Hallo zusammen,
da ich durch die Suchfunktion nichts gefunden habe, was exakt meinen Vorstellungen entspricht, möchte ich euch hier mein Problem mitteilen.
Ich habe mir gestern Nacht eine Art BKA Virus gefangen. Ich bekam einen Vollbild Browser und ein Fenster, dass aufgrund von Windows 7 Software Piraterie Schutzmaßnahmen etwas gemacht werden müsse und ich meinen PC
für 50€ Ukash wieder freischalten könne. Task Manager, etc. waren wie beim normalen BKA Virus nicht zu öffnen. So, habe jetzt durch Systemwiederherstellung auf einen Stand 3 Tage vorher wieder Zugriff auf meinen Rechner, allerdings weiß ich nicht ob der Virus jetzt noch auf meinem Laptop ist. Könntet ihr mir eventuell helfen? Bitte sagt mir, was ich machen kann, wenn ihr Logs braucht, dann sagt bitte dazu wie ich diese Logs bekomme.

Mein System:
Sony Vaio VGN-NW21MF Laptop
Windows 7 Home Premium 64-Bit Service Pack 1

Bitte helft mir!
Liebe Grüße,
Nox

Edit:
Da mein alter Thread im falschen Themenbereich hier nochmal.

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

2. Schritt

Systemscan mit OTL (bebilderte Anleitung)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden)- Doppelklick auf die OTL.exe

• Vista und Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen
• Wähle Scanne Alle Benuzer
• Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimale Ausgabe
• Unter Extra Registrierung, wähle bitte Benutze SafeList
• Klicke nun auf Scan links oben
• Wenn der Scan beendet wurde werden 2 Logfiles erstellt
• Poste die Logfiles hier in den Thread.

Hallo, danke für die Antwort,
hier die Logs:

Malwarebytes:

Malwarebytes Anti-Malware (Test) 1.62.0.1300
Malwarebytes : Free Anti-Malware download

Datenbank Version: v2012.08.10.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Nox :: NOX-PC [Administrator]

Schutz: Aktiviert

10.08.2012 04:43:13
mbam-log-2012-08-10 (04-43-13).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 624192
Laufzeit: 3 Stunde(n), 22 Minute(n), 22 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 1
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run|Policies (Trojan.Agent) -> Daten: C:\Windows\system32\WinDir\Svchost.exe -> Erfolgreich gelöscht und in Quarantäne gestellt.

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 24
C:\Program Files (x86)\MAGIX\Web Designer MX Premium\Protein\Berdi.exe (PUP.Hacktool.Patcher) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Anessia2\Anessia2.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Blackmamba Network\BlackMambaMT2.com Patcher.exe (Dont.Steal.Our.Software) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Blackmamba Network\metin2client.bin (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Calypso2\CL2-Revolution.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Hamachi\Ayendox2.exe (Trojan.Patch) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Helius2\Helius2.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Helius2\metin2client.bin (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Helius2\start.h2 (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Isomeria2\Isomeria2.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server MoonMt2\MoonMt2.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Mythology2\.Mythology.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Shizuka3\ClientStarter.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Takania2\metin2client.bin (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Takashi2\ClientStarter.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Takashi2\metin2client.bin (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server TaubBen-Mt2\TaubBe-Mt2.exe (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Verus2\verus2.bin (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Program Files (x86)\Metin2 P-Server Vuphon2\metin2client.bin (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Users\Nox\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\07PD36N0\start[1].h2 (RiskWare.Tool.CK) -> Keine Aktion durchgeführt.
C:\Users\Nox\AppData\Local\Temp\BetterInstaller.exe (PUP.BundleInstaller.Somoto) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Nox\Downloads\Downloads (Alt)\CheatEngine61.exe (PUP.BundleInstaller.BI) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Nox\Downloads\Downloads (Alt)\SoftonicDownloader_for_game-maker.exe (PUP.ToolbarDownloader) -> Erfolgreich gelöscht und in Quarantäne gestellt.
C:\Users\Nox\Downloads\Metin2\Bots\Switchbotv3_0_0_5\core\switchbot.dll (Malware.Gen) -> Erfolgreich gelöscht und in Quarantäne gestellt.

(Ende)

Die ganzen Metin2 Sachen habe ich nicht gelöscht, da ich sicher bin, dass es "kein" Virus ist, und weil ich die Programme dringend benötige. Die anderen, die ich nicht zu 100% kannte habe ich mal in die Quarantäne verschoben!
Der OTL Log wird gleich nachgereicht!

Edit:
OTL Logs:

OTL.txtOTL Logfile:

OTL logfile created on: 10.08.2012 14:43:29 - Run 1
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Users\Nox\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,97 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 61,03% Memory free
7,93 Gb Paging File | 5,60 Gb Available in Paging File | 70,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 456,28 Gb Total Space | 78,53 Gb Free Space | 17,21% Space Free | Partition Type: NTFS
Drive D: | 1,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 673,92 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: NOX-PC | User Name: Nox | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\Nox\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_270.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Users\Nox\AppData\Local\Google\Update\1.3.21.115\GoogleCrashHandler.exe (Google Inc.)
PRC - C:\Programme\AVAST Software\Avast\AvastUI.exe (AVAST Software)
PRC - C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
PRC - C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Programme\Web Assistant\ExtensionUpdaterService.exe ()
PRC - C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\SeaPort.exe (Microsoft Corporation.)
PRC - C:\Windows\SysWOW64\PnkBstrA.exe ()
PRC - C:\Program Files (x86)\Ask.com\Updater\Updater.exe (Ask)
PRC - C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
PRC - C:\xampp\apache\bin\httpd.exe (Apache Software Foundation)
PRC - c:\xampp\apache\bin\httpd.exe (Apache Software Foundation)
PRC - c:\xampp\mysql\bin\mysqld.exe ()
PRC - C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
MOD - C:\Program Files (x86)\Steam\bin\libcef.dll ()
MOD - C:\Program Files (x86)\Steam\bin\chromehtml.DLL ()
MOD - C:\Program Files (x86)\Steam\bin\avcodec-53.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avformat-53.dll ()
MOD - C:\Program Files (x86)\Steam\bin\avutil-51.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
MOD - C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll ()
MOD - C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated)
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (avast! Antivirus) -- C:\Programme\AVAST Software\Avast\AvastSvc.exe (AVAST Software)
SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation)
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (Hamachi2Svc) -- C:\Program Files (x86)\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (CGVPNCliSrvc) -- C:\Programme\CyberGhost VPN\CGVPNCliService.exe (mobile concepts GmbH)
SRV - (Web Assistant Updater) -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe ()
SRV - (BBUpdate) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\SeaPort.exe (Microsoft Corporation.)
SRV - (BBSvc) -- C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BBSvc.exe (Microsoft Corporation.)
SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe ()
SRV - (TeamViewer7) -- C:\Program Files (x86)\TeamViewer\Version7\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (OverwolfUpdaterService) -- C:\Program Files (x86)\Overwolf\\OverwolfUpdater.exe ()
SRV - (AdvancedSystemCareService5) -- C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCService.exe (IObit)
SRV - (Apache2.2) -- c:\xampp\apache\bin\httpd.exe (Apache Software Foundation)
SRV - (mysql) -- c:\xampp\mysql\bin\mysqld.exe ()
SRV - (wlidsvc) -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WlanNetService.exe (AVM Berlin)
SRV - (wlcrasvc) -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe (Microsoft Corporation)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (SwitchBoard) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
SRV - (Fabs) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe (MAGIX AG)
SRV - (MSSQLServerADHelper100) -- c:\Programme\Microsoft SQL Server\100\Shared\sqladhlp.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
SRV - (MSSQL$SQLEXPRESS) -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\sqlservr.exe (Microsoft Corporation)
SRV - (SQLAgent$SQLEXPRESS) -- c:\Programme\Microsoft SQL Server\MSSQL10.SQLEXPRESS\MSSQL\Binn\SQLAGENT.EXE (Microsoft Corporation)
SRV - (FirebirdServerMAGIXInstance) -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe (MAGIX®)
SRV - (SQLWriter) -- c:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - (aswSnx) -- C:\Windows\SysNative\drivers\aswSnx.sys (AVAST Software)
DRV:64bit: - (aswSP) -- C:\Windows\SysNative\drivers\aswSP.sys (AVAST Software)
DRV:64bit: - (aswMonFlt) -- C:\Windows\SysNative\drivers\aswMonFlt.sys (AVAST Software)
DRV:64bit: - (aswTdi) -- C:\Windows\SysNative\drivers\aswTdi.sys (AVAST Software)
DRV:64bit: - (aswRdr) -- C:\Windows\SysNative\drivers\aswRdr2.sys (AVAST Software)
DRV:64bit: - (aswFsBlk) -- C:\Windows\SysNative\drivers\aswFsBlk.sys (AVAST Software)
DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation)
DRV:64bit: - (dtsoftbus01) -- C:\Windows\SysNative\drivers\dtsoftbus01.sys (DT Soft Ltd)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (vmm) -- C:\Windows\SysNative\Treiber\VMM.sys (Microsoft Corporation)
DRV:64bit: - (VBoxNetAdp) -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys (Oracle Corporation)
DRV:64bit: - (USBAAPL64) -- C:\Windows\SysNative\drivers\usbaapl64.sys (Apple, Inc.)
DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project)
DRV:64bit: - (Point64) -- C:\Windows\SysNative\drivers\point64.sys (Microsoft Corporation)
DRV:64bit: - (fssfltr) -- C:\Windows\SysNative\drivers\fssfltr.sys (Microsoft Corporation)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (sdbus) -- C:\Windows\SysNative\drivers\sdbus.sys (Microsoft Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation)
DRV:64bit: - (FWLANUSB) -- C:\Windows\SysNative\drivers\fwlanusb.sys (AVM GmbH)
DRV:64bit: - (avmeject) -- C:\Windows\SysNative\drivers\avmeject.sys (AVM Berlin)
DRV:64bit: - (atikmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (yukonw7) -- C:\Windows\SysNative\drivers\yk62x64.sys (Marvell)
DRV:64bit: - (netw5v64) -- C:\Windows\SysNative\drivers\netw5v64.sys (Intel Corporation)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (GEARAspiWDM) -- C:\Windows\SysNative\drivers\GEARAspiWDM.sys (GEAR Software Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV:64bit: - (SFEP) -- C:\Windows\SysNative\drivers\SFEP.sys (Sony Corporation)
DRV:64bit: - (VPCNetS2) -- C:\Windows\SysNative\drivers\VMNetSrv.sys (Microsoft Corporation)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5}
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://isearch.babylon.com/?babsrc=HP_ss&mntrId=6a99226100000000000000ffcd53b77f
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = A5 52 64 F8 21 E8 CC 01  [binary data]
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.)
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = hxxp://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://isearch.babylon.com/web/{searchTerms}?babsrc=browsersearch&babsrc=SP_ss&mntrId=6a99226100000000000000ffcd53b77f
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{179E0838-8569-4D26-946B-FD123A2D5AAA}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=FV&apn_dtid=YYYYYYYYDE&apn_uid=f52fd9c7-ef79-494a-a4ce-c3a5c50a0353&apn_sauid=596AA695-5E0E-4633-A6B9-25709E40BCF5
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = hxxp://mystart.incredibar.com/mb143/?search={searchTerms}&loc=IB_DS&a=6OyB1k1aMe&i=26
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.defaultthis.engineName: "ClipGrab Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2536373&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "Ask.com"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FF&o=14594&locale=de_DE&apn_uid=f52fd9c7-ef79-494a-a4ce-c3a5c50a0353&apn_ptnrs=FV&apn_sauid=596AA695-5E0E-4633-A6B9-25709E40BCF5&apn_dtid=YYYYYYYYDE&&q="
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_270.dll ()
FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.4.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.4.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.0: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Nox\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Nox\AppData\Local\Google\Update\1.3.21.115\npGoogleUpdate3.dll (Google Inc.)
 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012.05.06 10:52:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.05.06 10:52:15 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\wrc@avast.com: C:\Program Files\AVAST Software\Avast\WebRep\FF [2012.07.07 11:14:31 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\webbooster@iminent.com: C:\Program Files (x86)\Iminent\webbooster@iminent.com
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.18 19:31:18 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2012.08.09 15:49:45 | 000,000,000 | ---D | M]
 
[2012.04.13 18:41:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nox\AppData\Roaming\mozilla\Extensions
[2012.08.07 18:32:38 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Nox\AppData\Roaming\mozilla\Firefox\Profiles\tzjqnf64.default\extensions
[2012.08.09 14:40:19 | 000,000,000 | ---D | M] (8 Ultimo) -- C:\Users\Nox\AppData\Roaming\mozilla\Firefox\Profiles\tzjqnf64.default\extensions\{2b6788a0-0ccd-11e1-be50-0800200c9a66}
[2012.08.09 14:40:19 | 000,000,000 | ---D | M] (FT DeepDark) -- C:\Users\Nox\AppData\Roaming\mozilla\Firefox\Profiles\tzjqnf64.default\extensions\{77d2ed30-4cd2-11e0-b8af-0800200c9a66}
[2012.07.26 15:25:20 | 000,000,919 | ---- | M] () -- C:\Users\Nox\AppData\Roaming\Mozilla\Firefox\Profiles\tzjqnf64.default\searchplugins\conduit.xml
[2012.05.06 10:52:00 | 000,002,203 | ---- | M] () -- C:\Users\Nox\AppData\Roaming\Mozilla\Firefox\Profiles\tzjqnf64.default\searchplugins\MyStart Search.xml
[2012.06.16 17:59:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.06.16 17:59:26 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions\ffxtlbr@babylon.com
[2012.07.07 11:14:31 | 000,000,000 | ---D | M] (avast! WebRep) -- C:\PROGRAM FILES\AVAST SOFTWARE\AVAST\WEBREP\FF
[2012.07.18 19:31:18 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.06.28 17:42:00 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
[2012.06.17 12:42:58 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.06.16 17:59:19 | 000,002,298 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\babylon.xml
[2012.06.17 12:42:58 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.06.17 12:42:58 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.06.17 12:42:58 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.06.17 12:42:58 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.06.17 12:42:58 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
========== Chrome  ==========
 
