Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Malwarebytes bericht (https://www.trojaner-board.de/128120-malwarebytes-bericht.html)

JulianK. 13.12.2012 18:45
Malwarebytes bericht
 
Hi community,
ich wollte letztens einen film angucken und dann stand da: video not found, hab bei google geguckt und da stand, dass ich einen virus hab und dass ich malwarebytes installieren soll und die viren löschen soll und dann den bericht hierreinkopieren soll, ich weiß zwar nicht warum, aber ich mach es einfach mal:
Malwarebytes Anti-Malware 1.65.1.1000
www.malwarebytes.org

Datenbank Version: v2012.12.13.09

Windows 7 x86 NTFS
Internet Explorer 9.0.8112.16421
Juli :: JULI-PC [Administrator]

13.12.2012 18:13:05
mbam-log-2012-12-13 (18-13-05).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 202836
Laufzeit: 5 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 1
C:\ProgramData\IBUpdaterService\ibsvc.exe (PUP.InstallBrain) -> 496 -> Löschen bei Neustart.

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 2
HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 1
C:\ProgramData\IBUpdaterService (PUP.InstallBrain) -> Löschen bei Neustart.

Infizierte Dateien: 3
C:\Users\Juli\Downloads\ADLSoft_UnCompressor.exe (PUP.Adware.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\ProgramData\IBUpdaterService\ibsvc.exe (PUP.InstallBrain) -> Löschen bei Neustart.
C:\ProgramData\IBUpdaterService\repository.xml (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

markusg 13.12.2012 19:53
Hi
wer illegale Angebote wie Kinox.to nutzt, muss sich über Malware nicht wundern, vor allem, wenn er nicht mal windows updatet. So was kann leicht mal teuer werden.
Entweder, wenn man beim Onlinebanking beklaut wird, mit seinen Daten missbrauch betrieben wird, oder, wenn man einfach nur beim schauen illegaler Streams / Filme erwischt wird, das kann gut und gern einige tausend € kosten.
Aufpassen sollte man auch bei angeboten mit pornografischem Inhalt.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

JulianK. 13.12.2012 20:38
OTL.txt:OTL Logfile:
Code:
OTL logfile created on: 13.12.2012 20:21:06 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Juli\Desktop
 Professional  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,14 Gb Available Physical Memory | 57,10% Memory free
4,00 Gb Paging File | 2,92 Gb Available in Paging File | 73,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,95 Gb Total Space | 68,39 Gb Free Space | 45,92% Space Free | Partition Type: NTFS
 
Computer Name: JULI-PC | User Name: Juli | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.12.13 20:11:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Juli\Desktop\OTL.exe
PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.09.29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.09.02 12:21:22 | 001,890,744 | ---- | M] (Bandoo Media, inc) -- C:\Programme\Searchqu Toolbar\Datamngr\datamngrUI.exe
PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2011.04.13 14:02:34 | 001,808,784 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft IntelliPoint\ipoint.exe
PRC - [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE
PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe
PRC - [2010.10.06 21:28:12 | 003,768,176 | ---- | M] (Stardock) -- C:\Programme\Stardock\ObjectDockFree\ObjectDock.exe
PRC - [2010.09.21 13:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2010.09.21 13:03:14 | 000,193,408 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe
PRC - [2010.03.04 22:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe
PRC - [2010.01.15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe
PRC - [2009.11.05 21:45:55 | 001,505,144 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft IntelliType Pro\itype.exe
PRC - [2009.11.05 21:45:55 | 000,444,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft IntelliType Pro\dpupdchk.exe
PRC - [2009.10.20 03:18:00 | 000,360,448 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2009.10.20 03:17:30 | 000,172,032 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2009.09.28 11:48:08 | 000,264,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeChat\LifeChat.exe
PRC - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2009.04.15 22:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe
PRC - [2009.02.26 14:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE
PRC - [2006.06.23 11:24:12 | 000,343,552 | ---- | M] (AVM Berlin GmbH) -- C:\Programme\avmwlanstick\FRITZWLanMini.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.02.16 22:13:28 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\2df79ab909c782d3796e4107d040327d\System.Web.ni.dll
MOD - [2012.02.16 22:13:23 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0a894f77b9aa64acbd3ce791916357d8\System.Runtime.Remoting.ni.dll
MOD - [2012.02.16 22:13:09 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll
MOD - [2012.02.16 22:13:03 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll
MOD - [2012.02.16 22:13:00 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll
MOD - [2012.02.16 22:12:57 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll
MOD - [2012.02.16 22:12:54 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll
MOD - [2011.10.13 14:39:20 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll
MOD - [2011.07.18 22:04:08 | 000,296,448 | ---- | M] () -- C:\Programme\Notepad++\NppShell_04.dll
MOD - [2011.05.28 21:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
MOD - [2010.10.04 18:54:31 | 000,053,760 | ---- | M] () -- C:\Programme\Stardock\ObjectDockFree\zlib.dll
MOD - [2010.10.04 18:54:29 | 000,807,936 | ---- | M] () -- C:\Programme\Stardock\ObjectDockFree\CrashRpt.dll
MOD - [2010.10.04 18:54:29 | 000,675,840 | ---- | M] () -- C:\Programme\Stardock\ObjectDockFree\DockShellHook.dll
MOD - [2010.10.04 18:54:22 | 000,094,208 | ---- | M] () -- C:\Programme\Stardock\ObjectDockFree\Docklets\Clock\Clock.dll
MOD - [2010.07.07 16:31:29 | 000,241,664 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiDesk.HydraVision.Dashboard\2.0.3579.36914__90ba9c70f846762e\CLI.Aspect.MultiDesk.HydraVision.Dashboard.dll
MOD - [2010.07.07 16:31:29 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MDProp.HydraVision.Dashboard\2.0.3579.36913__90ba9c70f846762e\CLI.Aspect.MDProp.HydraVision.Dashboard.dll
MOD - [2010.07.07 16:31:29 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiDesk.HydraVision.Runtime\2.0.3579.36914__90ba9c70f846762e\CLI.Aspect.MultiDesk.HydraVision.Runtime.dll
MOD - [2010.07.07 16:31:29 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MDProp.HydraVision.Runtime\2.0.3579.36913__90ba9c70f846762e\CLI.Aspect.MDProp.HydraVision.Runtime.dll
MOD - [2010.07.07 16:31:29 | 000,012,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeskMan.HydraVision.Shared\2.0.3579.36912__90ba9c70f846762e\CLI.Aspect.DeskMan.HydraVision.Shared.dll
MOD - [2010.07.07 16:31:29 | 000,010,240 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MDProp.HydraVision.Shared\2.0.3579.36913__90ba9c70f846762e\CLI.Aspect.MDProp.HydraVision.Shared.dll
MOD - [2010.07.07 16:31:29 | 000,009,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiDesk.HydraVision.Shared\2.0.3579.36914__90ba9c70f846762e\CLI.Aspect.MultiDesk.HydraVision.Shared.dll
MOD - [2010.07.07 16:31:28 | 001,695,744 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Wizard\2.0.3579.36926__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll
MOD - [2010.07.07 16:31:28 | 000,823,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3579.36850__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:28 | 000,643,072 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3579.36906__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:28 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3579.36895__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll
MOD - [2010.07.07 16:31:28 | 000,409,600 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3579.36871__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll
MOD - [2010.07.07 16:31:28 | 000,368,640 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3579.36805__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,356,352 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3579.36862__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:28 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HydraVision.Wizard\2.0.3579.36915__90ba9c70f846762e\CLI.Aspect.HydraVision.Wizard.dll
MOD - [2010.07.07 16:31:28 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3579.36824__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll
MOD - [2010.07.07 16:31:28 | 000,163,840 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeskMan.HydraVision.Dashboard\2.0.3579.36913__90ba9c70f846762e\CLI.Aspect.DeskMan.HydraVision.Dashboard.dll
MOD - [2010.07.07 16:31:28 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Grid.HydraVision.Dashboard\2.0.3579.36908__90ba9c70f846762e\CLI.Aspect.Grid.HydraVision.Dashboard.dll
MOD - [2010.07.07 16:31:28 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3579.36863__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll
MOD - [2010.07.07 16:31:28 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3579.36906__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3579.36876__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3579.36813__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:28 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3579.36862__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3579.36857__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3579.36896__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:28 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3579.36848__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3579.36819__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll
MOD - [2010.07.07 16:31:28 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Grid.HydraVision.Runtime\2.0.3579.36909__90ba9c70f846762e\CLI.Aspect.Grid.HydraVision.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeskMan.HydraVision.Runtime\2.0.3579.36912__90ba9c70f846762e\CLI.Aspect.DeskMan.HydraVision.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3579.36814__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,011,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.3579.36908__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll
MOD - [2010.07.07 16:31:28 | 000,010,240 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Grid.HydraVision.Shared\2.0.3579.36908__90ba9c70f846762e\CLI.Aspect.Grid.HydraVision.Shared.dll
MOD - [2010.07.07 16:31:28 | 000,008,704 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.3579.36907__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll
MOD - [2010.07.07 16:31:28 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Wizard\2.0.3579.36912__90ba9c70f846762e\CLI.Caste.HydraVision.Wizard.dll
MOD - [2010.07.07 16:31:28 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Dashboard\2.0.3579.36908__90ba9c70f846762e\CLI.Caste.HydraVision.Dashboard.dll
MOD - [2010.07.07 16:31:27 | 001,138,688 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3579.36922__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:27 | 000,573,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3579.36825__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:27 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3579.36849__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:27 | 000,368,640 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3579.36844__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:27 | 000,270,336 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:27 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3579.36825__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:27 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3574.20469__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3574.20459__90ba9c70f846762e\CLI.Foundation.dll
MOD - [2010.07.07 16:31:27 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3579.36849__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:27 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3579.36855__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll
MOD - [2010.07.07 16:31:27 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3574.20535__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3574.20569__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3574.20496__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3579.36848__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:27 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3574.20534__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll
MOD - [2010.07.07 16:31:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3574.20557__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3579.36855__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3579.36829__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3579.36849__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:27 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3579.36856__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll
MOD - [2010.07.07 16:31:27 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3574.20454__90ba9c70f846762e\LOG.Foundation.dll
MOD - [2010.07.07 16:31:27 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3574.20457__90ba9c70f846762e\NEWAEM.Foundation.dll
MOD - [2010.07.07 16:31:27 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3574.20638__90ba9c70f846762e\CLI.Foundation.XManifest.dll
MOD - [2010.07.07 16:31:27 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3574.20529__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3574.20492__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3574.20532__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll
MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3574.20491__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3574.20472__90ba9c70f846762e\CLI.Component.Client.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3574.20506__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3574.20483__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3574.20475__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3574.20501__90ba9c70f846762e\MOM.Foundation.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3574.20524__90ba9c70f846762e\DEM.Graphics.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3574.20485__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3574.20528__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3574.20495__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3574.20511__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3574.20570__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3574.20566__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3574.20505__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3574.20565__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll
MOD - [2010.07.07 16:31:27 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll
MOD - [2010.07.07 16:31:26 | 001,220,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3579.36809__90ba9c70f846762e\CLI.Component.Dashboard.dll
MOD - [2010.07.07 16:31:26 | 000,651,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3579.36920__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll
MOD - [2010.07.07 16:31:26 | 000,565,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3579.36885__90ba9c70f846762e\CLI.Component.Systemtray.dll
MOD - [2010.07.07 16:31:26 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3579.36819__90ba9c70f846762e\CLI.Component.Wizard.dll
MOD - [2010.07.07 16:31:26 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3579.36890__90ba9c70f846762e\MOM.Implementation.dll
MOD - [2010.07.07 16:31:26 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3579.36889__90ba9c70f846762e\LOG.Foundation.Implementation.dll
MOD - [2010.07.07 16:31:26 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3579.36801__90ba9c70f846762e\APM.Server.dll
MOD - [2010.07.07 16:31:26 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3579.36804__90ba9c70f846762e\CLI.Component.SkinFactory.dll
MOD - [2010.07.07 16:31:26 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3579.36802__90ba9c70f846762e\CLI.Component.Runtime.dll
MOD - [2010.07.07 16:31:26 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3574.20530__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll
MOD - [2010.07.07 16:31:26 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3574.20502__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll
MOD - [2010.07.07 16:31:26 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3574.20509__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll
MOD - [2010.07.07 16:31:26 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3579.36802__90ba9c70f846762e\AEM.Server.dll
MOD - [2010.07.07 16:31:26 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3579.36901__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll
MOD - [2010.07.07 16:31:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3574.20476__90ba9c70f846762e\CLI.Foundation.Private.dll
MOD - [2010.07.07 16:31:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3574.20487__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll
MOD - [2010.07.07 16:31:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3574.20489__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll
MOD - [2010.07.07 16:31:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3574.20496__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll
MOD - [2010.07.07 16:31:26 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3574.20464__90ba9c70f846762e\LOG.Foundation.Private.dll
MOD - [2010.07.07 16:31:26 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll
MOD - [2010.07.07 16:31:26 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3574.20525__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll
MOD - [2010.07.07 16:31:26 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3574.20482__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll
MOD - [2010.07.07 16:31:26 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3574.20498__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll
MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3574.20480__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll
MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3574.20494__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll
MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3574.20499__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll
MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3574.20537__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll
MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3574.20504__90ba9c70f846762e\APM.Foundation.dll
MOD - [2010.07.07 16:31:26 | 000,019,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3579.36890__90ba9c70f846762e\CCC.Implementation.dll
MOD - [2010.07.07 16:31:26 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3574.20484__90ba9c70f846762e\AEM.Server.Shared.dll
MOD - [2010.07.07 16:31:26 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3579.36802__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll
MOD - [2010.06.03 12:46:00 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2009.10.01 15:45:50 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll
MOD - [2009.07.14 09:47:13 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll
MOD - [2009.07.14 09:47:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
 
