16:35:30 | 000,353,792 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2012.06.01 16:35:30 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.06.01 16:35:30 | 000,223,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2012.06.01 16:35:30 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.06.01 16:35:30 | 000,152,064 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2012.06.01 16:35:30 | 000,150,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2012.06.01 16:35:30 | 000,086,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.06.01 16:35:30 | 000,078,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2012.06.01 16:35:30 | 000,074,752 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.06.01 16:35:30 | 000,074,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.06.01 16:35:30 | 000,031,744 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.06.01 16:35:30 | 000,023,552 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.06.01 16:35:29 | 002,382,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.06.01 16:35:29 | 001,791,488 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.06.01 16:35:29 | 000,227,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2012.06.01 16:35:29 | 000,163,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2012.06.01 16:35:29 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.06.01 16:35:29 | 000,117,760 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.06.01 16:35:29 | 000,101,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2012.06.01 16:35:29 | 000,054,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2012.06.01 16:35:29 | 000,041,472 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.06.01 16:35:29 | 000,035,840 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2012.06.01 16:35:29 | 000,010,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[2012.06.01 16:34:12 | 000,000,000 | ---D | C] -- C:\Program Files\Feedback Tool
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\Nuri Ayiz\AppData\Roaming\*.tmp files -> C:\Users\Nuri Ayiz\AppData\Roaming\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2012.06.29 13:53:05 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.06.29 13:53:01 | 1507,778,560 | -HS- | M] () -- C:\hiberfil.sys
[2012.06.29 13:26:13 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.06.29 12:48:06 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.06.29 12:48:06 | 000,009,696 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.06.29 12:43:38 | 000,001,919 | ---- | M] () -- C:\Users\***\Desktop\Microsoft Security Essentials.lnk
[2012.06.29 12:21:03 | 000,040,776 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2012.06.29 12:16:08 | 000,001,075 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.29 11:54:50 | 000,656,250 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.06.29 11:54:50 | 000,618,132 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.06.29 11:54:50 | 000,131,022 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.06.29 11:54:50 | 000,107,412 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.06.29 11:51:53 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2012.06.28 14:07:36 | 000,000,051 | ---- | M] () -- C:\Users\***\AppData\Roaming\blckdom.res
[2012.06.28 12:37:06 | 000,014,208 | ---- | M] () -- C:\Users\***\Desktop\Angebot für PRONTO PIZZERIA ERWITTE.odt
[2012.06.23 11:03:35 | 000,014,112 | ---- | M] () -- C:\Users\***\Documents\Angebot für Lieth Grill Paderborn.odt
[2012.06.23 09:26:08 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerApp.exe
[2012.06.23 09:26:08 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl
[2012.06.21 12:21:13 | 000,026,650 | ---- | M] () -- C:\Users\***\Desktop\Konserven.odt
[2012.06.21 12:10:45 | 000,026,819 | ---- | M] () -- C:\Users\***\Desktop\Preisliste 2011.odt
[2012.06.21 12:08:25 | 000,012,062 | ---- | M] () -- C:\Users\***\Desktop\Angebot für PRONTO PIZZERIA ERWITTE.odt
[2012.06.18 10:33:43 | 000,012,963 | ---- | M] () -- C:\Users\***\Desktop\Bestellung A&A Großhandel.odt
[2012.06.18 09:54:38 | 000,014,399 | ---- | M] () -- C:\Users\***\Documents\Paradies Grill.odt
[2012.06.16 19:05:53 | 000,013,021 | ---- | M] () -- C:\Users\***\Documents\Angebot für Facefood Imbiss Rietberg.odt
[2012.06.14 17:50:42 | 000,337,664 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2012.06.14 13:39:23 | 000,021,310 | ---- | M] () -- C:\Users\***\Documents\Angebot für Bei Badip Delbrück.odt
[2012.06.04 15:22:09 | 000,013,431 | ---- | M] () -- C:\Users\***\Documents\Saigon Brockhägerstr. Gütersloh.odt
[2012.06.04 09:36:27 | 000,016,963 | ---- | M] () -- C:\Users\***\Documents\Angebot für Karadeniz Grill Rheda-Wiedenbrück.odt
[2012.06.03 00:19:33 | 000,045,080 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wups2.dll
