| Malwarepro | 12.04.2015 16:14 |
Hi Schrauber, OTL: Code:
OTL logfile created on: 12.04.2015 17:08:18 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin.***-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17691)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 60,71% Memory free
8,00 Gb Paging File | 6,11 Gb Available in Paging File | 76,41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 247,82 Gb Total Space | 17,09 Gb Free Space | 6,90% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 69,99 Mb Free Space | 69,99% Space Free | Partition Type: NTFS
Drive E: | 683,59 Gb Total Space | 381,73 Gb Free Space | 55,84% Space Free | Partition Type: NTFS
Drive F: | 3,61 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 931,51 Gb Total Space | 13,94 Gb Free Space | 1,50% Space Free | Partition Type: NTFS
Computer Name: ***-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\Admin.***-PC\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Avast\avastui.exe (Avast Software s.r.o.)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_17_0_0_134.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes Anti-Malware\mbam.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Avast\AvastSvc.exe (Avast Software s.r.o.)
PRC - C:\Program Files\CyberGhost 5\Service.exe (CyberGhost S.R.L)
========== Modules (No Company Name) ==========
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll ()
MOD - C:\Program Files (x86)\Avast\libcef.dll ()
MOD - C:\Program Files (x86)\Avast\libglesv2.dll ()
MOD - C:\Program Files (x86)\Avast\libegl.dll ()
MOD - C:\Program Files (x86)\Avast\log.dll ()
MOD - C:\Program Files (x86)\Avast\JsonRpcServer.dll ()
========== Services (SafeList) ==========
SRV:64bit: - (GfExperienceService) -- C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe (NVIDIA Corporation)
SRV:64bit: - (NvStreamSvc) -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamsvc.exe (NVIDIA Corporation)
SRV:64bit: - (IEEtwCollectorService) -- C:\Windows\SysNative\IEEtwCollector.exe (Microsoft Corporation)
SRV:64bit: - (CGVPNCliService) -- C:\Program Files\CyberGhost 5\Service.exe (CyberGhost S.R.L)
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (iprip) -- C:\Windows\SysNative\iprip.dll (Microsoft Corporation)
SRV - (Origin Client Service) -- E:\Programme\Origin\OriginClientService.exe (Electronic Arts)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (MBAMScheduler) -- C:\Program Files (x86)\Malwarebytes Anti-Malware\mbamscheduler.exe (Malwarebytes Corporation)
SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (NvNetworkService) -- C:\Program Files (x86)\NVIDIA Corporation\NetService\NvNetworkService.exe (NVIDIA Corporation)
SRV - (avast! Antivirus) -- C:\Program Files (x86)\Avast\AvastSvc.exe (Avast Software s.r.o.)
SRV - (AvastVBoxSvc) -- C:\Program Files (x86)\Avast\ng\vbox\AvastVBoxSVC.exe (Avast Software)
SRV - (SkypeUpdate) -- E:\Program Files (x86)\Updater\Updater.exe (Skype Technologies)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (BITCOMET_HELPER_SERVICE) -- C:\Program Files (x86)\BitComet\tools\BitCometService.exe (www.BitComet.com)
SRV - (WAS) -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (W3SVC) -- C:\Windows\SysWOW64\inetsrv\iisw3adm.dll (Microsoft Corporation)
SRV - (AppHostSvc) -- C:\Windows\SysWOW64\inetsrv\apphostsvc.dll (Microsoft Corporation)
SRV - (Realtek8185) -- C:\Program Files (x86)\Realtek\RTL8185 Wireless LAN Utility\RtlService.exe (Realtek)
========== Driver Services (SafeList) ==========
DRV:64bit: - (MBAMSwissArmy) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys (Malwarebytes Corporation)
DRV:64bit: - (MBAMWebAccessControl) -- C:\Windows\SysNative\drivers\mwac.sys (Malwarebytes Corporation)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (NvStreamKms) -- C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamKms.sys (NVIDIA Corporation)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (Avast Software s.r.o.)
DRV:64bit: - (aswVmm) -- C:\Windows\SysNative\drivers\aswVmm.sys ()
DRV:64bit: - (aswStm) -- C:\Windows\SysNative\drivers\aswStm.sys (Avast Software s.r.o.)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (Avast Software s.r.o.)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (Avast Software s.r.o.)
DRV:64bit: - (aswRvrt) -- C:\Windows\SysNative\drivers\aswRvrt.sys ()
DRV:64bit: - (aswHwid) -- C:\Windows\SysNative\drivers\aswHwid.sys ()
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (Avast Software s.r.o.)
DRV:64bit: - (NVSWCFilter) -- C:\Windows\SysNative\drivers\nvswcfilter.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (nvvad_WaveExtensible) -- C:\Windows\SysNative\drivers\nvvad64v.sys (NVIDIA Corporation)
DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (usb_rndisx) -- C:\Windows\SysNative\drivers\usb8023x.sys (Microsoft Corporation)
DRV:64bit: - (usbrndis6) -- C:\Windows\SysNative\drivers\usb80236.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (RTL85n64) -- C:\Windows\SysNative\drivers\RTL85n64.sys (Realtek Semiconductor Corporation )
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek Corporation )
DRV - (VBoxAswDrv) -- C:\Program Files (x86)\Avast\ng\vbox\VBoxAswDrv.sys (Avast Software)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2014\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = https://www.google.com/?trackid=sp-006
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-20\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.com
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://gotut.ru/
IE - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.countryCode: "DE"
FF - prefs.js..browser.search.isUS: false
FF - prefs.js..browser.search.region: "DE"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "google.com"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:37.0.1
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_134.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=11.40.2: E:\Program Files (x86)\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=11.40.2: E:\Program Files (x86)\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_134.dll ()
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 37.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 37.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 37.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 37.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2015.01.21 21:55:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin.***-PC\AppData\Roaming\mozilla\Extensions
[2015.04.06 12:45:48 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Admin.***-PC\AppData\Roaming\mozilla\Firefox\Profiles\9oa10267.default\extensions
[2015.04.06 14:45:30 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\browser\extensions
[2015.04.06 14:45:30 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\mozilla firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
O1 HOSTS File: ([2015.04.10 15:53:38 | 000,000,630 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 www.isohunt.to
O1 - Hosts: 127.0.0.1 isohunt.to
O1 - Hosts: 127.0.0.1 www.torrentdownloads.me
O1 - Hosts: 127.0.0.1 torrentsdownload.com
O1 - Hosts: 127.0.0.1 37.1.201.116
O1 - Hosts: 127.0.0.1 www.megagames.com
O1 - Hosts: 127.0.0.1 megagames.com
O1 - Hosts: 127.0.0.1 www.gameburnworld.com
O1 - Hosts: 127.0.0.1 gameburnworld.com
O1 - Hosts: 127.0.0.1 www.keygen.us
O1 - Hosts: 127.0.0.1 keygen.us
O1 - Hosts: 127.0.0.1 easycracks.net
O1 - Hosts: 127.0.0.1 www.icracks.net
O1 - Hosts: 127.0.0.1 icracks.net
O1 - Hosts: 127.0.0.1 www.hackingstore.de
O1 - Hosts: 127.0.0.1 hackingstore.de
O1 - Hosts: 127.0.0.1 www.uploaded.net
O1 - Hosts: 127.0.0.1 uploaded.net
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - E:\Program Files (x86)\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\Avast\aswWebRepIE64.dll (Avast Software s.r.o.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - E:\Program Files (x86)\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (BitComet Helper) - {39F7E362-828A-4B5A-BCAF-5B79BFDFEA60} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.5.4.11.dll (BitComet)
O2 - BHO: (avast! Online Security) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Program Files (x86)\Avast\aswWebRepIE.dll (Avast Software s.r.o.)
