Code:
OTL logfile created on: 19.01.2013 16:15:08 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\YuT666\Downloads
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 2,02 Gb Available Physical Memory | 62,06% Memory free
6,50 Gb Paging File | 5,26 Gb Available in Paging File | 80,99% Paging File free
Paging file location(s): i:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 60,00 Gb Total Space | 10,79 Gb Free Space | 17,98% Space Free | Partition Type: NTFS
Drive D: | 177,87 Gb Total Space | 18,18 Gb Free Space | 10,22% Space Free | Partition Type: NTFS
Drive E: | 227,88 Gb Total Space | 19,60 Gb Free Space | 8,60% Space Free | Partition Type: NTFS
Drive F: | 170,01 Gb Total Space | 74,33 Gb Free Space | 43,72% Space Free | Partition Type: NTFS
Drive G: | 200,00 Gb Total Space | 112,07 Gb Free Space | 56,04% Space Free | Partition Type: NTFS
Drive H: | 65,76 Gb Total Space | 65,54 Gb Free Space | 99,67% Space Free | Partition Type: NTFS
Drive I: | 29,99 Gb Total Space | 26,62 Gb Free Space | 88,75% Space Free | Partition Type: NTFS
Computer Name: YUT666-PC | User Name: YuT666 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.01.19 14:49:01 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\YuT666\Downloads\OTL.exe
PRC - [2012.11.23 03:48:41 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2012.10.30 23:50:59 | 004,297,136 | ---- | M] (AVAST Software) -- C:\Tools\System\Security\Avast\AvastUI.exe
PRC - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) -- C:\Tools\System\Security\Avast\AvastSvc.exe
PRC - [2012.09.28 15:42:26 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe
PRC - [2012.09.28 02:38:42 | 000,473,088 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe
PRC - [2012.09.28 02:38:02 | 000,217,600 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe
PRC - [2012.07.17 14:49:00 | 001,713,904 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
PRC - [2012.07.17 14:49:00 | 000,194,304 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
PRC - [2010.11.20 22:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe
PRC - [2010.11.20 22:29:41 | 001,174,016 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Sidebar\sidebar.exe
PRC - [2010.11.20 22:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
========== Modules (No Company Name) ==========
MOD - [2013.01.09 15:47:12 | 000,253,952 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsFormsIntegra#\86d50cfb9c655209d3fbbbe6071337b2\WindowsFormsIntegration.ni.dll
MOD - [2013.01.09 15:44:57 | 000,096,768 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\UIAutomationProvider\a1b65a602c75409c0c1ce7fa1f2a0983\UIAutomationProvider.ni.dll
MOD - [2013.01.09 15:44:56 | 000,762,368 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Runtime.Remo#\569d22d5591f3d2d35bc64437011e919\System.Runtime.Remoting.ni.dll
MOD - [2013.01.09 15:44:48 | 001,801,216 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xaml\7256e28382f57416b828a0cc143b67b3\System.Xaml.ni.dll
MOD - [2013.01.09 15:18:06 | 018,000,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\25884c52a01d74137ffacdb51d8f2d04\PresentationFramework.ni.dll
MOD - [2013.01.09 15:17:50 | 011,451,904 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationCore\3ca69d589c23a0be94f3858f72e7a595\PresentationCore.ni.dll
MOD - [2013.01.09 15:17:46 | 000,595,968 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\PresentationFramewo#\35296661bd979735d6afd036a104bfd6\PresentationFramework.Aero.ni.dll
MOD - [2013.01.09 15:17:45 | 013,198,848 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Windows.Forms\12f94ec43a0160ab9ddd755b0e1be881\System.Windows.Forms.ni.dll
MOD - [2013.01.09 15:17:42 | 007,053,824 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Core\a0db56351a1589e44868456609b01737\System.Core.ni.dll
MOD - [2013.01.09 15:17:40 | 000,980,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Configuration\197761bb3230bf9d4f540305dcf6717c\System.Configuration.ni.dll
MOD - [2013.01.09 15:17:39 | 005,618,176 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Xml\3d6d9da56c9f607615b55d6742d8427d\System.Xml.ni.dll
MOD - [2013.01.09 15:17:39 | 003,856,896 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\WindowsBase\6133e360071a2fa7ba7deb483816e585\WindowsBase.ni.dll
MOD - [2013.01.09 15:17:36 | 001,667,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System.Drawing\8ba0620535aa28d509b9397500b7d530\System.Drawing.ni.dll
MOD - [2013.01.09 15:17:35 | 009,093,120 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\System\c182d7a0bd88caf2cddccb7491a5fa6e\System.ni.dll
MOD - [2013.01.09 15:17:28 | 014,412,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v4.0.30319_32\mscorlib\3f95a6d480ed1ebe45cf27b770ba94ed\mscorlib.ni.dll
MOD - [2012.09.28 15:42:42 | 000,095,232 | ---- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\Fuel.Proxy.Native.dll
MOD - [2012.02.17 19:55:35 | 000,166,912 | ---- | M] () -- C:\Tools\Compression\WinRAR\RarExt.dll
========== Services (SafeList) ==========
SRV - [2013.01.19 10:58:53 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.01.09 22:00:13 | 000,251,400 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\System32\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.10.30 23:50:59 | 000,044,808 | ---- | M] (AVAST Software) [Auto | Running] -- C:\Tools\System\Security\Avast\AvastSvc.exe -- (avast! Antivirus)
SRV - [2012.09.28 15:42:26 | 000,291,840 | ---- | M] (Advanced Micro Devices, Inc.) [Auto | Running] -- C:\Program Files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe -- (AMD FUEL Service)
SRV - [2012.09.28 02:38:02 | 000,217,600 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2012.09.12 15:58:46 | 001,512,448 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc)
SRV - [2012.07.17 14:49:00 | 001,713,904 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2012.07.13 12:28:36 | 000,160,944 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.04.26 14:03:36 | 000,135,584 | ---- | M] (Futuremark Corporation) [On_Demand | Stopped] -- C:\Programme\Futuremark\Futuremark SystemInfo\FMSISvc.exe -- (Futuremark SystemInfo Service)
SRV - [2010.11.20 22:29:49 | 001,121,792 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc)
SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc)
SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc)
SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend)
========== Driver Services (SafeList) ==========
DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\TEMP\cpuz135\cpuz135_x32.sys -- (cpuz135)
DRV - [2012.10.30 23:51:58 | 000,738,504 | ---- | M] (AVAST Software) [File_System | System | Running] -- C:\Windows\System32\drivers\aswSnx.sys -- (aswSnx)
DRV - [2012.10.30 23:51:58 | 000,361,032 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswSP.sys -- (aswSP)
DRV - [2012.10.30 23:51:58 | 000,054,232 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswTdi.sys -- (aswTdi)
DRV - [2012.10.30 23:51:57 | 000,058,680 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswMonFlt.sys -- (aswMonFlt)
DRV - [2012.10.30 23:51:56 | 000,021,256 | ---- | M] (AVAST Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\aswFsBlk.sys -- (aswFsBlk)
DRV - [2012.10.15 17:59:28 | 000,044,784 | ---- | M] (AVAST Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\aswRdr2.sys -- (aswRdr)
DRV - [2012.09.28 03:20:20 | 009,107,968 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag)
DRV - [2012.09.28 02:12:10 | 000,370,176 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap)
DRV - [2012.07.20 13:15:20 | 000,025,728 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\androidusb.sys -- (androidusb)
DRV - [2012.07.01 18:14:50 | 000,044,656 | ---- | M] (Fuzhou Rockchip Electronics Co,Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rockusb.sys -- (Rockusb)
DRV - [2012.05.14 07:12:28 | 000,086,656 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService)
DRV - [2012.04.09 10:13:58 | 000,048,256 | ---- | M] (Advanced Micro Devices) [Kernel | Auto | Running] -- C:\Programme\ATI Technologies\ATI.ACE\Fuel\i386\aoddriver2.sys -- (AODDriver4.2)
DRV - [2012.01.18 14:55:56 | 000,016,472 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\pwdrvio.sys -- (pwdrvio)
DRV - [2012.01.18 14:55:54 | 000,011,104 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\pwdspio.sys -- (pwdspio)
DRV - [2011.10.13 12:06:14 | 000,441,608 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\Windows\System32\drivers\Uim_IM.sys -- (Uim_IM)
DRV - [2011.10.13 12:06:14 | 000,277,576 | ---- | M] (Paragon) [Kernel | System | Running] -- C:\Windows\System32\drivers\Uim_Vim.sys -- (Uim_Vim)
DRV - [2011.10.13 12:06:14 | 000,045,240 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | System | Running] -- C:\Windows\System32\drivers\UimBus.sys -- (UimBus)
DRV - [2011.07.29 12:54:56 | 000,014,216 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\epmntdrv.sys -- (epmntdrv)
DRV - [2011.07.29 12:54:56 | 000,008,456 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\EuGdiDrv.sys -- (EuGdiDrv)
DRV - [2011.06.15 20:09:42 | 000,012,728 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\ddmdrv.sys -- (ddmdrv)
DRV - [2010.11.20 22:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010.11.20 22:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus)
DRV - [2010.11.20 22:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\dmvsc.sys -- (dmvsc)
