| Rainbow Dash | 28.06.2013 12:17 |
Na dann: Extras
OTL Logfile: Code:
OTL Extras logfile created on: 28.06.2013 12:17:17 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Rainy\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,98 Gb Total Physical Memory | 6,28 Gb Available Physical Memory | 78,63% Memory free
15,96 Gb Paging File | 14,01 Gb Available in Paging File | 87,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 218,96 Gb Total Space | 17,79 Gb Free Space | 8,12% Space Free | Partition Type: NTFS
Drive D: | 246,79 Gb Total Space | 221,92 Gb Free Space | 89,92% Space Free | Partition Type: NTFS
Drive E: | 218,96 Gb Total Space | 85,59 Gb Free Space | 39,09% Space Free | Partition Type: NTFS
Drive F: | 489,03 Gb Total Space | 470,73 Gb Free Space | 96,26% Space Free | Partition Type: NTFS
Drive G: | 442,38 Gb Total Space | 416,16 Gb Free Space | 94,07% Space Free | Partition Type: NTFS
Drive H: | 246,80 Gb Total Space | 48,80 Gb Free Space | 19,77% Space Free | Partition Type: NTFS
Drive K: | 194,64 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: TOMATENKÖNIG-PC | User Name: Rainy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Tools\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\*** Tools\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\*** Tools\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Tools\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- H:\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Tools\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Tools\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Tools\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Tools\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "C:\Mama Tools\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "C:\Mama Tools\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Tools\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- H:\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Tools\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Tools\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Tools\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Tools\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{01B99F74-CA07-4691-8B89-A39809629AFB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{094C42E9-1BAC-40F8-9344-F24A986838D7}" = lport=58149 | protocol=6 | dir=in | name=pando media booster |
"{2F83896C-66CD-4960-AFB7-DAE1DED7101F}" = lport=138 | protocol=17 | dir=in | app=system |
"{34AF60DC-DAF7-49F0-8C06-43C726E61E75}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{3A3F1F6A-0287-47CE-87CF-088538C704FF}" = lport=445 | protocol=6 | dir=in | app=system |
"{4C5CB43F-0E53-4685-BE93-40727C965F16}" = lport=10243 | protocol=6 | dir=in | app=system |
"{5C6CC812-C91A-4B87-BE4A-00A49B4F6EC3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{65B026E8-AF3B-4C56-B95B-ADB54A3CD57D}" = lport=2869 | protocol=6 | dir=in | app=system |
"{6CBA198E-5001-40E1-93D1-E93534E0C809}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{74A12F36-7833-4431-B6A7-3E777472D5A3}" = lport=58149 | protocol=17 | dir=in | name=pando media booster |
"{787B2577-3480-479C-8B4E-2BE4C335451B}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7AF47957-323E-4216-862F-76F1B6AA0BB5}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8865B158-D130-4054-AAC1-36E85CC950AD}" = rport=139 | protocol=6 | dir=out | app=system |
"{8B29AE97-8398-4B9C-9DDE-73F6B920ED9C}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8FFBF01C-5D1D-4DA5-9EA7-7CF49417F148}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{90CDBBD4-803F-42D9-84E1-FBB2E11612A8}" = lport=58149 | protocol=6 | dir=in | name=pando media booster |
"{9E62B420-C20A-45A9-A9AC-579F56DB2C8A}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A05FEB45-407F-49F2-965B-60FFD93E3DA7}" = lport=6004 | protocol=17 | dir=in | app=c:\mama tools\microsoft office\office14\outlook.exe |
"{ADA0BD06-88C1-4C8E-891C-AC67A0BEB420}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{AEC41139-08C3-470A-9501-279FE8FE68D8}" = rport=137 | protocol=17 | dir=out | app=system |
"{CB651003-4114-4556-8132-96381623E8A9}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D81996CC-E9A7-416C-BCDC-3C6A0DBC4B2D}" = rport=445 | protocol=6 | dir=out | app=system |
"{D938E3E1-40E4-4A61-A3F2-779F168DC735}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DFCE9FEC-6517-40DC-9121-761A937F0B03}" = lport=58149 | protocol=17 | dir=in | name=pando media booster |
"{E265389A-74CD-4CEA-B9C8-5D81B3D37FDD}" = rport=10243 | protocol=6 | dir=out | app=system |
"{E8C16F52-C191-4B2C-9D3F-480B34C1377C}" = rport=138 | protocol=17 | dir=out | app=system |
"{EDC2AD76-9754-4C40-BF9C-DB6783894E59}" = lport=137 | protocol=17 | dir=in | app=system |
"{F01B6616-2DD4-452D-B2A8-102BE8B596E6}" = lport=139 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{002DCC70-B3DD-4CA1-BDEC-28493E87D32D}" = protocol=6 | dir=in | app=h:\battlefield 2\bf2.exe |
"{024DCAE6-DA34-4514-AF8A-6D22AC7D679C}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{030F96B8-6627-43B1-A57B-D0594CA97F19}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{0511294F-D26C-45E6-9CF7-54E27598F022}" = protocol=17 | dir=in | app=c:\tools\starcraft ii\starcraft ii.exe |
"{18000E35-C260-45EF-9C25-A489ED8C5E4F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{1910FD63-26B0-4511-8FBC-528253334FF5}" = protocol=6 | dir=in | app=h:\dead space 3\deadspace3.exe |
"{1AADD56B-55C4-44ED-AEDC-BC72086D2626}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{2001ED55-802F-4040-B431-EC61CA34438B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{30D3E68D-FFEC-4208-A7F4-E90EC5E4F70B}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{31616332-6EF7-4E8D-B612-723D4F7B30D3}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{32773A87-F438-43F7-B802-6BE0FB97CDBE}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{32DE5ECB-5CB6-4045-A11F-3C014183F2B0}" = protocol=6 | dir=in | app=h:\ioquake3hd\ioq3ded.x86.exe |
"{3A35E486-DE60-49A2-9987-AFE1D35F6D35}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{3ADDCF5F-5C36-4277-B726-56DB4A9CABB6}" = protocol=17 | dir=in | app=c:\users\rainy\desktop\antichamber\antichamber v1.0 steam-rip cracked-richvsm\binaries\win32\udk.exe |
"{3D43532E-A0D4-47F2-B392-0CEF98375ACA}" = protocol=6 | dir=in | app=c:\users\rainy\downloads\utorrent_3.2.2b28595.exe |
"{41AFBE4A-4020-41DE-816C-90699CA6504F}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe |
"{44B79202-2B21-4D7E-B037-356DD215F702}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{44BC52FF-84A7-41EC-BEA2-5EF1CF2F9E59}" = protocol=17 | dir=in | app=h:\starcraft ii\versions\base24944\sc2.exe |
"{469C4E88-0419-42C0-8BC9-0EB0483BD15E}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{4708AD1B-C99E-44D7-A2BB-CA2838865EAA}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{48AD653F-F4EF-4137-9B9D-B129942C2089}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{5111D5A4-994C-4F2D-AD1E-0978A1F99F9B}" = protocol=6 | dir=in | app=h:\ioquake3hd\ioquake3.x86.exe |
"{54D3F514-98AE-4E26-8C9E-1DBF5EF69C02}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{58CFFA58-C91D-4122-82E1-66DE1DBB6AB1}" = protocol=6 | dir=out | app=system |
"{59B856F8-F2CF-4CB2-832C-AA081CD67FC5}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{59C8A2B9-79FA-4FDB-9B47-DEFE6844E6D3}" = protocol=17 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe |
"{5C5CB947-331B-4CB4-8B6D-E404E4982310}" = protocol=6 | dir=in | app=c:\tools\starcraft ii\starcraft ii public test.exe |
"{5FDFF3F6-3B2F-45F2-AB0F-F5C403FF2FA0}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{62D56C26-6379-45AA-ABCF-963185D9156B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{65F71103-053C-48A3-B17C-A19562BBD061}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{684EF3A5-41C2-48D1-8D31-7A537DB3540C}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe |
"{68843AC0-BA58-4F2A-8209-D8D5A1347A72}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{6C3229B2-438B-4FD6-B372-7C03C1DD9FBD}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{6CD0263C-7300-4B1D-9C87-492E679FCEF4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6CD6F5CD-5658-4D31-B17F-9A458B647226}" = protocol=17 | dir=in | app=h:\ioquake3hd\ioquake3.x86.exe |
"{6DF5AAC8-E713-4339-BBC0-C81A65299F27}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{6F523CE9-916A-497B-9DC8-ACC30998F413}" = protocol=6 | dir=in | app=h:\counter strike\hl2.exe |
"{738122D2-89CC-4527-AD4C-D746893D6525}" = protocol=6 | dir=in | app=h:\quake ultimate complete collection\quake iii complete\quake3.exe |
"{75AF0415-B8AF-4F37-A532-BE598A554085}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"{765B0F93-6E33-46EA-A0DF-C784D892F256}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8364FB1D-C602-4324-BCDD-7B61370B4B02}" = protocol=6 | dir=in | app=h:\diablo iii\diablo iii.exe |
"{8B23F602-6827-4813-8B85-1F5D6C481C9D}" = protocol=17 | dir=in | app=c:\tools\starcraft ii\starcraft ii public test.exe |
"{8BA5799B-59D9-42F6-BDD7-440BE1BA4077}" = protocol=17 | dir=in | app=h:\counter strike\hl2.exe |
"{8CE45951-C315-4E20-8FA0-1D49F1321E51}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"{8DD2A02E-595D-48DE-BD3A-4E8029FF2A8B}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{91DB3C49-2626-40A7-8389-822BE1F0735B}" = protocol=17 | dir=in | app=h:\diablo iii\diablo iii.exe |
"{95704686-A24E-44D5-A617-02FFC95FDCBB}" = protocol=6 | dir=in | app=c:\tools\starcraft ii\starcraft ii.exe |
"{9652574A-1D0E-47B5-A4A1-8E4B7FFE0751}" = dir=in | app=c:\program files (x86)\namco bandai games\darksouls\darksouls.exe |
"{984F538A-F291-418D-AD96-627047FBB1D3}" = protocol=6 | dir=in | app=c:\mama tools\microsoft office\office14\groove.exe |
"{9A5DD933-B65A-4A23-BDF3-9A2E87C2BF8F}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{9C21DE2D-4A17-4C0E-B3B0-1C02A9C0FA1E}" = protocol=58 | dir=in | app=system |
"{9C88F7B4-B8C4-49B2-B9DA-EA83129CF5BA}" = protocol=6 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe |
"{9C8D0D56-71C0-4CDB-A7D3-8EEC063C4A9B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{9E5EDB08-69E0-436F-A2E3-660EB031AF73}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe |
"{A00C05FB-55F8-4F9B-908C-EDAB80D38C64}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A5B0D035-00B1-4E76-8CB6-E48FEC2EC819}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{A6EBB33D-2A63-448B-B875-105DDE7DD0EB}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A757C15D-781E-4409-BBE3-3FF4CFE27634}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A9BB3EF2-99B5-4864-AD43-19BDB6DD900F}" = protocol=17 | dir=in | app=h:\quake ultimate complete collection\quake iii complete\quake3.exe |
"{ABF40907-D34A-412A-A918-9B8EE2F68B08}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1199\agent.exe |
"{AE1533B9-E656-470D-A943-EEC129E90F35}" = protocol=6 | dir=in | app=h:\starcraft ii\versions\base24944\sc2.exe |
"{AE5740F4-0DBA-4222-A68A-D0FDE99B4997}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{B180E5D3-9523-4AB9-9E8B-C9967B457806}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{B21CFC9B-B0F2-4317-B0D0-3A83137CEDC1}" = protocol=17 | dir=in | app=h:\dead space 3\deadspace3.exe |
"{BA13896E-C8EC-4D6B-BF9B-EFAB3EDB86F8}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{BB890253-398C-4ECC-ADC8-E8B36BD6C8A4}" = protocol=17 | dir=in | app=h:\ioquake3hd\ioq3ded.x86.exe |
"{C1314C1D-8E64-4C3F-9D20-25C684C950B1}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe |
"{C1CF2B4B-20A7-4086-BAA5-D6234193A65F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C6780441-AA53-49C9-AAC1-3DC5976665EA}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{C6F1E945-DA62-4E64-BFFC-A8E94ADBCC6E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{C9897248-841E-4FF2-B0E0-FDA076F7FBB0}" = protocol=6 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe |
"{CE301D00-6F12-45A3-BE4F-AABB21DE8917}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{D198BC03-AC58-432E-8085-BD8A51000EF0}" = protocol=17 | dir=in | app=c:\mama tools\microsoft office\office14\groove.exe |
"{D356D8EB-F3CF-4E28-BEF5-BC7C1C4DEAD4}" = protocol=6 | dir=in | app=c:\users\rainy\desktop\antichamber\antichamber v1.0 steam-rip cracked-richvsm\binaries\win32\udk.exe |
"{D48E03CD-3EEA-4469-A104-A0DC55843FCD}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{D5355F47-3A60-4117-B31C-42B462453473}" = protocol=17 | dir=in | app=c:\mama tools\microsoft office\office14\onenote.exe |
"{D556C315-FEC3-479B-89E6-21515D39F323}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe |
"{DB3E7DC3-A0C2-4A6F-95DB-3FA18017A4D7}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{DC270DE0-8B3D-4C1E-AE1D-47F7F4D4486D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\team fortress 2\hl2.exe |
"{DD9F4CEF-3844-4F82-A8BA-B35F952286CC}" = protocol=17 | dir=in | app=c:\program files (x86)\sybase\sql anywhere 9\win32\dbsrv9.exe |
"{E08A3AD0-E84C-4FB9-88E5-CE59C778CAA3}" = protocol=17 | dir=in | app=h:\battlefield 2\bf2.exe |
"{E0A75CD6-D42F-4E4D-AD36-4A7FF1832719}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{E22775BD-284C-4612-A5C8-4CC76DDC48CC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{EFF9CE79-9532-41F4-BCD1-2B2D7BD20092}" = protocol=17 | dir=in | app=c:\users\rainy\downloads\utorrent_3.2.2b28595.exe |
"{F34AA8FC-ACFB-4F28-AE00-0A7ED49F74CE}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F44431D4-1F0B-451A-8D9A-0B7EE6F46A82}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\team fortress 2\hl2.exe |
"{F47113EE-6867-4957-8CB2-AFBF3164252F}" = protocol=6 | dir=in | app=c:\mama tools\microsoft office\office14\onenote.exe |
"TCP Query User{10FF5A83-FA9D-435F-AF88-92E3BBCF32AF}H:\starcraft ii\versions\base24944\sc2.exe" = protocol=6 | dir=in | app=h:\starcraft ii\versions\base24944\sc2.exe |
"TCP Query User{22DB0342-0CDB-4F04-A3F0-9258F5BC91B0}C:\users\rainy\downloads\starcraft_2_eu_de-de.exe" = protocol=6 | dir=in | app=c:\users\rainy\downloads\starcraft_2_eu_de-de.exe |
"TCP Query User{23DAEC2C-DAD4-4239-9924-F225D0284355}C:\program files (x86)\bethesda softworks\doom 3 bfg edition\doom3bfg.exe" = protocol=6 | dir=in | app=c:\program files (x86)\bethesda softworks\doom 3 bfg edition\doom3bfg.exe |
"TCP Query User{35E13DA9-1C26-4163-A511-2E55036DB926}C:\programdata\battle.net\agent\agent.1363\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"TCP Query User{3D2E2900-FB68-49EF-99D1-B212B547530F}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" = protocol=6 | dir=in | app=c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe |
"TCP Query User{42348C35-9105-41AD-8E94-C5CA935F4550}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"TCP Query User{4331E652-98C9-447E-83A9-B010C3A4540D}E:\left 4 dead 2\left4dead2.exe" = protocol=6 | dir=in | app=e:\left 4 dead 2\left4dead2.exe |
"TCP Query User{44CDF135-BE52-4F15-A8A2-BE74CEB935C6}C:\users\rainy\downloads\utorrent_3.2.2b28595.exe" = protocol=6 | dir=in | app=c:\users\rainy\downloads\utorrent_3.2.2b28595.exe |
"TCP Query User{4A6BC642-7A0C-4327-A5F6-13C32D788670}C:\program files (x86)\steam\steamapps\rainbowdashhcooh\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\rainbowdashhcooh\team fortress 2\hl2.exe |
"TCP Query User{5C701A42-CF25-4F0E-BFA7-5D9A460FD43F}H:\ioquake3hd\ioquake3.x86.exe" = protocol=6 | dir=in | app=h:\ioquake3hd\ioquake3.x86.exe |
"TCP Query User{6FA25902-6AE7-4747-96A0-CB041933F046}C:\program files (x86)\left 4 dead 2\left 4 dead 2\left4dead2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\left 4 dead 2\left 4 dead 2\left4dead2.exe |
"TCP Query User{706950AA-A5C0-47A8-A495-CE38352ACFCC}H:\quake ultimate complete collection\quake iii complete\quake3.exe" = protocol=6 | dir=in | app=h:\quake ultimate complete collection\quake iii complete\quake3.exe |
"TCP Query User{760850C7-EB44-4D06-B0EB-033FD4C1E586}C:\tools\java\bin\java.exe" = protocol=6 | dir=in | app=c:\tools\java\bin\java.exe |
