BKA Trojaner mit Anti-Malware entfernt und OTL logs brauche ein script bitte

Aperture · 07.08.2012, 20:00

computer wurde gesperrt entsperren ukash polizei
Hab mit anit-malware alles gescant und gelöscht
dann OTL durch laufen lassen das sind die logs.

Extras :

Code:

ATTFilter

OTL Extras logfile created on: 07.08.2012 20:39:59 - Run 1
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Users\Dream\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,48 Gb Available Physical Memory | 62,05% Memory free
8,00 Gb Paging File | 6,28 Gb Available in Paging File | 78,58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 355,56 Gb Free Space | 38,17% Space Free | Partition Type: NTFS
 
Computer Name: S4LEAGUE | User Name: Dream | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
[HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
http [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
"DoNotAllowExceptions" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00B01D51-AB4D-4B9A-9652-C1395EAF7CB6}" = lport=138 | protocol=17 | dir=in | app=system | 
"{0854AE64-0245-4E31-A9AC-A478D5DD7241}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{0E293604-7B87-4A23-A8DF-98F7DB248003}" = lport=6890 | protocol=6 | dir=in | name=league of legends launcher | 
"{150F0048-E468-40D4-B9B9-224BD38CAA57}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{1F6FCB79-4F35-475D-8132-ED00E7AFBEC2}" = lport=6915 | protocol=17 | dir=in | name=league of legends launcher | 
"{23E9C0B3-50F8-498B-B434-E3F5762FBD64}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{2693F629-982E-4B22-B98A-9233F773CD69}" = lport=6983 | protocol=17 | dir=in | name=league of legends launcher | 
"{2901DBCC-6A9E-4757-A85A-30AA37E733EA}" = lport=58559 | protocol=6 | dir=in | name=pando media booster | 
"{3671B36A-D10A-4012-B773-221B9A6ACD2C}" = lport=8397 | protocol=6 | dir=in | name=league of legends launcher | 
"{3CC19F17-5398-4BC3-BDAA-6748FCECC2F8}" = lport=137 | protocol=17 | dir=in | app=system | 
"{3F2DBE95-2985-4139-8543-220ECD8342ED}" = lport=6915 | protocol=6 | dir=in | name=league of legends launcher | 
"{4082B3E2-7A68-4F4D-82FA-1B34EBFDC7C7}" = lport=58559 | protocol=17 | dir=in | name=pando media booster | 
"{43E63603-467F-4C23-92D1-7A826E019462}" = rport=137 | protocol=17 | dir=out | app=system | 
"{55020FB6-3DD1-4118-9361-5ED104BB58FA}" = lport=6908 | protocol=6 | dir=in | name=league of legends launcher | 
"{5573B29F-0981-4EC9-8E9F-2F5AC1DAE1CE}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{55C29100-5A31-4AF7-A59A-63378DA880E9}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{58A4C0F2-811B-44AD-87AD-8FCAD4E9A850}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{58CF21B2-A5B0-4400-84D3-08F4583FAF62}" = lport=58559 | protocol=17 | dir=in | name=pando media booster | 
"{5A16F0D5-FE54-4745-8876-24B77A78BB27}" = lport=57374 | protocol=17 | dir=in | name=pando media booster | 
"{5B6B4EC5-5305-4559-B14F-E5D118F8D8C1}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{608B21C8-5941-4A1B-9914-5EC8FAAA6CCB}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{629A0505-C0D8-496F-8C96-243EAF638931}" = rport=139 | protocol=6 | dir=out | app=system | 
"{68BF0717-F9D1-4170-87D4-B1C0AAEE8A9D}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=c:\windows\system32\svchost.exe | 
"{723B96B2-E63D-42E6-AE07-F4124A3FECDD}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher | 
"{7374EEE5-AEB9-4853-8BD2-D00A660D0E60}" = rport=445 | protocol=6 | dir=out | app=system | 
"{77110B5C-F98A-499B-823E-8B654E2071E4}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher | 
"{7CB008EB-2137-4B89-BED7-7A2D51EA892F}" = lport=57746 | protocol=6 | dir=in | name=pando media booster | 
"{836595C7-3DE5-4E39-BF94-B3F3F5EE35F0}" = lport=57374 | protocol=6 | dir=in | name=pando media booster | 
"{863C050B-08CC-4EDF-AB16-2ABB3CD54C29}" = lport=58559 | protocol=6 | dir=in | name=pando media booster | 
"{892DC3E5-EFD9-424E-B8E3-EC8BB8C45AB4}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 
"{8EC3B628-3298-4C31-9F3F-8D50705E0CF8}" = lport=57746 | protocol=17 | dir=in | name=pando media booster | 
"{92246C36-563F-4FF1-8A31-86BFDAF1136C}" = lport=57746 | protocol=6 | dir=in | name=pando media booster | 
"{94325558-4528-42BA-AD3F-FE4F96044AF4}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client | 
"{951AD9C4-5EBE-40F9-88F9-A06B1AE711A3}" = lport=6948 | protocol=17 | dir=in | name=league of legends launcher | 
"{95292A0F-6429-48C6-A5BF-4471E6465BB3}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby | 
"{977ACF2B-0134-4700-9A4D-EF7B86713D87}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface | 
"{97A96508-833F-4BB3-AF61-37723251584D}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 | 
"{9E15260B-153C-48A5-8094-8046D1B276E3}" = rport=138 | protocol=17 | dir=out | app=system | 
"{9FD82BD9-572E-4179-8596-E67EBDD396C3}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{A1C9F249-EC9B-419E-B674-5F4943079927}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{A2A5A943-48CD-4833-847B-C6A49D4C976B}" = lport=57746 | protocol=17 | dir=in | name=pando media booster | 
"{A53BB6FB-54B7-4D6B-9A59-AA26F23B01D8}" = lport=8398 | protocol=6 | dir=in | name=league of legends launcher | 
"{A8FCC139-FB9B-4363-A2C7-00E1EE98EFB8}" = lport=49161 | protocol=6 | dir=in | name=akamai netsession interface | 
"{ABC0AB6E-C921-4B81-BACC-92F1808A3146}" = lport=6948 | protocol=6 | dir=in | name=league of legends launcher | 
"{AD2B0077-6FF3-41D6-BE39-280552D8FD80}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client | 
"{B852B8AA-B9A1-41AF-83EE-F44DBA27AD08}" = lport=445 | protocol=6 | dir=in | app=system | 
"{B9F152FF-116A-458E-AD94-1AF28711E19E}" = lport=57374 | protocol=17 | dir=in | name=pando media booster | 
"{BA7E0966-7DEE-4328-8541-DE7DB82B2F92}" = lport=6908 | protocol=17 | dir=in | name=league of legends launcher | 
"{BD3972E5-A091-4E41-AAE4-58530A480064}" = lport=6983 | protocol=6 | dir=in | name=league of legends launcher | 
"{BE7A0DFF-2B30-4071-82F1-396A41CF1C9F}" = lport=139 | protocol=6 | dir=in | app=system | 
"{C827DA2B-AC0D-4058-A74E-3F9A15A2C204}" = lport=6890 | protocol=17 | dir=in | name=league of legends launcher | 
"{CBCCF586-9BBA-4F97-8C11-FC2602370113}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{CC913A9F-E3F8-4F5D-B430-45E51CCF25FC}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe | 
"{D09D21D9-FDFF-4B91-BC11-149B9ADD6A09}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{D1F877CA-5C16-41B7-B872-93AE3974CF6F}" = lport=6970 | protocol=6 | dir=in | name=league of legends launcher | 
"{D452C87A-57F9-41BE-BDCE-1EF161204C53}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{D5B89B59-A6AF-4AA4-9A68-248D8A920838}" = lport=6909 | protocol=6 | dir=in | name=league of legends launcher | 
"{D5B9EF8E-4715-4571-9FB9-BA58D73C43DB}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{D8816F67-555C-49A4-8933-CF0D877CB1A9}" = lport=57374 | protocol=6 | dir=in | name=pando media booster | 
"{D9078FC4-90B2-44DE-BDC1-DF42162C5654}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 
"{E092DFE0-8D26-44D5-9090-7F3E646E9A45}" = lport=6909 | protocol=17 | dir=in | name=league of legends launcher | 
"{E5177531-B6F5-4DFC-AAD1-599A463762C1}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{E74BC71F-1999-45F0-8762-E20C1A35008E}" = lport=8397 | protocol=17 | dir=in | name=league of legends launcher | 
"{EC8FA5C4-D68B-4F40-AF13-B957EA49B147}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby | 
"{EE0F02D7-F35A-4705-9AD2-89142C7C0A3D}" = lport=6970 | protocol=17 | dir=in | name=league of legends launcher | 
"{F173272F-AA03-436A-884F-DF86559D5A79}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{F8D328E7-D4E6-4C82-87BF-ED7BB2150C00}" = lport=8398 | protocol=17 | dir=in | name=league of legends launcher | 
"{FAE1D62E-A190-42F9-BA5F-95D365608EEB}" = lport=2869 | protocol=6 | dir=in | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05436D22-1B71-4B3A-AD8A-B6FFF4D05761}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version5\teamviewer.exe | 
"{0AC2B408-4128-4870-A5DF-36811C5817CF}" = protocol=6 | dir=in | app=c:\program files (x86)\league of legends\air\lolclient.exe | 
"{0FBC107B-3DA9-41A7-9992-B9CDC0261C94}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam hd the second encounter\bin\samhd_tse.exe | 
"{17D9AB1E-7F60-4756-9E98-1CC7E58C5D53}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{17E387E2-D21D-4F54-8D77-48E330FEC578}" = protocol=6 | dir=in | app=c:\users\dream\appdata\local\akamai\netsession_win.exe | 
"{183079EA-4058-463E-B88A-948898C776CF}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 
"{1F2C8178-A559-403F-AAF5-97F31842E74C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{2F290CA8-6E2B-4763-A172-CE6C363D7758}" = protocol=17 | dir=in | app=c:\program files (x86)\league of legends\lol.launcher.exe | 
"{302059DB-96AC-4119-9169-CE97CA1B6EFC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam hd the second encounter\bin\samhd_tse_unrestricted.exe | 
"{34E61F40-0422-41B6-987F-B5C2C08C1AC4}" = protocol=17 | dir=in | app=c:\program files (x86)\gameforge\nclauncher\nclauncher.exe | 
"{39FB20DD-785E-4A97-997F-133EC1174241}" = protocol=17 | dir=in | app=c:\program files (x86)\league of legends\game\league of legends.exe | 
"{48D376DF-AD4A-4996-96E4-CE8D2C85FEF2}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{4C23CE1D-A856-4370-99C6-DB40A4D6B3E7}" = protocol=6 | dir=in | app=c:\program files (x86)\league of legends\game\league of legends.exe | 
"{51E0C3EE-CFDA-489A-9C13-D1D80D08A568}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{550E703B-1521-4DFB-8909-D37EB48E6EF4}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{5D35CB02-9E06-4C53-8F35-AEF2BA3A50C1}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{614D641C-8830-4729-8CB9-A582568FDA04}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{62020997-596C-4D23-A9A5-4A7987978A3F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{62BE4F10-B419-4CEC-A05E-8101F1C0B5E1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{631B43EC-B068-446F-B539-7C5D63898664}" = protocol=17 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | 
"{65470F89-96CA-4D53-9140-A55A7AA5B1B2}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\adobe\cs4servicemanager\cs4servicemanager.exe | 
"{7204B729-E0B5-4002-B404-E5B7C1D04AF2}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{726ADFBB-FADB-4CE5-BBFD-B9971941EE55}" = protocol=6 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\117\tencentdl.exe | 
"{7AF7602C-F3DA-48C1-A0AC-D248697B0F7B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{7C4802FF-7CBA-4D74-89B3-F5F9EF20A54B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam hd the second encounter\bin\samhd_tse_unrestricted.exe | 
"{7D0AC303-3E83-4001-A6B0-3D44EB1D7FD7}" = protocol=17 | dir=in | app=c:\program files (x86)\league of legends\air\lolclient.exe | 
"{8096DD10-CA3A-499E-A847-6FF5F211A4F6}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{81F1B644-2A70-4849-8A87-61293D4DCD4C}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version5\teamviewer.exe | 
"{8F40B619-272E-43A7-BA22-CD95B02C1A6A}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{9B0833F0-16A2-4C69-83A3-008DDC4323DC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\portal 2\portal2.exe | 
"{9D13FB6B-5786-4B81-8A8F-7ECAE92A6126}" = protocol=6 | dir=in | app=c:\program files (x86)\reactor\ijjioptimizer.exe | 
"{A57020D1-DE95-4AB7-A092-8869DC810DED}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe | 
"{A6C04057-6573-4911-B4C0-C41026B6B7C9}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{ABF5B868-AFDE-4A4B-B04E-E893E4319767}" = protocol=17 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\117\tencentdl.exe | 
"{B0B5FF10-24BA-41C0-9C0A-27E171CF87F8}" = protocol=6 | dir=in | app=c:\program files (x86)\gameforge\nclauncher\nclauncher.exe | 
"{B34E9520-8897-4376-8206-0BBD87A7AB1B}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{BA489355-7BCC-4033-BB16-3CA7674D740F}" = protocol=6 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
"{C0C8A4F6-5E43-4C0E-80F7-1F6C15344B02}" = protocol=6 | dir=in | app=c:\program files (x86)\yahoo!\messenger\yahoomessenger.exe | 
"{C11A53BE-28A6-4879-95F8-0F7D2973483D}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{CA022D39-0B65-442F-B21C-5576C0157604}" = protocol=17 | dir=in | app=c:\program files (x86)\bittorrent\bittorrent.exe | 
"{CA58424C-B00A-48DF-A94D-B5C86FD5F819}" = protocol=17 | dir=in | app=c:\program files (x86)\reactor\ijjioptimizer.exe | 
"{D2688B05-C197-4659-B97A-3C8BF1BC0034}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam hd the second encounter\bin\samhd_tse.exe | 
"{DAFCDCC5-6E1D-493E-8A5E-363A8EA52827}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 
"{DF72081A-DBA8-453B-94AF-5C9C06B88049}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{DF7ADDB4-904C-4E2E-B71A-49A0C752D6EE}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{E03ACE1B-C2E1-4074-9DC7-0300861BAB36}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\portal 2\portal2.exe | 
"{E56B202C-441D-453E-A605-1DC74D17E22F}" = protocol=17 | dir=in | app=c:\users\dream\appdata\local\akamai\netsession_win.exe | 
"{FAB816A8-D087-4172-A58D-200C377ED448}" = protocol=6 | dir=in | app=c:\program files (x86)\league of legends\lol.launcher.exe | 
"{FCF48D2A-EEDA-4D1D-897D-87D35BE97408}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam hd the second encounter\bin\samhd_tse_seriouseditor.exe | 
"{FFAC34E9-E90E-487D-AF1B-BBA5C0850E20}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\serious sam hd the second encounter\bin\samhd_tse_seriouseditor.exe | 
"TCP Query User{0578569E-606E-42E2-876E-B819003C7EF3}C:\aeriagames\wolfteam\wolfteam.bin" = protocol=6 | dir=in | app=c:\aeriagames\wolfteam\wolfteam.bin | 
"TCP Query User{165B6077-61F3-46F2-BDD2-600F02ACBF6A}C:\program files (x86)\mirc\mirc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mirc\mirc.exe | 
"TCP Query User{1FCBB567-18E4-4557-9C9E-373B109348E8}C:\program files (x86)\xfire\xfire.exe" = protocol=6 | dir=in | app=c:\program files (x86)\xfire\xfire.exe | 
"TCP Query User{238D3DE2-CB61-41A1-A2F5-06BD89837775}C:\ijji\english\gunz\gunz.exe" = protocol=6 | dir=in | app=c:\ijji\english\gunz\gunz.exe | 
"TCP Query User{3A09B1C6-E5AA-40F6-9E47-159428C1CF44}C:\program files (x86)\heroes of newerth\hon.exe" = protocol=6 | dir=in | app=c:\program files (x86)\heroes of newerth\hon.exe | 
"TCP Query User{54A71F46-3B8E-453D-9A5B-568DE0A9C101}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe | 
"TCP Query User{581BCAD7-82B3-44A3-AB26-FE0F0ECEEFEC}C:\program files (x86)\starcraft ii\versions\base19679\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19679\sc2.exe | 
"TCP Query User{6EB242F4-513B-41D7-B2D7-488591FA85F6}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"TCP Query User{7EC4F809-0312-4647-ABDC-253DAD260DA8}C:\program files (x86)\icq7.2\icq.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"TCP Query User{9F34E3DB-861E-46E7-B8B0-2878D6F52279}C:\program files (x86)\starcraft ii\versions\base15405\sc2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base15405\sc2.exe | 