CHR - homepage: hxxp://www.google.com
CHR - default_search_provider: Google (Enabled)
CHR - default_search_provider: search_url = {google:baseURL}search?q={searchTerms}&{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}sourceid=chrome&ie={inputEncoding}
CHR - default_search_provider: suggest_url = {google:baseSuggestURL}search?{google:searchFieldtrialParameter}client=chrome&hl={language}&q={searchTerms}
CHR - homepage: hxxp://www.google.com
CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer
CHR - plugin: Native Client (Enabled) = C:\Users\Nox\AppData\Local\Google\Chrome\Application\21.0.1180.60\ppGoogleNaClPluginChrome.dll
CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Nox\AppData\Local\Google\Chrome\Application\21.0.1180.60\pdf.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Nox\AppData\Local\Google\Chrome\Application\21.0.1180.60\gcswf32.dll
CHR - plugin: Shockwave Flash (Disabled) = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\PepperFlash\11.2.31.144\pepflashplayer.dll
CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_235.dll
CHR - plugin: Injovo Extension Plugin (Enabled) = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.430_0\npbrowserext.dll
CHR - plugin: ESN Launch Mozilla Plugin (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll
CHR - plugin: ESN Sonar API (Enabled) = C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll
CHR - plugin: Java(TM) Platform SE 7 U4 (Enabled) = C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll
CHR - plugin: Java Deployment Toolkit 7.0.40.255 (Enabled) = C:\Windows\SysWOW64\npDeployJava1.dll
CHR - plugin: VLC Web Plugin (Enabled) = C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll
CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll
CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll
CHR - plugin: Google Update (Enabled) = C:\Users\Nox\AppData\Local\Google\Update\1.3.21.111\npGoogleUpdate3.dll
CHR - plugin: Shockwave for Director (Enabled) = C:\Windows\system32\Adobe\Director\np32dsw.dll
CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files (x86)\Microsoft Silverlight\4.1.10111.0\npctrl.dll
CHR - Extension: Turn Off the Lights = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\bfbmjmiodbnnpllbbbfblcplfjjepjdn\2.1.0.1_0\
CHR - Extension: YouTube = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Web Assistant = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.430_0\
CHR - Extension: AdBlock = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\gighmmpiobklfepjocnamgkkbiglidom\2.5.38_0\
CHR - Extension: avast! WebRep = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\icmlaeflemplmjndnaapfdbbnpncnbda\7.0.1456_0\
CHR - Extension: Browser Button for Turn Off the Lights = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\jfmfcimcjckbdhbbbbdemfaaphhgljgo\0.5.1_0\
CHR - Extension: Google Mail = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
 
O1 HOSTS File: ([2012.05.13 14:43:56 | 000,000,852 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 74.208.10.249 gs.apple.com
O2:64bit: - BHO: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O2:64bit: - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension64.dll ()
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO)
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll ()
O2 - BHO: (TBSB01620 Class) - {58124A0B-DC32-4180-9BFF-E0E21AE34026} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BingExt.dll (Microsoft Corporation.)
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.)
O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Program Files (x86)\Yontoo\YontooIEClient.dll (Yontoo LLC)
O3:64bit: - HKLM\..\Toolbar: (avast! WebRep) - {318A227B-5E9F-45bd-8999-7F8F10CA4CF5} - C:\Programme\AVAST Software\Avast\aswWebRepIE64.dll (AVAST Software)
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\7.1.382.0\BingExt.dll (Microsoft Corporation.)
O3 - HKLM\..\Toolbar: (avast! WebRep) - {8E5E2654-AD2D-48bf-AC2D-D17F00898D06} - C:\Programme\AVAST Software\Avast\aswWebRepIE.dll (AVAST Software)
O3 - HKLM\..\Toolbar: (IMinent Toolbar) - {977AE9CC-AF83-45E8-9E03-E2798216E2D5} - C:\Program Files (x86)\IMinent Toolbar\tbcore3.dll ()
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O3 - HKLM\..\Toolbar: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.)
O3 - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask)
O4:64bit: - HKLM..\Run: [IntelliPoint] c:\Program Files\Microsoft IntelliPoint\ipoint.exe (Microsoft Corporation)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [avast] C:\Program Files\AVAST Software\Avast\avastUI.exe (AVAST Software)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000..\Run: [Advanced SystemCare 5] C:\Program Files (x86)\IObit\Advanced SystemCare 5\ASCTray.exe (IObit)
O4 - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware ] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKLM..\RunOnce: [ Malwarebytes Anti-Malware  (cleanup)] C:\ProgramData\Malwarebytes\Malwarebytes' Anti-Malware\cleanup.dll (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Nox\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8:64bit: - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\Nox\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm ()
O8 - Extra context menu item: Sothink SWF Catcher - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O9 - Extra Button: Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O9 - Extra 'Tools' menuitem : Sothink SWF Catcher - {E19ADC6E-3909-43E4-9A89-B7B676377EE3} - C:\Program Files (x86)\Common Files\SourceTec\SWF Catcher\InternetExplorer.htm ()
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000009 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll (Apple Inc.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0)
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B3E1A5FD-87ED-4462-A12A-1EE9C464D337}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4194AB9-1FD2-4A27-9BD6-E8419E29B7FE}: DhcpNameServer = 192.168.178.1
O18:64bit: - Protocol\Handler\livecall - No CLSID value found
O18:64bit: - Protocol\Handler\msnim - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18:64bit: - Protocol\Handler\wlpg - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.09.21 11:33:00 | 000,000,055 | R--- | M] () - D:\autorun.inf -- [ UDF ]
O32 - AutoRun File - [2004.10.23 09:14:18 | 000,000,000 | ---D | M] - E:\AutoRun -- [ CDFS ]
O32 - AutoRun File - [2004.10.23 09:14:18 | 000,684,032 | R--- | M] (Electronic Arts Inc.) - E:\AutoRun.exe -- [ CDFS ]
O32 - AutoRun File - [2004.10.15 06:59:34 | 000,577,536 | R--- | M] (Electronic Arts Inc.) - E:\AutoRunGUI.dll -- [ CDFS ]
O32 - AutoRun File - [2004.10.23 09:19:56 | 000,000,105 | R--- | M] () - E:\autorun.inf -- [ CDFS ]
O33 - MountPoints2\{24ff4d0b-540e-11e1-bd24-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{24ff4d0b-540e-11e1-bd24-806e6f6e6963}\Shell\AutoRun\command - "" = D:\CdAutoRun.exe -- [2010.09.21 11:33:00 | 000,049,152 | R--- | M] ()
O33 - MountPoints2\{2c5833cb-b803-11e1-bcad-e5683a4d8c81}\Shell - "" = AutoRun
O33 - MountPoints2\{2c5833cb-b803-11e1-bcad-e5683a4d8c81}\Shell\AutoRun\command - "" = E:\setup.exe -- [2004.10.15 06:59:34 | 000,110,592 | R--- | M] (Electronic Arts Inc.)
O33 - MountPoints2\{5c73c207-832b-11e1-9490-001c4af76f7a}\Shell - "" = AutoRun
O33 - MountPoints2\{5c73c207-832b-11e1-9490-001c4af76f7a}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{f46de256-5412-11e1-8281-0022fbcf794e}\Shell - "" = AutoRun
O33 - MountPoints2\{f46de256-5412-11e1-8281-0022fbcf794e}\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.08.10 04:41:37 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\Malwarebytes
[2012.08.10 04:41:29 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.08.10 04:41:28 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012.08.10 04:41:27 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.08.10 04:41:27 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2012.08.10 03:05:46 | 000,596,480 | ---- | C] (OldTimer Tools) -- C:\Users\Nox\Desktop\OTL.exe
[2012.08.09 19:45:50 | 000,000,000 | ---D | C] -- C:\Users\Nox\Desktop\Sina Server
[2012.08.09 15:54:12 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\streamripper
[2012.08.09 15:53:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Streamripper
[2012.08.09 15:49:45 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Winamp Erkennungs-Plug-in
[2012.08.09 15:49:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp Detect
[2012.08.09 15:49:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\PX Storage Engine
[2012.08.09 15:49:24 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\Winamp
[2012.08.09 15:49:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winamp
[2012.08.08 18:21:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Takania2
[2012.08.08 17:54:38 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\RocketDock
[2012.08.08 03:43:15 | 000,000,000 | ---D | C] -- C:\mysql
[2012.08.08 01:01:01 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Zephos
[2012.08.07 20:42:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Dreamworld2
[2012.08.07 19:44:43 | 000,000,000 | ---D | C] -- C:\FR
[2012.08.06 13:18:51 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Conduit
[2012.08.06 13:18:48 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Local\Conduit
[2012.08.05 15:44:41 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\.minecraft
[2012.08.04 02:24:47 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\ProgSense
[2012.08.04 02:24:38 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\GrabPro
[2012.08.04 02:24:05 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\Orbit
[2012.08.03 03:04:56 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\M2Fish
[2012.08.03 03:04:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\M2Fish
[2012.08.03 03:04:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\M2Fish
[2012.08.02 18:06:32 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Local\Electronic_Arts_Inc
[2012.08.02 17:53:26 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Electronic Arts
[2012.08.02 17:30:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Blackmamba Network
[2012.08.01 00:10:44 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Zoera2
[2012.07.30 12:28:01 | 000,000,000 | ---D | C] -- C:\Users\Nox\Documents\Electronic Arts
[2012.07.29 22:56:48 | 000,447,752 | ---- | C] (On2.com) -- C:\Windows\SysWow64\vp6vfw.dll
[2012.07.29 22:56:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft WSE
[2012.07.29 21:37:37 | 000,000,000 | ---D | C] -- C:\ProgramData\TrackMania
[2012.07.29 21:32:00 | 000,000,000 | ---D | C] -- C:\Users\Nox\Documents\TrackMania
[2012.07.29 21:29:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TmUnitedForever
[2012.07.29 21:24:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TmUnitedForever
[2012.07.28 15:52:56 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\redsn0w
[2012.07.28 08:40:43 | 000,000,000 | ---D | C] -- C:\2011 Client for 1678Files
[2012.07.25 15:36:29 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Azuria
[2012.07.25 15:07:28 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Local\NFS Underground 2
[2012.07.25 14:57:34 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EA GAMES
[2012.07.25 14:53:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\EA GAMES
[2012.07.24 21:28:22 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\.Spoutcraft
[2012.07.22 15:44:15 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Anessia2
[2012.07.22 05:04:50 | 000,000,000 | ---D | C] -- C:\ProgramData\delight software gmbh
[2012.07.20 11:12:18 | 000,000,000 | ---D | C] -- C:\Users\Nox\Documents\Eden Games
[2012.07.20 11:11:30 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Local\CrashRpt
[2012.07.20 10:31:06 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Roaming\Foxit Software
[2012.07.19 13:39:45 | 000,000,000 | ---D | C] -- C:\Users\Nox\Documents\SimCity 4
[2012.07.16 17:06:48 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Foxit Software
[2012.07.16 16:53:05 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Vuphon2
[2012.07.15 21:48:29 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Local\libimobiledevice
[2012.07.15 20:19:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Helius2
[2012.07.15 11:11:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2012.07.15 11:09:36 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2012.07.15 11:09:16 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2012.07.15 11:09:16 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\iTunes
[2012.07.15 10:38:50 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Diablo III
[2012.07.15 10:38:50 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Blizzard Entertainment
[2012.07.15 10:38:49 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Diablo III
[2012.07.15 10:38:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Blizzard Entertainment
[2012.07.15 10:33:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Battle.net
[2012.07.14 12:13:03 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Metin2 P-Server Nexodia2
[2012.07.13 23:04:55 | 000,000,000 | ---D | C] -- C:\Users\Nox\AppData\Local\{D14A7AEC-DD51-4B7D-968D-ED860B4F1D1E}
[2012.07.13 23:04:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\IMinent Toolbar
[2012.07.13 23:03:24 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Iminent
[2012.07.13 23:02:15 | 000,000,000 | ---D | C] -- C:\Program Files\Software4u
[2012.07.13 23:01:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\System.Data.SQLite
[2012.07.13 23:01:20 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\System.Data.SQLite
[2012.07.13 15:30:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\WinSCP
[2012.07.13 15:30:35 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\WinSCP
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.08.10 14:28:00 | 000,001,112 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1322660023-3648253312-1832618820-1000UA.job
[2012.08.10 14:05:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2012.08.10 03:06:41 | 000,021,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.08.10 03:06:41 | 000,021,648 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.08.10 03:06:07 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Nox\Desktop\OTL.exe
[2012.08.10 02:56:44 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.08.10 02:56:37 | 3195,293,696 | -HS- | M] () -- C:\hiberfil.sys
[2012.08.09 20:28:00 | 000,001,060 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-1322660023-3648253312-1832618820-1000Core.job
[2012.08.09 17:39:16 | 000,771,437 | ---- | M] () -- C:\Users\Nox\Desktop\dfyoutubebg.png
[2012.08.09 17:39:12 | 000,000,132 | ---- | M] () -- C:\Users\Nox\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.08.09 17:05:46 | 000,046,465 | ---- | M] () -- C:\Users\Nox\Desktop\DFAvatar.png
[2012.08.09 16:53:16 | 000,001,966 | ---- | M] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012.08.09 15:01:39 | 000,017,408 | ---- | M] () -- C:\Users\Nox\AppData\Local\WebpageIcons.db
[2012.08.09 13:44:19 | 000,000,000 | ---- | M] () -- C:\Windows\SysWow64\config.nt
[2012.08.08 05:03:03 | 000,000,600 | ---- | M] () -- C:\Users\Nox\AppData\Local\PUTTY.RND
[2012.08.06 13:20:44 | 000,000,898 | ---- | M] () -- C:\Windows\SysWow64\InstallUtil.InstallLog
[2012.08.06 13:18:37 | 000,001,011 | ---- | M] () -- C:\Users\Public\Desktop\ClipGrab.lnk
[2012.08.03 03:05:26 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2012.08.03 03:05:26 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2012.08.03 03:04:57 | 000,001,035 | ---- | M] () -- C:\Users\Nox\Desktop\Statistic Reader.lnk
[2012.08.03 03:04:57 | 000,000,983 | ---- | M] () -- C:\Users\Nox\Desktop\M2Fish.lnk
[2012.07.31 22:16:22 | 000,001,783 | ---- | M] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.29 22:53:36 | 000,447,752 | ---- | M] (On2.com) -- C:\Windows\SysWow64\vp6vfw.dll
[2012.07.29 13:12:22 | 000,001,406 | ---- | M] () -- C:\Users\Nox\Desktop\Mozilla Firefox.lnk
[2012.07.26 04:49:19 | 485,899,592 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.07.20 14:48:16 | 000,000,600 | ---- | M] () -- C:\Users\Nox\AppData\Roaming\winscp.rnd
[2012.07.20 10:35:10 | 001,806,326 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.07.20 10:35:10 | 000,767,062 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.07.20 10:35:10 | 000,721,338 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.07.20 10:35:10 | 000,175,210 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.07.20 10:35:10 | 000,148,114 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2012.07.17 14:44:34 | 000,005,632 | ---- | M] () -- C:\Users\Nox\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.16 17:03:26 | 000,000,008 | ---- | M] () -- C:\XPWD.cfg
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ]
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.08.09 16:40:41 | 000,771,437 | ---- | C] () -- C:\Users\Nox\Desktop\dfyoutubebg.png
[2012.08.09 15:01:36 | 000,017,408 | ---- | C] () -- C:\Users\Nox\AppData\Local\WebpageIcons.db
[2012.08.09 13:44:24 | 000,001,966 | ---- | C] () -- C:\Users\Public\Desktop\avast! Free Antivirus.lnk
[2012.08.08 22:52:12 | 000,046,465 | ---- | C] () -- C:\Users\Nox\Desktop\DFAvatar.png
[2012.08.06 13:18:37 | 000,001,011 | ---- | C] () -- C:\Users\Public\Desktop\ClipGrab.lnk
[2012.08.03 03:04:57 | 000,001,035 | ---- | C] () -- C:\Users\Nox\Desktop\Statistic Reader.lnk
[2012.08.03 03:04:57 | 000,000,983 | ---- | C] () -- C:\Users\Nox\Desktop\M2Fish.lnk
[2012.07.29 13:12:22 | 000,001,406 | ---- | C] () -- C:\Users\Nox\Desktop\Mozilla Firefox.lnk
[2012.07.18 16:21:09 | 485,899,592 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2012.07.16 17:03:26 | 000,000,008 | ---- | C] () -- C:\XPWD.cfg
[2012.07.15 11:11:32 | 000,001,783 | ---- | C] () -- C:\Users\Public\Desktop\iTunes.lnk
[2012.07.13 23:03:52 | 000,000,898 | ---- | C] () -- C:\Windows\SysWow64\InstallUtil.InstallLog
[2012.07.13 15:30:38 | 000,000,600 | ---- | C] () -- C:\Users\Nox\AppData\Roaming\winscp.rnd
[2012.06.20 14:22:18 | 000,043,520 | ---- | C] () -- C:\Windows\SysWow64\CmdLineExt03.dll
[2012.06.17 11:47:46 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe
[2012.05.28 14:13:12 | 000,000,600 | ---- | C] () -- C:\Users\Nox\AppData\Local\PUTTY.RND
[2012.05.28 12:35:02 | 001,589,248 | ---- | C] () -- C:\Windows\SysWow64\libmysql_d.dll
[2012.04.14 20:14:02 | 000,154,800 | -H-- | C] () -- C:\Windows\SysWow64\mlfcache.dat
[2012.04.13 18:34:16 | 000,008,192 | ---- | C] () -- C:\Users\Nox\AppData\Roaming\SQLiteManager3.pref
[2012.04.05 15:46:53 | 001,174,083 | ---- | C] () -- C:\Windows\unins000.exe
[2012.04.05 15:46:53 | 000,018,073 | ---- | C] () -- C:\Windows\unins000.dat
[2012.03.08 21:31:21 | 000,001,456 | ---- | C] () -- C:\Users\Nox\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2012.03.08 21:28:10 | 000,000,132 | ---- | C] () -- C:\Users\Nox\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2012.03.04 15:11:38 | 000,000,069 | ---- | C] () -- C:\Windows\wininit.ini
[2012.03.01 17:49:21 | 000,000,132 | ---- | C] () -- C:\Users\Nox\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.03.01 15:57:26 | 000,280,904 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.03.01 15:57:20 | 000,075,136 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.02.29 16:52:36 | 000,005,632 | ---- | C] () -- C:\Users\Nox\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.02.19 12:11:28 | 000,002,085 | ---- | C] () -- C:\Users\Nox\.recently-used.xbel
[2012.02.16 18:00:23 | 001,642,402 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.02.10 19:43:25 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2006.06.09 15:38:35 | 000,015,259 | -H-- | C] () -- C:\Users\Nox\AppData\Roaming\Noxlog.dat