 
========== Services (SafeList) ==========
 
SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.09.25 15:22:17 | 001,737,728 | ---- | M] (Lavasoft Limited                                                  ) [On_Demand | Stopped] -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.03.09 15:38:14 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2012.02.29 07:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv)
SRV - [2011.02.28 17:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc)
SRV - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (SeaPort)
SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service)
SRV - [2010.09.22 23:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2010.09.22 15:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV - [2010.09.21 13:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc)
SRV - [2010.03.04 22:38:00 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess)
SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService)
SRV - [2009.10.20 03:17:30 | 000,172,032 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2006.10.26 13:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\npf.sys -- (NPF)
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT)
DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\bcmwlhigh6.sys -- (BCMH43XX)
DRV - [2012.09.29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector)
DRV - [2011.08.04 11:45:08 | 000,015,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer)
DRV - [2011.05.18 08:09:04 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d)
DRV - [2010.07.06 18:28:45 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\System32\drivers\Lbd.sys -- (Lbd)
DRV - [2010.05.20 15:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo)
DRV - [2009.11.12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen)
DRV - [2009.10.20 03:49:30 | 005,089,280 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag)
DRV - [2009.09.30 15:33:56 | 000,104,976 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService)
DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2009.07.14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2009.07.13 23:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD)
DRV - [2006.04.06 01:00:00 | 000,264,704 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2004.08.13 08:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=362&systemid=406&sr=0&q={searchTerms}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/406
IE - HKCU\..\URLSearchHook:  - No CLSID value found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=362&systemid=406&sr=0&q={searchTerms}
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search Results"
FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search Results"
FF - prefs.js..browser.search.selectedEngine: "Search Results"
FF - prefs.js..browser.startup.homepage: "hxxp://www.searchnu.com/406"
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9
FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.5.2
FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:6.3.0.11079
FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0
FF - prefs.js..extensions.enabledItems: {99079a25-328f-4bd4-be04-00955acaa0a7}:4.6.1.01
FF - prefs.js..extensions.enabledItems: {EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}:2.0
FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=362&systemid=406&sr=0&q="
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Juli\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Juli\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Juli\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.05.22 13:51:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.18 13:39:11 | 000,000,000 | ---D | M]
 