[2012.06.03 00:19:32 | 000,035,864 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wups.dll
[2012.06.03 00:19:23 | 000,577,048 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuapi.dll
[2012.06.03 00:12:32 | 002,422,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wucltux.dll
[2012.06.03 00:12:13 | 000,088,576 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wudriver.dll
[2012.06.02 15:19:42 | 000,171,904 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuwebv.dll
[2012.06.02 15:12:20 | 000,033,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wuapp.exe
[2012.06.02 12:56:32 | 000,016,318 | ---- | M] () -- C:\Users\***\Documents\Angebot für Bella Kreta Pizzeria Gütersloh.odt
[2012.06.01 16:35:32 | 000,161,280 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msls31.dll
[2012.06.01 16:35:31 | 000,162,304 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msrating.dll
[2012.06.01 16:35:31 | 000,130,560 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakeng.dll
[2012.06.01 16:35:31 | 000,110,592 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\IEAdvpack.dll
[2012.06.01 16:35:31 | 000,086,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesysprep.dll
[2012.06.01 16:35:31 | 000,076,800 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\SetIEInstalledDate.exe
[2012.06.01 16:35:31 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\RegisterIEPKEYs.exe
[2012.06.01 16:35:31 | 000,064,512 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jsproxy.dll
[2012.06.01 16:35:31 | 000,048,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtmler.dll
[2012.06.01 16:35:30 | 003,695,416 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dat
[2012.06.01 16:35:30 | 002,382,336 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\mshtml.tlb
[2012.06.01 16:35:30 | 001,426,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inetcpl.cpl
[2012.06.01 16:35:30 | 000,580,096 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2012.06.01 16:35:30 | 000,434,176 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2012.06.01 16:35:30 | 000,367,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2012.06.01 16:35:30 | 000,356,664 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iedkcs32.dll
[2012.06.01 16:35:30 | 000,353,792 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtmsft.dll
[2012.06.01 16:35:30 | 000,231,936 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\url.dll
[2012.06.01 16:35:30 | 000,223,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\dxtrans.dll
[2012.06.01 16:35:30 | 000,176,640 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieui.dll
[2012.06.01 16:35:30 | 000,152,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\wextract.exe
[2012.06.01 16:35:30 | 000,150,528 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iexpress.exe
[2012.06.01 16:35:30 | 000,078,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\inseng.dll
[2012.06.01 16:35:30 | 000,074,752 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iesetup.dll
[2012.06.01 16:35:30 | 000,074,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ie4uinit.exe
[2012.06.01 16:35:30 | 000,072,822 | ---- | M] () -- C:\Windows\System32\ieuinit.inf
[2012.06.01 16:35:30 | 000,031,744 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iernonce.dll
[2012.06.01 16:35:30 | 000,023,552 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\licmgr10.dll
[2012.06.01 16:35:29 | 001,791,488 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\jscript9.dll
[2012.06.01 16:35:29 | 000,227,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieaksie.dll
[2012.06.01 16:35:29 | 000,163,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieakui.dll
[2012.06.01 16:35:29 | 000,142,848 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\ieUnatt.exe
[2012.06.01 16:35:29 | 000,117,760 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2012.06.01 16:35:29 | 000,101,888 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\admparse.dll
[2012.06.01 16:35:29 | 000,054,272 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\pngfilt.dll
[2012.06.01 16:35:29 | 000,041,472 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedsbs.dll
[2012.06.01 16:35:29 | 000,035,840 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\imgutil.dll
[2012.06.01 16:35:29 | 000,010,240 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\msfeedssync.exe
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Users\***\AppData\Roaming\*.tmp files -> C:\Users\***\AppData\Roaming\*.tmp -> ]
========== Files Created - No Company Name ==========
[2012.06.29 12:43:38 | 000,001,919 | ---- | C] () -- C:\Users\***\Desktop\Microsoft Security Essentials.lnk
[2012.06.29 12:16:08 | 000,001,075 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.06.14 14:15:51 | 000,014,399 | ---- | C] () -- C:\Users\***\Documents\Paradies Grill.odt
