| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: bidr.trellian.com redirect im Firefox BrowserWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
02.10.2016, 02:44
| #1 |
 |  bidr.trellian.com redirect im Firefox Browser Hallo Trojaner-Board Community, Mein Mozilla Firefox Browser scheint nicht mehr ganz "sauber" zu sein. Meistens wenn ich den Browser starte bekomme ich eine Meldung von AVAST eine Bedrohung sei blockiert worden, da mein Browser versucht (es aber offensichtlich nicht macht durch AVAST) mich auf die Adresse bidr.trellian.com/.... weiterzuleiten. Dies scheint eine Seite mit Werbung zu sein, wie eine Internetrecherche ergab. Also habe ich versucht diese Malware mit unterschiedlichen Antimalwareprogrammen zu finden und zu löschen, aber leider war die Suche mit Malwarebytes Anti-Malware , adwcleaner und HitmanPro erfolglos und die Meldung taucht immernoch auf  Ich würde ungern meinen Browser neu aufsetzen, da dort ziemlich viele Daten eingespeichert sind und alles reibungslos läuft, der Mensch ist faul. Allerdings würde ich auch Firefox neu installieren wenn sich keine Lösung finden lässt  Im Anhang ist ein Screenshot der Fehlermeldung und ein Scan mit dem Farbar Recovery Scan Tool  |
|
02.10.2016, 04:32
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  bidr.trellian.com redirect im Firefox Browser Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
03.10.2016, 08:31
| #3 |
| | bidr.trellian.com redirect im Firefox Browser Okay, klar kein Problem hab es dann nochmal so gepostest :
__________________Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x86) Version: 30-09-2016
durchgeführt von King Haze (Administrator) auf KINGHAZE-PC (02-10-2016 03:11:00)
Gestartet von C:\Users\King Haze\Downloads
Geladene Profile: King Haze (Verfügbare Profile: King Haze)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Sprache: Deutsch (Deutschland)
Internet Explorer Version 10 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\AvastSvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Hi-Rez Studios) D:\Program Files\Hi-Rez Studios\HiPatchService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(MSI) C:\Program Files\MSI\Super-Charger\Super-Charger.exe
(AVAST Software) C:\Program Files\AVAST Software\Avast\avastui.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Palit Microsystems Ltd.) C:\Program Files\Thunder Master\THPanel.exe
(none) C:\Users\King Haze\Downloads\wopt021\WLAN Optimizer.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(MSI) C:\Program Files\MSI\Super-Charger\ChargeService.exe
(MICRO-STAR INTERNATIONAL CO., LTD.) C:\Program Files\MSI\MSITrigger\MSI_Trigger_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Razer Inc.) C:\Program Files\Razer\Razer Cortex\RzKLService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Valve Corporation) D:\Program Files\Steam\Steam.exe
(Valve Corporation) D:\Program Files\Steam\bin\steamwebhelper.exe
(Valve Corporation) D:\Program Files\Steam\bin\steamwebhelper.exe
(Valve Corporation) D:\Program Files\Steam\bin\steamwebhelper.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe [6323928 2013-06-27] (Realtek Semiconductor)
HKLM\...\Run: [IMSS] => C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-05-17] (Intel Corporation)
HKLM\...\Run: [USB3MON] => C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM\...\Run: [Super-Charger] => C:\Program Files\MSI\Super-Charger\Super-Charger.exe [506864 2013-03-08] (MSI)
HKLM\...\Run: [AvastUI.exe] => C:\Program Files\AVAST Software\Avast\AvastUI.exe [9107616 2016-09-12] (AVAST Software)
HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2787264 2016-01-12] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap.dll [1542600 2016-01-12] (NVIDIA Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation)
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\Run: [THPanel] => C:\Program Files\Thunder Master\THPanel.exe [2169640 2013-10-17] (Palit Microsystems Ltd.)
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\Run: [WLAN Optimizer] => C:\Users\King Haze\Downloads\wopt021\WLAN Optimizer.exe [109056 2009-08-07] (none)
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\MountPoints2: {82ba2e12-0520-11e5-bef8-448a5b212ed6} - G:\setup.exe
AppInit_DLLs: C:\GeDoSaTo\gedoshim.dll => C:\GeDoSaTo\gedoshim.dll [5120 2016-02-12] ()
AppInit_DLLs: , C:\GeDoSaTo\gedoshim.dll => C:\GeDoSaTo\gedoshim.dll [5120 2016-02-12] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => C:\Program Files\AVAST Software\Avast\ashShell.dll [2016-09-09] (AVAST Software)
BootExecute: autocheck autochk * bootdelete
GroupPolicyScripts: Beschränkung <======= ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\..\Interfaces\{4B355606-754D-494A-92FD-255FAB54E638}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{6324BC67-0616-40BB-9212-CCB7706AEAE1}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{F67C3489-5DD7-4B2F-80F2-A5796B552951}: [DhcpNameServer] 7.254.254.254
Internet Explorer:
==================
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll [2016-09-05] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-07-23] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL [2016-09-05] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-09-05] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-23] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2290024371-3984154701-145341786-1000 -> Kein Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Keine Datei
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-09-05] (Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-09-05] (Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-09-05] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-09-05] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Keine Datei
FireFox:
========
FF ProfilePath: C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-13] ()
FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files\Battlelog Web Plugins\2.5.1\npbattlelog.dll [2014-09-01] (EA Digital Illusions CE AB)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-05-17] (Intel Corporation)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-05-17] (Intel Corporation)
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-23] (Oracle Corporation)
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-09-05] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-09-05] (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
FF Plugin: @t.garena.com/garenatalk -> C:\Program Files\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll [Keine Datei]
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2290024371-3984154701-145341786-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\King Haze\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-05-08] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-2290024371-3984154701-145341786-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-08-02] ()
FF Extension: (Thumbnail Zoom Plus) - C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\extensions\thumbnailZoom@dadler.github.com.xpi [2016-06-17]
FF Extension: (youtubereplay) - C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\Extensions\jid0-VuYraOOT2NM2AcnQwG4APKol3Vs@jetpack.xpi [2016-04-27]
FF Extension: (Adblock Plus) - C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-28]
Chrome:
=======
CHR dev: Chrome dev build erkannt! <======= ACHTUNG
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
R2 avast! Antivirus; C:\Program Files\AVAST Software\Avast\AvastSvc.exe [197128 2016-09-09] (AVAST Software)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-05-24] (BitRaider, LLC)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [1967344 2016-09-04] (Microsoft Corporation)
S4 DAUpdaterSvc; C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [25832 2009-12-15] (BioWare)
S3 EasyAntiCheat; C:\Windows\system32\EasyAntiCheat.exe [245544 2015-07-19] (EasyAntiCheat Ltd)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [929728 2016-01-12] (NVIDIA Corporation)
U2 HiPatchService; D:\Program Files\Hi-Rez Studios\HiPatchService.exe [9728 2016-08-23] (Hi-Rez Studios) [Datei ist nicht signiert]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [583680 2013-02-13] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [637912 2013-02-13] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-05-17] (Intel Corporation)
R2 MSI_SuperCharger; C:\Program Files\MSI\Super-Charger\ChargeService.exe [161264 2013-02-20] (MSI)
R2 MSI_Trigger_Service; C:\Program Files\MSI\MSITrigger\MSI_Trigger_Service.exe [29728 2013-05-28] (MICRO-STAR INTERNATIONAL CO., LTD.)
R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-01-12] (NVIDIA Corporation)
S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [5178816 2016-01-12] (NVIDIA Corporation)
S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [3996608 2016-01-12] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [2130440 2016-09-16] (Electronic Arts)
S2 Origin Web Helper Service; C:\Program Files\Origin\OriginWebHelperService.exe [2195472 2016-09-16] (Electronic Arts)
S4 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2016-08-23] ()
S4 Razer Game Scanner Service; C:\Program Files\Razer\Razer Services\GSS\GameScannerService.exe [187048 2015-06-23] ()
R2 RzKLService; C:\Program Files\Razer\Razer Cortex\RzKLService.exe [129168 2015-07-14] (Razer Inc.)
S4 TunngleService; C:\Program Files\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH) [Datei ist nicht signiert]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
U4 AvastVBoxSvc; "C:\Program Files\AVAST Software\Avast\ng\vbox\AvastVBoxSVC.exe" [X]
S4 Hamachi2Svc; "C:\Program Files\LogMeIn Hamachi\hamachi-2.exe" -s [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 aswHwid; C:\Windows\system32\drivers\aswHwid.sys [34008 2016-09-09] (AVAST Software)
R1 aswKbd; C:\Windows\system32\drivers\aswKbd.sys [35096 2016-09-09] (AVAST Software)
R2 aswMonFlt; C:\Windows\system32\drivers\aswMonFlt.sys [92256 2016-09-09] (AVAST Software)
R1 aswRdr; C:\Windows\system32\drivers\aswRdr2.sys [91232 2016-09-09] (AVAST Software)
R0 aswRvrt; C:\Windows\system32\Drivers\aswRvrt.sys [60424 2016-09-09] (AVAST Software)
R1 aswSnx; C:\Windows\system32\drivers\aswSnx.sys [735488 2016-09-13] (AVAST Software)
R1 aswSP; C:\Windows\system32\drivers\aswSP.sys [433768 2016-09-22] (AVAST Software)
R2 aswStm; C:\Windows\system32\drivers\aswStm.sys [118664 2016-09-09] (AVAST Software)
R0 aswVmm; C:\Windows\system32\Drivers\aswVmm.sys [224616 2016-09-09] (AVAST Software)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 ipadtst; C:\Program Files\MSI\Super-Charger\ipadtst.sys [14576 2013-02-04] (Windows (R) 2000 DDK provider)
S3 ISCT; C:\Windows\System32\DRIVERS\ISCTD.sys [40936 2013-02-13] ()
R0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2013-04-26] (Intel Corporation)
R3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [361968 2013-04-26] (Intel Corporation)
R3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [793072 2013-04-26] (Intel Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [56432 2013-01-11] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files\MSI\Super-Charger\NTIOLib.sys [14392 2012-10-26] (MSI)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [42128 2015-12-18] (NVIDIA Corporation)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [20288 2015-06-12] (Razer, Inc.)