"TCP Query User{7619B3BB-16F8-4881-A53D-48672BF41C68}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |
"TCP Query User{8BFBE2DD-DBD8-48DA-BC20-95D2EAF674D6}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{91E21A6A-B68A-4B73-9C28-D74A100F1498}H:\ioquake3hd\ioq3ded.x86.exe" = protocol=6 | dir=in | app=h:\ioquake3hd\ioq3ded.x86.exe |
"TCP Query User{96E29646-26A6-4B4D-8700-EFA4D80A7F09}C:\tools\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=c:\tools\starcraft ii\versions\base21029\sc2.exe |
"TCP Query User{9B83639A-E159-4BCC-8C79-7A66A87A25E4}C:\program files\planetside\planetside2.exe" = protocol=6 | dir=in | app=c:\program files\planetside\planetside2.exe |
"TCP Query User{9D19AFBE-95BA-4639-8BC9-F2B46A438336}C:\program files (x86)\gog.com\unreal tournament 2004\system\ut2004.exe" = protocol=6 | dir=in | app=c:\program files (x86)\gog.com\unreal tournament 2004\system\ut2004.exe |
"TCP Query User{A12FAFF7-116D-4569-B15D-4DDBBA5029BA}C:\tools\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=6 | dir=in | app=c:\tools\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe |
"TCP Query User{A24424A8-67EB-4884-970A-DEEFBA4E20CD}C:\program files (x86)\gog.com\unreal tournament goty\system\unrealtournament.exe" = protocol=6 | dir=in | app=c:\program files (x86)\gog.com\unreal tournament goty\system\unrealtournament.exe |
"TCP Query User{A97774FF-F46E-484D-863E-AE55FE33FA36}H:\quake ultimate complete collection\enemy territory - quake wars\etqw.exe" = protocol=6 | dir=in | app=h:\quake ultimate complete collection\enemy territory - quake wars\etqw.exe |
"TCP Query User{AD6C2555-F719-4875-ADB9-F50673CDC339}C:\tools\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\tools\winamp\winamp.exe |
"TCP Query User{B1AE16C8-4D42-4C28-B845-1F98000AFC8F}C:\tools\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=c:\tools\starcraft ii\support\blizzarddownloader.exe |
"TCP Query User{B96781FA-2BCB-42AB-BDF8-3C0F91DDC122}H:\battlefield 1942\bf1942.exe" = protocol=6 | dir=in | app=h:\battlefield 1942\bf1942.exe |
"TCP Query User{BCEFD059-1A60-4B1D-967B-B88255AD3B08}C:\tools\starcraft ii\versions\base22612\sc2.exe" = protocol=6 | dir=in | app=c:\tools\starcraft ii\versions\base22612\sc2.exe |
"TCP Query User{BEDD3E2B-472C-46A6-B528-38829B8028BA}C:\tools\starcraft ii\versions\base23260\sc2.exe" = protocol=6 | dir=in | app=c:\tools\starcraft ii\versions\base23260\sc2.exe |
"TCP Query User{CA4D9AB9-F0C9-4B3A-8D26-C8E7CA3B8A75}H:\counter strike\hl2.exe" = protocol=6 | dir=in | app=h:\counter strike\hl2.exe |
"TCP Query User{D833F26D-A36D-497C-A18B-1594D2B50323}H:\warcraft iii\war3.exe" = protocol=6 | dir=in | app=h:\warcraft iii\war3.exe |
"TCP Query User{E16012AF-FD29-4E4B-AF5D-F4B6981E53BB}H:\quake ultimate complete collection\enemy territory - quake wars\etqwded.exe" = protocol=6 | dir=in | app=h:\quake ultimate complete collection\enemy territory - quake wars\etqwded.exe |
"TCP Query User{E32FAA1F-1E10-4408-9DCA-5D626560318E}H:\left 4 dead 2\left4dead2.exe" = protocol=6 | dir=in | app=h:\left 4 dead 2\left4dead2.exe |
"TCP Query User{E51F4966-CEA5-44BF-BAB8-632846491DC3}C:\games\q3ademo\quake3.exe" = protocol=6 | dir=in | app=c:\games\q3ademo\quake3.exe |
"TCP Query User{ECEAE21A-54F4-46BE-91CB-DE05ABC17BB3}C:\users\rainy\desktop\antichamber\antichamber v1.0 steam-rip cracked-richvsm\binaries\win32\udk.exe" = protocol=6 | dir=in | app=c:\users\rainy\desktop\antichamber\antichamber v1.0 steam-rip cracked-richvsm\binaries\win32\udk.exe |
"TCP Query User{FB744752-111F-459B-8B4C-A809504BEDE5}H:\torchlightii\torchlight2.exe" = protocol=6 | dir=in | app=h:\torchlightii\torchlight2.exe |
"TCP Query User{FD73AB2F-0B6E-496F-B980-BD0AB95E3846}C:\tools\winamp\winamp.exe" = protocol=6 | dir=in | app=c:\tools\winamp\winamp.exe |
"UDP Query User{09B69BBB-453B-49E8-86A6-7814C8FCCECF}C:\users\rainy\downloads\utorrent_3.2.2b28595.exe" = protocol=17 | dir=in | app=c:\users\rainy\downloads\utorrent_3.2.2b28595.exe |
"UDP Query User{0DE58554-A515-48A5-9E33-4D6D1D9CFAD2}C:\programdata\battle.net\agent\agent.1363\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"UDP Query User{14C040F1-17D9-43F7-BB86-66FB19F4D08E}C:\tools\starcraft ii\versions\base23260\sc2.exe" = protocol=17 | dir=in | app=c:\tools\starcraft ii\versions\base23260\sc2.exe |
"UDP Query User{1586CCD2-17FA-4F90-88FF-914B5E1313CD}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe |
"UDP Query User{20E41863-20EC-49C0-8D40-C01EC17F3DFE}C:\program files (x86)\steam\steamapps\rainbowdashhcooh\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\rainbowdashhcooh\team fortress 2\hl2.exe |
"UDP Query User{243D8422-23BE-4701-ABBE-6CE6A5DD4E59}C:\tools\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=c:\tools\starcraft ii\support\blizzarddownloader.exe |
"UDP Query User{35260136-4156-4811-95E8-BE5C99BDDC91}E:\left 4 dead 2\left4dead2.exe" = protocol=17 | dir=in | app=e:\left 4 dead 2\left4dead2.exe |
"UDP Query User{42E104E4-9F6C-44F5-A73E-6B7C28258F23}C:\users\rainy\downloads\starcraft_2_eu_de-de.exe" = protocol=17 | dir=in | app=c:\users\rainy\downloads\starcraft_2_eu_de-de.exe |
"UDP Query User{4F0D83FB-26AC-4B23-BBDB-967C4273DB70}C:\games\q3ademo\quake3.exe" = protocol=17 | dir=in | app=c:\games\q3ademo\quake3.exe |
"UDP Query User{52BA6B09-7FB1-45B8-B8B0-21C04ED48744}C:\windows\microsoft.net\framework\v2.0.50727\vbc.exe" = protocol=17 | dir=in | app=c:\windows\microsoft.net\framework\v2.0.50727\vbc.exe |
"UDP Query User{6C5E613E-D521-4528-B48C-328AD41726F3}H:\counter strike\hl2.exe" = protocol=17 | dir=in | app=h:\counter strike\hl2.exe |
"UDP Query User{7ED081CB-EFB5-4A48-A171-9F97970DECF5}C:\tools\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\tools\winamp\winamp.exe |
"UDP Query User{8000EA35-0AD5-4D6A-9544-8BE1E9B84576}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe |
"UDP Query User{8322BF6A-0DFB-4595-AC46-B7C9ACCB37E7}H:\quake ultimate complete collection\enemy territory - quake wars\etqwded.exe" = protocol=17 | dir=in | app=h:\quake ultimate complete collection\enemy territory - quake wars\etqwded.exe |
"UDP Query User{8408777D-7818-4842-95E1-9C653E59E2DC}C:\users\rainy\desktop\antichamber\antichamber v1.0 steam-rip cracked-richvsm\binaries\win32\udk.exe" = protocol=17 | dir=in | app=c:\users\rainy\desktop\antichamber\antichamber v1.0 steam-rip cracked-richvsm\binaries\win32\udk.exe |
"UDP Query User{90DA530A-496C-44BA-9CAF-6F794D44EAFE}H:\ioquake3hd\ioq3ded.x86.exe" = protocol=17 | dir=in | app=h:\ioquake3hd\ioq3ded.x86.exe |
"UDP Query User{92CE027F-6874-48CC-BCDC-91FD2C4E474D}H:\left 4 dead 2\left4dead2.exe" = protocol=17 | dir=in | app=h:\left 4 dead 2\left4dead2.exe |
"UDP Query User{93098145-D521-4F3F-8255-49DA8F5533E9}C:\tools\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe" = protocol=17 | dir=in | app=c:\tools\starcraft ii\sc2-x.x.x.x-1.5.0.22342-enus-downloader.exe |
"UDP Query User{944964DE-2D3C-4790-9C12-E2E7C9CF70AB}H:\torchlightii\torchlight2.exe" = protocol=17 | dir=in | app=h:\torchlightii\torchlight2.exe |
"UDP Query User{9C49CC88-0B1A-42C6-BAA0-29CB093FE17C}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{9C533713-61F9-4A3D-BC57-3995040209A5}H:\starcraft ii\versions\base24944\sc2.exe" = protocol=17 | dir=in | app=h:\starcraft ii\versions\base24944\sc2.exe |
"UDP Query User{A772FE6B-1B1C-48C7-93EF-394580658F96}C:\tools\winamp\winamp.exe" = protocol=17 | dir=in | app=c:\tools\winamp\winamp.exe |
"UDP Query User{AA5C58FF-26F9-4B2D-B3B7-53EB4B226ACF}C:\program files (x86)\left 4 dead 2\left 4 dead 2\left4dead2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\left 4 dead 2\left 4 dead 2\left4dead2.exe |
"UDP Query User{B49E26A3-6B92-4FF6-8DC0-FB60E6D8FC45}C:\program files (x86)\gog.com\unreal tournament 2004\system\ut2004.exe" = protocol=17 | dir=in | app=c:\program files (x86)\gog.com\unreal tournament 2004\system\ut2004.exe |
"UDP Query User{B8A64758-694A-4511-A5DD-BA55DA29B31A}H:\ioquake3hd\ioquake3.x86.exe" = protocol=17 | dir=in | app=h:\ioquake3hd\ioquake3.x86.exe |