[2012.06.11 09:07:59 | 000,000,051 | ---- | C] () -- C:\Users\***\AppData\Roaming\blckdom.res
[2012.06.01 16:35:30 | 000,072,822 | ---- | C] () -- C:\Windows\System32\ieuinit.inf
[2012.05.31 12:38:37 | 000,014,208 | ---- | C] () -- C:\Users\***\Desktop\Angebot für PRONTO PIZZERIA ERWITTE.odt
[2012.05.31 12:31:54 | 000,012,062 | ---- | C] () -- C:\Users\***\Desktop\Angebot für PRONTO PIZZERIA ERWITTE.odt
[2012.04.18 10:05:57 | 000,000,995 | ---- | C] () -- C:\Windows\eReg.dat
[2012.04.12 10:22:09 | 000,011,463 | ---- | C] () -- C:\Users\***\Bei Onkel Brunch Rechnung Tische.odt
[2011.11.25 13:15:38 | 000,000,035 | ---- | C] () -- C:\Windows\SIERRA.INI
[2011.10.26 14:34:23 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2011.10.26 14:34:22 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2011.10.25 11:31:03 | 000,138,264 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.10.25 11:31:03 | 000,138,056 | ---- | C] () -- C:\Users\***\AppData\Roaming\PnkBstrK.sys
[2011.10.25 11:30:37 | 000,234,768 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2011.10.25 11:30:33 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2011.10.01 11:08:42 | 000,000,232 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2011.08.26 15:05:39 | 000,010,865 | ---- | C] () -- C:\Users\***\Preise Pizzakartons NEUE.odt
[2011.08.20 13:52:00 | 000,012,444 | ---- | C] () -- C:\Users\***\Von FODI XL Einkauf und Verkauf.odt
[2011.08.11 14:36:03 | 000,021,731 | ---- | C] () -- C:\Users\***\Beckum Preise.odt
[2011.08.04 11:12:42 | 000,022,219 | ---- | C] () -- C:\Users\***\Preisliste Pizzerien.odt
[2011.07.25 10:46:01 | 000,911,092 | ---- | C] () -- C:\Users\***\Großhandel Logo.jpg
[2011.06.10 06:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2011.06.04 09:37:00 | 000,000,248 | ---- | C] () -- C:\Users\***\AppData\Roaming\wklnhst.dat
[2011.06.02 21:56:15 | 000,000,229 | ---- | C] () -- C:\Windows\Brpfx04a.ini
[2011.06.02 21:56:15 | 000,000,093 | ---- | C] () -- C:\Windows\brpcfx.ini
[2011.06.02 21:55:39 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2011.06.02 21:55:39 | 000,000,027 | ---- | C] () -- C:\Windows\BRPP2KA.INI
[2011.06.02 21:54:35 | 000,000,050 | ---- | C] () -- C:\Windows\System32\bridf08b.dat
[2011.06.02 21:54:03 | 000,000,000 | ---- | C] () -- C:\Windows\brdfxspd.dat
[2011.06.02 21:50:21 | 000,031,864 | ---- | C] () -- C:\Windows\maxlink.ini
[2011.02.11 19:10:52 | 000,439,308 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin
[2011.02.11 19:10:50 | 000,982,240 | ---- | C] () -- C:\Windows\System32\igkrng500.bin
[2011.02.11 19:10:50 | 000,092,356 | ---- | C] () -- C:\Windows\System32\igfcg500m.bin
[2011.02.11 18:40:40 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2011.02.11 18:38:44 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
========== LOP Check ==========
[2011.08.05 17:42:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2011.08.09 17:51:15 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2012.02.07 14:10:05 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DAEMON Tools Lite
[2011.07.14 14:22:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2011.07.14 14:22:01 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.06.28 14:06:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Edygc
[2012.06.28 14:01:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ifboe
[2012.05.30 11:39:08 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\kock
[2011.06.02 21:53:43 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2011.10.24 17:08:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera
[2011.08.18 12:58:25 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Sierra Entertainment
[2011.06.06 17:58:07 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Template
[2012.06.05 14:12:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\UAs
[2012.02.14 13:57:06 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Ubisoft
[2012.06.28 14:01:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Umoce
[2012.02.14 14:42:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent
[2012.02.23 11:01:45 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\WoAx-IT
[2012.06.05 14:13:02 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\xmldm
[2012.06.06 17:42:21 | 000,032,640 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
< End of report >
Code:
OTL Extras logfile created on: 29.06.2012 13:53:49 - Run 2
OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\***\Desktop
Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8080.16413)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
1,87 Gb Total Physical Memory | 0,99 Gb Available Physical Memory | 52,87% Memory free