DRV - [2010.11.20 22:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt)
DRV - [2010.11.20 22:29:03 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010.11.20 22:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc)
DRV - [2010.11.20 22:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbGD.sys -- (TsUsbGD)
DRV - [2010.11.20 22:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID)
DRV - [2010.11.20 22:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap)
DRV - [2010.08.25 18:39:00 | 000,013,704 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\System32\prwntdrv.sys -- (prwntdrv)
DRV - [2010.02.18 08:18:22 | 000,037,944 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\amdiox86.sys -- (amdiox86)
DRV - [2009.07.14 00:52:10 | 000,014,336 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\vwifimp.sys -- (vwifimp)
DRV - [2009.07.13 23:02:53 | 000,657,408 | ---- | M] (Ralink Technology Corp.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\netr28u.sys -- (netr28u)
DRV - [2009.07.13 23:02:53 | 000,347,136 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8187B.sys -- (RTL8187B)
DRV - [2009.04.29 23:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFILTERx86)
DRV - [2009.04.29 23:37:26 | 000,025,088 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\KMWDFILTER.sys -- (KMWDFilter)
DRV - [2007.06.29 13:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2006.11.22 09:01:48 | 000,693,760 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | Auto | Running] -- C:\Windows\System32\drivers\hardlock.sys -- (Hardlock)
DRV - [2006.11.22 09:01:48 | 000,100,096 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\aksusb.sys -- (aksusb)
DRV - [2006.11.22 09:01:46 | 000,327,168 | ---- | M] (Aladdin Knowledge Systems Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\akshasp.sys -- (akshasp)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.mocaflix.com/
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{BB74DE59-BC4C-4172-9AC4-73315F71CFFE}: "URL" = hxxp://websearch.mocaflix.com/?l=1&q={searchTerms}
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://websearch.mocaflix.com/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 0E 81 AC 89 5D 24 CD 01 [binary data]
IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - No CLSID value found
IE - HKCU\..\URLSearchHook: {7e111a5c-3d11-4f56-9463-5310c3c69025} - No CLSID value found
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..CT2736476.browser.search.defaultthis.engineName: true
FF - prefs.js..browser.search.defaultenginename: "WebSearch"
FF - prefs.js..browser.search.defaultenginename,S: S", "WebSearch"
FF - prefs.js..browser.search.defaultthis.engineName: "Winload Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://websearch.mocaflix.com/?l=1&q="
FF - prefs.js..browser.search.order.1: "WebSearch"
FF - prefs.js..browser.search.order.1,S: S", "WebSearch"
FF - prefs.js..browser.search.selectedEngine: "Google Deutschland"
FF - prefs.js..browser.search.selectedEngine,S: S", "WebSearch"
FF - prefs.js..browser.search.suggest.enabled: false
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "www.google.de"
FF - prefs.js..extensions.enabledAddons: stealthyextension%40gmail.com:2.4
FF - prefs.js..extensions.enabledAddons: %7BDB9127A2-3381-41ec-82B3-1B6ED4C6F29A%7D:6.0
FF - prefs.js..extensions.enabledAddons: %7B19503e42-ca3c-4c27-b1e2-9cdb2170ee34%7D:1.5.3
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:18.0.1
FF - prefs.js..keyword.URL: "hxxp://websearch.mocaflix.com/?l=1&q="
FF - prefs.js..network.proxy.http: "46.23.64.124"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.type: 0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: ""
FF - prefs.js..sweetim.toolbar.previous.browser.search.selectedEngine: ""
FF - prefs.js..browser.startup.homepage: ""
FF - prefs.js..sweetim.toolbar.previous.keyword.URL: ""
FF - user.js - File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_5_502_146.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=16.4.3505.0912: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@protectdisc.com/NPMPDRM: C:\Program Files\Common Files\mpDRM\Binaries\NPMPDRM.dll ( )
FF - HKLM\Software\MozillaPlugins\@rocketlife.com/RocketLife Secure Plug-In Layer;version=1.0.5: C:\ProgramData\Visan\plugins\npRLSecurePluginLayer.dll (RocketLife, LLP)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\ubisoft.com/uplaypc: C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll (Ubisoft)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Tools\System\Security\Avast\WebRep\FF [2012.11.04 18:31:26 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Components: C:\Tools\Internet\Firefox\components [2013.01.19 10:58:53 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 18.0.1\extensions\\Plugins: C:\Tools\Internet\Firefox\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Components: C:\Tools\Internet\Thunderbird\components [2013.01.08 21:19:55 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.2\extensions\\Plugins: C:\Tools\Internet\Thunderbird\plugins
[2012.04.27 11:53:57 | 000,000,000 | ---D | M] (No name found) -- C:\Users\YuT666\AppData\Roaming\mozilla\Extensions
[2013.01.10 21:02:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\YuT666\AppData\Roaming\mozilla\Firefox\Profiles\lt3hkzxi.default\extensions
[2013.01.05 09:45:03 | 000,000,000 | ---D | M] (Flashget Downloader Extension) -- C:\Users\YuT666\AppData\Roaming\mozilla\Firefox\Profiles\lt3hkzxi.default\extensions\{DB9127A2-3381-41ec-82B3-1B6ED4C6F29A}
[2012.10.22 22:44:15 | 000,183,174 | ---- | M] () (No name found) -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\extensions\stealthyextension@gmail.com.xpi
[2013.01.10 21:02:06 | 000,347,812 | ---- | M] () (No name found) -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
[2012.11.23 15:41:44 | 000,804,627 | ---- | M] () (No name found) -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.01.14 19:09:11 | 000,002,245 | ---- | M] () -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\searchplugins\ebay-deutschland---kleinanzeigen.xml
[2013.01.14 19:09:11 | 000,002,538 | ---- | M] () -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\searchplugins\ebay-deutschland.xml
[2013.01.17 10:38:42 | 000,002,400 | ---- | M] () -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\searchplugins\google-deutschland.xml
[2013.01.14 19:09:11 | 000,002,537 | ---- | M] () -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\searchplugins\imdb.xml
[2013.01.14 19:09:26 | 000,005,524 | ---- | M] () -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\searchplugins\ofdb---alles.xml
[2012.10.03 18:01:20 | 000,003,915 | ---- | M] () -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\searchplugins\sweetim.xml
[2012.11.10 11:52:42 | 000,000,544 | ---- | M] () -- C:\Users\YuT666\AppData\Roaming\mozilla\firefox\profiles\lt3hkzxi.default\searchplugins\WebSearch.xml
========== Chrome ==========
CHR - homepage: hxxp://websearch.mocaflix.com/
CHR - Extension: No name found = C:\Users\YuT666\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: No name found = C:\Users\YuT666\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: No name found = C:\Users\YuT666\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.1.0.1_0\
CHR - Extension: No name found = C:\Users\YuT666\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
CHR - Extension: No name found = C:\Users\YuT666\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\
CHR - Extension: No name found = C:\Users\YuT666\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\
CHR - Extension: No name found = C:\Users\YuT666\AppData\Local\Google\Chrome\User Data\Default\Extensions\jcdgjdiieiljkfkdcloehkohchhpekkn\1.1.0.1_0\
CHR - Extension: No name found = C:\Users\YuT666\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\
O1 HOSTS File: ([2012.11.27 08:54:01 | 000,444,883 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.007guard.com
O1 - Hosts: 127.0.0.1 007guard.com
O1 - Hosts: 127.0.0.1 008i.com
O1 - Hosts: 127.0.0.1 www.008k.com
O1 - Hosts: 127.0.0.1 008k.com
O1 - Hosts: 127.0.0.1 www.00hq.com
O1 - Hosts: 127.0.0.1 00hq.com
O1 - Hosts: 127.0.0.1 010402.com
O1 - Hosts: 127.0.0.1 www.032439.com
O1 - Hosts: 127.0.0.1 032439.com
O1 - Hosts: 127.0.0.1 www.0scan.com
O1 - Hosts: 127.0.0.1 0scan.com
O1 - Hosts: 127.0.0.1 1000gratisproben.com
O1 - Hosts: 127.0.0.1 www.1000gratisproben.com
O1 - Hosts: 127.0.0.1 1001namen.com
O1 - Hosts: 127.0.0.1 www.1001namen.com
O1 - Hosts: 127.0.0.1 www.100888290cs.com
O1 - Hosts: 127.0.0.1 100888290cs.com
O1 - Hosts: 127.0.0.1 100sexlinks.com
O1 - Hosts: 127.0.0.1 www.100sexlinks.com
O1 - Hosts: 127.0.0.1 www.10sek.com
O1 - Hosts: 127.0.0.1 10sek.com
O1 - Hosts: 127.0.0.1 1-2005-search.com
O1 - Hosts: 127.0.0.1 www.1-2005-search.com
O1 - Hosts: 127.0.0.1 www.123fporn.info
O1 - Hosts: 15278 more lines...
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Tools\System\Security\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (FlashGetBHO) - {b070d3e3-fec0-47d9-8e8a-99d4eeb3d3b0} - C:\Users\YuT666\AppData\Roaming\FlashGetBHO\FlashGetBHO.dll (Trend Media Group)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Tools\System\Security\Avast\aswWebRepIE.dll (AVAST Software)
O4 - HKLM..\Run: [amd_dc_opt] C:\Programme\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [avast] C:\Tools\System\Security\Avast\avastUI.exe (AVAST Software)
O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.)