< End of report >
         

--- --- ---

Extra.txt:OTL Logfile:

OTL Extras logfile created on: 10.08.2012 14:43:29 - Run 1
OTL by OldTimer - Version 3.2.56.0     Folder = C:\Users\Nox\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,97 Gb Total Physical Memory | 2,42 Gb Available Physical Memory | 61,03% Memory free
7,93 Gb Paging File | 5,60 Gb Available in Paging File | 70,59% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 456,28 Gb Total Space | 78,53 Gb Free Space | 17,21% Space Free | Partition Type: NTFS
Drive D: | 1,11 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive E: | 673,92 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: NOX-PC | User Name: Nox | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
jsfile [edit] -- "C:\Program Files (x86)\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
jsfile [edit] -- "C:\Program Files (x86)\Macromedia\Dreamweaver 8\dreamweaver.exe" "%1" (Macromedia, Inc.)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [Bridge] -- C:\Program Files (x86)\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0EC86E27-3D54-4123-A2FA-813AE0921719}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{9FB76C58-FCD3-4EFE-A28D-9CEEEB9E30B0}" = lport=25565 | protocol=17 | dir=in | name=udp | 
"{D04BE264-C768-4021-8978-113DBDEF5448}" = lport=25565 | protocol=6 | dir=in | name=tcp | 
"{E20CA7DF-D203-4E16-937B-812202CD611A}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{00E88E45-064D-4223-AB72-A456E26680F3}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{01E9D06C-2825-41C6-8403-84361FF39DD8}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server celestia2\celestia2.bin | 
"{0241ACBB-ED2C-4F71-BC8A-64B1C2DCA456}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{029A2FF2-E5E6-4267-8242-4DD634A8C978}" = protocol=6 | dir=in | app=c:\users\nox\desktop\sina server\minecraft_server.exe | 
"{030F468D-63E1-4B7A-9C73-A2241E421C4B}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server vuphon2\metin2client.bin | 
"{0B75B78C-0C07-4FE1-9AC9-D544B12E9A43}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\modified-client_4.0\mc.exe | 
"{0BA322A4-0920-4541-930D-25CED2C9D2F8}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server zoera2\metin2client.bin | 
"{0C08B8B6-5FF7-4721-81BB-F0878E469EDB}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\ayendox2 client v1.0\metin2.bin | 
"{0C2667A7-71F9-4423-9190-D9387E39BB0F}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server helius2\helius2.exe | 
"{0C7F9D75-BB79-46FD-A164-E286A8C9E406}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mx vs atv reflex\mxsettings.exe | 
"{11E15BA6-640C-4850-997D-F574BAAC61C8}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server rop\rop-network.exe | 
"{12030E1F-DD12-48E1-98BC-CC44856BED28}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server sirius mt2\metin2client_sirius_mt2.bin | 
"{13F53FEB-75C3-4942-8DE5-1F02E00B0407}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe | 
"{15A4B562-CCBD-4E7D-A241-E2498E33FA1A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\realm of the mad god\realm of the mad god.exe | 
"{15A704D7-1C91-4406-8ED3-6CA7981F3E54}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\2011 client for 1678files\metin2.bin | 
"{17B4FD21-13DB-437C-A4A6-0B237C01A283}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{17BA9C45-E2D8-4D49-844B-583AEC151DD0}" = dir=in | app=c:\program files (x86)\itunes\itunes.exe | 
"{17DD5597-8217-4BE6-B968-BB2F6004BAAC}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe | 
"{17ECA16E-852D-41BD-8F9D-1E17B8A42B7E}" = protocol=6 | dir=in | app=c:\program files\software4u\idevice manager\software4u.idevicemanager.exe | 
"{1A8497CE-5727-46F7-ABE8-23BC9A62D739}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{1AC6BD61-AEC6-46F0-A60B-36D3BD6D98A4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{1B9AA290-311D-453E-94E0-CDBE23688E32}" = protocol=17 | dir=in | app=c:\users\nox\downloads\anessia2patcher\metin2client.bin | 
"{1C044425-B907-42F5-AC5D-C5195C75D14E}" = protocol=17 | dir=in | app=c:\program files (x86)\software4u\idevice manager\software4u.idevicemanager.exe | 
"{1D549C52-9B35-4F1E-B700-BF910DC4D79C}" = protocol=17 | dir=in | app=c:\users\nox\downloads\tinyumbrella-5.11.00b.exe | 
"{1D55123E-9A31-4512-8C75-8EE1465EB5D0}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server alzoria2\metin2client.exe | 
"{1DFB5163-4F16-4DD0-AC88-8FF190F7BC9F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\uplauncher.exe | 
"{1E974F4C-F0B8-41F3-B9CA-2849DEC4776D}" = protocol=6 | dir=in | name=mctcp | 
"{1F1C8961-548F-45DC-96AD-7632BA1DF9DC}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server saphir2\saphir2.exe | 
"{1F24469D-CBC5-4168-9D9D-C8A10621AC14}" = protocol=6 | dir=in | app=c:\program files (x86)\z8games\crossfire\cf_g4box.exe | 
"{1F46B436-AD9A-4EBD-A174-6C0642FF511C}" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\java.exe | 
"{20CAEDF9-E2E5-45CD-83E7-A071C74CE1A7}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{21D60CB1-0B67-494E-A329-561BADCE59D2}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\modified-client_4.0\mc.exe | 
"{22C443A3-C43A-4902-B7BC-A18BAE65900A}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 
"{23D4D513-E4E6-46B7-8D6F-A28B89D6D621}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{243C34B3-7F0C-4D90-BEE5-9DD1D1ABB7D5}" = protocol=17 | dir=in | name=udp | 
"{24B9520B-5247-49A9-85FD-4FE3FE964FB5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\garrysmod\hl2.exe | 
"{250E5515-AE0E-4A7D-AE94-9832258002C3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{25BA805F-B760-4508-96E8-F7199D1D7412}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server zoera2\metin2client.bin | 
"{26537625-D828-4EC5-8ED5-B59E87165DCF}" = protocol=17 | dir=in | app=c:\users\nox\downloads\crossfire_downloader.exe | 
"{26B0E73F-0220-40A8-A4B5-027338C88A05}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\apb reloaded\launcher\apblauncher.exe | 
"{29652659-EED2-402D-A6F6-BC1D56FEFE96}" = protocol=17 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{29F23FE0-31EF-4A22-BEEF-FEDDC05579B8}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server verus2\verus2.bin | 
"{2A5374A3-FFAE-4003-8FA1-8807C0680E8D}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server vuphon2\metin2client.bin | 
"{2B7E462B-B943-40FF-9507-FBC4BAC8CA0C}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server taubben-mt2\taubbe-mt2.exe | 
"{2B89A7B6-3D1C-45EA-B376-303407AB8069}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2client.exe | 
"{2E3E7B3A-9C51-41AE-94E7-75D53093C1A3}" = protocol=6 | dir=in | app=c:\program files (x86)\icebeatzz - client\icebeatzz - starter.exe | 
"{2E6591A5-2E79-4838-A08C-B35B2D089166}" = protocol=6 | dir=in | app=c:\users\nox\downloads\crossfire_downloader.exe | 
"{2FB5FEA1-1ACB-4C7D-B438-789A7BC25EA2}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{303A0DAE-2A6E-4B7A-901E-752EC15DE40D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\testdrive2.exe | 
"{349E82B4-CD4C-48D3-B841-0E715F304470}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\modified_client_4.0_full_client_upload_by_mrvideolike_c5298\modified-client_4.0\mc.exe | 
"{360D09BD-A6E6-47DF-9BAD-D0B56EBF8821}" = dir=in | app=c:\program files (x86)\windows live\mesh\moe.exe | 
"{3614E29A-12A8-4F26-88A9-3E33CE6DB66E}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server mythology2\.mythology.exe | 
"{376EABEE-2A37-4F42-B4D7-9331055C0062}" = protocol=6 | dir=in | name=tcp | 
"{38332F66-0276-4D22-8A9A-1AB7136122B7}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2.bin | 
"{38894364-FA29-474D-AAA2-03FD1A3C7F9F}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{393C79F9-EC42-4CFA-91B6-14B6E97B2203}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{39429113-1D08-42A4-8353-206C26DE5BD0}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe | 
"{3A41F5D0-2844-4898-9381-F679D18C41DF}" = protocol=17 | dir=in | app=c:\program files (x86)\software4u\idevice manager\software4u.idevicemanager.exe | 
"{3A704BA5-1F9E-441E-BF1A-62734CB4954F}" = protocol=17 | dir=in | app=c:\users\nox\desktop\terraria server\terrariaserver.exe | 
"{3AB6E7A6-1E7F-4D70-B480-FD7B80D1A641}" = protocol=6 | dir=in | app=c:\users\nox\appdata\roaming\dropbox\bin\dropbox.exe | 
"{3AF35B42-9E87-4780-A98F-6493528DA770}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe | 
"{3BEE10E3-9AB7-4ABC-A345-16957572C784}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"{3C96CC44-EB2B-4212-ADB8-B89E75350523}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server shizuka3\clientstarter.exe | 
"{3CB69226-688E-486F-BFD2-EC30C9CD9B62}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mx vs atv reflex\mxreflex.exe | 
"{3D2559A2-4108-455A-9CDF-1E0B88583FC4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\realm of the mad god\realm of the mad god.exe | 
"{3D27F8E3-1EAA-48DF-BBE5-C256E9FA9CF4}" = protocol=17 | dir=in | app=c:\program files (x86)\tmunitedforever\tmforever.exe | 
"{3DB9DC6D-54D8-450A-A1ED-876434B9A1D4}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server zephion\metin2client.exe | 
"{3E996B24-39E4-47CD-A0F9-39E485ED02A6}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{3EDA5EA9-9867-43BD-95A0-68ACE944B3A8}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server helius2\helius2.exe | 
"{3F7A5D7F-690E-4727-AD73-26EE16D9BA72}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.exe | 
"{431DF5A3-3F5B-4223-803D-9F30DAD0F395}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe | 
"{43C266F4-4F09-4D69-A373-29DEBF5CC40A}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server shizuka3\clientstarter.exe | 
"{474F95F9-54F5-422A-8E86-F0D0C60E3BF7}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"{47C3977F-6F07-4DD7-A718-9B02761F534E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\apb reloaded\binaries\vivoxvoiceservice.exe | 
"{4868F00F-B773-4E1B-A18F-5FBBF42947C9}" = protocol=17 | dir=in | app=c:\program files\software4u\idevice manager\software4u.idevicemanager.exe | 
"{4A6F3B63-0ADC-4172-B281-698FA2DBF63B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{4BA638DB-7998-4CC2-A6C8-6377EA863ED4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\portal 2\portal2.exe | 
"{4C9F2F37-6DBC-49FD-A441-1683CD170FCE}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2client.exe | 
"{4D43EB43-67D9-45A2-973F-9246F6954CC6}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server lynastra2\lynastra2.exe | 
"{4D440277-021D-4ACD-883E-14C150411938}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\calypso-2.exe | 
"{4E16638F-3215-4539-B629-49CCDE898D9E}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{50F68D30-2BCA-4D07-8E43-6A5DFF99F1A3}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"{521E6C00-AA32-47BC-9BE5-689BD708DBC3}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server zephion\metin2client.exe | 
"{537664DF-4063-44E2-8139-07A96AE2F2CC}" = protocol=6 | dir=in | app=c:\users\nox\downloads\anessia2patcher\metin2client.bin | 
"{552DF0F1-3B58-4403-9E04-CFA7D4BEFF0B}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe | 
"{56E03848-9BAC-4FB4-B8CA-EAC55DA2F399}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe.exe | 
"{5764883C-E517-414D-A6C1-6FDF0537D46C}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\calypso2.exe | 
"{59C1C752-B8F4-4194-9905-4F7FAD80D375}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server hamachi\metin2.bin | 
"{59CF6D03-FA29-40E5-BE3C-19E62C0D219A}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\audiosurf\engine\questviewer.exe | 
"{59F9E790-CB03-4EC5-B0FD-B97098E71081}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\ayendox2 client v1.0\metin2.bin | 
"{5A3B5C49-4037-43C0-B656-DF587CC51F0E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{5B10FF4B-9E64-4E7B-9064-58B7A4829575}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\portmap\portmap.exe | 
"{5B8554F8-6055-4DE4-A1D6-63F735F72FB0}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | 
"{5E959366-A5F6-4FF4-9B7A-C5729F984096}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server hardcore reloaded\.hardcore reloaded.exe | 
"{5F5C4524-2ABF-43B7-AF19-C29CB4DC41C3}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server alzoria2\metin2client.exe | 
"{60C8CD88-F45C-4F56-B4E7-27431D6F1252}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\modified_client_4.0_full_client_upload_by_mrvideolike_c5298\modified-client_4.0\mc.exe | 
"{655F35F2-E997-408B-9F55-93C852B6E8FD}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\apb reloaded\binaries\apb.exe | 
"{65999391-D26A-46BA-A08B-7404E668182C}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{66602C9C-65C4-43F4-90DD-7AE5855B8586}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\calypso2.exe | 
"{6761B91B-E263-4198-B3F6-95EFA9FA6982}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\apb reloaded\launcher\apblauncher.exe | 
"{6A6C9BA7-98ED-4838-BBC4-F878B5174AFD}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server nexodia2\metin2client.bin | 
"{6BC2B7AF-8943-4466-982C-DA5D35016EF7}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{6BD1CD08-C8B9-46FD-BC9E-84E202E191EA}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server dark fusion2\metin2client.bin | 
"{6C39D4A7-9E7D-411A-87A1-EB4BDC1AD40A}" = protocol=6 | dir=in | app=c:\users\nox\downloads\downloads (alt)\crossfire_downloader.exe | 
"{6E6C0516-8571-4930-9C84-EB9635ABBE38}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2.bin | 
"{70B6A746-DBB5-4257-93CF-C51CCE4E096A}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\modified-client_4.0\mc.exe | 
"{71579D99-47AD-4F3B-8584-B50C31B80D90}" = protocol=17 | dir=in | app=c:\users\nox\appdata\roaming\dropbox\bin\dropbox.exe | 
"{71C2FCDA-D102-44EF-B97A-5F0BF2ADACD7}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | 
"{74424B0A-7F80-4D08-8DAA-1DF93F1D70A3}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server mythology2\.mythology.exe | 
"{76845832-78F1-4F2C-8EF0-20EF75E17F7F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{76D688CA-F17B-4F2C-A636-0F10ADE71A71}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server saphir2\saphir2.exe | 
"{77DDEE83-4C14-47A9-9949-AB2670F5E7EC}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server celestia2\celestia2.bin | 
"{78EF85D4-72B3-40E4-815A-617E9DF53E36}" = protocol=6 | dir=in | app=c:\users\nox\appdata\roaming\dropbox\bin\dropbox.exe | 
"{79AA0316-94E3-43EB-B947-06BB399255B4}" = protocol=17 | dir=in | app=c:\program files (x86)\z8games\crossfire\cf_g4box.exe | 
"{7B45459C-4D7C-4D86-8E77-8F0A6EA19ADC}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\simcity 4 deluxe\apps\simcity 4.exe | 
"{7B799736-21EF-4ACF-A11F-7DDB46D502D0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\garrysmod\hl2.exe | 
"{7BFF4E0D-6F4C-42CF-8AEC-F2FEDE0F47C3}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | 
"{7C177B90-F10D-4FB7-9B6F-E94EDBE4C858}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server taubben-mt2\taubbe-mt2.exe | 
"{7E0D9C9D-0935-4EA9-A854-5EFE244B88AA}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server rop\rop-network.exe | 
"{7FD15A3A-F6A6-4079-823A-467B5AD25CA1}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server hamachi\metin2.bin | 
"{80DD7B9C-0563-4A3F-BCB0-539083F156B5}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server verus2\verus2.bin | 
"{819E1126-901D-4CD1-8FC0-6531A47F9BDA}" = protocol=17 | dir=in | app=c:\users\nox\desktop\ipod jailbreak\tinyumbrella.exe | 
"{83681840-2EA4-4D02-A3FD-60CF16E80F65}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{839569B3-4602-47A1-A94E-060426880581}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server anessia2\anessia2.exe | 
"{855ADE4E-594A-482F-8D7F-653B7E9685E9}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server lynastra2\lynastra2.exe | 
"{8572C85D-D1B6-408D-BD96-7D46D0698B4B}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\2011 client for 1678files\metin2.bin | 
"{87460D3D-B378-4249-9E28-793425021053}" = protocol=6 | dir=in | app=c:\program files (x86)\software4u\idevice manager\software4u.idevicemanager.exe | 
"{88045585-45B5-4456-A508-2E082EDE43BC}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"{897CB40A-1AB2-4DB1-B05C-CCB15E90C381}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe | 