"UDP Query User{BA018263-DC3C-4181-ABFE-6003EBB15111}C:\program files (x86)\gog.com\unreal tournament goty\system\unrealtournament.exe" = protocol=17 | dir=in | app=c:\program files (x86)\gog.com\unreal tournament goty\system\unrealtournament.exe |
"UDP Query User{BABB7E35-B8B8-439E-B7BC-1C010535E92D}C:\tools\java\bin\java.exe" = protocol=17 | dir=in | app=c:\tools\java\bin\java.exe |
"UDP Query User{BBBE03C2-85B2-4053-ABEA-DFA874263B3F}H:\quake ultimate complete collection\quake iii complete\quake3.exe" = protocol=17 | dir=in | app=h:\quake ultimate complete collection\quake iii complete\quake3.exe |
"UDP Query User{BE1B6CEE-A619-49FA-9F5C-C149CA8924D5}H:\quake ultimate complete collection\enemy territory - quake wars\etqw.exe" = protocol=17 | dir=in | app=h:\quake ultimate complete collection\enemy territory - quake wars\etqw.exe |
"UDP Query User{C86C4DE9-320E-4582-B518-B224B44D27F0}C:\program files\planetside\planetside2.exe" = protocol=17 | dir=in | app=c:\program files\planetside\planetside2.exe |
"UDP Query User{E0866704-AF34-48E5-9C6B-A3E6D29C32D4}C:\program files (x86)\bethesda softworks\doom 3 bfg edition\doom3bfg.exe" = protocol=17 | dir=in | app=c:\program files (x86)\bethesda softworks\doom 3 bfg edition\doom3bfg.exe |
"UDP Query User{E4BF4B34-49DE-4C98-950A-614C3D052832}H:\battlefield 1942\bf1942.exe" = protocol=17 | dir=in | app=h:\battlefield 1942\bf1942.exe |
"UDP Query User{EA55A317-0B24-4777-8F16-6D6DBCD3822D}H:\warcraft iii\war3.exe" = protocol=17 | dir=in | app=h:\warcraft iii\war3.exe |
"UDP Query User{F4A7AF74-9CBF-4A2B-9AC5-3567D2098B53}C:\tools\starcraft ii\versions\base22612\sc2.exe" = protocol=17 | dir=in | app=c:\tools\starcraft ii\versions\base22612\sc2.exe |
"UDP Query User{FC69060B-EE01-4B17-AC0D-86CD65238174}C:\tools\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=c:\tools\starcraft ii\versions\base21029\sc2.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX700_series" = Canon MX700 series
"{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MX890_series" = Canon MX890 series MP Drivers
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{230D1595-57DA-4933-8C4E-375797EBB7E1}" = Bluetooth Win7 Suite (64)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{52D5E057-0E6A-4F0A-ADE1-46488936C2A1}" = SaveByClick
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-1000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-1000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-1000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUS_{70A3169E-288F-454F-A08D-20DF66639B50}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-1000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-1000-0000000FF1CE}_Office14.PROPLUS_{3013A793-10A7-4D1F-B8B4-2FAA82F4D259}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-1000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-1000-0000000FF1CE}_Office14.PROPLUS_{98782D5D-A9EE-43C6-88AD-B50AD8530E78}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0407-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (German) 2010
"{90140000-0043-0407-1000-0000000FF1CE}_Office14.PROPLUS_{8DFD91C7-66AE-4E54-9901-5D5F401AD329}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-1000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-1000-0000000FF1CE}_Office14.PROPLUS_{8299B64F-1537-4081-974C-033EAB8F098E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-1000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 301.42
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.8.15
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.16.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{BCCC97EE-E162-448C-8847-59718FF29B04}" = Intel(R) Network Connections 15.6.25.0
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{D600D357-5CB9-4DE9-8FD4-14E208BD1970}" = Nero Backup Drivers
"{D9C50188-12D5-4D3E-8F00-682346C2AA5F}" = Microsoft Xbox 360 Accessories 1.2
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CanonMyPrinter" = Canon My Printer
"C-Media CM108 Like Sound Driver" = USB PnP Sound Device
"DesktopIconAmazon" = Desktop Icon für Amazon
"Logitech Gaming Software" = Logitech Gaming Software 8.30
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"PROSetDX" = Intel(R) Network Connections 15.6.25.0
"UDK-384bcb73-1b68-4f8a-acc4-0fa481a28d13" = My Game Long Name
"VLC media player" = VLC media player 2.0.1
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{01E9B2FF-DAF4-4529-9CC9-2101625517C7}" = nero.prerequisites.msi
"{0320AB41-0926-4218-A8A6-68AC84E6BB93}" = Nero Recode 11
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{034DCAF9-96E7-4936-9A07-712F80B5181E}" = Nero RescueAgent 11
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"{0713D1F9-DD77-42C1-8C7D-54D479E2E743}" = Nero SoundTrax 11
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0D7A4289-99CF-4B8D-B812-86BE50A54552}" = Nero Video 11
"{0E64B098-8018-4256-BA23-C316A43AD9B0}" = QuickTime
"{0F32914F-A633-4516-B531-7084C8F19F93}" = Haufe iDesk-Browser
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{11D3EF85-63E1-4AE4-A7C1-9241BDB16B51}" = Nero ControlCenter 11
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{16FB2E08-AE8E-40C6-8334-B6A59E264D05}" = Lexware Admintools Plus
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1D081AB0-B1CC-11E0-80C0-005056B12123}" = Haufe iDesk-Service
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{235211CA-D0E3-4EC8-95D4-C024CE37537C}" = WISO Mein Geld 2012 Professional
"{2432E589-6256-4513-B0BF-EFA8E325D5F0}" = Nero SharedVideoCodecs
"{244FB715-13C4-4C85-BEB6-6C1ABB29D8B1}" = NVIDIA 3D Vision Video Player
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{2B2FBD25-F0E0-412B-8DA8-ECCA2DA53673}_is1" = Quake Ultimate Complete Collection
"{2CA7225D-CB12-462A-9DD1-50319E158BA5}" = Nero 11 PiP Effects Basic
"{2EF0D7ED-F944-4E0D-AC78-7DA00C0B81E4}_is1" = Penumbra Episode Eins
"{390757AA-8830-43DC-AEE0-4E5B6F8439EB}" = Nero SoundTrax 11 Help (CHM)
"{3B418709-D688-4E3A-BE0E-7D71FA84C948}" = Nero 11 PiP Effects 1
"{4382FC76-8100-4951-8658-31834E625E88}" = Nero 11 Video Transitions 1
"{448DA1AD-D1CA-4967-8EFA-9482F31E7BFD}" = Lexware Datenbank plus 2012
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4E4D0FA1-F880-4CCB-999A-501000008200}" = Dark Souls Prepare to Die Edition
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{5052F2A7-5DDE-47F5-BF29-673C10F3DA87}_is1" = Penumbra Requiem
"{51865D9D-8F63-46F2-87AB-9E72F93B618C}" = Welcome App (Start-up experience)
"{53F7746A-96AA-49A5-86B8-59989680DAC5}" = Nero Burning ROM 11 Help (CHM)
"{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"{54B7A3C7-0940-4C16-A509-FC3C3758D22A}_is1" = Amnesia - The Dark Descent
"{55C2143E-FBA5-442F-9AFA-726FF068F39D}" = Nero CoverDesigner 11 Help (CHM)
"{57F80ECF-E27C-4EEE-AB58-E971BACE2639}" = Nero Recode 11 Help (CHM)
"{5A212B2D-140D-46F4-B625-2D1CA5A00594}" = Nero 11 Kwik Themes Basic
"{5E98FDD6-3672-4DBE-AB8B-2C9A0BED1382}" = Nero 11 Disc Menus 3
"{61E1FF8F-C0A5-4F2F-BF24-4EA789B0C000}_is1" = Tomb Raider
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{65BB0407-4CC8-4DC7-952E-3EEFDF05602A}" = Nero Update
"{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}" = Battlefield 1942
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6AB2427E-A18F-4809-9A12-29F5EBABBB3A}" = Nero BackItUp 11 Help (CHM)
"{6AB4E5CD-0062-48E8-96A3-E5B4486DFCB3}" = Lexware buchhalter 2013
"{6B54B1AE-EBCA-48BE-92AF-61D02118F093}" = Lexware online banking
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{79B3E8EE-35F2-4CCD-82D9-4A57F408E449}" = Nero 11 Platinum
"{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}" = Age of Empires III
"{7DF2B5EE-2C16-4E86-9C71-8678068AD805}" = Nero 11 Disc Menus 2
"{7E3137DC-4564-4267-A8A3-B4342D5106D6}" = QuickSteuer DELUXE Wissens-Center 2012
"{8014FACB-1D1D-48C2-94AA-E29EE2E6B9CE}" = Nero WaveEditor 11
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8AE7E507-BC49-4DF0-A236-26878691AB53}" = Lexware Info Service