3,74 Gb Paging File | 2,78 Gb Available in Paging File | 74,36% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 677,54 Gb Total Space | 632,87 Gb Free Space | 93,41% Space Free | Partition Type: NTFS
Drive D: | 20,00 Gb Total Space | 13,54 Gb Free Space | 67,68% Space Free | Partition Type: NTFS
Computer Name: ***-PC | User Name: ***| Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0C85CA3F-EAF1-4F8F-AC2E-100D5435EC7A}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{13CAFEFE-C79A-4C0F-99C2-7CDEB68B85F2}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{1844A5DB-AED4-488C-BAF1-ACFAC936BF78}" = lport=6112 | protocol=6 | dir=in | name=6112 |
"{1D774036-45B6-44FB-B299-7CFF7FFCE673}" = lport=10243 | protocol=6 | dir=in | app=system |
"{1DC7E328-769E-48FE-824E-C4BE11D3C86F}" = rport=139 | protocol=6 | dir=out | app=system |
"{26740B4F-8D2D-4B54-BB0D-A6E945B2643A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2ED4E10F-711D-490F-AEB3-EAF6D33BB507}" = rport=445 | protocol=6 | dir=out | app=system |
"{2FD33465-3F23-46DD-ADAE-2260E85F55CD}" = lport=139 | protocol=6 | dir=in | app=system |
"{32D0625D-E86B-4410-80AB-2B02DD1B10FD}" = lport=2869 | protocol=6 | dir=in | app=system |
"{3B585B05-6D86-4C9D-8190-85DC61B755B8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{4365A3C0-9A58-4850-AD73-70C523EE4A5B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{4AEE451A-178E-473C-AF3D-FE3E4F1C9C44}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{603D7582-3015-4F42-B1D2-D30C1432B2FF}" = lport=138 | protocol=17 | dir=in | app=system |
"{6C604577-B2C1-41C3-9C41-523FE9C27CFF}" = rport=137 | protocol=17 | dir=out | app=system |
"{6EF5A78D-EE4C-4F01-83F2-FA9EA1A3E0F6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{75CEE065-883C-4A65-ABD1-4E234490B77E}" = lport=6881 | protocol=6 | dir=in | name=6881 |
"{775DD43B-47B9-4531-96AC-BFDAAA061125}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{86B77401-0219-4616-8BC1-F214748CC401}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{9EBB6C93-C398-4A28-A630-FBA3A03A297A}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{A0BF7709-DD39-4B68-9AA2-B524CDCE1BF0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A50D4A64-8EAB-4C1E-B213-3D04D1D62658}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{AAAB8A99-5581-4BE9-86F0-FB47733FE857}" = lport=445 | protocol=6 | dir=in | app=system |
"{C4AFF5CA-660D-4615-8B0B-23B4773B70C1}" = lport=6999 | protocol=6 | dir=in | name=6999 |
"{D53940F4-F18D-4FCA-8804-61B539A869D6}" = rport=10243 | protocol=6 | dir=out | app=system |
"{D7C55DF9-6E2A-4B21-BF4F-504EEBA4C0AD}" = rport=138 | protocol=17 | dir=out | app=system |
"{D96B0AF4-C1E0-4BE7-BFED-515FE76A5497}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DA89DDCC-71B0-49C2-BDA0-355C0933622A}" = lport=1119 | protocol=6 | dir=in | name=1119 |
"{E2E8D4CB-7AC3-48B7-A125-DA13A3160281}" = lport=3724 | protocol=6 | dir=in | name=3724 |
"{E6C28BB5-69A3-4B95-B316-150E41C988C3}" = lport=137 | protocol=17 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{074953A6-860D-4631-AF0F-7F051ED86536}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe |
"{0867BAA3-D940-4AB7-85AA-781574ABFCA4}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{08F9CCDA-8DC6-4E3C-A0BC-0DEE47C4CD6C}" = protocol=6 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{0A2173F0-83E8-46BD-AD45-98B1EDB253D4}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe |
"{0C01D3D2-AE71-4F26-99BF-A329C2E1921B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{262C24A0-69FC-4254-9250-5E9DE126350E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{2676D568-987D-45FA-BFE2-2DC7B934B6B8}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe |
"{35150CFC-EAAF-4A81-8F1F-DE2748AB41AF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{37AFAB4A-28A0-43F7-AA71-5777A44F016E}" = protocol=17 | dir=in | app=c:\program files\utorrent\utorrent.exe |
"{38001E01-E9CC-4B28-BA40-35AC52ADFE40}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe |
"{469CCA3B-F2B6-4282-8B1D-37A976DDDB99}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{49A1A732-3EB7-44A3-B0A7-A2C2B8EDFFFA}" = protocol=17 | dir=in | app=c:\program files\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{4C14A2FB-D7D0-4371-80F8-9A83BE5DA3F4}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{51274EF0-7984-4E92-93FF-DF9425D428B3}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.patch.exe |
"{55C59431-AC81-469F-AA9D-13C47F14CDAA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{57A45EDF-9449-40F6-9B6F-29EFFC50D257}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{6092AE64-61EF-4B96-9A04-34460281E67E}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{63C86683-1D8B-4FE3-9C64-66ED021B0FC4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{6DD79C2A-F42F-4D75-AB8D-2DB0C61B002A}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6E2C3062-6B7F-4D4C-BFBC-0BFA8B9D4EF0}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe |
"{701747CC-A64F-484D-8B15-E0DEF8BD3442}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{7634434C-D54A-49B7-ABD7-392C9C6E0263}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"{76CF78A5-81F4-4639-8822-1FFFA466A497}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\versions\base21029\sc2.exe |
"{7B3C9B72-8E55-4093-B8AD-659FB3658E83}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"{7D0BBBB7-C123-4B86-BA44-A897CF2F04E9}" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.exe |
"{7E6B36FB-F64E-432F-8A4C-7D708F7F51D3}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{80551BDE-F48B-4777-B021-F933624B88A3}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe |
"{86B97488-DE81-45A9-A8A0-B680ACD2B24B}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{8DFF2B73-1AAE-44F1-9462-A5D16CF0D632}" = protocol=6 | dir=out | app=system |
"{8E6D325E-9C60-49E8-B424-096D59317CE6}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.patch.exe |
"{94E17C80-AB13-445C-AA04-A0D6C409EC38}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{9D164B72-8FA3-47D6-BB4E-AC11DEB65275}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe |
"{A965F70C-904E-4CC8-B31D-91A69BCCA80D}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\versions\base21029\sc2.exe |
"{AC27E8DB-0814-4F9F-8782-1620A96478CA}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe |
"{B01800E3-CF57-48B7-A329-131FBBA5B1DB}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{B24536EA-9A0E-494F-BD3B-6E6CCB72EA25}" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.exe |
"{B79FCDD4-FDA0-4933-BB55-07702F328765}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{B7E6F40C-23A7-4D75-AA16-B7065791D076}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\wow-x.x.x.x-4.0.0.12911-downloader.exe |
"{B9931A8B-F155-493B-BFEE-ABB3095D3829}" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\launcher.exe |
"{BBBCB949-D759-44CD-B00F-33661D70FB83}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe |
"{C5DBAD99-443F-41BD-A949-87A47D2695C8}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\launcher.patch.exe |
"{C8507CC8-68AB-44B5-A79A-AA9DFF386B26}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe |
"{CB3B559F-3A0E-46B6-97B4-3B08C6499348}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{CE4B60D7-535F-4A02-ABE8-2CA09051C81A}" = protocol=6 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe |
"{D072F801-5494-497C-9BB6-BFC1477582C8}" = protocol=17 | dir=in | app=c:\program files\starcraft ii\starcraft ii.exe |
"{DAC4AA0C-3238-425E-893B-F33916B440B5}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{DE05C930-F6FE-4739-942C-AC62FE7105AD}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"{E09B05A6-2ECE-4F7A-BE6C-40E1D383DF01}" = dir=in | app=c:\program files\electronic arts\command & conquer 3 kanes rache\retailexe\1.0\cnc3ep1.dat |
"{E2928F96-2E89-4A11-985D-A7B737E33BAA}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{E4231019-55EC-48D2-B9C1-D04AC39D6F37}" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\wow-x.x.x.x-4.0.0.12911-downloader.exe |
"{E4E9599E-41CB-43A4-A05E-819AE1982364}" = protocol=6 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"{E5D6E942-E675-49ED-9967-ED4654F433CB}" = protocol=17 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"{F3140AFB-4A4B-465F-8670-97E4B8516D05}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-x.x.x.x-4.0.0.12911-eu-downloader.exe |
"{F3C914F9-4E21-45E9-AC5D-9DCA22841575}" = protocol=6 | dir=in | app=c:\program files\opera\pluginwrapper\opera_plugin_wrapper.exe |
"{F7422A3D-50EA-4A10-920B-AD9EC4D40102}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{FB431E52-E204-4419-91B5-8E1FBE4B3457}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{FEFBD851-3044-4C82-A073-BF40C7F63006}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{00B868DA-2657-4F4F-BA1E-F7101707B127}C:\program files\cityvillebot\cvbot.exe" = protocol=6 | dir=in | app=c:\program files\cityvillebot\cvbot.exe |
"TCP Query User{144865DC-97DC-4377-A5D5-A51F201AA88A}C:\users\***\appdata\local\opera\opera\temporary_downloads\diablo-iii-8370-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\opera\opera\temporary_downloads\diablo-iii-8370-dede-installer-downloader.exe |
"TCP Query User{327BA34D-7086-4000-AB46-EE6108FE88E7}C:\users\public\games\world of warcraft\backgrounddownloader.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"TCP Query User{4188D01D-0865-4C27-8B24-9D4FBFEB8B11}C:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe |
"TCP Query User{55145FAE-F73D-4F40-92C0-B8B62FB35D49}C:\users\nuri ayiz\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\cprogram filesopera\operaupgrader.exe |