"TCP Query User{B808A7C2-ACA3-46D3-A3BE-E566400DD628}C:\program files (x86)\steam\steamapps\ryku000\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\ryku000\team fortress 2\hl2.exe | 
"TCP Query User{BB571820-C017-4F0F-950C-BF7EFB949A96}C:\program files (x86)\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe | 
"TCP Query User{BDFAD286-7B04-4BF5-9796-3813E0EB9601}C:\ijji\english\u_sf\soldierfront.exe" = protocol=6 | dir=in | app=c:\ijji\english\u_sf\soldierfront.exe | 
"TCP Query User{CB92CE25-7EE1-4373-8C73-018600170763}C:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"TCP Query User{E296735D-7405-4221-B384-D3115C51B4F0}C:\program files (x86)\common files\tencent\qqdownload\117\tencentdl.exe" = protocol=6 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\117\tencentdl.exe | 
"TCP Query User{E39F3884-0AB3-4EAC-AC67-22DE24882294}C:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=6 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 
"TCP Query User{EABB0808-3564-419E-86CF-8F7C3B22AFE5}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe | 
"TCP Query User{ED1437C8-6C2C-4497-A54A-B555FA23A5BD}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"TCP Query User{FBEC9CA7-AA5B-4C8E-AD07-1733DADE6D02}C:\program files (x86)\reactor\reactor.exe" = protocol=6 | dir=in | app=c:\program files (x86)\reactor\reactor.exe | 
"UDP Query User{1CC23F8D-8096-499F-B0AA-A5DCA5493A0F}C:\program files (x86)\starcraft ii\versions\base15405\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base15405\sc2.exe | 
"UDP Query User{2F0E84C0-C967-41A7-B578-44243B219BB4}C:\program files (x86)\xfire\xfire.exe" = protocol=17 | dir=in | app=c:\program files (x86)\xfire\xfire.exe | 
"UDP Query User{33061570-997D-42FD-B8C4-AB87B7FF63B8}C:\program files (x86)\starcraft ii\versions\base19679\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base19679\sc2.exe | 
"UDP Query User{3A1CF775-87EB-4FE7-ABFC-D35D932CBA24}C:\program files (x86)\heroes of newerth\hon.exe" = protocol=17 | dir=in | app=c:\program files (x86)\heroes of newerth\hon.exe | 
"UDP Query User{4147FD00-988C-4EE5-A3B2-7BD1FBE62E4E}C:\ijji\english\gunz\gunz.exe" = protocol=17 | dir=in | app=c:\ijji\english\gunz\gunz.exe | 
"UDP Query User{43293ADA-2D9A-4877-8202-60CE938F4D07}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe | 
"UDP Query User{435F409B-A75F-4E37-BD5F-A2D5C55975FA}C:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=17 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe | 
"UDP Query User{45C54718-3081-45EC-80FC-6001963972D2}C:\program files (x86)\reactor\reactor.exe" = protocol=17 | dir=in | app=c:\program files (x86)\reactor\reactor.exe | 
"UDP Query User{48EFFAFF-4676-4287-A6BA-B7089A593688}C:\program files (x86)\mirc\mirc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mirc\mirc.exe | 
"UDP Query User{5855C3DF-EB10-4D90-941A-58658D4BF878}C:\aeriagames\wolfteam\wolfteam.bin" = protocol=17 | dir=in | app=c:\aeriagames\wolfteam\wolfteam.bin | 
"UDP Query User{68F415A8-71E3-4432-9684-4527C57201F2}C:\program files (x86)\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe | 
"UDP Query User{852F6C84-D4EC-46B7-AAA0-1B71EBD2D0FF}C:\program files (x86)\common files\tencent\qqdownload\117\tencentdl.exe" = protocol=17 | dir=in | app=c:\program files (x86)\common files\tencent\qqdownload\117\tencentdl.exe | 
"UDP Query User{8E3B67A8-2EF5-47CD-985C-DBF5F678ABF5}C:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"UDP Query User{9AE5E07D-D11D-4192-A0A8-953D68958390}C:\ijji\english\u_sf\soldierfront.exe" = protocol=17 | dir=in | app=c:\ijji\english\u_sf\soldierfront.exe | 
"UDP Query User{BD6FBA94-A9D1-48B0-879C-65E9E9E6A9A7}C:\program files (x86)\icq7.2\icq.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icq7.2\icq.exe | 
"UDP Query User{CD93793A-1B8D-4F41-A3D0-6A411A9C7D1C}C:\program files (x86)\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files (x86)\mozilla firefox\firefox.exe | 
"UDP Query User{D9E6A387-0277-43A5-8C7A-AD17639B43B8}C:\program files (x86)\starcraft ii\support\blizzarddownloader.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\support\blizzarddownloader.exe | 
"UDP Query User{EF4DDC62-785A-4442-A9F5-6435D5D1DDF4}C:\program files (x86)\starcraft ii\versions\base21029\sc2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\versions\base21029\sc2.exe | 
"UDP Query User{F5029992-A668-4D0A-B989-5F8C5119AEDE}C:\program files (x86)\steam\steamapps\ryku000\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\ryku000\team fortress 2\hl2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{056B9C5B-2E8D-4EBC-941C-06C78A30ABB3}" = Microsoft_VC80_ATL_x86_x64
"{071c9b48-7c32-4621-a0ac-3f809523288f}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{138D2BE4-7981-4F34-BA23-81B6B99D0DE6}" = Microsoft_VC80_MFCLOC_x86_x64
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26A24AE4-039D-4CA4-87B4-2F86416022FF}" = Java(TM) 6 Update 22 (64-bit)
"{28A0318C-B98D-B6B1-64D1-4E4755A8E668}" = AMD Drag and Drop Transcoding
"{328CC232-CFDC-468B-A214-2E21300E4CB5}" = Apple Mobile Device Support
"{3D46855F-7B71-4CF7-A270-62E0E4F05037}" = Microsoft_VC80_CRT_x86_x64
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{47A70BC0-BB3E-468B-9E01-56CCD6F2A911}" = Microsoft_VC80_MFC_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5800B5A7-176D-C773-7BA0-AABB25C57591}" = ATI Problem Report Wizard
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{62803CAB-203F-6307-BCCE-27B5E5A01419}" = ccc-utility64
"{64A3A4F4-B792-11D6-A78A-00B0D0160220}" = Java(TM) SE Development Kit 6 Update 22 (64-bit)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{88EAF577-71FA-46F2-8E42-AEA33E35AFB1}" = Vegas Pro 9.0 (64-bit)
"{8DAA31EB-6830-4006-A99F-4DF8AB24714F}" = Adobe CSI CS4 x64
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{8E3FABF5-C3B9-7F7E-4AAE-977D77D48C51}" = ATI Catalyst Install Manager
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{aac9fcc4-dd9e-4add-901c-b5496a07ab2e}" = Microsoft Visual C++ 2005 Redistributable (x64) - KB2467175
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B6E3757B-5E77-3915-866A-CCFC4B8D194C}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x64 8.0.50727.4053
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CB5340E7-7745-7B18-1413-C14508C2AC2B}" = ATI AVIVO64 Codecs
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR archiver
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{024521CF-C07E-4F8E-8481-0D75695E03AF}" = PxMergeModule
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04B989A5-70D0-3DDB-B88A-629F31D98814}" = CCC Help Korean
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{06036CDA-6B67-1338-5886-9B7DEB2491C6}" = Catalyst Control Center Graphics Full New
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0EDBEB2B-7C8D-42E6-8312-0F84394A3223}" = Windows Media Center Add-in for Silverlight
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{14AFE241-FC6E-4FDB-BCA0-7AD6F4974171}" = Adobe Setup
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{18455581-E099-4BA8-BC6B-F34B2F06600C}" = Google Toolbar for Internet Explorer
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1a413f37-ed88-4fec-9666-5c48dc4b7bb7}" = YouTube Downloader 2.7.2
"{1A46E1D3-0E8A-B75C-28A3-2DD05838A21B}" = CCC Help Italian
"{1EF419E0-E1FC-2990-C86B-BBB15D51F057}" = Catalyst Control Center Graphics Full Existing
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{2318C2B1-4965-11d4-9B18-009027A5CD4F}" = Google Toolbar for Internet Explorer
"{23F612EA-0F86-472F-2DCE-5C82DDBCC148}" = CCC Help Greek
"{23F79416-CAD1-41BF-99A3-040F6C814AAA}" = NVIDIA Photoshop Plug-ins
"{24036256-BFDB-4CD3-BE8A-A3D6160F2E16}" = TuneUp Utilities 2011
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 20
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{2A3FC24C-6EC0-4519-A52B-FDA4EA9B2D24}" = Windows Live Messenger
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{2C08D7E7-9EE1-4A08-AFE0-745F02DCD6A4}_is1" = Pokemon Online 0.9.95
"{2DB5CB5C-5EA0-D22D-5223-0B57A3A57525}" = CCC Help Czech
"{30C8AA56-4088-426F-91D1-0EDFD3A25678}" = Adobe Dreamweaver CS4
"{3124232A-A9AB-2FAD-6462-454921EDDCDE}" = CCC Help Norwegian
"{32A3A4F4-B792-11D6-A78A-00B0D0160230}" = Java(TM) SE Development Kit 6 Update 23
"{3A12C952-61D5-4C3B-B68B-8CFBE47E22F1}" = Adobe Setup
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{3D9892BB-A751-4E48-ADC8-E4289956CE1D}" = QuickTime
"{411F3ABA-2AB5-4799-AA19-6ADF0A8F7424}" = Adobe Setup
"{43509E18-076E-40FE-AF38-CA5ED400A5A9}" = Pixel Bender Toolkit
"{4363FE00-52E3-E8B5-58EE-1CB396D68000}" = CCC Help Russian
"{44E240EC-2224-4078-A88B-2CEE0D3016EF}" = Adobe After Effects CS4 Presets
"{45EC816C-0771-4C14-AE6D-72D1B578F4C8}" = Adobe After Effects CS4
"{46059418-BB80-F9D4-8DBC-813C28883022}" = CCC Help Chinese Standard
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B1BD47B-51CF-0C0E-21AB-027B331EDFD5}" = CCC Help English
"{4B6E9F7F-7DEE-8570-0FEB-305E000BB462}" = ccc-core-static
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{52FB9C98-2704-DAF1-8999-11EC1C14EB3C}" = Catalyst Control Center Localization All
"{553D7A1E-D263-FBF7-68E0-EA10865BC478}" = CCC Help Dutch
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{58DBB693-BE6E-DA0F-42DE-3944FA9229F9}" = Catalyst Control Center HydraVision Full
"{58F3E8F1-E7CE-B5E8-AF18-C1F1B7C6FB03}" = Catalyst Control Center Graphics Previews Vista
"{5D4C60AA-84E6-4E1A-8A68-69970D387BE1}" = TuneUp Utilities Language Pack (de-DE)
"{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}" = Adobe Dynamiclink Support
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{6582B077-4BC5-3383-4F6D-1F0BC0279120}" = CCC Help Hungarian
"{669B7CF5-FC58-AE3C-EDB1-3950A5E45920}" = Catalyst Control Center Graphics Previews Common
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6E0D0ABC-22CF-8CBB-F3E9-14776A25AA82}" = CCC Help Japanese
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{74CCE403-68F5-7CC9-967B-976229BF5180}" = CCC Help Chinese Traditional
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7BB5E925-A3DD-48C2-9A82-017AF5982FFE}" = Facebook Messenger 2.1.4590.0
"{7CC15B5F-DDA9-43D6-E53F-EE0CCBC8DB1A}" = CCC Help Danish
"{7FF0ACFE-4346-4D9D-B822-C69B99AAE1FC}" = Microsoft_VC80_MFCLOC_x86
"{80AA9FA1-CA39-FC76-D4CE-A5E6C659F4C7}" = CCC Help Portuguese
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{82FB3E3F-1A3F-BBF2-0926-C92F6974EC91}" = Catalyst Control Center Graphics Light
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{85F82863-A6DB-E29B-6B81-4A8582180679}" = CCC Help Thai
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8ACC73AA-6511-7C55-B1A9-8E5D1DEAFAA3}" = The Lord of the Rings FREE Trial 
"{8AE28FB8-B8AE-4B58-A5FE-77F45E462BAE}" = Microsoft_VC80_MFC_x86
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{901DC58A-5C1B-4315-BA40-5AD3D3A463B9}" = REACTOR
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{98A55952-7BE9-0869-A062-B6E402CCBF85}" = CCC Help Spanish
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B88DD94-1AAE-41C4-BD95-2D8737D5E9E2}" = Watson
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D318C86-AF4C-409F-A6AC-7183FF4CF424}" = Internet-TV für Windows Media Center
"{A68F5819-0EF7-72E5-41B4-F26EFC453553}" = CCC Help Finnish
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.3 - Deutsch
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B2D328BE-45AD-4D92-96F9-2151490A203E}" = Apple Application Support
"{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1" = Spybot - Search & Destroy
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}" = Adobe Media Encoder CS4 Additional Exporter
"{BF60B320-3AA3-4DFB-B542-BDA6D4F1A60E}" = Razer Mamba
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{CB07E706-5DD7-4093-83A1-1430D5B6FA75}" = Microsoft_VC80_ATL_x86
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE6C0DE7-8279-435D-AC60-D4C94EED1D4D}" = S4 League_EU
"{CE8C262E-5DB4-C8AC-7DA2-DC88767653A1}" = HydraVision
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CF8C33F5-9279-5A08-7EA0-5624E6D5AD55}" = Catalyst Control Center Core Implementation
"{CF929EEB-CE39-4F06-B1BF-F51FC617A2B2}" = Catalyst Control Center - Branding
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D7BF3B76-EEF9-4868-9B2B-42ABF60B279A}" = Microsoft_VC80_CRT_x86
"{D83BFF4C-FBB6-5A62-C27C-EF5612626205}" = CCC Help German
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE042823-C359-4B87-B66B-308057E8B6AF}" = Camtasia Studio 7
"{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}" = Adobe Media Encoder CS4
"{E000847A-AA69-E617-B038-217F8995FC4A}" = CCC Help French
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E2300343-26C4-11DA-7E89-FD35E1C6FDDA}" = CCC Help Polish
"{E59F4CC1-E338-7141-5B1C-1F4ADF371A87}" = CCC Help Swedish
"{E77D9ABC-BF6A-447A-A92D-28F8F4D402EA}" = XSplit
"{EA2DB6E0-72C5-4ef9-A3A0-E6705F4A6A9E}" = Nexon Game Manager
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F00B33C1-9F1C-FEA5-52EF-EE612E498D8D}" = CCC Help Turkish
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FE0646A7-19D0-41B4-A2BB-2C35D644270D}" = Windows Live OneCare safety scanner
"AC3Filter_is1" = AC3Filter 1.63b
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe_3dcb365ab9e01871fb8c6f27b0ea079" = Adobe After Effects CS4
"Adobe_435a6af7459cb02a9c1138113a26e93" = Adobe Dreamweaver CS3
"Adobe_acce07fd2c8fe7f9e3f26243e626578" = Adobe Dreamweaver CS4
"AhnLab Online Security" = AhnLab Online Security
"Akamai" = Akamai NetSession Interface Service
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BitTorrent" = BitTorrent
"BlueJ_is1" = BlueJ 3.0.3
"DivX Setup" = DivX-Setup
"Europe MapleStory_is1" = Europe MapleStory
"FileZilla Client" = FileZilla Client 3.3.4.1
"Fraps" = Fraps (remove only)
"Greenfoot_is1" = Greenfoot 2.0.0
"Gunz" = ijji - Gunz
"hon" = Heroes of Newerth
"League of Legends_is1" = League of Legends
"LOLReplay" = LOLReplay
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"mIRC" = mIRC
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NCLauncher_GameForge" = NC Launcher (GameForge)
"PhotoScape" = PhotoScape
"Picasa 3" = Picasa 3
"Rainmeter" = Rainmeter
"StarCraft II" = StarCraft II
"Steam App 41010" = Serious Sam HD: The Second Encounter
"Steam App 41014" = Second Edition Full Game
"Steam App 41040" = Serious Sam HD: The Second Encounter Editor
"Steam App 620" = Portal 2
"TeamViewer 5" = TeamViewer 5
"TuneUp Utilities 2011" = TuneUp Utilities 2011
"VertusFluidMask3" = Vertus Fluid Mask 3 3.2.3
"VLC media player" = VLC media player 1.1.2
"Windows Live OneCare safety scanner" = Windows Live OneCare safety scanner
"WinLiveSuite" = Windows Live Essentials
"Xfire" = Xfire (remove only)
"XfireXO Toolbar" = XfireXO Toolbar
"Yahoo! Messenger" = Yahoo! Messenger
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 05.08.2012 22:09:19 | Computer Name = S4League | Source = Google Update | ID = 20
Description = 
 