"{8F311E72-C27F-4DF0-8254-B739A1831668}_is1" = SUPER © v2012.build.53 (Sep 13, 2012) Version v2012.build.53
"{90A4562F-D4A1-4B65-906D-41F236CF6902}" = Path of Exile
"{9193490D-5229-4FC4-9BB9-A6D63C09574A}" = High-Definition Video Playback
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9F6BFB0F-6B1F-4D1A-A9DA-42F6794C9188}" = Lexware Elster
"{A0F34849-D9AB-46DD-B1BE-BB0DB60B1FE8}" = Nero 11 Disc Menus 1
"{A2433A63-5F5D-40E5-B529-9123C2B3E734}" = Anno 1701
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A2CDC001-F8B3-4C64-9E74-2E3FA0FAC9D9}" = Nero 11 Video Samples
"{A4F6BE36-4826-45BA-A396-04F265A3B61D}" = Nero 11 Kwik Themes 2
"{A5B5B6D8-DE44-44A3-90C4-8C07A1E0FAD4}" = WBFS Manager 2.5
"{A733DC44-DC71-447D-AD6C-33B9AB537828}" = QuickSteuer Deluxe 2013
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A7A0BF2E-31CC-49E3-9913-52C503EB969D}" = Nero Audio Pack 1
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AB2BBC64-8AC8-4E66-BBF3-E22D5EACEECA}" = Nero BackItUp 11
"{AB67580-257C-45FF-B8F4-C8C30682091A}_is1" = SIW version 2011.10.29
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.03) - Deutsch
"{ACD6B383-EC5B-4000-A455-CCB308B447FE}" = Nero 11 Kwik Themes 4
"{B160A672-F326-4414-9BB0-A056C61B357C}" = Nero 11 Cliparts
"{B1846721-A8E6-46C7-83B6-0DCF7ADB4267}" = Nero Burning ROM 11
"{B1F69AF3-B5B5-4CA5-ADC5-8A738EB6E574}" = Nero 11 Kwik Themes 1
"{B9B1BA7F-7E07-49DD-A713-5B397A5BB66B}" = Nero Kwik Media Help (CHM)
"{BA499CC0-12C0-4BA5-9007-76844B721158}" = Nero 11 Kwik Themes 3
"{BA6144AE-88CE-4DAF-A185-CA416470A873}" = PowerLine Utility
"{BE672587-331F-42F7-BC38-D59759311C75}" = Lexware reisekosten plus 2012
"{BE814218-3919-4EA3-868A-2F60BC135CB4}" = Nero Kwik Media
"{BEBEE34D-84A2-4EDD-8BEA-96CC54371263}" = Nero Core Components 11
"{D0106CC2-E34B-4FA3-B6B6-91F0ACEA2CC3}" = Hearts of Iron III
"{D01CE99A-8802-483C-A79F-298B691EB432}" = Nero RescueAgent 11 Help (CHM)
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2CBEFA4-F2D3-4E97-A171-8BFD6A31A5EC}" = Nero Express 11 Help (CHM)
"{D34A78EB-78F2-48ab-8CAE-5D4DC255A491}" = Lexware reisekosten plus 2012
"{D4329609-4102-4F8C-B83F-7FE024EEA314}" = Dead Space™ 3
"{D4D66270-9147-4BDF-9946-FCA2B303AA8F}" = Nero ControlCenter 11 Help (CHM)
"{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}" = Microsoft XNA Framework Redistributable 4.0 Refresh
"{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}" = WISO Steuer-Sparbuch 2013
"{D85FFE92-BF14-4E9B-BCCD-E5C16069E65F}_is1" = FireJump
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DDEDAF6C-488E-4CDA-8276-1CCF5F3C5C32}" = Command & Conquer 3
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{E0E55FC1-C53D-4F8D-B14B-B59C312747C8}" = LightScribe System Software
"{E10AAE4A-98B8-420A-BD93-E0520C23D624}" = Nero Express 11
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4B7F2AF-AEDA-4DE8-8014-9ADAFF7B4164}" = QuickSteuer Deluxe 2012
"{E51BC4B0-EA5E-49CC-AF3B-93B5C627EC22}" = Nero 11 Effects Basic
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EB8DED20-A887-4A9C-BB5A-F3E7523DFB44}" = Nero WaveEditor 11 Help (CHM)
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F3743A2C-5D5F-4456-8F98-5DF36A954C50}" = Nero 11 Image Samples
"{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and ConquerTM Generals Zero Hour
"{F49EF443-B2BD-4F10-8A46-87AFCDB90EDD}" = Nero 11 Disc Menus Basic
"{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center
"{F9706A8C-D740-42CA-8703-E08EDD0F0778}" = LogMeIn Hamachi
"{FA66CFD7-0977-4C45-AACD-A8BB994B1A05}" = Quake Live Mozilla Plugin
"{FAC3C37E-EDAB-4F3A-A173-A7C70CC88F09}" = Nero Video 11 Help (CHM)
"{FF44BCE5-5A18-4051-85F0-BC172D7B4695}" = Nero CoverDesigner 11
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Audacity_is1" = Audacity 2.0.3
"Avira AntiVir Desktop" = Avira Free Antivirus
"BioShock Infinite_is1" = BioShock Infinite
"Borderlands 2_is1" = Borderlands 2
"Canon MX700 series Benutzerregistrierung" = Canon MX700 series Benutzerregistrierung
"Canon MX890 series Benutzerregistrierung" = Canon MX890 series Benutzerregistrierung
"Canon MX890 series On-screen Manual" = Canon MX890 series On-screen Manual
"Canon_IJ_Network_Scan_UTILITY" = Canon IJ Network Scan Utility
"Canon_IJ_Network_UTILITY" = Canon IJ Network Tool
"CanonSolutionMenu" = Canon Utilities Solution Menu
"CanonSolutionMenuEX" = Canon Solution Menu EX
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo III" = Diablo III
"Easy-PhotoPrint EX" = Canon Easy-PhotoPrint EX
"Easy-WebPrint EX" = Canon Easy-WebPrint EX
"EVEREST Home Edition_is1" = EVEREST Home Edition v2.20
"ezCoverMaker 3.1.0" = ezCoverMaker 3.1.0
"FileZilla Client" = FileZilla Client 3.2.7.1
"fotokasten comfort_is1" = fotokasten comfort 4.4
"Free PDF to Word Doc Converter_is1" = Free PDF to Word Doc Converter v1.1
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.1.320
"Freeware.de Toolbar" = Freeware.de Toolbar
"GameSpy Arcade" = GameSpy Arcade
"GFWL_{4E4D0FA1-F880-4CCB-999A-501000008200}" = Dark Souls Prepare to Die Edition
"Google Chrome" = Google Chrome
"GrabIt_is1" = GrabIt 1.7.2 Beta 6 (build 1008)
"InstallShield_{06F80017-8F98-4C94-B868-52358569FC32}" = Command & Conquer Generals
"InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}" = Renesas Electronics USB 3.0 Host Controller Driver
"InstallShield_{F3E9C243-122E-4D6B-ACC1-E1FEC02F6CA1}" = Command and ConquerTM Generals Zero Hour
"LogMeIn Hamachi" = LogMeIn Hamachi
"MagniDriver" = marvell 91xx console driver
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400
"Mozilla Firefox 13.0.1 (x86 de)" = Mozilla Firefox 13.0.1 (x86 de)
"Mozilla Thunderbird 13.0.1 (x86 de)" = Mozilla Thunderbird 13.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"MP Navigator EX 1.0" = Canon MP Navigator EX 1.0
"MP Navigator EX 5.1" = Canon MP Navigator EX 5.1
"NoIPDUC" = No-IP DUC
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Open Codecs" = Xiph.Org Open Codecs 0.85.17777
"OpenAL" = OpenAL
"PDF Editor 3" = PDF Editor 3
"Quake 3 Arena Demo" = Quake 3 Arena Demo
"QuickPar" = QuickPar 0.9
"Rage_is1" = Rage
"Red Alert 2" = Command & Conquer Red Alert 2
"RXZvbGFuZA==_is1" = Evoland (c) Shiro Games version 1
"SP_661c9f97" =
"Speed Dial Utility" = Canon Kurzwahlprogramm
"StarCraft II" = StarCraft II
"Steam App 42910" = Magicka
"Steam App 440" = Team Fortress 2
"Steamless Counter Strike Source Pack" = Steamless Counter Strike Source Pack
"Torchlight 2 GERMAN (c) DEADALIC_is1" = Torchlight 2 GERMAN (c) DEADALIC version 1
"Unreal Tournament – Game of the Year Edition_is1" = Unreal Tournament – Game of the Year Edition
"Unreal Tournament 2004_is1" = Unreal Tournament 2004
"UnrealTournament" = Unreal Tournament
"uTorrent" = µTorrent
"WBFS Manager 3.0" = WBFS Manager 3.0
"Winamp" = Winamp
"WinPcapInst" = WinPcap 4.1.2
"WISO Mein Geld 2012 Professional" = WISO Mein Geld 2012 Professional
"Wondershare QuizCreator (Build 4.2.0)_is1" = QuizCreator
"xp-AntiSpy" = xp-AntiSpy 3.98-2
"Yuri's Revenge" = Command && Conquer Red Alert 2 - Yuri's Revenge
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Mozilla Firefox 21.0 (x86 de)" = Mozilla Firefox 21.0 (x86 de)
"Mozilla Thunderbird 17.0.6 (x86 de)" = Mozilla Thunderbird 17.0.6 (x86 de)
"Opera 12.10.1652" = Opera 12.10
"SOE-C:/Program Files/planetside" = gamelauncher-ps2-psg
"SOE-PlanetSide 2 PSG" = PlanetSide 2
"System Progressive Protection" = System Progressive Protection
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"UnityWebPlayer" = Unity Web Player
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 24.06.2013 11:29:43 | Computer Name = Tomatenkönig-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
(x86)\Common Files\Adobe AIR\Versions\1.0\Adobe AIR.dll". Fehler in Manifest- oder
Richtliniendatei "C:\Program Files (x86)\Common Files\Adobe AIR\Versions\1.0\Adobe
AIR.dll" in Zeile 3. Der Wert "MAJOR_VERSION.MINOR_VERSION.BUILD_NUMBER_MAJOR.BUILD_NUMBER_MINOR"
des "version"-Attributs im assemblyIdentity-Element ist ungültig.