O4 - HKLM..\Run: [Sweetpacks Communicator] C:\Programme\SweetIM\Communicator\SweetPacksUpdateManager.exe (SweetIM Technologies Ltd.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O8 - Extra context menu item: Download all links by FlashGet3 - C:\Tools\Internet\FlashGet 3\BHO\fdgetallurl.htm ()
O8 - Extra context menu item: Download all videos by FlashGet3 - C:\Tools\Internet\FlashGet 3\BHO\fdgetallflvurl.htm ()
O8 - Extra context menu item: Download by FlashGet3 - C:\Tools\Internet\FlashGet 3\BHO\fdgeturl.htm ()
O8 - Extra context menu item: Download current video by FlashGet3 - C:\Tools\Internet\FlashGet 3\BHO\fdgetflvurl.htm ()
O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 10.5.1)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/pub/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F46241AD-8CDA-4EC4-AF79-543C9AF31643}: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{FBC6EF45-D9DA-4BF3-9D2C-892702771E1D}: DhcpNameServer = 192.168.1.1
O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {8A69D345-D564-463c-AFF1-A69D9E530F96} - "C:\Program Files\Google\Chrome\Application\24.0.1312.52\Installer\setup.exe" --configure-user-settings --verbose-logging --system-level --multi-install --chrome
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
NetSvcs: FastUserSwitchingCompatibility - File not found
NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla - File not found
NetSvcs: Ntmssvc - File not found
NetSvcs: NWCWorkstation - File not found
NetSvcs: Nwsapagent - File not found
NetSvcs: SRService - File not found
NetSvcs: WmdmPmSp - File not found
NetSvcs: LogonHours - File not found
NetSvcs: PCAudit - File not found
NetSvcs: helpsvc - File not found
NetSvcs: uploadmgr - File not found
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
========== Files/Folders - Created Within 30 Days ==========
[2013.01.19 11:43:35 | 000,000,000 | ---D | C] -- C:\6
[2013.01.19 11:08:46 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2013.01.16 10:33:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PSP ISO Compressor
[2013.01.11 20:22:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
[2013.01.11 19:13:58 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Local\Targem
[2013.01.11 19:13:58 | 000,000,000 | ---D | C] -- C:\Users\Public\Documents\My Games
[2013.01.09 21:50:05 | 000,000,000 | ---D | C] -- C:\Users\YuT666\Desktop\PSP
[2013.01.09 21:32:10 | 000,000,000 | ---D | C] -- C:\Users\YuT666\Desktop\N64
[2013.01.09 19:13:59 | 000,000,000 | ---D | C] -- C:\Program Files\AGEIA Technologies
[2013.01.09 19:13:59 | 000,000,000 | ---D | C] -- C:\Windows\System32\AGEIA
[2013.01.09 19:13:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GearGrinder
[2013.01.05 09:43:44 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\FlashGet3.7
[2013.01.05 09:43:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\FlashGet3.7
[2013.01.05 09:43:41 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Roaming\FlashgetSetup
[2013.01.05 09:43:41 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Roaming\BITS
[2013.01.05 09:43:37 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Roaming\FlashGetBHO
[2013.01.05 09:43:33 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Roaming\FlashGet
[2013.01.04 20:24:38 | 000,000,000 | ---D | C] -- C:\Users\YuT666\Desktop\PSX
[2013.01.04 20:18:06 | 000,000,000 | ---D | C] -- C:\Users\YuT666\PSX
[2013.01.02 20:00:20 | 000,000,000 | ---D | C] -- C:\Users\YuT666\Documents\Neuer Ordner
[2012.12.31 11:50:20 | 000,000,000 | ---D | C] -- C:\Users\YuT666\Documents\Rockstar Games
[2012.12.31 11:21:11 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Local\Rockstar Games
[2012.12.31 10:53:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Rockstar Games
[2012.12.31 10:53:50 | 000,000,000 | ---D | C] -- C:\Program Files\Rockstar Games
[2012.12.30 16:47:55 | 000,000,000 | ---D | C] -- C:\toolbarImages
[2012.12.28 20:24:15 | 000,000,000 | ---D | C] -- C:\Users\YuT666\Desktop\Neuer Ordner
[2012.12.28 11:54:23 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Local\Programs
[2012.12.27 19:42:45 | 000,000,000 | R--D | C] -- C:\Users\YuT666\Documents\HP Photo Creations
[2012.12.27 19:42:45 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Roaming\Visan
[2012.12.27 19:42:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Visan
[2012.12.21 21:10:48 | 000,000,000 | ---D | C] -- C:\Users\YuT666\AppData\Local\Fallout3
========== Files - Modified Within 30 Days ==========
[2013.01.19 16:13:41 | 000,000,380 | ---- | M] () -- C:\Windows\System32\secustat.dat
[2013.01.19 16:03:45 | 000,001,184 | ---- | M] () -- C:\Windows\System32\secushr.dat
[2013.01.19 15:59:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.01.19 15:41:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2013.01.19 14:57:26 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2013.01.19 14:44:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.01.19 12:17:27 | 000,031,280 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.01.19 12:17:27 | 000,031,280 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.01.19 11:31:25 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.01.19 11:31:25 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.01.19 11:31:25 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.01.19 11:31:25 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.01.19 09:12:04 | 000,000,336 | ---- | M] () -- C:\Windows\tasks\GlaryInitialize.job
[2013.01.19 09:12:03 | 000,000,408 | -H-- | M] () -- C:\Windows\tasks\OptimizerProUpdaterTask{6263A61B-8152-43AA-91DD-D1FB79FDCCA3}.job
[2013.01.18 22:54:47 | 000,001,355 | ---- | M] () -- C:\Users\YuT666\Desktop\XMedia Recode - Verknüpfung.lnk
[2013.01.15 08:51:40 | 000,015,249 | ---- | M] () -- C:\Users\YuT666\Desktop\OpenDocument Text (neu).odt
[2013.01.11 20:22:39 | 000,000,579 | ---- | M] () -- C:\Users\Public\Desktop\Outcast.lnk
[2013.01.11 19:51:22 | 000,021,456 | ---- | M] () -- C:\Users\YuT666\Documents\ESt2012_Nirschl_Thomas.elfo
[2013.01.10 08:17:00 | 000,389,416 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.01.09 19:13:06 | 000,000,573 | ---- | M] () -- C:\Users\YuT666\Desktop\GearGrinder.lnk
[2013.01.07 16:26:51 | 000,158,603 | ---- | M] () -- C:\Users\YuT666\Documents\ESt2011_Nirschl_Thomas.elfo
[2013.01.05 09:44:22 | 000,001,446 | ---- | M] () -- C:\Users\YuT666\Desktop\FlashGet.lnk
[2013.01.05 09:43:55 | 000,000,025 | ---- | M] () -- C:\Windows\emcore.INI
[2013.01.05 09:43:47 | 000,000,945 | ---- | M] () -- C:\Users\YuT666\Desktop\FlashGet3.lnk
[2012.12.31 11:53:01 | 000,000,938 | ---- | M] () -- C:\Users\YuT666\Desktop\GTAIV - Verknüpfung.lnk
[2012.12.29 20:52:14 | 000,000,549 | ---- | M] () -- C:\Users\YuT666\Desktop\Minecraft (2).lnk
[2012.12.28 14:51:00 | 000,001,608 | ---- | M] () -- C:\Users\YuT666\Desktop\Revouninstaller.lnk
[2012.12.28 11:54:35 | 000,001,105 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
========== Files Created - No Company Name ==========
[2013.01.18 22:54:47 | 000,001,355 | ---- | C] () -- C:\Users\YuT666\Desktop\XMedia Recode - Verknüpfung.lnk
[2013.01.11 20:22:39 | 000,000,579 | ---- | C] () -- C:\Users\Public\Desktop\Outcast.lnk
[2013.01.11 19:51:11 | 000,021,456 | ---- | C] () -- C:\Users\YuT666\Documents\ESt2012_Nirschl_Thomas.elfo
[2013.01.09 19:13:06 | 000,000,573 | ---- | C] () -- C:\Users\YuT666\Desktop\GearGrinder.lnk
[2013.01.05 10:45:44 | 000,001,184 | ---- | C] () -- C:\Windows\System32\secushr.dat
[2013.01.05 09:45:19 | 000,000,380 | ---- | C] () -- C:\Windows\System32\secustat.dat
[2013.01.05 09:44:22 | 000,001,446 | ---- | C] () -- C:\Users\YuT666\Desktop\FlashGet.lnk
[2013.01.05 09:43:55 | 000,000,025 | ---- | C] () -- C:\Windows\emcore.INI
[2013.01.05 09:43:46 | 000,000,945 | ---- | C] () -- C:\Users\YuT666\Desktop\FlashGet3.lnk
[2013.01.02 23:08:03 | 000,015,249 | ---- | C] () -- C:\Users\YuT666\Desktop\OpenDocument Text (neu).odt
[2012.12.31 11:53:01 | 000,000,938 | ---- | C] () -- C:\Users\YuT666\Desktop\GTAIV - Verknüpfung.lnk
[2012.12.29 20:52:14 | 000,000,549 | ---- | C] () -- C:\Users\YuT666\Desktop\Minecraft (2).lnk
[2012.12.28 14:51:00 | 000,001,608 | ---- | C] () -- C:\Users\YuT666\Desktop\Revouninstaller.lnk
[2012.10.21 14:28:09 | 000,028,672 | ---- | C] () -- C:\Windows\System32\hlduinst.exe
[2012.10.21 14:28:08 | 000,153,088 | ---- | C] () -- C:\Windows\System32\UNWISE.EXE
[2012.10.21 14:28:08 | 000,006,836 | ---- | C] () -- C:\Windows\System32\UNWISE.INI
[2012.09.28 15:36:56 | 000,180,224 | ---- | C] () -- C:\Windows\System32\clinfo.exe
[2012.09.03 18:26:56 | 000,044,544 | ---- | C] () -- C:\Windows\System32\Gif89.dll
[2012.08.29 10:28:39 | 000,148,992 | ---- | C] () -- C:\Windows\UNWISE32.EXE
[2012.08.26 07:17:26 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.08.02 12:24:45 | 000,000,000 | ---- | C] () -- C:\Windows\SSCNCSrv.INI
[2012.08.02 11:55:34 | 000,000,021 | ---- | C] () -- C:\Windows\CNCLogin.INI
[2012.07.28 02:30:54 | 000,204,952 | ---- | C] () -- C:\Windows\System32\ativvsvl.dat