[2012.09.09 14:52:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Juli\AppData\Roaming\mozilla\Extensions
[2012.12.13 17:45:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions
[2011.10.25 13:25:30 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.09.09 14:52:13 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7}
[2010.10.02 16:30:18 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.03.13 20:01:45 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065}
[2011.10.18 12:51:07 | 000,000,000 | ---D | M] (DealPly) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}
[2011.03.13 20:01:45 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\engine@conduit.com
[2012.12.13 17:45:19 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\plugin@yontoo.com
[2010.12.08 15:47:52 | 000,000,927 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\conduit.xml
[2012.11.22 12:35:08 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-1.xml
[2011.10.02 18:55:01 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-10.xml
[2011.10.08 18:48:35 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-11.xml
[2011.10.17 21:10:06 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-12.xml
[2011.12.26 20:47:20 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-13.xml
[2012.02.11 11:56:51 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-14.xml
[2012.02.26 14:55:41 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-15.xml
[2012.03.29 18:58:46 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-16.xml
[2012.09.14 15:56:08 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-17.xml
[2011.02.23 16:47:14 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-2.xml
[2011.02.25 13:05:20 | 000,000,656 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-3.xml
[2011.03.14 15:41:39 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-4.xml
[2011.03.28 17:04:32 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-5.xml
[2011.04.01 16:12:48 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-6.xml
[2011.05.06 19:34:58 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-7.xml
[2011.06.29 15:38:41 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-8.xml
[2011.08.22 14:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-9.xml
[2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin.xml
[2011.10.17 21:08:53 | 000,002,520 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\SearchResults.xml
[2012.09.09 14:52:07 | 000,002,519 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\Search_Results.xml
[2012.11.22 12:35:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2012.10.31 10:50:22 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2011.02.23 10:10:53 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\talkback@mozilla.org
[2012.10.31 10:50:22 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.09.09 14:52:17 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION
[2011.10.02 18:54:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011.10.02 18:54:49 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2011.10.02 18:54:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2011.10.17 21:08:53 | 000,002,520 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml
[2012.09.09 14:52:07 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml
[2011.10.02 18:54:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2011.10.02 18:54:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.searchnu.com/406
CHR - default_search_provider: Search Results ()
CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&appid=362&systemid=406&sr=0&q={searchTerms}
CHR - default_search_provider: suggest_url =
CHR - homepage: hxxp://www.searchnu.com/406
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Juli\AppData\Local\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Juli\AppData\Local\Google\Chrome\Application\23.0.1271.64\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Juli\AppData\Local\Google\Chrome\Application\23.0.1271.64\gcswf32.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll
CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll
CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll
CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll
CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll
CHR - plugin: Java(TM) Platform SE 7 U2 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll
CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Juli\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll
CHR - plugin: Default Plug-in (Enabled) = default_plugin
CHR - Extension: YouTube = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: YouTube = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: Google-Suche = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google-Suche = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: DealPly = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje\3.0.7.2_0\
CHR - Extension: Skype Click to Call = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\
CHR - Extension: Google Mail = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
CHR - Extension: Google Mail = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
 
O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc)
O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Programme\DealPly\DealPlyIE.dll (DealPly Technologies Ltd)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programme\Yontoo\YontooIEClient.dll (Yontoo LLC)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll ()
O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.)
O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLanMini.exe (AVM Berlin GmbH)
O4 - HKLM..\Run: [DATAMNGR] C:\Programme\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc)
O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation)
O4 - HKLM..\Run: [LifeChat] C:\Program Files\Microsoft LifeChat\LifeChat.exe (Microsoft Corporation)
O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKCU..\Run: [DriverFinder] C:\Program Files\DriverFinder\DriverFinder.exe File not found
O4 - HKCU..\Run: [Facebook Update] C:\Users\Juli\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 File not found
O4 - HKCU..\Run: [Spotify] C:\Users\Juli\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd)
O4 - HKCU..\Run: [Video Performer63615.exe] C:\Users\Juli\AppData\Local\Temp\Video Performer63615.exe ()
O4 - Startup: C:\Users\Juli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)
O4 - Startup: C:\Users\Juli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Programme\Stardock\ObjectDockFree\ObjectDock.exe (Stardock)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Juli\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation)
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0)
O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4051BE0-0BEB-4BB0-A78B-3674CAE4463F}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F77253D4-B622-48D6-8073-A50984E4CB6B}: DhcpNameServer = 192.168.2.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~2\Datamngr\datamngr.dll) - C:\Programme\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc)
O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~2\Datamngr\IEBHO.dll) - C:\Programme\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O22 - SharedTaskScheduler: {1984D045-52CF-49cd-DB77-08F378FEA4DB} - ObjectDockShellExt - C:\Programme\Stardock\ObjectDockFree\ODMenu.dll (Stardock)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{a00bc207-89d6-11df-a1fa-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{a00bc207-89d6-11df-a1fa-806e6f6e6963}\Shell\AutoRun\command - "" = "D:\Diablo III Setup.exe"
O33 - MountPoints2\{cddca44c-34a9-11e1-af13-485b39a96ddd}\Shell - "" = AutoRun
O33 - MountPoints2\{cddca44c-34a9-11e1-af13-485b39a96ddd}\Shell\AutoRun\command - "" = F:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (lsdelete)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.12.13 20:11:33 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Juli\Desktop\OTL.exe
[2012.12.13 17:45:57 | 000,000,000 | ---D | C] -- C:\Users\Juli\AppData\Roaming\PerformerSoft
[2012.12.13 17:45:06 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo
[2012.12.13 17:45:04 | 000,017,464 | ---- | C] (PerformerSoft LLC) -- C:\Windows\System32\roboot.exe
[2012.12.13 17:44:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2012.12.13 17:43:56 | 000,000,000 | ---D | C] -- C:\Program Files\File Scout
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.12.13 20:14:02 | 000,003,758 | ---- | M] () -- C:\Users\Juli\Desktop\otlfix.jpg
[2012.12.13 20:11:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Juli\Desktop\OTL.exe
[2012.12.13 19:47:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000UA.job
[2012.12.13 19:08:01 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000UA.job
[2012.12.13 19:01:22 | 000,015,152 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.12.13 19:01:22 | 000,015,152 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.12.13 18:54:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.12.13 18:53:58 | 1610,051,584 | -HS- | M] () -- C:\hiberfil.sys
[2012.12.13 18:08:29 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012.12.12 22:08:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000Core.job
[2012.12.12 21:49:28 | 000,002,477 | ---- | M] () -- C:\Users\Juli\Desktop\Google Chrome.lnk
[2012.12.12 21:47:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000Core.job
[2012.12.07 16:20:23 | 000,000,064 | ---- | M] () -- C:\Windows\System32\rp_stats.dat
[2012.12.07 16:20:23 | 000,000,044 | ---- | M] () -- C:\Windows\System32\rp_rules.dat
[2012.12.07 11:49:26 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.12.07 11:49:26 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.12.07 11:49:26 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.12.07 11:49:26 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.12.02 20:58:10 | 000,382,792 | ---- | M] () -- C:\Users\Juli\Desktop\Präventionen für Sportverletzungen.odp
[2012.12.02 20:24:20 | 000,539,665 | ---- | M] () -- C:\Users\Juli\Desktop\Scan0012.jpg
[1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.12.13 20:14:04 | 000,003,758 | ---- | C] () -- C:\Users\Juli\Desktop\otlfix.jpg
[2012.12.02 20:57:48 | 000,382,792 | ---- | C] () -- C:\Users\Juli\Desktop\Präventionen für Sportverletzungen.odp
[2012.12.02 20:23:58 | 000,539,665 | ---- | C] () -- C:\Users\Juli\Desktop\Scan0012.jpg
[2012.10.29 21:09:53 | 000,003,584 | ---- | C] () -- C:\Users\Juli\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.01.01 22:41:03 | 000,138,160 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2012.01.01 22:41:00 | 000,271,200 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2012.01.01 22:40:34 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2012.01.01 21:20:22 | 000,097,312 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
[2011.10.26 15:08:34 | 000,150,996 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT
[2011.08.05 11:27:58 | 000,016,432 | ---- | C] () -- C:\Windows\System32\lsdelete.exe
[2011.08.04 11:45:50 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat
[2011.08.04 11:45:50 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat
[2011.05.18 13:48:29 | 000,037,153 | ---- | C] () -- C:\Users\Juli\energy-report.html
[2011.04.08 14:04:20 | 000,100,600 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2011.03.30 13:33:55 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.01.04 10:03:45 | 012,868,096 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2012.04.10 00:52:28 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Ad-Aware Antivirus
[2010.07.07 17:53:53 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Canneverbe Limited
[2011.04.18 11:58:32 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\DriverFinder
[2012.03.11 21:41:26 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\DVDVideoSoft
[2012.03.11 21:41:13 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.22 16:16:16 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\ICQ
[2010.07.14 17:12:01 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\LolClient
[2012.05.24 20:28:12 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\LolClient2
[2012.08.06 14:00:54 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Notepad++
[2012.12.13 17:59:09 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\PerformerSoft
[2012.12.13 19:46:02 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Spotify
[2011.05.06 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Stardock
[2011.10.18 19:56:51 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\TeamViewer
[2012.08.06 15:39:14 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Teeworlds
[2012.10.03 18:21:57 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Windows Live Writer
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2010.07.07 16:11:06 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2010.07.07 16:10:56 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2011.12.05 15:52:34 | 000,000,000 | ---D | M] -- C:\Fraps
[2010.07.11 16:27:19 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2012.12.13 19:47:09 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.12.13 20:05:02 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010.07.07 16:10:56 | 000,000,000 | -HSD | M] -- C:\Programme
[2010.07.07 16:10:56 | 000,000,000 | -HSD | M] -- C:\Recovery
[2011.03.23 17:10:37 | 000,000,000 | ---D | M] -- C:\Riot Games
[2012.12.13 20:22:38 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2010.07.07 16:11:01 | 000,000,000 | R--D | M] -- C:\Users
[2012.12.13 18:53:58 | 000,000,000 | ---D | M] -- C:\Windows
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< C:\Windows\system32\*.tsp >
[2009.07.14 02:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp
[2009.07.14 02:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp
[2009.07.14 02:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp
[2009.07.14 02:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp
[2009.07.14 02:14:11 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
[2009.07.14 05:53:46 | 000,032,640 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2009.07.14 05:53:47 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2011.05.08 14:02:54 | 000,001,064 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000Core.job
[2011.05.08 14:02:54 | 000,001,116 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000UA.job
[2012.11.01 22:03:18 | 000,000,902 | ---- | C] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000Core.job
[2012.11.01 22:03:19 | 000,000,924 | ---- | C] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000UA.job
 