Error - 25.06.2013 02:07:56 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
Error - 25.06.2013 09:02:09 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
Error - 26.06.2013 02:07:16 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
Error - 26.06.2013 07:43:50 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
Error - 27.06.2013 08:11:07 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
Error - 27.06.2013 09:48:41 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.06.2013 01:21:50 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.06.2013 04:21:49 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
Error - 28.06.2013 06:08:53 | Computer Name = Tomatenkönig-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 28.06.2013 04:22:30 | Computer Name = Tomatenkönig-PC | Source = WMPNetworkSvc | ID = 866306
Description =
Error - 28.06.2013 06:07:17 | Computer Name = Tomatenkönig-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "atksgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 28.06.2013 06:07:22 | Computer Name = Tomatenkönig-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "lirsgt" wurde aufgrund folgenden Fehlers nicht gestartet:
%%577
Error - 28.06.2013 06:08:20 | Computer Name = Tomatenkönig-PC | Source = DCOM | ID = 10016
Description =
Error - 28.06.2013 06:09:44 | Computer Name = Tomatenkönig-PC | Source = WMPNetworkSvc | ID = 866306
Description =
Error - 28.06.2013 06:09:44 | Computer Name = Tomatenkönig-PC | Source = WMPNetworkSvc | ID = 866306
Description =
Error - 28.06.2013 06:09:44 | Computer Name = Tomatenkönig-PC | Source = WMPNetworkSvc | ID = 866306
Description =
Error - 28.06.2013 06:09:44 | Computer Name = Tomatenkönig-PC | Source = WMPNetworkSvc | ID = 866306
Description =
Error - 28.06.2013 06:09:44 | Computer Name = Tomatenkönig-PC | Source = WMPNetworkSvc | ID = 866306
Description =
Error - 28.06.2013 06:09:44 | Computer Name = Tomatenkönig-PC | Source = WMPNetworkSvc | ID = 866306
Description =
< End of report >
--- --- --- OTL
OTL Logfile: Code:
OTL logfile created on: 28.06.2013 12:17:16 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Rainy\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,98 Gb Total Physical Memory | 6,28 Gb Available Physical Memory | 78,63% Memory free
15,96 Gb Paging File | 14,01 Gb Available in Paging File | 87,80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 218,96 Gb Total Space | 17,79 Gb Free Space | 8,12% Space Free | Partition Type: NTFS
Drive D: | 246,79 Gb Total Space | 221,92 Gb Free Space | 89,92% Space Free | Partition Type: NTFS
Drive E: | 218,96 Gb Total Space | 85,59 Gb Free Space | 39,09% Space Free | Partition Type: NTFS
Drive F: | 489,03 Gb Total Space | 470,73 Gb Free Space | 96,26% Space Free | Partition Type: NTFS
Drive G: | 442,38 Gb Total Space | 416,16 Gb Free Space | 94,07% Space Free | Partition Type: NTFS
Drive H: | 246,80 Gb Total Space | 48,80 Gb Free Space | 19,77% Space Free | Partition Type: NTFS
Drive K: | 194,64 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Computer Name: TOMATENKÖNIG-PC | User Name: Rainy | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.06.28 12:12:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Rainy\Desktop\OTL.exe
PRC - [2013.05.15 12:08:46 | 002,255,184 | ---- | M] (LogMeIn Inc.) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe
PRC - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.11.01 18:05:54 | 001,386,136 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
PRC - [2012.08.13 12:08:08 | 010,376,704 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.exe
PRC - [2012.08.13 12:08:08 | 010,368,512 | ---- | M] (OpenOffice.org) -- C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin
PRC - [2012.08.08 19:12:44 | 000,348,664 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Tools\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.06.20 18:13:12 | 000,074,752 | ---- | M] (Nullsoft, Inc.) -- C:\Tools\Winamp\winampa.exe
PRC - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Tools\Avira\AntiVir Desktop\sched.exe
PRC - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Tools\Avira\AntiVir Desktop\avguard.exe
PRC - [2011.11.25 16:32:36 | 000,687,400 | ---- | M] (Nero AG) -- C:\Program Files (x86)\Nero\Update\NASvc.exe
PRC - [2011.08.04 14:41:44 | 001,637,496 | ---- | M] (CANON INC.) -- C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE
PRC - [2011.07.31 15:07:18 | 000,189,808 | ---- | M] (Haufe-Lexware GmbH & Co. KG) -- C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe
PRC - [2011.06.29 16:16:30 | 000,083,248 | ---- | M] (iAnywhere Solutions, Inc.) -- C:\Program Files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe
PRC - [2010.04.27 04:09:52 | 000,113,288 | ---- | M] (Renesas Electronics Corporation) -- C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
========== Modules (No Company Name) ==========
MOD - [2013.01.24 13:16:54 | 001,050,112 | ---- | M] () -- c:\progra~2\saveby~1\sprote~1.dll
MOD - [2012.11.01 20:00:38 | 002,025,624 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\wfvie13.dll
MOD - [2012.11.01 18:05:54 | 001,386,136 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe
MOD - [2012.11.01 15:47:14 | 008,748,696 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\wgui13.dll
MOD - [2012.11.01 15:47:00 | 002,950,296 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\wcore13.dll
MOD - [2012.11.01 15:46:50 | 000,308,376 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\rscorewinapi48.dll
MOD - [2012.11.01 15:46:48 | 004,070,040 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\wauff13.dll
MOD - [2012.11.01 15:46:36 | 001,710,232 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\wreli13.dll
MOD - [2012.11.01 15:46:34 | 001,596,568 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\wsteu13.dll
MOD - [2012.11.01 15:46:34 | 000,320,664 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\rsguiwinapi48.dll
MOD - [2012.11.01 15:46:20 | 000,135,832 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\rsodbc48.dll
MOD - [2012.11.01 15:46:16 | 000,028,672 | ---- | M] () -- C:\Program Files (x86)\WISO\Steuersoftware 2013\rsdcom48.dll
MOD - [2012.08.10 17:51:32 | 000,985,088 | ---- | M] () -- C:\Program Files (x86)\OpenOffice.org 3\program\libxml2.dll
MOD - [2012.06.14 10:14:32 | 013,198,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\3971e166cf827b6726e142f344061dc9\System.Windows.Forms.ni.dll
MOD - [2012.06.14 10:14:23 | 001,666,048 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8c40f40ef36622109793788049fbe9ab\System.Drawing.ni.dll
MOD - [2012.06.14 10:12:27 | 005,617,664 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\d1f299160424bad90fe9f658661389e2\System.Xml.ni.dll
MOD - [2012.06.14 10:12:23 | 000,982,528 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\623d2a0f11dd82bb9bc13d1cb981b239\System.Configuration.ni.dll
MOD - [2012.06.14 10:12:19 | 009,091,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\6f9f0467e8b2dd3f69b015c8e30ac945\System.ni.dll
MOD - [2012.06.14 10:12:12 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3953b1d8b9b57e4957bff8f58145384e\mscorlib.ni.dll
MOD - [2011.03.17 00:11:16 | 004,297,568 | ---- | M] () -- C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE14\Cultures\office.odf
MOD - [2011.03.04 12:02:54 | 007,745,536 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtGui4.dll
MOD - [2011.03.04 12:02:52 | 000,135,168 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\plugins\imageformats\qjpeg4.dll
MOD - [2011.03.04 12:02:50 | 002,121,728 | ---- | M] () -- C:\Program Files (x86)\Common Files\LightScribe\QtCore4.dll
========== Services (SafeList) ==========
SRV:64bit: - [2010.08.12 15:00:20 | 000,133,800 | ---- | M] (Intel Corporation) [Auto | Running] -- C:\Windows\SysNative\IPROSetMonitor.exe -- (Intel® PROSet Monitoring Service)
SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2013.06.12 20:15:08 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.06.07 00:06:24 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.05.15 12:08:44 | 002,467,664 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2013.05.11 12:37:26 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.02.28 18:45:16 | 000,161,384 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.06.15 00:17:46 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.05.02 01:42:28 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Tools\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.05.02 00:34:34 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Tools\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011.11.25 16:32:36 | 000,687,400 | ---- | M] (Nero AG) [Auto | Running] -- C:\Program Files (x86)\Nero\Update\NASvc.exe -- (NAUpdate)
SRV - [2011.06.29 16:16:30 | 000,083,248 | ---- | M] (iAnywhere Solutions, Inc.) [Auto | Running] -- C:\Program Files (x86)\Sybase\SQL Anywhere 9\win32\dbsrv9.exe -- (Lexware_Datenbank_Plus)
SRV - [2010.12.28 00:27:52 | 051,727,736 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Mama Tools\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2010.10.27 16:18:52 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto | Running] -- C:\Program Files (x86)\Bluetooth Suite\adminservice.exe -- (AtherosSvc)
SRV - [2010.06.25 19:07:20 | 000,117,264 | ---- | M] (CACE Technologies, Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\WinPcap\rpcapd.exe -- (rpcapd)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2013.05.15 16:07:00 | 000,303,616 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2013.05.15 16:06:55 | 000,035,328 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2012.06.28 23:09:31 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.05.15 14:55:40 | 000,398,656 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvstusb.sys -- (NvStUSB)