"TCP Query User{60DEA1DD-7413-4ACC-9795-0E5BBD14CE82}C:\program files\world of warcraft\temp\wow-4.2.1.2727-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2727-enus-tools-downloader.exe |
"TCP Query User{6565386A-196D-44E4-ACB6-2950024ABE0F}C:\sierra\empire earth\empire earth.exe" = protocol=6 | dir=in | app=c:\sierra\empire earth\empire earth.exe |
"TCP Query User{67BE9662-3374-4E34-B2DD-141B11E79E61}C:\users\nuri ayiz\desktop\diablo-iii-8370-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\***\desktop\diablo-iii-8370-dede-installer-downloader.exe |
"TCP Query User{6AB3B3FB-5DB9-41FA-AF11-B7636ABF8FAB}C:\users\nuri ayiz\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\electronicarts_patcher_000.exe |
"TCP Query User{6E4F9237-F250-4DD9-9650-A551C3491E96}C:\program files\ea games\battlefield play4free\bfp4f.exe" = protocol=6 | dir=in | app=c:\program files\ea games\battlefield play4free\bfp4f.exe |
"TCP Query User{7C3BBB7C-1828-44EE-9E65-B57AFC64C14E}C:\program files\world of warcraft\temp\wow-4.2.1.2730-enus-tools-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2730-enus-tools-downloader.exe |
"TCP Query User{817867F5-20DB-491A-8436-A06CD55CB11E}C:\program files\thq\dawn of war\w40k.exe" = protocol=6 | dir=in | app=c:\program files\thq\dawn of war\w40k.exe |
"TCP Query User{9AF7B17E-E19C-4F69-8FB2-AF3950BBF631}C:\program files\starcraft ii\versions\base15405\sc2.exe" = protocol=6 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe |
"TCP Query User{CB9D1161-D157-42A0-A214-13E5603F7301}C:\windows\system32\taskhost.exe" = protocol=6 | dir=in | app=c:\windows\system32\taskhost.exe |
"TCP Query User{D3B2C2DF-54BA-4D63-B876-0D895C96FA50}C:\programdata\battle.net\agent\agent.749\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.749\agent.exe |
"TCP Query User{D5B417EB-C650-4EED-A2E8-40CB26195093}C:\windows\explorer.exe" = protocol=6 | dir=in | app=c:\windows\explorer.exe |
"TCP Query User{E3C7CB9C-673C-4536-B875-2767EDCF822B}C:\program files\opera\opera.exe" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe |
"TCP Query User{F534A655-1483-4D9D-BD3E-C77B2A1A7379}C:\programdata\battle.net\agent\agent.868\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe |
"UDP Query User{1911879C-9B7F-43C8-A7E6-E07CE001FA9C}C:\users\***\desktop\diablo-iii-8370-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\***\desktop\diablo-iii-8370-dede-installer-downloader.exe |
"UDP Query User{2CE87DE9-E440-4D87-AABE-8C234478B3E0}C:\users\***\appdata\local\temp\electronicarts_patcher_000.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\electronicarts_patcher_000.exe |
"UDP Query User{335363CB-D622-495A-85BF-AB293984516C}C:\users\***\appdata\local\opera\opera\temporary_downloads\diablo-iii-8370-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\nuri ayiz\appdata\local\opera\opera\temporary_downloads\diablo-iii-8370-dede-installer-downloader.exe |
"UDP Query User{462891AB-47D7-49A0-B711-A1649FDD2B58}C:\windows\explorer.exe" = protocol=17 | dir=in | app=c:\windows\explorer.exe |
"UDP Query User{4F834AD9-E182-4A1E-83E1-57CFC3D84F33}C:\users\public\games\world of warcraft\backgrounddownloader.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft\backgrounddownloader.exe |
"UDP Query User{50C5C039-C834-467C-91C5-5B61AE64A4D0}C:\program files\cityvillebot\cvbot.exe" = protocol=17 | dir=in | app=c:\program files\cityvillebot\cvbot.exe |
"UDP Query User{57FDB9D2-672F-4987-817B-406B36883447}C:\program files\world of warcraft\temp\wow-4.2.1.2730-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2730-enus-tools-downloader.exe |
"UDP Query User{5F61220E-F732-4CD7-98BD-9957A7420713}C:\program files\opera\opera.exe" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe |
"UDP Query User{70B98E48-A4C7-47C5-ADD7-1F90FEF3AEB7}C:\program files\thq\dawn of war\w40k.exe" = protocol=17 | dir=in | app=c:\program files\thq\dawn of war\w40k.exe |
"UDP Query User{7DABA21C-C2E0-461D-A5F3-C9F35C229A41}C:\users\***\appdata\local\temp\cprogram filesopera\operaupgrader.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\cprogram filesopera\operaupgrader.exe |
"UDP Query User{88AA2464-D681-4468-95D6-2F7FE25F8723}C:\program files\ea games\battlefield play4free\bfp4f.exe" = protocol=17 | dir=in | app=c:\program files\ea games\battlefield play4free\bfp4f.exe |
"UDP Query User{89CE6949-9746-48C8-8221-A53DEC035021}C:\programdata\battle.net\agent\agent.868\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.868\agent.exe |
"UDP Query User{AC3B2423-18C5-4478-A153-0B6AF413F186}C:\program files\world of warcraft\temp\wow-4.2.1.2727-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2727-enus-tools-downloader.exe |
"UDP Query User{DD8D3099-46A9-46CB-82FB-43218E77BC8C}C:\windows\system32\taskhost.exe" = protocol=17 | dir=in | app=c:\windows\system32\taskhost.exe |