< MD5 for: AGP440.SYS  >
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe
[2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe
[2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe
[2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\explorer.exe
[2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe
[2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
[2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe
[2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe
[2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe
[2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe
 
< MD5 for: IASTORV.SYS  >
[2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys
[2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys
[2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll
[2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys
[2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys
[2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll
[2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll
[2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe
[2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe
[2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2012.09.29 19:54:26 | 000,218,184 | ---- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
[2009.10.20 03:18:28 | 000,446,464 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\system32\ATIDEMGX.dll
[2012.02.18 20:29:49 | 000,118,784 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\iepeers.dll
[1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]
 
< %USERPROFILE%\*.* >
[2011.05.18 13:48:29 | 000,037,153 | ---- | M] () -- C:\Users\Juli\energy-report.html
[2012.12.13 20:31:11 | 002,883,584 | -HS- | M] () -- C:\Users\Juli\ntuser.dat
[2012.12.13 20:31:11 | 000,262,144 | -HS- | M] () -- C:\Users\Juli\ntuser.dat.LOG1
[2010.07.07 16:11:01 | 000,000,000 | -HS- | M] () -- C:\Users\Juli\ntuser.dat.LOG2
[2011.02.15 17:22:49 | 000,065,536 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{1def9879-3916-11e0-b7c7-485b39a96ddd}.TM.blf
[2011.02.15 17:22:49 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{1def9879-3916-11e0-b7c7-485b39a96ddd}.TMContainer00000000000000000001.regtrans-ms
[2011.02.15 17:22:49 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{1def9879-3916-11e0-b7c7-485b39a96ddd}.TMContainer00000000000000000002.regtrans-ms
[2010.07.07 16:33:33 | 000,065,536 | -HS- | M] () -- C:\Users\Juli\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2010.07.07 16:33:33 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2010.07.07 16:33:33 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2011.02.19 12:41:49 | 000,065,536 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{9eb43cd9-3c19-11e0-9cbe-485b39a96ddd}.TM.blf
[2011.02.19 12:41:49 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{9eb43cd9-3c19-11e0-9cbe-485b39a96ddd}.TMContainer00000000000000000001.regtrans-ms
[2011.02.19 12:41:49 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{9eb43cd9-3c19-11e0-9cbe-485b39a96ddd}.TMContainer00000000000000000002.regtrans-ms
[2011.02.14 16:26:06 | 000,065,536 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{be784bbc-3840-11e0-9371-485b39a96ddd}.TM.blf
[2011.02.14 16:26:06 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{be784bbc-3840-11e0-9371-485b39a96ddd}.TMContainer00000000000000000001.regtrans-ms
[2011.02.14 16:26:06 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{be784bbc-3840-11e0-9371-485b39a96ddd}.TMContainer00000000000000000002.regtrans-ms
[2010.07.07 16:11:01 | 000,000,020 | -HS- | M] () -- C:\Users\Juli\ntuser.ini
 
< %USERPROFILE%\Local Settings\Temp\*.exe >
 
< %USERPROFILE%\Local Settings\Temp\*.dll >
 
< %USERPROFILE%\Application Data\*.exe >
 
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16

< End of report >
--- --- ---

JulianK. 13.12.2012 20:39
Extra.txt:


Extra.txt:OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 13.12.2012 20:21:06 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = C:\Users\Juli\Desktop
 Professional  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2,00 Gb Total Physical Memory | 1,14 Gb Available Physical Memory | 57,10% Memory free
4,00 Gb Paging File | 2,92 Gb Available in Paging File | 73,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,95 Gb Total Space | 68,39 Gb Free Space | 45,92% Space Free | Partition Type: NTFS
 
