Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Trojaner; schwarzer Bildschirm; Nachricht; 50 Euro (https://www.trojaner-board.de/112053-trojaner-schwarzer-bildschirm-nachricht-50-euro.html)

Freezer271 21.03.2012 19:00
Trojaner; schwarzer Bildschirm; Nachricht; 50 Euro
 
Guten Tag liebes Trojaner-Board-Team

Wie mein Titel schon sagt hab ich mir einen Trojaner oder so etwas in der Art eingefangen.

Es erscheint immer beim Anmelden ein schwarzer Hintergrund, mit einer Nachricht und darüber die deutsche Flagge. Es wird von einer ernormen Viren belastung auf meinem System gewarnt und mann müsse ein Sicherheitsupdate erwerben. Bezahlen über Paypal oder Ukash

Ich habe den PC neu gestartet, und die Meldung ist wieder erschienen.

Nun Arbeite ich im Abgesicherten Modus.

Danke für die Hilfe

Freundliche Grüsse

Freezer271

markusg 21.03.2012 19:22
hi,
abgesicherter modus mit netzwerk starten, im betroffenen konto anmelden, dort bitte die internet verbindung herstellen und folgendes durchführen:
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Freezer271 21.03.2012 19:56
Danke für die schnelle Antwort.

Die OTL-DAtei:

OTL Logfile:
Code:
OTL logfile created on: 21.03.2012 19:25:52 - Run 1
OTL by OldTimer - Version 3.2.39.1    Folder = C:\Users\Benutzer\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
8.00 Gb Total Physical Memory | 7.10 Gb Available Physical Memory | 88.83% Memory free
24.34 Gb Paging File | 23.68 Gb Available in Paging File | 97.30% Paging File free
Paging file location(s): c:\pagefile.sys 0 0e:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.76 Gb Total Space | 136.26 Gb Free Space | 29.25% Space Free | Partition Type: NTFS
Drive E: | 1397.26 Gb Total Space | 1024.77 Gb Free Space | 73.34% Space Free | Partition Type: NTFS
Drive G: | 6.08 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive I: | 7.47 Gb Total Space | 7.47 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
 
Computer Name: LUCIUS-PC | User Name: Benutzer | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.03.21 19:24:22 | 000,594,432 | ---- | M] (OldTimer Tools) -- C:\Users\Benutzer\Downloads\OTL.exe
PRC - [2010.06.03 01:50:58 | 001,144,104 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2010.06.03 01:51:08 | 000,095,528 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll
MOD - [2010.06.03 01:50:58 | 001,144,104 | ---- | M] () -- C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2011.12.06 04:11:56 | 000,235,520 | ---- | M] (AMD) [Auto | Stopped] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.03.02 20:15:36 | 000,489,256 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.02.15 17:25:37 | 000,076,888 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.02.13 00:17:53 | 003,340,064 | ---- | M] () [Auto | Stopped] -- c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll -- (Akamai)
SRV - [2010.03.18 12:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.03.10 13:26:48 | 000,189,728 | ---- | M] (Protexis Inc.) [Auto | Stopped] -- c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2)
SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.12.22 01:08:38 | 000,814,344 | ---- | M] (ABBYY) [Disabled | Stopped] -- C:\Program Files (x86)\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe -- (ABBYY.Licensing.FineReader.Professional.10.0)
SRV - [2009.08.18 11:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.04 15:49:18 | 000,278,528 | ---- | M] () [Disabled | Stopped] -- E:\Programme\NETGEAR\WNDA3100v2\WifiSvc.exe -- (WSWNDA3100)
SRV - [2009.03.29 20:42:16 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.06.15 15:34:20 | 000,071,096 | ---- | M] () [Disabled | Stopped] -- C:\Program Files (x86)\CDBurnerXP\NMSAccessU.exe -- (NMSAccessU)
SRV - [2007.11.13 10:53:20 | 000,106,496 | ---- | M] () [Disabled | Stopped] -- C:\Windows\CBTWlanSrv.exe -- (CBTWlanSrv)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2011.12.06 04:45:40 | 010,720,256 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2011.12.06 04:45:40 | 010,720,256 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2011.12.06 03:12:14 | 000,327,168 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2011.10.17 18:40:40 | 000,090,128 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdLH6.sys -- (AtiHDAudioService)
DRV:64bit: - [2011.05.10 07:06:08 | 000,051,712 | ---- | M] (Apple, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\usbaapl64.sys -- (USBAAPL64)
DRV:64bit: - [2011.02.20 14:13:21 | 000,254,528 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\DRIVERS\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2010.04.19 19:29:18 | 000,022,528 | ---- | M] (Apple Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\netaapl64.sys -- (Netaapl)
DRV:64bit: - [2010.03.29 10:16:08 | 000,063,016 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\L1E60x64.sys -- (L1E)
DRV:64bit: - [2010.02.24 11:20:40 | 000,191,616 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2009.10.01 01:51:42 | 000,046,592 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\wpdusb.sys -- (WpdUsb)
DRV:64bit: - [2009.09.30 15:32:44 | 000,120,336 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV:64bit: - [2009.06.10 10:14:36 | 000,043,264 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SaiBus.sys -- (SaiNtBus)
DRV:64bit: - [2009.06.10 10:14:36 | 000,016,000 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\SaiMini.sys -- (SaiMini)
DRV:64bit: - [2009.05.18 12:17:08 | 000,034,152 | ---- | M] (GEAR Software Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\GEARAspiWDM.sys -- (GEARAspiWDM)
DRV:64bit: - [2009.05.05 12:09:46 | 000,789,496 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\bcmwlhigh664.sys -- (BCMH43XX)
DRV:64bit: - [2008.11.13 20:25:52 | 000,868,848 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\SysNative\Drivers\sptd.sys -- (sptd)
DRV:64bit: - [2008.04.22 08:53:36 | 000,012,744 | R--- | M] (EnTech Taiwan) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\ENTECH64.sys -- (ENTECH64)
DRV:64bit: - [2008.01.21 03:51:07 | 000,016,384 | ---- | M] (Microsoft Corporation) [Recognizer | System | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2008.01.21 03:47:27 | 000,903,168 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\xnacc.sys -- (xnacc)
DRV:64bit: - [2007.11.07 04:23:14 | 000,040,464 | ---- | M] (CACE Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\npf.sys -- (NPF)
DRV:64bit: - [2007.08.28 17:04:20 | 000,067,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\xusb21.sys -- (xusb21)
DRV:64bit: - [2007.05.01 15:10:50 | 000,171,144 | ---- | M] (Saitek) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\DRIVERS\SaiH075C.sys -- (SaiH075C)
DRV:64bit: - [2007.01.19 18:24:24 | 000,025,312 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | Boot | Running] -- C:\Windows\SysNative\DRIVERS\scmndisp.sys -- (SCMNdisP)
DRV:64bit: - [2006.11.28 21:46:20 | 000,041,280 | ---- | M] (Printing Communications Assoc., Inc. (PCAUSA)) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\Drivers\CBPSp50a64.sys -- (CBPSp50a64)
DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\DRIVERS\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2002.01.01 01:11:14 | 000,314,016 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\DRIVERS\atksgt.sys -- (atksgt)
DRV:64bit: - [2002.01.01 01:11:13 | 000,043,680 | ---- | M] () [Kernel | Auto | Stopped] -- C:\Windows\SysNative\DRIVERS\lirsgt.sys -- (lirsgt)
DRV - [2009.09.04 12:16:14 | 000,146,928 | ---- | M] (CyberLink Corp.) [2010/05/02 14:45:07] [Kernel | Auto | Stopped] -- C:\Program Files (x86)\CyberLink\PowerDVD\000.fcl -- ({95808DC4-FA4A-4C74-92FE-5B863F82066B})
DRV - [2009.04.24 15:03:10 | 000,018,432 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\LG Soft India\forteManager\bin\PII2CDriver.sys -- (LGII2CDevice)
DRV - [2009.04.24 15:03:10 | 000,014,336 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Program Files (x86)\LG Soft India\forteManager\bin\I2CDriver.sys -- (LGDDCDevice)
DRV - [2008.10.20 17:23:22 | 000,154,368 | ---- | M] (CyberLink Corporation.) [File_System | Auto | Stopped] -- C:\Windows\SysWow64\drivers\CLBUDFR.sys -- (CLBUDFR)
DRV - [2008.10.20 17:23:22 | 000,010,368 | ---- | M] (Cyberlink Co.,Ltd.) [Kernel | Boot | Stopped] -- C:\Windows\SysWow64\drivers\CLBStor.sys -- (CLBStor)
DRV - [2005.06.02 22:36:38 | 000,047,662 | ---- | M] (Silence of Troubles United Company Ltd.) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\FDCENT.SYS -- (FDCENT)
DRV - [2005.05.09 14:42:27 | 000,018,003 | ---- | M] (Motive, Inc.) [Kernel | On_Demand | Stopped] -- C:\PROGRA~2\COMMON~1\Motive\MRENDIS5.SYS -- (MRENDIS5)
DRV - [2004.05.13 14:00:04 | 000,111,808 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prohlp02.sys -- (prohlp02)
DRV - [2004.05.13 12:19:36 | 000,079,488 | ---- | M] (Protection Technology) [Kernel | System | Stopped] -- C:\Windows\SysWOW64\drivers\prodrv06.sys -- (prodrv06)
DRV - [2003.12.01 16:20:52 | 000,004,832 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\sfhlp01.sys -- (sfhlp01)
DRV - [2003.09.06 13:22:08 | 000,006,944 | ---- | M] (Protection Technology) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\prosync1.sys -- (prosync1)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Search,Local Page = Google
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA7406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{4327FABE-3C21-4689-8DBE-D226CF777FE9}: "URL" = hxxp://www2.iesearch.com/s/?&q={searchTerms}
IE - HKLM\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&systemid=406&q={searchTerms}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Babylon Search
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {8A96AF9E-4074-43b7-BEA3-87217BDA7406}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://isearch.babylon.com/web/{searchTerms}?babsrc=browsersearch&babsrc=SP_ss&affID=18474&mntrId=e67903c7000000000000002215f0fba6
IE - HKCU\..\SearchScopes\{23467ED4-D351-40B6-B35F-72B884FD1B26}: "URL" = hxxp://www.google.de/search?q={searchTerms}
IE - HKCU\..\SearchScopes\{4327FABE-3C21-4689-8DBE-D226CF777FE9}: "URL" = hxxp://www2.iesearch.com/s/?&q={searchTerms}
IE - HKCU\..\SearchScopes\{8A96AF9E-4074-43b7-BEA3-87217BDA7406}: "URL" = hxxp://www.searchqu.com/web?src=ieb&systemid=406&q={searchTerms}
IE - HKCU\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB9}: "URL" = hxxp://www.daemon-search.com/search?q={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local;127.0.0.1:9421
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 216.245.198.202:80
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Web Search"
FF - prefs.js..browser.search.order.1: "Web Search"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.ch/firefox?client=firefox-a&rls=org.mozilla:de:official"
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:2.7.1.3
FF - prefs.js..extensions.enabledItems: battlefieldheroespatcher@ea.com:5.0.31.0
FF - prefs.js..keyword.URL: "hxxp://www.searchqu.com/web?src=ffb&systemid=406&q="
FF - prefs.js..network.proxy.backup.ftp: "80.90.151.106"
FF - prefs.js..network.proxy.backup.ftp_port: 80
FF - prefs.js..network.proxy.backup.socks: "80.90.151.106"
FF - prefs.js..network.proxy.backup.socks_port: 80
FF - prefs.js..network.proxy.backup.ssl: "80.90.151.106"
FF - prefs.js..network.proxy.backup.ssl_port: 80
FF - prefs.js..network.proxy.ftp: "195.37.234.5"
FF - prefs.js..network.proxy.ftp_port: 80
FF - prefs.js..network.proxy.http: "195.37.234.5"
FF - prefs.js..network.proxy.http_port: 80
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "195.37.234.5"
FF - prefs.js..network.proxy.socks_port: 80
FF - prefs.js..network.proxy.ssl: "195.37.234.5"
FF - prefs.js..network.proxy.ssl_port: 80
FF - prefs.js..network.proxy.type: 0
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX,Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc;version=0.8.6i: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.03.17 15:08:05 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.10.03 20:27:45 | 000,000,000 | ---D | M]
 
[2011.05.21 13:15:45 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Extensions
[2012.01.07 17:04:43 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Firefox\Profiles\spducmme.default\extensions
[2010.06.29 16:47:51 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Firefox\Profiles\spducmme.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.05.21 13:15:36 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Firefox\Profiles\spducmme.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2010.08.29 14:42:03 | 000,000,000 | ---D | M] (Battlefield Heroes Updater) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Firefox\Profiles\spducmme.default\extensions\battlefieldheroespatcher@ea.com
[2011.03.27 12:15:57 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Firefox\Profiles\spducmme.default\extensions\engine@conduit.com
[2011.11.17 18:12:50 | 000,000,000 | ---D | M] (Babylon) -- C:\Users\Benutzer\AppData\Roaming\mozilla\Firefox\Profiles\spducmme.default\extensions\ffxtlbr@babylon.com
[2011.03.23 13:24:21 | 000,005,529 | ---- | M] () -- C:\Users\Benutzer\AppData\Roaming\Mozilla\Firefox\Profiles\spducmme.default\searchplugins\SearchquWebSearch.xml
[2012.01.02 14:19:53 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.03.17 15:08:05 | 000,097,208 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011.10.03 20:27:09 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2012.02.18 09:45:16 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.11.17 18:12:47 | 000,002,336 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012.02.18 09:45:16 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.02.18 09:45:16 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.18 09:45:16 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.03.23 13:24:21 | 000,005,529 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\SearchquWebSearch.xml
[2012.02.18 09:45:16 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.18 09:45:16 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - default_search_provider: Google ()
CHR - default_search_provider: search_url = {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?client=chrome&hl={language}&q={searchTerms}
 
O1 HOSTS File: ([2006.09.18 22:37:24 | 000,000,761 | ---- | M]) - C:\Windows\SysNative\drivers\etc\Hosts
O1 - Hosts: 127.0.0.1      localhost
O1 - Hosts: ::1            localhost
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2 - BHO: (Skype add-on (mastermind)) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.35.10\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\Windows iLivid Toolbar\ToolBar\searchqudtx.dll ()
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O2 - BHO: (no name) - {ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a}  - No CLSID value found.
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3:64bit: - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) -  - No CLSID value found.
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.4.35.10\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\PROGRA~2\Windows iLivid Toolbar\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3:64bit: - HKCU\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Program Files (x86)\softonic-de3\tbsoft.dll (Conduit Ltd.)
O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [BDRegion] C:\Program Files (x86)\Cyberlink\Shared Files\brs.exe (cyberlink)
O4 - HKLM..\Run: [CLMLServer] C:\Program Files (x86)\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
O4 - HKLM..\Run: [DATAMNGR] C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\datamngrUI.exe (Discordia, LTD)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [ExpressFiles] C:\Program Files (x86)\ExpressFiles\ExpressFiles.exe (Express Files)
O4 - HKLM..\Run: [hffsrv] c:\Windows\hffext\hffsrv.exe ()
O4 - HKLM..\Run: [LanguageShortcut] C:\Program Files (x86)\CyberLink\PowerDVD\Language\Language.exe ()
O4 - HKLM..\Run: [LGODDFU] C:\Program Files (x86)\lg_fwupdate\fwupdate.exe (BitLeader)
O4 - HKLM..\Run: [RoccatKone+] C:\Program Files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.EXE (ROCCAT GmbH)
O4 - HKLM..\Run: [StartCCC] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdateLBPShortCut] C:\Program Files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdateP2GoShortCut] C:\Program Files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePPShortCut] C:\Program Files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Benutzer\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [EADM] E:\Programme\Origin\Origin.exe (Electronic Arts)
O4 - HKCU..\Run: [iso data fast cast] "C:\ProgramData\hope dead army.e2wcg3j" File not found
O4 - HKCU..\Run: [ISUSPM Startup] C:\PROGRA~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe -startup File not found
O4 - HKCU..\Run: [Logo Cool] "C:\ProgramData\Licensegplgpl.orb70" File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [RGSC] E:\Programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe /silent File not found
O4 - HKCU..\Run: [SkypePM] C:\Users\Benutzer\AppData\Local\Skype\SkypePM.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {5067A26B-1337-4436-8AFE-EE169C2DA79F} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll (Skype Technologies S.A.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: Microsoft XML Parser for Java file:///C:/Windows/Java/classes/xmldso.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{833C9642-08A9-4518-BF5E-AE5D1FDDF73D}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{8FDC4918-E8F4-4418-9A61-6D5186A3919A}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9F3C90FD-B47D-446E-B0AC-8BCC181CEF7B}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B5963102-0C58-4D01-A0F0-EEF5FD2A516C}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E1BD8214-23E5-4963-96CA-022EC8BB2E4E}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\PROGRA~2\WI1F86~1\MESSEN~1\msgrapp.14.0.8089.0726.dll (Microsoft Corporation)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\x64\datamngr.dll) - C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\x64\datamngr.dll (Discordia, LTD)
O20:64bit: - AppInit_DLLs: (C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\x64\IEBHO.dll) - C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\x64\IEBHO.dll (Discordia, LTD)
O20 - AppInit_DLLs: (C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\datamngr.dll) - C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\datamngr.dll (Discordia, LTD)
O20 - AppInit_DLLs: (C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\IEBHO.dll) - C:\PROGRA~2\Windows iLivid Toolbar\Datamngr\IEBHO.dll (Discordia, LTD)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Benutzer\Desktop\modernwarfare247121920x[1].jpg
O24 - Desktop BackupWallPaper: C:\Users\Benutzer\Desktop\modernwarfare247121920x[1].jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2011.11.09 11:28:28 | 000,190,342 | R--- | M] () - G:\Autorun.ico -- [ UDF ]
O32 - AutoRun File - [2012.02.04 03:49:26 | 000,000,106 | R--- | M] () - G:\autorun.inf -- [ UDF ]
O33 - MountPoints2\{2417be88-3cd9-11e0-84d0-be3ad565fffb}\Shell - "" = AutoRun
O33 - MountPoints2\{2417be88-3cd9-11e0-84d0-be3ad565fffb}\Shell\AutoRun\command - "" = H:\Setup.exe
O33 - MountPoints2\{8bc32250-e36f-11df-9e0a-002215f0fba6}\Shell - "" = AutoRun
O33 - MountPoints2\{8bc32250-e36f-11df-9e0a-002215f0fba6}\Shell\AutoRun\command - "" = I:\LaunchU3.exe -a
O33 - MountPoints2\{f64ab962-546e-11df-9d37-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{f64ab962-546e-11df-9d37-806e6f6e6963}\Shell\AutoRun\command - "" = E:\autoplay.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} -
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} -
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Microsoft VM
ActiveX: {10880D85-AAD9-4558-ABDC-2AB1552D831F} - "C:\Program Files (x86)\Common Files\LightScribe\LSRunOnce.exe"
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.7
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {EFCE7BE0-510E-4932-9475-F44CD90DE16A} - Microsoft .NET Framework 1.1 Security Update (KB2572067)
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^forteManager.lnk -  - File not found
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^HP Digital Imaging Monitor.lnk - C:\PROGRA~2\HP\Digital Imaging\bin\hpqtra08.exe - (Hewlett-Packard Co.)
MsConfig:64bit - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^McAfee Security Scan Plus.lnk - C:\PROGRA~2\McAfee Security Scan\2.0.181\SSScheduler.exe - (McAfee, Inc.)
MsConfig:64bit - StartUpFolder: C:^Users^Benutzer^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^OpenOffice.org 3.2.lnk - C:\PROGRA~2\OpenOffice.org 3\program\quickstart.exe - ()
MsConfig:64bit - StartUpReg: AppleSyncNotifier - hkey= - key= - C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: Bonus.SSR.FR10 - hkey= - key= - C:\Program Files (x86)\ABBYY FineReader 10\Bonus.ScreenshotReader.exe (ABBYY.)
MsConfig:64bit - StartUpReg: DAEMON Tools Lite - hkey= - key= - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
MsConfig:64bit - StartUpReg: DriverMax - hkey= - key= - C:\Program Files (x86)\Innovative Solutions\DriverMax\devices.exe (Innovative Solutions)
MsConfig:64bit - StartUpReg: DriverMax_RESTART - hkey= - key= - C:\Program Files (x86)\Innovative Solutions\DriverMax\devices.exe (Innovative Solutions)
MsConfig:64bit - StartUpReg: EA Core - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: EADM - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: HP Software Update - hkey= - key= - C:\Program Files (x86)\HP\HP Software Update\HPWuSchd2.exe (Hewlett-Packard Co.)
MsConfig:64bit - StartUpReg: ISUSPM Startup - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: ISUSScheduler - hkey= - key= - C:\Program Files (x86)\Common Files\InstallShield\UpdateService\issch.exe (InstallShield Software Corporation)
MsConfig:64bit - StartUpReg: iTunesHelper - hkey= - key= - C:\Program Files (x86)\iTunes\iTunesHelper.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: LightScribe Control Panel - hkey= - key= - C:\Program Files (x86)\Common Files\LightScribe\LightScribeControlPanel.exe (Hewlett-Packard Company)
MsConfig:64bit - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig:64bit - StartUpReg: ProfilerU - hkey= - key= - C:\Programme\Saitek\SD6\Software\ProfilerU.exe (Saitek)
MsConfig:64bit - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files (x86)\QuickTime\QTTask.exe (Apple Inc.)
MsConfig:64bit - StartUpReg: SaiMfd - hkey= - key= - C:\Programme\Saitek\SD6\Software\SaiMfd.exe (Saitek)
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: Steam - hkey= - key= -  File not found
MsConfig:64bit - State: "startup" - Reg Error: Key error.
MsConfig:64bit - State: "services" - Reg Error: Key error.
MsConfig:64bit - State: "bootini" - Reg Error: Key error.
 