Error - 06.08.2012 08:36:03 | Computer Name = S4League | Source = Application Error | ID = 1000
Description = Faulting application name: MapleStory.exe, version: 1.0.0.17, time
 stamp: 0x4ff10992  Faulting module name: MapleStory.exe, version: 1.0.0.17, time 
stamp: 0x4ff10992  Exception code: 0xc0000005  Fault offset: 0x006d3d2b  Faulting process
 id: 0x22e0  Faulting application start time: 0x01cd7388087c7bcf  Faulting application
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Faulting module
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Report Id: 48579f5b-dfc3-11e1-8a95-4061865e5a82
 
Error - 06.08.2012 22:09:19 | Computer Name = S4League | Source = Google Update | ID = 20
Description = 
 
Error - 07.08.2012 00:01:59 | Computer Name = S4League | Source = Application Error | ID = 1000
Description = Faulting application name: MapleStory.exe, version: 1.0.0.17, time
 stamp: 0x4ff10992  Faulting module name: MapleStory.exe, version: 1.0.0.17, time 
stamp: 0x4ff10992  Exception code: 0xc0000005  Fault offset: 0x006d3d2b  Faulting process
 id: 0x19e4  Faulting application start time: 0x01cd73fb2ae9b9f1  Faulting application
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Faulting module
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Report Id: a29e8365-e044-11e1-8a95-4061865e5a82
 
Error - 07.08.2012 00:05:41 | Computer Name = S4League | Source = Application Error | ID = 1000
Description = Faulting application name: MapleStory.exe, version: 1.0.0.17, time
 stamp: 0x4ff10992  Faulting module name: MapleStory.exe, version: 1.0.0.17, time 
stamp: 0x4ff10992  Exception code: 0xc0000005  Fault offset: 0x006d3d2b  Faulting process
 id: 0x1d50  Faulting application start time: 0x01cd74516c3fad0c  Faulting application
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Faulting module
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Report Id: 26b3f0b1-e045-11e1-8a95-4061865e5a82
 
Error - 07.08.2012 08:17:15 | Computer Name = S4League | Source = Application Error | ID = 1000
Description = Faulting application name: MapleStory.exe, version: 1.0.0.17, time
 stamp: 0x4ff10992  Faulting module name: MapleStory.exe, version: 1.0.0.17, time 
stamp: 0x4ff10992  Exception code: 0xc0000005  Fault offset: 0x006d3d2b  Faulting process
 id: 0x1f94  Faulting application start time: 0x01cd7451ead0f94b  Faulting application
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Faulting module
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Report Id: d2cb5371-e089-11e1-8a95-4061865e5a82
 
Error - 07.08.2012 08:39:36 | Computer Name = S4League | Source = Application Error | ID = 1000
Description = Faulting application name: MapleStory.exe, version: 1.0.0.17, time
 stamp: 0x4ff10992  Faulting module name: MapleStory.exe, version: 1.0.0.17, time 
stamp: 0x4ff10992  Exception code: 0xc0000005  Fault offset: 0x006d3d2b  Faulting process
 id: 0x21c  Faulting application start time: 0x01cd7496e01a761a  Faulting application
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Faulting module
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Report Id: f1dee02c-e08c-11e1-8a95-4061865e5a82
 
Error - 07.08.2012 10:20:30 | Computer Name = S4League | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Users\Dream\Desktop\esetsmartinstaller_enu.exe".Error
 in manifest or policy file "" on line .  A component version required by the application
 conflicts with another component version already active.  Conflicting components 
are:.  Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 07.08.2012 14:37:49 | Computer Name = S4League | Source = SideBySide | ID = 16842832
Description = Activation context generation failed for "C:\Users\Dream\Desktop\esetsmartinstaller_enu.exe".Error
 in manifest or policy file "" on line .  A component version required by the application
 conflicts with another component version already active.  Conflicting components 
are:.  Component 1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Component
 2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
 
Error - 07.08.2012 14:39:27 | Computer Name = S4League | Source = Application Hang | ID = 1002
Description = The program firefox.exe version 14.0.1.4577 stopped interacting with
 Windows and was closed. To see if more information about the problem is available,
 check the problem history in the Action Center control panel.    Process ID: a70    Start
 Time: 01cd74cbca3402bf    Termination Time: 30    Application Path: C:\Program Files (x86)\Mozilla
 Firefox\firefox.exe    Report Id: 2645d830-e0bf-11e1-bbb0-4061865e5a82  
 
Error - 07.08.2012 14:42:19 | Computer Name = S4League | Source = Application Error | ID = 1000
Description = Faulting application name: MapleStory.exe, version: 1.0.0.17, time
 stamp: 0x4ff10992  Faulting module name: MapleStory.exe, version: 1.0.0.17, time 
stamp: 0x4ff10992  Exception code: 0xc0000005  Fault offset: 0x0039f86f  Faulting process
 id: 0x1054  Faulting application start time: 0x01cd74cc52c2c59a  Faulting application
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Faulting module
 path: C:\Program Files (x86)\NEXON\Europe MapleStory\MapleStory.exe  Report Id: 9dbf77ea-e0bf-11e1-bbb0-4061865e5a82
 
[ Media Center Events ]
Error - 02.05.2011 10:17:51 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 16:17:45 - Error connecting to the internet.  16:17:45 -     Unable 
to contact server..  
 
Error - 03.05.2011 09:52:33 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 15:52:33 - Failed to retrieve Directory (Error: The remote name could
 not be resolved: 'data.tvdownload.microsoft.com')  
 
Error - 03.05.2011 09:53:10 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 15:52:58 - Failed to retrieve MCESpotlight (Error: The remote name
 could not be resolved: 'data.tvdownload.microsoft.com')  
 
Error - 03.05.2011 09:53:29 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 15:53:22 - Failed to retrieve MCEClientUX (Error: The remote name 
could not be resolved: 'data.tvdownload.microsoft.com')  
 
Error - 04.05.2011 10:17:38 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 16:17:38 - Failed to retrieve Directory (Error: The remote name could
 not be resolved: 'data.tvdownload.microsoft.com')  
 
Error - 04.05.2011 10:18:15 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 16:18:03 - Failed to retrieve MCEClientUX (Error: The remote name 
could not be resolved: 'data.tvdownload.microsoft.com')  
 
Error - 04.05.2011 10:18:33 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 16:18:27 - Failed to retrieve Broadband (Error: The remote name could
 not be resolved: 'data.tvdownload.microsoft.com')  
 
Error - 05.05.2011 21:50:38 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 03:50:33 - Error connecting to the internet.  03:50:33 -     Unable 
to contact server..  
 
Error - 05.05.2011 22:51:16 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 04:51:15 - Error connecting to the internet.  04:51:15 -     Unable 
to contact server..  
 
Error - 05.05.2011 23:53:15 | Computer Name = S4League | Source = MCUpdate | ID = 0
Description = 05:53:14 - Error connecting to the internet.  05:53:14 -     Unable 
to contact server..  
 
[ System Events ]
Error - 07.08.2012 14:25:04 | Computer Name = S4League | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 07.08.2012 14:25:04 | Computer Name = S4League | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 07.08.2012 14:30:04 | Computer Name = S4League | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 07.08.2012 14:30:04 | Computer Name = S4League | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 07.08.2012 14:30:04 | Computer Name = S4League | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 07.08.2012 14:32:12 | Computer Name = S4League | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 07.08.2012 14:32:12 | Computer Name = S4League | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 07.08.2012 14:32:12 | Computer Name = S4League | Source = Service Control Manager | ID = 7001
Description = The Computer Browser service depends on the Server service which failed
 to start because of the following error:   %%1068
 
Error - 07.08.2012 14:36:53 | Computer Name = S4League | Source = Service Control Manager | ID = 7026
Description = The following boot-start or system-start driver(s) failed to load:
   cdrom
 
Error - 07.08.2012 14:38:10 | Computer Name = S4League | Source = DCOM | ID = 10010
Description = 
 
 
< End of report >

Code:

ATTFilter

OTL logfile created on: 07.08.2012 20:39:59 - Run 1
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Users\Dream\Desktop
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7601.17514)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,48 Gb Available Physical Memory | 62,05% Memory free
8,00 Gb Paging File | 6,28 Gb Available in Paging File | 78,58% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 355,56 Gb Free Space | 38,17% Space Free | Partition Type: NTFS
 
Computer Name: S4LEAGUE | User Name: Dream | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Dream\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\LOLReplay\LOLRecorder.exe (LOL Replay)
PRC - C:\Users\Dream\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe (Facebook)
PRC - C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe ()
PRC - C:\Program Files (x86)\Razer\Mamba\RazerMambaSysTray.exe (Razer USA Ltd)
PRC - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
PRC - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe (Safer Networking Ltd.)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files (x86)\LOLReplay\LOLUtils.dll ()
MOD - C:\Users\Dream\AppData\Local\Facebook\Messenger\2.1.4590.0\libcef.dll ()
MOD - C:\Users\Dream\AppData\Local\Facebook\Messenger\2.1.4590.0\CefSharp.WinForms.dll ()
MOD - C:\Users\Dream\AppData\Local\Facebook\Messenger\2.1.4590.0\CefSharp.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\a501b7960f6c6e2e39162b83f3303aaa\System.Web.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\7b7fbe651c6e72f12099a298654c9594\System.Windows.Forms.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\e717a230496832656b05b515eb9f3bc5\PresentationFramework.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\6bb439b3f87736d3248ae27d43e2c0d6\System.Drawing.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\14a87218ea49639f38097e278b98a3da\PresentationCore.ni.dll ()
MOD - C:\Nexon\NEXON_EU_Downloader\NEXON_EU_Downloader_Engine.exe ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\8e56489276063ededde74e597a121df3\PresentationFramework.Aero.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Data\f3814b488d9e083cbbc623e01b389f09\System.Data.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\46fce56db7685a586d3eeb7c373e3c1c\WindowsBase.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\ba3d70b651454c7d49b407b93663bfed\System.Xml.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\ce9ff6baf9053ed2ed673d948179195c\System.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cfa9c506bfb9254c89dace7b83bc9f9d\System.Configuration.ni.dll ()
MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\acfc1391e45fedd2a359778ea57d914c\mscorlib.ni.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdateCheck.dll ()
MOD - C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
MOD - C:\Windows\assembly\GAC_32\System.Data\2.0.0.0__b77a5c561934e089\System.Data.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (UxTuneUp) -- C:\Windows\SysNative\uxtuneup.dll (TuneUp Software)
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll ()
SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (HiPatchService) -- C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesService64.exe (TuneUp Software)
SRV - (UxTuneUp) -- C:\Windows\SysWOW64\uxtuneup.dll (TuneUp Software)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (nlsX86cc) -- C:\Windows\SysWOW64\nlssrv32.exe (Nalpeiron Ltd.)
SRV - (FLEXnet Licensing Service) -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.)
SRV - (TeamViewer5) -- C:\Program Files (x86)\TeamViewer\Version5\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (npggsvc) -- C:\Windows\SysWOW64\GameMon.des (INCA Internet Co., Ltd.)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (PxHlpa64) -- C:\Windows\SysNative\drivers\PxHlpa64.sys (Sonic Solutions)
DRV:64bit: - (ssudmdm) -- C:\Windows\SysNative\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (dg_ssudbus) -- C:\Windows\SysNative\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (vpcvmm) -- C:\Windows\SysNative\drivers\vpcvmm.sys (Microsoft Corporation)
DRV:64bit: - (vpcbus) -- C:\Windows\SysNative\drivers\vpchbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (vpcusb) -- C:\Windows\SysNative\drivers\vpcusb.sys (Microsoft Corporation)
DRV:64bit: - (vpcuxd) -- C:\Windows\SysNative\drivers\vpcuxd.sys (Microsoft Corporation)
DRV:64bit: - (vpcnfltr) -- C:\Windows\SysNative\drivers\vpcnfltr.sys (Microsoft Corporation)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation)
DRV:64bit: - (VKbms) -- C:\Windows\SysNative\drivers\VKbms.sys (Windows (R) Win 7 DDK provider)
DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys ()
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (AtiHdmiService) -- C:\Windows\SysNative\drivers\AtiHdmi.sys (ATI Technologies, Inc.)
DRV:64bit: - (Mkd3kfNt) -- C:\Windows\SysNative\drivers\mkd3kfnt.sys (AhnLab, Inc.)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (netr28ux) -- C:\Windows\SysNative\drivers\netr28ux.sys (Ralink Technology Corp.)
DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek                                            )
DRV:64bit: - (AtiPcie) -- C:\Windows\SysNative\drivers\AtiPcie.sys (Advanced Micro Devices Inc.)
DRV:64bit: - (Mkd2Nadr) -- C:\Windows\SysNative\drivers\Mkd2Nadr.sys (AhnLab, Inc.)
DRV:64bit: - (adfs) -- C:\Windows\SysNative\drivers\adfs.sys (Adobe Systems, Inc.)
DRV:64bit: - (DAdderFltr) -- C:\Windows\SysNative\drivers\dadder.sys (Razer (Asia-Pacific) Pte Ltd)
DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2011\TuneUpUtilitiesDriver64.sys (TuneUp Software)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
DRV - (NPPTNT2) -- C:\Windows\SysWOW64\npptNT2.sys (INCA Internet Co., Ltd.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook:  - No CLSID value found
IE - HKLM\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
 