O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found.
O4 - HKLM..\Run: [AvastUI.exe] C:\Program Files (x86)\Avast\AvastUI.exe (Avast Software s.r.o.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 4
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: SoftwareSASGeneration = 1
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O7 - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O8:64bit: - Extra context menu item: &Alles mit BitComet herunterladen - C:\Program Files (x86)\BitComet\BitComet.exe (www.BitComet.com)
O8:64bit: - Extra context menu item: Mit BitComet herunter&laden - C:\Program Files (x86)\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: &Alles mit BitComet herunterladen - C:\Program Files (x86)\BitComet\BitComet.exe (www.BitComet.com)
O8 - Extra context menu item: Mit BitComet herunter&laden - C:\Program Files (x86)\BitComet\BitComet.exe (www.BitComet.com)
O9 - Extra Button: BitComet - {D18A0B52-D63C-4ed0-AFC6-C1E3DC1AF43A} - C:\Program Files (x86)\BitComet\tools\BitCometBHO_1.5.4.11.dll (BitComet)
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7C735086-CC68-4892-8F0D-0D238A8F11E4}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{AEF7C8B7-689C-4D9C-A5C0-D76EE4CFA0C3}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{CF320001-F1C9-4BCE-A57F-01CD1229EBF8}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D1F9153E-54DA-4743-B290-6E3A339B8F56}: DhcpNameServer = 192.168.178.1
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.10.16 20:02:40 | 000,000,000 | ---D | M] - F:\Autorun -- [ CDFS ]
O32 - AutoRun File - [2010.10.16 18:57:00 | 000,103,608 | R--- | M] () - F:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2010.10.16 20:01:01 | 000,001,041 | R--- | M] () - F:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2015.04.12 16:54:04 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Admin.***-PC\Desktop\OTL.exe
[2015.04.11 21:35:25 | 000,443,208 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Admin.***-PC\Desktop\sc-cleaner.exe
[2015.04.11 14:14:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Brother
[2015.04.11 14:10:06 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Brother
[2015.04.10 15:15:18 | 000,000,000 | ---D | C] -- C:\Users\Admin.***-PC\AppData\Roaming\BitComet
[2015.04.09 19:24:13 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CyberGhost 5
[2015.04.09 19:24:11 | 000,000,000 | ---D | C] -- C:\Program Files\CyberGhost 5
[2015.04.09 18:15:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BitComet
[2015.04.09 11:20:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Defraggler
[2015.04.09 11:20:36 | 000,000,000 | ---D | C] -- C:\Program Files\Defraggler
[2015.04.09 10:27:26 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2015.04.09 10:27:20 | 000,000,000 | ---D | C] -- C:\Users\Admin.***-PC\AppData\Local\temp
[2015.04.09 10:14:39 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2015.04.09 10:14:39 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2015.04.09 10:14:39 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2015.04.09 10:13:31 | 000,000,000 | ---D | C] -- C:\Qoobox
[2015.04.07 23:18:07 | 000,000,000 | ---D | C] -- C:\Program Files\TAP-Windows
[2015.04.06 14:53:13 | 000,136,408 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2015.04.06 14:52:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes Anti-Malware
[2015.04.06 14:52:50 | 000,107,736 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2015.04.06 14:52:50 | 000,063,704 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
[2015.04.06 14:52:50 | 000,025,816 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2015.04.06 14:52:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes Anti-Malware
[2015.04.06 14:45:31 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2015.04.06 14:45:30 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2015.04.06 14:03:46 | 000,000,000 | -HSD | C] -- C:\Users\Admin.***-PC\AppData\Local\EmieUserList
[2015.04.06 14:03:46 | 000,000,000 | -HSD | C] -- C:\Users\Admin.***-PC\AppData\Local\EmieSiteList
[2015.04.06 14:03:46 | 000,000,000 | -HSD | C] -- C:\Users\Admin.***-PC\AppData\Local\EmieBrowserModeList
[2015.04.06 13:35:28 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2015.04.06 13:10:10 | 000,000,000 | ---D | C] -- C:\Users\Admin.***-PC\AppData\Roaming\Tunngle
[2015.04.06 13:00:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2015.04.06 12:56:02 | 000,000,000 | ---D | C] -- C:\Users\Admin.***-PC\AppData\Local\Programs
[2015.04.06 12:51:40 | 000,000,000 | ---D | C] -- C:\RegBackup
[2015.04.06 12:28:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\VS Revo Group
[2015.04.06 12:28:16 | 000,000,000 | ---D | C] -- C:\Users\Admin.***-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller
[2015.04.03 21:11:55 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Flash
[2015.04.03 21:05:44 | 000,000,000 | ---D | C] -- C:\ProgramData\KingSoft
[2015.04.03 21:03:16 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Tencent
[2015.04.03 21:02:58 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Tencent
[2015.04.03 21:02:56 | 000,087,864 | ---- | C] (电脑管家) -- C:\Windows\SysNative\drivers\TFsFltX64.sys
[2015.04.03 21:02:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Application Assistance
[2015.04.03 18:57:40 | 000,031,232 | ---- | C] (Tunngle.net) -- C:\Windows\SysNative\drivers\tap0901t.sys
[2015.04.03 15:52:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Steam
[2015.04.02 15:56:32 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2015.04.02 15:56:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Skype
[2015.04.02 15:56:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2015.03.29 03:06:11 | 000,000,000 | ---D | C] -- C:\Users\Admin.***-PC\AppData\Local\Diagnostics
[2015.03.28 23:55:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Skype
[2015.03.28 23:48:07 | 000,000,000 | --SD | C] -- C:\Windows\SysWow64\GWX
[2015.03.28 23:48:07 | 000,000,000 | --SD | C] -- C:\Windows\SysNative\GWX
[2015.03.28 23:13:21 | 000,000,000 | ---D | C] -- C:\ProgramData\eMule
[2015.03.28 17:40:53 | 000,000,000 | -HSD | C] -- C:\Windows\ftpcache
[2015.03.26 10:26:57 | 000,622,224 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvStreaming.exe
[2015.03.26 10:25:15 | 018,580,512 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll
[2015.03.26 10:25:15 | 001,540,240 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco6420103.dll
[2015.03.26 10:25:15 | 000,997,856 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll
[2015.03.26 10:25:14 | 032,114,888 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll
[2015.03.26 10:25:14 | 024,775,368 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll
[2015.03.26 10:25:14 | 017,258,024 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll
[2015.03.26 10:25:14 | 013,297,144 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll
[2015.03.26 10:25:14 | 010,775,080 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvopencl.dll
[2015.03.26 10:25:14 | 001,896,136 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6434788.dll
[2015.03.26 10:25:14 | 001,557,648 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6434788.dll
[2015.03.26 10:25:14 | 000,970,384 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFR64.dll
[2015.03.26 10:25:14 | 000,944,784 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\NvFBC64.dll
[2015.03.26 10:25:14 | 000,930,448 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFR.dll
[2015.03.26 10:25:14 | 000,909,512 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvFBC.dll
[2015.03.26 10:25:14 | 000,878,328 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll
[2015.03.26 10:25:14 | 000,496,272 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvEncodeAPI64.dll
[2015.03.26 10:25:14 | 000,400,584 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvEncodeAPI.dll
[2015.03.26 10:25:14 | 000,390,288 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFROpenGL.dll
[2015.03.26 10:25:14 | 000,354,112 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglshim64.dll
[2015.03.26 10:25:14 | 000,346,824 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFROpenGL.dll
[2015.03.26 10:25:14 | 000,306,208 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglshim32.dll
[2015.03.26 10:25:14 | 000,178,512 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll
[2015.03.26 10:25:14 | 000,164,568 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll
[2015.03.26 10:25:13 | 025,460,880 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll
[2015.03.26 10:25:13 | 020,466,376 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll
[2015.03.26 10:25:13 | 013,210,080 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll
[2015.03.26 10:25:13 | 010,715,864 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll
[2015.03.26 10:25:13 | 003,611,792 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll
[2015.03.26 10:25:13 | 003,249,352 | ---- | C] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll
[2015.03.26 02:15:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Sun
[2015.03.26 02:15:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2015.03.26 02:15:01 | 000,111,016 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2015.03.26 02:14:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
[2015.03.26 02:14:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Oracle
[2015.03.25 00:01:55 | 001,107,456 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aeinv.dll
[2015.03.25 00:01:55 | 000,943,616 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\appraiser.dll
[2015.03.25 00:01:55 | 000,760,832 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\invagent.dll
[2015.03.25 00:01:55 | 000,677,888 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\generaltel.dll
[2015.03.25 00:01:55 | 000,414,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\devinv.dll
[2015.03.25 00:01:55 | 000,227,328 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepdu.dll
[2015.03.25 00:01:55 | 000,192,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\aepic.dll
[2015.03.25 00:01:55 | 000,030,720 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\acmigration.dll
[2015.03.15 12:00:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Ubisoft
[2015.03.14 22:06:35 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Reality Pump
[2015.03.14 16:12:20 | 000,373,864 | ---- | C] (Lavasoft Limited) -- C:\Windows\SysNative\LavasoftTcpService64.dll
[2015.03.14 16:12:15 | 000,326,288 | ---- | C] (Lavasoft Limited) -- C:\Windows\SysWow64\LavasoftTcpService.dll
========== Files - Modified Within 30 Days ==========
[2015.04.12 17:07:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2015.04.12 17:01:42 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2015.04.12 17:01:42 | 000,021,664 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2015.04.12 16:59:27 | 001,794,928 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2015.04.12 16:59:27 | 000,769,348 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2015.04.12 16:59:27 | 000,711,950 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2015.04.12 16:59:27 | 000,173,666 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2015.04.12 16:59:27 | 000,141,386 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2015.04.12 16:54:06 | 000,136,408 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2015.04.12 16:54:02 | 000,000,436 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts.ics
[2015.04.12 16:53:56 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Admin.***-PC\Desktop\OTL.exe
[2015.04.12 16:52:30 | 000,065,536 | ---- | M] () -- C:\Windows\SysNative\Ikeext.etl
[2015.04.12 16:52:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2015.04.11 21:35:26 | 000,443,208 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Admin.***-PC\Desktop\sc-cleaner.exe
[2015.04.10 15:53:38 | 000,000,630 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2015.04.10 08:58:36 | 000,000,008 | RHS- | M] () -- C:\Users\Admin.***-PC\ntuser.pol
[2015.04.09 18:15:51 | 000,001,007 | ---- | M] () -- C:\Users\Public\Desktop\BitComet.lnk
[2015.04.09 11:20:37 | 000,001,684 | ---- | M] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2015.04.06 17:26:49 | 000,000,008 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2015.04.06 14:52:52 | 000,001,102 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2015.04.06 14:45:32 | 000,001,147 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2015.04.06 13:32:25 | 000,268,536 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2015.04.06 12:51:43 | 000,000,207 | ---- | M] () -- C:\Windows\tweaking.com-regbackup-***-PC-Windows-7-Home-Premium-(64-bit).dat
[2015.04.03 21:02:29 | 000,087,864 | ---- | M] (电脑管家) -- C:\Windows\SysNative\drivers\TFsFltX64.sys
[2015.04.03 19:10:28 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\Access.dat
[2015.04.03 15:45:24 | 000,001,231 | ---- | M] () -- C:\Users\Public\Desktop\Wolfenstein The New Order.lnk
[2015.04.02 15:56:32 | 000,002,687 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2015.03.26 02:14:34 | 000,111,016 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2015.03.17 12:09:21 | 000,778,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2015.03.17 12:09:21 | 000,142,512 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2015.03.17 06:15:38 | 000,063,704 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mwac.sys