CREATERESTOREPOINT
Error creating restore point.
 
========== Files/Folders - Created Within 30 Days ==========
 
[2027.02.09 15:54:17 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\Documents\ArmA 2 Other Profiles
[2015.07.08 16:53:26 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\AppData\Local\CAPCOM
[2015.07.08 15:50:22 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\Documents\CAPCOM
[2012.03.21 18:36:25 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\CyberLink PowerDVD
[2012.03.19 21:46:14 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\Desktop\RWS 2012
[2012.03.19 19:38:47 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\AppData\Roaming\ExpressFiles
[2012.03.19 19:38:47 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\ExpressFiles
[2012.03.18 14:13:00 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\AppData\Local\SKIDROW
[2012.03.18 13:32:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Xvid
[2012.03.18 13:32:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Xvid
[2012.03.18 13:32:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Video Codec
[2012.03.18 13:25:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RailSimulator.com
[2012.03.17 12:16:17 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Landwirtschafts Simulator 2011
[2012.03.17 11:57:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Premium
[2012.03.17 11:57:34 | 000,000,000 | ---D | C] -- C:\ProgramData\InstallMate
[2012.03.15 19:23:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.03.15 19:22:50 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.03.15 19:22:48 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.03.15 19:22:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.03.15 19:12:21 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.03.07 18:47:03 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 3
[2012.03.07 18:46:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NVIDIA Corporation
[2012.03.02 21:28:01 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\AppData\Local\PAYDAY
[2012.02.26 13:49:45 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\Desktop\1234
[2012.02.22 18:21:07 | 000,000,000 | ---D | C] -- C:\Users\Benutzer\AppData\Roaming\wargaming.net
[2012.02.22 18:16:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\World of Tanks
[2012.02.22 18:04:43 | 000,000,000 | ---D | C] -- C:\Games
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.21 19:24:49 | 000,000,805 | ---- | M] () -- C:\Users\Benutzer\Desktop\OTL - Verknüpfung.lnk
[2012.03.21 18:53:12 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.21 18:51:10 | 000,004,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.21 18:51:10 | 000,004,928 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.20 17:42:21 | 000,001,356 | ---- | M] () -- C:\Users\Benutzer\AppData\Local\d3d9caps.dat
[2012.03.19 19:38:49 | 000,001,796 | ---- | M] () -- C:\Users\Public\Desktop\ExpressFiles.lnk
[2012.03.18 13:25:06 | 000,001,136 | ---- | M] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk
[2012.03.17 12:16:17 | 000,000,858 | ---- | M] () -- C:\Users\Benutzer\Desktop\Landwirtschafts Simulator 2011 .lnk
[2012.03.15 19:23:30 | 000,001,694 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.03.14 20:38:55 | 000,002,201 | ---- | M] () -- C:\Users\Public\Desktop\Los Angeles Mod v2.1.lnk
[2012.03.07 18:47:03 | 000,000,988 | ---- | M] () -- C:\Users\Public\Desktop\Mass Effect 3.lnk
[2012.03.07 18:11:49 | 000,000,596 | ---- | M] () -- C:\Users\Public\Desktop\Origin.lnk
[2012.03.01 19:11:13 | 000,000,552 | ---- | M] () -- C:\Users\Benutzer\AppData\Local\d3d8caps.dat
[2012.02.22 18:16:43 | 000,000,725 | ---- | M] () -- C:\Users\Public\Desktop\World of Tanks.lnk
[2012.02.20 20:24:44 | 000,282,864 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2012.02.20 20:24:44 | 000,282,864 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.02.20 20:24:36 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.03.21 19:24:49 | 000,000,805 | ---- | C] () -- C:\Users\Benutzer\Desktop\OTL - Verknüpfung.lnk
[2012.03.19 19:38:49 | 000,001,796 | ---- | C] () -- C:\Users\Public\Desktop\ExpressFiles.lnk
[2012.03.18 13:32:19 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2012.03.18 13:32:19 | 000,153,088 | ---- | C] () -- C:\Windows\SysWow64\xvid.ax
[2012.03.18 13:32:18 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2012.03.18 13:25:06 | 000,001,136 | ---- | C] () -- C:\Users\Public\Desktop\Railworks 3 Train Simulator 2012 Deluxe.lnk
[2012.03.17 12:16:17 | 000,000,858 | ---- | C] () -- C:\Users\Benutzer\Desktop\Landwirtschafts Simulator 2011 .lnk
[2012.03.15 19:23:30 | 000,001,694 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.03.14 20:38:55 | 000,002,201 | ---- | C] () -- C:\Users\Public\Desktop\Los Angeles Mod v2.1.lnk
[2012.03.07 18:47:03 | 000,000,988 | ---- | C] () -- C:\Users\Public\Desktop\Mass Effect 3.lnk
[2012.03.07 18:11:49 | 000,000,596 | ---- | C] () -- C:\Users\Public\Desktop\Origin.lnk
[2012.02.22 18:16:43 | 000,000,725 | ---- | C] () -- C:\Users\Public\Desktop\World of Tanks.lnk
[2011.12.10 10:23:19 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
[2011.12.05 22:04:00 | 000,059,904 | ---- | C] () -- C:\Windows\SysWow64\OpenVideo.dll
[2011.12.05 22:03:52 | 000,054,784 | ---- | C] () -- C:\Windows\SysWow64\OVDecode.dll
[2011.11.25 18:34:50 | 000,000,056 | ---- | C] () -- C:\Windows\SysWow64\ezsidmv.dat
[2011.11.17 18:27:17 | 000,000,000 | ---- | C] () -- C:\Users\Benutzer\AppData\Roaming\FileOut.cns
[2011.11.17 18:27:17 | 000,000,000 | ---- | C] () -- C:\Users\Benutzer\AppData\Roaming\FileIn.cns
[2011.10.29 15:24:12 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll
[2011.10.29 15:23:47 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll
[2011.10.29 15:21:05 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin
[2011.10.27 16:43:18 | 000,000,552 | ---- | C] () -- C:\Users\Benutzer\AppData\Local\d3d8caps.dat
[2011.10.25 21:21:34 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\OVDecoder.dll
[2011.09.11 17:44:32 | 000,000,001 | ---- | C] () -- C:\Windows\SysWow64\SI.bin
[2011.04.09 17:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.02.05 09:09:53 | 000,053,299 | ---- | C] () -- C:\Windows\SysWow64\pthreadVC.dll
[2010.11.12 21:53:02 | 000,000,190 | ---- | C] () -- C:\Windows\ODBCINST.INI
[2010.11.12 21:18:29 | 000,225,296 | ---- | C] () -- C:\ProgramData\hope dead army.e2wcg3j
[2010.11.12 21:18:15 | 000,380,944 | ---- | C] () -- C:\ProgramData\Licensegplgpl.orb70
[2010.11.12 21:18:14 | 000,163,856 | ---- | C] () -- C:\ProgramData\Licensegplgpl.ympi4r
[2010.10.29 19:26:03 | 000,146,217 | ---- | C] () -- C:\Windows\hpoins18.dat
[2010.10.29 19:25:53 | 000,006,600 | ---- | C] () -- C:\Windows\hpomdl18.dat
[2010.08.29 14:56:01 | 002,427,248 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_heroes.exe
[2010.05.21 18:32:59 | 002,434,856 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_bc2.exe
[2010.05.02 08:38:56 | 000,001,356 | ---- | C] () -- C:\Users\Benutzer\AppData\Local\d3d9caps.dat
[2010.04.30 16:57:48 | 000,000,343 | ---- | C] () -- C:\Windows\lgfwup.ini
[2010.04.18 14:03:56 | 000,043,520 | ---- | C] () -- C:\Windows\SysWow64\CmdLineExt03.dll
[2010.04.14 15:56:27 | 000,101,204 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2010.03.25 22:25:15 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin
 
========== LOP Check ==========
 
[2011.05.21 13:19:14 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Babylon
[2009.02.06 17:32:52 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Black Sea Studios
[2009.11.20 22:46:21 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Blitware
[2010.05.08 13:11:12 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Broken Sword 2.5
[2011.06.22 18:28:57 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Canneverbe_Limited
[2008.11.13 20:54:43 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Capcom
[2010.03.30 17:41:53 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Command and Conquer 4
[2008.11.13 20:25:41 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\DAEMON Tools
[2011.02.20 14:14:49 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\DAEMON Tools Lite
[2012.03.21 18:05:57 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\ExpressFiles
[2002.01.01 02:07:57 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\FFSJ
[2011.11.17 18:12:43 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\FileHunter
[2010.10.29 20:00:08 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\GetRightToGo
[2011.04.01 16:34:42 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Kalypso Media
[2010.10.24 08:18:31 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\mediAvatar
[2010.03.21 19:13:27 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\OpenOffice.org
[2011.10.27 17:19:03 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Origin
[2001.12.31 23:04:45 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Petroglyph
[2011.03.30 18:15:54 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\ProtectDisc
[2009.06.13 00:57:28 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Red Alert 3
[2009.02.19 19:23:17 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Silver Style Entertainment
[2010.05.17 15:50:35 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\SpieleEntwicklungsKombinat
[2008.11.15 00:38:22 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\SPORE
[2011.03.15 20:47:30 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\The Creative Assembly
[2009.01.18 14:06:23 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\ubi.com
[2011.11.28 22:08:37 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\Ubisoft
[2012.03.18 17:28:20 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\uTorrent
[2012.02.22 18:25:07 | 000,000,000 | ---D | M] -- C:\Users\Benutzer\AppData\Roaming\wargaming.net
[2009.11.21 00:25:18 | 000,000,468 | ---- | M] () -- C:\Windows\Tasks\Driver Robot.job
[2012.03.21 18:51:10 | 000,032,510 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2010.05.14 16:54:44 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.10.29 15:18:05 | 000,000,000 | ---D | M] -- C:\1df0ca765808e5a2a47997c57dd4
[2012.02.13 15:19:35 | 000,000,000 | ---D | M] -- C:\AMD
[2010.05.02 08:46:19 | 000,000,000 | ---D | M] -- C:\ATI
[2011.10.29 16:13:57 | 000,000,000 | -HSD | M] -- C:\Boot
[2009.04.12 13:48:44 | 000,000,000 | ---D | M] -- C:\computec
[2012.03.16 17:54:18 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2010.10.10 18:09:12 | 000,000,000 | ---D | M] -- C:\crack sh4
[2006.11.02 16:42:17 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2008.11.09 16:34:28 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012.02.22 18:04:43 | 000,000,000 | ---D | M] -- C:\Games
[2011.12.17 14:07:56 | 000,000,000 | ---D | M] -- C:\HattrickOrganizer
[2008.01.21 04:04:13 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.03.15 19:22:50 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.03.19 19:38:47 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2012.03.17 11:57:54 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2008.11.09 16:34:28 | 000,000,000 | -HSD | M] -- C:\Programme
[2010.01.21 21:26:30 | 000,000,000 | ---D | M] -- C:\Scenario
[2012.03.20 20:28:59 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2011.10.29 11:11:32 | 000,000,000 | ---D | M] -- C:\temp
[2011.02.04 21:14:45 | 000,000,000 | ---D | M] -- C:\Users
[2012.03.16 17:55:56 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< MD5 for: AGP440.SYS  >
[2008.01.21 03:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\SysNative\drivers\AGP440.sys
[2008.01.21 03:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_163188bf770e4ab0\AGP440.sys
[2008.01.21 03:46:51 | 000,064,568 | ---- | M] (Microsoft Corporation) MD5=F6F6793B7F17B550ECFDBD3B229173F7 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_181d01cb743015fc\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2008.01.21 03:46:50 | 000,022,584 | ---- | M] (Microsoft Corporation) MD5=1898FAE8E07D97F2F6C2D5326C633FAC -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_3956c39dd9e73fd2\atapi.sys
[2009.04.10 23:15:02 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- C:\Windows\SysNative\drivers\atapi.sys
[2009.04.10 23:15:02 | 000,020,952 | ---- | M] (Microsoft Corporation) MD5=E68D9B3A3905619732F7FE039466A623 -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_3b423ca9d7090b1e\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 12:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\SysNative\cngaudit.dll
[2006.11.02 12:16:48 | 000,014,848 | ---- | M] (Microsoft Corporation) MD5=21322B1A2AD337C579F4A65EA0D25193 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_424bc4aceb06de1c\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\SysWOW64\cngaudit.dll
[2006.11.02 10:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2008.10.29 07:20:29 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=37440D09DEAE0B672A04DCCF7ABF06BE -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_b5f700fe698beb14\explorer.exe
[2008.10.29 07:29:41 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=4F554999D7D5F05DAAEBBA7B5BA1089D -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_b7eb106e66a7ac19\explorer.exe
[2008.10.29 07:15:50 | 003,087,360 | ---- | M] (Microsoft Corporation) MD5=50514057C28A74BAC2BD04B7B990D615 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.16771_none_aba256ac352b2919\explorer.exe
[2008.10.30 04:59:17 | 002,927,616 | ---- | M] (Microsoft Corporation) MD5=50BA5850147410CDE89C523AD3BC606E -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_b8583e9d7fda0512\explorer.exe
[2009.04.10 23:10:18 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\explorer.exe
[2009.04.10 23:10:18 | 003,079,168 | ---- | M] (Microsoft Corporation) MD5=6B08E54A451B3F95E4109DBA7E594270 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_afbebba22f3bab41\explorer.exe
[2008.10.28 03:30:12 | 003,086,848 | ---- | M] (Microsoft Corporation) MD5=72B9990E45C25AA3C75C4FB50A9D6CE0 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_ac5266dd4e2b0a41\explorer.exe
[2008.10.29 07:49:22 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=BBD8E74F23D7605CB0CDB57A1B25D826 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18164_none_ad96661c3246ea1e\explorer.exe
[2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\SysWOW64\explorer.exe
[2009.04.10 22:27:38 | 002,926,592 | ---- | M] (Microsoft Corporation) MD5=D07D4C3038F3578FFCE1C0237F2A1253 -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6002.18005_none_ba1365f4639c6d3c\explorer.exe
[2008.10.30 06:30:07 | 003,081,216 | ---- | M] (Microsoft Corporation) MD5=E404A65EF890140410E9F3D405841C95 -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.22298_none_ae03944b4b794317\explorer.exe
[2008.10.28 03:15:02 | 002,923,520 | ---- | M] (Microsoft Corporation) MD5=E7156B0B74762D9DE0E66BDCDE06E5FB -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6000.20947_none_b6a7112f828bcc3c\explorer.exe
[2008.01.21 03:48:44 | 003,080,704 | ---- | M] (Microsoft Corporation) MD5=F6D765FB6B457542D954682F50C26E4F -- C:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_add342963219dff5\explorer.exe
[2008.01.21 03:49:23 | 002,927,104 | ---- | M] (Microsoft Corporation) MD5=FFA764631CB70A30065C12EF8E174F9F -- C:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.0.6001.18000_none_b827ece8667aa1f0\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2008.01.21 03:46:59 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2008.01.21 03:46:59 | 000,290,872 | ---- | M] (Intel Corporation) MD5=3E3BF3627D886736D0B4E90054F929F6 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_0b2fedfc40256bc5\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2008.01.21 03:51:03 | 000,716,800 | ---- | M] (Microsoft Corporation) MD5=5D0A4891F8CD0E9E64FF57A6A34044F5 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_59d652c6f057598d\netlogon.dll
[2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SysWOW64\netlogon.dll
[2009.04.10 22:28:24 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_6616762521d9e6d4\netlogon.dll
[2009.04.10 23:11:18 | 000,717,312 | ---- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB -- C:\Windows\SysNative\netlogon.dll
[2009.04.10 23:11:18 | 000,717,312 | ---- | M] (Microsoft Corporation) MD5=A3F1B171702CA04744EE514243B45BFB -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_5bc1cbd2ed7924d9\netlogon.dll
[2008.01.21 03:48:28 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_642afd1924b81b88\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2008.01.21 03:46:54 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\SysNative\drivers\nvstor.sys
[2008.01.21 03:46:54 | 000,054,328 | ---- | M] (NVIDIA Corporation) MD5=F7EA0FE82842D05EDA3EFDD376DBFDBA -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_95f95eab775c159d\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.21 03:50:28 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_9e812831c5d9a243\scecli.dll
[2008.01.21 03:49:49 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=35F1DD99F9903BC267C2AF16B09F9BF7 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_942c7ddf9178e048\scecli.dll
[2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SysWOW64\scecli.dll
[2009.04.10 22:28:26 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_a06ca13dc2fb6d8f\scecli.dll
[2009.04.10 23:11:24 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B -- C:\Windows\SysNative\scecli.dll
[2009.04.10 23:11:24 | 000,235,520 | ---- | M] (Microsoft Corporation) MD5=9922ADB6DCA8F0F5EA038BEFF339C08B -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_9617f6eb8e9aab94\scecli.dll
 