S3 SCREAMINGBDRIVER; C:\Windows\System32\drivers\ScreamingBAudio.sys [34896 2012-07-31] (Screaming Bee LLC)
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [181432 2012-02-24] (DEVGURU Co., LTD.(www.devguru.co.kr))
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [27136 2009-09-16] (Tunngle.net)
S3 AmdLLD; system32\DRIVERS\AmdLLD.sys [X]
S3 BRDriver_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 eapihdrv; \??\C:\Users\KINGHA~1\AppData\Local\Temp\ehdrv.sys [X]
R4 hitmanpro37; \??\C:\Windows\system32\drivers\hitmanpro37.sys [X]
S3 NTIOLib_1_0_C; \??\E:\NTIOLib.sys [X]
U4 VBoxAswDrv; \??\C:\Program Files\AVAST Software\Avast\ng\vbox\VBoxAswDrv.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-10-02 03:11 - 2016-10-02 03:11 - 00017631 _____ C:\Users\King Haze\Downloads\FRST.txt
2016-10-02 03:10 - 2016-10-02 03:10 - 01754624 _____ (Farbar) C:\Users\King Haze\Downloads\FRST.exe
2016-10-02 03:09 - 2016-10-02 03:09 - 02404352 _____ (Farbar) C:\Users\King Haze\Downloads\FRST64.exe
2016-10-02 02:58 - 2016-10-01 17:30 - 00065344 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHdsKe.sys
2016-10-01 20:19 - 2016-10-01 20:19 - 00000376 _____ C:\Windows\system32\bootdelete.lst
2016-10-01 19:54 - 2016-10-01 20:19 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2016-10-01 19:35 - 2016-10-01 19:35 - 00001905 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2016-10-01 19:35 - 2016-10-01 19:35 - 00000000 ____D C:\Program Files\HitmanPro
2016-10-01 19:34 - 2016-10-01 19:55 - 00000000 ____D C:\ProgramData\HitmanPro
2016-10-01 19:34 - 2016-10-01 19:34 - 11003784 _____ (SurfRight B.V.) C:\Users\King Haze\Downloads\hitmanpro.exe
2016-10-01 19:30 - 2016-10-01 19:30 - 00002160 _____ C:\Users\King Haze\Desktop\adwcleaner_6.020.exe - Verknüpfung.lnk
2016-10-01 19:13 - 2016-10-01 19:14 - 03861056 _____ C:\Users\King Haze\Downloads\adwcleaner_6.020.exe
2016-09-23 09:05 - 2016-09-23 09:05 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2016-09-16 14:17 - 2016-09-16 14:17 - 00000000 ____D C:\Users\King Haze\.Origin
2016-09-13 18:07 - 2016-09-13 18:07 - 05384616 _____ (Canneverbe Limited ) C:\Users\King Haze\Downloads\cdbxp_setup_4.5.7.6321_minimal.exe
2016-09-13 18:07 - 2016-09-13 18:07 - 00001895 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2016-09-13 18:07 - 2016-09-13 18:07 - 00001845 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2016-09-13 18:07 - 2016-09-13 18:07 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2016-09-13 18:07 - 2016-09-13 18:07 - 00000000 ____D C:\Program Files\CDBurnerXP
2016-09-13 16:09 - 2016-09-13 16:59 - 4285749248 _____ C:\Users\King Haze\Downloads\Win10_1607_German_x64.iso
2016-09-13 15:42 - 2016-09-13 15:45 - 00000000 ____D C:\Users\King Haze\Downloads\dx_deutsch
2016-09-13 15:42 - 2016-09-13 15:42 - 01439828 _____ C:\Users\King Haze\Downloads\dx_deutsch.zip
2016-09-13 15:26 - 2016-09-13 15:39 - 00000000 ____D C:\Users\King Haze\Downloads\Deus Ex Sprachebackup
2016-09-11 13:26 - 2016-09-11 13:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deus Ex - HDTP Release 3
2016-09-11 11:10 - 2016-09-11 13:35 - 00000000 ____D C:\Users\King Haze\Documents\Deus Ex
2016-09-10 17:23 - 2016-09-10 17:30 - 00000000 ____D C:\Users\King Haze\Desktop\Deus.Ex.Human.Revolution.Directors.Cut
2016-09-09 09:16 - 2016-09-09 09:16 - 00319760 _____ (AVAST Software) C:\Windows\system32\aswBoot.exe
2016-09-09 09:16 - 2016-09-09 09:16 - 00053208 _____ (AVAST Software) C:\Windows\avastSS.scr
2016-09-07 14:00 - 2016-09-08 15:20 - 00000000 _____ C:\Windows\system32\last.dump
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-10-02 03:11 - 2015-07-09 15:46 - 00000000 ____D C:\FRST
2016-10-02 02:20 - 2013-12-28 21:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-10-01 20:47 - 2013-12-29 13:01 - 00000000 ____D C:\Users\King Haze\AppData\Local\CrashDumps
2016-10-01 20:10 - 2009-07-14 06:34 - 00033632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-10-01 20:10 - 2009-07-14 06:34 - 00033632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-10-01 20:09 - 2013-12-29 05:37 - 00710502 _____ C:\Windows\system32\perfh007.dat
2016-10-01 20:09 - 2013-12-29 05:37 - 00154832 _____ C:\Windows\system32\perfc007.dat
2016-10-01 20:09 - 2010-11-20 23:01 - 01651686 _____ C:\Windows\system32\PerfStringBackup.INI
2016-10-01 20:09 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf
2016-10-01 20:01 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-10-01 19:24 - 2014-04-06 03:27 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2016-10-01 19:17 - 2015-07-09 17:10 - 00000000 ____D C:\AdwCleaner
2016-09-23 09:06 - 2016-04-28 05:34 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-09-23 09:05 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-09-23 09:04 - 2016-04-28 05:30 - 00000000 ____D C:\Program Files\Microsoft Office
2016-09-22 18:44 - 2013-12-28 23:04 - 00000000 ____D C:\Users\King Haze\AppData\Roaming\TS3Client
2016-09-22 18:30 - 2016-08-04 12:00 - 00000000 ___RD C:\Users\King Haze\Desktop\Games
2016-09-22 18:05 - 2014-09-26 21:25 - 00433768 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsp.sys
2016-09-16 14:33 - 2014-10-04 21:29 - 00000000 ____D C:\ProgramData\Origin
2016-09-16 14:32 - 2014-10-04 21:31 - 00000000 ____D C:\Users\King Haze\AppData\Roaming\Origin
2016-09-16 14:17 - 2014-10-04 21:29 - 00000000 ____D C:\Program Files\Origin
2016-09-16 14:17 - 2013-12-28 20:52 - 00000000 ____D C:\Users\King Haze
2016-09-13 14:20 - 2013-12-28 21:00 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-09-13 14:20 - 2013-12-28 21:00 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-09-13 14:20 - 2013-12-28 21:00 - 00000000 ____D C:\Windows\system32\Macromed
2016-09-13 13:45 - 2014-09-26 21:25 - 00735488 _____ (AVAST Software) C:\Windows\system32\Drivers\aswsnx.sys
2016-09-11 10:53 - 2016-08-30 17:45 - 00000000 ____D C:\Users\King Haze\AppData\Local\dxhr
2016-09-11 10:50 - 2014-04-11 18:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2016-09-11 10:50 - 2014-04-11 18:36 - 00000000 ____D C:\GOG Games
2016-09-11 10:50 - 2009-07-14 06:52 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-09-11 10:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\LiveKernelReports
2016-09-11 01:41 - 2014-01-08 15:05 - 00000000 ____D C:\Users\King Haze\AppData\Roaming\uTorrent
2016-09-10 18:38 - 2016-08-04 12:03 - 00000000 ___RD C:\Users\King Haze\Desktop\Text & Temporär
2016-09-10 17:54 - 2014-11-27 18:28 - 00000000 ____D C:\Program Files\Deus.Ex.Human.Revolution.Directors.Cut
2016-09-09 09:16 - 2016-03-23 10:29 - 00035096 _____ (AVAST Software) C:\Windows\system32\Drivers\aswKbd.sys
2016-09-09 09:16 - 2014-09-26 21:25 - 00224616 _____ (AVAST Software) C:\Windows\system32\Drivers\aswVmm.sys
2016-09-09 09:16 - 2014-09-26 21:25 - 00118664 _____ (AVAST Software) C:\Windows\system32\Drivers\aswStm.sys
2016-09-09 09:16 - 2014-09-26 21:25 - 00092256 _____ (AVAST Software) C:\Windows\system32\Drivers\aswMonFlt.sys
2016-09-09 09:16 - 2014-09-26 21:25 - 00091232 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRdr2.sys
2016-09-09 09:16 - 2014-09-26 21:25 - 00060424 _____ (AVAST Software) C:\Windows\system32\Drivers\aswRvrt.sys
2016-09-09 09:16 - 2014-09-26 21:25 - 00034008 _____ (AVAST Software) C:\Windows\system32\Drivers\aswHwid.sys
2016-09-07 21:59 - 2014-08-16 17:06 - 00000000 ____D C:\Users\King Haze\AppData\Local\Adobe
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2016-07-17 13:35 - 2016-08-01 21:31 - 0000134 _____ () C:\Users\King Haze\AppData\Roaming\CSharpAnalytics-MeasurementQueue
2016-07-17 11:13 - 2016-08-01 21:31 - 0000443 _____ () C:\Users\King Haze\AppData\Roaming\CSharpAnalytics-MeasurementSession
2013-12-31 00:36 - 2014-10-05 01:05 - 0138056 _____ () C:\Users\King Haze\AppData\Roaming\PnkBstrK.sys
2006-12-11 20:13 - 2006-12-11 20:13 - 0097336 _____ (Un4seen Developments) C:\Users\King Haze\AppData\Local\bass.dll
2006-12-11 20:13 - 2006-12-11 20:13 - 0013872 _____ (Un4seen Developments) C:\Users\King Haze\AppData\Local\basscd.dll
2007-08-13 18:46 - 2007-08-13 18:46 - 0102912 _____ (Albert L Faber) C:\Users\King Haze\AppData\Local\CDRip.dll
2014-06-01 06:50 - 2014-06-01 06:50 - 0003584 _____ () C:\Users\King Haze\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2007-08-13 18:46 - 2007-08-13 18:46 - 0155136 _____ () C:\Users\King Haze\AppData\Local\lame_enc.dll
2007-01-18 22:09 - 2007-01-18 22:09 - 0623616 _____ (Ivan Bischof ©2003 - 2005) C:\Users\King Haze\AppData\Local\No23 Recorder.exe
2005-08-23 23:34 - 2005-08-23 23:34 - 0029184 _____ () C:\Users\King Haze\AppData\Local\no23xwrapper.dll
2006-10-26 02:06 - 2006-10-26 02:06 - 0015872 _____ () C:\Users\King Haze\AppData\Local\ogg.dll
2015-01-12 14:29 - 2016-08-20 13:31 - 0001485 _____ () C:\Users\King Haze\AppData\Local\RecConfig.xml
2015-05-31 00:01 - 2016-05-11 18:32 - 0007615 _____ () C:\Users\King Haze\AppData\Local\Resmon.ResmonCfg
2006-10-26 02:06 - 2006-10-26 02:06 - 0143872 _____ () C:\Users\King Haze\AppData\Local\vorbis.dll
2006-10-26 02:06 - 2006-10-26 02:06 - 0064000 _____ () C:\Users\King Haze\AppData\Local\vorbisenc.dll
2006-10-26 02:06 - 2006-10-26 02:06 - 0019456 _____ () C:\Users\King Haze\AppData\Local\vorbisfile.dll
2016-08-19 09:28 - 2016-08-19 09:28 - 0000016 _____ () C:\ProgramData\mntemp
Einige Dateien in TEMP:
====================
C:\Users\King Haze\AppData\Local\Temp\131144884690305829.exe
C:\Users\King Haze\AppData\Local\Temp\49f4f964ca5e2cb26657bac991c10e7e.dll
C:\Users\King Haze\AppData\Local\Temp\ed6e8e8c4b588010c8f64663407c6196.dll
C:\Users\King Haze\AppData\Local\Temp\jre-8u101-windows-au.exe
C:\Users\King Haze\AppData\Local\Temp\libeay32.dll
C:\Users\King Haze\AppData\Local\Temp\msvcr120.dll
C:\Users\King Haze\AppData\Local\Temp\proxy_vole196755273912063042.dll
C:\Users\King Haze\AppData\Local\Temp\proxy_vole2498957098586415027.dll
C:\Users\King Haze\AppData\Local\Temp\proxy_vole3320793795331912142.dll
C:\Users\King Haze\AppData\Local\Temp\sqlite3.dll
C:\Users\King Haze\AppData\Local\Temp\yiey0l6p.dll
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-09-25 12:38
==================== Ende vom FRST.txt ============================
|
|
05.10.2016, 00:19
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | bidr.trellian.com redirect im Firefox Browser Also du König, da fehlt die Hälfte an Logs.
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
05.10.2016, 16:12
| #5 |
| | bidr.trellian.com redirect im Firefox Browser Sorry Chef (aber nette Anspielung auf meinen PC-Benutzernamen), war ein Missverständnis. Dachte du würdest mir die weiteren Anweisungen geben, mit welchen Programmen ich Scans durchführen sollte und dementsprechend dann auch die Logs posten müsse. Aber ich glaube du hast direkt die Scans von Malwarebytes, adwcleaner und co. erwartet. Egal, kein Problem, also mit der Entschuldigung, hier dann alle weiteren Logs : Malwarebytes Anti-Malware : Code:
ATTFilter Malwarebytes Anti-Malware www.malwarebytes.org Suchlaufdatum: 05.10.2016 Suchlaufzeit: 16:14 Protokolldatei: Malwarebytes Anti-Malware 5.10.16 2.txt Administrator: Ja Version: 2.2.1.1043 Malware-Datenbank: v2016.10.05.06 Rootkit-Datenbank: v2016.09.26.02 Lizenz: Kostenlose Version Malware-Schutz: Deaktiviert Schutz vor bösartigen Websites: Deaktiviert Selbstschutz: Deaktiviert Betriebssystem: Windows 7 Service Pack 1 CPU: x86 Dateisystem: NTFS Benutzer: King Haze Suchlauftyp: Bedrohungssuchlauf Ergebnis: Abgeschlossen Durchsuchte Objekte: 276870 Abgelaufene Zeit: 8 Min., 13 Sek. Speicher: Aktiviert Start: Aktiviert Dateisystem: Aktiviert Archive: Aktiviert Rootkits: Deaktiviert Heuristik: Aktiviert PUP: Warnen PUM: Aktiviert Prozesse: 0 (keine bösartigen Elemente erkannt) Module: 0 (keine bösartigen Elemente erkannt) Registrierungsschlüssel: 0 (keine bösartigen Elemente erkannt) Registrierungswerte: 0 (keine bösartigen Elemente erkannt) Registrierungsdaten: 0 (keine bösartigen Elemente erkannt) Ordner: 0 (keine bösartigen Elemente erkannt) Dateien: 1 (keine bösartigen Elemente erkannt) Physische Sektoren: 0 (keine bösartigen Elemente erkannt) (end) AdwCleaner Logfile: Code:
ATTFilter # AdwCleaner v6.020 - Bericht erstellt am 01/10/2016 um 19:16:03
# Aktualisiert am 14/09/2016 von ToolsLib
# Datenbank : 2016-09-30.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (X86)
# Benutzername : King Haze - KINGHAZE-PC
# Gestartet von : C:\Users\King Haze\Downloads\adwcleaner_6.020.exe
# Modus: Suchlauf
# Unterstützung : https://toolslib.net/forum
***** [ Dienste ] *****
Keine schädlichen Dienste gefunden.
***** [ Ordner ] *****
Keine schädlichen Ordner gefunden.
***** [ Dateien ] *****
Keine schädlichen Dateien gefunden.
***** [ DLL ] *****
Keine infizierten DLLs gefunden.
***** [ WMI ] *****
Keine schädlichen Schlüssel gefunden.
***** [ Verknüpfungen ] *****
Keine infizierten Verknüpfungen gefunden.
***** [ Aufgabenplanung ] *****
Aufgabe Gefunden: ThunderMaster
***** [ Registrierungsdatenbank ] *****
Schlüssel Gefunden: HKU\.DEFAULT\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gefunden: HKU\S-1-5-21-2290024371-3984154701-145341786-1000\Software\WEBAPP
Schlüssel Gefunden: HKU\S-1-5-21-2290024371-3984154701-145341786-1000\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gefunden: HKU\S-1-5-18\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gefunden: HKCU\Software\WEBAPP
Schlüssel Gefunden: HKCU\Software\AppDataLow\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
Schlüssel Gefunden: HKLM\SOFTWARE\{12DA0E6F-5543-440C-BAA2-28BF01070AFA}
***** [ Internetbrowser ] *****
Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.
*************************
C:\AdwCleaner\AdwCleaner[R0].txt - [1962 Bytes] - [09/07/2015 17:15:04]
C:\AdwCleaner\AdwCleaner[S0].txt - [2021 Bytes] - [09/07/2015 17:16:39]
C:\AdwCleaner\AdwCleaner[S1].txt - [1888 Bytes] - [01/10/2016 19:16:03]
########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [1961 Bytes] ##########
Code:
ATTFilter HitmanPro 3.7.14.280
www.hitmanpro.com
Computer name . . . . : KINGHAZE-PC
Windows . . . . . . . : 6.1.1.7601.X86/4
User name . . . . . . : KingHaze-PC\King Haze
UAC . . . . . . . . . : Disabled
License . . . . . . . : Trial (30 days left)
Scan date . . . . . . : 2016-10-01 20:04:35
Scan mode . . . . . . : Normal
Scan duration . . . . : 10m 34s
Disk access mode . . : Direct disk access (SRB)
Cloud . . . . . . . . : Internet
Reboot . . . . . . . : No
Threats . . . . . . . : 0
Traces . . . . . . . : 3
Objects scanned . . . : 1.636.023
Files scanned . . . . : 66.679
Remnants scanned . . : 747.056 files / 822.288 keys
Suspicious files ____________________________________________________________
C:\Users\King Haze\Documents\Assassin's Creed IV Black Flag\pb\pbcl.dll -> Deleted
Size . . . . . . . : 973.512 bytes
Age . . . . . . . : 900.5 days (2014-04-15 07:22:04)
Entropy . . . . . : 7.6
SHA-256 . . . . . : 4E71C01D3F160FD652498701FB86919CA80678D50D59353BF1E15507EE5501DC
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 22.0
The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Program contains PE structure anomalies. This is not typical for most programs.