[2015.03.17 06:15:28 | 000,107,736 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2015.03.17 06:15:24 | 000,025,816 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2015.03.14 22:06:36 | 000,001,131 | ---- | M] () -- C:\Users\Public\Desktop\Two Worlds II.lnk
[2015.03.14 11:52:06 | 000,001,377 | ---- | M] () -- C:\Users\Public\Desktop\GeForce Experience.lnk
[2015.03.13 21:41:47 | 032,114,888 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglv64.dll
[2015.03.13 21:41:47 | 025,460,880 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcompiler.dll
[2015.03.13 21:41:47 | 024,775,368 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglv32.dll
[2015.03.13 21:41:47 | 020,466,376 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcompiler.dll
[2015.03.13 21:41:47 | 018,580,512 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvwgf2umx.dll
[2015.03.13 21:41:47 | 017,258,024 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvd3dumx.dll
[2015.03.13 21:41:47 | 016,022,016 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvwgf2um.dll
[2015.03.13 21:41:47 | 014,121,624 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvd3dum.dll
[2015.03.13 21:41:47 | 013,297,144 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvopencl.dll
[2015.03.13 21:41:47 | 013,210,080 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuda.dll
[2015.03.13 21:41:47 | 010,775,080 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvopencl.dll
[2015.03.13 21:41:47 | 010,715,864 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuda.dll
[2015.03.13 21:41:47 | 003,611,792 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcuvid.dll
[2015.03.13 21:41:47 | 003,303,448 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvapi64.dll
[2015.03.13 21:41:47 | 003,249,352 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvcuvid.dll
[2015.03.13 21:41:47 | 002,906,928 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvapi.dll
[2015.03.13 21:41:47 | 001,896,136 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispco6434788.dll
[2015.03.13 21:41:47 | 001,557,648 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvdispgenco6434788.dll
[2015.03.13 21:41:47 | 001,540,240 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvhdagenco6420103.dll
[2015.03.13 21:41:47 | 000,997,856 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvumdshimx.dll
[2015.03.13 21:41:47 | 000,970,384 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFR64.dll
[2015.03.13 21:41:47 | 000,944,784 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvFBC64.dll
[2015.03.13 21:41:47 | 000,930,448 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFR.dll
[2015.03.13 21:41:47 | 000,909,512 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvFBC.dll
[2015.03.13 21:41:47 | 000,878,328 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvumdshim.dll
[2015.03.13 21:41:47 | 000,496,272 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvEncodeAPI64.dll
[2015.03.13 21:41:47 | 000,400,584 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvEncodeAPI.dll
[2015.03.13 21:41:47 | 000,390,288 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\NvIFROpenGL.dll
[2015.03.13 21:41:47 | 000,354,112 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvoglshim64.dll
[2015.03.13 21:41:47 | 000,346,824 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\NvIFROpenGL.dll
[2015.03.13 21:41:47 | 000,306,208 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvoglshim32.dll
[2015.03.13 21:41:47 | 000,178,512 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvinitx.dll
[2015.03.13 21:41:47 | 000,164,568 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvinit.dll
[2015.03.13 21:41:47 | 000,073,872 | ---- | M] (Khronos Group) -- C:\Windows\SysNative\OpenCL.dll
[2015.03.13 21:41:47 | 000,060,560 | ---- | M] (Khronos Group) -- C:\Windows\SysWow64\OpenCL.dll
[2015.03.13 21:41:47 | 000,027,441 | ---- | M] () -- C:\Windows\SysNative\nvinfo.pb
[2015.03.13 18:16:47 | 006,861,968 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvcpl.dll
[2015.03.13 18:16:47 | 003,526,856 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvc64.dll
[2015.03.13 18:16:45 | 002,559,808 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvsvcr.dll
[2015.03.13 18:16:45 | 000,386,248 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvmctray.dll
[2015.03.13 18:16:45 | 000,062,608 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysNative\nvshext.dll
[2015.03.13 17:38:39 | 000,622,224 | ---- | M] (NVIDIA Corporation) -- C:\Windows\SysWow64\nvStreaming.exe
========== Files Created - No Company Name ==========
[2015.04.09 18:15:51 | 000,001,007 | ---- | C] () -- C:\Users\Public\Desktop\BitComet.lnk
[2015.04.09 11:20:37 | 000,001,684 | ---- | C] () -- C:\Users\Public\Desktop\Defraggler.lnk
[2015.04.09 10:14:39 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2015.04.09 10:14:39 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2015.04.09 10:14:39 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2015.04.09 10:14:39 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2015.04.09 10:14:39 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2015.04.06 14:52:52 | 000,001,102 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2015.04.06 14:45:32 | 000,001,159 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2015.04.06 14:45:32 | 000,001,147 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2015.04.06 12:51:43 | 000,000,207 | ---- | C] () -- C:\Windows\tweaking.com-regbackup-***-PC-Windows-7-Home-Premium-(64-bit).dat
[2015.04.06 12:19:50 | 000,000,008 | RHS- | C] () -- C:\Users\Admin.***-PC\ntuser.pol
[2015.04.03 19:10:28 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\Access.dat
[2015.04.03 15:45:24 | 000,001,231 | ---- | C] () -- C:\Users\Public\Desktop\Wolfenstein The New Order.lnk
[2015.04.03 07:15:35 | 000,000,008 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2015.04.02 15:56:32 | 000,002,687 | ---- | C] () -- C:\Users\Public\Desktop\Skype.lnk
[2015.04.02 12:51:42 | 000,268,536 | ---- | C] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2015.03.14 22:06:36 | 000,001,131 | ---- | C] () -- C:\Users\Public\Desktop\Two Worlds II.lnk
[2015.02.20 14:39:56 | 000,000,043 | ---- | C] () -- C:\Users\Admin.***-PC\AppData\Roaming\WB.CFG
[2015.01.20 21:16:45 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2015.01.15 20:23:32 | 001,768,272 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2015.02.13 07:22:33 | 014,177,280 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2015.02.13 07:26:18 | 012,875,264 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.21 05:24:25 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2015.01.15 23:09:21 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\AVAST Software
[2015.01.19 15:50:56 | 000,000,000 | ---D | M] -- C:\Users\Admin\AppData\Roaming\TuneUp Software