< MD5 for: USER32.DLL  >
[2008.01.21 03:48:29 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=32B87D215905F648EBE36A621978442C -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_295707c525b9f068\user32.dll
[2008.01.21 03:49:14 | 000,648,192 | ---- | M] (Microsoft Corporation) MD5=3D691030DBD3BD75DE1501BE54F0D425 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_33abb2175a1ab263\user32.dll
[2009.04.10 22:26:46 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\SysWOW64\user32.dll
[2009.04.10 22:26:46 | 000,648,704 | ---- | M] (Microsoft Corporation) MD5=D29FDB5DEDBDC1BD882164DC6DC4DD53 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_35972b23573c7daf\user32.dll
[2009.04.10 23:11:28 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=F3F5549E69AE8509342E67E4F972CA1C -- C:\Windows\SysNative\user32.dll
[2009.04.10 23:11:28 | 000,820,224 | ---- | M] (Microsoft Corporation) MD5=F3F5549E69AE8509342E67E4F972CA1C -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_2b4280d122dbbbb4\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\SysWOW64\userinit.exe
[2008.01.21 03:50:36 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2008.01.21 03:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\SysNative\userinit.exe
[2008.01.21 03:49:46 | 000,028,160 | ---- | M] (Microsoft Corporation) MD5=A0AB2BB9A92293D9CE66E252719AB5FE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_384755998a0d6941\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.10 23:11:10 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\SysNative\winlogon.exe
[2009.04.10 23:11:10 | 000,405,504 | ---- | M] (Microsoft Corporation) MD5=6D0773A3A65D28B663F334C90441D01A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_cdcd15a68a70b877\winlogon.exe
[2008.01.21 03:49:47 | 000,406,016 | ---- | M] (Microsoft Corporation) MD5=856491FCED98093D824B9EB2892F564A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_cbe19c9a8d4eed2b\winlogon.exe
[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SysWOW64\winlogon.exe
[2009.04.10 22:28:14 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2008.01.21 03:50:38 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2008.01.21 03:49:42 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2008.01.21 03:49:42 | 000,020,992 | ---- | M] (Microsoft Corporation) MD5=8A900348370E359B6BFF6A550E4649E1 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_aba53c58802b1777\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
< %USERPROFILE%\*.* >
[2012.03.21 19:25:18 | 008,388,608 | -HS- | M] () -- C:\Users\Benutzer\NTUSER.DAT
[2012.03.21 19:25:17 | 000,262,144 | -H-- | M] () -- C:\Users\Benutzer\ntuser.dat.LOG1
[2008.11.09 16:36:45 | 000,000,000 | -H-- | M] () -- C:\Users\Benutzer\ntuser.dat.LOG2
[2012.03.21 18:51:07 | 000,065,536 | -HS- | M] () -- C:\Users\Benutzer\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TM.blf
[2010.07.24 18:10:01 | 000,524,288 | -HS- | M] () -- C:\Users\Benutzer\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000001.regtrans-ms
[2012.03.21 18:51:07 | 000,524,288 | -HS- | M] () -- C:\Users\Benutzer\NTUSER.DAT{c328fef1-6a85-11db-9fbd-cf3689cba3de}.TMContainer00000000000000000002.regtrans-ms
[2008.11.09 16:36:45 | 000,000,020 | -HS- | M] () -- C:\Users\Benutzer\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,20480,768 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ProfileControl=Off MaxRequestThreads=16

< End of report >
--- --- ---

Freezer271 21.03.2012 19:59
Und die Extra-Datei:


Extra Logfile:

Code:
OTL Extras logfile created on: 21.03.2012 19:25:52 - Run 1
OTL by OldTimer - Version 3.2.39.1    Folder = C:\Users\Benutzer\Downloads
64bit-Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000807 | Country: Schweiz | Language: DES | Date Format: dd.MM.yyyy
 
8.00 Gb Total Physical Memory | 7.10 Gb Available Physical Memory | 88.83% Memory free
24.34 Gb Paging File | 23.68 Gb Available in Paging File | 97.30% Paging File free
Paging file location(s): c:\pagefile.sys 0 0e:\pagefile.sys 0 0 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 465.76 Gb Total Space | 136.26 Gb Free Space | 29.25% Space Free | Partition Type: NTFS
Drive E: | 1397.26 Gb Total Space | 1024.77 Gb Free Space | 73.34% Space Free | Partition Type: NTFS
Drive G: | 6.08 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: UDF
Drive I: | 7.47 Gb Total Space | 7.47 Gb Free Space | 100.00% Space Free | Partition Type: FAT32
 