 
 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = https://docs.google.com/spreadsheet/ccc?key=0Agyu6dPTNdq2dFpWanpKdGdwejVaVWxMYWh2VVRNMWc#gid=0
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = BB 19 47 08 00 50 CB 01  [binary data]
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes,DefaultScope = {66FE2A85-FEAA-424A-A7D8-274260EF1EB2}
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{66FE2A85-FEAA-424A-A7D8-274260EF1EB2}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&rlz=1I7GGHP_deDE474
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms}
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "data:text/plain,browser.startup.homepage=hxxp://de.search.yahoo.com/firefox/?fr=foxload-sfp"
FF - prefs.js..CommunityToolbar.SearchFromAddressBarSavedUrl: "data:text/plain,keyword.URL=hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=foxload&type=moz35awe&p="
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "hxxp://grooveshark.com/#!/playlist/Ty+Oce/68473628"
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..extensions.enabledItems: {5e5ab302-7f65-44cd-8211-c1d4caaccea3}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.86.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q="
FF - prefs.js..network.proxy.ftp: "94.102.153.150"
FF - prefs.js..network.proxy.ftp_port: 8888
FF - prefs.js..network.proxy.http: "109.123.126.253"
FF - prefs.js..network.proxy.http_port: 8080
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co"
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "94.102.153.150"
FF - prefs.js..network.proxy.socks_port: 8888
FF - prefs.js..network.proxy.ssl: "94.102.153.150"
FF - prefs.js..network.proxy.ssl_port: 8888
FF - prefs.js..network.proxy.type: 0
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@ahnlab.com/asp/npaosmgr.1: C:\Program Files (x86)\AhnLab\ASP\Components\aosmgr\conflict_221\npaosmgr.dll (AhnLab, Inc.)
FF - HKLM\Software\MozillaPlugins\@ahnlab.com/asp/npmkd25aos: C:\Program Files (x86)\AhnLab\ASP\MyKeyDefense 2.5\npmkd25aos.dll (AhnLab, Inc.)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files (x86)\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nexon.net/NxGame: C:\ProgramData\NexonUS\NGM\npNxGameUS.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=1.1.2: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (the VideoLAN Team)
FF - HKCU\Software\MozillaPlugins\@ahnlab.com/asp/npmkd25aos: C:\Program Files (x86)\AhnLab\ASP\MyKeyDefense 2.5\npmkd25aos.dll (AhnLab, Inc.)
FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Dream\AppData\Local\Facebook\Messenger\2.1.4590.0\npFbDesktopPlugin.dll (Facebook, Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.21 15:09:02 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 09:45:43 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.07.22 00:03:16 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 09:45:43 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2011.07.22 00:03:16 | 000,000,000 | ---D | M]
 
[2010.08.11 12:40:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dream\AppData\Roaming\Mozilla\Extensions
[2010.08.11 12:38:47 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\extensions
[2010.08.11 12:38:47 | 000,000,000 | ---D | M] (XfireXO Toolbar) -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}
[2012.08.04 21:57:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\extensions
[2012.04.12 11:06:27 | 000,000,000 | ---D | M] (ChatZilla) -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2012.07.16 11:59:22 | 000,000,000 | ---D | M] (XfireXO Community Toolbar) -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}
[2012.07.30 21:51:28 | 000,000,000 | ---D | M] (LastPass) -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\extensions\support@lastpass.com
[2012.06.21 08:07:44 | 000,000,000 | ---D | M] (LavaFox V2-Purple) -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\extensions\zigboom555@aol.com
[2010.08.05 21:30:44 | 000,000,917 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\conduit.xml
[2010.09.29 00:49:30 | 000,002,059 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\daemon-search.xml
[2012.08.03 21:53:36 | 000,001,056 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\icqplugin.xml
[2012.06.09 09:55:43 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2012.07.27 18:04:53 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.02.21 15:09:02 | 000,000,000 | ---D | M] (DivX Plus Web Player HTML5 &lt;video&gt;) -- C:\PROGRAM FILES (X86)\DIVX\DIVX PLUS WEB PLAYER\FIREFOX\DIVXHTML5
[2011.08.23 02:28:29 | 000,413,408 | ---- | M] () (No name found) -- C:\USERS\DREAM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL6QH8AD.DEFAULT\EXTENSIONS\{C45C406E-AB73-11D8-BE73-000A95BE3B12}.XPI
[2011.10.30 11:25:12 | 000,434,392 | ---- | M] () (No name found) -- C:\USERS\DREAM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL6QH8AD.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI
[2012.07.30 21:51:27 | 000,184,864 | ---- | M] () (No name found) -- C:\USERS\DREAM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\UL6QH8AD.DEFAULT\EXTENSIONS\STEALTHYEXTENSION@GMAIL.COM.XPI
[2012.07.18 09:45:43 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2010.08.23 00:44:12 | 000,411,368 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll
[2010.07.27 16:13:46 | 000,027,136 | ---- | M] (NHN USA Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npijjiautoinstallpluginff.dll
[2012.06.27 18:54:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.27 18:54:52 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.27 18:54:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.27 18:54:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.27 18:54:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.27 18:54:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2012.03.29 20:19:41 | 000,441,882 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: 127.0.0.1 activate.adobe.com
O1 - Hosts: 127.0.0.1 3dns-3.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns-3.adobe.com
O1 - Hosts: 127.0.0.1 ereg.wip3.adobe.com
O1 - Hosts: 127.0.0.1 activate-sea.adobe.com
O1 - Hosts: 127.0.0.1 wip3.adobe.com
O1 - Hosts: 127.0.0.1 wwis-dubc1-vip60.adobe.com
O1 - Hosts: 127.0.0.1 activate-sjc0.adobe.com
O1 - Hosts: 127.0.0.1 practivate.adobe.com
O1 - Hosts: 127.0.0.1 ereg.adobe.com
O1 - Hosts: 127.0.0.1 activate.wip3.adobe.com
O1 - Hosts: 127.0.0.1 3dns-2.adobe.com
O1 - Hosts: 127.0.0.1 adobe-dns.adobe.com 
O1 - Hosts: ::1             localhost
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 15189 more lines...
O2:64bit: - BHO: (Google Toolbar Helper) - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O2:64bit: - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files\Google\GoogleToolbarNotifier\5.7.7227.1100\swg64.dll (Google Inc.)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.7.7227.1100\swg.dll (Google Inc.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (Google Toolbar) - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.)
O3:64bit: - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
O3:64bit: - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found
O3 - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\Run: [Razer Mamba Elite Driver] C:\Program Files (x86)\Razer\Mamba\RazerMambaSysTray.exe (Razer USA Ltd)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000..\Run: [Facebook Update] C:\Users\Dream\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
O4 - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000..\Run: [KPeerNexonEU] C:\Nexon\NEXON_EU_Downloader\nxEULauncher.exe (NEXON Inc.)
O4 - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Dream\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk = C:\Users\Dream\AppData\Local\Facebook\Messenger\2.1.4590.0\FacebookMessenger.exe (Facebook)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {5D6F45B3-9043-443D-A792-115447494D24} hxxp://messenger.zone.msn.com/MessengerGamesContent/GameContent/de/uno1/GAME_UNO1.cab (UnoCtrl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 10.4.1)
O16 - DPF: {93C449FA-ECFB-402F-A8C7-37E4F8D60E49} hxxp://dl.pmang.com/common/pmangctl/pmangax.cab (Pmang Login Control)
O16 - DPF: {C3F79A2B-B9B4-4A66-B012-3EE46475B072} hxxp://messenger.zone.msn.com/binary/MessengerStatsPAClient.cab56907.cab (MessengerStatsClient Class)
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 10.4.1)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{59D97570-C9C0-4653-95B5-2FAA8D658592}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F1EF5C08-EC53-45C5-88C8-9A5BDB63E57B}: DhcpNameServer = 81.173.194.69 81.173.194.77
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\Shell - "" = AutoRun
O33 - MountPoints2\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{5c95afd0-c077-11e1-84e5-4061865e5a82}\Shell - "" = AutoRun
O33 - MountPoints2\{5c95afd0-c077-11e1-84e5-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\Shell - "" = AutoRun
O33 - MountPoints2\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O33 - MountPoints2\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\Shell - "" = AutoRun
O33 - MountPoints2\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.07 16:18:01 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Dream\Desktop\esetsmartinstaller_enu.exe
[2012.08.07 15:17:35 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Dream\Desktop\OTL.exe
[2012.08.07 14:54:30 | 000,000,000 | ---D | C] -- C:\Users\Dream\AppData\Roaming\Malwarebytes
[2012.08.07 14:54:25 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.07 14:54:24 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.07 14:54:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.07 14:54:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.07 14:35:48 | 000,000,000 | ---D | C] -- C:\ProgramData\rifldanvmwxuukm
[2012.07.27 19:07:33 | 000,000,000 | ---D | C] -- C:\Users\Dream\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook
[2012.07.27 19:07:30 | 000,000,000 | -HSD | C] -- C:\Config.Msi
[2012.07.17 20:59:15 | 000,000,000 | ---D | C] -- C:\Users\Dream\Desktop\sluts
[2012.07.11 15:34:14 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll
[2012.07.11 15:34:14 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll
[2012.07.11 15:34:07 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll
[2012.07.11 15:34:04 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll
[2012.07.11 15:34:04 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.07 20:44:35 | 000,014,416 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.07 20:44:34 | 000,014,416 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.07 20:37:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2012.08.07 20:36:33 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.07 20:36:29 | 3220,578,304 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.07 16:18:09 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Dream\Desktop\esetsmartinstaller_enu.exe
[2012.08.07 15:19:51 | 000,614,903 | ---- | M] () -- C:\Users\Dream\Desktop\adwcleaner.exe
[2012.08.07 15:17:38 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Dream\Desktop\OTL.exe
[2012.08.07 15:16:19 | 000,060,639 | ---- | M] () -- C:\Users\Dream\Desktop\OTL.png
[2012.08.07 14:54:25 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.07 14:35:50 | 000,000,051 | ---- | M] () -- C:\ProgramData\qmbiyhlgyfivtlu
[2012.08.07 14:15:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.07 14:03:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2012.08.07 13:07:01 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000UA.job
[2012.08.07 01:07:01 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000Core.job
[2012.08.03 06:15:14 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.08.03 06:15:14 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.01 08:49:59 | 002,359,352 | ---- | M] () -- C:\Users\Dream\Desktop\Maple0022.bmp
[2012.08.01 08:49:59 | 000,000,132 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2012.07.29 17:19:43 | 000,001,997 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk
[2012.07.27 20:50:00 | 000,222,552 | ---- | M] () -- C:\Users\Dream\Desktop\Untitled-1.psd
[2012.07.27 20:49:54 | 000,270,056 | ---- | M] () -- C:\Users\Dream\Desktop\Zeyben.bmp
[2012.07.27 20:30:43 | 000,017,976 | ---- | M] () -- C:\Users\Dream\Desktop\Untitled-2.bmp
[2012.07.27 19:14:04 | 000,792,550 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.27 19:14:04 | 000,661,476 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.27 19:14:04 | 000,125,666 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.27 19:07:33 | 000,001,298 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Facebook Messenger.lnk
[2012.07.27 18:57:30 | 000,446,464 | ---- | M] (NEXON Inc.) -- C:\Windows\NEXON_EU_DownloaderUpdater.exe
[2012.07.27 18:57:30 | 000,000,235 | ---- | M] () -- C:\Windows\SysWow64\nxEuUninstall.bat
[2012.07.22 10:41:07 | 000,166,693 | ---- | M] () -- C:\Users\Dream\Desktop\blablabla.jpg
[2012.07.19 23:56:32 | 000,123,279 | ---- | M] () -- C:\Users\Dream\Desktop\OSQH7Cokjf6D7NIfNi83GtU84RBrVMXrl-zmm80wbZkjhQfiFNYPWhldU2rkU6uFHGxxRbxFaEM.jpg
[2012.07.18 09:45:45 | 000,002,048 | ---- | M] () -- C:\Users\Dream\Application Data\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk
[2012.07.16 17:33:28 | 000,597,656 | ---- | M] () -- C:\Users\Dream\Desktop\Cerberos Gaming.bmp
[2012.07.16 17:27:14 | 001,208,101 | ---- | M] () -- C:\Users\Dream\Desktop\Cerberos Gaming.psd
[2012.07.12 03:23:25 | 004,878,288 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.07 15:19:46 | 000,614,903 | ---- | C] () -- C:\Users\Dream\Desktop\adwcleaner.exe
[2012.08.07 15:17:05 | 000,060,639 | ---- | C] () -- C:\Users\Dream\Desktop\OTL.png
[2012.08.07 14:54:25 | 000,001,113 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2012.08.07 14:35:45 | 000,000,051 | ---- | C] () -- C:\ProgramData\qmbiyhlgyfivtlu
[2012.08.01 08:49:56 | 002,359,352 | ---- | C] () -- C:\Users\Dream\Desktop\Maple0022.bmp
[2012.07.27 20:49:59 | 000,222,552 | ---- | C] () -- C:\Users\Dream\Desktop\Untitled-1.psd
[2012.07.27 20:49:52 | 000,270,056 | ---- | C] () -- C:\Users\Dream\Desktop\Zeyben.bmp
[2012.07.27 20:30:39 | 000,017,976 | ---- | C] () -- C:\Users\Dream\Desktop\Untitled-2.bmp
[2012.07.22 10:41:04 | 000,166,693 | ---- | C] () -- C:\Users\Dream\Desktop\blablabla.jpg
[2012.07.19 23:56:32 | 000,123,279 | ---- | C] () -- C:\Users\Dream\Desktop\OSQH7Cokjf6D7NIfNi83GtU84RBrVMXrl-zmm80wbZkjhQfiFNYPWhldU2rkU6uFHGxxRbxFaEM.jpg
[2012.07.16 17:33:25 | 000,597,656 | ---- | C] () -- C:\Users\Dream\Desktop\Cerberos Gaming.bmp
[2012.07.16 17:27:12 | 001,208,101 | ---- | C] () -- C:\Users\Dream\Desktop\Cerberos Gaming.psd
[2012.06.20 22:03:17 | 000,015,204 | ---- | C] () -- C:\Users\Dream\77.jpg
[2012.06.20 22:03:17 | 000,012,004 | ---- | C] () -- C:\Users\Dream\78.jpg
[2012.06.20 22:03:17 | 000,011,859 | ---- | C] () -- C:\Users\Dream\8.jpg
[2012.06.20 22:03:17 | 000,011,183 | ---- | C] () -- C:\Users\Dream\7.jpg
[2012.06.20 22:03:17 | 000,009,881 | ---- | C] () -- C:\Users\Dream\3.jpg
[2012.06.20 22:03:17 | 000,009,277 | ---- | C] () -- C:\Users\Dream\32.jpg
[2012.06.20 22:03:17 | 000,009,022 | ---- | C] () -- C:\Users\Dream\66.jpg
[2012.06.20 22:03:17 | 000,008,536 | ---- | C] () -- C:\Users\Dream\65.jpg
[2012.06.20 22:03:17 | 000,008,168 | ---- | C] () -- C:\Users\Dream\29.jpg
[2012.05.03 04:54:46 | 000,042,392 | ---- | C] () -- C:\Windows\SysWow64\xfcodec.dll
[2012.01.26 19:01:31 | 000,158,855 | ---- | C] () -- C:\Users\Dream\q net pw login.png
[2012.01.25 20:47:55 | 000,000,046 | R--- | C] () -- C:\Users\Dream\jam-nmr-mp3.rm
[2012.01.11 01:34:05 | 000,104,861 | ---- | C] () -- C:\Users\Dream\BarWhite.rar
[2012.01.11 01:29:59 | 001,503,806 | ---- | C] () -- C:\Users\Dream\Rumble.png
[2012.01.11 01:29:51 | 013,072,948 | ---- | C] () -- C:\Users\Dream\Rumble.psd
[2012.01.11 01:24:14 | 001,392,000 | ---- | C] () -- C:\Users\Dream\Rainmeter-2.2.exe
[2012.01.11 01:03:19 | 000,646,571 | ---- | C] () -- C:\Users\Dream\rumble_pirate[1].jpg
[2012.01.11 01:02:04 | 000,427,269 | ---- | C] () -- C:\Users\Dream\Rumble_in_the_jungle[1].jpg
[2012.01.11 00:54:25 | 000,000,355 | ---- | C] () -- C:\Users\Dream\Computer - Shortcut.lnk
[2012.01.07 20:31:37 | 000,001,836 | ---- | C] () -- C:\Users\Dream\RustyHearts.lnk
[2011.11.19 00:04:21 | 000,096,551 | ---- | C] () -- C:\Users\Dream\tumblr_lsx3fuYNl21qguhtbo1_500.jpg
[2011.11.18 23:59:59 | 000,124,710 | ---- | C] () -- C:\Users\Dream\blade_goddess_irelia_by_erina-d4cwqjw.jpg
[2011.11.18 23:58:04 | 000,185,698 | ---- | C] () -- C:\Users\Dream\irelia__the_first_rozen_maiden_by_k3lp0-d3l9g1h.jpg
[2011.11.18 23:56:25 | 000,026,797 | ---- | C] () -- C:\Users\Dream\24049-irelia.irelia-by-urusai-baka-d4e9otq.jpg
[2011.11.13 02:04:43 | 000,380,002 | ---- | C] () -- C:\Users\Dream\tumblr_ln861sQDOT1qjhj7ao1_1280.jpg
[2011.11.13 02:03:40 | 000,067,661 | ---- | C] () -- C:\Users\Dream\tumblr_lk4af5v4my1qevzluo1_500.jpg
[2011.11.13 01:54:11 | 000,547,918 | ---- | C] () -- C:\Users\Dream\irelia.jpg
[2011.11.11 01:15:00 | 001,529,830 | ---- | C] () -- C:\Users\Dream\champs.png
[2011.10.17 01:46:20 | 000,687,638 | ---- | C] () -- C:\Users\Dream\TooStrong.psd
[2011.10.16 00:48:13 | 000,111,540 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2011.10.09 20:34:44 | 070,399,111 | ---- | C] () -- C:\Users\Dream\YuGiOhPlaymat1.psd
[2011.10.09 20:33:28 | 065,830,484 | ---- | C] () -- C:\Users\Dream\150dpi.psd
[2011.10.09 17:38:25 | 089,516,219 | ---- | C] () -- C:\Users\Dream\Custom_Playmat_Templates__version_4.0_Hyoma.rar
[2011.08.25 04:06:09 | 000,046,976 | ---- | C] () -- C:\Users\Dream\Irelia.veg
[2011.08.23 18:43:53 | 001,589,396 | ---- | C] () -- C:\Users\Dream\SiehtAlles.psd
[2011.07.03 20:42:59 | 001,753,854 | ---- | C] () -- C:\Users\Dream\AW.psd
[2011.06.26 12:05:01 | 000,154,757 | ---- | C] () -- C:\Users\Dream\gaming_sig.png
[2011.06.11 10:23:05 | 012,414,020 | ---- | C] () -- C:\Users\Dream\Eminem feat. Lil Wayne No love.mp4
[2011.06.10 07:40:38 | 003,985,408 | ---- | C] () -- C:\Users\Dream\Nasus Dubstep.mp3
[2011.05.31 18:30:19 | 006,299,227 | ---- | C] () -- C:\Users\Dream\LMFAO - Party Rock Anthem (Official Lyrics on Screen) [HQ_HD].mp4
[2011.05.24 00:29:26 | 019,715,774 | ---- | C] () -- C:\Users\Dream\Ashley Tisdale - It's Alright, It's Ok.flv
[2011.05.23 23:10:08 | 006,999,803 | ---- | C] () -- C:\Users\Dream\Diddy - Dirty Money - Coming Home ft. Skylar Grey .mp3
[2011.05.18 02:03:10 | 000,418,972 | ---- | C] () -- C:\Users\Dream\QualiEGO0.png
[2011.05.18 02:01:40 | 005,142,673 | ---- | C] () -- C:\Users\Dream\QualiEGO.psd
[2011.05.17 21:23:50 | 001,027,425 | ---- | C] () -- C:\Users\Dream\Love_You.png
[2011.05.17 20:26:55 | 000,525,080 | ---- | C] () -- C:\Users\Dream\QualiEGO.png
[2011.05.02 21:31:22 | 055,990,824 | ---- | C] () -- C:\Users\Dream\Hectic - Ascension.mp4
[2011.04.19 01:27:24 | 010,894,053 | ---- | C] () -- C:\Users\Dream\I'll Make a Man Out of You.flv
[2011.04.19 00:52:18 | 005,750,771 | ---- | C] () -- C:\Users\Dream\One Piece Soundtracks~01~Die Legende Full version (Deutsch-German).flv
[2011.04.18 17:19:06 | 011,540,113 | ---- | C] () -- C:\Users\Dream\Breaking Benjamin - So Cold.flv
[2011.04.17 18:55:22 | 000,000,470 | ---- | C] () -- C:\Users\Dream\listen-dsl.asx
[2011.04.17 16:11:06 | 085,853,157 | ---- | C] () -- C:\Users\Dream\[Loaded] Clan Frag movie.mp4
[2011.04.16 16:17:00 | 010,289,302 | ---- | C] () -- C:\Users\Dream\Rise Against - Injection.flv
[2011.04.11 23:21:54 | 004,250,518 | ---- | C] () -- C:\Users\Dream\She - Coloris.flv
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\SysWow64\xlive.dll.cat
[2011.04.06 21:52:46 | 007,598,901 | ---- | C] () -- C:\Users\Dream\One dream - Jayed.flv
[2011.02.24 16:07:48 | 000,151,552 | ---- | C] () -- C:\Windows\SysWow64\nvRegDev.dll
[2011.02.13 21:40:07 | 000,000,132 | ---- | C] () -- C:\Users\Dream\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2011.02.13 21:39:12 | 000,000,132 | ---- | C] () -- C:\Users\Dream\AppData\Roaming\Adobe BMP Format CS5 Prefs
[2010.10.09 02:02:56 | 000,000,132 | ---- | C] () -- C:\Users\Dream\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.10.08 23:43:05 | 000,006,656 | ---- | C] () -- C:\Users\Dream\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.09.25 15:24:24 | 000,779,174 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2010.08.23 22:06:47 | 000,190,861 | ---- | C] () -- C:\Users\Dream\loveu.jpg
[2010.08.17 12:58:21 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.08.11 13:23:13 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.08.11 10:29:15 | 000,394,183 | ---- | C] () -- C:\Users\Dream\S4 Farmbot + Autologin by Woche3 v.1.3.exe
 