[2015.01.21 21:53:25 | 000,000,000 | ---D | M] -- C:\Users\Admin.***-PC\AppData\Roaming\AVAST Software
[2015.04.11 16:24:27 | 000,000,000 | ---D | M] -- C:\Users\Admin.***-PC\AppData\Roaming\BitComet
[2015.02.02 17:11:55 | 000,000,000 | ---D | M] -- C:\Users\Admin.***-PC\AppData\Roaming\TuneUp Software
[2015.04.06 13:10:10 | 000,000,000 | ---D | M] -- C:\Users\Admin.***-PC\AppData\Roaming\Tunngle
[2015.01.15 19:38:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\AVAST Software
[2015.04.12 04:59:22 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\BitComet
[2015.03.07 12:23:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\BitTorrent
[2015.04.03 07:15:17 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Browsers
[2015.01.26 01:19:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DarkSoulsII
[2015.02.20 02:50:59 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\dlg
[2015.01.17 16:11:21 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dwarfs
[2015.02.20 03:34:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera Software
[2015.03.09 23:42:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Origin
[2015.02.20 02:43:51 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\QuickScan
[2015.02.20 03:09:53 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\sparta123
[2015.04.03 07:15:12 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\SPI
[2015.01.20 22:08:07 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Steganos
[2015.01.20 22:08:07 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Steganos VPN
[2015.04.10 00:44:36 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client
[2015.01.20 23:28:04 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TuneUp Software
[2015.04.03 20:23:37 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Tunngle
[2015.04.12 06:50:41 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\uTorrent
[2015.01.20 21:52:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\OpenOffice.org
[2015.01.18 23:02:47 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Origin
========== Purity Check ==========
========== Files - Unicode (All) ==========
[2015.04.03 07:15:17 | 000,001,309 | R-S- | C] ()(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\?ozill? Firefo?.lnk) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Мozillа Firefoх.lnk
< End of report >
Extras: Code:
OTL Extras logfile created on: 12.04.2015 17:08:18 - Run 2
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Admin.***-PC\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.11.9600.17691)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
4,00 Gb Total Physical Memory | 2,43 Gb Available Physical Memory | 60,71% Memory free
8,00 Gb Paging File | 6,11 Gb Available in Paging File | 76,41% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 247,82 Gb Total Space | 17,09 Gb Free Space | 6,90% Space Free | Partition Type: NTFS
Drive D: | 100,00 Mb Total Space | 69,99 Mb Free Space | 69,99% Space Free | Partition Type: NTFS
Drive E: | 683,59 Gb Total Space | 381,73 Gb Free Space | 55,84% Space Free | Partition Type: NTFS
Drive F: | 3,61 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive G: | 931,51 Gb Total Space | 13,94 Gb Free Space | 1,50% Space Free | Partition Type: NTFS
Computer Name: ***-PC | User Name: Admin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-3735647818-3390927355-959790164-1003\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\IEXPLORE.EXE" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"UpdatesDisableNotify" = 0
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DisableUnicastResponsesToMulticastBroadcast" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03B4FA71-1874-4D3F-ABED-A1D0F09BF73C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0FCA15FE-8089-4553-8531-F12D90BC2583}" = lport=10243 | protocol=6 | dir=in | app=system |
"{10AAA2DD-F131-4E14-A651-F2C0F1B13CBC}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{116BB5A2-E7B1-49B3-84CB-7276EF484A8E}" = lport=2869 | protocol=6 | dir=in | app=system |
"{175A0A68-A410-4F0E-B232-18435D404633}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{22D87343-5144-4C94-87F2-40AAD96AA1A7}" = lport=5353 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamnetworkservice.exe |
"{2ADDF2E5-C497-4F0C-822B-FF6A98888F2C}" = lport=47995 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{32C7CB5B-4C32-4C6F-B3BD-AB71F2BC7DDE}" = lport=1542 | protocol=6 | dir=in | name=realtek wps tcp prot |
"{34CDF4F1-165D-4A49-8309-178588EFA6B9}" = lport=67 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{43A37F75-902C-44B1-93B4-587EE3182B5E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{44E53FE5-241A-4D49-A36F-66B1EEB84B8A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{46B2A9FF-BE34-4CC6-BEC7-FB68C206CC1B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{50CBC0CB-5CF9-41BB-9F78-4910B7C09FA6}" = lport=53 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{52FE1C03-5399-4927-808B-2B78FE4CE6CF}" = lport=80 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{534DF886-E704-441B-A006-FBCCD913D9D3}" = lport=80 | protocol=6 | dir=in | app=system |
"{587D2DCC-93F3-44BD-8D2B-D096DA51C007}" = lport=48000 | protocol=17 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamer.exe |
"{5A453361-15D5-48EB-99A9-76F091BD3F29}" = lport=443 | protocol=6 | dir=in | app=c:\program files (x86)\nvidia corporation\netservice\nvnetworkservice.exe |
"{5AFC7BF6-0528-4B33-8362-D85142605289}" = rport=2869 | protocol=6 | dir=out | app=system |
"{5BC05455-20E9-456D-A0AB-3B9C0EFC1D18}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5CF57D97-913D-43D1-B981-9EF098AB4E3F}" = lport=137 | protocol=17 | dir=in | app=system |
"{617FBAF7-C390-41FD-9C59-FAA52C5AB7B6}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{64F3FF99-1444-4CF3-9C6E-9D48828F231B}" = rport=445 | protocol=6 | dir=out | app=system |
"{661F5120-CE1D-4AF7-96E8-882F318DC1A6}" = lport=2869 | protocol=6 | dir=in | app=system |
"{7022FDDC-2A61-4B4A-8CCC-0E5CC95BFD36}" = rport=10243 | protocol=6 | dir=out | app=system |
"{72A41EEE-B3FF-42F7-87DA-427C34DF5F9B}" = lport=547 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{730433A4-DAF7-4D62-92EB-DBD866809734}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{7FA5074A-A921-4A5F-8541-420A6BEC6D41}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{827B8093-273D-487F-9C3E-983DBFF808A4}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{84D80788-5EEB-43A8-996C-39D227629BEF}" = rport=139 | protocol=6 | dir=out | app=system |
"{8C5C2DCC-F469-4B35-9273-93D2A941AEF4}" = lport=68 | protocol=17 | dir=in | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{915E7223-E7F3-43E4-B56A-821CAD288BBE}" = rport=138 | protocol=17 | dir=out | app=system |
"{95348BBE-E7AD-49B0-9D66-321BF7195625}" = lport=139 | protocol=6 | dir=in | app=system |