Computer Name: JULI-PC | User Name: Juli | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromiumHTML] -- Reg Error: Key error. File not found
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- "C:\Program Files\File Scout\filescout.exe" /open "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallDisableNotify" = 0
"FirewallOverride" = 1
"UpdatesDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0007633D-1A44-4183-A1DF-93373B91821A}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{02D35978-DC78-4C31-A23D-78C83F854328}" = rport=10243 | protocol=6 | dir=out | app=system |
"{05BE383F-B5EF-416E-961F-0EF8E6ED7968}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{09BF7534-E102-4413-B986-26BDBD613992}" = lport=6957 | protocol=6 | dir=in | name=league of legends launcher |
"{0AF83C3E-E9BF-481E-972D-336A237BB5F8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0CE876DC-7A46-4FB5-81A1-85448E68452A}" = lport=58733 | protocol=17 | dir=in | name=pando media booster |
"{0D9061FF-489C-455A-A0D9-756A5B1FBF4C}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client |
"{0E33750E-D5ED-47A7-997D-D41CC84132E1}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby |
"{0F3B0277-ED5E-492F-B981-D6158AA24968}" = lport=6962 | protocol=17 | dir=in | name=league of legends launcher |
"{132C1743-A9B2-4BEE-8C87-D8EE28C3191C}" = lport=6909 | protocol=6 | dir=in | name=league of legends launcher |
"{1E302115-A555-4B5C-8E89-A087F518EE75}" = lport=6981 | protocol=6 | dir=in | name=league of legends launcher |
"{1EEA2316-1AE2-4D07-B19E-95FA0E91D439}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher |
"{221D9152-7D94-4460-9777-CD53EDF852C5}" = lport=6982 | protocol=17 | dir=in | name=league of legends launcher |
"{23379463-8EBC-4EB9-BDEB-173199B17718}" = lport=8398 | protocol=17 | dir=in | name=league of legends launcher |
"{276B5604-C8CE-46EE-BCDC-F8559E6C5019}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{27939A87-2491-4D31-89B9-CD2DF7BEFC35}" = lport=6897 | protocol=17 | dir=in | name=league of legends launcher |
"{291468E4-EDC1-4C1E-A811-3D56CD6154B9}" = lport=137 | protocol=17 | dir=in | app=system |
"{30F50554-D354-4B5B-A00B-36AA8CFDB8BA}" = rport=139 | protocol=6 | dir=out | app=system |
"{31995171-9E9C-4525-9B7F-FF5AD4E09EB7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{34033F15-55FB-44D9-83C3-5713D7627B4E}" = lport=6900 | protocol=17 | dir=in | name=league of legends launcher |
"{3633D287-6354-4D91-9A37-5B4916368613}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{382D24E9-D162-4E8D-AEAF-850A6CA96CCF}" = lport=6913 | protocol=6 | dir=in | name=league of legends launcher |
"{3EBCAD7C-99C2-4BC3-A0A8-F86BB9C6929F}" = lport=138 | protocol=17 | dir=in | app=system |
"{4138D379-BE1B-400A-B908-4657A75E79B3}" = lport=57682 | protocol=17 | dir=in | name=pando media booster |
"{416C18EB-0A03-4D3C-B8AF-FC7A91CA77B8}" = lport=6910 | protocol=17 | dir=in | name=league of legends launcher |
"{41B313CD-13FA-4356-93C4-CD0DC4C9CAD9}" = lport=6982 | protocol=6 | dir=in | name=league of legends launcher |
"{41E89051-D054-43FE-BA5D-C6EB110EFAF2}" = lport=6974 | protocol=6 | dir=in | name=league of legends launcher |
"{42297800-81D4-43F3-B7EE-6529FB2441EF}" = lport=58994 | protocol=6 | dir=in | name=pando media booster |
"{44D03B70-5432-4405-87BF-C3B80F685A43}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{45F05930-9690-4F8B-AD23-790E518D4A33}" = lport=6900 | protocol=6 | dir=in | name=league of legends launcher |
"{4DC81FAE-3602-4CFC-8D52-68464EC0F87D}" = lport=8397 | protocol=6 | dir=in | name=league of legends launcher |
"{4DF8EFAA-573C-4895-B2EB-255158B1152D}" = rport=137 | protocol=17 | dir=out | app=system |
"{4F81B8D2-1D62-4B8D-916C-7A7BA1EC66CB}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher |
"{563E44FA-6BAB-43CB-8770-6A2D0BFCA7A9}" = lport=8398 | protocol=6 | dir=in | name=league of legends launcher |
"{616FF4CD-17A5-46CA-86DE-4FADB109E70A}" = lport=6957 | protocol=17 | dir=in | name=league of legends launcher |
"{62F33DAA-7A75-4141-9091-90A5B643229B}" = lport=57682 | protocol=6 | dir=in | name=pando media booster |
"{63FEA214-126B-481D-A4F3-EEA60F430A03}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{68DB6C8F-2C46-4C07-9A44-8F3BE3DBC32B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6A318DE9-BEE1-495D-80B5-A36A810B92E1}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby |
"{6CBEB9CE-1172-41AA-AAF4-86582FADA49F}" = lport=6919 | protocol=17 | dir=in | name=league of legends launcher |
"{6F3B3B82-E681-4FE7-A81C-296CB0ED6179}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{6F810CB5-7E97-4568-9F0B-83780EEAAB11}" = lport=139 | protocol=6 | dir=in | app=system |
"{7501E91C-CFD4-4BDF-A058-922193CB7CD1}" = lport=6928 | protocol=17 | dir=in | name=league of legends launcher |
"{7807D179-693E-4369-A43C-B98A363F154A}" = lport=6910 | protocol=6 | dir=in | name=league of legends launcher |
"{786194ED-1362-460D-A2FE-8F232118E5D2}" = lport=6909 | protocol=17 | dir=in | name=league of legends launcher |
"{788B08FD-C190-4B23-BEE0-63D4BDA14B73}" = lport=58733 | protocol=6 | dir=in | name=pando media booster |
"{78BF0405-AA78-4209-85BD-6EA204644426}" = lport=57682 | protocol=6 | dir=in | name=pando media booster |
"{797B1F13-18B3-4899-AD96-A8A5FDA92425}" = lport=6913 | protocol=17 | dir=in | name=league of legends launcher |
"{7BE22AF6-4928-42FF-936E-4CDF01E3A30A}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher |
"{7CF45026-A245-42A7-BB3E-BF7A7EE975B6}" = lport=6926 | protocol=17 | dir=in | name=league of legends launcher |
"{801EDCB7-F0DC-4E4F-95C0-E0EB9EA564CF}" = rport=445 | protocol=6 | dir=out | app=system |
"{810C5C9B-2899-4D4E-9264-EC2622002C34}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher |
"{82B381DE-74B8-47D1-A2C8-EAB43224908B}" = lport=8303 | protocol=17 | dir=in | name=elite blocker2 |
"{893CD072-233A-4BFD-9CED-3091CE7AFE74}" = lport=6926 | protocol=6 | dir=in | name=league of legends launcher |
"{894CD151-7247-4698-9420-E7274C7D3A74}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{898462BE-3A1F-4CEE-BCE1-D4947CC0C09C}" = lport=6884 | protocol=17 | dir=in | name=league of legends launcher |
"{8A4F9C78-DAB9-4CAD-BFEB-52002AC7F8F6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8D74E92C-952E-4E9F-B0B9-628DAE1CC872}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8EA8C0F0-3B00-4ECF-8452-3A1B3B140B77}" = rport=8303 | protocol=17 | dir=out | name=elite blocker2 |
"{8EE55384-E6B1-4E71-A398-573E5629F2DE}" = lport=57682 | protocol=17 | dir=in | name=pando media booster |
"{8F2B77B8-D4C9-4110-A6B3-B790A5EEC29A}" = lport=6884 | protocol=6 | dir=in | name=league of legends launcher |
"{8F715028-A31D-4BDB-BFE1-5687453EC185}" = lport=10243 | protocol=6 | dir=in | app=system |
"{90E7CC3C-4B4B-49E3-83A5-3A0B079985CA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A029ECE6-4028-4612-BBCA-626A166EE7F8}" = lport=58994 | protocol=17 | dir=in | name=pando media booster |
"{A1843C0F-9243-480B-B363-205E69DE8A27}" = rport=138 | protocol=17 | dir=out | app=system |
"{A33024D7-61B6-4FCD-9193-05D173167E43}" = lport=58994 | protocol=17 | dir=in | name=pando media booster |
"{A535DE85-B786-454F-9A6B-78C8F731C440}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{B1AC1A48-062F-45B5-BB12-5BB607EB3111}" = lport=58994 | protocol=6 | dir=in | name=pando media booster |
"{B52D390D-3B5F-4A2C-846E-57A2A2B62BCB}" = lport=6962 | protocol=6 | dir=in | name=league of legends launcher |
"{B5319170-E846-4AEA-A48C-346E820B9EAD}" = lport=6981 | protocol=17 | dir=in | name=league of legends launcher |
"{B949A0A3-BA0D-4CDD-98E6-BD1CBE91AFB9}" = lport=6919 | protocol=6 | dir=in | name=league of legends launcher |
"{BAC4803D-61DB-4812-9C03-268B338BD726}" = rport=8303 | protocol=6 | dir=out | name=elite blocker |
"{BBDAACA3-DD5F-41F4-A309-CC3B5C6D3EBC}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{BC8C9DEC-A1B3-44E6-A3C8-F954E66C0E5C}" = lport=8397 | protocol=17 | dir=in | name=league of legends launcher |
"{BD605D56-8AD3-40A3-81FB-CC6BB311789D}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher |
"{C1B97C15-8078-4C4D-A8C6-336FCA540EE5}" = lport=6974 | protocol=17 | dir=in | name=league of legends launcher |
"{C63A01BC-32C1-448A-BA68-162710284768}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D35B68AC-4593-44A9-B2FC-32A77CAE8EF9}" = lport=6897 | protocol=6 | dir=in | name=league of legends launcher |
"{D5AC0420-D596-4025-B7C3-A270EDC78358}" = lport=6883 | protocol=17 | dir=in | name=league of legends launcher |
"{D71BC3B9-AAD7-4AA4-A46A-7F89E4870830}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D71E764F-01B7-4252-AEAC-94F6A66F7D43}" = lport=58733 | protocol=6 | dir=in | name=pando media booster |
"{D7A76BF2-996C-4347-A45B-7AF100DF639B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DAC5EB64-CC5E-4D17-8851-D5010AD6E3B1}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client |
"{E30ED459-3C02-46B4-ABCF-6BB2A799D8D5}" = lport=445 | protocol=6 | dir=in | app=system |
"{E65FF183-75FC-4360-B4C4-9A22CFA3D893}" = lport=58733 | protocol=17 | dir=in | name=pando media booster |
"{E931DB36-409C-423D-B3C1-FB824074C2B4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E9E65677-4B93-4BAA-B487-45A16F6DFCD1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EA7BE8FF-9E4D-42DC-8AE1-E4AFA08B66E8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EC6AA8F7-478E-4302-9A39-C17536A4BF1D}" = lport=8303 | protocol=6 | dir=in | name=elite blocker |
"{ECE45DB9-F0A9-484B-AB6E-12E6FBC8BC88}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher |
"{EF6DF789-1CC9-42B3-9B56-54D4DA0FE66A}" = lport=6928 | protocol=6 | dir=in | name=league of legends launcher |
"{F523E788-E245-413A-A1B4-52C14C53FCE2}" = lport=6883 | protocol=6 | dir=in | name=league of legends launcher |
"{F802AA55-5E8D-40A4-9E2F-7E3A6EA4DE3F}" = lport=2869 | protocol=6 | dir=in | app=system |
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06EF281B-0109-48F7-A214-F70105B1EBC4}" = protocol=6 | dir=in | app=c:\program files\gameforge4d\elsword_de\data\x2.exe |
"{0D6134D3-A335-432D-96A8-EB251917884A}" = protocol=17 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe |
"{0FB77932-289F-4965-91FA-BD5A6C97755C}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{12521BF1-BFE3-4311-8714-AD89A36C3D08}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"{1368F58F-1660-4A4D-9E8A-97D468A8DCC6}" = protocol=6 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"{162A4277-DCF4-4940-8B55-CBACD1CEFF66}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{17CA3AF5-E529-4381-AAD9-1DCC7CAC33CB}" = protocol=17 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe |
"{1AEB8CBC-0CFC-4E60-AEDC-217E210CCD3A}" = protocol=6 | dir=in | app=c:\program files\searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{1AFF6F95-D946-4BEE-86A2-C07D2713D28A}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"{2008205D-4DD1-44E5-BB82-A1FA8FCE22B4}" = protocol=17 | dir=in | app=c:\program files\gameforge4d\elsword_de\data\x2.exe |
"{235C12EB-7585-484E-ACD7-296BA95238C1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{2569931C-C195-4BF6-A8A6-1A67B114C4AB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{25E7AD6A-73CC-4B77-B83F-3420A4032C5F}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe |
"{262706BE-EBF4-49C4-B909-7ABD1B008274}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"{26E13305-AC10-4373-9384-E1A993BB17E7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2899B4E8-29CD-4657-886A-6FAD4B6B9D19}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{2A1E4F28-3965-4438-9D10-94EA6C9632C9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2C2BCB67-F092-4486-9422-542E656D7EE5}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{3387057B-3F8D-4EA4-AA5E-95F037667145}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{36934C93-F494-4C26-A745-D25DAA3DAEBF}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{418174BD-4C80-4054-80EE-46EFF2F8D7DC}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{442B81E6-CE8E-4A64-8455-CC9EC4A8C43B}" = dir=in | app=c:\users\juli\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{44E39CA4-50AB-4D27-8864-905405F887F9}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{460ECC15-A8F1-47D6-9E72-730E0E2B56EF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{472536CF-E3FF-4C48-B68C-39FFC424FAC1}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{494443C2-AE9C-43BD-890C-1D3A74CD08E2}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{4BDAD8A5-9B74-4AE8-8B3A-EEA512C4AFEF}" = protocol=17 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe |
"{4E5AF366-4553-4D71-AB0F-A9A425A05957}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{52B6A95D-34C8-4764-B178-3BAE1D8B7361}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{52EFBB52-EA28-4576-A8D7-D204245A0EA3}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{58CBCE6F-F5A5-4BCD-A794-AFFDDD1A2D5F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6076F113-7C5D-4E27-9E14-0BA0B5A3E4F0}" = protocol=6 | dir=out | app=system |
"{61D84C3A-F720-4B6A-BE66-9E7DB20D831C}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"{66F513A6-8151-4A71-A2DA-6BEFD155273D}" = protocol=6 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe |
"{69B46F99-E9BA-4639-89CF-A4B7C62318C0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6B9EA090-A424-4618-99A7-BB737FB758EB}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{6F9A75D1-2BB5-4343-868B-6F112FB8B86D}" = protocol=17 | dir=in | app=c:\users\juli\appdata\roaming\spotify\spotify.exe |
"{73493254-B34D-4E7F-8C3E-5CD01FADEB9F}" = protocol=6 | dir=in | app=c:\program files\windows ilivid toolbar\datamngr\toolbar\dtuser.exe |
"{74FDECE1-9F0E-4242-8468-FC443629DE48}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{75A9951C-FC48-4979-8653-F2403A4A8757}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{793D8D13-6DC1-4E06-BBAB-5D76D070C371}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{7C6242AC-CD0F-4918-87E6-641F815B4DF2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7D4B3BD8-1722-4D3B-A922-0AFF9CC87F29}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{7D74ADC9-8A21-445E-ACD7-3D7354785C52}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{7DD4976B-7193-4D81-9F84-5B291C83C0B1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8142F2A7-2340-40D7-AEA5-B55BCF803125}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{82B05BF0-EC8F-4F01-9F90-71F9EE306B13}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{84609F01-B07A-40FC-BADE-984F74C6E8D2}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{85CD23C0-FA7F-432E-AECB-2E19D0764513}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{8BB6ED1E-7617-4643-95FC-BBD2382A2B0D}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{8D80F179-5F7B-4AA1-8438-744A5C374B5A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{931E9345-9235-4375-838C-4A0355547905}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{931FC0A7-6EC3-4BAA-B7B1-FB0AB45EFEFE}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{93ADC9A0-F91A-4BC2-95DF-7AB632C20CB0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{97F5C3B6-9400-469D-9D02-500B8487AAD3}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{98E62A52-E9E8-4315-9F28-7FE796F4027C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A218C91F-8386-4070-9CBA-B6E225AC85B9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A2FDD89C-1519-41E0-856F-A69026C8E7BE}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe |
"{A35B42FE-42B7-4088-9D8F-243D0CC65AC1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A4E67FA9-C096-4062-B910-7870FC182D4C}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{A76028C7-74D4-4BB6-AF4C-1EA1D44FC268}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{A79E80CE-2A9A-4673-B509-E2208EAA7AFA}" = protocol=6 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe |
"{A8CFC5EC-14E5-46C4-836D-6A6A6743AE32}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{AF0A7B7E-6E43-4144-B16A-28B69969B5EE}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{B161A211-2D2E-46EC-AB4F-5FDDA1D5C90C}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{B5C45758-C1EE-46BF-B2F3-B711386AD901}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{B62721CE-3B82-4F81-9035-001C6832BA35}" = protocol=6 | dir=in | app=c:\users\juli\appdata\roaming\spotify\spotify.exe |
"{B6661706-6185-4DFF-B5D3-07822FFE43FC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BA4B773C-F7FB-4768-9335-98C71EA76179}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C08510E9-DBEF-4E19-9232-6558F5084329}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C25305E1-8490-40BB-9E78-5EB3036A8CA0}" = protocol=17 | dir=in | app=c:\program files\windows ilivid toolbar\datamngr\toolbar\dtuser.exe |
"{C4387DF6-02B1-492B-B02D-FC482074B9FD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C5390CB0-DF1B-4FD9-BD76-66137DE9CF11}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{C5EC2D60-0421-4C95-A1E6-EA79A586058A}" = protocol=6 | dir=in | app=c:\program files\srware iron\iron.exe |
"{C6659329-ACAC-4787-937F-E7794AD8A085}" = protocol=17 | dir=in | app=c:\program files\searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{C954400A-8C51-46CA-9563-F24FC793FA2C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CABC9B84-2F15-44A9-9FB9-16A998549DA3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CABE93A8-4E83-4FC1-BCD5-E3576F5B4830}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{D3033945-B352-40AF-A20F-662E16B71A24}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{D5649A3B-E0DA-4B08-94A3-7702EEA84830}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{DC6B8A9B-CEE6-40EC-AC93-9B86AA64F400}" = protocol=17 | dir=in | app=c:\program files\srware iron\iron.exe |
"{DDC0CAA1-9BA3-4DBC-8742-5467A964EE88}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe |
"{DF06FEB4-F36A-44D7-BF11-AD5DF8F1BAC4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E2A4F47D-16E9-4E53-AC9E-2F0CC84D0D2A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E32A80AB-8435-4411-9F17-00E57C327BB8}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe |
"{E7EABA95-E6BA-4ECA-A670-1AA219A6987B}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{E8C9B1E8-9048-4C36-A942-2B9DE057468F}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{EA09853D-B98F-4935-AD51-3B557C83F278}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{EA83F750-245A-42E3-A342-109CE0006C97}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{EA8D9BB8-687A-4471-B463-5E5995FAD09F}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe |
"{EC3E4C96-B2DD-4358-A97D-276B6AF22F71}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{F08FA180-DB19-44E3-9AE8-5835A1C15632}" = protocol=17 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"{F204EB20-A7E6-44CC-993E-D6B66ACCDCA2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F4BB3868-BEC2-4820-A8F2-B26B8297A00A}" = protocol=6 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe |
"{FAC6FB8A-A80E-45C2-94F9-D4942C3EE49C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{0616F539-65BB-4C0D-9ADF-9ED31DAC5F7A}C:\users\juli\desktop\teeworlds\data\3509_server.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\teeworlds\data\3509_server.exe |
"TCP Query User{2D12814A-C506-41EA-A716-03C8E4D1DE18}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"TCP Query User{6A41BB9C-1FC9-4168-8740-CB5E0E4938A0}C:\program files\metin2\metin2.bin" = protocol=6 | dir=in | app=c:\program files\metin2\metin2.bin |
"TCP Query User{7B041B1B-B56B-475A-AE98-57B843C74703}C:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv.exe |
"TCP Query User{84BF7D81-B2C7-415C-9F6F-3A29F7220632}C:\program files\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files\lolreplay\lolreplay.exe |
"TCP Query User{96FDBC56-D83F-4623-A7E3-4C5BA11DFD8A}C:\users\juli\desktop\teeworlds\3477_server.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\teeworlds\3477_server.exe |
"TCP Query User{B13CED52-09C4-4577-9D7C-C3C1A46ADAF8}C:\program files\metin2\metin2.exe" = protocol=6 | dir=in | app=c:\program files\metin2\metin2.exe |
"TCP Query User{B5B8251F-0471-457A-9547-DF55AB809BD7}C:\users\juli\desktop\cod 4-lan version\iw3mp.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\cod 4-lan version\iw3mp.exe |
"TCP Query User{B8E067E6-4B85-4012-80E4-F45F920F1ED1}C:\users\juli\desktop\warcraft 3 lan\warcraft iii lan\war3.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\warcraft 3 lan\warcraft iii lan\war3.exe |
"TCP Query User{C375DDAC-B5FD-4297-A8EA-0EDCF011FF10}C:\users\juli\desktop\call of duty - world at war\codwawmp.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\call of duty - world at war\codwawmp.exe |
"TCP Query User{C7E1564A-B74F-43AE-9064-806C736F2331}C:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv_ddrace.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv_ddrace.exe |
"UDP Query User{10CC45C7-A340-4815-8905-ACBB0D92DF0D}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"UDP Query User{12B84900-C9AD-428F-A7D3-8B2130926E78}C:\users\juli\desktop\warcraft 3 lan\warcraft iii lan\war3.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\warcraft 3 lan\warcraft iii lan\war3.exe |
"UDP Query User{1ABAF7C5-CC71-4C44-B779-45F1BA7974F3}C:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv.exe |
"UDP Query User{1CE89E52-1BF6-41C3-BB56-99607394DA99}C:\program files\metin2\metin2.exe" = protocol=17 | dir=in | app=c:\program files\metin2\metin2.exe |
"UDP Query User{23C82EC5-FF8E-4A3F-9EB4-953CF7E792F3}C:\program files\metin2\metin2.bin" = protocol=17 | dir=in | app=c:\program files\metin2\metin2.bin |
"UDP Query User{2698BCED-63D9-4E81-96CE-270F28123172}C:\users\juli\desktop\cod 4-lan version\iw3mp.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\cod 4-lan version\iw3mp.exe |
"UDP Query User{48DF35F4-6C98-4BF5-891D-0C1DE6668540}C:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv_ddrace.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv_ddrace.exe |
"UDP Query User{5C5A98A9-D46D-4BB6-A29A-8F48120B47C1}C:\users\juli\desktop\teeworlds\3477_server.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\teeworlds\3477_server.exe |
"UDP Query User{744C7760-F131-4F2D-84CC-AA2B29C4137A}C:\users\juli\desktop\call of duty - world at war\codwawmp.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\call of duty - world at war\codwawmp.exe |
"UDP Query User{BF278268-0998-4689-B3CA-8208D37A6240}C:\users\juli\desktop\teeworlds\data\3509_server.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\teeworlds\data\3509_server.exe |
"UDP Query User{F96D378C-DCAE-482F-AFA0-1FF76D51B03B}C:\program files\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files\lolreplay\lolreplay.exe |
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources
"{041F8509-D5F5-E79D-02ED-589B620DFF60}" = CCC Help Thai
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{07425A09-9981-A75B-FE4B-F1B6EEEEF588}" = CCC Help Czech
"{08CCA2C2-CA38-1C55-FC24-A8011DF249BC}" = CCC Help German
"{0AF5AD01-AD58-C2C3-D80A-85EAB670A826}" = Catalyst Control Center InstallProxy
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{11E94FDB-C895-45F1-B756-1C9B8C36C8F1}" = Microsoft IntelliType Pro 7.1
"{141893BD-9F35-2D0F-AFD0-8A04D33C545F}" = CCC Help Hungarian
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = LG Power Tools
"{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}" = Catalyst Control Center - Branding
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{23F97773-A8A6-83AC-F7E3-5DAC32AB1237}" = CCC Help Dutch
"{24364652-56E2-6E22-0D47-66069386D85E}" = ccc-core-static
"{26A24AE4-039D-4CA4-87B4-2F83217002FF}" = Java(TM) 7 Update 2
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2B4E24A0-A06F-488D-87D8-16738E5E1104}" = Windows Live Family Safety
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = LG CyberLink PowerDVD
"{2C13F8C1-570B-42A9-87B4-8C7903ECD602}" = ObjectDock Free
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{2DCAE285-1FCC-71CF-A53C-B95036961954}" = CCC Help Chinese Standard
"{32DECFFD-0271-BD79-DC07-9AE9B263C5BB}" = CCC Help Spanish
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3977C85E-C4AA-4559-741E-E6A643C3B6CE}" = CCC Help Greek
"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CE220CE-D879-28C9-AB5A-A677DC3AA80A}" = Catalyst Control Center Graphics Full Existing
"{3D4D4CBF-79F3-4E38-A1DC-30646F030443}" = Microsoft LifeChat
"{49BFAFC6-B39E-F4E9-15D9-A870AA6201A5}" = CCC Help Finnish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56D65EF0-E8D8-C918-B008-9B9B9EDAE295}" = CCC Help Portuguese
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{64BF17B6-2812-2F90-02D7-A8AF5E8A8018}" = Catalyst Control Center Graphics Light
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6D9AA6EA-198D-9DA2-48AE-DDABD242861F}" = CCC Help Korean
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71BE93ED-5BDB-D29E-F987-E99DA69E4E2C}" = CCC Help Norwegian
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{752C1E4E-B4D6-B8B0-9A33-946E4AD6DFE7}" = CCC Help English
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{76A315B7-E848-E23C-5D66-21B923B5ECBC}" = ATI Catalyst Install Manager
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7BC71286-FADF-D923-578F-C508687A6360}" = Catalyst Control Center Graphics Previews Vista
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{809A7654-ABB4-6BC8-74AD-75A24F10100E}" = Catalyst Control Center Graphics Full New
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.03
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BEFCC62-D379-A975-4E54-4A53B30A531F}" = CCC Help Chinese Traditional
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{939628A7-8A3A-9041-8048-EA5515A58364}" = ATI AVIVO Codecs
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C2F9B2C-1585-43AD-9EF9-48AAD60DFC04}" = Microsoft IntelliPoint 8.1
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7400060-6326-9CA7-A7C2-645489937792}" = CCC Help Russian
"{A7952011-A626-AF5C-F818-3125E977B0A6}" = CCC Help French
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AB3C288F-94D9-43EB-43A9-70EFAEA6612A}" = CCC Help Italian
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{ADD5DB49-72CF-11D8-9D75-000129760D75}" = LG CyberLink PowerBackup
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7C29974-4D97-D5D7-7212-BF04B4A05858}" = CCC Help Turkish
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{C1FF64D2-942A-CEE3-8B4B-8C2EFC88DD37}" = Catalyst Control Center Graphics Previews Common
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C59CF2CE-B302-4833-AA35-E0E07D8EBC52}_is1" = SRWare Iron 10.0.650.0
"{C5A245AA-8C8B-7854-8957-4F5C0A80E6B1}" = CCC Help Danish
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB0A385F-F761-EA8E-B1BA-61CF54CAEF37}" = CCC Help Japanese
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D558831D-DE89-44DC-1D71-ED17D95DE6C7}" = HydraVision
"{D5DA695C-089A-4A13-0F8D-B7F967DE828B}" = CCC Help Swedish
"{D72C0FA9-FF2C-C710-C7A0-364FEAAE4B65}" = ccc-utility
"{DB6BB57C-2647-74DC-7CCD-2AD92238AF0C}" = Catalyst Control Center Core Implementation
"{DD41811D-6C9B-279E-3EB8-B5AA84F75759}" = Catalyst Control Center Localization All
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8B68C6A-CE50-8748-6002-6E65E4AC3209}" = CCC Help Polish
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FD020AE5-B9EA-243E-1BEC-B0F52157AB30}" = Catalyst Control Center HydraVision Full
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CCleaner" = CCleaner
"ClearProg" = ClearProg 1.5.1 Beta 6
"DealPly" = DealPly
"Diablo III" = Diablo III
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.17.221
"GeoGebra" = GeoGebra
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = LG Power Tools
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = LG CyberLink PowerDVD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft IntelliPoint 8.1" = Microsoft IntelliPoint 8.1
"Mozilla Firefox (3.6.28)" = Mozilla Firefox (3.6.28)
"Notepad++" = Notepad++
"ObjectDock Free" = ObjectDock Free
"Searchqu Toolbar" = Searchqu Toolbar
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VideoLAN VLC media player 0.8.6b
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Spotify" = Spotify
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 18.12.2011 07:44:41 | Computer Name = Juli-PC | Source = Application Hang | ID = 1002
Description = Programm metin2client.bin, Version 0.0.0.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: f28    Startzeit:
01ccbd7a047380c0    Endzeit: 12    Anwendungspfad: C:\Program Files\Metin2\metin2client.bin