Computer Name: LUCIUS-PC | User Name: Benutzer | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = ChromeHTML] -- Reg Error: Key error. File not found
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
http [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
https [open] -- "C:\Program Files (x86)\Google\Chrome\Application\chrome.exe" -- "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- C:\Program Files (x86)\VideoLAN\VLC\vlc.exe --started-from-file --playlist-enqueue "%1" ()
Directory [Browse with &IrfanView] -- "C:\Program Files (x86)\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- C:\Program Files (x86)\VideoLAN\VLC\vlc.exe --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = 9F 9E 16 8C DC 5B C8 01  [binary data]
"VistaSp2" = EF 57 5F 35 4D 96 CC 01  [binary data]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\S-1-5-21-1210777864-786218563-2691137719-1000]
"EnableNotifications" = 0
"EnableNotificationsRef" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"oobe_av" = 1
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0AAB320E-5FE9-4656-B24F-4CAB68C96F5E}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{0DF04929-902F-410C-BC41-9DA68EEE2E24}" = rport=138 | protocol=17 | dir=out | app=system |
"{1D912B14-ED4E-4FC3-8A50-0E27EA8E786E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{22A7280F-3696-4CFF-A354-8626B303329A}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{250B24EC-3985-49C7-97BD-912D24849C29}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{321A984F-6B65-415B-B946-4F0AED83A490}" = rport=137 | protocol=17 | dir=out | app=system |
"{3FA7D9B3-79A2-443E-8847-C8A42FC7E662}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5285CF42-360D-4408-8742-3495F4BA5937}" = rport=139 | protocol=6 | dir=out | app=system |
"{55D4EC86-275C-46C4-B2B0-810B8A4F81D1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{57448A4F-9326-402B-90A7-E3E33D4C0469}" = lport=138 | protocol=17 | dir=in | app=system |
"{5AF22CC9-227A-458B-991C-047F9A2215AA}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6B4D2EBB-5BEA-4B73-93D7-783D066E3961}" = lport=137 | protocol=17 | dir=in | app=system |
"{8357D02B-651F-4C71-83D6-2EBAAD5DE4A9}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{84D86A69-7D4A-448D-BF12-2AC6A093F479}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{8F5B42EF-F079-42EF-B5F1-D0E5F6E23928}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{926FEF2D-915C-431B-9361-CA721DFDE8EB}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{9F00C374-5537-4F4F-B193-161D3413DD60}" = lport=2869 | protocol=6 | dir=in | app=system |
"{9F5F34B5-15EC-46E2-BEC1-86FF1FED7C3C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A97BFC84-CFCA-428C-AD24-1D489BE2DC22}" = lport=445 | protocol=6 | dir=in | app=system |
"{A989F711-BD3C-483F-9711-C876E740D5B4}" = lport=10243 | protocol=6 | dir=in | app=system |
"{B3EB76A3-D549-4034-9147-22A2A51AF343}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{BDFF97CD-75FD-46E2-AD49-E60535CB5C3F}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe |
"{C3885858-F1CC-4351-BB5E-F664E392CF87}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{CD7C4DE6-908A-471F-BA06-A23F5F795542}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{D2A043DF-B507-44C1-95F8-6023510D4C35}" = rport=445 | protocol=6 | dir=out | app=system |
"{D2EE5DBD-D495-4006-B058-CF8E924417E3}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{D5D04D6D-0CA8-4EE7-B9A6-382DF8A42B1D}" = lport=49160 | protocol=6 | dir=in | name=akamai netsession interface |
"{E1130536-16B8-4C2F-8925-6149DBDDDC3C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{E2DAA529-02C8-43A2-ADB0-C72A2FB5693B}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{E6465F89-B4A0-4979-AD49-2BB893DA9ABB}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{E71D7A52-8071-4F65-AC61-2FABEC69771D}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{ECB2D1B2-E241-4E6A-A995-0591C2C09121}" = lport=139 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008E4C92-9EA7-4034-967C-7075D2256DB6}" = protocol=17 | dir=in | app=e:\programme\bohemia interactive\arma 2 reinforcements\arma2rft.exe |
"{01478FE3-2C36-4638-ADD2-18078B629592}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\sid meier's civilization v\launcher.exe |
"{030E96CF-3222-4408-BFB2-12B105086F46}" = protocol=17 | dir=in | app=e:\programme\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{07E1FCFD-23F5-4085-A2CC-297370A30A62}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{0883086D-F352-4F55-AEDA-229E87613B29}" = protocol=17 | dir=in | app=c:\program files (x86)\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{08D7EBE7-B486-4609-A0B6-C81DBF1F2989}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3loader.exe |
"{09986054-F15A-42A6-84FD-64E696F6760A}" = protocol=17 | dir=in | app=c:\program files (x86)\expressfiles\expressfiles.exe |
"{09B555EF-F5D1-4F84-A186-34E2A15CA3C0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops rcon\blackopsrcon.exe |
"{09F7692F-27C0-40AA-904D-995848B86C29}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe |
"{0D78276E-D7C7-423F-80CA-3A61A888E6AF}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\total war shogun 2\data\encyclopedia\how_to_play.html |
"{0E4BB150-5FA3-446E-9732-41FE0F72E426}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{0FF75487-98F8-4C3F-B362-689422994F05}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"{109B2E4A-B9EF-414D-90AF-BC077FC34102}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{1170B28F-1CD6-490C-9D4E-CD69B629185D}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\tom clancy's h.a.w.x\hawx_dx10.exe |
"{1205C6AF-A120-4613-9C53-8498457DA0CB}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\addonweb.exe |
"{12A864B5-8EC9-4E1C-A525-F47FB3A46301}" = protocol=6 | dir=in | app=c:\program files (x86)\gamigo\heroes in the sky\his.exe |
"{134441C9-EA50-4234-90A9-8E83086D69C4}" = protocol=17 | dir=in | app=e:\programme\mass effect 2\masseffect2launcher.exe |
"{13DED5CB-580F-4D1D-AB4C-23F8DE46673B}" = protocol=6 | dir=out | app=system |
"{15BED8F3-2DC8-4005-85DF-DB224DF9DD3E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e. free week end\ruse.exe |
"{16D42AB4-A6DA-4984-B3DA-31D22BFBA0EF}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{1798D94C-8185-4E1A-B60C-2AFDB6D936CC}" = protocol=6 | dir=in | app=c:\program files (x86)\capcom\motogp 08\launcher.exe |
"{17A7464A-C622-4C18-B05D-2283526548C6}" = protocol=6 | dir=in | app=e:\programme\landwirtschafts simulator 2011\game.exe |
"{17E52426-26B3-4A9E-8991-DA1443CD8148}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\saints row the third\game_launcher.exe |
"{1BE79A00-5FD4-4A3D-A52C-17CCA3FFA18E}" = protocol=17 | dir=in | app=c:\program files (x86)\atari\codename panzers cold war\home\game\cpcw.exe |
"{1CB1E9EA-6409-4CB0-912F-8B0451B0AD59}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{1CE7F250-3584-4D06-A2D3-DCBF7A883B0C}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\dead island\deadislandgame.exe |
"{1E866850-8184-4C28-AE60-EB8F23D7BBBA}" = protocol=6 | dir=in | app=c:\program files (x86)\expressfiles\expressdl.exe |
"{1EE7A5B5-C015-46AC-B46A-0DA85CBB2DDC}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat |
"{230B7C27-7AB2-4786-A4C8-3E4B03672AA9}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\fc2launcher.exe |
"{2361CA10-37BA-4CDD-95E2-D004C158AC94}" = protocol=6 | dir=in | app=c:\program files (x86)\expressfiles\expressfiles.exe |
"{24D1998D-CB4E-487D-85BB-8E4A31A29C65}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{2598E3D4-2C26-4099-B9B2-89F582722A61}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{26BF373F-9045-49D9-9715-A1AE998ED72B}" = protocol=6 | dir=in | app=e:\programme\coh\relicdownloader\relicdownloader.exe |
"{27BF1F2E-119E-411A-9439-F7C4BDA0905E}" = protocol=17 | dir=in | app=c:\program files (x86)\activision\call of duty 4 - modern warfare\iw3mp.exe |
"{286B740A-FBD6-4EF4-8B12-A27E7FD967F3}" = protocol=17 | dir=in | app=c:\program files (x86)\capcom\motogp 08\launcher.exe |
"{2934517D-5779-4E0C-B467-1A436FEE5DBF}" = protocol=17 | dir=in | app=c:\program files (x86)\capcom\streetfighteriv\streetfighteriv.exe |
"{2AEA572B-743E-4E47-AFD5-BF3C59985F0C}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\fc2editor.exe |
"{2C1E41CD-F015-45D9-B43F-372F2293E24A}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\total war shogun 2\shogun2.exe |
"{2D823CDE-6BCB-4697-8389-1CFECFE5B17B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2D9923DC-6EF3-40B9-BDA2-8766E534ACDE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\data\encyclopedia\how_to_play.html |
"{2F11AE3C-48F6-456B-8D61-F9E53B1C590F}" = protocol=17 | dir=in | app=e:\programme\origin games\mass effect 3\binaries\win32\masseffect3.exe |
"{2F426CF5-8E82-4B41-BFA7-CEE4908D0F7D}" = protocol=17 | dir=in | app=c:\program files (x86)\rockstar games\rockstar games social club\rgsclauncher.exe |
"{30D9250E-7308-48AF-B0F1-855BFBB097FC}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\sid meier's civilization v\launcher.exe |
"{30F6427B-2D97-4E38-B1DC-7B887BCE4C95}" = protocol=6 | dir=in | app=c:\program files (x86)\lucasarts\star wars empire at war\gamedata\sweaw.exe |
"{33969CD3-0334-45D9-B217-0D2783484E2E}" = protocol=6 | dir=in | app=c:\program files (x86)\activision\call of duty 4 - modern warfare\iw3mp.exe |
"{37F6C894-D923-48C8-842D-999A478A0C7C}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{38D74970-89CE-4A75-B4D2-4C00864BDAA6}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\napoleon total war\napoleon.exe |
"{3A5B930C-C1FB-4CB8-AD87-5F6AC8DBC249}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{3AFF7471-B4FB-4B27-9277-8C5295FEAF6F}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{3BF1AF80-D9EA-4A5B-81CE-9ACBFEFD5833}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\payday the heist\payday_win32_release.exe |
"{3C5089BA-7AB2-467F-9CE2-1CDECE9ABA09}" = protocol=17 | dir=in | app=c:\program files (x86)\expressfiles\expressdl.exe |
"{3C5C11F3-34B4-4880-80B7-619769F6DE04}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe |
"{3C757EE8-B551-4E4C-9200-F8B8B5B91A4F}" = protocol=17 | dir=in | app=e:\programme\ubisoft\related designs\anno 2070\initengine.exe |
"{3C8C626A-F1F1-489D-B820-1F5925846B6F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{3CF38CBF-4215-4EC6-B5B1-5DB4E172F090}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe |
"{3E21ED97-83C7-428F-BEF6-64B1F5D94CC3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{3FD3B072-0588-470F-8121-8C4BD714A240}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\game_launcher.exe |
"{40325FAD-B75C-4D0C-B384-3134584D05E0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\metro 2033\metro2033.exe |
"{41C4AAF7-FB2D-4BD3-9011-A5A958FFF980}" = dir=in | app=c:\program files (x86)\windows live\messenger\wlcsdk.exe |
"{431D5738-256B-488F-8B78-EC78ABFAC169}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization v\civilizationv.exe |
"{44CF24A4-E283-40F5-8F77-778E508F1724}" = dir=in | app=c:\program files (x86)\cyberlink\powerdvd\powerdvd.exe |
"{462998F1-72A0-4657-9AA9-9E6993560144}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{47CD4A16-2014-4CB0-A81A-02866F1B07B0}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\saints row the third\game_launcher.exe |
"{4874C050-9105-4201-A829-0C7F13DC13B4}" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe |
"{48BCEF2E-9AFB-4315-A491-FEFE0A33C5EB}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{498C37EA-7C90-4052-AFE7-9B2987AC5D1E}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{49D08806-B98B-448F-9332-01E30775CC3B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e. free week end\ruse.exe |
"{4D0B2E66-66E4-47D2-8B76-109721CCA7DC}" = protocol=6 | dir=in | app=c:\program files (x86)\cyanide\blood bowl\bb.exe |
"{4D3FB1C4-22E7-4018-8304-884E20B44BCE}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\addonweb.exe |
"{4E4C5BF4-F8D9-4B4F-ADA1-4536DCF43DC0}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\napoleon total war\napoleon.exe |
"{4F2269FE-76B9-4F4D-BB52-9E4DCB952613}" = protocol=6 | dir=in | app=c:\program files (x86)\rockstar games\eflc\launcheflc.exe |
"{51733BF0-F6C3-409C-B4CB-401B34DDEE7F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization v\launcher.exe |
"{519C2A8A-C7FD-4708-8B14-83BDEADBDF4F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackops.exe |
"{522B63B6-5332-4430-8886-A8C6037824AE}" = protocol=17 | dir=in | app=e:\programme\ubisoft\related designs\anno 2070\anno5.exe |
"{52783DA8-D935-497A-A82F-E6F30DC5D3C6}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\metro 2033\metro2033.exe |
"{5344E84C-0F66-4C70-A6F4-C347C3020B83}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\tom clancy's h.a.w.x\hawx.exe |
"{5352F5B3-E735-4B07-93E4-F56365362622}" = protocol=6 | dir=in | app=e:\programme\mass effect 2\binaries\masseffect2.exe |
"{55BEC28B-E5E4-4003-B8F9-66BB7D6316E2}" = protocol=17 | dir=in | app=c:\program files (x86)\eidos\kane and lynch dead men\kaneandlynch.exe |
"{57CE509E-4F21-42DD-A616-CC4CF843CF9F}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{5928D4E6-3A59-4812-949B-5DDB142CEF58}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{5C114497-32BE-429C-BAD3-EDA58362D33A}" = protocol=6 | dir=in | app=e:\ubisoft\silent hunter 5\sh5.exe |
"{5C43D747-BC37-4134-9C2D-F5BDA1063F89}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e\ruse.exe |
"{5C4C1366-8F9B-4830-AF9E-BDAFFE19FFBE}" = protocol=6 | dir=in | app=c:\program files (x86)\reality pump\two worlds ii\twoworlds2.exe |
"{5C528A5B-A413-4D95-8F09-6717CB288BEC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{5DBA7AD7-8569-4B55-9D08-B167120F7F09}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\launcher.exe |
"{5F49C44D-E6AD-4D83-876F-596EBCFE68A1}" = protocol=6 | dir=in | app=c:\program files (x86)\cyanide\blood bowl\autorun\exe\autorun.exe |
"{5FFABEC8-EC9D-4D3B-9096-3DDD8DAF21DE}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{600FD260-01B0-4042-BDF2-F63937A7083C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat |
"{61245E5F-2F46-4110-B15D-D18C8D955FAB}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\world in conflict\wic_online.exe |
"{61CD06B3-3E1F-470A-8D16-A61174C77290}" = protocol=17 | dir=in | app=c:\program files (x86)\lucasarts\star wars empire at war\gamedata\sweaw.exe |
"{628831A4-AAAF-4178-B1E4-2FEB1341B548}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{6294CEBF-62B0-4A3B-83E3-C9EF7393E6F2}" = protocol=17 | dir=in | app=e:\programme\landwirtschafts simulator 2011\farmingsimulator2011.exe |
"{63022E52-E1E0-40A9-87FC-5F10CCEA813A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\metro 2033\metro2033.exe |
"{63EC07A1-D972-4F4B-B6D2-802A1745F74E}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat |
"{63F07E2A-2B04-4B40-9EFB-D812796CBBE2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6426DCF5-955E-425F-B07F-1F8C44C98DDE}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{64306D03-0C48-4055-98FA-CEC459DE7FCE}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\fc2editor.exe |
"{64AF4878-F937-4E08-ADF5-03FC939A267C}" = protocol=17 | dir=in | app=e:\programme\bohemia interactive\arma 2\arma2oa.exe |
"{6658C364-2F59-4614-AF73-2B4DB65C7F5B}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{67DF104E-FFCF-4C54-943F-32EA1094A305}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization v\civilizationv.exe |
"{68CD7C11-F086-4448-9B50-13621D2EEC86}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{696E74C4-C65A-4489-8B00-6C3C4C109313}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\napoleon total war\napoleon.exe |
"{6A6CFEA4-D11B-4A5B-9B1C-3D5204B56C7D}" = protocol=17 | dir=in | app=e:\programme\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe |
"{6A9F4273-3DA8-46B6-9480-3DB15A33BF3A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{6BE5C25C-847A-4711-A962-27BE83B3F788}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe |
"{6BF236D0-FCB3-4366-B83C-62BF791B7437}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{6BF9574C-0029-4D31-BFED-0DB299F0D07B}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\tom clancy's h.a.w.x\hawx.exe |
"{6D37B7CC-E06A-4257-82A1-A1C00D792D64}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6F4A715E-E040-4CB9-869F-3F337ED5630D}" = protocol=6 | dir=in | app=c:\program files (x86)\thq\gas powered games\supreme commander - forged alliance\bin\forgedalliance.exe |
"{6FED497F-A6E0-43DE-9C41-2E42DE1AD9AA}" = protocol=6 | dir=in | app=e:\programme\origin games\mass effect 3\binaries\win32\masseffect3.exe |
"{720CBB6C-054F-475C-92DC-363E53A4EB11}" = protocol=6 | dir=in | app=c:\program files (x86)\windows ilivid toolbar\toolbar\dtuser.exe |
"{72D1A960-601B-48DF-9814-C20E16EF7FC8}" = protocol=6 | dir=in | app=c:\program files (x86)\atari\codename panzers cold war\home\game\cpcw.exe |
"{754C910A-803D-4974-80DC-85D6A11DFDD5}" = protocol=6 | dir=in | app=e:\programme\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{77E69E2C-13B8-4648-A689-CAD4826B81FE}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{79DC8F9E-AE46-45BB-B03A-B6B54CA5863C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_dx11.exe |
"{7A3A50FD-0BDF-4EAC-8F5C-3DE0AB2B23D3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackops.exe |
"{7B3FEBEE-9C83-4281-8BC9-95A04168972D}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_current_settings.bat |
"{7BBA7DBD-FF82-4114-95E5-CCF0282B21AD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat |
"{7C50FECE-A06E-45E9-81D1-4BA35AD93E22}" = protocol=17 | dir=in | app=c:\program files (x86)\thq\gas powered games\supreme commander - forged alliance\bin\forgedalliance.exe |
"{7CD65B4A-A923-4384-98B9-FC05F0ED61C8}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe |
"{7D2E2BF1-33BA-4D88-B95A-603D871E433F}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe |
"{7E41D72E-3BE2-4181-B394-927E62A9E1CD}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\sid meier's civilization v\launcher.exe |
"{7EFCB523-2912-4839-AA6A-D85B0F678202}" = protocol=17 | dir=in | app=e:\programme\coh\relicdownloader\relicdownloader.exe |
"{817EEE06-568F-42A8-B9B8-0FA10F91270F}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{82669312-90A2-40DF-825A-78C17BE11A78}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat |
"{82EFFBC3-887B-4AE4-A19F-EEC5C1B87839}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{83BC2AFE-9984-43E3-AD01-4D67FD82A971}" = protocol=6 | dir=in | app=e:\programme\eidos\batman arkham asylum\binaries\shippingpc-bmgame.exe |
"{8468D3DD-5D9C-4E5F-BC19-8A53582DBFA0}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\r.u.s.e\ruse.exe |
"{84D83678-AA73-43A6-8CB5-391FEE54AD1E}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\total war shogun 2\data\encyclopedia\how_to_play.html |
"{864104BF-0D10-4D13-93D2-79B038ECCDF0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{87067910-71BB-44AF-89FB-20DEEDEE2BD4}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{88C5816D-CC8A-453C-839D-FF7E23D283DC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird.exe |
"{89394F89-80DC-4E94-9350-B0F8D7C04562}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{89BA8109-1EDE-4F4A-8202-2FDE4A103D7D}" = protocol=17 | dir=in | app=e:\programme\electronic arts\battlefield 3\bf3.exe |
"{89F1EF77-F639-43AE-8A00-7832F7311874}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\dead island\deadislandgame.exe |
"{8A9E0E5B-2D4B-4EBC-8B70-3F50F2C2B26A}" = protocol=6 | dir=in | app=c:\program files (x86)\eidos\kane and lynch dead men\kaneandlynch.exe |
"{8B83A69A-6E10-48AC-A227-E06FC07CB938}" = protocol=6 | dir=in | app=e:\programme\bohemia interactive\arma 2\arma2oa.exe |
"{8CBF53EA-086B-4577-BF88-40D55D793C18}" = protocol=17 | dir=in | app=c:\program files (x86)\windows ilivid toolbar\toolbar\dtuser.exe |
"{8CE20B03-6B36-44FC-8B04-04584734B5D5}" = protocol=6 | dir=in | app=e:\programme\ubisoft\related designs\anno 2070\autopatcher.exe |
"{8D3F89B6-F8A1-46E7-B83A-562F77429E11}" = protocol=17 | dir=in | app=c:\program files (x86)\rockstar games\eflc\launcheflc.exe |
"{8D994952-AFDE-4211-B044-3954072A9488}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\launcher.exe |
"{8DA164EA-55C9-4D18-9334-7F65326D7AB2}" = protocol=6 | dir=in | app=c:\program files (x86)\firefly studios\stronghold legends\strongholdlegends.exe |
"{8E667852-782D-4EFF-9913-BF4818447ECF}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\addon.exe |
"{90679A67-4475-4317-B049-D268C43F3171}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{92253D7E-56BB-4621-AF15-B4071FAE0A25}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\r.u.s.e\ruse.exe |
"{92E14AE4-26C2-48B8-B5E1-519184D9C4AF}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\anno4.exe |
"{92F58F28-E65B-42AE-8C8E-50BAB41B4FF7}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{94E97B85-75E2-4D79-A9D8-FA9FED187B14}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird.exe |
"{95013647-3ECA-4E84-A9A2-D53F3A6FBBB9}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysisdedicatedserver.exe |
"{951302CF-801E-4CB7-88EF-C130F22C14A7}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{96C875AD-4B59-4990-BE76-70D51418B9EB}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\world in conflict\wic_online.exe |
"{974EF06B-DD47-44F5-AAED-F68E27F6B970}" = protocol=6 | dir=in | app=c:\users\benutzer\appdata\local\akamai\netsession_win.exe |
"{990BDF9A-3C17-40ED-8FA8-FAA6381F4CA5}" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe |
"{99A87D51-722E-443A-9961-1BDD37C198DB}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{9AA904EC-3864-41F1-A13B-485A1A27998C}" = protocol=6 | dir=in | app=e:\programme\bohemia interactive\arma 2 reinforcements\arma2rft.exe |
"{9AB65539-37D3-4A0B-972B-E513D7359F5A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\data\encyclopedia\how_to_play.html |
"{9BE6D62C-6154-40E2-AB29-B30208D8302F}" = protocol=17 | dir=in | app=c:\program files (x86)\firefly studios\stronghold legends\strongholdlegends.exe |
"{9C3250B6-91F2-4EDD-A456-FC950FE0AC03}" = protocol=17 | dir=in | app=c:\users\benutzer\appdata\local\akamai\netsession_win.exe |
"{9D959A25-D56C-4A5E-B383-0B636C32C3E4}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin32\crysis.exe |
"{9EFEF2A2-232C-4E1E-90EE-815EFD20FA90}" = protocol=17 | dir=in | app=e:\programme\ubisoft\related designs\anno 2070\autopatcher.exe |
"{9FB42C7C-EFA4-4F2F-8C7D-D9C9E24AEE90}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\metro 2033\metro2033.exe |
"{A1E19258-8E15-4AED-B8D4-6E93C67CCCF5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{A464F979-1F0B-4805-8CCB-41C6CA3E2182}" = protocol=17 | dir=in | app=c:\program files (x86)\thq\company of heroes\reliccoh.exe |
"{A8597036-C39F-4314-9CFE-D1F45134FD13}" = protocol=17 | dir=in | app=e:\programme\coh\reliccoh.exe |
"{A9DE7621-C10B-46FB-8979-FEFF2958BD55}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{A9F9A27B-DE5C-4A42-9267-3CB08BA9C751}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{AA0C7638-E3DB-45E1-974E-DB7C2CCFD342}" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\halo 2\halo2.exe |
"{AA59AE7A-CEB2-40C7-9D95-578EEBD0929B}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\call of duty black ops\blackops.exe |
"{ABC44819-9E6E-4675-8AC3-A3C7772DA1DF}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\medal of honor airborne\unrealengine3\binaries\moha.exe |
"{AD07E4AA-80F6-474D-9049-E9BF89518958}" = protocol=6 | dir=in | app=e:\programme\ubisoft\related designs\anno 2070\initengine.exe |
"{AD2AAECA-E80F-40A2-9890-9D85D8C3A005}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{AD324796-D7B5-416B-8065-EB2F47B86347}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat |
"{AE0071FE-E01B-4FA9-9059-3897258F5EC0}" = protocol=6 | dir=in | app=e:\programme\coh\reliccoh.exe |
"{AF2B7637-13AA-450A-BC9B-B123D70E3654}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{AF2CAED1-4E6C-4475-A9F5-8DDEC68EC46D}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\total war shogun 2\benchmarks\benchmark_specify_properties.bat |
"{B055E3BB-482A-4729-91F6-D60F43972C00}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\total war shogun 2\shogun2.exe |
"{B0C3D8AB-EFED-4142-9BE3-256CEF752A56}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2updater.exe |
"{B212DE44-53BB-429E-8AB2-D6D0DA00C93B}" = protocol=17 | dir=in | app=c:\program files (x86)\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe |
"{B31761D6-5101-46C2-8FA7-FE8F8A7FCE1C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B376D433-493C-445F-9EBF-21EB817CBB40}" = protocol=17 | dir=in | app=c:\program files (x86)\cyanide\blood bowl\bb.exe |
"{B424D30A-194A-43F9-A7C8-C8E167416FCA}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{B7789604-5708-48FF-8116-9415BCEC5023}" = protocol=6 | dir=in | app=e:\programme\landwirtschafts simulator 2011\farmingsimulator2011.exe |