[2012.07.28 02:30:54 | 000,157,144 | ---- | C] () -- C:\Windows\System32\ativvsva.dat
[2012.07.26 20:16:26 | 000,338,432 | ---- | C] () -- C:\Windows\System32\sqlite36_engine.dll
[2012.06.15 15:53:44 | 000,000,212 | ---- | C] () -- C:\Users\YuT666\.swfinfo
[2012.05.25 18:11:33 | 002,468,520 | ---- | C] () -- C:\Windows\System32\BootMan.exe
[2012.05.25 18:11:33 | 000,086,408 | ---- | C] () -- C:\Windows\System32\setupempdrv03.exe
[2012.05.25 18:11:33 | 000,019,840 | ---- | C] () -- C:\Windows\System32\EuEpmGdi.dll
[2012.05.25 18:11:33 | 000,008,456 | ---- | C] () -- C:\Windows\System32\EuGdiDrv.sys
[2012.05.25 18:11:32 | 000,014,216 | ---- | C] () -- C:\Windows\System32\epmntdrv.sys
[2012.05.23 16:31:02 | 000,632,252 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2012.05.13 17:30:32 | 000,098,696 | ---- | C] () -- C:\Windows\System32\setupprwdrv03.exe
[2012.05.13 17:30:32 | 000,013,704 | ---- | C] () -- C:\Windows\System32\prwntdrv.sys
[2012.05.12 22:13:45 | 001,118,648 | ---- | C] () -- C:\Windows\ddmmain.exe
[2012.05.12 22:13:45 | 000,012,728 | ---- | C] () -- C:\Windows\System32\ddmdrv.sys
[2012.05.12 21:49:36 | 000,922,184 | ---- | C] () -- C:\Windows\System32\pwNative.exe
[2012.05.12 21:49:35 | 000,016,472 | ---- | C] () -- C:\Windows\System32\pwdrvio.sys
[2012.05.12 21:49:34 | 000,011,104 | ---- | C] () -- C:\Windows\System32\pwdspio.sys
[2012.05.11 20:52:51 | 000,003,072 | ---- | C] () -- C:\Users\YuT666\AppData\Local\file__0.localstorage
[2012.05.02 14:58:10 | 000,029,184 | ---- | C] () -- C:\Windows\System32\kdbsdk32.dll
[2012.04.29 12:18:03 | 000,000,867 | ---- | C] () -- C:\Users\YuT666\.recently-used.xbel
[2012.04.29 11:45:12 | 000,000,617 | ---- | C] () -- C:\Users\YuT666\AppData\Roaming\burnaware.ini
[2012.04.27 22:40:16 | 000,032,768 | ---- | C] () -- C:\Windows\System32\drivers\sp_rsdrv2.sys
[2012.04.27 20:45:31 | 000,000,362 | ---- | C] () -- C:\Users\YuT666\.jajuk_bootstrap.xml
[2011.09.28 16:44:14 | 000,179,271 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.09.12 23:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\System32\atipblag.dat
[2011.04.12 02:30:05 | 000,653,928 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2011.04.12 02:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2011.04.12 02:30:05 | 000,129,800 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2011.04.12 02:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat
========== ZeroAccess Check ==========
[2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 05:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 22:29:20 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
========== LOP Check ==========
[2012.04.27 18:33:01 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\.kde
[2012.12.30 11:12:47 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\.minecraft
[2012.05.26 19:37:04 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\.minecraft_server
[2012.06.01 16:26:13 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\Bioshock2
[2013.01.19 16:13:41 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\BITS
[2012.09.30 09:43:07 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\CPC Loader
[2012.07.26 20:16:24 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\DesktopIconForAmazon
[2012.12.02 10:44:12 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\DVDVideoSoft
[2012.05.18 18:16:23 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\elsterformular
[2012.06.09 14:55:58 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\FFSJ
[2013.01.05 12:43:51 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\FlashGet
[2013.01.05 09:43:38 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\FlashGetBHO
[2013.01.05 09:43:41 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\FlashgetSetup
[2012.11.02 12:52:22 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\FreeFLVConverter
[2012.06.13 19:37:01 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\GameFly
[2012.06.09 19:05:11 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\GetRightToGo
[2012.07.08 05:53:32 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\GlarySoft
[2012.08.25 18:05:15 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\globalip
[2012.04.29 12:18:03 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\gtk-2.0
[2012.04.29 11:58:44 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\ImgBurn
[2012.05.03 11:13:03 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\Jaangle
[2012.12.01 21:54:07 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\MAXON
[2012.08.02 11:56:12 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\NJSTC
[2012.05.13 14:19:15 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\OpenOffice.org
[2012.04.27 15:55:26 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\PhotoFiltre
[2012.10.06 19:41:34 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\ProtectDISC
[2012.11.10 11:52:44 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\SendSpace
[2012.04.29 11:48:40 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\Software Update
[2012.05.04 09:26:04 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\T-Online
[2012.04.27 11:58:37 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\Thunderbird
[2012.12.02 00:50:18 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\TS3Client
[2012.06.23 15:46:13 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\Ubisoft
[2012.12.27 19:42:45 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\Visan
[2012.12.23 20:16:43 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\XnView
[2012.06.01 18:34:42 | 000,000,000 | ---D | M] -- C:\Users\YuT666\AppData\Roaming\ZombieDriver
========== Purity Check ==========
========== Custom Scans ==========
< %SYSTEMDRIVE%\*. >
[2012.08.25 05:34:24 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2012.07.14 11:21:10 | 000,000,000 | -H-D | M] -- C:\$WINDOWS.~BT
[2013.01.19 11:43:35 | 000,000,000 | ---D | M] -- C:\6
[2012.08.26 07:11:09 | 000,000,000 | ---D | M] -- C:\AMD
[2012.04.29 18:55:42 | 000,000,000 | ---D | M] -- C:\archive_db
[2012.04.27 11:58:46 | 000,000,000 | -HSD | M] -- C:\Boot
[2012.05.13 14:15:34 | 000,000,000 | ---D | M] -- C:\clean
[2013.01.19 11:08:48 | 000,000,000 | -HSD | M] -- C:\Config.Msi
[2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings
[2012.04.27 11:05:57 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2013.01.19 16:03:45 | 000,000,000 | --SD | M] -- C:\Downloads
[2012.05.31 07:41:11 | 000,000,000 | ---D | M] -- C:\HbUser
[2012.07.31 08:36:20 | 000,000,000 | ---D | M] -- C:\Infotext
[2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2013.01.19 10:59:24 | 000,000,000 | R--D | M] -- C:\Program Files
[2012.12.28 11:49:45 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2012.04.27 11:05:57 | 000,000,000 | -HSD | M] -- C:\Programme
[2012.04.27 11:05:57 | 000,000,000 | -HSD | M] -- C:\Recovery
[2013.01.19 16:16:58 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.10.05 15:39:49 | 000,000,000 | ---D | M] -- C:\T-Online Banking
[2012.12.30 16:47:55 | 000,000,000 | ---D | M] -- C:\toolbarImages
[2012.08.02 11:52:53 | 000,000,000 | ---D | M] -- C:\Tools
[2012.04.27 11:06:08 | 000,000,000 | R--D | M] -- C:\Users
[2013.01.09 19:14:01 | 000,000,000 | ---D | M] -- C:\Windows
< %PROGRAMFILES%\*.exe >
< %LOCALAPPDATA%\*.exe >
< %systemroot%\*. /mp /s >
< C:\Windows\system32\*.tsp >
[2009.07.14 02:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp
[2009.07.14 02:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp
[2009.07.14 02:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp
[2009.07.14 02:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp
[2010.11.20 22:29:06 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp
[2009.07.14 05:53:46 | 000,032,640 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT
[2009.07.14 05:53:47 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT
[2012.04.27 11:09:01 | 000,000,884 | ---- | C] () -- C:\Windows\Tasks\Adobe Flash Player Updater.job
[2012.04.27 15:19:58 | 000,001,094 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
[2012.04.27 15:20:00 | 000,001,098 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
[2012.04.29 11:37:28 | 000,000,336 | ---- | C] () -- C:\Windows\Tasks\GlaryInitialize.job
[2012.11.10 11:52:34 | 000,000,408 | -H-- | C] () -- C:\Windows\Tasks\OptimizerProUpdaterTask{6263A61B-8152-43AA-91DD-D1FB79FDCCA3}.job
< MD5 for: AGP440.SYS >
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
< MD5 for: ATAPI.SYS >
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
< MD5 for: CNGAUDIT.DLL >
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
< MD5 for: EXPLORER.EXE >
[2010.11.20 22:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\explorer.exe
[2010.11.20 22:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe
< MD5 for: IASTORV.SYS >
[2010.11.20 22:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\drivers\iaStorV.sys
[2010.11.20 22:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 22:29:03 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
< MD5 for: NETLOGON.DLL >