"{9605E32F-B389-4B43-8D01-624CA0D82DE6}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{96232A6F-2419-471E-A56B-7468A6620088}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe |
"{96653687-79FB-4948-A0A4-BFA213906DD8}" = rport=137 | protocol=17 | dir=out | app=system |
"{A18CD003-A388-420B-93C8-1968768E4E3B}" = lport=138 | protocol=17 | dir=in | app=system |
"{A2ACB5B3-D1A9-4D98-935A-DCF4F10FDFEA}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A50BE899-293D-492F-A9DB-A816C71BEF38}" = lport=18315 | protocol=17 | dir=in | name=bitcomet 18315 udp |
"{A9187B57-7CF5-4C06-B9A3-EEBEFB41DC35}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{A9726B68-0F31-406F-86FE-4CC5A22CC994}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{B94C6561-E750-4A02-B9D3-78BFC2B78A76}" = lport=1542 | protocol=17 | dir=in | name=realtek wps udp prot |
"{BAE58AD2-07CB-45EA-8D4A-952862903CD1}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{C0EBE295-A3DA-42F4-A326-0F821955B5D1}" = lport=47984 | protocol=6 | dir=in | app=c:\program files\nvidia corporation\nvstreamsrv\nvstreamnetworkservice.exe |
"{D13004DA-5777-4CBF-AEE4-8B049BE869D4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{DFF73723-E885-42B8-8791-4D19DF987C23}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{E0F27857-F72A-466E-816E-AAB3F6A77FB2}" = lport=18315 | protocol=6 | dir=in | name=bitcomet 18315 tcp |
"{F0E60599-07C7-4988-BCDE-C0783DC2F8E4}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F20F44A8-830C-47CB-9E1D-138C5A8386E2}" = lport=445 | protocol=6 | dir=in | app=system |
"{F98D3258-C23B-4CA2-9720-535C32B917D5}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{FD516282-7DD2-4D1E-971F-DFB0104587CC}" = lport=53 | protocol=17 | dir=in | name=realtek ap udp prot |
"{FEA908E4-DAE3-4F5D-9ADD-B816C5B05805}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B7AF388-A45C-486C-9CAC-86EC79ECDCA8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{0CBEE6C1-CD6A-431F-B931-EACA0FC8D562}" = protocol=6 | dir=in | app=c:\users\***\appdata\roaming\utorrent\utorrent.exe |
"{0CD01CBB-46D9-4317-ACA5-20FED8C1DFF3}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\tom clancy's splinter cell blacklist\blacklist_launcher.exe |
"{0D014367-38BF-486E-B625-900F9F5848FD}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls ii\game\darksoulsii.exe |
"{10824D26-95DB-40A8-BA2B-90F3F94AA047}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{158DEFD6-6C57-451B-B149-C393CAD7E381}" = dir=in | app=e:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\rld-wothneor\crack\wolfneworder_x64.exe |
"{18516896-3AA5-43CF-9469-14990308E3FE}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{1CA34E89-3DBC-4640-851F-D37490F1785E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls ii\game\darksoulsii.exe |
"{22E83034-8534-40CD-BA1B-738AF5AA592A}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"{2946E225-D7E6-49BF-9EBE-DCA9E598C402}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\tom clancy's splinter cell blacklist\src\system\blacklist_game.exe |
"{2B26837E-0BD2-43E4-83DE-863240A26E9B}" = dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\130\tencentdl.exe |
"{2C6A4479-5B37-40EA-81BE-7CF77C763AE9}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{2E52F7AF-3D1C-40D3-BAEC-85B28206D63B}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\nether\launcher\launcher.exe |
"{2FC2AD02-3C9E-4E71-9B26-725891CE2949}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\tom clancy's splinter cell blacklist\src\system\blacklist_game.exe |
"{31502B3E-FE7C-463C-BF23-0195F4E6C2DE}" = dir=in | app=e:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\rld-wothneor\setup.exe |
"{336868BB-31D3-4411-877C-560EECF8C5E0}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\tom clancy's splinter cell blacklist\src\system\blacklist_dx11_game.exe |
"{3375CCF9-974C-4ACC-B57B-FF3D0833296E}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\tom clancy's splinter cell blacklist\src\system\gu.exe |
"{374C7F29-BE78-4816-8ADF-28078E688CAA}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{37CB131C-CDD0-4B7E-BE5D-F6B36861CAB7}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{38FAA670-9C7A-4A34-A4EA-32A83749D649}" = dir=in | app=e:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\wolfenstein the new order\wolfneworder_x64.exe |
"{3DAFDCAB-71D0-474E-9A65-53D28163BFB9}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\sniper elite v2\launcher\sniperv2launcher.exe |
"{3DFBEF1D-A475-4DE5-997B-EFFAF2C963E7}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{42A10FB6-7CBC-4C0A-BDE4-21998304A476}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls ii\game\darksoulsii.exe |
"{439BA7E8-D004-4CE6-B33A-0B410B3464AA}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\sniper elite v2\bin\sniperelitev2.exe |
"{4575097B-FD27-453B-9C2F-8C4E4B203240}" = protocol=6 | dir=in | app=e:\program files (x86)\origin games\dead space 3\deadspace3.exe |
"{47892E58-5AD0-48AC-B691-A9E70A313C43}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{4B31C15D-6188-4714-BB7D-EF0B6A91A919}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{50D4AADD-802E-4EDE-8361-9E87E2C06B50}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\evolvegame\bin64_steamretail\evolve.exe |
"{52C43A86-E274-4056-A553-38AEB8104C47}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\bin\steamwebhelper.exe |
"{546A4ACF-C0FA-48E9-8855-B74B31BEFCF2}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\evolvegame\bin64_steamretail\evolve.exe |
"{58DA7A35-E7F0-4FF7-9769-A594E8E2C923}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls ii\game\darksoulsii.exe |
"{5950763A-974A-4EC7-B29E-85D8CEFEC4F3}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5A9D4D87-CA61-4BD7-A539-8D3999AF1A72}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"{5AF1E737-20DB-4075-AB73-5D3CDFD2356A}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\tom clancy's splinter cell blacklist\src\system\gu.exe |
"{5BE86AD7-9E76-45AE-9AC0-AEF822088362}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe |
"{6718FDA6-BBA5-41E9-91B1-3E6743AA9B41}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\evolvegame\bin64_steamretail\evolve.exe |
"{68299EFB-561F-46A8-A06B-670F0685DAEE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{6941F323-A4FC-4111-8362-BC9023BFBF54}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6B58FCB1-9140-47CF-B0D8-05970C66603B}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\dying light\dyinglightgame.exe |
"{6D34121C-68CB-4F6F-BFCB-5C98DF3B3610}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls ii\game\darksoulsii.exe |
"{74C47503-0D15-4079-8FE6-EF49DF9BCD47}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\defiance\patcher.exe |