"{B857B43E-2BF9-44BE-820F-27A6A5643003}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\game_launcher.exe |
"{B9DA597C-2D9B-4A11-8DD4-E684B8A07C50}" = protocol=6 | dir=in | app=c:\program files (x86)\thq\company of heroes\reliccoh.exe |
"{BBB14926-A240-402C-A081-B3A2ED2F19B6}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\world in conflict\wic_ds.exe |
"{BBE92EA4-6415-41F4-8BD3-67D21E357344}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{BC7D4716-5ED3-4C11-8068-363B24F5DFA3}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\call of duty black ops\blackops.exe |
"{BD4D92C2-B59D-4FED-B4CD-CE0094772356}" = protocol=17 | dir=in | app=e:\programme\landwirtschafts simulator 2011\game.exe |
"{BDD87644-C7ED-4CD6-82EF-CCDFBEBE0111}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{BE0F096B-3B4D-4A3C-939E-CE8F6AE77630}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{BE203A81-7965-493F-B3C5-E6FA7017E803}" = protocol=6 | dir=in | app=e:\programme\ubisoft\related designs\anno 2070\anno5.exe |
"{BE2FBD13-D8F5-4BCE-B98D-59A6F7085F79}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{BE3BFD2A-AAED-4256-9F8B-1CCAB490A49D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe |
"{BEADF9DD-9EFF-48B8-849D-57A180A28415}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops rcon\blackopsrcon.exe |
"{C082D347-9B38-4AE7-B978-B33B0ACE3748}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{C2AF370E-ED93-4BB0-A4E3-C40FE9D14B9E}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\farcry2.exe |
"{C3262033-862E-4337-B9B7-1312ABE77AF6}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{C32964BA-70A9-4016-8CBA-60C11C4B52B2}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{C38F81F2-7FCC-4908-A697-CB77D6D1E83B}" = protocol=17 | dir=in | app=e:\ubisoft\silent hunter 5\sh5.exe |
"{C4559E66-0BA7-4AD8-AB6E-9CC008C6CC30}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C49EA3AD-E048-4B2B-9B56-A03A223F306A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3game.exe |
"{C4A8AD7D-47DE-485D-8367-6C2976615404}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysisdedicatedserver.exe |
"{C998AAFF-D351-4CC6-8EB4-1A3D9D9F9122}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CA45D853-996B-452A-A535-4D644E33E585}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{CA93E8A2-543E-44EA-BDD1-0F9FD95E0A61}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{CD310793-8EA8-454F-9602-7A0C9C23D003}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{CD4D331B-47C6-4125-B669-23E5893B61B4}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\fc2launcher.exe |
"{CDD4DEF7-DD35-4DF8-8118-0982CC744661}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\addon.exe |
"{CE335A0B-7EFD-4B7B-AA1A-D9348D376E81}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{CEB93793-7D9E-47E5-A6D5-5B0D09B9E844}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{CF3688EF-DD9B-443E-80B8-20891221AC0B}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\payday the heist\payday_win32_release.exe |
"{D0195049-0A08-468C-953C-501636DAAB52}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"{D10F0E57-9334-481B-944A-733B64928B14}" = protocol=6 | dir=in | app=c:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe |
"{D327CA98-5FA1-4E02-975D-948DDF125115}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe |
"{D3A0DF96-6EFA-4A48-B9EE-195A7195FDF9}" = protocol=6 | dir=in | app=e:\steam\steamapps\common\america's army 3\binaries\aa3loader.exe |
"{D3FDA894-7436-460F-9CE3-AC5BD21DC9C0}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{D40C4806-ED57-4AB1-9D89-26C30DC761C6}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\world in conflict\wic_ds.exe |
"{D530A52D-2353-4633-9C54-207E2E1694DE}" = protocol=17 | dir=in | app=c:\program files (x86)\gamigo\heroes in the sky\his.exe |
"{D71FAADC-F464-4BB2-876F-E7FBE2B49DFE}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\tom clancy's h.a.w.x\hawx_dx10.exe |
"{D83CA01F-DE42-480B-B939-59BA40CEE9A0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{D886712C-83C3-4F7D-830A-B71B2C6425F1}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e\ruse.exe |
"{D89AEDC1-F6E3-4909-9D3F-C42FB82C0E6B}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{D9A51895-79F9-490B-8C74-29ABE8DA7C34}" = protocol=6 | dir=in | app=c:\program files (x86)\capcom\streetfighteriv\streetfighteriv.exe |
"{D9F39BE3-D5D4-4364-93FF-74F18C795F64}" = protocol=6 | dir=in | app=c:\program files (x86)\rockstar games\grand theft auto iv\launchgtaiv.exe |
"{DD70E9FF-2028-4AEA-8C5C-3724DC7F88DB}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\america's army 3\binaries\aa3loader.exe |
"{DDA5A79A-DFC6-46AB-BB0A-1EDC9C4E4F75}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\farcry2.exe |
"{E08EFE79-EA57-4B0F-8069-B759C6980F0E}" = protocol=17 | dir=in | app=c:\program files (x86)\reality pump\two worlds ii\twoworlds2.exe |
"{E09D3ADA-89B2-4A3F-98A2-17FCF1CFCF80}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{E2FCFE8A-C003-4D9D-B86C-F1FC17B8B070}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{E3FD3CAC-7D80-440F-A793-0A22F2DB777B}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe |
"{E41470F7-BC68-4369-BCD1-BF78C277D3DA}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"{E6E6E0B9-CBDA-43B4-BC79-98805997D45E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3loader.exe |
"{E7A7741C-353B-4415-9980-1595BA70047B}" = protocol=17 | dir=in | app=c:\program files (x86)\cyanide\blood bowl\autorun\exe\autorun.exe |
"{E81895E8-80C3-4A33-A51C-2E8A69E56820}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\crytek\crysis\bin64\crysis.exe |
"{EA6AB906-B9DB-41E8-842C-392993BA5F05}" = protocol=17 | dir=in | app=e:\programme\mass effect 2\binaries\masseffect2.exe |
"{EACD8128-6F67-4579-8547-D553D0C1E02B}" = protocol=17 | dir=in | app=c:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe |
"{EAFAA14F-DC3C-4A39-9938-DAB7B1BEF5A1}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{EC65F95A-44C0-4DB3-BDC0-67A94C5F2529}" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\medal of honor airborne\unrealengine3\binaries\moha.exe |
"{ED38D65F-466F-4A86-95C2-87D4B3E93309}" = protocol=17 | dir=in | app=e:\steam\steamapps\common\napoleon total war\napoleon.exe |
"{EDA3C7CD-AAC9-4EFA-B98D-E1DDE444A35D}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{EDED591A-EEF9-469D-AF29-97F2FAC5488B}" = protocol=6 | dir=in | app=e:\programme\mass effect 2\masseffect2launcher.exe |
"{F19D35F8-5B10-4C55-B1C3-F6E789069E57}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{F41732D6-75F8-492D-8EA1-C0105F32D513}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\saints row the third\saintsrowthethird_dx11.exe |
"{F52BFB87-99E1-4500-B07B-ACB7A25DBBE5}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\world in conflict\wic.exe |
"{F59D111B-77BE-4447-AFBA-12B96BCDE3D7}" = protocol=6 | dir=in | app=c:\program files (x86)\rockstar games\rockstar games social club\rgsclauncher.exe |
"{F6A1D40A-868C-48E0-AE41-FA1BC8020D71}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{F7CA95DC-BB1E-4645-BC3F-2909CF832EAE}" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\halo 2\halo2.exe |
"{F7F7D8CB-9B3F-4831-81DD-17A4A59E4EB4}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\world in conflict\wic.exe |
"{F95E8943-FB0C-4DAC-BE94-962CA5C8A3B4}" = protocol=6 | dir=in | app=e:\programme\electronic arts\battlefield 3\bf3.exe |
"{F95FAD5C-CFAD-4FC5-BB2D-FA11982A0FFA}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\america's army 3\binaries\aa3game.exe |
"{FA930DC6-20DA-49A5-A526-D191EAD32901}" = protocol=6 | dir=in | app=c:\program files (x86)\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe |
"{FB023270-3401-45AA-88D6-D43E53B114AB}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{FD606334-B55F-4F8E-8DF7-C949EA6D68D4}" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2updater.exe |
"{FD7D9BD1-1045-4533-B212-7D934F38C018}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{FE04F5AB-32ED-4017-A2C1-609437BB5798}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{FFE6D769-48B8-42B7-A948-72BA09C57D22}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"TCP Query User{03078377-86A9-4EDD-8357-90107D002047}C:\program files (x86)\microsoft games\microsoft flight simulator x\fsx.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft games\microsoft flight simulator x\fsx.exe |
"TCP Query User{03A22A25-275F-4D64-95D0-A657B7047878}C:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe |
"TCP Query User{07D8AA93-9506-45A9-A02A-872F1E830D13}C:\program files (x86)\steam\steamapps\common\call of duty black ops\blackops.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackops.exe |
"TCP Query User{08295983-0070-45AC-ABF9-959807854990}C:\program files (x86)\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"TCP Query User{0F13A204-3E5D-4838-AB0E-82DCACD08AA0}C:\program files (x86)\steam\steamapps\big_paddy\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\big_paddy\team fortress 2\hl2.exe |
"TCP Query User{1078C509-268E-40E4-A4A1-D1AF54596002}E:\programme\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=6 | dir=in | app=e:\programme\rockstar games\grand theft auto iv\gtaiv.exe |
"TCP Query User{108ACC07-EF3D-41E6-932B-5D2F4ECF4C0D}C:\program files (x86)\ubisoft\ghost recon advanced warfighter\graw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ghost recon advanced warfighter\graw.exe |
"TCP Query User{1627CDA5-7990-44B3-899D-861DB24BC3D9}C:\program files (x86)\electronic arts\alarmstufe rot 3\data\ra3_1.0.game" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\alarmstufe rot 3\data\ra3_1.0.game |
"TCP Query User{237D1517-2291-42A2-A145-F10E2157FD83}C:\program files (x86)\ea games\battlefield 2\bf2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe |
"TCP Query User{27DCE810-31F3-4110-B5AA-B44F0F92E821}C:\program files (x86)\call of duty world at war\codwawmp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\call of duty world at war\codwawmp.exe |
"TCP Query User{2B563152-D753-4681-BB2B-709A09E0FD2C}E:\programme\quadriga games\emergency 2012\bin.x86\em2012.exe" = protocol=6 | dir=in | app=e:\programme\quadriga games\emergency 2012\bin.x86\em2012.exe |
"TCP Query User{2E15CB36-4EEA-489C-809A-96A8E7D7CDEA}C:\program files (x86)\call of duty world at war\codwawmp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\call of duty world at war\codwawmp.exe |
"TCP Query User{2ECA4EDE-1F95-455D-BF68-E9B8886D63AF}E:\programme\2k games\gearbox software\borderlands\binaries\borderlands.exe" = protocol=6 | dir=in | app=e:\programme\2k games\gearbox software\borderlands\binaries\borderlands.exe |
"TCP Query User{33DA4B8B-F208-4ED3-A54C-35074378D857}C:\program files (x86)\ubisoft\silent hunter 4 wolves of the pacific\sh4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\silent hunter 4 wolves of the pacific\sh4.exe |
"TCP Query User{36D49CBB-EC07-4DFC-BC8A-B0B256444D5D}C:\program files (x86)\utorrent\utorrent.exe" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"TCP Query User{36D5AD07-A336-45AE-B5F1-C6CCEEAAF273}E:\programme\ubisoft\tom clancy's splinter cell double agent\scda-online\system\scda_online.exe" = protocol=6 | dir=in | app=e:\programme\ubisoft\tom clancy's splinter cell double agent\scda-online\system\scda_online.exe |
"TCP Query User{3F6FA590-273A-45B8-9EBE-FF817AB51C6C}C:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"TCP Query User{43B7F89C-5CF7-4D49-B34A-DBB00632F467}C:\program files (x86)\atari\act of war - direct action\actofwar.exe" = protocol=6 | dir=in | app=c:\program files (x86)\atari\act of war - direct action\actofwar.exe |
"TCP Query User{49CEA5E6-3AA3-4A62-B3FA-4A4583BA3569}C:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"TCP Query User{4C458BB7-09E9-4B7E-8E8D-4DFC4D4FC059}C:\program files (x86)\reality pump\two worlds ii\twoworlds2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\reality pump\two worlds ii\twoworlds2.exe |
"TCP Query User{4E7E0245-63E8-4270-8257-1FBF979CEEF3}E:\programme\the witcher 2\bin\witcher2.exe" = protocol=6 | dir=in | app=e:\programme\the witcher 2\bin\witcher2.exe |
"TCP Query User{4F8C2BCC-85E9-4C37-A5F6-8E8E74318419}E:\programme\lucasarts\star wars empire at war\gamedata\fpupdate.exe" = protocol=6 | dir=in | app=e:\programme\lucasarts\star wars empire at war\gamedata\fpupdate.exe |
"TCP Query User{59878463-F145-41F0-9227-56958B8C1FD2}C:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe |
"TCP Query User{5ACB97C0-17AD-4235-9F09-71DC4B4B6E89}C:\program files (x86)\steam\steamapps\common\left 4 dead demo\left4dead.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead demo\left4dead.exe |
"TCP Query User{63D7C1E6-41F4-4BB2-A2ED-A32E99F83482}C:\program files (x86)\monte cristo\war on terror\wot.exe" = protocol=6 | dir=in | app=c:\program files (x86)\monte cristo\war on terror\wot.exe |
"TCP Query User{6532664D-FAF4-4A6B-95F6-E785DAD36594}C:\program files (x86)\steam\steamapps\fcb1993\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\fcb1993\counter-strike source\hl2.exe |
"TCP Query User{66BDFBE7-D6BD-4871-926B-24A51AD50616}C:\program files (x86)\ubisoft\red storm entertainment\rainbow six lockdown\lockdown.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\red storm entertainment\rainbow six lockdown\lockdown.exe |
"TCP Query User{6844460D-E0B6-4D16-A7E9-764A77122F8B}C:\program files (x86)\electronic arts\command & conquer 4 tiberian twilight\data\cnc4.game" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\command & conquer 4 tiberian twilight\data\cnc4.game |
"TCP Query User{6AFB120E-CC1C-4990-8537-ED22E0B490BD}C:\program files (x86)\black sea studios\knights of honor\koh.exe" = protocol=6 | dir=in | app=c:\program files (x86)\black sea studios\knights of honor\koh.exe |
"TCP Query User{71A1C754-3B05-4796-8505-080923B891EA}E:\programme\ubisoft\tom clancy's splinter cell double agent\scda-offline\system\splintercell4.exe" = protocol=6 | dir=in | app=e:\programme\ubisoft\tom clancy's splinter cell double agent\scda-offline\system\splintercell4.exe |
"TCP Query User{77ABCDFF-D52D-4E1B-A79D-127F3553733E}C:\program files (x86)\call of duty\codmp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\call of duty\codmp.exe |
"TCP Query User{77F6EB14-A5EB-4BC1-A803-A5DF67C57C76}C:\program files (x86)\firefly studios\stronghold legends\strongholdlegends.exe" = protocol=6 | dir=in | app=c:\program files (x86)\firefly studios\stronghold legends\strongholdlegends.exe |
"TCP Query User{794DDF1E-7056-4417-A9BD-86DC81AB0C43}C:\program files (x86)\call of duty world at war\codwaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\call of duty world at war\codwaw.exe |
"TCP Query User{7A33C2A8-67CA-4ABC-8EAC-75D47E747763}C:\program files (x86)\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"TCP Query User{8058D9C3-1C2E-49A9-BB4D-703F574FF432}C:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\nfs11.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\nfs11.exe |
"TCP Query User{81005AD7-E93F-4237-B67C-11FF6C67CAC2}C:\program files (x86)\steam\steamapps\freezer271\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\freezer271\team fortress 2\hl2.exe |
"TCP Query User{8C01D948-421F-4DE4-B421-64318D3DB547}C:\program files (x86)\hd publishing\joint task force\jtf.exe" = protocol=6 | dir=in | app=c:\program files (x86)\hd publishing\joint task force\jtf.exe |
"TCP Query User{8ED168C9-FF42-4692-8760-C48AFCE002DE}C:\program files (x86)\steam\steamapps\common\r.u.s.e\uplaybrowser\uplaybrowser.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e\uplaybrowser\uplaybrowser.exe |
"TCP Query User{901B138D-2B10-4632-9006-0FE2509E3C20}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"TCP Query User{9591F2B3-356B-42AE-98C7-69D71689D33D}C:\program files (x86)\steam\steamapps\fcb1993\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\fcb1993\counter-strike source\hl2.exe |
"TCP Query User{9786EF19-E870-42D1-918B-C7969C2C1DE3}C:\program files (x86)\call of duty world at war\codwaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\call of duty world at war\codwaw.exe |
"TCP Query User{9A9A0278-BAFE-4BF8-9D3B-1A2DFB79580E}C:\users\benutzer\appdata\local\temp\bcbbaf45b511435fb3279c2f0b73964d\relicdownloader.exe" = protocol=6 | dir=in | app=c:\users\benutzer\appdata\local\temp\bcbbaf45b511435fb3279c2f0b73964d\relicdownloader.exe |
"TCP Query User{A19316E5-4169-4D96-9CF7-69CEB2F93201}C:\program files (x86)\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\activision\call of duty 4 - modern warfare\iw3mp.exe |
"TCP Query User{A1BEF147-CA62-4618-B344-808C4698BA7F}C:\program files (x86)\sixteen tons entertainment\emergency 4\em4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\sixteen tons entertainment\emergency 4\em4.exe |
"TCP Query User{A7C9C652-C59F-4855-8226-74AA70B6863E}C:\program files (x86)\eidos\kane and lynch dead men\kaneandlynch.exe" = protocol=6 | dir=in | app=c:\program files (x86)\eidos\kane and lynch dead men\kaneandlynch.exe |
"TCP Query User{B2390B4B-B2B0-49CC-A795-6A18B41ACC7D}C:\program files (x86)\cyanide\blood bowl\bb.exe" = protocol=6 | dir=in | app=c:\program files (x86)\cyanide\blood bowl\bb.exe |
"TCP Query User{B9A9AD7D-31F1-4137-B4B4-84D208D839BC}C:\program files (x86)\steam\steamapps\common\call of duty black ops\blackopsmp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"TCP Query User{BFA35EA5-85A6-4F77-A279-DD376BD261D2}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |
"TCP Query User{C1D44736-5C9D-4E01-87C3-4C876EF47B51}C:\program files\bohemia interactive\arma 2\arma2.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe |
"TCP Query User{C850DA4E-4CB1-4FC8-85E1-7FCB22BD359D}C:\program files (x86)\call of duty\codmp.exe" = protocol=6 | dir=in | app=c:\program files (x86)\call of duty\codmp.exe |
"TCP Query User{DF4120E4-CC48-449B-B57D-DCF49F7301B2}C:\games\world_of_tanks\worldoftanks.exe" = protocol=6 | dir=in | app=c:\games\world_of_tanks\worldoftanks.exe |
"TCP Query User{E1FF0BC6-68CD-4EFA-975A-0E15D6D312A4}C:\program files (x86)\itunes\itunes.exe" = protocol=6 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"TCP Query User{E2C28969-37AC-4284-AA0B-C5B19B50BE64}C:\program files (x86)\thq\fsw ten hammers\fsw2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\thq\fsw ten hammers\fsw2.exe |
"TCP Query User{E44E189D-D24A-4E06-BAFD-215FD31215E4}C:\program files (x86)\steam\steam.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"TCP Query User{E6CCD78D-3D0A-4178-8367-570F0C5D4204}C:\users\benutzer\appdata\local\temp\adcb5e2480054324b71a3579620e687c\relicdownloader.exe" = protocol=6 | dir=in | app=c:\users\benutzer\appdata\local\temp\adcb5e2480054324b71a3579620e687c\relicdownloader.exe |
"TCP Query User{EBD5B84C-CCEA-4C40-AFA7-4272EF1632C2}E:\steam\steam.exe" = protocol=6 | dir=in | app=e:\steam\steam.exe |
"TCP Query User{EE258EE7-42E8-409A-A162-1940226C4226}C:\program files (x86)\ubisoft\silent hunter 4 wolves of the pacific\sh4.exe" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\silent hunter 4 wolves of the pacific\sh4.exe |
"TCP Query User{EF711FC6-5CFE-4399-A7E8-D74E856DA530}C:\users\benutzer\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\benutzer\appdata\local\akamai\netsession_win.exe |
"TCP Query User{EFF81E4E-2E5A-4B16-8AEB-55B0853331BC}C:\games\world_of_tanks\wotlauncher.exe" = protocol=6 | dir=in | app=c:\games\world_of_tanks\wotlauncher.exe |
"TCP Query User{F1FA5089-AC9C-4167-ADA2-46D630DB4751}C:\program files (x86)\electronic arts\need for speed shift\shift.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\need for speed shift\shift.exe |
"TCP Query User{F4A30688-E8AB-4923-96EA-C36DECE1D604}E:\sh2\stronghold2.exe" = protocol=6 | dir=in | app=e:\sh2\stronghold2.exe |
"TCP Query User{FF41F9AA-F049-4B56-AAF0-88480DCBB65C}C:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe |
"UDP Query User{019D9816-5865-401D-82E6-A606FEBF695A}C:\program files (x86)\thq\fsw ten hammers\fsw2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\thq\fsw ten hammers\fsw2.exe |
"UDP Query User{03339A35-C64C-49CF-A5C2-C67FA3CE2AD9}C:\program files (x86)\ubisoft\silent hunter 4 wolves of the pacific\sh4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\silent hunter 4 wolves of the pacific\sh4.exe |
"UDP Query User{077DFF6E-7175-4FF9-AE53-147EB79836AE}C:\program files (x86)\electronic arts\alarmstufe rot 3\data\ra3_1.0.game" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\alarmstufe rot 3\data\ra3_1.0.game |
"UDP Query User{08B32CFA-6142-440A-942E-F88BDE54BF94}C:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\firefly studios\stronghold 2\stronghold2.exe |
"UDP Query User{0A90A8FC-B465-494D-8D46-9C224DBA11EC}E:\programme\quadriga games\emergency 2012\bin.x86\em2012.exe" = protocol=17 | dir=in | app=e:\programme\quadriga games\emergency 2012\bin.x86\em2012.exe |
"UDP Query User{0F8BE244-1C86-4EEB-AACD-0901EA454656}C:\program files (x86)\black sea studios\knights of honor\koh.exe" = protocol=17 | dir=in | app=c:\program files (x86)\black sea studios\knights of honor\koh.exe |
"UDP Query User{14DCFFEE-42FA-4E71-8B6D-8DFD17848912}E:\programme\the witcher 2\bin\witcher2.exe" = protocol=17 | dir=in | app=e:\programme\the witcher 2\bin\witcher2.exe |
"UDP Query User{17BBE684-B280-4728-BA2C-5F18CC36F43B}C:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"UDP Query User{1BCB7A40-8A8B-43B0-9139-D2D5E14F55B7}C:\program files (x86)\call of duty\codmp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\call of duty\codmp.exe |
"UDP Query User{1CDEE77B-E996-445E-9780-67CD8A3D79FD}C:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"UDP Query User{1DA4DC9E-2EA5-4861-94DF-67CFB3F13B4C}C:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\related designs\anno 1404\tools\anno4web.exe |
"UDP Query User{1E217B27-A36D-45CD-83D9-BB535A4C68F8}C:\program files (x86)\call of duty world at war\codwaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\call of duty world at war\codwaw.exe |
"UDP Query User{22A6BC67-C7EB-4A3B-8006-AE1D5E7683A7}C:\program files (x86)\electronic arts\eadm\core.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\eadm\core.exe |
"UDP Query User{236BC4B0-6DC3-47E9-917A-C77D3CE8FFCD}C:\program files (x86)\sixteen tons entertainment\emergency 4\em4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\sixteen tons entertainment\emergency 4\em4.exe |
"UDP Query User{241B847C-01EC-49B7-A70C-13B8498EEB6F}C:\program files (x86)\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"UDP Query User{2C23AF2B-CFCD-42C3-BF01-CC63FF743079}E:\programme\lucasarts\star wars empire at war\gamedata\fpupdate.exe" = protocol=17 | dir=in | app=e:\programme\lucasarts\star wars empire at war\gamedata\fpupdate.exe |
"UDP Query User{2C4A75EC-69B7-41F6-B6FC-6E1E78653A95}C:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\total war shogun 2\shogun2.exe |
"UDP Query User{2DE6CC32-0107-40CC-8D71-3AA5565C6BC9}C:\program files\bohemia interactive\arma 2\arma2.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe |
"UDP Query User{2EC2AB5E-A16E-4092-B930-97143DE9AC0A}C:\program files (x86)\steam\steamapps\common\call of duty black ops\blackopsmp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackopsmp.exe |
"UDP Query User{31372374-D68E-4DBC-987F-5C3302F6E6F1}C:\users\benutzer\appdata\local\temp\adcb5e2480054324b71a3579620e687c\relicdownloader.exe" = protocol=17 | dir=in | app=c:\users\benutzer\appdata\local\temp\adcb5e2480054324b71a3579620e687c\relicdownloader.exe |
"UDP Query User{3448876D-12FB-4B35-BCA5-3597FCF76FEE}C:\program files (x86)\atari\act of war - direct action\actofwar.exe" = protocol=17 | dir=in | app=c:\program files (x86)\atari\act of war - direct action\actofwar.exe |
"UDP Query User{358F556A-F239-40F5-85FD-98E7D9C52447}C:\program files (x86)\steam\steam.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"UDP Query User{3B062535-97EC-4284-963C-4DE607E1FB63}E:\programme\ubisoft\tom clancy's splinter cell double agent\scda-offline\system\splintercell4.exe" = protocol=17 | dir=in | app=e:\programme\ubisoft\tom clancy's splinter cell double agent\scda-offline\system\splintercell4.exe |
"UDP Query User{418E05FE-001B-445E-8926-BB62852A0312}C:\program files (x86)\cyanide\blood bowl\bb.exe" = protocol=17 | dir=in | app=c:\program files (x86)\cyanide\blood bowl\bb.exe |
"UDP Query User{435AC733-A3D0-4B8D-9EF9-D251A07A7B2D}C:\program files (x86)\steam\steamapps\freezer271\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\freezer271\team fortress 2\hl2.exe |
"UDP Query User{4A48A259-8477-4868-95F6-E763089BC655}E:\programme\rockstar games\grand theft auto iv\gtaiv.exe" = protocol=17 | dir=in | app=e:\programme\rockstar games\grand theft auto iv\gtaiv.exe |
"UDP Query User{4B7DBAC5-52CD-4386-911A-C61532AD1550}C:\games\world_of_tanks\wotlauncher.exe" = protocol=17 | dir=in | app=c:\games\world_of_tanks\wotlauncher.exe |
"UDP Query User{4E23055C-9945-4C3B-AC17-17F232A77D9C}C:\program files (x86)\call of duty\codmp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\call of duty\codmp.exe |