[2010.11.20 22:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010.11.20 22:29:12 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
< MD5 for: NVSTOR.SYS >
[2010.11.20 22:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\drivers\nvstor.sys
[2010.11.20 22:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 22:29:03 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
< MD5 for: SCECLI.DLL >
[2010.11.20 22:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010.11.20 22:29:07 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
< MD5 for: USER32.DLL >
[2010.11.20 22:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010.11.20 22:29:20 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
< MD5 for: USERINIT.EXE >
[2010.11.20 22:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010.11.20 22:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
< MD5 for: WINLOGON.EXE >
[2012.12.14 16:49:28 | 000,216,424 | ---- | M] () MD5=22101A85B3CA2FE2BE05FE9A61A7A83D -- C:\Tools\System\Security\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2010.11.20 22:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010.11.20 22:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
< MD5 for: WS2IFSL.SYS >
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
< %systemroot%\system32\drivers\*.sys /lockedfiles >
< %systemroot%\System32\config\*.sav >
< %systemroot%\system32\*.dll /lockedfiles >
[2012.09.28 02:39:14 | 000,442,368 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\system32\atidemgy.dll
[2009.07.14 02:15:36 | 000,226,816 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\LocationApi.dll
< %USERPROFILE%\*.* >
[2012.04.27 20:45:32 | 000,000,362 | ---- | M] () -- C:\Users\YuT666\.jajuk_bootstrap.xml
[2012.04.29 12:18:03 | 000,000,867 | ---- | M] () -- C:\Users\YuT666\.recently-used.xbel
[2012.06.15 15:53:44 | 000,000,212 | ---- | M] () -- C:\Users\YuT666\.swfinfo
[2013.01.19 16:16:48 | 007,864,320 | -HS- | M] () -- C:\Users\YuT666\NTUSER.DAT
[2013.01.19 16:16:48 | 000,262,144 | -HS- | M] () -- C:\Users\YuT666\ntuser.dat.LOG1
[2012.04.27 11:06:31 | 000,000,000 | -HS- | M] () -- C:\Users\YuT666\ntuser.dat.LOG2
[2012.04.27 11:37:53 | 000,065,536 | -HS- | M] () -- C:\Users\YuT666\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf
[2012.04.27 11:37:53 | 000,524,288 | -HS- | M] () -- C:\Users\YuT666\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms
[2012.04.27 11:37:53 | 000,524,288 | -HS- | M] () -- C:\Users\YuT666\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms
[2013.01.06 00:04:01 | 000,065,536 | -HS- | M] () -- C:\Users\YuT666\NTUSER.DAT{7ce805f6-5735-11e2-bd37-001f1f746886}.TM.blf
[2013.01.06 00:04:01 | 000,524,288 | -HS- | M] () -- C:\Users\YuT666\NTUSER.DAT{7ce805f6-5735-11e2-bd37-001f1f746886}.TMContainer00000000000000000001.regtrans-ms
[2013.01.06 00:04:01 | 000,524,288 | -HS- | M] () -- C:\Users\YuT666\NTUSER.DAT{7ce805f6-5735-11e2-bd37-001f1f746886}.TMContainer00000000000000000002.regtrans-ms
[2012.04.27 11:06:31 | 000,000,020 | -HS- | M] () -- C:\Users\YuT666\ntuser.ini
< %USERPROFILE%\Local Settings\Temp\*.exe >
< %USERPROFILE%\Local Settings\Temp\*.dll >
< %USERPROFILE%\Application Data\*.exe >
< HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs >
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data]
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16
========== Alternate Data Streams ==========
@Alternate Data Stream - 122 bytes -> C:\ProgramData\TEMP:373E1720
< End of report >
Code:
OTL Extras logfile created on: 19.01.2013 14:51:08 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\YuT666\Downloads
Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,25 Gb Total Physical Memory | 1,76 Gb Available Physical Memory | 54,13% Memory free
6,50 Gb Paging File | 4,89 Gb Available in Paging File | 75,34% Paging File free
Paging file location(s): i:\pagefile.sys 0 0 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 60,00 Gb Total Space | 10,51 Gb Free Space | 17,51% Space Free | Partition Type: NTFS
Drive D: | 177,87 Gb Total Space | 18,18 Gb Free Space | 10,22% Space Free | Partition Type: NTFS
Drive E: | 227,88 Gb Total Space | 19,60 Gb Free Space | 8,60% Space Free | Partition Type: NTFS
Drive F: | 170,01 Gb Total Space | 74,33 Gb Free Space | 43,72% Space Free | Partition Type: NTFS
Drive G: | 200,00 Gb Total Space | 112,07 Gb Free Space | 56,04% Space Free | Partition Type: NTFS
Drive H: | 65,76 Gb Total Space | 65,54 Gb Free Space | 99,67% Space Free | Partition Type: NTFS
Drive I: | 29,99 Gb Total Space | 26,62 Gb Free Space | 88,75% Space Free | Partition Type: NTFS
Drive O: | 1,86 Gb Total Space | 1,61 Gb Free Space | 86,22% Space Free | Partition Type: FAT32
Computer Name: YUT666-PC | User Name: YuT666 | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = ChromeHTML] -- C:\Program Files\Google\Chrome\Application\chrome.exe (Google Inc.)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromeHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
https [open] -- "C:\Program Files\Google\Chrome\Application\chrome.exe" -- "%1" (Google Inc.)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [TNCremo] -- C:\Tools\CNC\TNCremo\TNCremoNT.exe -w "%1" (DR. JOHANNES HEIDENHAIN GmbH)
Directory [TNCserver] -- C:\Tools\CNC\TNCremo\TNCserver.exe "%1" (DR. JOHANNES HEIDENHAIN GmbH)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Tools\Internet\FlashGet 3\FlashGet3.exe" = C:\Tools\Internet\FlashGet 3\FlashGet3.exe:*:Enabled:Flashget3 -- (Trend Media Corporation Limited)
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{17050D8F-8942-4893-849D-8918FF7BDA7A}" = lport=445 | protocol=6 | dir=in | app=system |
"{1941F0FC-B24A-4E97-A5C3-C0823777B919}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2E2C8541-2F12-4469-812C-0870BDD806A1}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{47A81665-1336-4B93-85E9-4C607A6F68CB}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4F25FF83-4867-4215-B4F7-4B1AC4C37BC0}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{500A4944-0B61-4A0D-A5CB-3CD1A58BD2DD}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{50A93EF8-7318-449F-8AF1-2B6291369B33}" = rport=139 | protocol=6 | dir=out | app=system |
"{6712B8C2-EC46-4766-A106-AB182C5922CC}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{77BC10D9-8A26-498E-96D3-C767D794A8D2}" = lport=139 | protocol=6 | dir=in | app=system |
"{7C48D365-4A98-442A-8C2A-7DDFAC81CFAD}" = rport=10243 | protocol=6 | dir=out | app=system |
"{7C9501BC-3B1A-4BFF-A16D-D22E99810663}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{82BE3E49-9939-4B06-B477-EB8070D876E6}" = rport=137 | protocol=17 | dir=out | app=system |
"{8F9F594A-9DCA-4A82-B878-39753F37D7A7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{957E5C50-36D4-47C7-9A61-8BA9B7CE4C39}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{A640F20A-608E-4FCC-A168-A790F3ED8095}" = rport=445 | protocol=6 | dir=out | app=system |
"{A95D8C2C-3D11-476E-8924-8653D75E83CB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{BB3CA46A-A76B-43D2-9416-141189FE075E}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{BDD952C2-5077-43E7-ACCD-BEDEF458A3E5}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C2F52610-6BB9-46E0-AC79-AC0752DA7A95}" = lport=137 | protocol=17 | dir=in | app=system |
"{C6B24557-4C00-43B3-BF18-8B8BC9830486}" = lport=138 | protocol=17 | dir=in | app=system |
"{E64AE0C8-E227-4BC4-90DC-6EFF7B43B826}" = rport=138 | protocol=17 | dir=out | app=system |
"{EA018113-4995-47AB-BABA-E97187C9F313}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EF942EC5-764B-4432-81D0-5F18A9F00D38}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F4EC4266-1E83-4F78-AF0C-D2B9A93A6FFF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F7478F5F-463F-4A46-AE05-CA0D92DC832C}" = lport=10243 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{050B066A-032F-4B63-B1BC-4FF527B9FF4D}" = protocol=6 | dir=in | app=f:\grand theft auto iv\gtaiv.exe |
"{0780131C-5E89-4346-AEF8-63520A15E0C9}" = protocol=17 | dir=in | app=f:\anno 2070\autopatcher.exe |
"{0BA3C067-E8C6-4756-BE4C-B38441E8C788}" = protocol=6 | dir=in | app=f:\crysis\bin32\crysis.exe |
"{0C319DD3-7235-42E3-AFCF-6975B90D3237}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{0E24332B-0F54-4BC5-B54A-602E2B39015F}" = protocol=6 | dir=in | app=f:\grand theft auto iv\launchgtaiv.exe |
"{0F4F8CBD-FEF4-4EDF-8941-DF26854144F2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{11D627EB-AE8B-40A9-987B-62318F122BCE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{138256F6-8271-4735-8962-BB371FD01410}" = protocol=6 | dir=in | app=f:\anno 2070\autopatcher.exe |
"{173182FA-2A90-4A56-BD01-F2C17756788D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1A1EDDF1-6613-4C1E-BB56-75F6ACBA65A0}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\flatout ultimate carnage\launcher.exe |
"{1B296A30-7097-4F92-9DAD-FD76C2FC4924}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\duke nukem forever\system\dukeforever.exe |