"UDP Query User{E768F98F-9512-4012-9A46-45DED2EFD6DC}C:\sierra\empire earth\empire earth.exe" = protocol=17 | dir=in | app=c:\sierra\empire earth\empire earth.exe |
"UDP Query User{E97D3925-90A9-4F5A-88D6-ACF5EE1C165E}C:\programdata\battle.net\agent\agent.749\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.749\agent.exe |
"UDP Query User{ED1F9670-E211-4CC0-93D7-874819C7B35C}C:\program files\starcraft ii\versions\base15405\sc2.exe" = protocol=17 | dir=in | app=c:\program files\starcraft ii\versions\base15405\sc2.exe |
"UDP Query User{FA50C7E0-36EA-4B4C-B3AB-3A74DE5014D8}C:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\temp\wow-4.2.1.2736-enus-tools-downloader.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02570AE0-BEE0-4A6C-BE3F-D806E9F2EA17}" = ScanSoft PaperPort 11
"{0F842B77-56EA-4AAF-8295-81A022350B5E}" = Microsoft Security Client
"{1280E900-35DA-4E08-A700-B79A5B2B8532}" = Microsoft Antimalware Service DE-DE Language Pack
"{13A5E785-5197-4EAD-8EE3-D660271E49BC}" = Feedback Tool
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F77C418-2C90-459C-BD33-B56A4182B9FA}" = System Requirements Lab CYRI
"{26A24AE4-039D-4CA4-87B4-2F83216022FF}" = Java(TM) 6 Update 30
"{29042B1C-0713-4575-B7CA-5C8E7B0899D4}" = MySQL Connector/ODBC 5.1
"{39D0E034-1042-4905-BECB-5502909FCB7C}" = Microsoft Works
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{48D082B9-18F6-4426-AFAC-8B6A3E7021B1}" = Brother MFL-Pro Suite MFC-250C
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{50779A29-834E-4E36-BBEB-B7CABC67A825}" = Microsoft Security Client DE-DE Language Pack
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95120000-003F-0409-0000-0000000FF1CE}" = Microsoft Office Excel Viewer
"{95120000-00AF-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint Viewer 2007 (German)
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.3) - Deutsch
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.61.0.1400
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft Security Client" = Microsoft Security Essentials
"Opera 12.00.1467" = Opera 12.00
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 22.06.2012 11:56:15 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec49b60 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0001df3d ID des fehlerhaften
Prozesses: 0x1578 Startzeit der fehlerhaften Anwendung: 0x01cd508f8cd8b5b9 Pfad der
fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: cb9e22fa-bc82-11e1-8c56-6c626d05b73c
Error - 22.06.2012 12:57:21 | Computer Name = ***-PC | Source = Brother BrLog | ID = 1001
Description = WDLMW BrtWDLMW: [2012/06/22 18:57:21.079]: [00002572]: lperrcode->api
= 1 , lperrcode->code = 2
Error - 22.06.2012 12:57:22 | Computer Name = ***-PC | Source = Brother BrLog | ID = 1001
Description = WDLMW BrtWDLMW: [2012/06/22 18:57:22.593]: [00002572]: lperrcode->api
= 1 , lperrcode->code = 2
Error - 22.06.2012 12:57:24 | Computer Name = ***-PC | Source = Brother BrLog | ID = 1001
Description = WDLMW BrtWDLMW: [2012/06/22 18:57:24.093]: [00002572]: lperrcode->api
= 1 , lperrcode->code = 2
Error - 23.06.2012 13:06:39 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec49b60 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0001f8c4 ID des fehlerhaften
Prozesses: 0x1f7c Startzeit der fehlerhaften Anwendung: 0x01cd51628d25d978 Pfad der
fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: cbb949d3-bd55-11e1-8c8b-6c626d05b73c
Error - 27.06.2012 11:14:32 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec49b60 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00077c29 ID des fehlerhaften
Prozesses: 0x143c Startzeit der fehlerhaften Anwendung: 0x01cd54778cf852d0 Pfad der
fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: cbd32c73-c06a-11e1-8ca6-6c626d05b73c
Error - 28.06.2012 04:21:49 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: svchost.exe, Version: 6.1.7600.16385,
Zeitstempel: 0x4a5bc100 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7601.17725,
Zeitstempel: 0x4ec49b60 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00052bb6 ID des fehlerhaften
Prozesses: 0x2a00 Startzeit der fehlerhaften Anwendung: 0x01cd55070f6cbe82 Pfad der
fehlerhaften Anwendung: C:\Windows\system32\svchost.exe Pfad des fehlerhaften Moduls:
C:\Windows\SYSTEM32\ntdll.dll Berichtskennung: 4e4c5ae6-c0fa-11e1-8ca5-6c626d05b73c
Error - 28.06.2012 08:05:24 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: msseces.exe, Version: 4.0.1526.0,
Zeitstempel: 0x4f710276 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00010854 ID des fehlerhaften
Prozesses: 0x178 Startzeit der fehlerhaften Anwendung: 0x01cd55264b9268f4 Pfad der
fehlerhaften Anwendung: C:\Program Files\Microsoft Security Client\msseces.exe Pfad