"UDP Query User{53DDA8D2-A989-4AF5-84EC-F8C1116381FC}C:\program files (x86)\ubisoft\red storm entertainment\rainbow six lockdown\lockdown.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\red storm entertainment\rainbow six lockdown\lockdown.exe |
"UDP Query User{53FE930D-E28A-47B9-ADA0-DA90B0021B50}C:\program files (x86)\hd publishing\joint task force\jtf.exe" = protocol=17 | dir=in | app=c:\program files (x86)\hd publishing\joint task force\jtf.exe |
"UDP Query User{58ED0510-857E-4295-BE19-2DA59D196CBC}C:\users\benutzer\appdata\local\temp\bcbbaf45b511435fb3279c2f0b73964d\relicdownloader.exe" = protocol=17 | dir=in | app=c:\users\benutzer\appdata\local\temp\bcbbaf45b511435fb3279c2f0b73964d\relicdownloader.exe |
"UDP Query User{5CC00348-BA4D-4DB4-99B4-4C4DE9C58CB4}C:\program files (x86)\steam\steamapps\fcb1993\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\fcb1993\counter-strike source\hl2.exe |
"UDP Query User{6B0CD637-2931-4ECA-8AA9-4ACBB1299565}C:\program files (x86)\reality pump\two worlds ii\twoworlds2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\reality pump\two worlds ii\twoworlds2.exe |
"UDP Query User{72AE4150-41FA-48F2-9355-B81DA20BD6E9}C:\program files (x86)\ubisoft\silent hunter 4 wolves of the pacific\sh4.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\silent hunter 4 wolves of the pacific\sh4.exe |
"UDP Query User{735402C0-5C28-4777-952C-53D21E7A2E00}C:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\battlefield bad company 2\bfbc2game.exe |
"UDP Query User{7F89558B-2088-405D-8EFD-46C65C5CE112}E:\sh2\stronghold2.exe" = protocol=17 | dir=in | app=e:\sh2\stronghold2.exe |
"UDP Query User{7FBD4492-2605-4B63-A3CA-8CB83F6063F7}C:\program files (x86)\steam\steamapps\common\r.u.s.e\uplaybrowser\uplaybrowser.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\r.u.s.e\uplaybrowser\uplaybrowser.exe |
"UDP Query User{89E46DB7-E784-4E8C-A5B5-3FA5C7A58084}C:\program files (x86)\utorrent\utorrent.exe" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"UDP Query User{8B8FF469-EA21-452C-8BD5-A49E3BB4C424}E:\steam\steam.exe" = protocol=17 | dir=in | app=e:\steam\steam.exe |
"UDP Query User{93BDA378-126A-47C9-B8C8-BC4C23850269}C:\program files (x86)\electronic arts\need for speed shift\shift.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\need for speed shift\shift.exe |
"UDP Query User{9414C55A-F5FA-4CB5-A9AF-91A2820B81D6}C:\program files (x86)\activision\call of duty 4 - modern warfare\iw3mp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\activision\call of duty 4 - modern warfare\iw3mp.exe |
"UDP Query User{9925D27A-6FAE-4DFF-A459-77851B66C544}C:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\nfs11.exe" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\need for speed(tm) hot pursuit\nfs11.exe |
"UDP Query User{9F2E131F-7386-438C-A860-988AD6886C6C}C:\program files (x86)\itunes\itunes.exe" = protocol=17 | dir=in | app=c:\program files (x86)\itunes\itunes.exe |
"UDP Query User{A83EDE01-2516-4F79-8F6D-7DBF35197AD4}E:\programme\ubisoft\tom clancy's splinter cell double agent\scda-online\system\scda_online.exe" = protocol=17 | dir=in | app=e:\programme\ubisoft\tom clancy's splinter cell double agent\scda-online\system\scda_online.exe |
"UDP Query User{AD302CE6-D7A9-4899-B1F5-5951135C8656}C:\program files (x86)\call of duty world at war\codwawmp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\call of duty world at war\codwawmp.exe |
"UDP Query User{B0A692D9-38D7-4A6E-9BBF-FD60913D8346}C:\program files (x86)\ubisoft\ghost recon advanced warfighter\graw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ghost recon advanced warfighter\graw.exe |
"UDP Query User{B107BD5C-7D38-45BA-94A1-93B2E2DFF7AC}E:\programme\2k games\gearbox software\borderlands\binaries\borderlands.exe" = protocol=17 | dir=in | app=e:\programme\2k games\gearbox software\borderlands\binaries\borderlands.exe |
"UDP Query User{B29B2DB8-4044-4482-B97B-E1D2FEBD5177}C:\users\benutzer\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\benutzer\appdata\local\akamai\netsession_win.exe |
"UDP Query User{C4DDEE0B-85F7-4549-B881-63CDAFAF683F}C:\program files (x86)\monte cristo\war on terror\wot.exe" = protocol=17 | dir=in | app=c:\program files (x86)\monte cristo\war on terror\wot.exe |
"UDP Query User{C6FEC1CE-7508-45D1-B86F-E86039EC441A}C:\program files (x86)\electronic arts\command & conquer 4 tiberian twilight\data\cnc4.game" = protocol=17 | dir=in | app=c:\program files (x86)\electronic arts\command & conquer 4 tiberian twilight\data\cnc4.game |
"UDP Query User{C7EAE3AF-64AA-4190-8CCB-4D1B5A5F50B3}C:\program files (x86)\call of duty world at war\codwaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\call of duty world at war\codwaw.exe |
"UDP Query User{D2F0CCAB-BB19-4A93-B14F-B1D8E0073DAC}C:\program files (x86)\eidos\kane and lynch dead men\kaneandlynch.exe" = protocol=17 | dir=in | app=c:\program files (x86)\eidos\kane and lynch dead men\kaneandlynch.exe |
"UDP Query User{D6C39EF6-C54A-4A9B-90C0-41A95A0F912C}C:\program files (x86)\steam\steamapps\common\left 4 dead demo\left4dead.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead demo\left4dead.exe |
"UDP Query User{E481C56E-3F36-493F-80A1-DE96BA8FDF4A}C:\program files (x86)\call of duty world at war\codwawmp.exe" = protocol=17 | dir=in | app=c:\program files (x86)\call of duty world at war\codwawmp.exe |
"UDP Query User{E4E404C4-7DA0-4326-8223-41F837984644}C:\program files (x86)\steam\steamapps\big_paddy\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\big_paddy\team fortress 2\hl2.exe |
"UDP Query User{E52080FC-8741-467F-A3FB-2EBFCD4E1F50}C:\program files (x86)\steam\steamapps\fcb1993\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\fcb1993\counter-strike source\hl2.exe |
"UDP Query User{E76634DB-B95D-4CC0-9609-03E8AAF91DE6}C:\program files (x86)\microsoft games\microsoft flight simulator x\fsx.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft games\microsoft flight simulator x\fsx.exe |
"UDP Query User{ECC9B8DE-8F1C-4042-8F06-6DE51EB9BC24}C:\games\world_of_tanks\worldoftanks.exe" = protocol=17 | dir=in | app=c:\games\world_of_tanks\worldoftanks.exe |
"UDP Query User{F2A5252E-C4C7-4840-A776-6C811F244FC1}C:\program files (x86)\steam\steamapps\common\call of duty black ops\blackops.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops\blackops.exe |
"UDP Query User{FDEB4B3A-29C9-4227-9138-F10B07A0EE8F}C:\program files (x86)\firefly studios\stronghold legends\strongholdlegends.exe" = protocol=17 | dir=in | app=c:\program files (x86)\firefly studios\stronghold legends\strongholdlegends.exe |
"UDP Query User{FE1C8976-276E-4BA1-99A1-386FD2DC483E}C:\program files (x86)\ea games\battlefield 2\bf2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\ea games\battlefield 2\bf2.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{282E5AB2-8E47-4571-B6FA-6B512555B557}" = HP Photosmart.All-In-One Driver Software 8.0 .A
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{4BDE7544-0A08-4AD9-8A8F-4B7944471C36}" = iTunes
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{51DDB4F9-7FFF-4970-AED4-DB3C22A5C522}" = Corel Graphics - Windows Shell Extension 64 Bit
"{52D530AD-5CCA-48dc-B6F0-6D14652B0291}" = AIO_CDA_ToolboxIni64
"{56F26668-13DA-497A-883F-61434A10CBAB}" = MobileMe Control Panel
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{899FCA36-ADAF-4612-8579-B37DDB0C092F}" = Saitek SD6 Programming Software 6.6.6.9
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{9E3B2120-0BD8-9865-0387-E9BAC2A53AD3}" = ccc-utility64
"{9F560BEB-021F-43AC-825F-AA60442D8DE4}" = 64 Bit HP CIO Components Installer
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{B8AD779A-82DA-4365-A7D0-AD3DCFC55CFF}" = Apple Mobile Device Support
"{BE882A12-5A45-3DFF-9FD0-306DE65EB8A5}" = AMD Catalyst Install Manager
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"WinRAR archiver" = WinRAR
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"_{B6BFCD02-BA0E-41A9-9C9C-6624C4BB475F}" = Corel Graphics - Windows Shell Extension
"_{CE54DCE1-E00A-4D91-ACB9-A2D916C24051}" = CorelDRAW(R) Graphics Suite X5
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{02B244A2-7F6A-42E8-A36F-8C385D7A1625}" = Gothic III
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}" = Battlefield 2(TM)
"{0513EE35-E0FB-4166-B663-BD1AE3A803DE}" = Anno 1404
"{0B5154C0-8F00-4616-B0AB-6240AE80D9CE}" = SimCity™ Societies
"{0CB3C535-1171-4A20-B549-E2CB5DEB9723}" = MySQL Connector/ODBC 3.51
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0D97F8D1-2102-53D2-5633-C992D6086801}" = CCC Help Chinese Traditional
"{0EA00EA7-42C0-ED9C-9110-2C04B8EDBA66}" = CCC Help Italian
"{0EB86B70-91FF-39BF-633C-785DF2218CC6}" = CCC Help French
"{10F755FD-ED31-4ABF-8720-49A399C52297}" = calibre
"{1367FA2F-2B3D-430F-872F-588B93420BFC}" = TimeShift
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{14574B7F-75D1-4718-B7F2-EBF6E2862A35}" = Company of Heroes - FAKEMSI
"{1686C07D-C2BB-A8B2-C5ED-32C4EE1A3E62}" = CCC Help Spanish
"{16D2C649-CBA8-44EE-B730-12584667D487}" = Stronghold 2
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{18B6A9F8-25BC-5978-6B42-A50FA2CABC18}" = CCC Help English
"{1998BD34-1AAB-4169-ACFF-67342E2AF9B4}" = Gothic III Release Update
"{199E6632-EB28-4F73-AECB-3E192EB92D18}" = Company of Heroes - FAKEMSI
"{1EAC1D02-C6AC-4FA6-9A44-96258C37C812}_is1" = World of Tanks v.0.7.1
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink Blu-ray Disc Suite
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{2217B0B4-35CB-48C6-B640-864DF2F30F99}" = OpenOffice.org 3.2
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{22D90DD2-8654-4E8A-B2F1-B6B86A2BF390}" = CyberLink UDF Reader 5.0
"{24D9A3E0-D086-4B62-AF93-63CF6B05CB48}" = CorelDRAW Graphics Suite X5 - Custom Data
"{25724802-CC14-4B90-9F3B-3D6955EE27B1}" = Company of Heroes - FAKEMSI
"{25B473C3-2C62-482B-858F-94ED76880F79}" = Patrizier 4
"{25F28E39-FDBB-11DB-8314-0800200C9A66}" = Medal of Honor Airborne
"{260ED378-2B8C-4831-ADAE-D0712D119AC5}" = CorelDRAW Graphics Suite X5 - VSTA
"{26945917-E053-45F6-AF98-309730CFC318}" = Visual Basic for Applications (R) Core
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{296D8550-CB06-48E4-9A8B-E5034FB64715}" = Command & Conquer™ Alarmstufe Rot 3
"{298C6691-46B2-2065-0DD7-1E7B3B669A47}" = CCC Help Finnish
"{299C0434-4F4E-341F-A916-4E07AEB35E79}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime
"{2D2D8FE2-605C-4D3C-B706-36E981E7EEF0}" = CyberLink BD Advisor 2.0
"{2E1A71D5-7897-4F3F-B0E3-B412C86A646D}" = Need for Speed™ ProStreet
"{2ECA81CA-D932-4AD3-AD59-BF5CCF099C83}" = Catalyst Control Center - Branding
"{3108C217-BE83-42E4-AE9E-A56A2A92E549}" = Atheros Communications Inc.(R) AR8121/AR8113/AR8114 Gigabit/Fast Ethernet Driver
"{3260D61B-DCA6-4ec6-8A41-DCCE01BC6EE4}" = c4100_Help
"{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}" = Company of Heroes - FAKEMSI
"{3472C84E-2FD0-439F-B27F-C290C1E4CD8B}" = CorelDRAW Graphics Suite X5 - Filters
"{35072D55-075E-43E0-9415-AA122DE3EED4}" = War Leaders Patch
"{37155929-A51F-4BAB-B141-50B341F3299C}" = Desperados 2
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3B4E636E-9D65-4D67-BA61-189800823F52}" = Windows Live Communications Platform
"{3C7839E7-21F4-49E0-B4D5-AC8ED818CCB0}" = NETGEAR WNDA3100v2 wireless USB 2.0 adapter
"{3CA5E31B-3294-4352-A7D7-A156763779E9}" = NavyFIELD Europa
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{400C5445-1AE8-1A41-CAC6-AB114341F65D}" = CCC Help Swedish
"{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"{41E654A9-26D0-4EAC-854B-0FA824FFFABB}" = Windows Live Messenger
"{448B1C6D-02C2-7681-66B2-624E58B25375}" = CCC Help Turkish
"{44F5A980-8A6B-4aca-8D85-EFCE5D67D379}" = AIO_CDA_ProductContext
"{46EB9D45-FC1A-2635-1693-176E6FA1C672}" = CCC Help Portuguese
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E79A60F-15D2-4BEC-91AD-E41EC42E61B0}" = Batman: Arkham Asylum
"{50193078-F553-4EBA-AA77-64C9FAA12F98}" = Company of Heroes - FAKEMSI
"{50D4CB89-AF34-4978-96DC-C3034062E901}" = Battlefield 2: Special Forces
"{513148E7-B7A1-48B2-B518-668701E546F5}" = LightScribe System Software  1.14.19.1
"{51D718D1-DA81-4FAD-919F-5C1CE3C33379}" = Company of Heroes - FAKEMSI
"{51F24145-A833-4BD5-AA38-AFC5268928E5}" = IL-2 Sturmovik Series Ultimate Edition
"{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}" = Skype web features
"{5454083B-1308-4485-BF17-1110000B8301}" = Grand Theft Auto IV
"{5454083B-1308-4485-BF17-1110000D8301}" = Grand Theft Auto IV
"{54B8F4A1-02B0-4D32-8F37-925526C0EEC6}" = CorelDRAW Graphics Suite X5 - Connect
"{57400C1E-BC51-4ECE-AD2A-A6096204DDEC}" = CorelDRAW Graphics Suite X5 - VBA
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{587A2120-41D3-11DB-3D6C-00E19E4D4AE1}" = MSTS Patch 1.8.0105
"{59123CCF-FED2-46FF-9293-D1DC80042219}" = CorelDRAW Graphics Suite X5 - Redist
"{59ABBDF0-E1E5-48AF-85FB-F523A08C3490}" = STREET FIGHTER IV
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5FC68772-6D56-41C6-9DF1-24E868198AE6}" = Windows Live Call
"{6179550A-3E7C-499E-BCC9-9E8113E0A285}" = LG Tool Kit
"{62978C1C-FE2E-4A4E-851D-3EB406C9EBC2}" = CorelDRAW Graphics Suite X5 - Draw
"{651F43AA-3F06-9277-6F1B-8E8155017463}" = CCC Help Polish
"{66A405D2-BA14-4594-BF36-B3B544F0754E}" = Stronghold Legends
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{66F78C51-D108-4F0C-A93C-1CBE74CE338F}" = Company of Heroes - FAKEMSI
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}" = CyberLink PowerDVD
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{68DE32E1-292B-6A02-6A53-935BFAE70C99}" = CCC Help Chinese Standard
"{6A9D1594-7791-48f5-9CAA-DE9BCB968320}" = Mass Effect™ 3
"{6AEE2B0B-B3C1-4367-B1EF-FC4ED98DEED1}" = C4100
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6B9B0C6F-E5FA-4633-A640-AB98A272ECCA}" = Safari
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7353BAE6-5E49-46C4-A9B5-8A269A313789}" = Crysis WARHEAD(R)
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{76DAEC83-AF7B-333C-8A53-83D7C7D39199}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7B63B2922B174135AFC0E1377DD81EC2}" =
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}" = Company of Heroes - FAKEMSI
"{80AE0E0A-5579-4015-9C1A-35F2F2CE5673}" = Emergency 4
"{80D03817-7943-4839-8E96-B9F924C5E67D}" = Company of Heroes - FAKEMSI
"{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"{818212BA-7F8C-DDF9-64BE-F6D0B6F46D29}" = CCC Help German
"{82696435-8572-4D8B-A230-D1AA567D0F0F}" = Command & Conquer™ 4 Tiberian Twilight
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83A606F5-BF6F-42ED-9F33-B9F74297CDED}" = Need for Speed(TM) Hot Pursuit
"{84F4542C-ED64-28AC-49B3-1A9BAB395AB4}" = CCC Help Hungarian
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89661B04-C646-4412-B6D3-5E19F02F1F37}" = EAX4 Unified Redist
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8D15E1B2-D2B7-4A17-B44B-D2DDE5981406}" = iLivid
"{8DC910CD-8EE3-4ffc-A4EB-9B02701059C4}" = Battlefield Heroes
"{8E1CCF20-9E12-4824-BD59-7AD9E0486DD8}" = SWAT 4
"{8E87B944-4815-3C5E-947F-5035C9F64362}" = Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU
"{8FDC1610-3FB5-4EF2-A0D0-CEDC3A525A25}" = DIE SIEDLER - Das Erbe der Könige
"{90850407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Word Viewer 2003
"{9244E956-5939-4B88-930C-0699D4AB2B95}" = CorelDRAW Graphics Suite X5 - WT
"{9530AE42-DAE1-4619-9594-B23487285D17}" = NVIDIA PhysX
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{974C4B12-4D02-4879-85E0-61C95CC63E9E}" = Fallout 3
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{97E5205F-EA4F-438F-B211-F1846419F1C1}" = Company of Heroes - FAKEMSI
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{983F7145-CABF-4EDD-9F3D-E06B2F024BD3}" = CorelDRAW Graphics Suite X5 - FontNav
"{99A7722D-9ACB-43F3-A222-ABC7133F159E}" = Company of Heroes - FAKEMSI
"{99AE7207-8612-4DBA-A8F8-BAE5C633390D}" = Star Wars Empire at War
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C3B7F54-C6E2-4A74-9937-9C6EBA10C4A2}" = Victoria 2
"{9C41195F-11B3-8EEC-6634-7183BE6CB1B1}" = CCC Help Japanese
"{9DF0196F-B6B8-4C3A-8790-DE42AA530101}" = SPORE™
"{A07B2C21-863B-47AB-AE7E-20BB00BD7D33}" = ANNO 1404 - Venedig
"{A1B04B6B-25BB-48AD-8BD9-D31A86E89F3E}" = CorelDRAW Graphics Suite X5 - PHOTO-PAINT
"{A1C962E2-2426-49C6-A38B-9A07E40D607C}" = Microsoft Games for Windows - LIVE
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A33A89D0-2F48-FD1C-A243-9073EE0592E0}" = Catalyst Control Center InstallProxy
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A5D65411-8E73-4C85-AD80-9FE8B7391CF9}" = Rome Total War - patch 1.3
"{A66C4716-7E10-4A53-8101-00C3C11D6A9C}" = Kane and Lynch: Dead Men
"{A66FB6C7-B689-AFD5-21BA-7CAF8E44E6E6}" = Catalyst Control Center Graphics Previews Common
"{A804B134-F03D-4EFD-9BC0-DCD257AA1B22}" = Hitman Blood Money
"{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU
"{AA59DDE4-B672-4621-A016-4C248204957A}" = Skype™ 5.5
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC61C594-5F86-4BE9-ABAF-763C6A8E2302}" = Silent Hunter 5
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch
"{AC76BA86-7AD7-5464-3428-900000000004}" = Spelling Dictionaries Support For Adobe Reader 9
"{ADD5DB49-72CF-11D8-9D75-000129760D75}" = CyberLink PowerBackup
"{AE136F7F-7DC6-600F-9DF9-BFA0DF516135}" = Catalyst Control Center Localization All
"{AEDDF5A3-29CE-11D5-A8C2-000102246AAE}" = ubi.com
"{AF1C9345-B53D-4110-BFBF-A0DD83AEAB83}" = AIO_CDA_Software
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B399C91E-96F2-4265-9884-1C9A10E9FCF4}" = CorelDRAW Graphics Suite X5
"{B3B2E45F-A0FC-47C6-B399-72D9D8482C8A}" = Visual Basic for Applications (R) Core - German
"{B48E264C-C8CD-4617-B0BE-46E977BAD694}" = ANNO 2070
"{B4CF00AE-2622-7BC6-24EC-4E5A0A8C9135}" = CCC Help Czech
"{B6BFCD02-BA0E-41A9-9C9C-6624C4BB475F}" = Corel Graphics - Windows Shell Extension
"{B7666229-351B-47D9-AA6F-DF777CF04BBF}" = Caesar IV
"{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"{B99CB207-4704-4C51-9309-0FA90AA26DD4}" = ROCCAT Kone[+] Mouse Driver
"{BA801B94-C28D-46EE-B806-E1E021A3D519}" = Company of Heroes - FAKEMSI
"{BAE1C0A8-634D-CFF1-0E0C-893092427D34}" = CCC Help Danish
"{BBB51C33-8D83-4B6C-84F8-CD6700B54463}" = Gigaset USB Adapter 300
"{BBF0A67B-5DBA-452F-9D2E-6F168BC226E4}" = Need for Speed™ SHIFT
"{BCB9DF93-537D-433D-AF3B-36025DEF5798}" = Joint Task Force
"{BCCD600C-6AC4-4F73-B3C8-F34BF5E417CC}" = War Leaders - Clash of Nations
"{BDA825AD-D60B-4935-9590-B0F1AC2E0D22}" = MotoGP 08
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C2DEC505-79A9-E952-32B0-31B67B83E231}" = CCC Help Korean
"{C2FB14FB-DF6B-287D-BDC3-C7BEC86F539E}" = Catalyst Control Center
"{C59C179C-668D-49A9-B6EA-0121CCFC1243}" = CyberLink LabelPrint
"{C59D3645-2A0D-4D5A-8258-EFB0CF17EC37}" = Driver Simulator
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{CA3861BA-1D96-4D66-B577-318E1602C4F3}" = CorelDRAW Graphics Suite X5 - Common
"{CAD1691A-FA24-4B95-9009-3257B8440ECC}" = Tom Clancy's Splinter Cell Double Agent
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CCEFAE22-4D01-0084-D1CA-AC14AA743A97}" = CCC Help Greek
"{CE54DCE1-E00A-4D91-ACB9-A2D916C24051}" = CorelDRAW Graphics Suite X5 - Setup Files
"{D0106CC2-E34B-4FA3-B6B6-91F0ACEA2CC3}" = Hearts of Iron III
"{D4D244D1-05E0-4D24-86A2-B2433C435671}" = Company of Heroes - FAKEMSI
"{D596EEA2-C6C8-45D3-89DF-FA2DBE99F829}" = Visual Basic for Applications (R) Core - English
"{D642FF8D-438D-4545-A1D5-2EDB4BCAE3BA}" = CorelDRAW Graphics Suite X5 - Photozoom Plugin
"{DA6FAB8D-E87A-4E8E-A3D3-B7B9F479C725}" = forteManager
"{DCF22E37-A8B6-4F78-9D61-3BCB5ED38A50}" = CorelDRAW Graphics Suite X5 - DE
"{DE29025A-091F-4998-AD2D-24C84421190F}" = Railroad Tycoon 3
"{DE460826-5E72-2357-154F-E376F9926008}" = CCC Help Norwegian
"{DE6CBC04-8673-4DBA-BA81-07F1639CEB5F}" = CorelDRAW Graphics Suite X5 - IPM
"{DFAE9340-E8BB-4433-9A08-C8334DAFE1B9}" = Star Wars Republic Commando
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E21FFD29-D231-3BD3-6941-15710E44BED4}" = CCC Help Dutch
"{E3A64E20-EDA4-4B93-9176-FD3B4C7B085F}" = Transport Giant: Down Under
"{E3E313C7-0AE2-7F44-52E8-528D4EDC74B2}" = CCC Help Thai
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"{E90DCEE9-DC27-401B-A7AC-B0AFF5B34E4D}" = Lock On: Modern Air Combat
"{EAF636A9-F664-4703-A659-85A894DA264F}" = Company of Heroes - FAKEMSI
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{EB879750-CCBD-4013-BFD5-0294D4DA5BD0}" = Apple Application Support
"{EDB98D5A-A6FB-425C-BFB7-51A0924B762D}" = CorelDRAW Graphics Suite X5 - Capture
"{EE5BC0BB-9EDA-423C-8276-48857B735D68}" = Prince of Persia Warrior Within
"{F0A209B7-7F85-4BDD-8F1F-B98EEAD9E04B}" = The Witcher 2
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F1000000-0001-0000-0000-074957833700}" = ABBYY FineReader 10 Professional Edition
"{F2485BF4-830D-4D7F-B553-3B125CCFB255}" = Codename: Panzers Cold War
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{F9929777-7B6E-F53D-3105-1C06E5120CA1}" = CCC Help Russian
"{FE4B83DE-85CF-4DE5-90CE-A2735A0E1F21}" = CorelDRAW Graphics Suite X5 - VideoBrowser
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"{THEGUILDREN-0010-2010-300520102330}_is1" = The Guild 2 - Renaissance
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Airline Tycoon - Deluxe" = Airline Tycoon - Deluxe
"Airport Tycoon 3_is1" = Airport Tycoon 3
"Akamai" = Akamai NetSession Interface Service
"ARMA 2 Operation Arrowhead" = ARMA 2 Operation Arrowhead Uninstall
"ARMA 2 REINFORCEMENTS" = ARMA 2 REINFORCEMENTS Uninstall
"ArmA2" = ArmA2 Uninstall
"AVS Update Manager_is1" = AVS Update Manager 1.0
"AVS4YOU Software Navigator_is1" = AVS4YOU Software Navigator 1.4
"AVS4YOU Video Converter 7_is1" = AVS Video Converter 7
"BabylonToolbar" = Babylon toolbar on IE
"Battlelog Web Plugins" = Battlelog Web Plugins
"BattlEye" = BattlEye Uninstall
"BattlEye for OA" = BattlEye for OA Uninstall
"BloodBowl_is1" = Blood Bowl Version 1.2.0.1
"Broken Sword 2.5_is1" = Broken Sword 2.5
"C11-Nitro" = Alarm für Cobra 11 - Nitro (remove only)
"Call of Duty" = Call of Duty
"Company of Heroes" = Company of Heroes
"Crysis WARHEAD(R)" = Crysis WARHEAD(R)
"DAEMON Tools Lite" = DAEMON Tools Lite
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"DivX Setup.divx.com" = DivX-Setup
"DMX5_is1" = DriverMax 5
"Driver Cleaner Pro" = DH Driver Cleaner Professional Edition
"ESN Sonar-0.70.4" = ESN Sonar
"FarmingSimulator2011DE_is1" = Landwirtschafts Simulator 2011
"Hattrick Organizer" = Hattrick Organizer (remove only)
"heroes in the sky" = heroes in the sky
"Hide Files and Folders_is1" = Hide Files and Folders v2.5
"iLivid" = iLivid
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = CyberLink Blu-ray Disc Suite
"InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}" = CyberLink Power2Go
"InstallShield_{51F24145-A833-4BD5-AA38-AFC5268928E5}" = IL-2 Sturmovik Series Ultimate Edition
"InstallShield_{80E158EA-7181-40FE-A701-301CE6BE64AB}" = CyberLink MediaShow
"InstallShield_{8E1CCF20-9E12-4824-BD59-7AD9E0486DD8}" = SWAT 4
"InstallShield_{B7A0CE06-068E-11D6-97FD-0050BACBF861}" = CyberLink PowerProducer
"InstallShield_{E48469CC-635E-4FD5-A122-1497C286D217}" = Call of Duty(R) 4 - Modern Warfare(TM)
"IrfanView" = IrfanView (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"McAfee Security Scan" = McAfee Security Scan Plus
"mediAvatar Video Converter" = mediAvatar Video Converter Professionell
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mozilla Firefox 11.0 (x86 de)" = Mozilla Firefox 11.0 (x86 de)
"OpenTTD" = OpenTTD 1.0.2
"Origin" = Origin
"oZone3D.Net FurMark_is1" = oZone3D.Net FurMark v1.6.4
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PunkBusterSvc" = PunkBuster Services
"Railworks 3 Train Simulator 2012 Deluxe_is1" = Railworks 3 Train Simulator 2012 Deluxe
"RiseOfNations 1.0" = Microsoft Rise Of Nations
"RiseofNationsExpansion 1.0" = Rise of Nations Thrones and Patriots
"SADK" = Die Siedler - Aufbruch der Kulturen
"Searchqu 406 MediaBar" = Windows iLivid Toolbar
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 13140" = America's Army 3
"Steam App 13180" = America's Army 3 Dedicated Server
"Steam App 21970" = R.U.S.E
"Steam App 24240" = PAYDAY: The Heist
"Steam App 34030" = Napoleon: Total War
"Steam App 34330" = Total War: SHOGUN 2
"Steam App 400" = Portal
"Steam App 42700" = Call of Duty: Black Ops
"Steam App 42710" = Call of Duty: Black Ops - Multiplayer
"Steam App 42720" = Call of Duty Black Ops - Remote Console
"Steam App 43110" = Metro 2033
"Steam App 440" = Team Fortress 2
"Steam App 50130" = Mafia II
"Steam App 55230" = Saints Row: The Third
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 8930" = Sid Meier's Civilization V
"Steam App 91310" = Dead Island
"Train Simulator 1.0" = Microsoft Train Simulator
"Two Worlds II" = Two Worlds II
"VLC media player" = VideoLAN VLC media player 0.8.6i
"WinLiveSuite_Wave3" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"Xvid_is1" = Xvid MPEG-4 Video Codec
Ist unvollständig. Siehe nächste Antwort