"{1E0C5BB5-10F8-4C67-8324-7CB2E01FA0C7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{202CBF28-8DA9-41E4-8924-1E5308A91ED9}" = protocol=6 | dir=in | app=f:\stronghold legends\strongholdlegends.exe |
"{222EBA8A-0435-4701-8756-47E8FB5531B7}" = protocol=6 | dir=out | app=system |
"{236031B9-C809-41A9-9355-6DDCFCEB5A47}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{24024999-1BC0-45FC-B8AD-D86ABAFFD472}" = protocol=6 | dir=in | app=f:\anno 2070\initengine.exe |
"{2696187F-4BE6-4CA3-BED7-F290FB795D59}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\aliens versus predator classic\avp_classic.exe |
"{2977D3DB-25EA-4438-9FB3-DF9266FFA4AE}" = protocol=17 | dir=in | app=f:\bioshock 2\sp\builds\binaries\bioshock2.exe |
"{29DAF31D-3AEE-447B-88EE-36C706B8AC90}" = protocol=6 | dir=in | app=c:\program files\rockstar games\rockstar games social club\rgsclauncher.exe |
"{2B0506F9-A28E-437A-964E-DEBDF1AAFB69}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\aliens versus predator classic\avp_classic.exe |
"{2FE555E4-5E0D-45A5-A017-0DC2AD317E4D}" = protocol=17 | dir=in | app=f:\bioshock 2\mp\builds\binaries\bioshock2.exe |
"{38963E3E-6BA0-4696-8627-B3E3788AF9FA}" = protocol=17 | dir=in | app=f:\anno 2070\initengine.exe |
"{39A49FBF-0270-4A9F-AB96-63FCA3CC6771}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{39F7326D-CFCC-4E2A-8B4E-F7AF4CC39AD8}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3CD69AD2-DA24-4E11-9439-9A23CBFA804D}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\duke nukem forever\system\dukeforever.exe |
"{43DE5A73-6B1F-43C1-B777-92007ED7103A}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{4625E41E-6ECB-49DB-9F4F-8E12D1FC52C6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{479D38D8-BC4F-404B-947D-F7EB4DBCF701}" = protocol=6 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{48964CFE-B774-4DC0-85BB-70FCBCC814C7}" = protocol=6 | dir=in | app=f:\anno 2070\anno5.exe |
"{4AA3F194-DE8B-4BC1-B5D1-C9A519A1F82F}" = protocol=6 | dir=in | app=f:\bioshock 2\sp\builds\binaries\bioshock2.exe |
"{4B505131-5E58-40BC-BE83-089BC8AE8EC3}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{4B89AB06-F6F0-4DC7-A197-EB3CC8FF6CF2}" = protocol=6 | dir=in | app=f:\tom clancy's h.a.w.x\hawx.exe |
"{4EB3C91A-03B4-4D43-8B11-81E258FF0AD9}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{52396B40-E58B-4A8F-BFD6-3E104E601D5D}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\flatout ultimate carnage\launcher.exe |
"{5DEEC7E9-A94D-422C-BB90-9173F703417D}" = protocol=17 | dir=in | app=f:\anno 2070\anno5.exe |
"{62F6C6A4-6C66-4FD4-9B44-4D93222376AE}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\fallout 3 goty\falloutlauncher.exe |
"{66659ACF-762D-4876-BC14-A625F2A85F42}" = protocol=6 | dir=in | app=c:\windows\system32\msiexec.exe |
"{6B53B46E-000F-42D4-A8AF-0E76E9E23E5E}" = protocol=6 | dir=in | app=f:\steam\steamapps\common\duke nukem forever\system\dukeforever.exe |
"{719CFA65-CA7D-4E50-B193-1BDE5CD352D5}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\stalker clear sky\bin\xrengine.exe |
"{8F9E9345-0DEA-4CA1-ADCA-95089B0F6863}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\post apocalyptic mayhem\pammaingame.exe |
"{90A525E3-D223-4328-9D43-397071B8C9D6}" = dir=in | app=c:\users\yut666\appdata\local\microsoft\skydrive\skydrive.exe |
"{923AD8E3-4516-4B00-88D3-740DDF44EEAE}" = protocol=17 | dir=in | app=f:\steam\steamapps\common\fallout new vegas\falloutnvlauncher.exe |
"{95D2B8EF-5638-471E-8A82-2F9E8A57B574}" = protocol=6 | dir=in | app=f:\steam\steamapps\common\fallout new vegas\falloutnvlauncher.exe |
"{95E860E6-1042-4721-9566-2498664E4E33}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{9668EE34-1178-421A-BD54-2C72FC6BA3E6}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{9A39FD85-A3D1-4752-93BE-B008CF1234E9}" = protocol=17 | dir=in | app=f:\tom clancy's h.a.w.x\hawx.exe |
"{9D8683CD-F632-4C72-AD2D-34763EF87210}" = protocol=17 | dir=in | app=c:\program files\rockstar games\rockstar games social club\rgsclauncher.exe |
"{A1C02604-11B4-4747-88C5-05C52BF5B283}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{A2961EAB-15AE-4705-9D7B-831EFF7F471A}" = protocol=17 | dir=in | app=f:\stronghold legends\strongholdlegends.exe |
"{A81580BC-D09F-4414-9764-2B3252DF4DD8}" = protocol=6 | dir=in | app=f:\crysis\bin32\crysisdedicatedserver.exe |
"{AA2BAEAB-5D3C-4119-A683-66A9EA8A4EAB}" = protocol=17 | dir=in | app=c:\windows\system32\msiexec.exe |
"{ABAE9F60-B197-44A3-8A99-9E1A7B51B6EE}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{AEC7CB68-3F45-4CCF-A3D3-7F9025128F4D}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\mafia ii\pc\mafia2.exe |
"{B84F61D0-DBF2-4091-B0A3-649028BA02E7}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\alien swarm\swarm.exe |
"{C4408D79-33D6-4183-BA21-F0AD3E27548D}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C4F76B44-10F5-4B6B-94DF-CF8F357C8C42}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\post apocalyptic mayhem\pammaingame.exe |
"{CA9A2041-96AF-4AAE-A313-DD0C65C24FFF}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{CE0F719B-F14A-4972-BC53-409114D6B0EC}" = protocol=6 | dir=in | app=f:\tom clancy's h.a.w.x\hawx_dx10.exe |
"{D1B7D94C-4897-46DD-9B38-29423EB2F60A}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\alien swarm\swarm.exe |
"{D3980980-D4AC-466C-969C-452D155F471D}" = protocol=17 | dir=in | app=f:\tom clancy's h.a.w.x\hawx_dx10.exe |
"{D51BA1B3-F450-4C9D-B468-6F9A6553F51B}" = protocol=6 | dir=in | app=f:\bioshock 2\mp\builds\binaries\bioshock2.exe |
"{DB147C95-6BA3-427A-9A10-9764D749E42E}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\left 4 dead 2\left4dead2.exe |
"{E02B660F-2CEB-40D1-BA8D-D63EECA7CD86}" = protocol=17 | dir=in | app=f:\steam\steamapps\common\duke nukem forever\system\dukeforever.exe |
"{E08F48A3-6CF1-4E40-A44E-6CBA8191AEB7}" = protocol=17 | dir=in | app=g:\steam\steamapps\common\stalker clear sky\bin\xrengine.exe |
"{E35529F0-C94A-4732-8611-F845AD7E09EE}" = protocol=17 | dir=in | app=c:\program files\sweetim\communicator\sweetpacksupdatemanager.exe |
"{EA4A4CDE-6E43-4CDB-9938-4C5065B2B4C6}" = protocol=17 | dir=in | app=f:\crysis\bin32\crysisdedicatedserver.exe |
"{F18D08A7-D2F4-4484-A0FF-FAF9D4E991F8}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{F27CEBB2-D90E-42C3-9057-59F506F8536A}" = protocol=17 | dir=in | app=f:\grand theft auto iv\gtaiv.exe |
"{F2E7E1F5-6F9D-41A7-AB2D-66125F4057DF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F3AD664F-02D1-41F1-B56E-3003722581F3}" = protocol=17 | dir=in | app=f:\crysis\bin32\crysis.exe |
"{F47302E3-267A-43A9-B1C1-C8944C6701B7}" = protocol=6 | dir=in | app=g:\steam\steamapps\common\fallout 3 goty\falloutlauncher.exe |
"{F59C56BD-FA01-476F-A88E-0D9AB3306D32}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{FA1192DE-B448-4326-A055-08173783D14A}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{FD5AE02E-2352-4E24-8F3C-A75A1CBA8856}" = protocol=17 | dir=in | app=f:\grand theft auto iv\launchgtaiv.exe |
"TCP Query User{0058429A-D71C-4DB8-9B23-2AFBA358767D}C:\tools\cnc\itnc530\sys\bin\ext.exe" = protocol=6 | dir=in | app=c:\tools\cnc\itnc530\sys\bin\ext.exe |
"TCP Query User{08208DF5-DD90-436E-B4E2-3AAA85FE0A7F}C:\tools\cnc\itnc530\sys\bin\regel.exe" = protocol=6 | dir=in | app=c:\tools\cnc\itnc530\sys\bin\regel.exe |
"TCP Query User{0EF63B95-CB01-4C06-9366-4C5543745113}F:\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=6 | dir=in | app=f:\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
"TCP Query User{0FF1ECF2-DA12-4EE2-B7E7-E783FF497580}C:\tools\internet\flashget 3\flashget3.exe" = protocol=6 | dir=in | app=c:\tools\internet\flashget 3\flashget3.exe |
"TCP Query User{13ED96AE-EE6E-405A-ADE5-EE1C800AB5C0}F:\tmnationsforever\tmforever.exe" = protocol=6 | dir=in | app=f:\tmnationsforever\tmforever.exe |
"TCP Query User{218894DC-5709-4652-BB48-D60EA250E1BE}C:\tools\cnc\itnc530\sys\bin\geo.exe" = protocol=6 | dir=in | app=c:\tools\cnc\itnc530\sys\bin\geo.exe |
"TCP Query User{43EB4DBA-289D-4C30-A2AF-F25011319EBD}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"TCP Query User{5315171F-927A-430B-92F4-D2DEEFEC60A2}C:\users\yut666\downloads\nanortmp\nanortmp\rtmpexplorer2\rtmpsuck.exe" = protocol=6 | dir=in | app=c:\users\yut666\downloads\nanortmp\nanortmp\rtmpexplorer2\rtmpsuck.exe |
"TCP Query User{57B690B0-3671-440A-A4DB-185E710653B5}C:\tools\cnc\sscnc\server\sshttp.exe" = protocol=6 | dir=in | app=c:\tools\cnc\sscnc\server\sshttp.exe |
"TCP Query User{58220C87-B887-4B46-B6FA-F5451F5ABB70}C:\windows\system32\javaw.exe" = protocol=6 | dir=in | app=c:\windows\system32\javaw.exe |
"TCP Query User{7B3202E5-3125-4E1F-9BE2-BFCA697AC894}C:\tools\cnc\sscnc\server\sscncsrv.exe" = protocol=6 | dir=in | app=c:\tools\cnc\sscnc\server\sscncsrv.exe |
"TCP Query User{9DFB57EC-D127-4F74-ADEB-57A73176D068}C:\tools\cnc\itnc530\xwin\bin\xwin.exe" = protocol=6 | dir=in | app=c:\tools\cnc\itnc530\xwin\bin\xwin.exe |
"TCP Query User{9FED7081-F215-4B09-8A05-E88C6FCBD1B1}C:\Program Files\Java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\java.exe |