"{75B7449A-016F-480F-AA01-5095B363E22D}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\sniper elite v2\bin\sniperelitev2.exe |
"{75E923B7-8858-4ACA-9846-5A79EBB0D33E}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\lords of the fallen\bin\lordsofthefallen.exe |
"{76F6CB9F-4611-4EAA-AF8D-5F183050B7B6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{77CE1DC7-AB34-41F9-97A4-F8EE0ABCBB96}" = protocol=6 | dir=in | app=c:\program files (x86)\bitcomet\bitcomet.exe |
"{7FF731EC-BBB1-42EE-B9C2-57E5AC3D9D31}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\zombie army trilogy\launcher\zatlauncher.exe |
"{84649C4C-C0AA-42F8-96D4-61A699E0B003}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\defiance\patcher.exe |
"{8B37A63E-692C-43F4-BD2E-15C5096B1A3C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls ii\game\darksoulsii.exe |
"{8BE3297D-ACC4-4D1D-AFE6-6C919F8351FA}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\lords of the fallen\bin\lordsofthefallen.exe |
"{8E77BDB3-9B2E-425E-994D-2DC76EE395C5}" = dir=in | app=e:\program files (x86)\phone\skype.exe |
"{8E9E1577-BD98-4886-BD80-F8A7933D0495}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\nether\launcher\launcher.exe |
"{92D016C1-E954-4C30-B9B1-A2F181F2830B}" = protocol=17 | dir=in | app=c:\program files (x86)\bitcomet\bitcomet.exe |
"{946AE773-F49C-4753-835E-106452DBBB18}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{94F2F8F2-B1DA-47CC-B67C-E0787FECCFF2}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls ii\game\darksoulsii.exe |
"{96F6CDCF-7E9E-4C90-AA4B-47A226C91987}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{986EFD69-3B55-4102-ACE4-A3C14B589682}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{98F21E5F-2B1A-41D2-B73D-FC7A9850809D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{9AC2E833-1FC1-4F82-B34E-2B58A743DAA5}" = protocol=17 | dir=in | app=c:\program files (x86)\realtek\rtl8185 wireless lan utility\rtwlan.exe |
"{9E4177A1-4345-4E93-9DAB-98D3EFE2E8ED}" = protocol=6 | dir=in | app=c:\program files (x86)\realtek\rtl8185 wireless lan utility\rtwlan.exe |
"{A140EACD-C7A6-49B2-A77F-DEB3C38D000A}" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"{A1790976-1B41-42B8-8B86-DF7D3EBAFB34}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A2F18F7C-2D9D-4FA5-BBE0-0598B1982BAA}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{A3A20088-3523-4B4B-BA6D-00B4A212BAEA}" = dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\130\bugreport_xf.exe |
"{A920EFDA-5534-4DB0-8334-5744703786FC}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\zombie army trilogy\launcher\zatlauncher.exe |
"{AEA46CA8-347A-4C70-A208-33A0204C8B92}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{C218AC3E-9DF4-4479-A56C-C4E33B383FEF}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\dying light\dyinglightgame.exe |
"{C22457E2-3F57-4D28-9F9C-9878C626C7FF}" = protocol=6 | dir=out | app=system |
"{C3806E9D-3584-4EC1-A019-7042D285AD4E}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\two worlds ii\twoworlds2.exe |
"{C52459DF-138D-4686-B62C-6D4AD38A4567}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dark souls ii\game\darksoulsii.exe |
"{C7921FF1-2605-4850-897D-3167112EFEEF}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\killingfloor\system\killingfloor.exe |
"{C7AD4D48-7B74-445B-A033-E83A7EFC1875}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{CCA12CC1-A036-49C6-A2C6-4347CC7A1469}" = protocol=17 | dir=in | app=e:\program files (x86)\origin games\dead space 3\deadspace3.exe |
"{CD415D51-B3BA-4EA5-BAFE-2140830E63B6}" = protocol=58 | dir=in | name=@hnetcfg.dll,-148 |
"{D328E85E-4F13-4704-8A94-CE9BC899BD1D}" = dir=in | app=e:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\rld-wothneor\crack\wolfneworder_x64.exe |
"{D6924441-7243-4772-BEAD-14421AF61223}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\evolvegame\bin64_steamretail\evolve.exe |
"{D89263AB-7AF6-4CB4-B632-6E340891B8A2}" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe |
"{DAB8CF28-CBE6-4BA3-A724-4689D76B371B}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{DAFAA7B5-4B64-4190-B8A7-2CE23489F593}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\two worlds ii\twoworlds2.exe |
"{DD66FB2D-FBA0-47D1-AC8B-B2DF66E23F5F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E5DBE090-F71A-48BB-BB31-2BC1DB05681A}" = dir=in | app=e:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\wolfenstein the new order\wolfneworder_x64.exe |
"{E90C0288-09C0-46F5-BACD-023BC5407D4E}" = dir=out | svc=sharedaccess | app=%systemroot%\system32\svchost.exe |
"{EB636D29-E6A9-4B52-90E8-F7209AD94F9B}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\tom clancy's splinter cell blacklist\src\system\blacklist_dx11_game.exe |
"{EE1500CD-8225-485E-806C-3364A9E98222}" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\sniper elite v2\launcher\sniperv2launcher.exe |
"{EEF97DE2-C5B3-489B-AE51-43EC30543B1F}" = dir=in | app=e:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\rld-wothneor\setup.exe |
"{EF83E4C5-0512-4465-9D19-D28B5F34804B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{F0891D46-15E3-423C-9BFC-5A5BB807A80D}" = protocol=17 | dir=in | app=c:\users\***\appdata\roaming\utorrent\utorrent.exe |
"{F2240A34-8E80-497F-937F-5CA7503CD02E}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe |
"{F33A65A4-2282-44A6-A6FA-12CDECD13380}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{FB466C0B-8859-4D97-A85D-DC2D4D6FA636}" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\tom clancy's splinter cell blacklist\blacklist_launcher.exe |
"{FE823368-8FF6-44C2-BB49-F0E4F416AE34}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\bin\steamwebhelper.exe |
"{FEF873B8-2CE3-418F-BD96-109ECBFAD9B7}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\killingfloor\system\killingfloor.exe |
"{FF12C71C-925B-4E40-8941-B5D37AD461ED}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"TCP Query User{40B1920A-8039-4C29-A231-50B4C2CC6215}E:\program files (x86)\bin\javaw.exe" = protocol=6 | dir=in | app=e:\program files (x86)\bin\javaw.exe |
"TCP Query User{58E46785-2583-4123-ABB1-DCF66CFCCDC2}E:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\wolfenstein the new order\wolfneworder_x64.exe" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\wolfenstein the new order\wolfneworder_x64.exe |
"TCP Query User{AE23AD19-D314-4878-B22E-A5DF459647DE}E:\programme\steamapps\common\steamapps\common\nether\game\binaries\win64\nether.exe" = protocol=6 | dir=in | app=e:\programme\steamapps\common\steamapps\common\nether\game\binaries\win64\nether.exe |
"UDP Query User{11D0AE15-A726-4686-9C52-8C7B36959FE0}E:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\wolfenstein the new order\wolfneworder_x64.exe" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\wolfenstein the new order-reloaded\wolfenstein the new order\wolfneworder_x64.exe |