markusg 21.03.2012 20:05
hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4 - HKCU..\Run: [SkypePM] C:\Users\Benutzer\AppData\Local\Skype\SkypePM.exe (Microsoft Corporation)
 :Files
C:\Users\Benutzer\AppData\Local\Skype
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Freezer271 21.03.2012 20:09
Ich weiss nicht ob es noch nötig ist. Aber hier ist trotzdem noch die restlichen Zeilen
Code:
0x4a594cd0, Ausnahmecode 0xc0000005, Fehleroffset 0x000100b5,  Prozess-ID 0xf00,
Anwendungsstartzeit 01cba1f805466399.
 
Error - 22.12.2010 13:50:29 | Computer Name = Lucius-PC | Source = WinMgmt | ID = 10
Description =
 
Error - 22.12.2010 15:05:27 | Computer Name = Lucius-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\DivX\DivX Update\x64\DivXUpdateCheck.dll".  Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.12.2010 15:14:34 | Computer Name = Lucius-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\DivX\DivX Update\x64\DivXUpdateCheck.dll".  Die abhängige Assemblierung "Microsoft.VC80.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="8.0.50727.4053""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 22.12.2010 15:20:14 | Computer Name = Lucius-PC | Source = Windows Search Service | ID = 3013
Description =
 
Error - 23.12.2010 08:19:59 | Computer Name = Lucius-PC | Source = WinMgmt | ID = 10
Description =
 
[ System Events ]
Error - 21.03.2012 13:52:33 | Computer Name = Lucius-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\CLBStor.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 21.03.2012 13:52:37 | Computer Name = Lucius-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\CLBStor.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 21.03.2012 13:52:37 | Computer Name = Lucius-PC | Source = Application Popup | ID = 1060
Description = Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\CLBStor.SYS
 nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version
 des Treibers zu erhalten.
 