Berichts-ID:
 
 
Error - 18.12.2011 07:46:44 | Computer Name = Juli-PC | Source = Application Hang | ID = 1002
Description = Programm metin2client.bin, Version 0.0.0.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: e7c    Startzeit:
01ccbd7a74441360    Endzeit: 162    Anwendungspfad: C:\Program Files\Metin2\metin2client.bin

Berichts-ID:
 
 
Error - 18.12.2011 07:50:52 | Computer Name = Juli-PC | Source = Application Hang | ID = 1002
Description = Programm metin2client.bin, Version 0.0.0.0 kann nicht mehr unter Windows
 ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
 um nach weiteren Informationen zum Problem zu suchen.    Prozess-ID: dac    Startzeit:
01ccbd7ac4494e20    Endzeit: 12    Anwendungspfad: C:\Program Files\Metin2\metin2client.bin

Berichts-ID:
 
 
Error - 20.12.2011 11:22:37 | Computer Name = Juli-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
 
Error - 23.12.2011 11:17:16 | Computer Name = Juli-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
 
Error - 23.12.2011 17:12:22 | Computer Name = Juli-PC | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Skype\Toolbars\Internet
 Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest- oder Richtliniendatei "C:\Program
 Files\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" in Zeile 2.  Mehrere
 requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
Error - 26.12.2011 15:39:00 | Computer Name = Juli-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Skype.exe, Version: 5.5.0.124, Zeitstempel:
 0x4e96a02b  Name des fehlerhaften Moduls: Skype.exe, Version: 5.5.0.124, Zeitstempel:
 0x4e96a02b  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00f58d70  ID des fehlerhaften Prozesses:
 0x880  Startzeit der fehlerhaften Anwendung: 0x01ccc405c46f8fe0  Pfad der fehlerhaften
 Anwendung: C:\Program Files\Skype\Phone\Skype.exe  Pfad des fehlerhaften Moduls:
C:\Program Files\Skype\Phone\Skype.exe  Berichtskennung: 41aa7d80-2ff9-11e1-b36f-485b39a96ddd
 
Error - 27.12.2011 12:28:49 | Computer Name = Juli-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: metin2.exe, Version: 0.0.0.0, Zeitstempel:
 0x4e408722  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16695, Zeitstempel:
 0x4cc7ab44  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0002fa7b  ID des fehlerhaften Prozesses:
 0xdd4  Startzeit der fehlerhaften Anwendung: 0x01ccc4b493108ad0  Pfad der fehlerhaften
 Anwendung: C:\Program Files\Metin2\metin2.exe  Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll
Berichtskennung:
 da7fc5c0-30a7-11e1-ad4a-485b39a96ddd
 
Error - 29.12.2011 13:30:02 | Computer Name = Juli-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: fraps.exe, Version: 3.4.6.13747,
Zeitstempel: 0x4e34fb43  Name des fehlerhaften Moduls: fraps.exe, Version: 3.4.6.13747,
 Zeitstempel: 0x4e34fb43  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00011ad9  ID des fehlerhaften
 Prozesses: 0xaa0  Startzeit der fehlerhaften Anwendung: 0x01ccc64f5793372c  Pfad der
 fehlerhaften Anwendung: C:\Fraps\fraps.exe  Pfad des fehlerhaften Moduls: C:\Fraps\fraps.exe
Berichtskennung:
 bd0231bc-3242-11e1-86dd-485b39a96ddd
 
Error - 01.01.2012 15:52:15 | Computer Name = Juli-PC | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Skype\Toolbars\Internet
 Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest- oder Richtliniendatei "C:\Program
 Files\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" in Zeile 2.  Mehrere
 requestedPrivileges-Elemente sind nicht im Manifest zulässig.
 
[ Media Center Events ]
Error - 01.10.2010 10:03:18 | Computer Name = Juli-PC | Source = MCUpdate | ID = 0
Description = 16:03:18 - Fehler beim Herstellen der Internetverbindung.  16:03:18
-    Serververbindung konnte nicht hergestellt werden.. 
 
Error - 01.10.2010 10:03:27 | Computer Name = Juli-PC | Source = MCUpdate | ID = 0
Description = 16:03:23 - Fehler beim Herstellen der Internetverbindung.  16:03:23
-    Serververbindung konnte nicht hergestellt werden.. 
 
[ System Events ]
Error - 11.12.2012 08:44:45 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
Error - 11.12.2012 09:28:41 | Computer Name = Juli-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?11.?12.?2012 um 14:27:24 unerwartet heruntergefahren.
 
Error - 11.12.2012 09:28:58 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
Error - 11.12.2012 12:38:57 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
Error - 11.12.2012 15:28:03 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
Error - 12.12.2012 10:33:12 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
Error - 12.12.2012 16:07:06 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
Error - 13.12.2012 10:36:48 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
Error - 13.12.2012 13:10:05 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
Error - 13.12.2012 13:54:15 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
  luafv
 
 
< End of report >
--- --- ---

markusg 13.12.2012 20:44
hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4 - HKCU..\Run: [Video Performer63615.exe] C:\Users\Juli\AppData\Local\Temp\Video Performer63615.exe ()
 :Files
:Commands
[EMPTYFLASH]
[emptytemp]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

JulianK. 13.12.2012 22:10
Der Upload hat erfolgreich geklappt. und jetzt?:)

markusg 14.12.2012 13:42
Hallo,
combofix:
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.
Downloade dir bitte Combofix von einem dieser Downloadspiegel

Link 1
Link 2


WICHTIG - Speichere Combofix auf deinem Desktop
  • Deaktiviere bitte all deine Anti Viren sowie Anti Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören.
Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort.


Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

JulianK. 14.12.2012 15:28
also soll ich jetzt den ordner noch mal uploaden oder dieses combofix benutzen? btw. ich glaube, dass ich kein virus mehr hab, weil das video geht jetzt wieder, und ich hab schon alle gefundenen viren mit dem programm "malwarebytes anti-malware" gelöscht
sorry bin neu

markusg 14.12.2012 15:47
Wieso noch mal uploaden, steht doch oben, was zu tun ist.


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:11 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19