DRV:64bit: - [2012.05.02 15:24:12 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2012.04.27 10:20:04 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.04.25 00:32:27 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.18 19:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.12.01 11:42:44 | 000,072,240 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NBVol.sys -- (NBVol)
DRV:64bit: - [2011.12.01 11:42:44 | 000,015,920 | ---- | M] (Nero AG) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NBVolUp.sys -- (NBVolUp)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.21 05:24:43 | 000,020,992 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2010.11.21 05:24:33 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.21 05:23:48 | 000,117,248 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tsusbhub.sys -- (tsusbhub)
DRV:64bit: - [2010.11.21 05:23:48 | 000,088,960 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Synth3dVsc.sys -- (Synth3dVsc)
DRV:64bit: - [2010.11.21 05:23:48 | 000,071,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dmvsc.sys -- (dmvsc)
DRV:64bit: - [2010.11.21 05:23:48 | 000,034,816 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\terminpt.sys -- (terminpt)
DRV:64bit: - [2010.11.21 05:23:47 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.21 05:23:47 | 000,031,232 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV:64bit: - [2010.10.27 15:50:28 | 000,301,680 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2010.10.27 15:50:28 | 000,279,152 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2010.10.27 15:50:28 | 000,203,624 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2010.10.27 15:50:28 | 000,156,520 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2010.10.27 15:50:28 | 000,058,992 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2010.10.27 15:50:28 | 000,055,336 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AthDfu.sys -- (ATHDFU)
DRV:64bit: - [2010.10.27 15:50:28 | 000,038,248 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2010.10.27 15:50:28 | 000,031,080 | ---- | M] (Atheros) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2010.09.21 09:59:38 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\HECIx64.sys -- (MEIx64)
DRV:64bit: - [2010.09.21 08:34:18 | 000,313,520 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1c62x64.sys -- (e1cexpress)
DRV:64bit: - [2010.08.27 19:53:22 | 000,297,000 | ---- | M] (Marvell Semiconductor, Inc.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\mv91xx.sys -- (mv91xx)
DRV:64bit: - [2010.06.25 19:07:26 | 000,035,344 | ---- | M] (CACE Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\npf.sys -- (NPF)
DRV:64bit: - [2010.04.27 03:30:52 | 000,184,968 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010.04.27 03:29:54 | 000,083,080 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2009.11.24 02:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.24 02:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.09.03 17:56:20 | 001,307,648 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\CM10864.sys -- (USBPNPA)
DRV:64bit: - [2009.08.21 01:52:10 | 000,079,976 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\xusb21.sys -- (xusb21)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009.07.14 02:35:37 | 000,025,088 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\WSDScan.sys -- (WSDScan)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 22:37:05 | 006,108,416 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2009.06.10 22:35:53 | 000,051,712 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rtnic64.sys -- (RTL8023x64)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.18 17:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2736476
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: ""
FF - prefs.js..browser.search.defaultenginename,S: S", ""
FF - prefs.js..browser.search.defaultthis.engineName: ""
FF - prefs.js..browser.search.defaulturl: ""
FF - prefs.js..browser.search.order.1: ""
FF - prefs.js..browser.search.order.1,S: S", ""
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.selectedEngine,S: S", ""
FF - prefs.js..browser.startup.homepage: "google.de"
FF - prefs.js..extensions.enabledAddons: %7Ba95d8332-e4b4-6e7f-98ac-20b733364387%7D:0.6.4
FF - prefs.js..extensions.enabledAddons: youtubeunblocker%40unblocker.yt:0.4.4
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:22.0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""
FF - prefs.js..keyword.URL: ""
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\MAMATO~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.1: C:\Tools\VLC\npvlc.dll (VideoLAN)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@canon.com/EPPEX: C:\Program Files (x86)\Canon\Easy-PhotoPrint EX\NPEZFFPI.DLL (CANON INC.)
FF - HKLM\Software\MozillaPlugins\@idsoftware.com/QuakeLive: C:\ProgramData\id Software\QuakeLive\npquakezero.dll (id Software Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.51204.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~3\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@Nero.com/KM: C:\PROGRA~2\COMMON~1\Nero\BROWSE~1\NPBROW~1.DLL (Nero AG)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.145\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Rainy\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Tools\Mozilla Firefox\components [2013.05.17 13:57:54 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Tools\Mozilla Firefox\plugins [2013.05.17 13:57:51 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Components: C:\Mama Tools\Mozilla Thunderbird\components [2013.06.27 17:09:29 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 13.0.1\extensions\\Plugins: C:\Mama Tools\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Components: C:\Tools\Mozilla Firefox\components [2013.05.17 13:57:54 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 21.0\extensions\\Plugins: C:\Tools\Mozilla Firefox\plugins [2013.05.17 13:57:51 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Components: C:\Mama Tools\Mozilla Thunderbird\components [2013.06.27 17:09:29 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 17.0.6\extensions\\Plugins: C:\Mama Tools\Mozilla Thunderbird\plugins
[2012.07.01 11:54:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rainy\AppData\Roaming\mozilla\Extensions
[2013.06.07 20:54:11 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Rainy\AppData\Roaming\mozilla\Firefox\Profiles\bd7rnn6m.default-1368618891935\extensions
[2013.06.07 20:54:11 | 000,008,025 | ---- | M] () (No name found) -- C:\Users\Rainy\AppData\Roaming\mozilla\firefox\profiles\bd7rnn6m.default-1368618891935\extensions\youtubeunblocker@unblocker.yt.xpi
[2013.06.03 20:14:51 | 000,054,689 | ---- | M] () (No name found) -- C:\Users\Rainy\AppData\Roaming\mozilla\firefox\profiles\bd7rnn6m.default-1368618891935\extensions\{a95d8332-e4b4-6e7f-98ac-20b733364387}.xpi
[2013.05.15 13:56:43 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\Rainy\AppData\Roaming\mozilla\firefox\profiles\bd7rnn6m.default-1368618891935\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
========== Chrome ==========
CHR - homepage: hxxp://www.google.com/
O1 HOSTS File: ([2013.06.14 21:00:43 | 000,004,205 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 adobeereg.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 www.adobeereg.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 68 more lines...
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Mama Tools\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Mama Tools\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll File not found
O2 - BHO: (Canon Easy-WebPrint EX BHO) - {3785D0AD-BFFF-47F6-BF5B-A587C162FED9} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexbho.dll (CANON INC.)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O2 - BHO: (CIESpeechBHO Class) - {8D10F6C4-0E01-4BD4-8601-11AC1FDF8126} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~3\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (Canon Easy-WebPrint EX) - {759D9886-0C6F-4498-BAB6-4A5F47C6C72F} - C:\Program Files (x86)\Canon\Easy-WebPrint EX\ewpexhlp.dll (CANON INC.)
O3 - HKLM\..\Toolbar: (Freeware.de Toolbar) - {7e111a5c-3d11-4f56-9463-5310c3c69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (Freeware.de Toolbar) - {7E111A5C-3D11-4F56-9463-5310C3C69025} - C:\Program Files (x86)\Freeware.de\prxtbFree.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AthBtTray] C:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] C:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Communications)
O4:64bit: - HKLM..\Run: [BCSSync] C:\Mama Tools\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [CanonMyPrinter] C:\Program Files\Canon\MyPrinter\BJMyPrt.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [CanonSolutionMenu] C:\Program Files (x86)\Canon\SolutionMenu\CNSLMAIN.exe (CANON INC.)
O4:64bit: - HKLM..\Run: [Cm108Sound] C:\Windows\Syswow64\cm108.dll (C-Media Corporation)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [XboxStat] C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe (Microsoft Corporation)
O4 - HKLM..\Run: [AdobeCS5ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS5ServiceManager\CS5ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avgnt] C:\Tools\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [CanonSolutionMenuEx] C:\Program Files (x86)\Canon\Solution Menu EX\CNSEMAIN.EXE (CANON INC.)
O4 - HKLM..\Run: [LexwareInfoService] C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe (Haufe-Lexware GmbH & Co. KG)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [NBAgent] C:\Tools\Nero\Nero 11\Nero BackItUp\NBAgent.exe (Nero AG)
O4 - HKLM..\Run: [NUSB3MON] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [WinampAgent] C:\Tools\Winamp\winampa.exe (Nullsoft, Inc.)