"{8A8F48E4-1542-48FC-841A-21518B383434}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | 
"{8AC6967E-EDC1-481A-A887-0369AB46E4F5}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server anessia2\metin2client.bin | 
"{8B2A62B3-219A-42C1-9853-6BD6B65D0D59}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\metin2 client hamachi\metin2.bin | 
"{8C108356-01BF-45A8-B3C6-FFF53969E37D}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.bin | 
"{8CF9CEF1-07FE-4DC8-87CE-4D51DBBC0509}" = protocol=17 | dir=in | app=c:\program files (x86)\alzoclient\metin2client.exe | 
"{8D381F86-10A1-4715-BE23-3FD0745960E5}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server nexodia2\metin2client.bin | 
"{8DB4AB03-1025-4CE4-B257-32B97733463B}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server aura-mt2\aura-mt2.exe | 
"{8F1E7FF4-8E92-47DD-BC4A-192EF973B6E8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\simcity 4 deluxe\apps\simcity 4.exe | 
"{8FB23FB3-3246-4E6F-92FA-FD4126D13525}" = dir=in | app=c:\program files (x86)\windows live\messenger\msnmsgr.exe | 
"{91065F01-73E3-4AE9-AC75-A2DC59E8FBB2}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server beagmmt2\mc.exe | 
"{91406EAC-671A-4214-87D8-5625C4C501A8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 
"{944592E1-9615-4C2D-87D0-90A83EA04FBB}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe | 
"{951F9DDC-5642-4BE6-8368-D5EC6DCCD778}" = protocol=6 | dir=in | app=c:\program files (x86)\alzoclient\metin2client.exe | 
"{9526602F-EA6F-48FC-8720-074E407BEB9F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{95961E0C-1D96-43FA-B8AA-2F4FB6D4B9B4}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.bin | 
"{959DC308-F280-4A79-A50A-4AB76374FBF4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\apb reloaded\binaries\vivoxvoiceservice.exe | 
"{96DA0862-7637-47A3-96A9-FCD041D0FF21}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\metin2 client hamachi\metin2.bin | 
"{977427C5-DFED-41C4-8CB8-9312212B5B31}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{9807B56D-2F25-47F1-8621-08EDEB4BC3EA}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server mitin2\metin2client.exe | 
"{9A4A1B80-49E7-4DF9-BD40-9D3B9595DCA0}" = protocol=6 | dir=in | app=c:\program files (x86)\bonjour\mdnsresponder.exe | 
"{9DB7253B-3D77-4153-AACA-C5EECD3DCDC2}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server takashi2\clientstarter.exe | 
"{9FF14EB7-5110-47E9-8574-26AD7AE46BA4}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"{A01DED57-B54E-4B46-8AE7-63F153D2E43E}" = protocol=17 | dir=in | name=mcudp | 
"{A03FEC34-0F4D-4389-A56E-AF09FCFA17F5}" = protocol=6 | dir=in | app=c:\program files (x86)\software4u\idevice manager\software4u.idevicemanager.exe | 
"{A234834B-6D04-4986-A9DE-149598AF8B94}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server aura-mt2\aura-mt2.exe | 
"{A3537608-F4C9-4A41-8356-A214B2FA0E0F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mountblade warband\mb_warband.exe | 
"{A53B3DF7-5A16-438F-8617-C10D3B6CEA70}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server tsuyoshi2\metin2client.bin | 
"{A6D2A76F-8E81-4851-AC8E-B0A635AD2267}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\portmap\portmap.exe | 
"{A7D57775-564E-4D3A-A76E-78190F297C2C}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{A9DDEB69-C9DF-47A6-96DF-E0BDACFFD136}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\fifa 12\game\fifa.exe | 
"{AA5884D4-5CD3-4F4B-93B9-52F24DBED5F7}" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"{AB5F163E-2974-455D-84C5-78E9C3B5BC8E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\simcity 4 deluxe\support\ea help\electronic_arts_technical_support.htm | 
"{AC783896-1F3F-40FD-9300-BA294CF9B111}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server beagmmt2\mc.exe | 
"{AE89400F-686D-4B2A-B147-F7F893A897B5}" = protocol=17 | dir=in | app=c:\users\nox\downloads\downloads (alt)\crossfire_downloader.exe | 
"{B0E53B8A-8BB6-4E46-9C25-A4A763C63046}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dungeondefenders.exe | 
"{B1369747-FF47-4EC0-A704-991044F4A39D}" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\java.exe | 
"{B4BADD9C-1BB2-4321-BABF-4202AC5233C3}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | 
"{B6C73D2A-7FE1-4081-866F-55BEE35AC670}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\modified-client_4.0\mc.exe | 
"{B795B601-8BA3-46E8-B7CC-29BCAED654F4}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\metin2 client hamachi\metin2.bin | 
"{B89C647B-6529-46AB-AFC0-2A1E46BD08C4}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe | 
"{B8B0BAD6-2DFE-4D4B-944C-14673C5CAE8C}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{BA5B3BB8-E1E0-4966-A088-E008D53B571F}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server mitin2\metin2client.exe | 
"{BBFE3317-B7AB-4F16-BC2E-D0C9A560AD13}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2\metin2client.bin | 
"{BD48F4A9-08B7-4AE8-9846-3CFA0F2C9593}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 
"{BD4EE93C-DACA-453B-835B-9FBA6D4E8091}" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"{BDCA004B-3959-4367-AEF8-2580D0B7C36B}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer.exe | 
"{BDE04706-62EE-4F31-A4B7-7DA2F908A9F5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe | 
"{C0C77C73-531F-4969-8D91-A61AABD6BC80}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe | 
"{C0D8E04D-7059-4CF1-94C4-F87188B5758E}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\simcity 4 deluxe\support\ea help\electronic_arts_technical_support.htm | 
"{C0E650E3-9A4B-47D1-ACDB-3AF7D43BCCE5}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dungeondefenders.exe | 
"{C8DCF991-FB2E-4240-9D65-0B3A461AEDDA}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server takashi2\clientstarter.exe | 
"{C9579BB5-EB0E-430E-87B8-04F9C1CCD013}" = protocol=6 | dir=in | app=c:\users\nox\desktop\terraria server\terrariaserver.exe | 
"{CA96E562-4948-4E62-92EA-83E2528D7D8A}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{CD53A0C4-4CAE-42A8-9D93-FC0D0D65B56D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\audiosurf\engine\questviewer.exe | 
"{CD69E294-3109-4F73-8864-953D14033E25}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server isomeria2\isomeria2.exe | 
"{CE2E39FC-CAB2-48CD-AEE3-B7ED3898F2DD}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"{D0046718-C414-4254-9A32-A007ADD77979}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"{D0591305-CBF2-4466-BCBE-FC2753277878}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{D0BF94D1-B7BE-49F1-B71F-10765FC4FDF8}" = dir=in | app=c:\brickforce\bflauncher.exe | 
"{D0C477BA-DA7D-4937-ABD9-08BB34D378AD}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server tsuyoshi2\metin2client.bin | 
"{D298ECC0-8DA1-4FF3-B2D6-2B6C0EB30E63}" = protocol=17 | dir=in | app=c:\users\nox\appdata\roaming\dropbox\bin\dropbox.exe | 
"{D3D23E51-6050-4392-8B26-F1B04D2EC2BC}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"{D3F662C3-4CEE-4129-9665-0F3C159418DB}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\portal 2\portal2.exe | 
"{D441A6E5-5F27-4B6A-9936-7D54F43E640E}" = protocol=17 | dir=in | app=c:\program files (x86)\icebeatzz - client\icebeatzz - starter.exe | 
"{D45E5E6F-AF5C-4276-87CD-E3D9490BBF31}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe | 
"{D4B62D46-D66C-4FC1-B703-E634DA80DF32}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe.exe | 
"{D5F991A8-1582-4579-A0B4-828747A2B4AA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"{D6678D41-6B2F-4079-8DCB-7C20949D9531}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\the binding of isaac\isaac.exe | 
"{D6D6CC4B-6447-43BE-8FD6-3720751A617E}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{D710103C-F2E2-4915-804D-F53B59243F87}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\portmap\portmap.exe | 
"{D7B5E04B-47E2-4578-A30C-F1534B698F34}" = protocol=6 | dir=in | app=c:\users\nox\downloads\tinyumbrella-5.11.00b.exe | 
"{D95EDB3E-EFAF-4731-8D3C-95D952D576D5}" = protocol=6 | dir=in | app=c:\program files (x86)\tmunitedforever\tmforever.exe | 
"{D97D0F84-8992-49C1-AE35-2342E1D4DD56}" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"{DB3B77E7-CFE6-4B1C-A98E-4D454115E708}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mx vs atv reflex\mxsettings.exe | 
"{DB6EA7C5-8E5C-4C20-9A69-DFED2FCD2467}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server anessia2\metin2client.bin | 
"{DFE35B1A-5B53-4C52-B8F7-C387B6BDE927}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server hardcore reloaded\.hardcore reloaded.exe | 
"{E12443EB-206E-45F8-9121-E3A549502FED}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{E35A7777-6B13-4C2C-B367-881C165E676A}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\metin2 client hamachi\metin2.bin | 
"{E3BB9648-8678-4D32-930A-8FF94F6B587F}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"{E4329C06-F263-4441-9FF9-E2089E14F1B2}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\calypso-2.exe | 
"{E4B51380-3B32-4B7F-BA66-60342AC782CB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 
"{E89FEEE7-D464-49B7-9FAB-CD54D9BDF562}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server anessia2\anessia2.exe | 
"{E9274822-4565-41BD-8671-DDA7E9925663}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{E9B77DCA-14A4-46AE-9E8D-DC8333C0CB7B}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server sirius mt2\metin2client_sirius_mt2.bin | 
"{EA3F08F9-DDBC-4851-89AD-CEBFB5FA66C2}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server isomeria2\isomeria2.exe | 
"{EA4E9A90-BF6F-4ED2-BE0C-B03A96F9272B}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server dark fusion2\metin2client.bin | 
"{EA61FEFC-9E0C-431C-B95B-7ABD6627C0AE}" = dir=in | app=c:\brickforce\brickforce.exe | 
"{EC7B8DAA-5273-48C0-A7A6-9635577D8F87}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 
"{ED5BC53C-D820-464A-8E1D-88A65377601B}" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"{ED789AC4-A89F-4EEF-963A-32B2FBEC5664}" = protocol=6 | dir=in | app=c:\users\nox\desktop\ipod jailbreak\tinyumbrella.exe | 
"{EE84578E-F0AA-4F7C-AD1F-6DEFB856BF80}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\mx vs atv reflex\mxreflex.exe | 
"{EECA027A-7FB3-4BAC-81A5-746768CF5377}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\uplauncher.exe | 
"{EEE70A60-B7C8-47C9-925D-00DBAFA2CC72}" = protocol=6 | dir=in | app=c:\program files (x86)\metin2\metin2client.bin | 
"{EF501509-5496-4762-8246-13F3B000777A}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\portmap\portmap.exe | 
"{F16F635A-61F2-4724-B1A8-BF99FD37E276}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version7\teamviewer_service.exe | 
"{F1EDE9EE-80F3-49E1-A5D0-E04A7CCFB678}" = protocol=17 | dir=in | app=c:\users\nox\desktop\sina server\minecraft_server.exe | 
"{F595F446-7BF6-4DA6-A645-D9EDD6D39013}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\apb reloaded\binaries\apb.exe | 
"{F8C6EFD7-3A72-4F36-ACD1-56D78C137107}" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.exe | 
"{FB051833-718F-43FF-B45C-CBE62B7076A5}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\testdrive2.exe | 
"TCP Query User{044E2FF3-068C-4830-BEAC-03266BEF6F27}C:\program files (x86)\metin2 p-server noxumi2 [admin]\metin2 client hamachi\metin2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\metin2 client hamachi\metin2.bin | 
"TCP Query User{0872B3E5-3E70-410D-85A6-C70FF454232F}C:\program files (x86)\metin2 p-server rop\rop-network.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server rop\rop-network.exe | 
"TCP Query User{095B23FC-611D-4F89-B1A9-360F476D5B44}C:\program files (x86)\metin2 p-server calypso2\calypso2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\calypso2.exe | 
"TCP Query User{0B51A9C9-9808-4E9B-AA2D-EEE987246FC3}C:\xampp\apache\bin\httpd.exe" = protocol=6 | dir=in | app=c:\xampp\apache\bin\httpd.exe | 
"TCP Query User{0C3793F7-034E-495B-B9A2-D1E82230651B}C:\program files (x86)\metin2 p-server lynastra2\lynastra2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server lynastra2\lynastra2.exe | 
"TCP Query User{0F64C29B-9A2A-475B-B558-D64C2274D01A}C:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"TCP Query User{11E2A60B-EA4A-49D1-8051-EB47C15CDBAB}C:\program files (x86)\icebeatzz - client\icebeatzz - starter.exe" = protocol=6 | dir=in | app=c:\program files (x86)\icebeatzz - client\icebeatzz - starter.exe | 
"TCP Query User{148EA37A-6CEE-4ABA-A3E1-50BE3AE81C1D}C:\program files (x86)\metin2 p-server noxumi2 [admin]\2011 client for 1678files\metin2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\2011 client for 1678files\metin2.bin | 
"TCP Query User{17C7D84D-E1D5-4A70-9BD5-2DC9F905453E}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{18C10C00-3560-4DAC-8B2B-CF56F421475D}C:\program files (x86)\metin2 p-server takashi2\clientstarter.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server takashi2\clientstarter.exe | 
"TCP Query User{1A8325ED-F094-4203-9455-836CBF323AB1}C:\program files (x86)\metin2 p-server anessia2\anessia2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server anessia2\anessia2.exe | 
"TCP Query User{1C05887E-B956-4E47-9F66-FD98A6893FA5}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"TCP Query User{1E334E74-AE41-4D63-B7D0-CBC4913893A0}C:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2client.exe | 
"TCP Query User{1ECFD0A7-419F-482F-9D5F-04AF06A58FC0}C:\program files (x86)\metin2 p-server ayendox [admin]\ayendox2 client v1.0\metin2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\ayendox2 client v1.0\metin2.bin | 
"TCP Query User{2146E644-052D-445B-8F5E-28265A30E327}C:\program files (x86)\metin2 p-server helius2\helius2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server helius2\helius2.exe | 
"TCP Query User{2169EF5D-CBE5-4FDC-87D2-278047B6FD0C}C:\program files (x86)\metin2 p-server hardcore reloaded\.hardcore reloaded.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server hardcore reloaded\.hardcore reloaded.exe | 
"TCP Query User{229D18B3-CE71-4B5E-B48B-F74C5DF7761E}C:\program files (x86)\steam\steamapps\triblx\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\team fortress 2\hl2.exe | 
"TCP Query User{2C8EA560-08B4-4798-B384-6D60D2C88044}C:\program files (x86)\metin2 p-server shizuka3\clientstarter.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server shizuka3\clientstarter.exe | 
"TCP Query User{32342766-18BC-481E-B331-058359663FB5}C:\program files (x86)\metin2 p-server ayendox [admin]\modified-client_4.0\mc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\modified-client_4.0\mc.exe | 
"TCP Query User{328E4DE5-0A4E-4F04-A5DC-B19AC198F2BC}C:\program files (x86)\metin2 p-server isomeria2\isomeria2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server isomeria2\isomeria2.exe | 
"TCP Query User{40EF21ED-329C-41B8-8D92-216EB695B8D7}C:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe.exe | 
"TCP Query User{42651726-8423-4C0A-8A75-F5091843A48F}C:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2.bin | 
"TCP Query User{43A9C477-458D-4357-AD0C-47A3A4CE238E}C:\program files (x86)\metin2 p-server celestia2\celestia2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server celestia2\celestia2.bin | 
"TCP Query User{44CC999F-FFD6-4E1D-836D-59B5EE1C88E4}C:\program files (x86)\metin2 p-server gronox2 [admin]\metin2 client hamachi\metin2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\metin2 client hamachi\metin2.bin | 
"TCP Query User{481F723F-D06A-444D-BC50-D518320C0155}C:\program files (x86)\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe | 
"TCP Query User{4F2157C3-4FE3-4359-A21B-BA62454678CD}C:\program files (x86)\metin2 p-server gronox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"TCP Query User{4F68F66C-9D7B-41D7-9DAE-ED7F1F664E2A}C:\program files (x86)\metin2 p-server ayendox [admin]\portmap\portmap.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\portmap\portmap.exe | 
"TCP Query User{52D543E3-3D07-47D8-85BC-EB605A309CAB}C:\program files (x86)\metin2 p-server mitin2\metin2client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server mitin2\metin2client.exe | 
"TCP Query User{5403620D-1151-4C82-8F9E-AB032ACFEFC8}C:\program files\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\java.exe | 