Error - 21.03.2012 13:53:37 | Computer Name = Lucius-PC | Source = DCOM | ID = 10005
Description =
 
Error - 21.03.2012 13:53:48 | Computer Name = Lucius-PC | Source = DCOM | ID = 10005
Description =
 
Error - 21.03.2012 13:53:52 | Computer Name = Lucius-PC | Source = DCOM | ID = 10005
Description =
 
Error - 21.03.2012 13:54:08 | Computer Name = Lucius-PC | Source = DCOM | ID = 10005
Description =
 
Error - 21.03.2012 13:54:10 | Computer Name = Lucius-PC | Source = DCOM | ID = 10005
Description =
 
Error - 21.03.2012 13:54:27 | Computer Name = Lucius-PC | Source = Service Control Manager | ID = 7001
Description =
 
Error - 21.03.2012 13:54:27 | Computer Name = Lucius-PC | Source = Service Control Manager | ID = 7026
Description =
 
 
< End of report >

markusg 21.03.2012 20:10
danke dir :-)

Freezer271 21.03.2012 20:22
Code:
All processes killed
Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context!
Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context!
Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context!
Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context!
Error: Unable to interpret </md5start> in the current context!
Error: Unable to interpret <userinit.exe> in the current context!
Error: Unable to interpret <eventlog.dll> in the current context!
Error: Unable to interpret <scecli.dll> in the current context!
Error: Unable to interpret <netlogon.dll> in the current context!
Error: Unable to interpret <cngaudit.dll> in the current context!
Error: Unable to interpret <ws2ifsl.sys> in the current context!
Error: Unable to interpret <sceclt.dll> in the current context!
Error: Unable to interpret <ntelogon.dll> in the current context!
Error: Unable to interpret <winlogon.exe> in the current context!
Error: Unable to interpret <logevent.dll> in the current context!
Error: Unable to interpret <user32.DLL> in the current context!
Error: Unable to interpret <explorer.exe> in the current context!
Error: Unable to interpret <iaStor.sys> in the current context!
Error: Unable to interpret <nvstor.sys> in the current context!
Error: Unable to interpret <atapi.sys> in the current context!
Error: Unable to interpret <IdeChnDr.sys> in the current context!
Error: Unable to interpret <viasraid.sys> in the current context!
Error: Unable to interpret <AGP440.sys> in the current context!
Error: Unable to interpret <vaxscsi.sys> in the current context!
Error: Unable to interpret <nvatabus.sys> in the current context!
Error: Unable to interpret <viamraid.sys> in the current context!
Error: Unable to interpret <nvata.sys> in the current context!
Error: Unable to interpret <nvgts.sys> in the current context!
Error: Unable to interpret <iastorv.sys> in the current context!
Error: Unable to interpret <ViPrt.sys> in the current context!
Error: Unable to interpret <eNetHook.dll> in the current context!
Error: Unable to interpret <ahcix86.sys> in the current context!
Error: Unable to interpret <KR10N.sys> in the current context!
Error: Unable to interpret <nvstor32.sys> in the current context!
Error: Unable to interpret <ahcix86s.sys> in the current context!
Error: Unable to interpret </md5stop> in the current context!
Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context!
Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context!
Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context!
Error: Unable to interpret <%USERPROFILE%\*.*> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context!
Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context!
Error: Unable to interpret <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs> in the current context!
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SkypePM deleted successfully.
C:\Users\Benutzer\AppData\Local\Skype\SkypePM.exe moved successfully.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: Administrator
->Flash cache emptied: 41620 bytes
 
User: All Users
 
User: Benutzer
->Flash cache emptied: 108590 bytes
 
User: Default
->Flash cache emptied: 41620 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0.00 mb
 
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 51038 bytes
->Temporary Internet Files folder emptied: 34057 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Benutzer
->Temp folder emptied: 4688982402 bytes
->Temporary Internet Files folder emptied: 21315042 bytes
->Java cache emptied: 770117 bytes
->FireFox cache emptied: 71811334 bytes
->Google Chrome cache emptied: 6217153 bytes
->Flash cache emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 557056 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 900219122 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33109 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 33170 bytes
RecycleBin emptied: 22197176559 bytes
 
Total Files Cleaned = 26'595.00 mb
 
 
OTL by OldTimer - Version 3.2.39.1 log created on 03212012_201021

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
Es hört sich zwar makaber an, aber ich bin froh dass alle Prozesse gekillt wurden.

Ist noch ein weiterer Schritt vonnöten?

Und Danke schon mal für die schnellen Antworten und die kompetente lösungsorientierte und schadensbegrenzende Hilfe.

Bei unsere Geschäfts IT hätte das Wochen gedauert:-).(Ist mein Privat-PC)

markusg 21.03.2012 21:02
das war nicht mein script, lies noch mal und mach es erneut.

Freezer271 21.03.2012 22:02
Ich habe es nochmals durchlaufen lassen.

Schritt für Schritt und habe auch den Upload getätigt.
Ich hoffe diesmal war es dein Script (Einfach deinen Text in das Fenster im OTL kopiert und dan Run Fix gedrückt).

Hier die neue txt.-Datei:

Code:
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\SkypePM not found.
File C:\Users\Benutzer\AppData\Local\Skype\SkypePM.exe not found.
========== COMMANDS ==========
 
[EMPTYFLASH]
 
User: Administrator
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Benutzer
->Flash cache emptied: 456 bytes
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0.00 mb
 
 
[EMPTYTEMP]
 
User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: All Users
 
User: Benutzer
->Temp folder emptied: 327242 bytes
->Temporary Internet Files folder emptied: 2352551 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 39723604 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 2729 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 40.00 mb
 
 
OTL by OldTimer - Version 3.2.39.1 log created on 03212012_215058

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

markusg 22.03.2012 13:12
passt, danke.
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Freezer271 22.03.2012 18:58
Code:
ComboFix 12-03-22.01 - Benutzer 22.03.2012  18:30:21.1.4 - x64
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.41.1031.18.8190.6550 [GMT 1:00]
ausgeführt von:: c:\users\Benutzer\Downloads\ComboFix.exe
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Mozilla Firefox\searchplugins\SearchquWebSearch.xml
c:\users\Benutzer\AppData\Roaming\FFSJ
c:\users\Benutzer\AppData\Roaming\FFSJ\FFSJ.cfg
c:\users\Benutzer\AppData\Roaming\Mozilla\Firefox\Profiles\spducmme.default\searchplugins\SearchquWebSearch.xml
c:\windows\SysWow64\Packet.dll
c:\windows\SysWow64\pthreadVC.dll
c:\windows\SysWow64\wpcap.dll
.
.
(((((((((((((((((((((((((((((((((((((((  Treiber/Dienste  )))))))))))))))))))))))))))))))))))))))))))))))))
.
.
-------\Service_NPF
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-02-22 bis 2012-03-22  ))))))))))))))))))))))))))))))
.
.
2015-07-08 15:53 . 2015-07-08 15:53        --------        d-----w-        c:\users\Benutzer\AppData\Local\CAPCOM
2012-03-22 17:39 . 2012-03-22 17:39        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-03-22 17:39 . 2012-03-22 17:39        --------        d-----w-        c:\users\Administrator\AppData\Local\temp
2012-03-21 19:10 . 2012-03-21 20:58        --------        d-----w-        C:\_OTL
2012-03-19 18:38 . 2012-03-22 16:31        --------        d-----w-        c:\users\Benutzer\AppData\Roaming\ExpressFiles
2012-03-19 18:38 . 2012-03-19 18:38        --------        d-----w-        c:\program files (x86)\ExpressFiles
2012-03-18 13:13 . 2012-03-18 13:13        --------        d-----w-        c:\users\Benutzer\AppData\Local\SKIDROW
2012-03-18 12:32 . 2011-06-24 15:28        650752        ----a-w-        c:\windows\SysWow64\xvidcore.dll
2012-03-18 12:32 . 2011-06-24 14:58        153088        ----a-w-        c:\windows\SysWow64\xvid.ax
2012-03-18 12:32 . 2012-03-18 12:32        --------        d-----w-        c:\program files (x86)\Xvid
2012-03-18 12:32 . 2011-06-24 15:44        243200        ----a-w-        c:\windows\SysWow64\xvidvfw.dll
2012-03-18 12:32 . 2012-03-18 12:32        --------        d-----w-        c:\program files (x86)\Video Codec
2012-03-17 14:08 . 2012-03-17 14:08        592824        ----a-w-        c:\program files (x86)\Mozilla Firefox\gkmedias.dll
2012-03-17 14:08 . 2012-03-17 14:08        44472        ----a-w-        c:\program files (x86)\Mozilla Firefox\mozglue.dll
2012-03-17 10:57 . 2012-03-17 10:57        --------        d-----w-        c:\programdata\Premium
2012-03-17 10:57 . 2012-03-17 10:57        --------        d-----w-        c:\programdata\InstallMate
2012-03-15 18:22 . 2012-03-15 18:22        --------        d-----w-        c:\program files\iPod
2012-03-15 18:22 . 2012-03-15 18:23        --------        d-----w-        c:\program files\iTunes
2012-03-15 18:22 . 2012-03-15 18:23        --------        d-----w-        c:\program files (x86)\iTunes
2012-03-07 17:46 . 2012-03-07 17:46        --------        d-----w-        c:\program files (x86)\NVIDIA Corporation
2012-03-02 20:28 . 2012-03-02 20:51        --------        d-----w-        c:\users\Benutzer\AppData\Local\PAYDAY
2012-02-22 17:21 . 2012-02-22 17:25        --------        d-----w-        c:\users\Benutzer\AppData\Roaming\wargaming.net
2012-02-22 17:04 . 2012-02-22 17:04        --------        d-----w-        C:\Games
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-02-20 19:24 . 2011-11-24 16:44        282864        ----a-w-        c:\windows\SysWow64\PnkBstrB.xtr
2012-02-20 19:24 . 2008-11-13 18:46        282864        ----a-w-        c:\windows\SysWow64\PnkBstrB.exe
2012-02-20 19:24 . 2008-11-13 18:46        280904        ----a-w-        c:\windows\SysWow64\PnkBstrB.ex0
2012-02-15 16:25 . 2008-11-13 18:46        76888        ----a-w-        c:\windows\SysWow64\PnkBstrA.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\URLSearchHooks]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\program files (x86)\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
.
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
.
[HKEY_LOCAL_MACHINE\Wow6432Node\~\Browser Helper Objects\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
2010-06-03 16:24        2736736        ----a-w-        c:\program files (x86)\softonic-de3\tbsoft.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar]
"{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}"= "c:\program files (x86)\softonic-de3\tbsoft.dll" [2010-06-03 2736736]
.
[HKEY_CLASSES_ROOT\clsid\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}]
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Logo Cool"="c:\programdata\Licensegplgpl.orb70" [X]
"iso data fast cast"="c:\programdata\hope dead army.e2wcg3j" [X]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2009-04-10 1555968]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 138240]
"ISUSPM Startup"="c:\progra~2\COMMON~1\INSTAL~1\UPDATE~1\isuspm.exe" [2004-06-16 221184]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2010-05-01 2938552]
"DAEMON Tools Lite"="c:\program files (x86)\DAEMON Tools Lite\DTLite.exe" [2011-01-20 1305408]
"Akamai NetSession Interface"="c:\users\Benutzer\AppData\Local\Akamai\netsession_win.exe" [2012-03-13 3331872]
"EADM"="e:\programme\Origin\Origin.exe" [2012-03-02 3402376]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-06-20 35760]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-06-09 976832]
"UpdateLBPShortCut"="c:\program files (x86)\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe" [2008-02-21 222504]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2008-07-18 104936]
"UpdateP2GoShortCut"="c:\program files (x86)\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe" [2008-09-24 210216]
"UpdatePPShortCut"="c:\program files (x86)\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe" [2008-06-13 210216]
"LGODDFU"="c:\program files (x86)\lg_fwupdate\fwupdate.exe" [2010-05-02 557056]
"UpdatePSTShortCut"="c:\program files (x86)\CyberLink\Blu-ray Disc Suite\MUITransfer\MUIStartMenu.exe" [2008-10-20 210216]
"BDRegion"="c:\program files (x86)\Cyberlink\Shared Files\brs.exe" [2009-09-04 75048]
"RemoteControl"="c:\program files (x86)\CyberLink\PowerDVD\PDVDServ.exe" [2009-04-16 87336]
"LanguageShortcut"="c:\program files (x86)\CyberLink\PowerDVD\Language\Language.exe" [2009-04-16 62760]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2010-06-03 1144104]
"DATAMNGR"="c:\progra~2\Windows iLivid Toolbar\Datamngr\datamngrUI.exe" [2011-03-24 1115536]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-02-20 59240]
"hffsrv"="c:\windows\hffext\hffsrv.exe" [2006-05-06 82432]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-12-05 343168]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-03-06 421736]
"ExpressFiles"="c:\program files (x86)\ExpressFiles\ExpressFiles.exe" [2012-03-19 453240]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
NETGEAR WNDA3100v2 Smart Wizard.lnk - e:\programme\NETGEAR\WNDA3100v2\WNDA3100v2.exe [2011-2-5 3330048]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
R4 ABBYY.Licensing.FineReader.Professional.10.0;ABBYY FineReader 10 PE Licensing Service;c:\program files (x86)\Common Files\ABBYY\FineReader\10.00\Licensing\PE\NetworkLicenseServer.exe [2009-12-22 814344]
S2 acedrv11;acedrv11;c:\windows\system32\drivers\acedrv11.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
Akamai        REG_MULTI_SZ          Akamai
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2008-07-30 08:39        451872        ----a-w-        c:\program files (x86)\Common Files\LightScribe\LSRunOnce.exe
.
Inhalt des "geplante Tasks" Ordners
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"combofix"="c:\combofix\CF14977.3XE" [2008-01-21 363008]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x1
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://isearch.babylon.com/?babsrc=HP_ss&affID=18474&mntrId=e67903c7000000000000002215f0fba6
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local;127.0.0.1:9421;<local>
uInternet Settings,ProxyServer = 216.245.198.202:80
TCP: DhcpNameServer = 192.168.1.1
DPF: Microsoft XML Parser for Java - file:///C:/Windows/Java/classes/xmldso.cab
CLSID: {603d3801-bd81-11d0-a3a5-00c04fd706ec} - %SystemRoot%\SysWow64\browseui.dll
FF - ProfilePath - c:\users\Benutzer\AppData\Roaming\Mozilla\Firefox\Profiles\spducmme.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxp://www.google.ch/firefox?client=firefox-a&rls=org.mozilla:de:official
FF - prefs.js: keyword.URL - hxxp://www.searchqu.com/web?src=ffb&systemid=406&q=
FF - prefs.js: network.proxy.ftp - 195.37.234.5
FF - prefs.js: network.proxy.ftp_port - 80
FF - prefs.js: network.proxy.http - 195.37.234.5
FF - prefs.js: network.proxy.http_port - 80
FF - prefs.js: network.proxy.socks - 195.37.234.5
FF - prefs.js: network.proxy.socks_port - 80
FF - prefs.js: network.proxy.ssl - 195.37.234.5
FF - prefs.js: network.proxy.ssl_port - 80
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
BHO-{ee1babcf-cbe2-4c07-8e18-dfe6fc08c30a}  - (no file)
Toolbar-10 - (no file)
Wow6432Node-HKCU-Run-RGSC - e:\programme\Rockstar Games\Rockstar Games Social Club\RGSCLauncher.exe
Toolbar-10 - (no file)
WebBrowser-{CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - (no file)
HKLM-Run-Windows Defender - c:\program files (x86)\Windows Defender\MSASCui.exe
AddRemove-Battlelog Web Plugins - c:\program files (x86)\Battlelog Web Plugins\uninstall.exe
AddRemove-BattlEye - e:\programme\Bohemia Interactive\ArmA 2Expansion\BattlEye\UnInstallBE.exe
AddRemove-BattlEye for OA - e:\programme\Bohemia Interactive\ArmA 2Expansion\BattlEye\UnInstallBE.exe
AddRemove-Steam App 10180 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 10190 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 13140 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 13180 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 21970 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 34030 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 34330 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 400 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 42700 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 42720 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 43110 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 440 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 55230 - c:\program files (x86)\Steam\steam.exe
AddRemove-Steam App 8930 - c:\program files (x86)\Steam\steam.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files (x86)\DivX\DivXCodecUninstall.exe
AddRemove-{8ADFC4160D694100B5B8A22DE9DCABD9} - c:\program files (x86)\DivX\DivXPlayerUninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\Akamai]
"ServiceDll"="c:\program files (x86)\common files\akamai/netsession_win_7de0ed9.dll"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet002\Services\{95808DC4-FA4A-4C74-92FE-5B863F82066B}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-1210777864-786218563-2691137719-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:05,00,5f,09,cc,2f,a6,ad,13,55,50,c6,30,82,65,2d,ca,c8,1d,5b,2f,6c,fc,
  22,3f,94,2f,7f,af,02,55,c3,6f,c2,32,a7,e1,1d,6e,ad,ed,42,24,39,59,42,44,09,\
"??"=hex:f9,55,86,5b,11,fb,0d,9c,10,01,33,bc,35,37,db,23
.
[HKEY_USERS\S-1-5-21-1210777864-786218563-2691137719-1000\Software\SecuROM\License information*]
"datasecu"=hex:b3,6c,f6,f9,15,ad,1f,fd,f6,1b,23,57,d0,6d,d3,56,32,6a,6b,32,d3,
  d7,2e,2c,d4,13,a5,82,d1,0c,b5,99,5c,80,c9,3a,e6,63,ce,c5,d3,88,37,bf,b1,11,\
"rkeysecu"=hex:33,56,48,52,c3,2f,62,59,f5,0b,b7,de,15,d6,12,d1
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}]
@Denied: (A 2) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{D27CDB6B-AE6D-11CF-96B8-444553540000}\1.0]
@="Shockwave Flash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}]
@Denied: (A 2) (Everyone)
@=""
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\TypeLib\{FAB3E735-69C7-453B-A446-B6823C6DF1C9}\1.0]
@="FlashBroker"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Classes]
"SymbolicLinkValue"=hex(6):5c,00,52,00,45,00,47,00,49,00,53,00,54,00,52,00,59,
  00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\ExpressFiles\EFupdater.exe
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\Common Files\LightScribe\LSSrvc.exe
c:\windows\SysWOW64\PnkBstrA.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\ROCCAT\Kone[+] Mouse\Kone[+]Monitor.exe
c:\program files (x86)\Windows iLivid Toolbar\Datamngr\datamngrUI.exe
c:\program files (x86)\Mozilla Firefox\firefox.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-22  18:56:30 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-03-22 17:56
.
Vor Suchlauf: 16 Verzeichnis(se), 146'349'101'056 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 145'531'604'992 Bytes frei
.
- - End Of File - - 50980B8593E11BAEE57BDD9E957B54B2

markusg 22.03.2012 19:01
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Freezer271 22.03.2012 21:43
Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.03.22.04

Windows Vista Service Pack 2 x64 NTFS
Internet Explorer 9.0.8112.16421
Benutzer :: LUCIUS-PC [Administrator]

22.03.2012 19:08:16
mbam-log-2012-03-22 (19-08-16).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 909339
Laufzeit: 2 Stunde(n), 29 Minute(n), 39 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 8
C:\Users\Benutzer\Desktop\Ordner\E4\7\1st-RUSE-Trainer-1.exe (HackTool.GamesCheat.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Benutzer\Downloads\Anno 2070 (2011_ENG).exe (Trojan.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Benutzer\Downloads\DownloadSetup.exe (Affiliate.Downloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Benutzer\Downloads\SoftonicDownloader_for_hide-files-and-folders(1).exe (PUP.BundleOffer.Downloader.S) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Benutzer\Downloads\SoftonicDownloader_for_hide-files-and-folders.exe (PUP.BundleOffer.Downloader.S) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Benutzer\Downloads\video.exe (Trojan.FakeAlert) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\_OTL\MovedFiles\03212012_201021\C_Users\Benutzer\AppData\Local\Skype\SkypePM.exe (Spyware.Zbot) -> Erfolgreich gelöscht und in Quarantäne gestellt.
E:\Programme\Ubisoft\Related Designs\ANNO 2070\solidcore32.dll (Trojan.Krypt) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

markusg 23.03.2012 16:31
lade den CCleaner standard:
CCleaner Download - CCleaner 3.16.1666
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.


Alle Zeitangaben in WEZ +1. Es ist jetzt 20:09 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131