========== LOP Check ==========
 
[2012.06.17 13:35:26 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\BitTorrent
[2010.09.29 12:06:14 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\com.adobe.bridge.PublishPanel
[2010.09.30 18:25:13 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\DAEMON Tools Lite
[2012.06.27 13:29:31 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\FileZilla
[2011.08.22 04:26:43 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\ICQ
[2012.04.12 12:50:18 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\ijjigame
[2010.08.11 16:12:22 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\LolClient
[2012.05.25 21:47:05 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\LolClient2
[2010.08.29 01:11:03 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\PhotoScape
[2010.09.10 17:36:55 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\Publish Providers
[2012.01.11 01:27:55 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\Rainmeter
[2011.11.12 16:09:15 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\Razer
[2010.09.07 22:41:37 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\Sony
[2012.01.26 15:51:38 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\SplitMediaLabs
[2010.09.14 16:40:51 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\TeamViewer
[2012.04.15 13:19:09 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\Tencent
[2012.06.27 18:50:18 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\TS3Client
[2011.04.06 12:45:09 | 000,000,000 | ---D | M] -- C:\Users\Dream\AppData\Roaming\TuneUp Software
[2012.05.14 14:55:28 | 000,000,000 | ---D | M] -- C:\Users\Maple Story\AppData\Roaming\Rainmeter
[2011.07.29 18:51:21 | 000,000,000 | ---D | M] -- C:\Users\Maple Story\AppData\Roaming\TuneUp Software
[2012.08.07 01:07:01 | 000,001,116 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000Core.job
[2012.08.07 13:07:01 | 000,001,138 | ---- | M] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000UA.job
[2012.04.24 08:25:40 | 000,032,608 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Files - Unicode (All) ==========
[2011.07.25 17:53:14 | 000,001,121 | ---- | M] ()(C:\Users\Dream\?? ?? ?? -?? ??.contact) -- C:\Users\Dream\럭키 스타 녹색 -럭키 스타.contact
[2011.07.25 17:53:14 | 000,001,121 | ---- | C] ()(C:\Users\Dream\?? ?? ?? -?? ??.contact) -- C:\Users\Dream\럭키 스타 녹색 -럭키 스타.contact

< End of report >

t'john · 07.08.2012, 20:12

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
Starte die OTL.exe.
Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

Code:

ATTFilter

:OTL
SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll () 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 
IE - HKLM\..\URLSearchHook: - No CLSID value found 
IE - HKLM\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) 
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found 
IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\URLSearchHook: - No CLSID value found 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes,DefaultScope = {66FE2A85-FEAA-424A-A7D8-274260EF1EB2} 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{66FE2A85-FEAA-424A-A7D8-274260EF1EB2}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&rlz=1I7GGHP_deDE474 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = http://www.daemon-search.com/search/web?q={searchTerms} 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157 
IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
FF - prefs.js..browser.startup.homepage: "data:text/plain,browser.startup.homepage=http://de.search.yahoo.com/firefox/?fr=foxload-sfp" 
FF - prefs.js..CommunityToolbar.SearchFromAddressBarSavedUrl: "data:text/plain,keyword.URL=http://de.search.yahoo.com/search?ei=UTF-8&fr=foxload&type=moz35awe&p=" 
FF - prefs.js..browser.search.defaultenginename: "ICQ Search" 
FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search" 
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}" 
FF - prefs.js..browser.search.selectedEngine: "Google" 
FF - prefs.js..browser.startup.homepage: "http://grooveshark.com/#!/playlist/Ty+Oce/68473628" 
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 
FF - prefs.js..keyword.URL: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q=" 
FF - prefs.js..network.proxy.ftp: "94.102.153.150" 
FF - prefs.js..network.proxy.ftp_port: 8888 
FF - prefs.js..network.proxy.http: "109.123.126.253" 
FF - prefs.js..network.proxy.http_port: 8080 
FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co" 
FF - prefs.js..network.proxy.share_proxy_settings: true 
FF - prefs.js..network.proxy.socks: "94.102.153.150" 
FF - prefs.js..network.proxy.socks_port: 8888 
FF - prefs.js..network.proxy.ssl: "94.102.153.150" 
FF - prefs.js..network.proxy.ssl_port: 8888 
FF - prefs.js..network.proxy.type: 0 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found 
O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) 
O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found 
O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) 
O3:64bit: - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) 
O3:64bit: - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found 
O3 - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) 
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found 
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) 
O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) 
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) 
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 10.4.1) 
O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) 
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 10.4.1) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O33 - MountPoints2\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\Shell - "" = AutoRun 
O33 - MountPoints2\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe 
O33 - MountPoints2\{5c95afd0-c077-11e1-84e5-4061865e5a82}\Shell - "" = AutoRun 
O33 - MountPoints2\{5c95afd0-c077-11e1-84e5-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe 
O33 - MountPoints2\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\Shell - "" = AutoRun 
O33 - MountPoints2\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe 
O33 - MountPoints2\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\Shell - "" = AutoRun 
O33 - MountPoints2\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe 

[2012.08.07 14:35:48 | 000,000,000 | ---D | C] -- C:\ProgramData\rifldanvmwxuukm 
[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] 

[2012.08.07 14:35:50 | 000,000,051 | ---- | M] () -- C:\ProgramData\qmbiyhlgyfivtlu 
[2012.07.29 17:19:43 | 000,001,997 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk 
[2
[2010.08.05 21:30:44 | 000,000,917 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\conduit.xml 
[2010.09.29 00:49:30 | 000,002,059 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\daemon-search.xml 
[2012.08.03 21:53:36 | 000,001,056 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\icqplugin.xml 
[2012.06.27 18:54:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml 
[2012.06.27 18:54:52 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml 
[2012.06.27 18:54:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml 
[2012.06.27 18:54:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml 
[2012.06.27 18:54:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml 
[2012.06.27 18:54:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml 

[2012.08.07 20:37:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job 
[2012.08.07 14:15:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job 
[2012.08.07 14:03:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job 
[2012.08.07 13:07:01 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000UA.job 
[2012.08.07 01:07:01 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000Core.job 
[2012.07.27 19:07:30 | 000,000,000 | -HSD | C] -- C:\Config.Msi 
:Files

ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]

Schließe alle Programme.
Klicke auf den Fix Button.
Wenn OTL einen Neustart verlangt, bitte zulassen.
Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

Aperture · 07.08.2012, 21:07

Vielen Dank

Code:

ATTFilter

All processes killed
Error: Unable to interpret <SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll () > in the current context!
Error: Unable to interpret <IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} > in the current context!
Error: Unable to interpret <IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC > in the current context!
Error: Unable to interpret <IE:64bit: - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 > in the current context!
Error: Unable to interpret <IE - HKLM\..\URLSearchHook: - No CLSID value found > in the current context!
Error: Unable to interpret <IE - HKLM\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) > in the current context!
Error: Unable to interpret <IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - No CLSID value found > in the current context!
Error: Unable to interpret <IE - HKLM\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990} > in the current context!
Error: Unable to interpret <IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC > in the current context!
Error: Unable to interpret <IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 > in the current context!
Error: Unable to interpret <IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157 > in the current context!
Error: Unable to interpret <IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 > in the current context!
Error: Unable to interpret <IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://www.google.com/ie > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\URLSearchHook: - No CLSID value found > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\URLSearchHook: {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes,DefaultScope = {66FE2A85-FEAA-424A-A7D8-274260EF1EB2} > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{66FE2A85-FEAA-424A-A7D8-274260EF1EB2}: "URL" = hxxp://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8&rlz=1I7GGHP_deDE474 > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7 > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}: "URL" = hxxp://www.daemon-search.com/search/web?q={searchTerms} > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2304157 > in the current context!
Error: Unable to interpret <IE - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 > in the current context!
Error: Unable to interpret <FF - prefs.js..browser.startup.homepage: "data:text/plain,browser.startup.homepage=hxxp://de.search.yahoo.com/firefox/?fr=foxload-sfp" > in the current context!
Error: Unable to interpret <FF - prefs.js..CommunityToolbar.SearchFromAddressBarSavedUrl: "data:text/plain,keyword.URL=hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=foxload&type=moz35awe&p=" > in the current context!
Error: Unable to interpret <FF - prefs.js..browser.search.defaultenginename: "ICQ Search" > in the current context!
Error: Unable to interpret <FF - prefs.js..browser.search.defaultthis.engineName: "XfireXO Customized Web Search" > in the current context!
Error: Unable to interpret <FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}" > in the current context!
Error: Unable to interpret <FF - prefs.js..browser.search.selectedEngine: "Google" > in the current context!
Error: Unable to interpret <FF - prefs.js..browser.startup.homepage: "hxxp://grooveshark.com/#!/playlist/Ty+Oce/68473628" > in the current context!
Error: Unable to interpret <FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2 > in the current context!
Error: Unable to interpret <FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q=" > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.ftp: "94.102.153.150" > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.ftp_port: 8888 > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.http: "109.123.126.253" > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.http_port: 8080 > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.no_proxies_on: "localhost, 127.0.0.1, stealthy.co" > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.share_proxy_settings: true > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.socks: "94.102.153.150" > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.socks_port: 8888 > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.ssl: "94.102.153.150" > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.ssl_port: 8888 > in the current context!
Error: Unable to interpret <FF - prefs.js..network.proxy.type: 0 > in the current context!
Error: Unable to interpret <FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found > in the current context!
Error: Unable to interpret <O2 - BHO: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) > in the current context!
Error: Unable to interpret <O3:64bit: - HKLM\..\Toolbar: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found > in the current context!
Error: Unable to interpret <O3 - HKLM\..\Toolbar: (XfireXO Toolbar) - {5e5ab302-7f65-44cd-8211-c1d4caaccea3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) > in the current context!
Error: Unable to interpret <O3:64bit: - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (Google Toolbar) - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.) > in the current context!
Error: Unable to interpret <O3:64bit: - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (DAEMON Tools Toolbar) - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll File not found > in the current context!
Error: Unable to interpret <O3 - HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\..\Toolbar\WebBrowser: (XfireXO Toolbar) - {5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} - C:\Program Files (x86)\XfireXO\prxtbXfir.dll (Conduit Ltd.) > in the current context!
Error: Unable to interpret <O4 - HKLM..\Run: [DivXUpdate] C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe () > in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found > in the current context!
Error: Unable to interpret <O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found > in the current context!
Error: Unable to interpret <O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 > in the current context!
Error: Unable to interpret <O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 > in the current context!
Error: Unable to interpret <O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 > in the current context!
Error: Unable to interpret <O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 > in the current context!
Error: Unable to interpret <O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found > in the current context!
Error: Unable to interpret <O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) > in the current context!
Error: Unable to interpret <O16:64bit: - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) > in the current context!
Error: Unable to interpret <O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22) > in the current context!
Error: Unable to interpret <O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 10.4.1) > in the current context!
Error: Unable to interpret <O16 - DPF: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_20-windows-i586.cab (Java Plug-in 1.6.0_20) > in the current context!
Error: Unable to interpret <O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 10.4.1) > in the current context!
Error: Unable to interpret <O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found > in the current context!
Error: Unable to interpret <O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found > in the current context!
Error: Unable to interpret <O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. > in the current context!
Error: Unable to interpret <O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. > in the current context!
Error: Unable to interpret <O32 - HKLM CDRom: AutoRun - 1 > in the current context!
Error: Unable to interpret <O33 - MountPoints2\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\Shell - "" = AutoRun > in the current context!
Error: Unable to interpret <O33 - MountPoints2\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe > in the current context!
Error: Unable to interpret <O33 - MountPoints2\{5c95afd0-c077-11e1-84e5-4061865e5a82}\Shell - "" = AutoRun > in the current context!
Error: Unable to interpret <O33 - MountPoints2\{5c95afd0-c077-11e1-84e5-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe > in the current context!
Error: Unable to interpret <O33 - MountPoints2\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\Shell - "" = AutoRun > in the current context!
Error: Unable to interpret <O33 - MountPoints2\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe > in the current context!
Error: Unable to interpret <O33 - MountPoints2\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\Shell - "" = AutoRun > in the current context!
Error: Unable to interpret <O33 - MountPoints2\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\Shell\AutoRun\command - "" = D:\AutoRun.exe > in the current context!
Error: Unable to interpret <[2012.08.07 14:35:48 | 000,000,000 | ---D | C] -- C:\ProgramData\rifldanvmwxuukm > in the current context!
Error: Unable to interpret <[6 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] > in the current context!
Error: Unable to interpret <[2012.08.07 14:35:50 | 000,000,051 | ---- | M] () -- C:\ProgramData\qmbiyhlgyfivtlu > in the current context!
Error: Unable to interpret <[2012.07.29 17:19:43 | 000,001,997 | ---- | M] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk > in the current context!
Error: Unable to interpret <[2> in the current context!
Error: Unable to interpret <[2010.08.05 21:30:44 | 000,000,917 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\conduit.xml > in the current context!
Error: Unable to interpret <[2010.09.29 00:49:30 | 000,002,059 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\daemon-search.xml > in the current context!
Error: Unable to interpret <[2012.08.03 21:53:36 | 000,001,056 | ---- | M] () -- C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\icqplugin.xml > in the current context!
Error: Unable to interpret <[2012.06.27 18:54:52 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml > in the current context!
Error: Unable to interpret <[2012.06.27 18:54:52 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml > in the current context!
Error: Unable to interpret <[2012.06.27 18:54:52 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml > in the current context!
Error: Unable to interpret <[2012.06.27 18:54:52 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml > in the current context!
Error: Unable to interpret <[2012.06.27 18:54:52 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml > in the current context!
Error: Unable to interpret <[2012.06.27 18:54:52 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml > in the current context!
Error: Unable to interpret <[2012.08.07 20:37:00 | 000,001,104 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job > in the current context!
Error: Unable to interpret <[2012.08.07 14:15:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job > in the current context!
Error: Unable to interpret <[2012.08.07 14:03:00 | 000,001,108 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job > in the current context!
Error: Unable to interpret <[2012.08.07 13:07:01 | 000,001,138 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000UA.job > in the current context!
Error: Unable to interpret <[2012.08.07 01:07:01 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000Core.job > in the current context!
Error: Unable to interpret <[2012.07.27 19:07:30 | 000,000,000 | -HSD | C] -- C:\Config.Msi > in the current context!
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Dream\Desktop\cmd.bat deleted successfully.
C:\Users\Dream\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56504 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Dream
->Temp folder emptied: 1039964418 bytes
->Temporary Internet Files folder emptied: 372147012 bytes
->Java cache emptied: 1109383 bytes
->FireFox cache emptied: 64143177 bytes
->Flash cache emptied: 57113 bytes
 
User: Maple Story
->Temp folder emptied: 2275629 bytes
->Temporary Internet Files folder emptied: 89201 bytes
->Flash cache emptied: 56504 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 164600961 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 527883 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67563 bytes
RecycleBin emptied: 21056127 bytes
 
Total Files Cleaned = 1.589,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Dream
->Flash cache emptied: 0 bytes
 
User: Maple Story
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.56.0 log created on 08072012_215939

Files\Folders moved on Reboot...
C:\Users\Dream\AppData\Local\Temp\Low\REG1B50.tmp moved successfully.
C:\Users\Dream\AppData\Local\Temp\Low\REGE9E1.tmp moved successfully.
C:\Users\Dream\AppData\Local\Temp\Low\REGF099.tmp moved successfully.
C:\Users\Dream\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File\Folder C:\Users\Dream\AppData\Local\Temp\~DFA940D5941D329E8F.TMP not found!
File\Folder C:\Users\Dream\AppData\Local\Temp\~DFC96B490864BDB017.TMP not found!
File\Folder C:\Users\Dream\AppData\Local\Temp\~DFD44EC59B80695BF8.TMP not found!
File\Folder C:\Users\Dream\AppData\Local\Temp\~DFE416C79596F5CA90.TMP not found!
File\Folder C:\Users\Dream\AppData\Local\Temp\~DFF3772DB2D321052D.TMP not found!
File\Folder C:\Users\Dream\AppData\Local\Temp\~DFF59F931F7086B816.TMP not found!
C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KA13WV0B\si[7].htm moved successfully.
C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GMXQY722\121512-bka-trojaner-anti-malware-entfernt-otl-logs-brauche-script-bitte[1].html moved successfully.
C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D3TH0RQ3\ads[4].htm moved successfully.
C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D3TH0RQ3\si[8].htm moved successfully.
C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5YR46OOJ\ads[4].htm moved successfully.
C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5YR46OOJ\si[2].htm moved successfully.
C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat moved successfully.

PendingFileRenameOperations files...
File C:\Users\Dream\AppData\Local\Temp\Low\REG1B50.tmp not found!
File C:\Users\Dream\AppData\Local\Temp\Low\REGE9E1.tmp not found!
File C:\Users\Dream\AppData\Local\Temp\Low\REGF099.tmp not found!
File C:\Users\Dream\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
File C:\Users\Dream\AppData\Local\Temp\~DFA940D5941D329E8F.TMP not found!
File C:\Users\Dream\AppData\Local\Temp\~DFC96B490864BDB017.TMP not found!
File C:\Users\Dream\AppData\Local\Temp\~DFD44EC59B80695BF8.TMP not found!
File C:\Users\Dream\AppData\Local\Temp\~DFE416C79596F5CA90.TMP not found!
File C:\Users\Dream\AppData\Local\Temp\~DFF3772DB2D321052D.TMP not found!
File C:\Users\Dream\AppData\Local\Temp\~DFF59F931F7086B816.TMP not found!
File C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\KA13WV0B\si[7].htm not found!
File C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\GMXQY722\121512-bka-trojaner-anti-malware-entfernt-otl-logs-brauche-script-bitte[1].html not found!
File C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D3TH0RQ3\ads[4].htm not found!
File C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\D3TH0RQ3\si[8].htm not found!
File C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5YR46OOJ\ads[4].htm not found!
File C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\Content.IE5\5YR46OOJ\si[2].htm not found!
File C:\Users\Dream\AppData\Local\Microsoft\Windows\Temporary Internet Files\Low\AntiPhishing\2CEDBFBC-DBA8-43AA-B1FD-CC8E6316E3E2.dat not found!

Registry entries deleted on Reboot...

t'john · 07.08.2012, 23:42

Falsch! Der Fix beginnt mit:

:OTL

Nochmal! Anleitung beachten!

Aperture · 08.08.2012, 06:42

oh sorry ganicht mit bekommen das es nicht mit kopiert wurde.
Danke !

Code:

ATTFilter

All processes killed
========== OTL ==========
Service Akamai stopped successfully!
Service Akamai deleted successfully!
c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ deleted successfully.
C:\Program Files (x86)\XfireXO\prxtbXfir.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ not found.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ not found.
File C:\Program Files (x86)\XfireXO\prxtbXfir.dll not found.
HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry key HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\SearchScopes\{66FE2A85-FEAA-424A-A7D8-274260EF1EB2}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{66FE2A85-FEAA-424A-A7D8-274260EF1EB2}\ not found.
Registry key HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}\ not found.
Registry key HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\SearchScopes\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8}\ not found.
Registry key HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKU\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
Prefs.js: "data:text/plain,browser.startup.homepage=hxxp://de.search.yahoo.com/firefox/?fr=foxload-sfp" removed from browser.startup.homepage
Prefs.js: "data:text/plain,keyword.URL=hxxp://de.search.yahoo.com/search?ei=UTF-8&fr=foxload&type=moz35awe&p=" removed from CommunityToolbar.SearchFromAddressBarSavedUrl
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "XfireXO Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Google" removed from browser.search.selectedEngine
Prefs.js: "hxxp://grooveshark.com/#!/playlist/Ty+Oce/68473628" removed from browser.startup.homepage
Prefs.js: engine@conduit.com:3.3.3.2 removed from extensions.enabledItems
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q=" removed from keyword.URL
Prefs.js: "94.102.153.150" removed from network.proxy.ftp
Prefs.js: 8888 removed from network.proxy.ftp_port
Prefs.js: "109.123.126.253" removed from network.proxy.http
Prefs.js: 8080 removed from network.proxy.http_port
Prefs.js: "localhost, 127.0.0.1, stealthy.co" removed from network.proxy.no_proxies_on
Prefs.js: true removed from network.proxy.share_proxy_settings
Prefs.js: "94.102.153.150" removed from network.proxy.socks
Prefs.js: 8888 removed from network.proxy.socks_port
Prefs.js: "94.102.153.150" removed from network.proxy.ssl
Prefs.js: 8888 removed from network.proxy.ssl_port
Prefs.js: 0 removed from network.proxy.type
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ not found.
File C:\Program Files (x86)\XfireXO\prxtbXfir.dll not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{5e5ab302-7f65-44cd-8211-c1d4caaccea3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}\ not found.
File C:\Program Files (x86)\XfireXO\prxtbXfir.dll not found.
64bit-Registry value HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{2318C2B1-4965-11D4-9B18-009027A5CD4F} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2318C2B1-4965-11D4-9B18-009027A5CD4F}\ deleted successfully.
C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll moved successfully.
64bit-Registry value HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found.
Registry value HKEY_USERS\S-1-5-21-3227452625-3624007457-1889642414-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}\ not found.
File C:\Program Files (x86)\XfireXO\prxtbXfir.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\DivXUpdate deleted successfully.
C:\Program Files (x86)\DivX\DivX Update\DivXUpdate.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Add to Google Photos Screensa&ver\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{45ccd493-0b42-11e1-8c8c-4061865e5a82}\ not found.
File D:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c95afd0-c077-11e1-84e5-4061865e5a82}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c95afd0-c077-11e1-84e5-4061865e5a82}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c95afd0-c077-11e1-84e5-4061865e5a82}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c95afd0-c077-11e1-84e5-4061865e5a82}\ not found.
File D:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ccea2313-0d37-11e1-8ab3-4061865e5a82}\ not found.
File D:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ccea2315-0d37-11e1-8ab3-4061865e5a82}\ not found.
File D:\AutoRun.exe not found.
C:\ProgramData\rifldanvmwxuukm folder moved successfully.
File/Folder C:\Windows\SysWow64\*.tmp not found.
C:\ProgramData\qmbiyhlgyfivtlu moved successfully.
C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\LOLRecorder.lnk moved successfully.
File  not found.
C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\conduit.xml moved successfully.
C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\daemon-search.xml moved successfully.
C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\searchplugins\icqplugin.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\amazondotcom-de.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\bing.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\eBay-de.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\leo_ende_de.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\wikipedia-de.xml moved successfully.
C:\Program Files (x86)\Mozilla Firefox\searchplugins\yahoo-de.xml moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job moved successfully.
C:\Windows\Tasks\Adobe Flash Player Updater.job moved successfully.
C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000UA.job moved successfully.
C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-3227452625-3624007457-1889642414-1000Core.job moved successfully.
C:\Config.Msi folder moved successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows IP Configuration
Successfully flushed the DNS Resolver Cache.
C:\Users\Dream\Desktop\cmd.bat deleted successfully.
C:\Users\Dream\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Dream
->Temp folder emptied: 6004637 bytes
->Temporary Internet Files folder emptied: 335697 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 56987764 bytes
->Flash cache emptied: 1104 bytes
 
User: Maple Story
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 92882 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 441882 bytes
 
Total Files Cleaned = 61,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Dream
->Flash cache emptied: 0 bytes
 
User: Maple Story
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.56.0 log created on 08082012_065120

Files\Folders moved on Reboot...
C:\Users\Dream\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...
File C:\Users\Dream\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!