"TCP Query User{551A4EC8-63E7-4A3C-8D53-13921138F77A}C:\program files (x86)\metin2 p-server tsuyoshi2\metin2client.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server tsuyoshi2\metin2client.bin | 
"TCP Query User{559F1333-37ED-4E95-A062-EE522B51B38B}C:\program files (x86)\metin2 p-server nexodia2\metin2client.bin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server nexodia2\metin2client.bin.exe | 
"TCP Query User{55F4CBA9-8297-4520-8A91-DBC018C1CB84}C:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.bin | 
"TCP Query User{56052706-D909-4A88-925F-046B55D0E66D}C:\program files (x86)\metin2 p-server verus2\verus2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server verus2\verus2.bin | 
"TCP Query User{59A40CE9-A239-4ED4-B11B-88909D03D07D}C:\program files (x86)\metin2 p-server ayendox2 [admin]\portmap\portmap.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\portmap\portmap.exe | 
"TCP Query User{5CF2B090-B6A1-48C8-BCDD-77EC661CEF62}C:\program files (x86)\steam\steamapps\triblx\garrysmod\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\garrysmod\hl2.exe | 
"TCP Query User{5EB3B601-6727-4CFF-945E-ED3BDD76FDFC}C:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.exe | 
"TCP Query User{71E9F1AC-A145-4E84-BA77-218BDA1F02FE}C:\program files (x86)\metin2 p-server mythology2\.mythology.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server mythology2\.mythology.exe | 
"TCP Query User{738FD134-04FA-446E-B87F-FB4FFBEF765C}C:\program files (x86)\metin2\metin2client.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2\metin2client.bin | 
"TCP Query User{7F6F0A5C-6042-4C64-9AE9-8AA385B92F23}C:\program files (x86)\metin2 p-server vuphon2\metin2client.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server vuphon2\metin2client.bin | 
"TCP Query User{84857280-FF2C-401E-ADB2-112890064FB6}C:\program files (x86)\tmunitedforever\tmforever.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tmunitedforever\tmforever.exe | 
"TCP Query User{84C91073-DD74-4BE5-A008-81DE19C483EF}C:\program files (x86)\metin2 p-server beagmmt2\mc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server beagmmt2\mc.exe | 
"TCP Query User{87A071CA-E2DF-4A5A-8720-E815E9DAD1C0}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"TCP Query User{890FD5DF-415A-40F2-BC36-1ED7FD4EC8ED}C:\program files (x86)\metin2 p-server noxumi2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"TCP Query User{8B44053E-685A-4C2B-9410-D5A3AF2D4B88}C:\program files (x86)\metin2 p-server calypso2\calypso-2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\calypso-2.exe | 
"TCP Query User{8B6D63D7-ADAE-4BAC-AF5B-CEEFA8AAA32D}C:\program files (x86)\metin2 p-server dark fusion\metin2client.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server dark fusion\metin2client.bin | 
"TCP Query User{91337550-BBFF-4DFF-8D69-6901BAC9AAD3}C:\program files (x86)\metin2 p-server zoera2\metin2client.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server zoera2\metin2client.bin | 
"TCP Query User{96537CA8-AC93-478D-A5C4-F08352BA24BF}C:\program files (x86)\metin2 p-server saphir2\saphir2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server saphir2\saphir2.exe | 
"TCP Query User{97DB193B-1CC8-48D5-A3B8-6E225CA7A6A0}C:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe | 
"TCP Query User{9869FC71-5173-40C1-A8C2-6CA5ADDA5E9F}C:\program files (x86)\alzoclient\metin2client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\alzoclient\metin2client.exe | 
"TCP Query User{9DB4D22E-7A6F-4114-BEFC-28597CB40FE5}C:\program files (x86)\metin2 p-server hamachi\metin2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server hamachi\metin2.bin | 
"TCP Query User{9E88218B-2582-425C-8ABF-DD0EB4445EF3}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe | 
"TCP Query User{9F06A857-DD52-4754-BC6F-8F851130BC0C}C:\users\nox\downloads\tinyumbrella-5.11.00b.exe" = protocol=6 | dir=in | app=c:\users\nox\downloads\tinyumbrella-5.11.00b.exe | 
"TCP Query User{9F2FC140-BA7B-44B0-A5AC-BBBBAD63C24C}C:\program files (x86)\metin2 p-server ayendox2 [admin]\modified-client_4.0\mc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\modified-client_4.0\mc.exe | 
"TCP Query User{A2FFCA09-D126-4AAF-8B39-7F45A7D71243}C:\users\nox\desktop\ipod jailbreak\tinyumbrella.exe" = protocol=6 | dir=in | app=c:\users\nox\desktop\ipod jailbreak\tinyumbrella.exe | 
"TCP Query User{AD62B355-8F33-4FD7-A171-3A54BD798B75}C:\users\nox\desktop\terraria server\terrariaserver.exe" = protocol=6 | dir=in | app=c:\users\nox\desktop\terraria server\terrariaserver.exe | 
"TCP Query User{B3263984-1BA3-432B-81A0-43A0956A873F}C:\program files (x86)\metin2 p-server ayendox [admin]\modified_client_4.0_full_client_upload_by_mrvideolike_c5298\modified-client_4.0\mc.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\modified_client_4.0_full_client_upload_by_mrvideolike_c5298\modified-client_4.0\mc.exe | 
"TCP Query User{B6D6EDAC-20AF-4CF3-9098-A1AD0ECCCB2E}C:\program files (x86)\metin2 p-server nexodia2\metin2client.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server nexodia2\metin2client.bin | 
"TCP Query User{BC117B5A-547F-44DB-A5C6-BEE44C39EDD0}C:\program files (x86)\metin2 p-server zephion\metin2client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server zephion\metin2client.exe | 
"TCP Query User{C2E82575-DA4D-48AB-92D0-A84637BD4D04}C:\program files (x86)\metin2 p-server taubben-mt2\taubbe-mt2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server taubben-mt2\taubbe-mt2.exe | 
"TCP Query User{CB16C230-6C83-470A-A18D-140E56FC8C7E}C:\program files (x86)\metin2 p-server alzoria2\metin2client.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server alzoria2\metin2client.exe | 
"TCP Query User{CE0092BD-F5A2-4610-B155-678308F48D2E}C:\program files (x86)\metin2 p-server moonmt2\moonmt2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server moonmt2\moonmt2.exe | 
"TCP Query User{CEE5AB25-A7B4-4524-BDDA-FFD3EA9A8635}C:\program files (x86)\metin2 p-server anessia2\metin2client.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server anessia2\metin2client.bin | 
"TCP Query User{D00EC0AA-40A0-483D-83C2-44D292780CC7}C:\program files (x86)\metin2 p-server aura-mt2\aura-mt2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server aura-mt2\aura-mt2.exe | 
"TCP Query User{D5E31843-259F-44C0-B717-C0EBCA2294AF}C:\program files (x86)\steam\steamapps\triblx\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\counter-strike source\hl2.exe | 
"TCP Query User{E11C8BE8-694B-4B17-BD51-3DDFF1F513E7}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe | 
"TCP Query User{E8A78516-24B9-4580-988C-D7A5F8059542}C:\program files (x86)\metin2 p-server dark fusion2\metin2client.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server dark fusion2\metin2client.bin | 
"TCP Query User{EFCC524B-5203-4DAC-BCB4-2041C6C36535}C:\program files (x86)\metin2 p-server ayendox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"TCP Query User{F027F184-F2E1-49D4-B54D-EC60CBD7654C}C:\program files (x86)\metin2 p-server azuria\azuria-clientstarter.exe" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server azuria\azuria-clientstarter.exe | 
"TCP Query User{F11A57D7-EFD0-42FA-88E9-3A4DC39C22E2}C:\program files (x86)\steam\steamapps\triblx\counter-strike source\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\counter-strike source\hl2.exe | 
"TCP Query User{F1D9BC29-2D73-48A4-8D00-510AD5FE711B}C:\program files (x86)\steam\steamapps\common\test drive unlimited 2\testdrive2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\testdrive2.exe | 
"TCP Query User{F3C95126-0D94-4014-9850-EE93328A44B5}C:\program files (x86)\steam\steamapps\triblx\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\team fortress 2\hl2.exe | 
"TCP Query User{F9494B4C-140A-4960-8644-422D454FB57E}C:\program files (x86)\metin2 p-server sirius mt2\metin2client_sirius_mt2.bin" = protocol=6 | dir=in | app=c:\program files (x86)\metin2 p-server sirius mt2\metin2client_sirius_mt2.bin | 
"TCP Query User{F9B7B4F1-9DB4-4F24-9E07-5145EC338B3B}C:\users\nox\downloads\anessia2patcher\metin2client.bin" = protocol=6 | dir=in | app=c:\users\nox\downloads\anessia2patcher\metin2client.bin | 
"UDP Query User{004D72D3-507C-4AFC-91E5-269D6D1771B1}C:\program files (x86)\steam\steamapps\triblx\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\counter-strike source\hl2.exe | 
"UDP Query User{10884543-21A8-49F9-B683-7074C3959E24}C:\program files (x86)\metin2 p-server saphir2\saphir2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server saphir2\saphir2.exe | 
"UDP Query User{142B36FF-229D-48A2-9074-7AB1AF51D2F5}C:\program files (x86)\metin2 p-server verus2\verus2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server verus2\verus2.bin | 
"UDP Query User{14CD4CDE-E55C-4F4F-A870-4EE0E1737858}C:\program files (x86)\metin2 p-server helius2\helius2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server helius2\helius2.exe | 
"UDP Query User{151A8492-8399-418F-968C-FDEF39F21BE6}C:\program files (x86)\metin2 p-server ayendox [admin]\modified-client_4.0\mc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\modified-client_4.0\mc.exe | 
"UDP Query User{15B6AFAB-00FE-4AAF-9DE4-B584515C5DBB}C:\program files (x86)\metin2 p-server gronox2 [admin]\metin2 client hamachi\metin2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\metin2 client hamachi\metin2.bin | 
"UDP Query User{18EFE0D1-08F3-4EB6-962A-9D8B59ADA8CA}C:\program files (x86)\metin2 p-server rop\rop-network.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server rop\rop-network.exe | 
"UDP Query User{1AF69BAC-A7E6-43BB-A416-0078FE49158F}C:\program files (x86)\metin2 p-server mitin2\metin2client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server mitin2\metin2client.exe | 
"UDP Query User{204B313C-86C0-4988-BDB5-C094DA2E47F8}C:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\terraria\terrariaserver.exe | 
"UDP Query User{2BB67869-2D23-4B29-8AC6-0BD8D35C2AEB}C:\program files (x86)\metin2 p-server ayendox [admin]\ayendox2 client v1.0\metin2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\ayendox2 client v1.0\metin2.bin | 
"UDP Query User{2C8A4445-A52E-4E0D-AD52-EC98FDA238E4}C:\users\nox\desktop\ipod jailbreak\tinyumbrella.exe" = protocol=17 | dir=in | app=c:\users\nox\desktop\ipod jailbreak\tinyumbrella.exe | 
"UDP Query User{2E020FC1-E3AE-4CCD-A604-9743B71F2552}C:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2.bin | 
"UDP Query User{2E75F4D1-D34B-403D-A90A-BDA5D2CD03FE}C:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\2011 client for 1678files\metin2client.exe | 
"UDP Query User{35092D51-E449-48ED-A92A-AA8F100811F4}C:\program files (x86)\metin2 p-server calypso2\calypso2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\calypso2.exe | 
"UDP Query User{35D1C8EC-68B7-4A5E-8EAF-4D1D86CDB955}C:\program files (x86)\metin2 p-server vuphon2\metin2client.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server vuphon2\metin2client.bin | 
"UDP Query User{384F0C93-0B5C-488E-AFD4-B7BF14F9B1DE}C:\program files (x86)\metin2 p-server nexodia2\metin2client.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server nexodia2\metin2client.bin | 
"UDP Query User{43DCEC4D-B138-47D5-9828-D0A971648A38}C:\program files (x86)\icebeatzz - client\icebeatzz - starter.exe" = protocol=17 | dir=in | app=c:\program files (x86)\icebeatzz - client\icebeatzz - starter.exe | 
"UDP Query User{449E432D-DCBB-48FA-8F6D-42671685176C}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{48CD2F8F-A928-4CE1-85D6-E4B8C516364A}C:\program files (x86)\steam\steamapps\triblx\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\team fortress 2\hl2.exe | 
"UDP Query User{4CB9496B-F7C5-42EC-AED6-43D07DE50B96}C:\program files (x86)\metin2 p-server lynastra2\lynastra2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server lynastra2\lynastra2.exe | 
"UDP Query User{4FADDF70-4D7B-472C-8D6B-12547E57E6D3}C:\program files (x86)\metin2 p-server hardcore reloaded\.hardcore reloaded.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server hardcore reloaded\.hardcore reloaded.exe | 
"UDP Query User{4FC15437-DEBE-46BF-802F-421CAF70BF85}C:\program files (x86)\metin2 p-server ayendox [admin]\modified_client_4.0_full_client_upload_by_mrvideolike_c5298\modified-client_4.0\mc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\modified_client_4.0_full_client_upload_by_mrvideolike_c5298\modified-client_4.0\mc.exe | 
"UDP Query User{571892E9-EE59-4ADB-85D2-B70A76A487DE}C:\program files (x86)\metin2 p-server moonmt2\moonmt2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server moonmt2\moonmt2.exe | 
"UDP Query User{57C54552-FC22-438F-9371-020E426A2696}C:\program files (x86)\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe | 
"UDP Query User{58835599-DD54-4695-8AB7-BE260F34A854}C:\program files (x86)\tmunitedforever\tmforever.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tmunitedforever\tmforever.exe | 
"UDP Query User{641DE180-5E44-4CC5-9CF4-F4768425E7AE}C:\program files (x86)\metin2 p-server hamachi\metin2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server hamachi\metin2.bin | 
"UDP Query User{6EB72F4C-4364-4178-B919-541A1F5B6AA1}C:\program files (x86)\steam\steamapps\triblx\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\team fortress 2\hl2.exe | 
"UDP Query User{6F8EFF27-5C1D-4FDB-916D-45A7B2C49760}C:\program files (x86)\java\jre6\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\java.exe | 
"UDP Query User{739BE6D3-0E25-4F08-B3CC-4AA5BCCDC076}C:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.bin | 
"UDP Query User{756D16EC-D26B-49F0-B9F4-55DBBDD09456}C:\program files (x86)\metin2 p-server sirius mt2\metin2client_sirius_mt2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server sirius mt2\metin2client_sirius_mt2.bin | 
"UDP Query User{7F32E3AD-25E7-4443-8EC3-63EF86E41210}C:\program files (x86)\metin2 p-server taubben-mt2\taubbe-mt2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server taubben-mt2\taubbe-mt2.exe | 
"UDP Query User{7FADF2E7-1BF0-4EF8-9F65-7AD51FBEAB92}C:\program files\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\java.exe | 
"UDP Query User{81003EAE-5D40-4150-8981-BB59252FD45D}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe | 
"UDP Query User{83703E18-CE12-42DE-A053-8ACE671FF87D}C:\program files (x86)\steam\steamapps\triblx\counter-strike source\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\counter-strike source\hl2.exe | 
"UDP Query User{8BF34174-512E-48F2-B554-FDE527B2F848}C:\program files (x86)\metin2 p-server azuria\azuria-clientstarter.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server azuria\azuria-clientstarter.exe | 
"UDP Query User{8D8E6B6F-B109-4A4B-B6E5-25EF2BDEBC4A}C:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dungeon defenders\binaries\win32\dundefgame.exe | 
"UDP Query User{93CA6D6D-C6E6-4EA4-8A8F-A672AD29962A}C:\program files (x86)\metin2 p-server nexodia2\metin2client.bin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server nexodia2\metin2client.bin.exe | 
"UDP Query User{9556FDFC-E931-48D3-ACFF-BA5EAF5C3C90}C:\program files (x86)\metin2 p-server ayendox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"UDP Query User{96A995BF-B536-4DA2-9E13-1AEE2B0FE40F}C:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe | 
"UDP Query User{9CA0E076-E720-48ED-AD9F-622895AAB220}C:\program files (x86)\steam\steamapps\triblx\garrysmod\hl2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\triblx\garrysmod\hl2.exe | 
"UDP Query User{A0BA5503-2D63-44B2-805B-F0818A84D1E3}C:\program files (x86)\metin2 p-server zephion\metin2client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server zephion\metin2client.exe | 
"UDP Query User{A16A6EDB-78E7-4A5B-B237-FD49F100BA9F}C:\program files (x86)\metin2 p-server tsuyoshi2\metin2client.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server tsuyoshi2\metin2client.bin | 
"UDP Query User{A3681BDF-8892-4BF0-9F6F-AD1C562D2FEA}C:\program files (x86)\metin2 p-server takashi2\clientstarter.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server takashi2\clientstarter.exe | 
"UDP Query User{A42C4ADA-70B5-4F71-8E8D-8D53C952B040}C:\program files (x86)\metin2 p-server noxumi2 [admin]\2011 client for 1678files\metin2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\2011 client for 1678files\metin2.bin | 