des fehlerhaften Moduls: unknown Berichtskennung: 8a38e451-c119-11e1-b64b-6c626d05b73c
Error - 28.06.2012 08:05:32 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: msseces.exe, Version: 4.0.1526.0,
Zeitstempel: 0x4f710276 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00010854 ID des fehlerhaften
Prozesses: 0x998 Startzeit der fehlerhaften Anwendung: 0x01cd55265139ad9b Pfad der
fehlerhaften Anwendung: C:\Program Files\Microsoft Security Client\msseces.exe Pfad
des fehlerhaften Moduls: unknown Berichtskennung: 8ee899db-c119-11e1-b64b-6c626d05b73c
Error - 29.06.2012 06:43:42 | Computer Name = ***-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: msseces.exe, Version: 4.0.1526.0,
Zeitstempel: 0x4f710276 Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
Zeitstempel: 0x00000000 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00010854 ID des fehlerhaften
Prozesses: 0xae4 Startzeit der fehlerhaften Anwendung: 0x01cd55e40bcd480b Pfad der
fehlerhaften Anwendung: C:\Program Files\Microsoft Security Client\msseces.exe Pfad
des fehlerhaften Moduls: unknown Berichtskennung: 4a901955-c1d7-11e1-8c8b-6c626d05b73c
[ System Events ]
Error - 02.05.2012 04:00:42 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 3002
Description = Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt
Feature:
%%835 Fehlercode: 0x80070005 Fehlerbeschreibung: Zugriff verweigert Grund: %%842
Error - 02.05.2012 04:00:42 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 3002
Description = Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt
Feature:
%%834 Fehlercode: 0x80070005 Fehlerbeschreibung: Zugriff verweigert Grund: %%837
Error - 02.05.2012 04:00:42 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 3002
Description = Vom Echtzeitschutz-Feature von %%860 wurde ein Fehler festgestellt
Feature:
%%835 Fehlercode: 0x80070005 Fehlerbeschreibung: Zugriff verweigert Grund: %%837
Error - 14.05.2012 02:49:24 | Computer Name = ***-PC | Source = Microsoft-Windows-Application-Experience | ID = 205
Description = Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht
initialisieren.
Error - 21.05.2012 03:09:27 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.
Neue
Signaturversion: Vorherige Signaturversion: 1.127.273.0 Aktualisierungsquelle: %%859
Aktualisierungsphase:
%%852 Quellpfad: hxxp://www.microsoft.com Signaturtyp: %%800 Aktualisierungstyp: %%803
Benutzer:
NT-AUTORITÄT\SYSTEM Aktuelle Modulversion: Vorherige Modulversion: 1.1.8403.0 Fehlercode:
0x80072efe Fehlerbeschreibung: Die Serververbindung wurde aufgrund eines Fehlers
beendet.
Error - 04.06.2012 02:54:26 | Computer Name = ***-PC | Source = Microsoft-Windows-Application-Experience | ID = 205
Description = Der Dienst "Programmkompatibilitäts-Assistent" konnte Phase 2 nicht
initialisieren.
Error - 06.06.2012 12:18:23 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.
Neue
Signaturversion: Vorherige Signaturversion: 1.127.1364.0 Aktualisierungsquelle:
%%859 Aktualisierungsphase: %%854 Quellpfad: hxxp://www.microsoft.com Signaturtyp:
%%800 Aktualisierungstyp: %%803 Benutzer: NT-AUTORITÄT\SYSTEM Aktuelle Modulversion:
Vorherige Modulversion: 1.1.8403.0 Fehlercode: 0x8024001e Fehlerbeschreibung: Unerwartetes
Problem bei der Überprüfung auf Updates. Informationen zum Installieren von Updates
oder zur Problembehandlung finden Sie unter "Hilfe und Support".
Error - 28.06.2012 08:31:04 | Computer Name = ***-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?28.?06.?2012 um 14:30:10 unerwartet heruntergefahren.
Error - 29.06.2012 07:52:16 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.
Neue
Signaturversion: Vorherige Signaturversion: 1.129.640.0 Aktualisierungsquelle: %%859
Aktualisierungsphase:
%%853 Quellpfad: hxxp://www.microsoft.com Signaturtyp: %%800 Aktualisierungstyp: %%803
Benutzer:
NT-AUTORITÄT\SYSTEM Aktuelle Modulversion: Vorherige Modulversion: 1.1.8502.0 Fehlercode:
0x8024001e Fehlerbeschreibung: Unerwartetes Problem bei der Überprüfung auf Updates.
Informationen zum Installieren von Updates oder zur Problembehandlung finden Sie
unter "Hilfe und Support".
Error - 29.06.2012 07:52:16 | Computer Name = ***-PC | Source = Microsoft Antimalware | ID = 2001
Description = Beim Aktualisieren der Signaturen wurde von %%860 ein Fehler festgestellt.
Neue
Signaturversion: Vorherige Signaturversion: 1.129.640.0 Aktualisierungsquelle: %%859
Aktualisierungsphase:
%%853 Quellpfad: hxxp://www.microsoft.com Signaturtyp: %%800 Aktualisierungstyp: %%803
Benutzer:
NT-AUTORITÄT\SYSTEM Aktuelle Modulversion: Vorherige Modulversion: 1.1.8502.0 Fehlercode:
0x8024001e Fehlerbeschreibung: Unerwartetes Problem bei der Überprüfung auf Updates.
Informationen zum Installieren von Updates oder zur Problembehandlung finden Sie
unter "Hilfe und Support".
< End of report >
Danke im Vorraus !
Lg Jo |