Registry entries deleted on Reboot...

t'john · 08.08.2012, 14:43

Sehr gut!

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Search.
Nach Ende des Suchlaufs öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Aperture · 08.08.2012, 16:52

Code:

ATTFilter

# AdwCleaner v1.800 - Logfile created 08/08/2012 at 17:51:58
# Updated 01/08/2012 by Xplode
# Operating system : Windows 7 Ultimate Service Pack 1 (64 bits)
# User : Dream - S4LEAGUE
# Running from : C:\Users\Dream\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****

Folder Found : C:\Users\Dream\AppData\Local\Conduit
Folder Found : C:\Users\Dream\AppData\LocalLow\boost_interprocess
Folder Found : C:\Users\Dream\AppData\LocalLow\Conduit
Folder Found : C:\Users\Dream\AppData\LocalLow\ConduitEngine
Folder Found : C:\Users\Dream\AppData\LocalLow\XfireXO
Folder Found : C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\Conduit
Folder Found : C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\ConduitCommon
Folder Found : C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\CT2304157
Folder Found : C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\extensions\{5e5ab302-7f65-44cd-8211-c1d4caaccea3}
Folder Found : C:\Program Files (x86)\Conduit
Folder Found : C:\Program Files (x86)\DAEMON Tools Toolbar
Folder Found : C:\Program Files (x86)\XfireXO

***** [Registry] *****
[*] Key Found : HKLM\SOFTWARE\Classes\Toolbar.CT2304157
Key Found : HKCU\Software\AppDataLow\Software\Conduit
Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
Key Found : HKCU\Software\AppDataLow\Toolbar
Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine
Key Found : HKLM\SOFTWARE\Conduit
Key Found : HKLM\SOFTWARE\DT Soft
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\XfireXO Toolbar
Key Found : HKLM\SOFTWARE\XfireXO
[x64] Key Found : HKCU\Software\AppDataLow\Software\Conduit
[x64] Key Found : HKCU\Software\AppDataLow\Software\ConduitSearchScopes
[x64] Key Found : HKCU\Software\AppDataLow\Toolbar
[x64] Key Found : HKLM\SOFTWARE\Classes\Conduit.Engine

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{E70F0988-ED46-43AB-910B-DB3ACD028B44}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E4AFA675-768E-43B2-90B5-D42B0258A31D}
Key Found : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{0AA068F6-5EB8-44F8-B507-5134C8AAB72E}
Key Found : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{E70F0988-ED46-43AB-910B-DB3ACD028B44}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{32099AAC-C132-4136-9E9A-4E364A424E17}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{32099AAC-C132-4136-9E9A-4E364A424E17}
[x64] Key Found : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{5E5AB302-7F65-44CD-8211-C1D4CAACCEA3}

***** [Internet Browsers] *****

-\\ Internet Explorer v8.0.7601.17514

[OK] Registry is clean.

-\\ Mozilla Firefox v14.0.1 (de)

Profile name : default 
File : C:\Users\Dream\AppData\Roaming\Mozilla\Firefox\Profiles\ul6qh8ad.default\prefs.js