Program is code signed with a valid Authenticode certificate.
C:\Users\King Haze\Documents\Assassin's Creed IV Black Flag\pb\pbcls.dll -> Deleted
Size . . . . . . . : 973.512 bytes
Age . . . . . . . : 900.5 days (2014-04-15 07:22:04)
Entropy . . . . . : 7.6
SHA-256 . . . . . : 4E71C01D3F160FD652498701FB86919CA80678D50D59353BF1E15507EE5501DC
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 22.0
The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
Program contains PE structure anomalies. This is not typical for most programs.
Program is code signed with a valid Authenticode certificate.
C:\Windows\system32\drivers\PnkBstrK.sys
Size . . . . . . . : 138.032 bytes
Age . . . . . . . : 996.9 days (2014-01-08 22:38:38)
Entropy . . . . . : 7.8
SHA-256 . . . . . : ABAF3FACF01E10E4C685F79C3B9E5D2118B3CF8629C4277EBE035B2A10474148
RSA Key Size . . . : 2048
Authenticode . . . : Valid
Fuzzy . . . . . . : 26.0
The .reloc (relocation) section in this program contains code. This is an indication of malware infection.
Entropy (or randomness) indicates the program is encrypted, compressed or obfuscated. This is not typical for most programs.
Authors name is missing in version info. This is not common to most programs.
Version control is missing. This file is probably created by an individual. This is not typical for most programs.
The file is located in a folder that contains core operating system files from Windows. This is not typical for most programs and is only common to system tools, drivers and hacking utilities.
Program contains PE structure anomalies. This is not typical for most programs.
The file is a device driver. Device drivers run as trusted (highly privileged) code.
Program is code signed with a valid Authenticode certificate.
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x86) Version: 30-09-2016
durchgeführt von King Haze (02-10-2016 03:11:26)
Gestartet von C:\Users\King Haze\Downloads
Microsoft Windows 7 Professional Service Pack 1 (X86) (2013-12-28 18:52:39)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2290024371-3984154701-145341786-500 - Administrator - Disabled)
ASPNET (S-1-5-21-2290024371-3984154701-145341786-1003 - Limited - Enabled)
Gast (S-1-5-21-2290024371-3984154701-145341786-501 - Limited - Disabled)
King Haze (S-1-5-21-2290024371-3984154701-145341786-1000 - Administrator - Enabled) => C:\Users\King Haze
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AV: Avast Antivirus (Enabled - Up to date) {17AD7D40-BA12-9C46-7131-94903A54AD8B}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Avast Antivirus (Enabled - Up to date) {ACCC9CA4-9C28-93C8-4B81-AFE241D3E736}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
Adobe Acrobat Reader DC - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)
Adobe Flash Player 23 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 23.0.0.162 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 23.0.0.162 - Adobe Systems Incorporated)
Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Avast Free Antivirus (HKLM\...\Avast) (Version: 12.3.2280 - AVAST Software)
Avira (HKLM\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Battle for Wesnoth 1.10.4 (HKLM\...\Battle for Wesnoth 1.10.4) (Version: 1.10.4 - )
Battle for Wesnoth 1.12.2 (HKLM\...\Battle for Wesnoth 1.12.2) (Version: 1.12.2 - )
Battle for Wesnoth 1.12.4 (HKLM\...\Battle for Wesnoth 1.12.4) (Version: 1.12.4 - )
Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment)
Battlelog Web Plugins (HKLM\...\Battlelog Web Plugins) (Version: 2.5.1 - EA Digital Illusions CE AB)
BitRaider Streaming Client (HKLM\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Blacklight: Retribution (HKLM\...\Steam App 209870) (Version: - Zombie, Inc.)
Boid (HKLM\...\Steam App 314010) (Version: - Mokus)
Borderlands 2 (HKLM\...\Steam App 49520) (Version: - Gearbox Software)
Card Hunter (HKLM\...\Steam App 293260) (Version: - Blue Manchu)
CCleaner (HKLM\...\CCleaner) (Version: 5.19 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.7.6321 - CDBurnerXP)
Chronicle: RuneScape Legends (HKLM\...\Steam App 205890) (Version: - Jagex)
CLEO 4.3 (HKLM\...\{A8F37EB0-C741-41D7-8CAB-5B40ECEEF094}_is1) (Version: 4.3 - Seemann, Deji, Alien)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve)
Creativerse (HKLM\...\Steam App 280790) (Version: - Playful Corporation)
Curse (HKLM\...\{1F2611FB-6F69-4AA8-BECD-243BD8CB45F3}) (Version: 6.0.0.0 - Curse)
Deus Ex - HDTP Release 3 (HKLM\...\HDTPr2_is1) (Version: 1.0 - HDTP Team)
Deus Ex GOTY (HKLM\...\GOGPACKDEUSEX_is1) (Version: 2.0.0.11 - GOG.com)
Deus Ex New Vision (HKLM\...\Deus Ex New Vision) (Version: 1.5 - DaveW)
Deus.Ex.Human.Revolution.Directors.Cut (HKLM\...\RGV1c0V4SHVtYW5SZXZvbHV0aW9uRGlyZWN0b3JzQ3V0_is1) (Version: 1 - )
Dirty Bomb (HKLM\...\Steam App 333930) (Version: - Splash Damage®)
Discord (HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\Discord) (Version: 0.0.296 - Hammer & Chisel, Inc.)
DNDownloader version 1.2 (HKLM\...\DNDownloader_is1) (Version: 1.2 - )
Don't Starve (HKLM\...\GOGPACKDONTSTARVE_is1) (Version: 2.7.0.16 - GOG.com)
Dr. Langeskov, The Tiger, and The Terribly Cursed Emerald: A Whirlwind Heist (HKLM\...\Steam App 409160) (Version: - Crows Crows Crows)
Dragon Age 2 (HKLM\...\{94C4C4F4-56FB-4032-908D-826220CBB97F}_is1) (Version: 1.04 - Bioware)
Dragon Age: Origins (HKLM\...\{AEC81925-9C76-4707-84A9-40696C613ED3}) (Version: 1.04 - Electronic Arts, Inc.)
Dragonball Xenoverse (HKLM\...\Dragonball Xenoverse_is1) (Version: - )
Dragonball Xenoverse Update 6 MULTi2 1.0 (HKLM\...\Dragonball Xenoverse Update 6 MULTi2 1.0) (Version: - )
Duelyst (HKLM\...\Steam App 291410) (Version: - Counterplay Games Inc.)
Dungeon Defenders II (HKLM\...\Steam App 236110) (Version: - Trendy Entertainment)
Dxtory version 2.0.126 (HKLM\...\Dxtory2.0_is1) (Version: 2.0.126 - ExKode Co. Ltd.)
Electric Highways (HKLM\...\Steam App 412140) (Version: - Zykov Eddy)
Endless Sky (HKLM\...\Steam App 404410) (Version: - Michael Zahniser)
EpicGear Meduza HDST Mouse (HKLM\...\InstallShield_{D348D476-3A04-4AA0-B094-954138A844CF}) (Version: 1.00.0000 - Epicgear)
Fallout Mod Manager 0.13.21 (HKLM\...\Generic Mod Manager_is1) (Version: - Q, Timeslip)
Far Cry 3 (HKLM\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.04 - Ubisoft)
Fraps (remove only) (HKLM\...\Fraps) (Version: - )
Free YouTube to MP3 Converter version 3.12.56.301 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.56.301 - DVDVideoSoft Ltd.)
Guild Wars 2 (HKLM\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
Hearthstone (HKLM\...\Hearthstone) (Version: - Blizzard Entertainment)
Heroes of the Storm (HKLM\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
Hi-Rez Studios Authenticate and Update Service (HKLM\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Hitman Absolution (HKLM\...\Hitman Absolution_is1) (Version: - )
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.14.280 - SurfRight B.V.)
inSSIDer Home (HKLM\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)
Intel(R) Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.10.1372 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Java 8 Update 101 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
League of Legends (HKLM\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (Version: 3.0.1 - Riot Games ) Hidden
Life Is Strange™ (HKLM\...\Steam App 319630) (Version: - DONTNOD Entertainment)
LIMBO (HKLM\...\Steam App 48000) (Version: - Playdead)
LogMeIn Hamachi (HKLM\...\LogMeIn Hamachi) (Version: 2.2.0.410 - LogMeIn, Inc.)
LogMeIn Hamachi (Version: 2.2.0.410 - LogMeIn, Inc.) Hidden
Magic Duels (HKLM\...\Steam App 316010) (Version: - Stainless Games Ltd.)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Mass Effect (HKLM\...\Steam App 17460) (Version: - BioWare)
Mass Effect 2 (HKLM\...\Steam App 24980) (Version: - BioWare)
Mass Effect™ 3 (HKLM\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
MechWarrior Online (HKLM\...\Steam App 342200) (Version: - Piranha Games Inc.)
Meduza HDST Mouse (Version: 1.00.0000 - Epicgear) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.6741.2071 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\OneDriveSetup.exe) (Version: 17.3.5951.0827 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Minecraft1.7.2 (HKLM\...\Minecraft1.7.2) (Version: - )
Moirai (HKLM\...\Steam App 496920) (Version: - Chris Johnson)
Monaco (HKLM\...\Steam App 113020) (Version: - Pocketwatch Games)
Mozilla Firefox 48.0 (x86 de) (HKLM\...\Mozilla Firefox 48.0 (x86 de)) (Version: 48.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.51.0 - Black Tree Gaming)
No23 Recorder (HKLM\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
NVIDIA GeForce Experience 2.9.1.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.9.1.22 - NVIDIA Corporation)
NVIDIA Grafiktreiber 365.10 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 365.10 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.4 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (Version: 16.0.6701.1041 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6701.1041 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.6701.1041 - Microsoft Corporation) Hidden
Open Broadcaster Software (HKLM\...\Open Broadcaster Software) (Version: - )
OpenAL (HKLM\...\OpenAL) (Version: - )
OpenOffice 4.1.1 (HKLM\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Orcs Must Die! Unchained (HKLM\...\Steam App 427270) (Version: - Robot Entertainment)
Origin (HKLM\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Outlast: Whistleblower (HKLM\...\T3V0bGFzdFdoaXN0bGVibG93ZXI=_is1) (Version: 1 - )
Path of Exile (HKLM\...\Steam App 238960) (Version: - Grinding Gear Games)
PAYDAY 2 (HKLM\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
PCSX2 - Playstation 2 Emulator (HKLM\...\pcsx2) (Version: - )
Planescape Torment (HKLM\...\Planescape Torment_is1) (Version: - GOG.com)
Portal 2 (HKLM\...\Steam App 620) (Version: - Valve)
Razer Cortex (HKLM\...\Razer Cortex_is1) (Version: 6.0.29.0 - Razer Inc.)
RE_BH 6 AIO [W.B] (Version: 1.0 - Warlord Blade) Hidden
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.72.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6959 - Realtek Semiconductor Corp.)
Relic Hunters Zero (HKLM\...\Steam App 382490) (Version: - Rogue Snail)
RIFT (HKLM\...\Steam App 39120) (Version: - Trion Worlds)
S.T.A.L.K.E.R. - Shadow of Chernobyl (HKLM\...\S.T.A.L.K.E.R. - Shadow of Chernobyl_is1) (Version: 1.0000 - THQ)
S.T.A.L.K.E.R.: Lost Alpha version 1.3003 (HKLM\...\S.T.A.L.K.E.R.: Lost Alpha_is1) (Version: 1.3003 - dezowave)
SafeZone Stable 1.51.2220.62 (Version: 1.51.2220.62 - Avast Software) Hidden
Saints Row IV (HKLM\...\Steam App 206420) (Version: - Deep Silver Volition)
Samsung_MonSetup (HKLM\...\{8EA79DBF-D637-448A-89D6-410A087A4493}) (Version: 1.00.0000 - Samsung)
SHIELD Streaming (Version: 4.1.0260 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.9.1.22 - NVIDIA Corporation) Hidden
SkySaga Infinite Isles (HKLM\...\SkySaga Infinite Isles 1.0.3652.0) (Version: 1.0.3652.0 - Radiant Worlds)
SkySaga Infinite Isles (Version: 1.0.3652.0 - Radiant Worlds) Hidden
SMITE (HKLM\...\Steam App 386360) (Version: - Hi-Rez Studios)
Sniper Elite V2 (HKLM\...\Steam App 63380) (Version: - Rebellion)
Splinter Cell Pandora Tomorrow (HKLM\...\{084A9731-D05B-4ADA-B4A0-0ADD25FD7152}) (Version: 1.00.000 - )
Spotify (HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\Spotify) (Version: 1.0.13.108.gcd94e7db - Spotify AB)
Star Wars: The Old Republic (HKLM\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
StarCraft II (HKLM\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM\...\Steam) (Version: - Valve Corporation)
Super-Charger (HKLM\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.018 - MSI)
Sven Co-op (HKLM\...\Steam App 225840) (Version: - Sven Co-op Team)
System Requirements Lab CYRI (HKLM\...\{19B0831B-0C18-4103-86E4-90FCD04CD3B9}) (Version: 6.0.12.5 - Husdawg, LLC)
System Requirements Lab for Intel (HKLM\...\{1EBDF6D2-CEA0-484C-A23E-2DDAD7FD0DD0}) (Version: 4.5.22.0 - Husdawg, LLC)
Team Fortress 2 (HKLM\...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
The Expendabros (HKLM\...\Steam App 312990) (Version: - Free Lives)
The Walking Dead - Season 2 (HKLM\...\The Walking Dead - Season 2_R.G. Mechanics_is1) (Version: - R.G. Mechanics, spider91)
Thunder Master v1.9 (HKLM\...\{EE04522C-0814-4B63-AE57-0B63E5A355BB}_is1) (Version: 1.9.7.4 - Palit Microsystems Ltd.)