"UDP Query User{A5243100-2FB9-481D-BD92-F01D9DCEA6E3}C:\program files (x86)\metin2 p-server mythology2\.mythology.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server mythology2\.mythology.exe | 
"UDP Query User{A6E111CF-C7FC-49BE-9D38-BE4041F20765}C:\program files (x86)\metin2 p-server shizuka3\clientstarter.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server shizuka3\clientstarter.exe | 
"UDP Query User{A8086B37-5C35-49B0-95A6-2AB62F158590}C:\program files (x86)\metin2 p-server zoera2\metin2client.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server zoera2\metin2client.bin | 
"UDP Query User{A8E11A7E-0485-4C7D-B49F-7B961E0EDD3D}C:\program files (x86)\metin2 p-server anessia2\metin2client.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server anessia2\metin2client.bin | 
"UDP Query User{AB5082CA-B0A2-4472-97C7-EB8927A1F9D1}C:\program files (x86)\metin2 p-server dark fusion2\metin2client.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server dark fusion2\metin2client.bin | 
"UDP Query User{AFBF4B2B-0E43-4AF8-971E-4E9662EBF0ED}C:\program files (x86)\metin2 p-server ayendox2 [admin]\modified-client_4.0\mc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\modified-client_4.0\mc.exe | 
"UDP Query User{AFE5FE23-6540-4D14-BDC9-2A748CBDA56C}C:\users\nox\downloads\tinyumbrella-5.11.00b.exe" = protocol=17 | dir=in | app=c:\users\nox\downloads\tinyumbrella-5.11.00b.exe | 
"UDP Query User{B18BFC6C-DD46-4650-827B-B2B0E8446B67}C:\program files (x86)\metin2 p-server calypso2\calypso-2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\calypso-2.exe | 
"UDP Query User{B48E01F4-0E0E-4F55-9477-CA12AB588AF6}C:\program files (x86)\metin2 p-server dark fusion\metin2client.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server dark fusion\metin2client.bin | 
"UDP Query User{BBA6DA4D-2D61-4B65-9822-3BF4E2903D19}C:\program files (x86)\metin2 p-server isomeria2\isomeria2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server isomeria2\isomeria2.exe | 
"UDP Query User{C23BE960-92D0-4B06-B155-3F161A22595E}C:\xampp\apache\bin\httpd.exe" = protocol=17 | dir=in | app=c:\xampp\apache\bin\httpd.exe | 
"UDP Query User{C3794AF5-B7D6-428B-9073-12C1D05DFD1B}C:\program files (x86)\metin2 p-server alzoria2\metin2client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server alzoria2\metin2client.exe | 
"UDP Query User{C5204F70-242C-43E0-AA93-758220E767B4}C:\program files (x86)\metin2 p-server beagmmt2\mc.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server beagmmt2\mc.exe | 
"UDP Query User{CA6FBC71-FD69-4FFC-9F88-7C27FDABDA28}C:\program files (x86)\metin2 p-server noxumi2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"UDP Query User{D1BD7897-6C0F-42DB-B4D4-A25FFE11291A}C:\program files (x86)\metin2 p-server celestia2\celestia2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server celestia2\celestia2.bin | 
"UDP Query User{D41934A7-1C4E-4AC3-8686-C7C7139C186C}C:\program files (x86)\metin2 p-server anessia2\anessia2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server anessia2\anessia2.exe | 
"UDP Query User{D9D112F7-2DBC-4ADE-8FD1-1BAEE6D0BF1B}C:\program files (x86)\metin2 p-server ayendox [admin]\portmap\portmap.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox [admin]\portmap\portmap.exe | 
"UDP Query User{D9D87C5E-5E94-4E97-B638-06C72248A55A}C:\program files (x86)\java\jre7\bin\java.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\java.exe | 
"UDP Query User{DA02ACC6-3379-4005-B940-A00486967E52}C:\users\nox\desktop\terraria server\terrariaserver.exe" = protocol=17 | dir=in | app=c:\users\nox\desktop\terraria server\terrariaserver.exe | 
"UDP Query User{DB070A3C-B804-4627-A9E6-29FCCA5478A5}C:\program files (x86)\alzoclient\metin2client.exe" = protocol=17 | dir=in | app=c:\program files (x86)\alzoclient\metin2client.exe | 
"UDP Query User{DC7EF586-F24D-4522-BCA5-16BDA1A3853F}C:\program files (x86)\metin2 p-server ayendox2 [admin]\portmap\portmap.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\portmap\portmap.exe | 
"UDP Query User{DD729DD8-F7C8-4837-943C-41F0F68F9AAC}C:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server calypso2\cl2-revolution.exe.exe | 
"UDP Query User{E18C3827-A2F9-4BAA-B7E3-B669508D0DC1}C:\program files (x86)\metin2 p-server noxumi2 [admin]\metin2 client hamachi\metin2.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server noxumi2 [admin]\metin2 client hamachi\metin2.bin | 
"UDP Query User{E553778B-74AA-4D5E-AC9C-C1536FDD9454}C:\program files (x86)\metin2\metin2client.bin" = protocol=17 | dir=in | app=c:\program files (x86)\metin2\metin2client.bin | 
"UDP Query User{E7339D2B-6D38-4ACA-BC12-0342D8069611}C:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server ayendox2 [admin]\ayendox2 client v1.0\metin2.exe | 
"UDP Query User{EE173C0A-F8ED-449E-983E-73D4E0185F19}C:\program files (x86)\steam\steamapps\common\test drive unlimited 2\testdrive2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\test drive unlimited 2\testdrive2.exe | 
"UDP Query User{F4A0618A-6954-4019-A450-2CE0E59A0415}C:\program files (x86)\metin2 p-server aura-mt2\aura-mt2.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server aura-mt2\aura-mt2.exe | 
"UDP Query User{F94A386A-67A3-4C2B-BD38-018955005EF7}C:\program files (x86)\metin2 p-server gronox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe" = protocol=17 | dir=in | app=c:\program files (x86)\metin2 p-server gronox2 [admin]\portmaps by x3globaltech\portmap by x3globaltech.exe | 
"UDP Query User{FD2FF724-3C21-4E3A-B3EC-43700804532A}C:\users\nox\downloads\anessia2patcher\metin2client.bin" = protocol=17 | dir=in | app=c:\users\nox\downloads\anessia2patcher\metin2client.bin | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{09782D89-1CA6-4B7D-82C5-2DE01AF5601B}" = Microsoft SQL Server 2008 Common Files
"{0ADF605D-2D94-4467-91F7-D75C71CF328D}" = Microsoft SQL Server 2008 Database Engine Shared
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{11BA2B00-1495-47B8-BFA8-D08C605AB2CC}" = Windows Live Family Safety
"{180C8888-50F1-426B-A9DC-AB83A1989C65}" = Windows Live Language Selector
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26A24AE4-039D-4CA4-87B4-2F86417003FF}" = Java(TM) 7 Update 3 (64-bit)
"{28D06854-572C-4A65-83E5-F8CAF26B9FDC}" = Microsoft SQL Server VSS Writer
"{2DF4C5DD-7417-301D-935D-939D3B7B5997}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{2F14965D-567B-4E59-ADEB-0A2CC1E3ADDF}" = Sql Server Customer Experience Improvement Program
"{336D0C35-8A85-403a-B9D2-65C292C39087}_is1" = Web Assistant 2.0.0.430
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{3C983A67-DFB2-3D3D-AD9E-CA1A5A09FD18}" = Microsoft Visual Studio 2010 Express Prerequisites x64 - DEU
"{440668AA-7524-40DB-966A-60BE535E1B3F}" = Microsoft SQL Server 2008 Database Engine Services
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{5340A3B5-3853-4745-BED2-DD9FF5371331}" = Microsoft SQL Server 2008 Common Files
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{624C7F0A-89B2-4C49-9CAB-9D69613EC95A}" = Microsoft IntelliPoint 8.2
"{643BEFE5-D5CE-4112-902C-C5C2C7917732}" = MAGIX Web Designer MX Premium Content Pack
"{6A76BEAF-6D1F-4273-A79B-DA8410A2E56B}" = Apple Mobile Device Support
"{6AF73222-EE90-434C-AE7E-B96F70A68D89}" = Unterstützungsdateien für Microsoft SQL Server 2008-Setup 
"{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}" = Bonjour
"{739FE2DC-0C7E-4A1C-AC6E-46348169E27E}" = MAGIX Web Designer MX Premium
"{7ACE202B-1B01-4B43-B6AE-03D66D621CDE}" = Microsoft SQL Server 2008 RsFx Driver
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8325FD0C-2FDB-46C3-921A-3A78385EA972}" = Microsoft SQL Server 2008 Native Client
"{840A3BAA-4C68-4581-9C7A-6F8D6CF531B9}" = iTunes
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.02
"{8A7CAA24-7B23-410B-A7C3-F994B0944160}" = Microsoft Virtual PC 2007
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{94D70749-4281-39AC-AD90-B56A0E0A402E}" = Microsoft Visual C++ 2010  x64 Runtime - 10.0.30319
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{C3EAE456-7E7A-451F-80EF-F34C7A13C558}" = Microsoft SQL Server Compact 3.5 SP2 x64 DEU
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{CC8BA866-16A7-4667-BA0C-C494A1E7B2BF}" = Microsoft SQL Server 2008 Database Engine Shared
"{CEA21F20-DBF4-464C-8B81-28B8508AFDDD}" = Windows Live Family Safety
"{D5876F0A-B2E9-4376-B9F5-CD47B7B8D820}" = Windows Live Remote Client Resources
"{D930AF5C-5193-4616-887D-B974CEFC4970}" = Windows Live Remote Service Resources
"{DA54F80E-261C-41A2-A855-549A144F2F59}" = Windows Live MIME IFilter
"{DF6D988A-EEA0-4277-AAB8-158E086E439B}" = Windows Live Remote Client
"{E02A6548-6FDE-40E2-8ED9-119D7D7E641F}" = Windows Live Remote Service
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FBD367D1-642F-47CF-B79B-9BE48FB34007}" = Microsoft SQL Server 2008 Database Engine Services
"{FCADA26A-5672-31DD-BF0E-BA76ECF9B02D}" = Microsoft Help Viewer 1.0
"{FD67869B-C97B-4F2C-AD80-ABF130238441}" = Oracle VM VirtualBox 4.1.16
"CyberGhost VPN_is1" = CyberGhost VPN
"FE5AE7DC-7B01-4263-A94C-B4526C276550_is1" = iDevice Manager
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft IntelliPoint 8.2" = Microsoft IntelliPoint 8.2
"Microsoft SQL Server 10" = Microsoft SQL Server 2008 (64-bit)
"Microsoft SQL Server 10 Release" = Microsoft SQL Server 2008 (64-bit)
"TS3 Overlay" = TS3 Overlay
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{02E43EC2-6B1C-45B5-9E48-941C3E1B204A}_is1" = System.Data.SQLite v1.0.81.0
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0A89364A-98BC-42AD-87DD-25BFE7C39EAC}" = MAGIX Screenshare
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F022A2E-7022-497D-90A5-0F46746D8275}" = Macromedia Extension Manager
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{0FF3D021-5ED4-11E1-8FD8-F04DA23A5C58}" = Vegas Pro 11.0
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{122ADF8C-DDA1-480C-9936-C88F2825B265}" = Apple Application Support
"{147894EE-5ED4-11E1-A8FF-F04DA23A5C58}" = MSVCRT Redists
"{15FEDA5F-141C-4127-8D7E-B962D1742728}" = Adobe Photoshop CS5
"{196467F1-C11F-4F76-858B-5812ADC83B94}" = MSXML 4.0 SP3 Parser
"{1BA1DBDC-5431-46FD-A66F-A17EB1C439EE}" = Windows Live Messenger
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83217004FF}" = Java(TM) 7 Update 4
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34EB6245-C8D0-4D8A-B8D8-EEBFF7A91485}" = Firebird SQL Server - MAGIX Edition
"{355CAC3F-0788-4117-B401-3CC4F8367E0A}" = Overwolf
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{44025BD7-AD10-4769-99AE-6378FD0303D6}" = Macromedia Dreamweaver 8
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AF2248C-B3DF-46FB-9596-87F5DB193689}" = Microsoft SQL Server 2008 Browser
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{6037B8AD-7D5B-4D50-9BCA-A586C44EEF34}" = Ace of Spades
"{612C34C7-5E90-47D8-9B5C-0F717DD82726}" = swMSM
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{6327A158-4E59-4E01-8E41-F325D3D4BAA0}" = MAGIX Speed burnR (MSI)
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{64BFBE7A-886C-4CA2-A9B4-0C2B5A5942BC}" = Battlefield 3™
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7224A5D0-FE0A-4D35-AA4A-0E498026D125}_is1" = MoonMt2Juni2012 Version 1.6.2
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{735AA36F-9A9E-477B-BC74-9E6AF1A8A6D8}" = MAGIX Music Maker MX Premium Download-Version
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7B2CC3DF-64FA-44AE-8F57-B0F915147E4F}_is1" = Need For Speed™ World
"{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}" = Text-To-Speech-Runtime
"{7FB413C8-3CAD-49F7-A67C-6EFEB4B04050}" = LogMeIn Hamachi
"{7FC84AD6-D939-41A0-A3DF-FB9B511FF275}_is1" = Sothink SWF Catcher for Internet Explorer
"{831D4B74-7A92-4363-869D-524876C480B1}_is1" = Sirius MT2 Version 20.12.02
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{8651DCE7-956F-4513-9FBC-F61423F97279}" = SQLiteManager
"{86D4B82A-ABED-442A-BE86-96357B70F4FE}" = Ask Toolbar
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A1033B0-EF33-4FB5-97A1-C47A7DCDD7E6}_is1" = ClipGrab 3.2.0.7
"{8AF7479C-B28D-4BFF-867B-4755DE019259}_is1" = MountMusket Battalion
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{907B4640-266B-4A21-92FB-CD1A86CD0F63}" = RollerCoaster Tycoon 3 Platinum
"{909F8EBC-EC7F-48FF-0085-475D818F0F31}" = Need for Speed Underground 2
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{943A8D28-80D6-41DC-AE94-81FEB42041BF}" = System Requirements Lab CYRI
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A76AA284-E52D-47E6-9E4F-B85DBF8E35C3}" = IMinent Toolbar
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{A9739666-2235-42F8-85D6-9B4005DC7951}" = Bing Bar
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die*Sims™*3
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{CCAC7E52-ECCE-3C4D-B1BE-BC2ACF1C1C0E}" = Microsoft Visual Basic 2010 Express - DEU
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D0B44725-3666-492D-BEF6-587A14BD9BD9}" = MSVCRT_amd64
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DE3A9DC5-9A5D-6485-9662-347162C7E4CA}" = Adobe Media Player
"{DE43AA92-E8C0-4620-AFE2-FBD623C71643}" = Sizer 3.33
"{DEA314C4-0929-4250-BC92-98E4C105F28D}" = NVIDIA PhysX
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E5B21F11-6933-4E0B-A25C-7963E3C07D11}" = Windows Live Messenger
"{EA8ADAA9-6671-4839-A51E-0C6792B78F3E}" = FIFA 12
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FE23D063-934D-4829-A0D8-00634CE79B4A}" = Adobe AIR
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"5513-1208-7298-9440" = JDownloader 0.9
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.6
"Advanced SystemCare 5_is1" = Advanced SystemCare 5
"Audacity_is1" = Audacity 2.0
"avast" = avast! Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"BabylonToolbar" = Babylon toolbar on IE
"Battlelog Web Plugins" = Battlelog Web Plugins
"BrickForce" = BrickForce 1.9.87
"Calypso-2" = Calypso-2
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cheat Engine 6.1_is1" = Cheat Engine 6.1
"ClipGrab Toolbar" = ClipGrab Toolbar
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo III" = Diablo III
"EA Installer.-2085323405" = EA Installer
"ESN Sonar-0.70.4" = ESN Sonar
"FE5AE7DC-7B01-4263-A94C-B4526C276550_is1" = iDevice Manager
"FormatFactory" = FormatFactory 2.90
"Foxit Reader_is1" = Foxit Reader
"Fraps" = Fraps (remove only)
"Free Video Dub_is1" = Free Video Dub version 2.0.5.221
"Free YouTube Download_is1" = Free YouTube Download version 3.0.20.1228
"FUSSBALL MANAGER 11" = FUSSBALL MANAGER 11
"Game Booster_is1" = Game Booster 3
"Game Maker 8.0" = Game Maker 8.0
"HyperCam 3" = HyperCam 3
"LogMeIn Hamachi" = LogMeIn Hamachi
"M2Fish" = M2Fish 4.4
"MAGIX_{739FE2DC-0C7E-4A1C-AC6E-46348169E27E}" = MAGIX Web Designer MX Premium
"MAGIX_MSI_mm18dlx" = MAGIX Music Maker MX Premium Download-Version
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.62.0.1300
"Metin2_is1" = Metin2
"Microsoft Visual Basic 2010 Express - DEU" = Microsoft Visual Basic 2010 Express - DEU
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NoIPDUC" = No-IP DUC
"Notepad++" = Notepad++
"Origin" = Origin
"PremiumSoft Navicat Premium 8.2_is1" = PremiumSoft Navicat Premium 8.2
"PunkBusterSvc" = PunkBuster Services
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"RollerCoaster Tycoon Setup" = Roll
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 105600" = Terraria
"Steam App 113200" = The Binding Of Isaac
"Steam App 12900" = Audiosurf
"Steam App 200210" = Realm of the Mad God
"Steam App 240" = Counter-Strike: Source
"Steam App 24780" = SimCity 4 Deluxe
"Steam App 4000" = Garry's Mod
"Steam App 40800" = Super Meat Boy
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 440" = Team Fortress 2
"Steam App 48700" = Mount & Blade: Warband
"Steam App 55140" = MX vs ATV Reflex
"Steam App 620" = Portal 2
"Steam App 65800" = Dungeon Defenders
"Steam App 9930" = Test Drive Unlimited 2
"Streamripper" = Streamripper (Remove only)
"TeamViewer 7" = TeamViewer 7
"TmUnitedForever_is1" = TmUnitedForever
"Tunatic" = Tunatic
"VLC media player" = VLC media player 2.0.0
"Winamp" = Winamp
"WinGimp-2.0_is1" = GIMP 2.6.11
"WinLiveSuite" = Windows Live Essentials
"winscp3_is1" = WinSCP 4.3.8
"Wisdom-soft Set up ASR 3.1 Free" = Wisdom-soft Set up ASR 3.1 Free
"xampp" = XAMPP 1.7.7
"ZetaProducer10" = Zeta Producer 10 10.7.1 (nur entfernen)
 