Found : user_pref("CT2304157..clientLogIsEnabled", false);
Found : user_pref("CT2304157..clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.as[...]
Found : user_pref("CT2304157..uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Re[...]
Found : user_pref("CT2304157.ALLOW_SHOWING_HIDDEN_TOOLBAR", false);
Found : user_pref("CT2304157.AboutPrivacyUrl", "hxxp://www.conduit.com/privacy/Default.aspx");
Found : user_pref("CT2304157.AppTrackingLastCheckTime", "Fri Jul 27 2012 18:10:18 GMT+0200");
Found : user_pref("CT2304157.BrowserCompStateIsOpen_1000515", true);
Found : user_pref("CT2304157.BrowserCompStateIsOpen_2467196106677119704", true);
Found : user_pref("CT2304157.CTID", "CT2304157");
Found : user_pref("CT2304157.CurrentServerDate", "8-8-2012");
Found : user_pref("CT2304157.DialogsAlignMode", "LTR");
Found : user_pref("CT2304157.DialogsGetterLastCheckTime", "Sun Aug 05 2012 21:52:28 GMT+0200");
Found : user_pref("CT2304157.DownloadReferralCookieData", "");
Found : user_pref("CT2304157.EMailNotifierLabelLength", 5);
Found : user_pref("CT2304157.EMailNotifierPollDate", "Wed Aug 08 2012 13:40:59 GMT+0200");
Found : user_pref("CT2304157.FeedLastCount129078895246717929", 50);
Found : user_pref("CT2304157.FeedLastCount129095439763593837", 0);
Found : user_pref("CT2304157.FeedPollDate129078895250311712", "Wed Aug 08 2012 13:06:00 GMT+0200");
Found : user_pref("CT2304157.FeedPollDate129095439763593837", "Wed Aug 08 2012 13:25:59 GMT+0200");
Found : user_pref("CT2304157.FeedPollDate129604942912022444", "Wed Aug 08 2012 13:25:59 GMT+0200");
Found : user_pref("CT2304157.FeedTTL129078895250311712", 40);
Found : user_pref("CT2304157.FirstServerDate", "11-8-2010");
Found : user_pref("CT2304157.FirstTime", true);
Found : user_pref("CT2304157.FirstTimeFF3", true);
Found : user_pref("CT2304157.FirstTimeSettingsDone", true);
Found : user_pref("CT2304157.FixPageNotFoundErrors", true);
Found : user_pref("CT2304157.GroupingServerCheckInterval", 1440);
Found : user_pref("CT2304157.GroupingServiceUrl", "hxxp://grouping.services.conduit.com/");
Found : user_pref("CT2304157.HasUserGlobalKeys", true);
Found : user_pref("CT2304157.HomePageProtectorEnabled", false);
Found : user_pref("CT2304157.Initialize", true);
Found : user_pref("CT2304157.InitializeCommonPrefs", true);
Found : user_pref("CT2304157.InstallationAndCookieDataSentCount", 3);
Found : user_pref("CT2304157.InstalledDate", "Wed Aug 11 2010 12:48:11 GMT+0200");
Found : user_pref("CT2304157.IsAlertDBUpdated", true);
Found : user_pref("CT2304157.IsGrouping", false);
Found : user_pref("CT2304157.IsMulticommunity", false);
Found : user_pref("CT2304157.IsOpenThankYouPage", true);
Found : user_pref("CT2304157.IsOpenUninstallPage", true);
Found : user_pref("CT2304157.LanguagePackLastCheckTime", "Tue Aug 07 2012 21:04:39 GMT+0200");
Found : user_pref("CT2304157.LanguagePackReloadIntervalMM", 1440);
Found : user_pref("CT2304157.LanguagePackServiceUrl", "hxxp://translation.users.conduit.com/Translation.ashx[...]
Found : user_pref("CT2304157.LastLogin_2.7.2.0", "Mon Jan 24 2011 14:05:48 GMT+0100");
Found : user_pref("CT2304157.LastLogin_3.10.0.1", "Thu May 03 2012 22:41:12 GMT+0200");
Found : user_pref("CT2304157.LastLogin_3.12.2.3", "Tue Jun 05 2012 15:41:31 GMT+0200");
Found : user_pref("CT2304157.LastLogin_3.13.0.6", "Mon Jul 16 2012 07:52:32 GMT+0200");
Found : user_pref("CT2304157.LastLogin_3.14.1.0", "Wed Aug 08 2012 10:56:30 GMT+0200");
Found : user_pref("CT2304157.LastLogin_3.2.5.2", "Thu Mar 24 2011 00:05:54 GMT+0100");
Found : user_pref("CT2304157.LastLogin_3.3.3.2", "Tue Jun 21 2011 17:57:49 GMT+0200");
Found : user_pref("CT2304157.LastLogin_3.5.0.12", "Wed Aug 17 2011 17:10:48 GMT+0200");
Found : user_pref("CT2304157.LastLogin_3.6.0.10", "Tue Sep 27 2011 20:45:32 GMT+0200");
Found : user_pref("CT2304157.LastLogin_3.7.0.6", "Wed Nov 09 2011 14:43:14 GMT+0100");
Found : user_pref("CT2304157.LastLogin_3.8.0.8", "Sat Jan 07 2012 16:59:35 GMT+0100");
Found : user_pref("CT2304157.LastLogin_3.8.1.0", "Fri Feb 03 2012 10:57:26 GMT+0100");
Found : user_pref("CT2304157.LastLogin_3.9.0.3", "Wed Mar 21 2012 20:12:36 GMT+0100");
Found : user_pref("CT2304157.LatestVersion", "3.14.1.0");
Found : user_pref("CT2304157.Locale", "en");
Found : user_pref("CT2304157.LoginCache", 4);
Found : user_pref("CT2304157.MCDetectTooltipHeight", "83");
Found : user_pref("CT2304157.MCDetectTooltipShow", false);
Found : user_pref("CT2304157.MCDetectTooltipUrl", "hxxp://@EB_INSTALL_LINK@/rank/tooltip/?version=1");
Found : user_pref("CT2304157.MCDetectTooltipWidth", "295");
Found : user_pref("CT2304157.MyStuffEnabledAtInstallation", true);
Found : user_pref("CT2304157.PublisherContainerWidth", 1108);
Found : user_pref("CT2304157.SHRINK_TOOLBAR", 1);
Found : user_pref("CT2304157.SavedHomepage", "");
Found : user_pref("CT2304157.SearchEngine", "Search||hxxp://search.conduit.com/Results.aspx?q=UCM_SEARCH_TER[...]
Found : user_pref("CT2304157.SearchEngineBeforeUnload", "Google");
Found : user_pref("CT2304157.SearchFromAddressBarIsInit", true);
Found : user_pref("CT2304157.SearchFromAddressBarUrl", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT230[...]
Found : user_pref("CT2304157.SearchInNewTabEnabled", true);
Found : user_pref("CT2304157.SearchInNewTabIntervalMM", 1440);
Found : user_pref("CT2304157.SearchInNewTabLastCheckTime", "Tue Aug 07 2012 21:04:38 GMT+0200");
Found : user_pref("CT2304157.SearchInNewTabServiceUrl", "hxxp://newtab.conduit-hosting.com/newtab/?ctid=EB_T[...]
Found : user_pref("CT2304157.SearchInNewTabUsageUrl", "hxxp://usage.hosting.toolbar.conduit-services.com/usa[...]
Found : user_pref("CT2304157.SearchProtectorEnabled", false);
Found : user_pref("CT2304157.SearchProtectorToolbarDisabled", false);
Found : user_pref("CT2304157.ServiceMapLastCheckTime", "Tue Aug 07 2012 21:04:39 GMT+0200");
Found : user_pref("CT2304157.SettingsCheckIntervalMin", 120);
Found : user_pref("CT2304157.SettingsLastCheckTime", "Wed Aug 08 2012 06:56:29 GMT+0200");
Found : user_pref("CT2304157.SettingsLastUpdate", "1340630852");
Found : user_pref("CT2304157.ThirdPartyComponentsInterval", 504);
Found : user_pref("CT2304157.ThirdPartyComponentsLastCheck", "Fri Jul 27 2012 18:09:58 GMT+0200");
Found : user_pref("CT2304157.ThirdPartyComponentsLastUpdate", "1331805997");
Found : user_pref("CT2304157.TrusteLinkUrl", "hxxp://trust.conduit.com/CT2304157");
Found : user_pref("CT2304157.TrustedApiDomains", "conduit.com,conduit-hosting.com,conduit-services.com,clien[...]
Found : user_pref("CT2304157.UserID", "UN63674275202695865");
Found : user_pref("CT2304157.ValidationData_Search", 2);
Found : user_pref("CT2304157.ValidationData_Toolbar", 2);
Found : user_pref("CT2304157.alertChannelId", "700614");
Found : user_pref("CT2304157.appApproved.2467196106677119704", true);
Found : user_pref("CT2304157.approveUntrustedApps", false);
Found : user_pref("CT2304157.autoDisableScopes", -1);
Found : user_pref("CT2304157.backendstorage.2304157a129604967990223179000000paramsgk2", "7B22757064617465526[...]
Found : user_pref("CT2304157.backendstorage.appbuttondisablenull", "30");
Found : user_pref("CT2304157.backendstorage.cachedprofile2304157a129604967990223179000000", "786669726567616[...]
Found : user_pref("CT2304157.backendstorage.eb_dailyactivity", "31323937393330313135313930");
Found : user_pref("CT2304157.backendstorage.eb_lifetimesent", "54525545");
Found : user_pref("CT2304157.backendstorage.ebayguidct2304157", "38666236613435652D316134652D383863612D34656[...]
Found : user_pref("CT2304157.backendstorage.facebbok_user_cuid_100000139628843", "64313262303030312D31386363[...]
Found : user_pref("CT2304157.backendstorage.facebbok_user_id", "313030303030313339363238383433");
Found : user_pref("CT2304157.backendstorage.facebok_user_id_2304157a129604967990223179000000", "313030303030[...]
Found : user_pref("CT2304157.backendstorage.facebook_conduit_social_sskey_100000139628843", "695235503269326[...]
Found : user_pref("CT2304157.backendstorage.facebook_ctid_connect_send_n", "73656E646564");
Found : user_pref("CT2304157.backendstorage.facebook_ctid_connect_send_new", "73656E646564");
Found : user_pref("CT2304157.backendstorage.facebook_first_visit", "6E6F744669727374");
Found : user_pref("CT2304157.backendstorage.facebook_last_message_choice", "616C6C");
Found : user_pref("CT2304157.backendstorage.facebook_loggedin", "796573");
Found : user_pref("CT2304157.backendstorage.facebook_login_refresh", "302E33333030303037313035353135313637")[...]
Found : user_pref("CT2304157.backendstorage.facebook_login_status", "33");
Found : user_pref("CT2304157.backendstorage.facebook_login_status_2304157a129604967990223179000000", "31");
Found : user_pref("CT2304157.backendstorage.facebook_lust_recieve", "32313934343037352C");
Found : user_pref("CT2304157.backendstorage.facebook_lust_recievegadet", "");
Found : user_pref("CT2304157.backendstorage.facebook_mode", "32");
Found : user_pref("CT2304157.backendstorage.facebook_permission_lastshow_100000139628843", "3133313731353839[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_cachetime_2304157a129604967990223179000000", "[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_comments_2304157a129604967990223179000000_1000[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_events_2304157a129604967990223179000000", "253[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_info_2304157a129604967990223179000000", "25374[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_last_visit_tab_2304157a12960496799022317900000[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_likes_2304157a129604967990223179000000", "2537[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_photos_2304157a129604967990223179000000", "253[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_video_2304157a129604967990223179000000", "2535[...]
Found : user_pref("CT2304157.backendstorage.facebook_template_wall_2304157a129604967990223179000000", "25374[...]
Found : user_pref("CT2304157.backendstorage.facebook_toolbar_not_numer", "32");
Found : user_pref("CT2304157.backendstorage.facebook_user_locale", "6465");
Found : user_pref("CT2304157.backendstorage.facebook_user_name", "3078303034452C3078303036462C3078303037322C[...]
Found : user_pref("CT2304157.backendstorage.facebook_user_name_2304157a129604967990223179000000", "4E6F726D6[...]
Found : user_pref("CT2304157.backendstorage.facebook_user_token", "3230393834353033353330347C323532313538623[...]
Found : user_pref("CT2304157.backendstorage.facebook_user_token_2304157a129604967990223179000000", "30783030[...]
Found : user_pref("CT2304157.backendstorage.facebooknotifications", "31");
Found : user_pref("CT2304157.backendstorage.facebooktemplate_2304157a129604967990223179000000_lang", "4445")[...]
Found : user_pref("CT2304157.backendstorage.hxxp://facebook_conduitapps_com/v3_9.facebook_last_visit_tab", "[...]
Found : user_pref("CT2304157.backendstorage.onebaygkct2304157", "546875204A616E20323720323031312032323A30353[...]
Found : user_pref("CT2304157.backendstorage.smsp_alertcounter", "32");
Found : user_pref("CT2304157.backendstorage.smsp_lastalertshowdt", "372D332D313132");
Found : user_pref("CT2304157.backendstorage.smsp_lastalertshowts", "31333434343034353139393837");
Found : user_pref("CT2304157.backendstorage.smsp_settcounter", "313238");
Found : user_pref("CT2304157.backendstorage.smsp_settcounter1", "3630");
Found : user_pref("CT2304157.backendstorage.smspareaid", "3830");
Found : user_pref("CT2304157.backendstorage.smspclkalrts", "5B7B226F6964223A22303030303234222C22766965777322[...]
Found : user_pref("CT2304157.backendstorage.smspcntrycode", "3439");
Found : user_pref("CT2304157.backendstorage.smspcntryinfo", "38305F3439");
Found : user_pref("CT2304157.backendstorage.smspcntryshort", "4445");
Found : user_pref("CT2304157.backendstorage.smspcntryts", "31333138383335343434343837");
Found : user_pref("CT2304157.backendstorage.smspcontacts", "5B7B2276616C7565223A224E6174616C69652020204A6165[...]
Found : user_pref("CT2304157.backendstorage.smspcredits", "32");
Found : user_pref("CT2304157.backendstorage.smspctid", "435432333034313537");
Found : user_pref("CT2304157.backendstorage.smsplng", "656E");
Found : user_pref("CT2304157.backendstorage.smspregistrationts", "31333138303936333530393330");
Found : user_pref("CT2304157.backendstorage.smspuid", "34393137363632393330393237");
Found : user_pref("CT2304157.backendstorage.smspunq", "3133313830393632393139313934393137363632393330393237"[...]
Found : user_pref("CT2304157.backendstorage.smspunuid", "736D737031333137323435313931383236");
Found : user_pref("CT2304157.backendstorage.smspunvwdalrts", "5B7B226F6964223A2230303231222C227669657773223A[...]
Found : user_pref("CT2304157.backendstorage.smspviewstate", "31");
Found : user_pref("CT2304157.backendstorage.smspvwdalrt", "5B7B226F6964223A22303030303137222C227669657773223[...]
Found : user_pref("CT2304157.backendstorage.smspvwdalrts", "5B7B226F6964223A22303030303137222C22766965777322[...]
Found : user_pref("CT2304157.clientLogIsEnabled", true);
Found : user_pref("CT2304157.clientLogServiceUrl", "hxxp://clientlog.users.conduit.com/ClientDiagnostics.asm[...]
Found : user_pref("CT2304157.components.1000034", true);
Found : user_pref("CT2304157.components.1000515", true);
Found : user_pref("CT2304157.counterAppsAdded", 2);
Found : user_pref("CT2304157.generalConfigFromLogin", "{\"ApiMaxAlerts\":\"12\",\"SocialDomains\":\"social.c[...]
Found : user_pref("CT2304157.globalFirstTimeInfoLastCheckTime", "Tue Aug 07 2012 21:04:39 GMT+0200");
Found : user_pref("CT2304157.homepageProtectorEnableByLogin", true);
Found : user_pref("CT2304157.initDone", true);
Found : user_pref("CT2304157.isAppTrackingManagerOn", true);
Found : user_pref("CT2304157.myStuffEnabled", true);
Found : user_pref("CT2304157.myStuffPublihserMinWidth", 400);
Found : user_pref("CT2304157.myStuffSearchUrl", "hxxp://Apps.conduit.com/search?q=SEARCH_TERM&SearchSourceOr[...]
Found : user_pref("CT2304157.myStuffServiceIntervalMM", 1440);
Found : user_pref("CT2304157.myStuffServiceUrl", "hxxp://mystuff.conduit-services.com/MyStuffService.ashx?Co[...]
Found : user_pref("CT2304157.oldAppsList", "128883653123969059,128883653123969060,111,128883659132094175,129[...]
Found : user_pref("CT2304157.revertSettingsEnabled", true);
Found : user_pref("CT2304157.searchProtectorDialogDelayInSec", 10);
Found : user_pref("CT2304157.searchProtectorEnableByLogin", true);
Found : user_pref("CT2304157.testingCtid", "");
Found : user_pref("CT2304157.toolbarAppMetaDataLastCheckTime", "Tue Aug 07 2012 21:04:39 GMT+0200");
Found : user_pref("CT2304157.toolbarContextMenuLastCheckTime", "Fri Jul 27 2012 18:10:16 GMT+0200");
Found : user_pref("CT2304157.undefined", "Sat Feb 05 2011 21:55:12 GMT+0100");
Found : user_pref("CT2304157.uninstallLogServiceUrl", "hxxp://uninstall.users.conduit.com/Uninstall.asmx/Reg[...]
Found : user_pref("CT2304157.usagesFlag", 2);
Found : user_pref("CommunityToolbar.ETag.hxxp://Settings.toolbar.search.conduit.com/root/CT2304157/CT2304157[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1248799/1244472/DE", "\"0\"[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/1341653/1337321/DE", "\"0\"[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/2388/2388/DE", "\"0\"");
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/700614/696475/DE", "\"0\"")[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/900750/896545/DE", "\"0\"")[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://alerts.conduit-services.com/root/909619/905414/DE", "\"0\"")[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://appsmetadata.toolbar.conduit-services.com/?ctid=CT2304157", [...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=GottenApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=OtherApps&loc[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=SharedApps&lo[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://contextmenu.toolbar.conduit-services.com/?name=Toolbar&local[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.alert.conduit-services.com/alert/dlg.pkg", "\[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.engine.conduit-services.com/DLG.pkg?ver=3.3.3[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.10[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.12[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.13[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.14[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.3.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.5.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.6.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.7.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.8.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://dynamicdialogs.toolbar.conduit-services.com/DLG.pkg?ver=3.9.[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/Toolbar/?ownerId=CT2304157",[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://servicemap.conduit-services.com/toolbar/", "\"63433363123173[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=0", "63[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=1/11/20[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=2/17/20[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=2/22/20[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.engine.conduit-services.com/?browser=FF&lut=3/13/20[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.conduit-services.com/?ctid=CT2304157&octid=[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://settings.toolbar.search.conduit.com/root/CT2304157/CT2304157[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://translation.toolbar.conduit-services.com/?locale=en", "\"504[...]
Found : user_pref("CommunityToolbar.ETag.hxxp://twitter.com/users/show/21817319.xml", "\"ac38f9c9f1895f04bd4[...]
Found : user_pref("CommunityToolbar.EngineOwner", "");
Found : user_pref("CommunityToolbar.EngineOwnerGuid", "{5e5ab302-7f65-44cd-8211-c1d4caaccea3}");
Found : user_pref("CommunityToolbar.EngineOwnerToolbarId", "xfirexo");
Found : user_pref("CommunityToolbar.IsEngineShown", true);
Found : user_pref("CommunityToolbar.IsMyStuffImportedToEngine", true);
Found : user_pref("CommunityToolbar.LatestLibsPath", "file:///C:\\Users\\Dream\\AppData\\Roaming\\Mozilla\\F[...]
Found : user_pref("CommunityToolbar.LatestToolbarVersionInstalled", "3.14.1.0");
Found : user_pref("CommunityToolbar.MiniIPageGadgetPosition.hxxp://cndt.thefreesmsapp.com/v1.0.5.2/main.htm?[...]
Found : user_pref("CommunityToolbar.MiniIPageGadgetPosition.hxxp://cndt.thefreesmsapp.com/v1.0.5.2/main.htm?[...]
Found : user_pref("CommunityToolbar.MiniIPageGadgetPosition.hxxp://myconduitapplications.com/youtube_shuffle[...]
Found : user_pref("CommunityToolbar.MiniIPageGadgetPosition.hxxp://www.shqipmessenger.com/toolbar/", "211x20[...]
Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://myconduitapplications.com/youtube_shuffle/pro[...]
Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://www.shqipmessenger.com/toolbar/", "850x587");
Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://www.xfire.com/toolbar/activityreport/", "280x[...]
Found : user_pref("CommunityToolbar.MiniIPageGadgetSize.hxxp://www.xfire.com/toolbar/screenshots/", "345x516[...]
Found : user_pref("CommunityToolbar.OriginalEngineOwner", "CT2304157");
Found : user_pref("CommunityToolbar.OriginalEngineOwnerGuid", "{5e5ab302-7f65-44cd-8211-c1d4caaccea3}");
Found : user_pref("CommunityToolbar.OriginalEngineOwnerToolbarId", "xfirexo");
Found : user_pref("CommunityToolbar.ToolbarsList", "CT2304157");
Found : user_pref("CommunityToolbar.ToolbarsList2", "CT2304157");
Found : user_pref("CommunityToolbar.alert.alertDialogsGetterLastCheckTime", "Thu Mar 24 2011 10:15:52 GMT+01[...]
Found : user_pref("CommunityToolbar.alert.alertInfoInterval", 1440);
Found : user_pref("CommunityToolbar.alert.alertInfoLastCheckTime", "Tue Jun 21 2011 17:57:57 GMT+0200");
Found : user_pref("CommunityToolbar.alert.clientsServerUrl", "hxxp://alert.client.conduit.com");
Found : user_pref("CommunityToolbar.alert.locale", "en");
Found : user_pref("CommunityToolbar.alert.loginIntervalMin", 1440);
Found : user_pref("CommunityToolbar.alert.loginLastCheckTime", "Tue Jun 21 2011 17:57:48 GMT+0200");
Found : user_pref("CommunityToolbar.alert.loginLastUpdateTime", "1305622559");
Found : user_pref("CommunityToolbar.alert.messageShowTimeSec", 20);
Found : user_pref("CommunityToolbar.alert.servicesServerUrl", "hxxp://alert.services.conduit.com");
Found : user_pref("CommunityToolbar.alert.showTrayIcon", false);
Found : user_pref("CommunityToolbar.alert.userCloseIntervalMin", 300);
Found : user_pref("CommunityToolbar.alert.userId", "d9d713c2-2480-4c5c-bd70-97083eb45cb5");
Found : user_pref("CommunityToolbar.globalUserId", "acb66137-b572-4ccc-b2f7-3656a448aad9");
Found : user_pref("CommunityToolbar.isAlertUrlAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.isClickActionAddedToFeedItemTable", true);
Found : user_pref("CommunityToolbar.keywordURLSelectedCTID", "CT2304157");
Found : user_pref("CommunityToolbar.killedEngine", true);
Found : user_pref("CommunityToolbar.notifications.alertDialogsGetterLastCheckTime", "Fri Aug 03 2012 18:10:3[...]
Found : user_pref("CommunityToolbar.notifications.alertInfoInterval", 1440);
Found : user_pref("CommunityToolbar.notifications.alertInfoLastCheckTime", "Tue Aug 07 2012 21:04:49 GMT+020[...]
Found : user_pref("CommunityToolbar.notifications.clientsServerUrl", "hxxp://alert.client.conduit.com");
Found : user_pref("CommunityToolbar.notifications.locale", "en");
Found : user_pref("CommunityToolbar.notifications.loginIntervalMin", 1440);
Found : user_pref("CommunityToolbar.notifications.loginLastCheckTime", "Tue Aug 07 2012 21:04:39 GMT+0200");
Found : user_pref("CommunityToolbar.notifications.loginLastUpdateTime", "1313487611");
Found : user_pref("CommunityToolbar.notifications.messageShowTimeSec", 20);
Found : user_pref("CommunityToolbar.notifications.servicesServerUrl", "hxxp://alert.services.conduit.com");
Found : user_pref("CommunityToolbar.notifications.showTrayIcon", false);
Found : user_pref("CommunityToolbar.notifications.userCloseIntervalMin", 300);
Found : user_pref("CommunityToolbar.notifications.userId", "503346bd-4216-4878-a729-473c37849e53");
Found : user_pref("CommunityToolbar.permanenceEngine", false);
Found : user_pref("CommunityToolbar.twitter.user_21817319.LastCheckTime", "Wed Aug 08 2012 12:57:00 GMT+0200[...]
Found : user_pref("CommunityToolbar.undefined", "");
Found : user_pref("keyword.URL", "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2304157&q=");

*************************

AdwCleaner[R1].txt - [27870 octets] - [08/08/2012 17:51:58]

########## EOF - C:\AdwCleaner[R1].txt - [27999 octets] ##########

t'john · 09.08.2012, 11:23

Wo ist das Malwarebytes Log?

Aperture · 09.08.2012, 13:59

Sorry viel mals ich dachte das brauch man nicht weil nur unter dem anderen programm logs posten stand :/
Vielen dank für all die Arbeit

Code:

ATTFilter

 Malwarebytes Anti-Malware  (Trial) 1.62.0.1300
www.malwarebytes.org

Database version: v2012.08.07.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Dream :: S4LEAGUE [administrator]

Protection: Enabled

08.08.2012 16:13:38
mbam-log-2012-08-08 (16-13-38).txt

Scan type: Full scan (C:\|)
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 502645
Time elapsed: 1 hour(s), 37 minute(s), 32 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

(end)

t'john · 10.08.2012, 13:59

Sehr gut!

Schließe alle offenen Programme und Browser.
Starte die adwcleaner.exe mit einem Doppelklick.
Klicke auf Delete.
Bestätige jeweils mit Ok.
Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
Poste mir den Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

danach:

Malware-Scan mit Emsisoft Anti-Malware

Lade die Gratisversion von => Emsisoft Anti-Malware herunter und installiere das Programm.
Lade über Jetzt Updaten die aktuellen Signaturen herunter.
Wähle den Freeware-Modus aus.

Wähle Detail Scan und starte über den Button Scan die Überprüfung des Computers.
Am Ende des Scans nichts loeschen lassen!. Mit Klick auf Bericht speichern das Logfile auf dem Desktop speichern und hier in den Thread posten.

Anleitung: http://www.trojaner-board.de/103809-...i-malware.html

t'john · 09.09.2012, 02:29

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html

Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.

07.08.2012, 23:42	#4
t'john /// Helfer-Team	BKA Trojaner mit Anti-Malware entfernt und OTL logs brauche ein script bitte Falsch! Der Fix beginnt mit: :OTL Nochmal! Anleitung beachten! __________________ Mfg, t'john Das TB unterstützen

09.08.2012, 11:23	#8
t'john /// Helfer-Team	BKA Trojaner mit Anti-Malware entfernt und OTL logs brauche ein script bitte Wo ist das Malwarebytes Log? __________________ Mfg, t'john Das TB unterstützen

BKA Trojaner mit Anti-Malware entfernt und OTL logs brauche ein script bitte

Log-Analyse und Auswertung: BKA Trojaner mit Anti-Malware entfernt und OTL logs brauche ein script bitte