Tom Clancy's Splinter Cell (HKLM\...\Uplay Install 109) (Version: - Ubisoft)
Tom Clancys Splinter Cell Chaos Theory MULTi6 - ElAmigos Version 1.05.157 (HKLM\...\{B26428C7-19FA-41C9-8948-DA42A80738D4}_is1) (Version: 1.05.157 - Ubisoft)
TP-LINK TL-WN781ND Driver (HKLM\...\{87C7B472-9BC2-43C8-9F03-86D2908E1A51}) (Version: 1.3.1 - TP-LINK)
Transmissions: Element 120 (HKLM\...\Steam App 365300) (Version: - Shokunin)
Tunngle beta (HKLM\...\Tunngle beta_is1) (Version: - Tunngle.net GmbH)
Unity Web Player (HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\UnityWebPlayer) (Version: 5.3.5f1 - Unity Technologies ApS)
Unturned (HKLM\...\Steam App 304930) (Version: - Nelson Sexton)
Uplay (HKLM\...\Uplay) (Version: 21.1 - Ubisoft)
VGA Boost (HKLM\...\{809ACFAE-9A4D-4C60-9223-D8B615CD8CBA}}_is1) (Version: 1.0.0.5 - MSI)
VirtualCloneDrive (HKLM\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
Vulkan Run Time Libraries 1.0.8.1 (HKLM\...\VulkanRT1.0.8.1) (Version: 1.0.8.1 - LunarG, Inc.)
Warcraft III eSK 1.26.0.6401 (HKLM\...\Warcraft III eSK 1.26.0.6401) (Version: - )
Warcraft III Reign of Chaos & The Frozen Throne (HKLM\...\Warcraft III Reign of Chaos & The Frozen Throne) (Version: - )
Warframe (HKLM\...\Steam App 230410) (Version: - Digital Extremes)
Winamp (HKLM\...\Winamp) (Version: 5.666 - Nullsoft, Inc)
Windows Live ID Sign-in Assistant (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 5.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
XCOM: Enemy Unknown (HKLM\...\Steam App 200510) (Version: - Firaxis Games)
Xiph.Org Open Codecs 0.85.17777 (HKLM\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)
YAWLE 0.5b (HKLM\...\Yawle_0.3b) (Version: - )
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2290024371-3984154701-145341786-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\King Haze\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {16A29C3F-CE41-4FAA-A392-3D8B11101635} - System32\Tasks\{AF2EA78A-951E-4613-87F6-3509A1D28393} => pcalua.exe -a "d:\program files\hi-rez studios\HiRezGamesDiagAndSupport.exe" -c uninstall=402
Task: {1E2282BC-E8DB-4833-BA6D-E00C3BF928DF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-13] (Adobe Systems Incorporated)
Task: {2EDB5D3D-D706-4D1C-9A8C-FEEC603098B7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-06-10] (Piriform Ltd)
Task: {391D13C7-6E54-41D5-AD81-026237075850} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-09-05] (Microsoft Corporation)
Task: {57FC6433-E11B-40DD-B122-D8F6FFFF3A09} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-09-05] (Microsoft Corporation)
Task: {953934DB-AAA9-4582-8D04-E71B3F81238C} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-03] (AVAST Software)
Task: {96BE8AAE-BAF4-4FD8-8AEF-56E354A0F223} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-09-04] (Microsoft Corporation)
Task: {A12C1782-AEE2-4924-8382-09F77582A172} - System32\Tasks\{0673662D-D139-4954-8D14-B63BA1BC66CE} => pcalua.exe -a "C:\Users\King Haze\Downloads\dxwebsetup(1).exe" -d "C:\Users\King Haze\Downloads"
Task: {C02E1E04-3986-42E5-AE97-20B240390DD7} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-09-04] (Microsoft Corporation)
Task: {CB357DDA-1DBD-4048-A727-30403449E685} - System32\Tasks\{F255CCAF-9B4E-494F-AD7F-FD8AFEEEA648} => pcalua.exe -a "C:\Program Files\MonitorDriver\MonSetup.exe" -d "C:\Users\King Haze\Desktop"
Task: {D0850805-2C34-4B11-8F59-6A1FE909BE5D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-09-05] (Microsoft Corporation)
Task: {D2297DAC-AA39-4F61-9113-D2534373015E} - System32\Tasks\{98C6A655-E96E-44C4-90FC-1670DE772DB2} => pcalua.exe -a "C:\Users\King Haze\Downloads\NewSRInstaller-v1.1-MadeByChewbacca-YurixyWorks\New Summoners Rift Installer.exe" -d "C:\Users\King Haze\Downloads\NewSRInstaller-v1.1-MadeByChewbacca-YurixyWorks"
Task: {EE37BCF6-EB6E-41B5-AC0B-877FEFA1564F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-09-16] (Adobe Systems Incorporated)
Task: {F44AFC95-2A40-4792-87EF-6CE42DB0DC17} - System32\Tasks\avast! Emergency Update => C:\Program Files\AVAST Software\Avast\AvastEmUpdate.exe [2016-09-09] (AVAST Software)
Task: {F5A4407D-B628-445C-B3BE-418E7B85D840} - System32\Tasks\SafeZone scheduled Autoupdate 1458721784 => C:\Program Files\AVAST Software\SZBrowser\launcher.exe [2016-09-06] (Avast Software)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-05-05 17:16 - 2016-02-12 04:36 - 00005120 _____ () C:\GeDoSaTo\gedoshim.dll
2016-09-09 09:16 - 2016-09-09 09:16 - 00169064 _____ () C:\Program Files\AVAST Software\Avast\JsonRpcServer.dll
2016-10-01 17:30 - 2016-10-01 17:30 - 03118360 _____ () C:\Program Files\AVAST Software\Avast\defs\16100104\algo.dll
2016-09-09 09:16 - 2016-09-09 09:16 - 00482928 _____ () C:\Program Files\AVAST Software\Avast\ffl2.dll
2015-07-08 14:55 - 2016-04-27 13:22 - 00122936 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2016-04-28 05:30 - 2016-09-04 20:53 - 00144576 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2016-07-01 17:16 - 2016-07-01 17:16 - 48936448 _____ () C:\Program Files\AVAST Software\Avast\libcef.dll
2015-07-08 14:56 - 2016-01-12 06:43 - 00018880 _____ () C:\Program Files\NVIDIA Corporation\Update Core\detoured.dll
2013-12-28 21:34 - 2013-05-17 01:05 - 01199576 ____R () C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
2014-07-20 17:20 - 2016-09-08 05:14 - 00784672 _____ () D:\Program Files\Steam\SDL2.dll
2015-04-04 00:49 - 2016-09-01 03:02 - 04969248 _____ () D:\Program Files\Steam\v8.dll
2015-04-04 00:49 - 2016-09-01 03:02 - 01563936 _____ () D:\Program Files\Steam\icui18n.dll
2015-04-04 00:49 - 2016-09-01 03:02 - 01195296 _____ () D:\Program Files\Steam\icuuc.dll
2014-07-20 17:20 - 2016-09-20 21:28 - 02321696 _____ () D:\Program Files\Steam\video.dll
2014-08-29 01:35 - 2016-01-27 09:49 - 02549760 _____ () D:\Program Files\Steam\libavcodec-56.dll
2014-08-29 01:35 - 2016-01-27 09:49 - 00442880 _____ () D:\Program Files\Steam\libavutil-54.dll
2014-08-29 01:35 - 2016-01-27 09:49 - 00491008 _____ () D:\Program Files\Steam\libavformat-56.dll
2014-08-29 01:35 - 2016-01-27 09:49 - 00332800 _____ () D:\Program Files\Steam\libavresample-2.dll
2014-08-29 01:35 - 2016-01-27 09:49 - 00485888 _____ () D:\Program Files\Steam\libswscale-3.dll
2014-07-20 17:20 - 2016-09-20 21:28 - 00835360 _____ () D:\Program Files\Steam\bin\chromehtml.DLL
2016-03-09 16:40 - 2016-07-05 00:17 - 00266560 _____ () D:\Program Files\Steam\openvr_api.dll
2014-07-20 17:20 - 2016-08-04 22:56 - 49825056 _____ () D:\Program Files\Steam\bin\libcef.dll
2015-04-04 00:49 - 2015-09-25 01:52 - 00119208 _____ () D:\Program Files\Steam\winh264.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [322]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [322]
AlternateDataStreams: C:\Users\King Haze:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [322]
AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
AlternateDataStreams: C:\ProgramData\Application Data:NT2 [322]
AlternateDataStreams: C:\Users\King Haze\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\King Haze\Anwendungsdaten:NT2 [322]
AlternateDataStreams: C:\Users\King Haze\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\King Haze\AppData\Roaming:NT2 [322]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com
IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com
IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-19\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-19\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-19\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-19\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-20\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-20\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-20\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-20\...\sony.com -> sony.com
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
MSCONFIG\Services: DAUpdaterSvc => 3
MSCONFIG\Services: Hamachi2Svc => 2
MSCONFIG\Services: LMIGuardianSvc => 2
MSCONFIG\Services: MBAMScheduler => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: PnkBstrA => 2
MSCONFIG\Services: Razer Game Scanner Service => 2
MSCONFIG\Services: RzKLService => 2
MSCONFIG\Services: TunngleService => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TP-LINK Wireless Configuration Utility.lnk => C:\Windows\pss\TP-LINK Wireless Configuration Utility.lnk.CommonStartup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\King Haze\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: amd_dc_opt => C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
MSCONFIG\startupreg: Avira Systray => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: Discord => C:\Users\King Haze\AppData\Local\Discord\app-0.0.295\Discord.exe
MSCONFIG\startupreg: GarenaPlus => "C:\Program Files\Garena Plus\GarenaMessenger.exe" -autolaunch
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: MyComGames => "C:\Users\King Haze\AppData\Local\MyComGames\MyComGames.exe" -autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\King Haze\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: WLAN Optimizer => C:\Users\King Haze\Downloads\wopt021\WLAN Optimizer.exe
==================== FirewallRules (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{95E47FEA-A545-461B-B87E-70D896E4B644}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{66A5FE03-F7AD-4113-8A55-158F4A57E412}] => (Allow) D:\Programme\Winamp\winamp.exe
FirewallRules: [{7A7A5404-DDA0-4425-B89B-0AF311E8B1F6}] => (Allow) D:\Programme\Winamp\winamp.exe
FirewallRules: [{47D110E2-A70F-420D-B30D-372F12D98046}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{EE5B334E-A5CE-4F5F-8E59-E215B132ECC4}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{EA6619CE-B85F-4345-90EB-B87D3DCC27B2}] => (Allow) D:\Program Files\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{2D7C67BD-548F-4118-AA9E-335ED7C626B6}] => (Allow) D:\Program Files\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{07870B6F-6C3B-4726-A180-BB33C92A44E6}] => (Allow) C:\Windows\System32\PnkBstrA.exe
FirewallRules: [{B62DAF84-16F6-47E2-BCBA-CF5A10A90326}] => (Allow) C:\Windows\System32\PnkBstrA.exe
FirewallRules: [{41F32E1D-9161-4128-A5FD-5DFB681AC32E}] => (Allow) C:\Windows\System32\PnkBstrB.exe
FirewallRules: [{41BEF963-2E94-4E7F-B8F2-80FCCDAFDDF8}] => (Allow) C:\Windows\System32\PnkBstrB.exe
FirewallRules: [{32E6557B-3D9E-4379-97D6-FB41571A60E6}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\farcry3.exe
FirewallRules: [{D22DC451-512C-4844-AAB5-C44D0D01FE20}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\farcry3.exe
FirewallRules: [{120008A2-B0A4-4EAD-9C19-13B92D911F84}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\farcry3_d3d11.exe
FirewallRules: [{D8D415BA-6160-42F7-B35A-68370FF7D071}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\farcry3_d3d11.exe
FirewallRules: [{58D38450-3B17-4ACB-8796-21AF1C2E77BD}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\FC3Updater.exe
FirewallRules: [{C90067C7-226B-4150-850E-6215F19A90E3}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\FC3Updater.exe
FirewallRules: [{1DCE4A5B-2489-4311-8D55-E5BDF63B32B1}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\FC3Editor.exe
FirewallRules: [{BD70F1AE-1302-41BE-9E8B-DEB9E476F983}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\FC3Editor.exe
FirewallRules: [{7D76562B-1476-43D3-AC4D-6B27C3DBF000}] => (Allow) D:\Program Files\Steam\SteamApps\common\blacklightretribution\Blacklight Retribution.exe
FirewallRules: [{2B69FB67-543D-4450-8F75-E0A3F737AFF3}] => (Allow) D:\Program Files\Steam\SteamApps\common\blacklightretribution\Blacklight Retribution.exe
FirewallRules: [TCP Query User{E87269CC-0B9C-4611-9C73-DF9D36EE4D2A}D:\programme\outlast\outlast\binaries\win32\olgame.exe] => (Allow) D:\programme\outlast\outlast\binaries\win32\olgame.exe
FirewallRules: [UDP Query User{72B842FA-D136-4755-B36E-6E2A4D26DEF2}D:\programme\outlast\outlast\binaries\win32\olgame.exe] => (Allow) D:\programme\outlast\outlast\binaries\win32\olgame.exe