========== HKEY_USERS Uninstall List ==========
 
[HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{79A765E1-C399-405B-85AF-466F52E918B0}" = Ask Toolbar Updater
"FileZilla Client" = FileZilla Client 3.5.3
"Google Chrome" = Google Chrome
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"Winamp Detect" = Winamp Erkennungs-Plug-in
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 08.08.2012 16:53:53 | Computer Name = Nox-PC | Source = Bonjour Service | ID = 100
Description = Task Scheduling Error: m->NextScheduledSPRetry 10670
 
Error - 08.08.2012 20:47:39 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 08.08.2012 20:53:27 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 09.08.2012 07:29:14 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 09.08.2012 07:45:24 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 09.08.2012 07:55:15 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 09.08.2012 08:59:45 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 09.08.2012 09:19:44 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 09.08.2012 19:15:54 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
Error - 09.08.2012 20:59:09 | Computer Name = Nox-PC | Source = WinMgmt | ID = 10
Description = 
 
[ System Events ]
Error - 02.08.2012 18:35:43 | Computer Name = Nox-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?02.?08.?2012 um 22:12:26 unerwartet heruntergefahren.
 
Error - 02.08.2012 18:35:38 | Computer Name = Nox-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 02.08.2012 18:35:38 | Computer Name = Nox-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 02.08.2012 20:12:49 | Computer Name = Nox-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 02.08.2012 20:51:13 | Computer Name = Nox-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 03.08.2012 06:32:03 | Computer Name = Nox-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 03.08.2012 19:16:09 | Computer Name = Nox-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
Error - 03.08.2012 20:39:56 | Computer Name = Nox-PC | Source = Service Control Manager | ID = 7024
Description = Der Dienst "Apache2.2" wurde mit folgendem dienstspezifischem Fehler
 beendet: %%1.
 
Error - 04.08.2012 05:33:42 | Computer Name = Nox-PC | Source = atikmdag | ID = 52236
Description = CPLIB :: General - Invalid Parameter
 
Error - 04.08.2012 05:33:42 | Computer Name = Nox-PC | Source = atikmdag | ID = 43029
Description = Display is not active
 
 
< End of report >
         

--- --- ---

-- Edit --
In Post davor eingefügt.

Fixen mit OTL

Lade (falls noch nicht vorhanden) OTL von Oldtimer herunter und speichere es auf Deinem Desktop (nicht woanders hin).