O4 - Startup: C:\Users\Rainy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O8:64bit: - Extra context menu item: An OneNote s&enden - C:\Mama Tools\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8:64bit: - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Mama Tools\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: An OneNote s&enden - C:\Mama Tools\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Mama Tools\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Mama Tools\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Mama Tools\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Mama Tools\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - C:\Mama Tools\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - C:\Program Files (x86)\Bluetooth Suite\IEPlugIn.dll (Atheros Commnucations)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} https://fpdownload.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5D9EF6C7-4E77-4D73-B86B-BE7CE59249C0}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{93B03C5D-735A-4AAA-B491-6440247F6FF3}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\haufereader - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\haufereader - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - AppInit_DLLs: (c:\progra~2\saveby~1\sprote~1.dll) - c:\progra~2\saveby~1\sprote~1.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\Mama Tools\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~3\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2008.08.25 17:57:47 | 000,000,042 | R--- | M] () - K:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{9f92edac-c161-11e1-aedd-004095338007}\Shell - "" = AutoRun
O33 - MountPoints2\{9f92edac-c161-11e1-aedd-004095338007}\Shell\AutoRun\command - "" = K:\penumbra_requiem_eng.exe -- [2008.08.25 17:55:10 | 122,303,323 | R--- | M] (Frictional Games )
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.06.28 12:12:33 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Rainy\Desktop\OTL.exe
[2013.06.28 12:09:31 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\Atheros
[2013.06.28 12:07:32 | 000,000,000 | R--D | C] -- C:\Users\Rainy\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BT Devices
[2013.06.14 21:36:56 | 000,000,000 | ---D | C] -- C:\ProgramData\regid.1986-12.com.adobe
[2013.06.14 21:06:22 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Adobe
[2013.06.14 21:05:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Adobe Media Player
[2013.06.14 21:05:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe
[2013.06.14 21:04:28 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Adobe AIR
[2013.06.12 17:19:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.06.12 17:19:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.06.05 19:12:44 | 000,000,000 | ---D | C] -- C:\Users\Rainy\Documents\Penumbra
[2013.06.04 16:38:20 | 000,000,000 | ---D | C] -- C:\Users\Rainy\Documents\Penumbra Overture
[2013.06.04 16:38:13 | 000,431,104 | ---- | C] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll
[2013.06.04 16:38:13 | 000,409,600 | ---- | C] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
[2013.06.04 16:38:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenAL
[2013.06.04 16:36:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Penumbra
[2013.05.30 16:43:34 | 000,000,000 | ---D | C] -- C:\Users\Rainy\Desktop\Bücher Dokumente Spiritual
[2013.05.30 16:18:05 | 000,000,000 | ---D | C] -- C:\Users\Rainy\Desktop\Spiele
[2012.09.28 13:42:01 | 000,044,544 | ---- | C] (Microsoft Corporation) -- C:\ProgramData\lsass.exe
========== Files - Modified Within 30 Days ==========
[2013.06.28 12:16:14 | 000,026,352 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.06.28 12:16:14 | 000,026,352 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.06.28 12:15:01 | 000,000,140 | ---- | M] () -- C:\Users\Rainy\defogger_reenable
[2013.06.28 12:15:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.06.28 12:13:54 | 000,377,856 | ---- | M] () -- C:\Users\Rainy\Desktop\gmer_2.1.19163.exe
[2013.06.28 12:12:48 | 000,050,477 | ---- | M] () -- C:\Users\Rainy\Desktop\Defogger.exe
[2013.06.28 12:12:34 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Rainy\Desktop\OTL.exe
[2013.06.28 12:12:00 | 000,001,122 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.06.28 12:08:49 | 000,001,969 | ---- | M] () -- C:\Users\Rainy\Desktop\Skype.lnk
[2013.06.28 12:07:31 | 000,000,035 | ---- | M] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini
[2013.06.28 12:07:21 | 000,001,118 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.06.28 12:07:15 | 000,000,266 | ---- | M] () -- C:\Windows\tasks\AutoKMS.job
[2013.06.28 12:07:08 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.06.28 12:07:01 | 2132,025,343 | -HS- | M] () -- C:\hiberfil.sys
[2013.06.20 17:10:56 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.06.20 17:10:56 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.06.20 17:10:56 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.06.20 17:10:56 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.06.20 17:10:56 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.06.15 06:47:37 | 005,004,328 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.06.14 21:00:43 | 000,004,205 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2013.06.07 23:31:57 | 000,000,004 | ---- | M] () -- C:\Users\Rainy\Documents\schmup.123
[2013.06.04 16:38:13 | 000,431,104 | ---- | M] (Creative Labs) -- C:\Windows\SysNative\wrap_oal.dll
[2013.06.04 16:38:13 | 000,409,600 | ---- | M] (Creative Labs) -- C:\Windows\SysWow64\wrap_oal.dll
========== Files Created - No Company Name ==========
[2013.06.28 12:15:01 | 000,000,140 | ---- | C] () -- C:\Users\Rainy\defogger_reenable
[2013.06.28 12:13:54 | 000,377,856 | ---- | C] () -- C:\Users\Rainy\Desktop\gmer_2.1.19163.exe
[2013.06.28 12:12:48 | 000,050,477 | ---- | C] () -- C:\Users\Rainy\Desktop\Defogger.exe
[2013.06.28 12:08:49 | 000,001,969 | ---- | C] () -- C:\Users\Rainy\Desktop\Skype.lnk
[2013.06.28 12:07:31 | 000,000,035 | ---- | C] () -- C:\Users\Public\Documents\AtherosServiceConfig.ini
[2013.06.14 21:07:39 | 000,000,741 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5 (64 Bit).lnk
[2013.06.14 21:07:21 | 000,000,696 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Photoshop CS5.lnk
[2013.06.14 21:06:20 | 000,000,670 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Bridge CS5.lnk
[2013.06.14 21:06:14 | 000,000,733 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Device Central CS5.lnk
[2013.06.14 21:04:51 | 000,000,790 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Extension Manager CS5.lnk
[2013.06.14 21:04:46 | 000,001,523 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe ExtendScript Toolkit CS5.lnk
[2013.06.14 21:04:29 | 000,000,997 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Help.lnk
[2013.06.10 19:14:22 | 001,272,843 | ---- | C] () -- C:\Users\Rainy\Desktop\Bardon, Franz - Der Weg zum wahren Adepten.pdf
[2013.06.07 23:00:43 | 000,000,004 | ---- | C] () -- C:\Users\Rainy\Documents\schmup.123
[2013.03.24 12:42:54 | 000,081,408 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2013.02.16 18:06:46 | 000,001,209 | ---- | C] () -- C:\Windows\eReg.dat
[2013.01.21 19:11:14 | 000,000,080 | ---- | C] () -- C:\Windows\wiso.ini
[2012.10.07 13:23:10 | 000,207,488 | ---- | C] () -- C:\Windows\SysWow64\LXPrnUtil10.dll
[2012.10.07 13:23:08 | 000,138,368 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvmc100.dll
[2012.10.07 13:23:08 | 000,074,368 | ---- | C] () -- C:\Windows\SysWow64\LxDNTvm100.dll
[2012.10.07 13:23:06 | 000,318,592 | ---- | C] () -- C:\Windows\SysWow64\LxDNT100.dll
[2012.10.01 19:42:57 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2012.10.01 19:41:17 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2012.09.14 08:59:14 | 004,503,728 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.06.29 08:41:38 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix108.dll
[2012.06.29 08:41:38 | 000,000,169 | ---- | C] () -- C:\Windows\Cm108.ini.cfl
[2012.06.29 08:41:29 | 000,002,029 | ---- | C] () -- C:\Windows\Cm108.ini.cfg
[2012.06.29 08:41:29 | 000,000,123 | ---- | C] () -- C:\Windows\Cm108.ini.imi
[2012.06.29 08:41:28 | 000,001,151 | ---- | C] () -- C:\Windows\cm108.ini
[2012.06.29 00:16:22 | 000,000,135 | ---- | C] () -- C:\Windows\ODBC.INI
[2012.06.28 23:30:27 | 000,008,192 | ---- | C] () -- C:\Windows\SysWow64\drivers\IntelMEFWVer.dll
[2012.06.28 23:23:24 | 000,001,769 | ---- | C] () -- C:\Windows\Language_trs.ini
[2012.06.28 23:23:21 | 000,025,181 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2012.06.28 23:04:54 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2012.05.15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.01.04 12:44:25 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.01.04 10:59:38 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2013.06.16 18:29:25 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\.minecraft
[2013.04.12 22:34:44 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Audacity
[2012.12.16 10:45:22 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Canon
[2013.05.19 16:24:20 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\com.shirogames.evoland
[2013.05.27 18:26:07 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2012.08.27 19:07:46 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\DAEMON Tools Lite
[2013.05.25 09:42:52 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\DVDVideoSoft
[2013.04.01 12:08:40 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\DVDVideoSoftIEHelpers
[2013.03.24 16:45:13 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\FileOpen
[2013.01.05 18:47:58 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\FileZilla
[2013.01.03 20:17:29 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\GrabIt
[2012.08.04 21:41:29 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Leadertech
[2012.07.01 11:17:46 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Lexware
[2012.07.09 15:03:33 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\LolClient
[2013.03.24 16:45:13 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Nitro
[2013.02.15 13:31:56 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\OpenOffice.org
[2012.11.07 16:47:06 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Opera
[2013.01.12 12:48:05 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Quake3
[2012.11.07 16:00:13 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\TeamViewer
[2012.07.02 17:06:20 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\Thunderbird
[2013.05.12 09:21:44 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\TS3Client
[2013.06.14 20:45:31 | 000,000,000 | ---D | M] -- C:\Users\Rainy\AppData\Roaming\uTorrent
========== Purity Check ==========
< End of report >
--- --- --- Gmer
GMER Logfile: Code:
GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-06-28 13:07:10
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP2T0L0-2 SAMSUNG_HD501LJ rev.CR100-10 465,76GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\Rainy\AppData\Local\Temp\awtdapod.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075391465 2 bytes [39, 75]
.text C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe[768] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753914bb 2 bytes [39, 75]
.text ... * 2
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075391465 2 bytes [39, 75]
.text C:\Program Files (x86)\OpenOffice.org 3\program\soffice.bin[2172] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753914bb 2 bytes [39, 75]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[5244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075391465 2 bytes [39, 75]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe[5244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000753914bb 2 bytes [39, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\002683115a51
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\002683115a51 (not active ControlSet)
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk1\DR1 unknown MBR code
---- EOF - GMER 2.1 ----
--- --- ---
Ist Hijackthis veraltet, oder gab es speziellere Gründe, warum es nichtmehr genutzt wird?
Ansonsten, vielen Dank schonmal für deine Antwort, falls es noch was gibt - Das Übliche: Bin da.
Liebe Grüße |
Cracks und Keygens