FirewallRules: [{45213D07-6AD7-41B3-A963-3911242DF487}] => (Allow) C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe
FirewallRules: [{9D5B4CFA-40C8-421E-92D0-E8D1A9A23F6B}] => (Allow) C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe
FirewallRules: [{F0334ED5-FDFF-45FB-9F58-4A61455F205B}] => (Allow) C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe
FirewallRules: [{84D3C170-63DD-4FF5-BD72-254C666D8CE2}] => (Allow) C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe
FirewallRules: [TCP Query User{A2A8CD81-E07A-4F93-9210-169C5FBF822C}C:\games\the stanley parable\stanley.exe] => (Block) C:\games\the stanley parable\stanley.exe
FirewallRules: [UDP Query User{B61D3FF5-40CE-465E-A9AA-2553BB98FAB6}C:\games\the stanley parable\stanley.exe] => (Block) C:\games\the stanley parable\stanley.exe
FirewallRules: [{37F7DA4F-DDA4-484D-A443-18882140A472}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{787FC88C-9510-4DE2-A0C7-09A4A8CE9346}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{2B7D7B46-581E-4299-B478-F69161C5EB58}] => (Allow) C:\Program Files\Tunngle\TnglCtrl.exe
FirewallRules: [{7FBB25AB-FC43-474F-9BC1-BBB875183FBF}] => (Allow) C:\Program Files\Tunngle\TnglCtrl.exe
FirewallRules: [{288F009E-9323-4C61-A3B1-A8B276A028E2}] => (Allow) C:\Program Files\Tunngle\Tunngle.exe
FirewallRules: [{295F0203-A546-43FA-B3B5-A35FA4D3D10F}] => (Allow) C:\Program Files\Tunngle\Tunngle.exe
FirewallRules: [{FA38561D-B169-4F3E-AD33-EF5D58BC1425}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{CDCED1DB-24C6-4724-B002-E0E36B7C7C4B}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{32C02294-276F-4370-A921-2E3CB386B02B}] => (Allow) D:\Program Files\Steam\bin\steamwebhelper.exe
FirewallRules: [{4F962B2F-97CB-4C12-9841-110B4A44188B}] => (Allow) D:\Program Files\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{7EFB85FA-B8E6-4B97-9E44-1F55BBB3F8B8}C:\program files\warcraft iii reign of chaos & the frozen throne\war3.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\war3.exe
FirewallRules: [UDP Query User{6B7574CE-6FD5-4E3A-AAB0-4E33F9E559B9}C:\program files\warcraft iii reign of chaos & the frozen throne\war3.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\war3.exe
FirewallRules: [TCP Query User{45AE972B-32C7-40C5-9713-0C7CB2FCE602}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\war3.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\war3.exe
FirewallRules: [UDP Query User{7A36CB57-4E07-4A91-9EBE-33B7486392BB}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\war3.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\war3.exe
FirewallRules: [TCP Query User{547AB8C3-A76C-485E-83F8-FE2A6287F503}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\yawle.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\yawle.exe
FirewallRules: [UDP Query User{54E96C63-09A0-4C17-A430-8550A1A10644}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\yawle.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\yawle.exe
FirewallRules: [{D1E0AC19-A31E-48CB-AEF7-C7D4DD6AF8CA}] => (Allow) C:\Program Files\Warcraft III Reign of Chaos & The Frozen Throne\Warcraft III Frozen Throne eSK\Frozen Throne.exe
FirewallRules: [{A01507DB-6299-4C12-B05E-77011B76BB92}] => (Allow) C:\Program Files\Warcraft III Reign of Chaos & The Frozen Throne\Warcraft III Frozen Throne eSK\Frozen Throne.exe
FirewallRules: [{B71434FC-BBD9-4DCB-8461-F2F4B700C23E}] => (Allow) C:\Program Files\Warcraft III Reign of Chaos & The Frozen Throne\Warcraft III Frozen Throne eSK\Frozen Throne.exe
FirewallRules: [{40B77E29-A7AB-46A4-8CC9-EF0C7A85E31B}] => (Allow) C:\Program Files\Warcraft III Reign of Chaos & The Frozen Throne\Warcraft III Frozen Throne eSK\Frozen Throne.exe
FirewallRules: [TCP Query User{FA880C85-47B8-4DCB-ACD5-A8101C9D9631}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\nirvana.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\nirvana.exe
FirewallRules: [UDP Query User{D211DF2B-C85F-47AF-B234-7865FDBA6E46}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\nirvana.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\nirvana.exe
FirewallRules: [{07826E19-D989-47A7-966E-EE67F3E5102A}] => (Allow) C:\Program Files\Battle.net\Battle.net.exe
FirewallRules: [{5157BDAD-FD1B-4526-9744-87F56E9DF5C7}] => (Allow) C:\Program Files\Battle.net\Battle.net.exe
FirewallRules: [{298DEB91-9A44-4B35-A458-478B358A289A}] => (Allow) C:\Program Files\Hearthstone\Hearthstone.exe
FirewallRules: [{34B4AC82-12E0-47A8-A3C1-5D6CE51C9630}] => (Allow) C:\Program Files\Hearthstone\Hearthstone.exe
FirewallRules: [{85B2E2CA-C8B7-431E-B41D-3F5F6EFCAE15}] => (Allow) C:\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{666843BE-849A-4D84-8504-6D93EE60DEF8}] => (Allow) C:\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{03D9A59B-6E34-4B17-A131-2A740D769B24}] => (Allow) C:\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{AA0E8EBD-A4DF-4CD8-B878-667B0301BC18}] => (Allow) C:\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{1256E77A-D8C2-4434-89A1-C579EC2C1552}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{AFAA881B-9F0D-4DE2-B01B-939970EAA68F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5CF49325-8A71-4DBF-A21D-8334F45F0BBB}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{F5765E85-A311-4D21-BE9B-E406D969AFED}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{AF2E0868-2307-4AF5-90AF-9517288D0E04}C:\program files\wb games\batman arkham city goty\binaries\win32\batmanac_o.exe] => (Allow) C:\program files\wb games\batman arkham city goty\binaries\win32\batmanac_o.exe
FirewallRules: [TCP Query User{60B7BCFE-252C-4A7E-B466-98D3F3D9B38B}C:\steam\steamapps\common\cryptic studios\neverwinter\live\gameclient.exe] => (Allow) C:\steam\steamapps\common\cryptic studios\neverwinter\live\gameclient.exe
FirewallRules: [UDP Query User{774CA783-5F8B-47DF-B9CF-E067A2B28BB8}C:\steam\steamapps\common\cryptic studios\neverwinter\live\gameclient.exe] => (Allow) C:\steam\steamapps\common\cryptic studios\neverwinter\live\gameclient.exe
FirewallRules: [{8DA416F8-5458-4C23-AF33-AA039965B1C3}] => (Allow) C:\Program Files\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{13C30349-17D0-40FD-81B6-589CC9E5AA4E}] => (Allow) C:\Program Files\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{F8FF2EA9-ECFE-435B-B0A0-B64A6414714F}] => (Allow) C:\Program Files\Dragon Age\DAOriginsLauncher.exe
FirewallRules: [{0BF63947-C866-42AD-8747-4E03DB2E4F18}] => (Allow) C:\Program Files\Dragon Age\DAOriginsLauncher.exe
FirewallRules: [TCP Query User{D22ADA01-C8D1-4B42-8882-585AA15FA11A}C:\program files\dragon age\bin_ship\daorigins.exe] => (Allow) C:\program files\dragon age\bin_ship\daorigins.exe
FirewallRules: [UDP Query User{ACD3783B-D206-4607-B927-16C4D14B7ABE}C:\program files\dragon age\bin_ship\daorigins.exe] => (Allow) C:\program files\dragon age\bin_ship\daorigins.exe
FirewallRules: [{05D16A60-7406-4EB2-9F2B-06A231B1376C}] => (Allow) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{E0A7BB86-16D7-4793-8E41-9B53DF3E884E}] => (Allow) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{0AD16971-B7FB-4D36-9188-0F7A6EFBAF9C}] => (Allow) C:\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{C9637076-4BAE-455E-94C4-FFEE3BAC3B32}] => (Allow) C:\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{815FA5B9-674A-4D01-941F-E7D8055ED069}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{FD43D18F-692F-4EA8-9E5A-99534609666C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{425C2EC1-1B3D-4B5F-A8CF-4E9F3269A995}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{081DF930-D6A6-489E-9D13-C5A062B557A2}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{40DF7ACC-966D-4CE9-9EC6-EF6A4D38403D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{E97155BF-E4EB-4C75-A4C5-615F9BFD5E2F}] => (Allow) C:\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe
FirewallRules: [{3B53BE49-D1A0-4637-9352-462A01ECB0AD}] => (Allow) C:\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe
FirewallRules: [{18E826B1-811A-45C8-9D6E-8BD9310BB388}] => (Allow) D:\Program Files\Steam\SteamApps\common\blacklightretribution\Binaries\Win32\FoxGame-win32-Shipping.exe
FirewallRules: [{CF82F166-0AAF-48BD-8C50-0C7089205990}] => (Allow) D:\Program Files\Steam\SteamApps\common\blacklightretribution\Binaries\Win32\FoxGame-win32-Shipping.exe
FirewallRules: [{0402840F-977B-4222-843E-B9EB7C503980}] => (Allow) C:\Steam\SteamApps\common\Monaco\MONACO.exe
FirewallRules: [{7F3EF5FB-D5F1-4DA5-B85D-F7E2A4E45F98}] => (Allow) C:\Steam\SteamApps\common\Monaco\MONACO.exe
FirewallRules: [{803738DD-D413-4864-9B4C-7A5D9888BF12}] => (Allow) C:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{A828308A-0C78-41E1-9865-7A2B104E933E}] => (Allow) C:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [TCP Query User{B5B73691-E70B-4704-9E79-23FF046E8D2B}C:\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe] => (Allow) C:\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe
FirewallRules: [UDP Query User{6DC783E1-E37B-4F8A-A959-4B36AD283301}C:\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe] => (Allow) C:\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe
FirewallRules: [TCP Query User{373BC5E1-36A6-436B-869C-7FA510DE085C}D:\games\civilization v\civilization v\civilizationv.exe] => (Allow) D:\games\civilization v\civilization v\civilizationv.exe
FirewallRules: [UDP Query User{23F2FF4E-B2B3-4F66-87ED-C310F84C95BF}D:\games\civilization v\civilization v\civilizationv.exe] => (Allow) D:\games\civilization v\civilization v\civilizationv.exe
FirewallRules: [{A500BC6E-A87F-4012-A466-948CD63F7201}] => (Allow) C:\Steam\SteamApps\common\PAYDAY 2\payday2_win32_release.exe
FirewallRules: [{695D525B-AEE8-4B7C-9EB9-FF9E8CE96A85}] => (Allow) C:\Steam\SteamApps\common\PAYDAY 2\payday2_win32_release.exe
FirewallRules: [{AFE55187-985B-4DCE-BA11-CA7852C3169D}] => (Allow) C:\Steam\SteamApps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{7433EB07-F396-4E0E-8AE3-34E4CFB62A39}] => (Allow) C:\Steam\SteamApps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{C42CD5CE-0ACE-4AA1-B40D-0030F86329EA}] => (Allow) C:\Steam\SteamApps\common\SMITE\Binaries\Win32\HirezBridge.exe
FirewallRules: [{AE21A960-03F0-46F3-BAFE-A83BD11516FF}] => (Allow) C:\Steam\SteamApps\common\SMITE\Binaries\Win32\HirezBridge.exe
FirewallRules: [TCP Query User{C6B143BE-D3A5-4521-9EB0-35ABC3A28BC1}C:\steam\steamapps\common\smite\binaries\win32\smite.exe] => (Allow) C:\steam\steamapps\common\smite\binaries\win32\smite.exe
FirewallRules: [UDP Query User{8DFAAE30-907A-4E36-8327-59319C831829}C:\steam\steamapps\common\smite\binaries\win32\smite.exe] => (Allow) C:\steam\steamapps\common\smite\binaries\win32\smite.exe
FirewallRules: [{10C99F19-BC6E-4B96-A917-11469EEFA1F5}] => (Allow) C:\Steam\SteamApps\common\Dungeon Defenders 2\DunDefLauncher.exe
FirewallRules: [{1F7746E6-50B9-492B-8589-ED738F146CED}] => (Allow) C:\Steam\SteamApps\common\Dungeon Defenders 2\DunDefLauncher.exe
FirewallRules: [{69AB5A32-303A-467B-B2A2-9CA3155F89B8}] => (Allow) C:\Steam\SteamApps\common\Endless Sky\EndlessSky.exe
FirewallRules: [{476F1030-C818-47E7-9FD4-18DE15E2E184}] => (Allow) C:\Steam\SteamApps\common\Endless Sky\EndlessSky.exe
FirewallRules: [{110F2A23-2AD2-4850-AA84-DCFEC2A4FE14}] => (Allow) C:\Steam\SteamApps\common\Electric Highways\Electric Highways.exe
FirewallRules: [{8ECFE623-FBC2-4DB1-A154-E2A8797B5047}] => (Allow) C:\Steam\SteamApps\common\Electric Highways\Electric Highways.exe
FirewallRules: [{78A6DA5D-B46F-4235-9020-10829DD7C21E}] => (Allow) C:\Steam\SteamApps\common\Saints Row IV\SaintsRowIV.exe
FirewallRules: [{1D14D1B2-895D-4413-B633-121E119D6A05}] => (Allow) C:\Steam\SteamApps\common\Saints Row IV\SaintsRowIV.exe
FirewallRules: [{40F112E2-7CCE-46EA-91B1-BED3DD591BEE}] => (Allow) C:\Steam\SteamApps\common\Dr Langeskov The Tiger and The Terribly Cursed Emerald A Whirlwind Heist\DrLangeskov.exe