• Deaktiviere etwaige Virenscanner wie Avira, Kaspersky etc.
• Starte die OTL.exe.
  Vista- und Windows 7-User starten mit Rechtsklick auf das Programm-Icon und wählen "Als Administrator ausführen".
• Kopiere folgendes Skript in das Textfeld unterhalb von Benuterdefinierte Scans/Fixes:

:OTL
SRV - (Web Assistant Updater) -- C:\Programme\Web Assistant\ExtensionUpdaterService.exe () 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} 
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKLM\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.) 
IE - HKLM\..\SearchScopes,DefaultScope = {006ee092-9658-4fd6-bd8e-a21a348e59f5} 
IE - HKLM\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = http://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = http://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://isearch.babylon.com/?babsrc=HP_ss&mntrId=6a99226100000000000000ffcd53b77f 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\URLSearchHook: {00000000-6E41-4FD3-8538-502F5495E5FC} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\URLSearchHook: {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.) 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes,DefaultScope = 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}: "URL" = http://cloud-search.linkury.com/results.htm?cx=partner-pub-7890126930977991:1926905636&cof=FORID:11&q={searchTerms}&sa=Search&siteurl=search.linkury.com 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = http://isearch.babylon.com/web/{searchTerms}?babsrc=browsersearch&babsrc=SP_ss&mntrId=6a99226100000000000000ffcd53b77f 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{179E0838-8569-4D26-946B-FD123A2D5AAA}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=FF&o=14594&src=kw&q={searchTerms}&locale=de_DE&apn_ptnrs=FV&apn_dtid=YYYYYYYYDE&apn_uid=f52fd9c7-ef79-494a-a4ce-c3a5c50a0353&apn_sauid=596AA695-5E0E-4633-A6B9-25709E40BCF5 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}: "URL" = http://mystart.incredibar.com/mb143/?search={searchTerms}&loc=IB_DS&a=6OyB1k1aMe&i=26 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 
IE - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local 
FF - prefs.js..browser.search.defaultengine: "Ask.com" 
FF - prefs.js..browser.search.defaultenginename: "Ask.com" 
FF - prefs.js..browser.search.defaultthis.engineName: "ClipGrab Customized Web Search" 
FF - prefs.js..browser.search.defaulturl: "http://search.conduit.com/ResultsExt.aspx?ctid=CT2536373&SearchSource=3&q={searchTerms}" 
FF - prefs.js..browser.search.order.1: "Ask.com" 
FF - prefs.js..browser.search.selectedEngine: "Ask.com" 
FF - prefs.js..browser.startup.homepage: "http://www.google.de/" 
FF - prefs.js..keyword.URL: "http://websearch.ask.com/redirect?client=ff&src=kw&tb=FF&o=14594&locale=de_DE&apn_uid=f52fd9c7-ef79-494a-a4ce-c3a5c50a0353&apn_ptnrs=FV&apn_sauid=596AA695-5E0E-4633-A6B9-25709E40BCF5&apn_dtid=YYYYYYYYDE&&q=" 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_270.dll File not found 
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found 
64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\PROGRAM FILES\WEB ASSISTANT\FIREFOX [2012.05.06 10:52:15 | 000,000,000 | ---D | M] 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox [2012.05.06 10:52:15 | 000,000,000 | ---D | M] 
CHR - Extension: Web Assistant = C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.430_0\ 
O2:64bit: - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension64.dll () 
O2 - BHO: (Babylon toolbar helper) - {2EECD738-5844-4a99-B4B6-146BF802613B} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll (Babylon BHO) 
O2 - BHO: (Web Assistant) - {336D0C35-8A85-403a-B9D2-65C292C39087} - C:\Programme\Web Assistant\Extension32.dll () 
O2 - BHO: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O2 - BHO: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.) 
O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. 
O3 - HKLM\..\Toolbar: (Babylon Toolbar) - {98889811-442D-49dd-99D7-DC866BE87DBC} - C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll (Babylon Ltd.) 
O3 - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found. 
O3 - HKLM\..\Toolbar: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O3 - HKLM\..\Toolbar: (ClipGrab Toolbar) - {e36df325-3f4b-476f-8f89-123bc5d51a30} - C:\Program Files (x86)\ClipGrab\prxtbClip.dll (Conduit Ltd.) 
O3 - HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\..\Toolbar\WebBrowser: (Ask Toolbar) - {D4027C7F-154A-4066-A1AD-4243D8127440} - C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll (Ask) 
O4 - HKLM..\Run: [] File not found 
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 
O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 10.3.0) 
O16:64bit: - DPF: {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) 
O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} http://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab (Java Plug-in 1.7.0_03) 
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found 
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. 
O32 - HKLM CDRom: AutoRun - 1 
O32 - AutoRun File - [2010.09.21 11:33:00 | 000,000,055 | R--- | M] () - D:\autorun.inf -- [ UDF ] 
O32 - AutoRun File - [2004.10.23 09:19:56 | 000,000,105 | R--- | M] () - E:\autorun.inf -- [ CDFS ] 
O33 - MountPoints2\{24ff4d0b-540e-11e1-bd24-806e6f6e6963}\Shell - "" = AutoRun 
O33 - MountPoints2\{24ff4d0b-540e-11e1-bd24-806e6f6e6963}\Shell\AutoRun\command - "" = D:\CdAutoRun.exe -- [2010.09.21 11:33:00 | 000,049,152 | R--- | M] () 
O33 - MountPoints2\{2c5833cb-b803-11e1-bcad-e5683a4d8c81}\Shell - "" = AutoRun 
O33 - MountPoints2\{2c5833cb-b803-11e1-bcad-e5683a4d8c81}\Shell\AutoRun\command - "" = E:\setup.exe -- [2004.10.15 06:59:34 | 000,110,592 | R--- | M] (Electronic Arts Inc.) 
O33 - MountPoints2\{5c73c207-832b-11e1-9490-001c4af76f7a}\Shell - "" = AutoRun 
O33 - MountPoints2\{5c73c207-832b-11e1-9490-001c4af76f7a}\Shell\AutoRun\command - "" = E:\pushinst.exe 
O33 - MountPoints2\{f46de256-5412-11e1-8281-0022fbcf794e}\Shell - "" = AutoRun 
O33 - MountPoints2\{f46de256-5412-11e1-8281-0022fbcf794e}\Shell\AutoRun\command - "" = E:\pushinst.exe 
 
[2 C:\Windows\SysWow64\*.tmp files -> C:\Windows\SysWow64\*.tmp -> ] 


:Files


ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[emptyflash]
         

• Schließe alle Programme.
• Klicke auf den Fix Button.
• Wenn OTL einen Neustart verlangt, bitte zulassen.
• Kopiere den Inhalt des Logfiles hier in Code-Tags in Deinen Thread.
  Nachträglich kannst Du das Logfile hier einsehen => C:\_OTL\MovedFiles\<datum_nummer.log>

Hinweis für Mitleser: Obiges OTL-Script ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

So, nach Restart kam folgende .txt, hoffe das ist der Log.

All processes killed
========== OTL ==========
Service Web Assistant Updater stopped successfully!
Service Web Assistant Updater deleted successfully!
C:\Programme\Web Assistant\ExtensionUpdaterService.exe moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\URLSearchHooks\\{e36df325-3f4b-476f-8f89-123bc5d51a30} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ deleted successfully.
C:\Program Files (x86)\ClipGrab\prxtbClip.dll moved successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Bar| /E : value set successfully!
HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Search Page| /E : value set successfully!
HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Search\\Default_Search_URL| /E : value set successfully!
HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\SOFTWARE\Microsoft\Internet Explorer\Search\\SearchAssistant| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{00000000-6E41-4FD3-8538-502F5495E5FC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{00000000-6E41-4FD3-8538-502F5495E5FC}\ deleted successfully.
C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll moved successfully.
Registry value HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{e36df325-3f4b-476f-8f89-123bc5d51a30} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ not found.
File C:\Program Files (x86)\ClipGrab\prxtbClip.dll not found.
HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\SearchScopes\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{006ee092-9658-4fd6-bd8e-a21a348e59f5}\ not found.
Registry key HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ not found.
Registry key HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\SearchScopes\{179E0838-8569-4D26-946B-FD123A2D5AAA}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{179E0838-8569-4D26-946B-FD123A2D5AAA}\ not found.
Registry key HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CFF4DB9B-135F-47c0-9269-B4C6572FD61A}\ not found.
HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyEnable|dword:0 /E : value set successfully!
HKU\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings\\ProxyOverride| /E : value set successfully!
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "ClipGrab Customized Web Search" removed from browser.search.defaultthis.engineName
Prefs.js: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2536373&SearchSource=3&q={searchTerms}" removed from browser.search.defaulturl
Prefs.js: "Ask.com" removed from browser.search.order.1
Prefs.js: "Ask.com" removed from browser.search.selectedEngine
Prefs.js: "hxxp://www.google.de/" removed from browser.startup.homepage
Prefs.js: "hxxp://websearch.ask.com/redirect?client=ff&src=kw&tb=FF&o=14594&locale=de_DE&apn_uid=f52fd9c7-ef79-494a-a4ce-c3a5c50a0353&apn_ptnrs=FV&apn_sauid=596AA695-5E0E-4633-A6B9-25709E40BCF5&apn_dtid=YYYYYYYYDE&&q=" removed from keyword.URL
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@Apple.com/iTunes,version=\ deleted successfully.
File HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{336D0C35-8A85-403a-B9D2-65C292C39087}: C:\Program Files\Web Assistant\Firefox not found.
C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.430_0\resources folder moved successfully.
C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.430_0\libraries folder moved successfully.
C:\Users\Nox\AppData\Local\Google\Chrome\User Data\Default\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd\2.0.0.430_0 folder moved successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}\ deleted successfully.
C:\Programme\Web Assistant\Extension64.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2EECD738-5844-4a99-B4B6-146BF802613B}\ deleted successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\bh\BabylonToolbar.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{336D0C35-8A85-403a-B9D2-65C292C39087}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{336D0C35-8A85-403a-B9D2-65C292C39087}\ deleted successfully.
C:\Programme\Web Assistant\Extension32.dll moved successfully.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ deleted successfully.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ not found.
File C:\Program Files (x86)\ClipGrab\prxtbClip.dll not found.
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{98889811-442D-49dd-99D7-DC866BE87DBC} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{98889811-442D-49dd-99D7-DC866BE87DBC}\ deleted successfully.
C:\Program Files (x86)\BabylonToolbar\BabylonToolbar\1.5.3.17\BabylonToolbarTlbr.dll moved successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{ae07101b-46d4-4a98-af68-0333ea26e113} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ae07101b-46d4-4a98-af68-0333ea26e113}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{e36df325-3f4b-476f-8f89-123bc5d51a30} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{e36df325-3f4b-476f-8f89-123bc5d51a30}\ not found.
File C:\Program Files (x86)\ClipGrab\prxtbClip.dll not found.
Registry value HKEY_USERS\S-1-5-21-1322660023-3648253312-1832618820-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Starting removal of ActiveX control {8AD9C840-044E-11D1-B3E9-00805F499D93}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{8AD9C840-044E-11D1-B3E9-00805F499D93}\ not found.
Starting removal of ActiveX control {CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA}\ not found.
Starting removal of ActiveX control {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Code Store Database\Distribution Units\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
Registry key HKEY_USERS\.DEFAULT\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Active Setup\Installed Components\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\VMApplet:/pagefile deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File move failed. E:\autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{24ff4d0b-540e-11e1-bd24-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ff4d0b-540e-11e1-bd24-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{24ff4d0b-540e-11e1-bd24-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{24ff4d0b-540e-11e1-bd24-806e6f6e6963}\ not found.
File move failed. D:\CdAutoRun.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c5833cb-b803-11e1-bcad-e5683a4d8c81}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c5833cb-b803-11e1-bcad-e5683a4d8c81}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2c5833cb-b803-11e1-bcad-e5683a4d8c81}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2c5833cb-b803-11e1-bcad-e5683a4d8c81}\ not found.
File move failed. E:\setup.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c73c207-832b-11e1-9490-001c4af76f7a}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c73c207-832b-11e1-9490-001c4af76f7a}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5c73c207-832b-11e1-9490-001c4af76f7a}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5c73c207-832b-11e1-9490-001c4af76f7a}\ not found.
File E:\pushinst.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f46de256-5412-11e1-8281-0022fbcf794e}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f46de256-5412-11e1-8281-0022fbcf794e}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{f46de256-5412-11e1-8281-0022fbcf794e}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{f46de256-5412-11e1-8281-0022fbcf794e}\ not found.
File E:\pushinst.exe not found.
C:\Windows\SysWow64\themeui.dll.tmp deleted successfully.
C:\Windows\SysWow64\uxtheme.dll.tmp deleted successfully.
========== FILES ==========
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Nox\Desktop\cmd.bat deleted successfully.
C:\Users\Nox\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56475 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Nox
->Temp folder emptied: 1552054606 bytes
->Temporary Internet Files folder emptied: 202755436 bytes
->Java cache emptied: 520922 bytes
->FireFox cache emptied: 1024525197 bytes
->Google Chrome cache emptied: 339259707 bytes
->Flash cache emptied: 91774 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 62726248 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67899 bytes
RecycleBin emptied: 36850978 bytes
 
Total Files Cleaned = 3.070,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Nox
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
 
OTL by OldTimer - Version 3.2.56.0 log created on 08102012_192849

Files\Folders moved on Reboot...
File move failed. D:\autorun.inf scheduled to be moved on reboot.
File\Folder E:\autorun.inf not found!
File move failed. D:\CdAutoRun.exe scheduled to be moved on reboot.
File\Folder E:\setup.exe not found!
C:\Users\Nox\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
File move failed. C:\Windows\temp\_avast_\Webshlock.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...
[2010.09.21 11:33:00 | 000,000,055 | R--- | M] () D:\autorun.inf : MD5=B8E6374C046BB2B53DD426BB26C2FBC5
File E:\autorun.inf not found!
[2010.09.21 11:33:00 | 000,049,152 | R--- | M] () D:\CdAutoRun.exe : MD5=0F58394F39DDC430D42FE77327431A9E
File E:\setup.exe not found!
File C:\Users\Nox\AppData\Local\Temp\FXSAPIDebugLogFile.txt not found!
[2012.08.10 19:36:37 | 000,000,000 | ---- | M] () C:\Windows\temp\_avast_\Webshlock.txt : Unable to obtain MD5

Registry entries deleted on Reboot...
         

Sehr gut!

Wie laeuft der Rechner?

1. Schritt

Bitte einen Vollscan mit Malwarebytes Anti-Malware machen und Log posten.
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Malwarebytes Anti-Malware
- Anwendbar auf Windows 2000, XP, Vista und 7.
- Installiere das Programm in den vorgegebenen Pfad.
- Aktualisiere die Datenbank!
- Aktiviere "Komplett Scan durchführen" => Scan.
- Wähle alle verfügbaren Laufwerke (ausser CD/DVD) aus und starte den Scan.
- Funde bitte löschen lassen oder in Quarantäne.
- Wenn der Scan beendet ist, klicke auf "Zeige Resultate".

danach:

2. Schritt

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Starte die adwcleaner.exe mit einem Doppelklick.
• Klicke auf Search.
• Nach Ende des Suchlaufs öffnet sich eine Textdatei.
• Poste mir den Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

Fehlende Rückmeldung

Gibt es Probleme beim Abarbeiten obiger Anleitung?

Um Kapazitäten für andere Hilfesuchende freizumachen, lösche ich dieses Thema aus meinen Benachrichtigungen.

Solltest Du weitermachen wollen, schreibe mir eine PN oder eröffne ein neues Thema.
http://www.trojaner-board.de/69886-a...-beachten.html


Hinweis: Das Verschwinden der Symptome bedeutet nicht, dass Dein Rechner sauber ist.