"TCP Query User{AB658A23-8000-4C0C-841C-17B5C227DA01}C:\tools\internet\flashget 3\flashget3.exe" = protocol=6 | dir=in | app=c:\tools\internet\flashget 3\flashget3.exe |
"TCP Query User{B1E268A1-557E-4754-A11E-C087523A0A76}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"TCP Query User{C4742F8B-22BD-42EB-B445-E01186BA0DF4}C:\tools\cnc\itnc530\sys\bin\plc.exe" = protocol=6 | dir=in | app=c:\tools\cnc\itnc530\sys\bin\plc.exe |
"TCP Query User{E46E9F29-97B6-4C24-BCCD-79AA2FF20201}C:\users\yut666\downloads\nanortmp\nanortmp\rtmpexplorer2\rtmpsrv.exe" = protocol=6 | dir=in | app=c:\users\yut666\downloads\nanortmp\nanortmp\rtmpexplorer2\rtmpsrv.exe |
"TCP Query User{EA8783B8-4389-4D15-8B44-EEEFE2372861}G:\steam\steamapps\common\moon base alpha\binaries\win32\moonbasealphagame.exe" = protocol=6 | dir=in | app=g:\steam\steamapps\common\moon base alpha\binaries\win32\moonbasealphagame.exe |
"TCP Query User{F69E1B6C-E8AF-4789-822B-989CAED50FBB}C:\tools\cnc\sscnc\server\ssftp.exe" = protocol=6 | dir=in | app=c:\tools\cnc\sscnc\server\ssftp.exe |
"UDP Query User{0F1CA0E2-BF82-4D50-B8BC-958CF17A7656}F:\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe" = protocol=17 | dir=in | app=f:\steam\steamapps\common\company of heroes\relicdownloader\relicdownloader.exe |
"UDP Query User{1C3C90DB-7FF6-4B11-B6F6-160F87080740}C:\tools\cnc\itnc530\sys\bin\plc.exe" = protocol=17 | dir=in | app=c:\tools\cnc\itnc530\sys\bin\plc.exe |
"UDP Query User{1C4AF434-8AF7-40EA-9E11-4EB1BFB5515D}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe |
"UDP Query User{37D6ECD9-827E-4A5B-866A-3FD15AD35688}C:\Program Files\Java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\java.exe |
"UDP Query User{4D098172-9BCB-4EE5-8E95-57A494C7165B}C:\tools\cnc\itnc530\xwin\bin\xwin.exe" = protocol=17 | dir=in | app=c:\tools\cnc\itnc530\xwin\bin\xwin.exe |
"UDP Query User{5D6FABEE-58F9-4437-9803-3FAAC8DC4FEF}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe |
"UDP Query User{60307A55-2738-4B3C-A59A-4EC3EA9843A1}C:\tools\cnc\sscnc\server\sscncsrv.exe" = protocol=17 | dir=in | app=c:\tools\cnc\sscnc\server\sscncsrv.exe |
"UDP Query User{84F3A718-CA3D-40D0-9680-2044F8589814}C:\tools\cnc\sscnc\server\ssftp.exe" = protocol=17 | dir=in | app=c:\tools\cnc\sscnc\server\ssftp.exe |
"UDP Query User{986FF2A7-9D37-4E1E-B558-2380509B90C8}C:\tools\internet\flashget 3\flashget3.exe" = protocol=17 | dir=in | app=c:\tools\internet\flashget 3\flashget3.exe |
"UDP Query User{A5DACD91-5EBD-48FA-A28D-E86037BF4A49}C:\tools\cnc\sscnc\server\sshttp.exe" = protocol=17 | dir=in | app=c:\tools\cnc\sscnc\server\sshttp.exe |
"UDP Query User{B6283601-60B7-413D-98DA-F95AC636D4D4}C:\tools\cnc\itnc530\sys\bin\ext.exe" = protocol=17 | dir=in | app=c:\tools\cnc\itnc530\sys\bin\ext.exe |
"UDP Query User{C6376DCC-D1BA-47F2-A8E6-BEAD79F0851D}C:\users\yut666\downloads\nanortmp\nanortmp\rtmpexplorer2\rtmpsuck.exe" = protocol=17 | dir=in | app=c:\users\yut666\downloads\nanortmp\nanortmp\rtmpexplorer2\rtmpsuck.exe |
"UDP Query User{C7A2C5FA-5061-45C8-990E-BC872174E614}C:\tools\cnc\itnc530\sys\bin\geo.exe" = protocol=17 | dir=in | app=c:\tools\cnc\itnc530\sys\bin\geo.exe |
"UDP Query User{CB929F9D-8510-4672-A778-2953205C1D19}G:\steam\steamapps\common\moon base alpha\binaries\win32\moonbasealphagame.exe" = protocol=17 | dir=in | app=g:\steam\steamapps\common\moon base alpha\binaries\win32\moonbasealphagame.exe |
"UDP Query User{D4A7D45E-79AC-41B5-A111-A3CDC1314936}C:\tools\internet\flashget 3\flashget3.exe" = protocol=17 | dir=in | app=c:\tools\internet\flashget 3\flashget3.exe |
"UDP Query User{E021CC2B-89CE-4A97-93EC-22C63B5F1DC8}C:\windows\system32\javaw.exe" = protocol=17 | dir=in | app=c:\windows\system32\javaw.exe |
"UDP Query User{E2BDC2E8-D531-4827-8FE6-58AE118CB09A}C:\tools\cnc\itnc530\sys\bin\regel.exe" = protocol=17 | dir=in | app=c:\tools\cnc\itnc530\sys\bin\regel.exe |
"UDP Query User{E90B6AEC-A1F9-41A5-9737-716338EB00CD}C:\users\yut666\downloads\nanortmp\nanortmp\rtmpexplorer2\rtmpsrv.exe" = protocol=17 | dir=in | app=c:\users\yut666\downloads\nanortmp\nanortmp\rtmpexplorer2\rtmpsrv.exe |
"UDP Query User{EB77801D-5194-48B8-AAA6-473CC79B9DA6}F:\tmnationsforever\tmforever.exe" = protocol=17 | dir=in | app=f:\tmnationsforever\tmforever.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{000E79B7-E725-4F01-870A-C12942B7F8E4}" = Crysis(R)
"{00277C92-28A4-4A4F-828C-3C7C15732E9E}" = Banking
"{03CC9D58-B132-4CC0-A521-4F3660AA43C7}" = Movie Maker
"{0454BB9A-2A7A-4214-BDFF-937F7A711A44}" = Windows Live Communications Platform
"{08B3869E-D282-424C-9AFC-870E04A4BA14}" = Rockstar Games Social Club
"{0F7A6FD0-87F5-FB5D-973C-CF604DE1BC6B}" = CCC Help Polish
"{1111706F-666A-4037-7777-211328764D10}" = JavaFX 2.1.1
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{15F3A6F5-06AE-4332-AE3E-21CD0416827A}" = Windows Live Mail
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1A9BE3D6-4D53-2C9D-B77D-562D85936B91}" = CCC Help Norwegian
"{1B947146-366B-42CD-86D5-219993CE3EE2}" = Windows Live MIME IFilter
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{210DFA65-F805-1A2B-4F83-8E27279AE385}" = Catalyst Control Center Graphics Previews Common
"{26A24AE4-039D-4CA4-87B4-2F83216022F0}" = Java(TM) 6 Update 22
"{26A24AE4-039D-4CA4-87B4-2F83216031FF}" = Java(TM) 6 Update 31
"{26A24AE4-039D-4CA4-87B4-2F83217007FF}" = Java 7 Update 11
"{28E82311-8616-11E1-BEB0-B8AC6F97B88E}" = Google Earth
"{29822CAD-C76A-0BEE-55F5-AAA524DA814F}" = CCC Help Greek
"{30F99474-EBE3-4134-A02B-F6CD38CFE243}" = Photo Gallery
"{34A153FE-6926-4C14-B48A-B71E68C672A8}_is1" = MiniTool Partition Wizard Home Edition 7.1
"{3A1293DF-7D09-BB0F-9576-EC47EE4A9362}" = CCC Help Italian
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3C3DCD2B-6FC7-41BF-BB80-40A936E1A785}" = Windows Live Writer
"{3CBD94C1-BA15-488C-888B-D8DD296CC6DC}" = Fotogalerie
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{400C31E4-796F-4E86-8FDC-C3C4FACC6847}" = Junk Mail filter update
"{4286716B-1287-48E7-9078-3DC8248DBA96}" = OpenOffice.org 3.3
"{430912D2-51D8-1CB9-3B38-79D570F034DC}" = AMD Accelerated Video Transcoding
"{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}" = 3DMark 11
"{47416F0B-6589-591E-C6F8-4235D2230B14}" = Catalyst Control Center InstallProxy
"{4926AA2D-3C66-443D-A456-53AE3FA44144}" = Windows Live Family Safety
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A8B461A-9336-4CF9-98F4-14DD38E673F0}" = BioShock 2
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4CCBD1F4-CEEC-452A-9CB8-46564B501315}" = Windows Live UX Platform
"{4E31D9A6-245B-41A6-949D-C7B029A703D2}" = iTNC530 (340494)
"{4F6B6582-B9F6-42B2-AAFC-48E097D07837}_is1" = Aurora 3D Text & Logo Maker version 11.12.22
"{5285F904-1577-5F06-FF04-4FA4EBA52966}" = AMD Media Foundation Decoders
"{5454085C-129F-416C-9C0B-8B1000058301}" = BioShock 2
"{579BA58C-F33D-4970-9953-B94B43768AC3}" = Grand Theft Auto IV
"{625FC7D1-656D-1BEC-F86F-3EACAFDAA8FE}" = CCC Help English
"{66A405D2-BA14-4594-BF36-B3B544F0754E}" = Stronghold Legends
"{690F5BA3-5DEB-42CD-962B-F687EE59FAA7}" = Windows Live Essentials
"{6A8DB215-7BCD-4377-B015-2E4541A3E7C6}" = Windows Live PIMT Platform
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{6E36A172-06FB-4BC8-B7FC-D30D219E6776}" = Tom Clancy's H.A.W.X
"{70854FE6-3BF1-4C69-94D0-BEB821102E34}" = Windows Live Mail
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7351EEF8-9D6C-5F46-5A19-F2C7456CE132}" = CCC Help German
"{74852D78-260B-0612-89EE-D414414CFF60}" = GameFly
"{759E97EC-9E3D-4F55-C321-7819C93F0887}" = ccc-utility
"{7F172E34-4107-8964-6AEA-5051FFD265FF}" = CCC Help Portuguese
"{8256F87F-8554-4457-8C3D-3F3324697D9F}" = Windows Live ID Sign-in Assistant
"{832BB2A2-F100-4CFE-8D8B-C1A143B8B6B6}_is1" = Condemned - Criminal Origins
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{85CE9026-C02A-46B4-B08C-4C77CCCC54FF}" = Windows Live Family Safety
"{86095E92-1959-8364-920E-82E81F64F8FB}" = AMD VISION Engine Control Center
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8913AC02-67B8-4B52-91B2-BBA7B9C265B5}" = Windows Live Writer Resources
"{89D05F35-933A-89C0-B935-C92BEE4229BD}" = CCC Help French
"{8A642ACD-CE3A-4A23-A8B1-A0F7EB12B214}" = Windows Live SOXE Definitions
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E14DDC8-EA60-4E18-B3E3-1937104D5BDA}" = MSVCRT110
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{959E4378-CCA1-E4E4-2425-793DA92E8D95}" = CCC Help Czech
"{96BB3C67-4EB4-9757-E0C2-C0D2FE9053B1}" = CCC Help Turkish
"{974F4B73-2017-E174-9070-3F58F01B341F}" = CCC Help Danish
"{97A8C4B4-2B50-42D1-AFE6-5E8433185436}_is1" = Cryostasis (Remove Only)
"{97C79BEC-43F7-4BD8-A6A7-85C0257E488A}" = Windows Live Writer
"{98E20A18-3C29-86FA-50B4-918C2B34A082}" = CCC Help Hungarian
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9AD6518A-539D-8E0D-2C72-E51A62978096}" = AMD Drag and Drop Transcoding
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9E2E5EB3-DC6E-9277-E9DB-13175E7DDA39}" = CCC Help Dutch
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A25FF1C0-80B6-4B8B-A551-DC525697A408}" = AMD APP SDK Runtime