FirewallRules: [{0533B9CC-C753-4D44-8249-2A27AE97BF02}] => (Allow) C:\Steam\SteamApps\common\Dr Langeskov The Tiger and The Terribly Cursed Emerald A Whirlwind Heist\DrLangeskov.exe
FirewallRules: [{59699C8A-D010-48BB-97D7-F45B349935F8}] => (Allow) C:\Steam\SteamApps\common\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{831C93F6-431B-4697-BDCD-F71849E3DE6F}] => (Allow) C:\Steam\SteamApps\common\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{4016DE2C-FCF3-4417-A670-064E1DA6C8CF}] => (Allow) C:\Steam\SteamApps\common\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{D566C3D7-B159-4B24-B9BA-2D1A0D1D851F}] => (Allow) C:\Steam\SteamApps\common\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{EE36377F-FA81-4866-BE87-FDF564BEE576}] => (Allow) C:\Steam\SteamApps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe
FirewallRules: [{A517CAA9-E2FA-4AD7-836D-B00D83A9B911}] => (Allow) C:\Steam\SteamApps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe
FirewallRules: [{F78AA34E-76B6-4A18-BA62-8AEAFA9E354F}] => (Allow) C:\Steam\SteamApps\common\MechWarrior Online\Bin32\MWOClient.exe
FirewallRules: [{3FC821B5-FE0E-47C4-AEDA-E88FB8501612}] => (Allow) C:\Steam\SteamApps\common\MechWarrior Online\Bin32\MWOClient.exe
FirewallRules: [TCP Query User{B944C513-41D6-43FB-966C-CA956BF5CBD3}C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Allow) C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe
FirewallRules: [UDP Query User{D3F7EEDB-4DA2-4DCB-AB9F-EE6788DF62A3}C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Allow) C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe
FirewallRules: [{86B8475A-ED5B-40C9-94E2-EB0A3BBDD648}] => (Allow) C:\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{0A8A6895-0BE4-468D-80E6-5C378E777B54}] => (Allow) C:\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{9756525B-5163-4574-A503-E8F99F0D69A2}] => (Allow) C:\Steam\SteamApps\common\Sven Co-op\svencoop.exe
FirewallRules: [{86F1D273-703E-47C3-BE1F-49F8C5F2D5C4}] => (Allow) C:\Steam\SteamApps\common\Sven Co-op\svencoop.exe
FirewallRules: [{5F3BD67E-6AE7-4D2B-9B52-2C9E953E10A1}] => (Allow) C:\Steam\SteamApps\common\Creativerse\Creativerse.exe
FirewallRules: [{8351E608-3F49-4AF0-94B4-396EA41415B1}] => (Allow) C:\Steam\SteamApps\common\Creativerse\Creativerse.exe
FirewallRules: [{7F63D697-F89A-45B0-91B7-0CBCE764DDE7}] => (Allow) C:\Steam\SteamApps\common\CardHunter\CardHunter.exe
FirewallRules: [{CCFDE491-7AFD-4F81-BF24-9765D43FAD03}] => (Allow) C:\Steam\SteamApps\common\CardHunter\CardHunter.exe
FirewallRules: [{4EA48A06-E7F1-41D4-BC68-2BAC2521E187}] => (Allow) D:\Program Files\Steam\SteamApps\common\RIFT\riftpatchlive.exe
FirewallRules: [{96088CF2-0E48-4E2D-B1B7-637973452D21}] => (Allow) D:\Program Files\Steam\SteamApps\common\RIFT\riftpatchlive.exe
FirewallRules: [{CDD78ABE-B94C-4EFB-8DBA-2D7B8EF7E8E6}] => (Allow) D:\Program Files\Steam\SteamApps\common\OrcsMustDieUnchained\Dashboard\Bin\SpitfireDashboard.exe
FirewallRules: [{DB69DF6D-60BB-4BDB-8F77-BEF02DC6E641}] => (Allow) D:\Program Files\Steam\SteamApps\common\OrcsMustDieUnchained\Dashboard\Bin\SpitfireDashboard.exe
FirewallRules: [TCP Query User{093587EA-7457-4898-8439-D95C61D12AFE}D:\program files\steam\steamapps\common\orcsmustdieunchained\binaries\win32\spitfiregame.exe] => (Allow) D:\program files\steam\steamapps\common\orcsmustdieunchained\binaries\win32\spitfiregame.exe
FirewallRules: [UDP Query User{ED14B75B-31E4-468F-96B9-046D9AD3BF65}D:\program files\steam\steamapps\common\orcsmustdieunchained\binaries\win32\spitfiregame.exe] => (Allow) D:\program files\steam\steamapps\common\orcsmustdieunchained\binaries\win32\spitfiregame.exe
FirewallRules: [TCP Query User{560149C9-AF46-4502-92CB-DA9A282797E6}C:\program files\java\jre1.8.0_91\bin\jp2launcher.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\jp2launcher.exe
FirewallRules: [UDP Query User{6F1AECFE-7AC4-461D-AA11-ADFCDE5A4BFF}C:\program files\java\jre1.8.0_91\bin\jp2launcher.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\jp2launcher.exe
FirewallRules: [{B0E34543-8AC1-4DE3-B043-50A94A893242}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{42E75E4D-E21D-4AF8-9B5E-442D10261388}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{2B2BE28A-04F0-49D3-9A14-27A87ABA2FB3}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{E4F5A3B7-CC32-4AB2-9CF6-E6A67C0F8F74}] => (Allow) D:\Program Files\Steam\SteamApps\common\Mass Effect\Binaries\MassEffect.exe
FirewallRules: [{5166BBD2-CA71-4293-BF15-6A2F23DA3BE1}] => (Allow) D:\Program Files\Steam\SteamApps\common\Mass Effect\Binaries\MassEffect.exe
FirewallRules: [{99279482-5243-47B1-B051-5EDEBDDE3561}] => (Allow) D:\Program Files\Steam\SteamApps\common\Magic Duels\MagicDuels.exe
FirewallRules: [{8169D75B-74E8-4AB1-B786-7C46EEB5D7CF}] => (Allow) D:\Program Files\Steam\SteamApps\common\Magic Duels\MagicDuels.exe
FirewallRules: [{5D171A16-1562-4080-81D9-17F3205AA9FE}] => (Allow) C:\Steam\SteamApps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{27C1D9B0-92C5-4CC4-B20C-B40BE0EB1A73}] => (Allow) C:\Steam\SteamApps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{FF30C975-D7CC-40A8-AAB3-ABE6AC297E53}] => (Allow) C:\Program Files\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe
FirewallRules: [{A9E93BE3-7CED-42BC-A106-9DB30B36D727}] => (Allow) C:\Program Files\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe
FirewallRules: [{C5A24F35-10ED-4C36-B5FA-C6EF274B4B31}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{81079A2A-76C9-4991-9DE2-EEA90A0C3E65}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{A1AC4DE5-F77A-48FD-807F-513854ECE29C}] => (Allow) D:\Program Files\Steam\SteamApps\common\Limbo\limbo.exe
FirewallRules: [{2675A5DA-DDFC-4616-A01F-5C7206183971}] => (Allow) D:\Program Files\Steam\SteamApps\common\Limbo\limbo.exe
FirewallRules: [{7DDFD7D5-6E6C-4955-B660-6C9150BABA5F}] => (Allow) D:\Program Files\Steam\SteamApps\common\Broforce The Expendables Missions\Expendabros.exe
FirewallRules: [{02527521-750C-4045-AA52-27A0455A82FF}] => (Allow) D:\Program Files\Steam\SteamApps\common\Broforce The Expendables Missions\Expendabros.exe
FirewallRules: [{6432CAA8-A8E1-4009-A410-D0997F0C6473}] => (Allow) D:\Program Files\Steam\SteamApps\common\Transmissions Element 120\hl2.exe
FirewallRules: [{EBD7C577-680B-491E-A886-9DC89353D6BE}] => (Allow) D:\Program Files\Steam\SteamApps\common\Transmissions Element 120\hl2.exe
FirewallRules: [{6211CD23-60C8-4E78-9AF2-7B677A2A7778}] => (Allow) D:\Program Files\Steam\SteamApps\common\Relic Hunters Zero\RelicHuntersZero.exe
FirewallRules: [{D10E21B2-C031-47A1-AE73-8A1AFD6F1BCE}] => (Allow) D:\Program Files\Steam\SteamApps\common\Relic Hunters Zero\RelicHuntersZero.exe
FirewallRules: [{3688A76F-83E4-459B-B5DA-7EC31B0FFFD7}] => (Allow) D:\Program Files\Steam\SteamApps\common\Boid\Boid.exe
FirewallRules: [{0B7A584C-AF5A-4ED6-A33A-7837C494C4CC}] => (Allow) D:\Program Files\Steam\SteamApps\common\Boid\Boid.exe
FirewallRules: [{B4428D9C-CFF4-4B5B-BA0C-04B907C9B75B}] => (Allow) D:\Program Files\Steam\SteamApps\common\Chronicle\Chronicle.exe
FirewallRules: [{7E75A19D-BEA2-4C04-A779-19A646334863}] => (Allow) D:\Program Files\Steam\SteamApps\common\Chronicle\Chronicle.exe
FirewallRules: [{F2F03D14-73EF-423D-A82A-DC1AEBB5CD6E}] => (Allow) C:\Program Files\Radiant Worlds\SkySaga Infinite Isles\SkySagaLauncher.exe
FirewallRules: [{D2263C7D-E5E7-40DF-9C6A-BA60B32077C9}] => (Allow) C:\Program Files\Radiant Worlds\SkySaga Infinite Isles\Client\SkySaga.exe
FirewallRules: [{74805831-0251-4DCF-8A51-4D3A1AC9E4C2}] => (Allow) D:\Program Files\Steam\SteamApps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{F7155883-F7C0-495E-84CF-40F1E4943BD4}] => (Allow) D:\Program Files\Steam\SteamApps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{BDBFF1AF-ED70-47DE-A6F7-BBA571B3434D}] => (Allow) D:\Program Files\Steam\SteamApps\common\Magic Duels\MagicDuels.exe
FirewallRules: [{9009C425-ED7A-4EF9-B97B-C9FD17AEA7F8}] => (Allow) D:\Program Files\Steam\SteamApps\common\Magic Duels\MagicDuels.exe
FirewallRules: [{05C7F461-4EF2-496F-8DB6-568C7F0A9525}] => (Allow) D:\Program Files\Steam\SteamApps\common\Moirai\Moirai.exe
FirewallRules: [{FF0A7691-BD2A-4F78-9A21-B30F87612FCF}] => (Allow) D:\Program Files\Steam\SteamApps\common\Moirai\Moirai.exe
FirewallRules: [TCP Query User{49A2912B-6D0C-4F54-86FD-A47CA362F189}C:\program files\ubisoft\splinter cell pandora tomorrow\pandora.exe] => (Allow) C:\program files\ubisoft\splinter cell pandora tomorrow\pandora.exe
FirewallRules: [UDP Query User{01582EBD-A094-4698-9A49-04B34885FA36}C:\program files\ubisoft\splinter cell pandora tomorrow\pandora.exe] => (Allow) C:\program files\ubisoft\splinter cell pandora tomorrow\pandora.exe
FirewallRules: [TCP Query User{B2B68182-A621-4F10-96B9-8856C556A35A}C:\program files\ubisoft\splinter cell chaos theory\system\splintercell3.exe] => (Block) C:\program files\ubisoft\splinter cell chaos theory\system\splintercell3.exe
FirewallRules: [UDP Query User{0B28F234-A8C7-4A49-8C15-269D16EDC3DB}C:\program files\ubisoft\splinter cell chaos theory\system\splintercell3.exe] => (Block) C:\program files\ubisoft\splinter cell chaos theory\system\splintercell3.exe
FirewallRules: [{5C4A4C48-D793-44B3-BAE1-44F8154619A6}] => (Allow) D:\Program Files\Steam\SteamApps\common\SKILL\Binaries\Win32\sf2.exe
FirewallRules: [{A1071E04-4315-4B30-B5F1-0C3F4E61B7E7}] => (Allow) D:\Program Files\Steam\SteamApps\common\SKILL\Binaries\Win32\sf2.exe
FirewallRules: [TCP Query User{0E5B99F6-E28F-4E59-AC7A-5B45FB493846}D:\program files\ubisoft\farcry 3\bin\farcry3.exe] => (Block) D:\program files\ubisoft\farcry 3\bin\farcry3.exe
FirewallRules: [UDP Query User{3A3C3834-7AAD-42C5-B1C2-8A8C2F51D653}D:\program files\ubisoft\farcry 3\bin\farcry3.exe] => (Block) D:\program files\ubisoft\farcry 3\bin\farcry3.exe
FirewallRules: [{1140F6D7-668D-4101-A002-57DC25AF5F2A}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{EB2FC75D-0951-4275-A8D4-1740455083CF}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{1890CAD8-6288-4996-AC69-45F031F7B38B}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{67CC658A-E44E-4885-8CF1-4BE1754674D8}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{CDF50E2C-9521-44D1-B060-A0AF02E5F8C2}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{7B1C55DD-4CB9-4A81-A701-8447A0B323FC}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{8B568A3D-DFCA-4350-B8ED-35243932A0AC}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{043295F3-57B2-4460-963D-553081DBB3DC}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{37E7B099-2FCC-4536-B895-429C0C3B7867}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{F3C2A8A9-0F97-413C-BBBC-1452B59CA877}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{03F95123-2C9B-47F7-AA32-703D149A1C21}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{CF84095C-B5EC-406D-B416-ECC5197A778D}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{18D7775B-4896-4169-9298-6F9B505E0402}] => (Allow) D:\Program Files\Steam\SteamApps\common\Duelyst\Duelyst.exe
FirewallRules: [{451A2FF3-9A64-44AA-A267-DC897689FBD9}] => (Allow) D:\Program Files\Steam\SteamApps\common\Duelyst\Duelyst.exe
FirewallRules: [{66100AAE-7C98-4308-A2FC-9AFC6850F2C7}] => (Allow) C:\Steam\SteamApps\common\Sven Co-op\svends.exe
FirewallRules: [{E1AECCDC-B175-469B-BF81-480685B0C887}] => (Allow) C:\Steam\SteamApps\common\Sven Co-op\svends.exe
FirewallRules: [{C8E72231-25A6-4486-99AC-35B58E9FAAAA}] => (Allow) C:\Steam\SteamApps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{6129AF73-DB33-4E0C-873C-17CBA7D59320}] => (Allow) C:\Steam\SteamApps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
==================== Wiederherstellungspunkte =========================
Überprüfen Sie den "winmgmt" Dienst oder reparieren Sie den WMI.
==================== Fehlerhafte Geräte im Gerätemanager =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Hamachi Network Interface
Description: Hamachi Network Interface
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn, Inc.