"UDP Query User{9ED35944-90EE-4035-8885-A94B464D04C0}E:\program files (x86)\bin\javaw.exe" = protocol=17 | dir=in | app=e:\program files (x86)\bin\javaw.exe |
"UDP Query User{AF84502B-75A5-4277-8D9C-55A5FF3015DB}E:\programme\steamapps\common\steamapps\common\nether\game\binaries\win64\nether.exe" = protocol=17 | dir=in | app=e:\programme\steamapps\common\steamapps\common\nether\game\binaries\win64\nether.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1DB0C90B-2A9F-3A1E-B1DF-616C5A2A1417}" = Microsoft .NET Framework 4.5.2 (DEU)
"{26784146-6E05-3FF9-9335-786C7C0FB5BE}" = Microsoft .NET Framework 4.5.2
"{26A24AE4-039D-4CA4-87B4-2F86418040F0}" = Java 8 Update 40 (64-bit)
"{28791292-D18D-42FA-AE66-3D3D20AA8618}" = Apple Application Support (64-Bit)
"{37B8F9C7-03FB-3253-8781-2517C99D7C00}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.61030
"{5ED7462B-EF58-4757-B609-53755021EC34}" = Apple Mobile Device Support
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031" = Microsoft .NET Framework 4.5.2 (Deutsch)
"{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033" = Microsoft .NET Framework 4.5.2
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 347.88
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 347.88
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 347.88
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience" = NVIDIA GeForce Experience 2.4.0.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 347.09
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.14.0702
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 2.4.0.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.LEDVisualizer" = NVIDIA LED Visualizer 1.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GFExperience.NvStreamSrv" = SHIELD Streaming
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_GfExperienceService" = NVIDIA GeForce Experience Service
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.33.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Network.Service" = NVIDIA Network Service
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShadowPlay" = NVIDIA ShadowPlay 2.4.0.9
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_ShieldWirelessController" = SHIELD Wireless Controller Driver
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Update.Core" = NVIDIA Update Core
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_VirtualAudio.Driver" = NVIDIA Virtual Audio 1.2.27
"{BDD99690-3541-4619-9D2A-3CDDB3E15F9E}" = Apple Mobile Device Support
"{CF2BEA3C-26EA-32F8-AA9B-331F7E34BA97}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.61030
"CyberGhost 5_is1" = CyberGhost 5
"Defraggler" = Defraggler
"TAP-Windows" = TAP-Windows 9.9.2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 5.20 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{24991BA0-F0EE-44AD-9CC8-5EC50AECF6B7}" = Skype™ 7.3
"{2FE00055-C4F3-4F7A-AEDD-E198D54CF12F}" = Apple Application Support (32-Bit)
"{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030
"{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}" = Microsoft ASP.NET MVC 4 Runtime
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{B175520C-86A2-35A7-8619-86DC379688B9}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.61030
"{B455E95A-B804-439F-B533-336B1635AE97}" = NVIDIA PhysX
"{BD95A8CD-1D9F-35AD-981A-3E7925026EBB}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.61030
"{ca67548a-5ebe-413a-b50c-4b9ceb6d66c6}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.61030
"{D4329609-4102-4F8C-B83F-7FE024EEA314}" = Dead Space™ 3
"{EA594E28-547D-4FB5-AED8-3628EFB1474D}" = TuneUp Utilities 2014 (de-DE)
"{EF72E0A5-57E8-471F-837E-82BB19771363}" = REALTEK RTL8185 Wireless LAN Software
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{FE8D473A-6F06-4F99-B5F4-BED72B2A038C}" = TuneUp Utilities 2014
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Adobe Flash Player NPAPI" = Adobe Flash Player 17 NPAPI
"Avast" = Avast Free Antivirus
"BitComet" = BitComet 1.38
"Malwarebytes Anti-Malware_is1" = Malwarebytes Anti-Malware Version 2.1.4.1018
"Mozilla Firefox 37.0.1 (x86 de)" = Mozilla Firefox 37.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"Revo Uninstaller" = Revo Uninstaller 1.95
"Steam" = Steam
"Steam App 1250" = Killing Floor
"Steam App 211420" = Dark Souls: Prepare to Die Edition
"Steam App 224600" = Defiance
"Steam App 235600" = Tom Clancy's Splinter Cell Blacklist
"Steam App 236430" = DARK SOULS™ II
"Steam App 239140" = Dying Light
"Steam App 247730" = Nether
"Steam App 265300" = Lords Of The Fallen
"Steam App 273350" = Evolve
"Steam App 301640" = Zombie Army Trilogy
"Steam App 326960" = Killing Floor - Toy Master
"Steam App 49520" = Borderlands 2
"Steam App 63380" = Sniper Elite V2
"TuneUp Utilities" = TuneUp Utilities 2014
"Two Worlds II" = Two Worlds II
"Uplay" = Uplay
"V29sZmVuc3RlaW5UaGVOZXdPcmRlcg==_is1" = Wolfenstein: The New Order
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 11.04.2015 17:56:21 | Computer Name = ***-PC | Source = VSS | ID = 8193
Description =
Error - 11.04.2015 17:56:23 | Computer Name = ***-PC | Source = VSS | ID = 13
Description =
Error - 11.04.2015 17:56:23 | Computer Name = ***-PC | Source = VSS | ID = 8193
Description =
Error - 11.04.2015 17:57:04 | Computer Name = ***-PC | Source = WinMgmt | ID = 10
Description =
Error - 12.04.2015 02:48:09 | Computer Name = ***-PC | Source = Microsoft-Windows-CAPI2 | ID = 512
Description = Vom Kryptografiedienst konnte das VSS-Sicherungsobjekt "System Writer"
nicht initialisiert werden. Details: Could not query the status of the EventSystem
service. System Error: Der Computer wird heruntergefahren. .
Error - 12.04.2015 10:52:30 | Computer Name = ***-PC | Source = VSS | ID = 13
Description =
Error - 12.04.2015 10:52:30 | Computer Name = ***-PC | Source = VSS | ID = 8193
Description =
Error - 12.04.2015 10:52:31 | Computer Name = ***-PC | Source = VSS | ID = 13
Description =
Error - 12.04.2015 10:52:31 | Computer Name = ***-PC | Source = VSS | ID = 8193
Description =
Error - 12.04.2015 10:52:49 | Computer Name = ***-PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:04:40 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7001
Description = Der Dienst "Intelligenter Hintergrundübertragungsdienst" ist vom Dienst
"COM+-Ereignissystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%1058
Error - 12.04.2015 11:09:27 | Computer Name = ***-PC | Source = ipnathlp | ID = 31004
Description =
< End of report >
Ich persöhnlich sehe nur: Code:
IE - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://gotut.ru/
Warum Bing eingerichtet ist, verstehe ich auch nicht: Code:
IE - HKU\S-1-5-21-3735647818-3390927355-959790164-1003\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
|