"{A2EAE643-8804-9420-5DBE-2752D6957964}" = AMD Catalyst Install Manager
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A64240FF-9C31-4858-AE9D-65483C5DE63A}" = Living Hell Light
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{AAACC0A5-4382-04D0-C75E-0669C7B949B6}" = CCC Help Japanese
"{ACEF4078-9B86-2455-E18D-34D52D37D9D5}" = CCC Help Chinese Standard
"{AE364ACC-B9DF-466B-B4EA-AEECD0CD581E}" = Windows Live Messenger
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B48E264C-C8CD-4617-B0BE-46E977BAD694}" = ANNO 2070
"{B55FB422-B803-11F5-5582-B3666EA1B9AC}" = Catalyst Control Center Localization All
"{B727564C-47D3-473A-AC9E-F4BE7B1BD5D3}" = Windows Live UX Platform Language Pack
"{B8010864-15F8-613B-20EF-AC35B14B3E0D}" = CCC Help Russian
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C1342411-5A98-DE8A-5629-D0C518E1C280}" = CCC Help Finnish
"{C268B5E1-A5DA-11DF-A289-005056C00008}" = Paragon Backup & Recovery™ 2012 Free
"{C424CD5E-EA05-4D3E-B5DA-F9F149E1D3AC}" = Windows Live Installer
"{C9A87D86-FDFD-418B-BF96-EF09320973B3}" = PC Inspector smart recovery
"{C9B6EFD0-4F01-4BBA-8374-39AD99A3ED72}" = Windows Live Photo Common
"{D08B4177-5160-6B66-8934-2F9012134D61}" = CCC Help Thai
"{D0D7FF19-F218-4783-B79F-01CD1EF19900}" = VPNAutoconnect
"{D2C146B1-948D-47EF-8387-5D1C6B980F7C}" = Windows Live Writer
"{D344E559-FA0B-44EC-AAD5-1BD6D464C5E2}" = TNCremo
"{D34A6029-FB1A-9EA8-A938-5393F82A3A00}" = CCC Help Korean
"{D47087E7-AA15-4D1D-8C0A-60F7E446D597}" = PSP ISO Compressor
"{DEDF2885-0086-4534-9912-F9B97377ED07}" = AGEIA GAME System Software
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E1203F8C-FF34-4968-A4A5-B4F1F8533DAB}" = Photo Common
"{E2F0AF23-FE2F-4222-9A43-55E63CC41EF1}" = Catalyst Control Center - Branding
"{E3A09D13-4D40-3CF8-7D32-8BD55F8D1533}" = CCC Help Spanish
"{EA8FA6BE-29BE-4AF2-9352-841F83215EB0}" = Update Manager for SweetPacks 1.1
"{ED6C77F9-4D7E-447C-9EC0-9A212D075535}" = Movie Maker
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{EE74D039-45D7-44E9-BF95-B9CFB015964F_P1Sec}_is1" = ArcaniA - Gothic 4 Patch
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F2235E5E-7881-4293-9B6F-04B2609FBFF0}" = Windows Live Messenger
"{F2C35491-9323-3AE7-6023-6B4128045153}" = CCC Help Swedish
"{FA042EF2-5103-2F7E-C313-976C6F761EBE}" = AMD Fuel
"{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1" = StreamTransport version: 1.0.2.2171
"{FC66A32F-1A57-AC5C-4F12-DAC2F4CB77A0}" = CCC Help Chinese Traditional
"{FE7C0B3D-50B9-4951-BE78-A321CBF86552}" = Windows Live SOXE
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Aomei Dynamic Disk Manager Home Edition_is1" = Aomei Dynamic Disk Manager Home Edition
"ArcaniA" = ArcaniA - Gothic 4
"avast" = avast! Free Antivirus
"Burn4Free DVD Burning_is1" = Burn4Free DVD Burning 6.0.0.0
"BurnAware Free_is1" = BurnAware Free 4.8
"CdCoverCreator" = CdCoverCreator 2.5.3
"DATAPILOT 4110 V642" = DataPilot 4110 (362834-05)
"DesktopIconAmazon" = Desktop Icon für Amazon
"EaseUS Partition Master Home Edition_is1" = EaseUS Partition Master 9.1.1 Home Edition
"EASEUS Partition Recovery_is1" = EASEUS Partition Recovery 5.0.1
"ElsterFormular" = ElsterFormular
"ESET Online Scanner" = ESET Online Scanner v3
"FlashGet3.7" = FlashGet3.7
"Free Audio Converter_is1" = Free Audio Converter version 5.0.20.1031
"Free FLV Converter_is1" = Free FLV Converter V 7.5.0
"GameFly" = GameFly
"GearGrinder_is1" = GearGrinder
"Glary Utilities_is1" = Glary Utilities 2.47.0.1539
"Google Chrome" = Google Chrome
"Hardlock Gerätetreiber" = Hardlock Gerätetreiber
"HD Tune_is1" = HD Tune 2.55
"HDD Capacity Restore_is1" = HDD Capacity Restore 1.2
"ImgBurn" = ImgBurn
"Jaangle music management" = Jaangle music management
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.70.0.1100
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Mozilla Firefox 18.0.1 (x86 de)" = Mozilla Firefox 18.0.1 (x86 de)
"Mozilla Thunderbird 17.0.2 (x86 de)" = Mozilla Thunderbird 17.0.2 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"OpenAL" = OpenAL
"Outcast_is1" = Outcast
"Recuva" = Recuva
"Software Update" = Software Update 1.2.0.172
"Steam App 12360" = FlatOut: Ultimate Carnage
"Steam App 20510" = S.T.A.L.K.E.R.: Clear Sky
"Steam App 22370" = Fallout 3 - Game of the Year Edition
"Steam App 22380" = Fallout: New Vegas
"Steam App 50130" = Mafia II
"Steam App 550" = Left 4 Dead 2
"Steam App 564" = Left 4 Dead 2 Add-on Support
"Steam App 57900" = Duke Nukem Forever
"Swansoft CNC Simulator" = Swansoft CNC Simulator 6.8.0.1
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TmNationsForever_is1" = TmNationsForever
"UnderCoverXP_is1" = UnderCoverXP 1.23
"Unigine Heaven DX11 Benchmark (Basic Edition)_is1" = Heaven DX11 Benchmark version 3.0
"Wildlife Park 3_is1" = Wildlife Park 3 v1.09
"WinGimp-2.0_is1" = GIMP 2.6.12-2
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.11 (32-Bit)
"Zombie Driver" = Zombie Driver 1.2.2
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Living Hell Light" = Living Hell Light
"PhotoFiltre" = PhotoFiltre
"SkyDriveSetup.exe" = Microsoft SkyDrive
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 15.01.2013 11:38:33 | Computer Name = YuT666-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: atieclxx.exe, Version: 6.14.11.1131,
Zeitstempel: 0x5064ffa2 Name des fehlerhaften Moduls: atieclxx.exe, Version: 6.14.11.1131,
Zeitstempel: 0x5064ffa2 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000181fa ID des fehlerhaften
Prozesses: 0x111c Startzeit der fehlerhaften Anwendung: 0x01cdf3365f995533 Pfad der
fehlerhaften Anwendung: C:\Windows\system32\atieclxx.exe Pfad des fehlerhaften Moduls:
C:\Windows\system32\atieclxx.exe Berichtskennung: 9e38ac6f-5f29-11e2-954d-d33f135cc3c8
Error - 16.01.2013 03:41:02 | Computer Name = YuT666-PC | Source = WinMgmt | ID = 10
Description =
Error - 17.01.2013 05:35:05 | Computer Name = YuT666-PC | Source = WinMgmt | ID = 10
Description =
Error - 17.01.2013 08:36:23 | Computer Name = YuT666-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Tools\System\Security\spybot
- search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\Tools\System\Security\spybot
- search & destroy\DelZip179.dll" in Zeile 8. Der Wert "*" des "language"-Attributs
im assemblyIdentity-Element ist ungültig.
Error - 18.01.2013 03:01:24 | Computer Name = YuT666-PC | Source = WinMgmt | ID = 10
Description =
Error - 18.01.2013 04:33:23 | Computer Name = YuT666-PC | Source = SideBySide | ID = 16842815
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\Tools\System\Security\spybot
- search & destroy\DelZip179.dll". Fehler in Manifest- oder Richtliniendatei "c:\Tools\System\Security\spybot
- search & destroy\DelZip179.dll" in Zeile 8. Der Wert "*" des "language"-Attributs
im assemblyIdentity-Element ist ungültig.
Error - 18.01.2013 07:08:06 | Computer Name = YuT666-PC | Source = WinMgmt | ID = 10
Description =
Error - 18.01.2013 13:21:01 | Computer Name = YuT666-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Banking.exe, Version: 6.9.3.3, Zeitstempel:
0x4f86ba74 Name des fehlerhaften Moduls: HAUPTA~1.OCX, Version: 6.9.3.2, Zeitstempel:
0x4f46317d Ausnahmecode: 0xc0000005 Fehleroffset: 0x000067fa ID des fehlerhaften Prozesses:
0x16a0 Startzeit der fehlerhaften Anwendung: 0x01cdf5a0205e9483 Pfad der fehlerhaften
Anwendung: C:\Tools\Office\T-Online Banking\Banking.exe Pfad des fehlerhaften Moduls:
C:\Tools\Office\T-ONLI~1\HAUPTA~1.OCX Berichtskennung: 6db60e0e-6193-11e2-8c06-f635a10d71f8
Error - 19.01.2013 04:13:43 | Computer Name = YuT666-PC | Source = WinMgmt | ID = 10
Description =
Error - 19.01.2013 06:08:32 | Computer Name = YuT666-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: iexplore.exe, Version: 9.0.8112.16457,
Zeitstempel: 0x50a2f9e3 Name des fehlerhaften Moduls: aswWebRepIE.dll, Version:
7.0.1474.765, Zeitstempel: 0x50905939 Ausnahmecode: 0x40000015 Fehleroffset: 0x0001b14c
ID
des fehlerhaften Prozesses: 0xaa4 Startzeit der fehlerhaften Anwendung: 0x01cdf62cec9f5c30
Pfad
der fehlerhaften Anwendung: C:\Program Files\Internet Explorer\iexplore.exe Pfad
des fehlerhaften Moduls: C:\Tools\System\Security\Avast\aswWebRepIE.dll Berichtskennung:
2d40dca7-6220-11e2-825e-bb03081995f7
[ System Events ]
Error - 16.09.2012 11:59:50 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 19.09.2012 01:35:25 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 22.09.2012 02:35:22 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 23.09.2012 02:23:17 | Computer Name = YuT666-PC | Source = DCOM | ID = 10010
Description =
Error - 25.09.2012 12:41:10 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 27.09.2012 04:29:20 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 30.09.2012 09:48:49 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 02.10.2012 05:24:57 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 03.10.2012 05:37:36 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
Error - 04.10.2012 03:19:26 | Computer Name = YuT666-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
< End of report >
|