Service: hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (10/02/2016 02:13:11 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\outlast whistleblower\Binaries\Win64\OLGame_R.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/02/2016 02:13:11 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\outlast whistleblower\Binaries\Win64\OLGame.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/02/2016 02:12:53 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\Steam\steamapps\common\mechwarrior online\Bin64\MWOClient.exe".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/02/2016 02:12:52 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\Steam\steamapps\common\mechwarrior online\Bin64\CrashSender1402.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/02/2016 02:12:21 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "d:\program files\Steam\steamapps\common\Warframe\Warframe.x64.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/01/2016 11:45:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\outlast whistleblower\Binaries\Win64\OLGame_R.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/01/2016 11:45:47 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\outlast whistleblower\Binaries\Win64\OLGame.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/01/2016 11:44:52 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\Steam\steamapps\common\mechwarrior online\Bin64\MWOClient.exe".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/01/2016 11:44:51 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\Steam\steamapps\common\mechwarrior online\Bin64\CrashSender1402.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/01/2016 11:43:24 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "d:\program files\Steam\steamapps\common\Warframe\Warframe.x64.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Systemfehler:
=============
Error: (10/02/2016 02:59:20 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen:
Zugriff verweigert
Error: (10/02/2016 02:59:07 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen:
Zugriff verweigert
Error: (10/02/2016 02:58:54 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen:
Zugriff verweigert
Error: (10/02/2016 02:58:42 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen:
Zugriff verweigert
Error: (10/02/2016 02:58:41 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen:
Zugriff verweigert
Error: (10/02/2016 02:58:28 AM) (Source: Service Control Manager) (EventID: 7006) (User: )
Description: Der Aufruf "ScRegSetValueExW" ist für "Type" aufgrund folgenden Fehlers fehlgeschlagen:
Zugriff verweigert
Error: (10/01/2016 08:02:37 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Origin Web Helper Service" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.
Error: (10/01/2016 08:02:37 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Origin Web Helper Service erreicht.
Error: (10/01/2016 07:21:56 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen (Anwendungsspezifisch) wird der SID (S-1-5-18) für Benutzer NT-AUTORITÄT\SYSTEM von Adresse LocalHost (unter Verwendung von LRPC) keine Berechtigung zum Start (Lokal) für die COM-Serveranwendung mit CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
und APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungsprogramm für Komponentendienste geändert werden.
Error: (10/01/2016 07:20:23 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Origin Web Helper Service" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.
CodeIntegrity:
===================================
Date: 2016-09-08 20:36:16.822
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-08 20:36:16.666
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-07 12:58:48.181
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-07 12:58:48.103
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-06 12:45:18.727
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-06 12:45:18.665
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-05 18:51:42.401
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-05 18:51:42.354
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-04 21:19:25.353
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-04 21:19:25.306
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 61%
Installierter physikalischer RAM: 3544.07 MB
Verfügbarer physikalischer RAM: 1374.95 MB
Summe virtueller Speicher: 7086.45 MB
Verfügbarer virtueller Speicher: 4239.09 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:638.54 GB) (Free:119.3 GB) NTFS
Drive d: () (Fixed) (Total:292.87 GB) (Free:93.2 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: DF39E75C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=292.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=638.5 GB) - (Type=07 NTFS)
==================== Ende vom Addition.txt ============================
|
|
06.10.2016, 14:14
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | bidr.trellian.com redirect im Firefox Browser Bitte Avast deinstallieren. Das Teil können wir einfach nicht mehr guten Gewissens empfehlen. => Antivirensoftware: Schutz Für Ihre Dateien, Aber Auf Kosten Ihrer Privatsphäre? | Emsisoft Blog Auch andere Freewareanbieter wie Avira, AVG oder Panda springen auf diesen oder ähnlichen Zügen rauf, basteln Junkware in die Setups, arbeiten mit ASK zusammen etc; so was ist bei Sicherheitssoftware einfach inakzeptabel. Gib Bescheid wenn Avast weg ist; wenn wir hier durch sind, kannst du auf einen anderen Virenscanner umsteigen, Infos folgen dann im Abschlussposting. Bitte JETZT nix mehr ohne Absprache installieren!
__________________ --> bidr.trellian.com redirect im Firefox Browser |
|
09.10.2016, 20:28
| #7 |
| | bidr.trellian.com redirect im Firefox Browser Also ich habe Avast deinstalliert und noch keinen neuen Virenscanner als Ersatz installiert, deswegen würde ich gerne wissen, wie wir weiter verfahren. |
|
09.10.2016, 22:37
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | bidr.trellian.com redirect im Firefox Browser Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.10.2016, 11:14
| #9 |
| | bidr.trellian.com redirect im Firefox Browser Yo cosinus, ich habe das Malwarebytes Anti-Rootkit Tool laufen lassen wie in der Anleitung beschrieben (ist auch keine wirkliche Quantenphysik  ) und trotzdem keine Rootkits/Malware gefunden  Allerdings bekam ich beim Starten von Malwarebytes Anti-Rootkit folgende Meldung über die vermutete Aktivität von Rootkits , ich habe auf Nein gedrückt, da ich mir nicht sicher war.www.directupload.net/file/d/4504/vx8yca32_png.htm Hier noch das Logfile : Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org
Database version:
main: v2016.10.10.02
rootkit: v2016.09.26.02
Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 10.0.9200.16750
King Haze :: KINGHAZE-PC [administrator]
10.10.2016 11:55:39
mbar-log-2016-10-10 (11-55-39).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 276956
Time elapsed: 11 minute(s), 28 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Geändert von Chillzz (10.10.2016 um 11:21 Uhr) |
|
10.10.2016, 12:11
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | bidr.trellian.com redirect im Firefox Browser Vllt sollte man erleichtert und nicht verärgert sein, wenn nix schlimmneres gefunden wird  Adware/Junkware/Toolbars entfernen Alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop! Virenscanner jetzt vor dem Einsatz dieser Tools bitte komplett deaktivieren! 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.10.2016, 15:39
| #11 | |
| | bidr.trellian.com redirect im Firefox BrowserZitat:
adwcleaner : Code:
ATTFilter # AdwCleaner v6.021 - Bericht erstellt am 10/10/2016 um 16:30:57
# Aktualisiert am 06/10/2016 von ToolsLib
# Datenbank : 2016-10-07.1 [Server]
# Betriebssystem : Windows 7 Professional Service Pack 1 (X86)
# Benutzername : King Haze - KINGHAZE-PC
# Gestartet von : C:\Users\King Haze\Desktop\adwcleaner_6.021.exe
# Modus: Suchlauf
# Unterstützung : https://toolslib.net/forum
***** [ Dienste ] *****
Keine schädlichen Dienste gefunden.
***** [ Ordner ] *****
Keine schädlichen Ordner gefunden.
***** [ Dateien ] *****
Keine schädlichen Dateien gefunden.
***** [ DLL ] *****
Keine infizierten DLLs gefunden.
***** [ WMI ] *****
Keine schädlichen Schlüssel gefunden.
***** [ Verknüpfungen ] *****
Keine infizierten Verknüpfungen gefunden.
***** [ Aufgabenplanung ] *****
Keine schädlichen Aufgaben gefunden.
***** [ Registrierungsdatenbank ] *****
Keine schädlichen Elemente in der Registrierungsdatenbank gefunden.
***** [ Internetbrowser ] *****
Keine schädlichen Elemente in Firefox basierten Browsern gefunden.
Keine schädlichen Elemente in Chrome basierten Browsern gefunden.
*************************
C:\AdwCleaner\AdwCleaner[C0].txt - [1886 Bytes] - [01/10/2016 19:17:34]
C:\AdwCleaner\AdwCleaner[R0].txt - [1962 Bytes] - [09/07/2015 17:15:04]
C:\AdwCleaner\AdwCleaner[S0].txt - [2021 Bytes] - [09/07/2015 17:16:39]
C:\AdwCleaner\AdwCleaner[S1].txt - [2040 Bytes] - [01/10/2016 19:16:03]
C:\AdwCleaner\AdwCleaner[S2].txt - [1497 Bytes] - [10/10/2016 16:30:57]
########## EOF - C:\AdwCleaner\AdwCleaner[S2].txt - [1570 Bytes] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Malwarebytes
Version: 8.0.9 (09.30.2016)
Operating System: Windows 7 Professional x86
Ran by King Haze (Administrator) on 10.10.2016 at 16:32:59,99
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
File System: 19
Successfully deleted: C:\ProgramData\mntemp (File)
Successfully deleted: C:\Users\King Haze\AppData\Local\crashrpt (Folder)
Successfully deleted: C:\Windows\System32\ai_recyclebin (Folder)
Successfully deleted: C:\Users\King Haze\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2L59XLC6 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\King Haze\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\58O5HPEX (Temporary Internet Files Folder)
Successfully deleted: C:\Users\King Haze\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8IK59IVD (Temporary Internet Files Folder)
Successfully deleted: C:\Users\King Haze\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JX804636 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\King Haze\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LZPHYBV2 (Temporary Internet Files Folder)
Successfully deleted: C:\Users\King Haze\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S2MUB4MF (Temporary Internet Files Folder)
Successfully deleted: C:\Users\King Haze\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEXN9NPX (Temporary Internet Files Folder)
Successfully deleted: C:\Users\King Haze\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIS9LTDL (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\2L59XLC6 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\58O5HPEX (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\8IK59IVD (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\JX804636 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\LZPHYBV2 (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\S2MUB4MF (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TEXN9NPX (Temporary Internet Files Folder)
Successfully deleted: C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\TIS9LTDL (Temporary Internet Files Folder)
Registry: 0
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 10.10.2016 at 16:34:08,96
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
|
|
10.10.2016, 17:16
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | bidr.trellian.com redirect im Firefox Browser Das Problem ist, dass deine tollen Virenscanner nicht das immer finden sollen, was dich so nervt. Unseröse AVs schieben den ahnungslosen Anwender so einen Müll auch noch unter anstatt sowas zu verhindern. Kurz gesagt, man verarscht euch. Zumindest wenn das AV von Avast/AVG, Avira oder zb Panda ist. Dann zeig mal frische FRST Logs. Haken setzen bei addition.txt dann auf Untersuchen klicken
__________________ Logfiles bitte immer in CODE-Tags posten |
|
10.10.2016, 21:08
| #13 |
| | bidr.trellian.com redirect im Firefox Browser frst.txt : Code:
ATTFilter Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x86) Version: 09-10-2016
durchgeführt von King Haze (Administrator) auf KINGHAZE-PC (10-10-2016 22:00:31)
Gestartet von C:\Users\King Haze\Downloads
Geladene Profile: King Haze (Verfügbare Profile: King Haze)
Platform: Microsoft Windows 7 Professional Service Pack 1 (X86) Sprache: Deutsch (Deutschland)
Internet Explorer Version 10 (Standard-Browser: FF)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Prozesse (Nicht auf der Ausnahmeliste) =================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\ClickToRun\OfficeClickToRun.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe
(Hi-Rez Studios) D:\Program Files\Hi-Rez Studios\HiPatchService.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(MSI) C:\Program Files\MSI\Super-Charger\ChargeService.exe
(MICRO-STAR INTERNATIONAL CO., LTD.) C:\Program Files\MSI\MSITrigger\MSI_Trigger_Service.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(MSI) C:\Program Files\MSI\Super-Charger\Super-Charger.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe
(Oracle Corporation) C:\Program Files\Common Files\Java\Java Update\jusched.exe
(Palit Microsystems Ltd.) C:\Program Files\Thunder Master\THPanel.exe
(none) C:\Users\King Haze\Downloads\wopt021\WLAN Optimizer.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
(Razer Inc.) C:\Program Files\Razer\Razer Cortex\RzKLService.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Mozilla Corporation) C:\Program Files\Mozilla Firefox\firefox.exe
==================== Registry (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)
HKLM\...\Run: [RTHDVCPL] => C:\Program Files\Realtek\Audio\HDA\RtkNGUI.exe [6323928 2013-06-27] (Realtek Semiconductor)
HKLM\...\Run: [IMSS] => C:\Program Files\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [134616 2013-05-17] (Intel Corporation)
HKLM\...\Run: [USB3MON] => C:\Program Files\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [292848 2013-04-26] (Intel Corporation)
HKLM\...\Run: [Super-Charger] => C:\Program Files\MSI\Super-Charger\Super-Charger.exe [506864 2013-03-08] (MSI)
HKLM\...\Run: [NvBackend] => C:\Program Files\NVIDIA Corporation\Update Core\NvBackend.exe [2787264 2016-01-12] (NVIDIA Corporation)
HKLM\...\Run: [ShadowPlay] => C:\Windows\system32\nvspcap.dll [1542600 2016-01-12] (NVIDIA Corporation)
HKLM\...\Run: [SunJavaUpdateSched] => C:\Program Files\Common Files\Java\Java Update\jusched.exe [598552 2016-06-22] (Oracle Corporation)
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\Run: [THPanel] => C:\Program Files\Thunder Master\THPanel.exe [2169640 2013-10-17] (Palit Microsystems Ltd.)
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\Run: [WLAN Optimizer] => C:\Users\King Haze\Downloads\wopt021\WLAN Optimizer.exe [109056 2009-08-07] (none)
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\MountPoints2: {82ba2e12-0520-11e5-bef8-448a5b212ed6} - G:\setup.exe
AppInit_DLLs: C:\GeDoSaTo\gedoshim.dll => C:\GeDoSaTo\gedoshim.dll [5120 2016-02-12] ()
AppInit_DLLs: , C:\GeDoSaTo\gedoshim.dll => C:\GeDoSaTo\gedoshim.dll [5120 2016-02-12] ()
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
GroupPolicyScripts: Beschränkung <======= ACHTUNG
==================== Internet (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{4B355606-754D-494A-92FD-255FAB54E638}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{6324BC67-0616-40BB-9212-CCB7706AEAE1}: [DhcpNameServer] 192.168.178.1
Tcpip\..\Interfaces\{F67C3489-5DD7-4B2F-80F2-A5796B552951}: [DhcpNameServer] 7.254.254.254
Internet Explorer:
==================
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.dell.com
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Lync Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office\root\Office16\OCHelper.dll [2016-09-05] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_101\bin\ssv.dll [2016-07-23] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> c:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\root\Office16\URLREDIR.DLL [2016-09-05] (Microsoft Corporation)
BHO: Microsoft OneDrive for Business Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office\root\Office16\GROOVEEX.DLL [2016-09-05] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_101\bin\jp2ssv.dll [2016-07-23] (Oracle Corporation)
Toolbar: HKU\S-1-5-21-2290024371-3984154701-145341786-1000 -> Kein Name - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - Keine Datei
Handler: mso-minsb-roaming.16 - {83C25742-A9F7-49FB-9138-434302C88D07} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-09-05] (Microsoft Corporation)
Handler: mso-minsb.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-09-05] (Microsoft Corporation)
Handler: osf-roaming.16 - {42089D2D-912D-4018-9087-2B87803E93FB} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-09-05] (Microsoft Corporation)
Handler: osf.16 - {5504BE45-A83B-4808-900A-3A5C36E7F77A} - C:\Program Files\Microsoft Office\root\Office16\MSOSB.DLL [2016-09-05] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - Keine Datei
FireFox:
========
FF ProfilePath: C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default [2016-10-10]
FF Extension: (youtubereplay) - C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\Extensions\jid0-VuYraOOT2NM2AcnQwG4APKol3Vs@jetpack.xpi [2016-04-27]
FF Extension: (Thumbnail Zoom Plus) - C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\Extensions\thumbnailZoom@dadler.github.com.xpi [2016-06-17]
FF Extension: (Adblock Plus) - C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2016-04-28]
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_23_0_0_162.dll [2016-09-13] ()
FF Plugin: @esn/npbattlelog,version=2.5.1 -> C:\Program Files\Battlelog Web Plugins\2.5.1\npbattlelog.dll [2014-09-01] (EA Digital Illusions CE AB)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI ipt;version=3.5.29 -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-05-17] (Intel Corporation)
FF Plugin: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-05-17] (Intel Corporation)
FF Plugin: @java.com/DTPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\dtplugin\npDeployJava1.dll [2016-07-23] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.101.2 -> C:\Program Files\Java\jre1.8.0_101\bin\plugin2\npjp2.dll [2016-07-23] (Oracle Corporation)
FF Plugin: @microsoft.com/Lync,version=15.0 -> C:\Program Files\Microsoft Office\root\VFS\ProgramFilesX86\Mozilla Firefox\plugins\npmeetingjoinpluginoc.dll [2016-09-05] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office\root\Office16\NPSPWRAP.DLL [2016-09-05] (Microsoft Corporation)
FF Plugin: @pandonetworks.com/PandoWebPlugin -> C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll [Keine Datei]
FF Plugin: @t.garena.com/garenatalk -> C:\Program Files\Garena Plus\bbtalk\plugins\npPlugin\npGarenaTalkPlugin.dll [Keine Datei]
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2016-06-30] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-2290024371-3984154701-145341786-1000: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\King Haze\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll [2016-05-08] (Unity Technologies ApS)
FF Plugin HKU\S-1-5-21-2290024371-3984154701-145341786-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2016-08-02] ()
Chrome:
=======
CHR DefaultProfile: Default
CHR dev: Chrome dev build erkannt! <======= ACHTUNG
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - hxxps://clients2.google.com/service/update2/crx
==================== Dienste (Nicht auf der Ausnahmeliste) ====================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 BRSptStub; C:\ProgramData\BitRaider\BRSptStub.exe [363208 2015-05-24] (BitRaider, LLC)
R2 ClickToRunSvc; C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeClickToRun.exe [1967344 2016-09-04] (Microsoft Corporation)
S4 DAUpdaterSvc; C:\Program Files\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [25832 2009-12-15] (BioWare)
S3 EasyAntiCheat; C:\Windows\system32\EasyAntiCheat.exe [245544 2015-07-19] (EasyAntiCheat Ltd)
R2 GfExperienceService; C:\Program Files\NVIDIA Corporation\GeForce Experience Service\GfExperienceService.exe [929728 2016-01-12] (NVIDIA Corporation)
U2 HiPatchService; D:\Program Files\Hi-Rez Studios\HiPatchService.exe [9728 2016-08-23] (Hi-Rez Studios) [Datei ist nicht signiert]
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [583680 2013-02-13] (Intel(R) Corporation) [Datei ist nicht signiert]
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [637912 2013-02-13] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-05-17] (Intel Corporation)
R2 MSI_SuperCharger; C:\Program Files\MSI\Super-Charger\ChargeService.exe [161264 2013-02-20] (MSI)
R2 MSI_Trigger_Service; C:\Program Files\MSI\MSITrigger\MSI_Trigger_Service.exe [29728 2013-05-28] (MICRO-STAR INTERNATIONAL CO., LTD.)
R2 NvNetworkService; C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe [1879488 2016-01-12] (NVIDIA Corporation)
S3 NvStreamNetworkSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe [5178816 2016-01-12] (NVIDIA Corporation)
S4 NvStreamSvc; C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamService.exe [3996608 2016-01-12] (NVIDIA Corporation)
S3 Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [2130440 2016-09-16] (Electronic Arts)
S2 Origin Web Helper Service; C:\Program Files\Origin\OriginWebHelperService.exe [2195472 2016-09-16] (Electronic Arts)
S4 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [76888 2016-08-23] ()
S4 Razer Game Scanner Service; C:\Program Files\Razer\Razer Services\GSS\GameScannerService.exe [187048 2015-06-23] ()
R2 RzKLService; C:\Program Files\Razer\Razer Cortex\RzKLService.exe [129168 2015-07-14] (Razer Inc.)
S4 TunngleService; C:\Program Files\Tunngle\TnglCtrl.exe [758224 2013-11-06] (Tunngle.net GmbH) [Datei ist nicht signiert]
R2 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2013-05-27] (Microsoft Corporation)
S4 Hamachi2Svc; "C:\Program Files\LogMeIn Hamachi\hamachi-2.exe" -s [X]
===================== Treiber (Nicht auf der Ausnahmeliste) ======================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
S3 cpudrv; C:\Program Files\SystemRequirementsLab\cpudrv.sys [11336 2011-06-02] ()
R1 ElbyCDIO; C:\Windows\System32\Drivers\ElbyCDIO.sys [30616 2013-03-04] (Elaborate Bytes AG)
S3 hamachi; C:\Windows\System32\DRIVERS\hamachi.sys [26176 2009-03-18] (LogMeIn, Inc.)
S3 ipadtst; C:\Program Files\MSI\Super-Charger\ipadtst.sys [14576 2013-02-04] (Windows (R) 2000 DDK provider)
S3 ISCT; C:\Windows\System32\DRIVERS\ISCTD.sys [40936 2013-02-13] ()
R0 iusb3hcs; C:\Windows\System32\DRIVERS\iusb3hcs.sys [16880 2013-04-26] (Intel Corporation)
R3 iusb3hub; C:\Windows\System32\DRIVERS\iusb3hub.sys [361968 2013-04-26] (Intel Corporation)
R3 iusb3xhc; C:\Windows\System32\DRIVERS\iusb3xhc.sys [793072 2013-04-26] (Intel Corporation)
R3 MEI; C:\Windows\System32\DRIVERS\HECI.sys [56432 2013-01-11] (Intel Corporation)
R3 NTIOLib_1_0_3; C:\Program Files\MSI\Super-Charger\NTIOLib.sys [14392 2012-10-26] (MSI)
R3 nvvad_WaveExtensible; C:\Windows\System32\drivers\nvvad32v.sys [42128 2015-12-18] (NVIDIA Corporation)
R2 rzpmgrk; C:\Windows\system32\drivers\rzpmgrk.sys [20288 2015-06-12] (Razer, Inc.)
S3 SCREAMINGBDRIVER; C:\Windows\System32\drivers\ScreamingBAudio.sys [34896 2012-07-31] (Screaming Bee LLC)
S3 ssudserd; C:\Windows\System32\DRIVERS\ssudserd.sys [181432 2012-02-24] (DEVGURU Co., LTD.(www.devguru.co.kr))
R3 tap0901t; C:\Windows\System32\DRIVERS\tap0901t.sys [27136 2009-09-16] (Tunngle.net)
S3 AmdLLD; system32\DRIVERS\AmdLLD.sys [X]
U0 aswVmm; kein ImagePath
S3 BRDriver_1_3_3_E02B25FC; \??\C:\ProgramData\BitRaider\support\1.3.3\E02B25FC\BRDriver.sys [X]
S3 EagleXNt; \??\C:\Windows\system32\drivers\EagleXNt.sys [X]
S3 eapihdrv; \??\C:\Users\KINGHA~1\AppData\Local\Temp\ehdrv.sys [X]
S3 NTIOLib_1_0_C; \??\E:\NTIOLib.sys [X]
S3 xhunter1; \??\C:\Windows\xhunter1.sys [X]
==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
==================== Ein Monat: Erstellte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-10-10 22:00 - 2016-10-10 22:00 - 00000000 ____D C:\Users\King Haze\Downloads\FRST-OlderVersion
2016-10-10 16:34 - 2016-10-10 16:34 - 00003410 _____ C:\Users\King Haze\Desktop\JRT.txt
2016-10-10 16:32 - 2016-10-10 16:32 - 01631928 _____ (Malwarebytes) C:\Users\King Haze\Desktop\JRT.exe
2016-10-10 16:28 - 2016-10-10 16:28 - 03874368 _____ C:\Users\King Haze\Desktop\adwcleaner_6.021.exe
2016-10-10 11:38 - 2016-10-10 20:01 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2016-10-10 11:33 - 2016-10-10 12:08 - 00000000 ____D C:\Users\King Haze\Desktop\mbar
2016-10-10 11:32 - 2016-10-10 11:32 - 16563352 _____ (Malwarebytes Corp.) C:\Users\King Haze\Desktop\mbar-1.09.3.1001.exe
2016-10-02 03:11 - 2016-10-10 22:00 - 00015915 _____ C:\Users\King Haze\Downloads\FRST.txt
2016-10-02 03:11 - 2016-10-05 17:14 - 00070647 _____ C:\Users\King Haze\Downloads\Addition.txt
2016-10-02 03:10 - 2016-10-10 22:00 - 01757184 _____ (Farbar) C:\Users\King Haze\Downloads\FRST.exe
2016-10-01 19:54 - 2016-10-01 20:19 - 00012872 _____ (SurfRight B.V.) C:\Windows\system32\bootdelete.exe
2016-10-01 19:35 - 2016-10-01 19:35 - 00001905 _____ C:\Users\Public\Desktop\HitmanPro.lnk
2016-10-01 19:35 - 2016-10-01 19:35 - 00000000 ____D C:\Program Files\HitmanPro
2016-10-01 19:34 - 2016-10-01 19:55 - 00000000 ____D C:\ProgramData\HitmanPro
2016-10-01 19:34 - 2016-10-01 19:34 - 11003784 _____ (SurfRight B.V.) C:\Users\King Haze\Downloads\hitmanpro.exe
2016-09-23 09:05 - 2016-09-23 09:05 - 00000000 ____D C:\Program Files\Common Files\DESIGNER
2016-09-16 14:17 - 2016-09-16 14:17 - 00000000 ____D C:\Users\King Haze\.Origin
2016-09-13 18:07 - 2016-09-13 18:07 - 05384616 _____ (Canneverbe Limited ) C:\Users\King Haze\Downloads\cdbxp_setup_4.5.7.6321_minimal.exe
2016-09-13 18:07 - 2016-09-13 18:07 - 00001895 _____ C:\Users\Public\Desktop\CDBurnerXP.lnk
2016-09-13 18:07 - 2016-09-13 18:07 - 00001845 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\CDBurnerXP.lnk
2016-09-13 18:07 - 2016-09-13 18:07 - 00000000 ____D C:\ProgramData\Canneverbe Limited
2016-09-13 18:07 - 2016-09-13 18:07 - 00000000 ____D C:\Program Files\CDBurnerXP
2016-09-13 16:09 - 2016-09-13 16:59 - 4285749248 _____ C:\Users\King Haze\Downloads\Win10_1607_German_x64.iso
2016-09-13 15:42 - 2016-09-13 15:45 - 00000000 ____D C:\Users\King Haze\Downloads\dx_deutsch
2016-09-13 15:42 - 2016-09-13 15:42 - 01439828 _____ C:\Users\King Haze\Downloads\dx_deutsch.zip
2016-09-13 15:26 - 2016-09-13 15:39 - 00000000 ____D C:\Users\King Haze\Downloads\Deus Ex Sprachebackup
2016-09-11 13:26 - 2016-09-11 13:26 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Deus Ex - HDTP Release 3
2016-09-11 11:10 - 2016-09-11 13:35 - 00000000 ____D C:\Users\King Haze\Documents\Deus Ex
2016-09-10 17:23 - 2016-10-10 11:52 - 00000000 ____D C:\Users\King Haze\Desktop\Deus.Ex.Human.Revolution.Directors.Cut
==================== Ein Monat: Geänderte Dateien und Ordner ========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)
2016-10-10 22:00 - 2015-07-09 15:46 - 00000000 ____D C:\FRST
2016-10-10 21:20 - 2013-12-28 21:00 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2016-10-10 20:11 - 2009-07-14 06:34 - 00033632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-10-10 20:11 - 2009-07-14 06:34 - 00033632 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-10-10 20:06 - 2013-12-29 05:37 - 00710502 _____ C:\Windows\system32\perfh007.dat
2016-10-10 20:06 - 2013-12-29 05:37 - 00154832 _____ C:\Windows\system32\perfc007.dat
2016-10-10 20:06 - 2010-11-20 23:01 - 01651686 _____ C:\Windows\system32\PerfStringBackup.INI
2016-10-10 20:06 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\inf
2016-10-10 20:01 - 2009-07-14 06:53 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2016-10-10 16:30 - 2015-07-09 17:10 - 00000000 ____D C:\AdwCleaner
2016-10-10 11:55 - 2015-05-15 09:49 - 00094936 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamchameleon.sys
2016-10-10 11:55 - 2014-04-06 03:27 - 00170200 _____ (Malwarebytes) C:\Windows\system32\Drivers\mbamswissarmy.sys
2016-10-10 11:52 - 2014-11-27 18:28 - 00000000 ____D C:\Program Files\Deus.Ex.Human.Revolution.Directors.Cut
2016-10-10 11:37 - 2013-12-28 21:16 - 00000000 ____D C:\ProgramData\AVAST Software
2016-10-05 17:14 - 2016-08-04 12:03 - 00000000 ___RD C:\Users\King Haze\Desktop\Text & Temporär
2016-10-01 20:47 - 2013-12-29 13:01 - 00000000 ____D C:\Users\King Haze\AppData\Local\CrashDumps
2016-09-23 09:06 - 2016-04-28 05:34 - 00000000 ____D C:\ProgramData\regid.1991-06.com.microsoft
2016-09-23 09:05 - 2009-07-14 04:37 - 00000000 ____D C:\Program Files\Common Files\microsoft shared
2016-09-23 09:04 - 2016-04-28 05:30 - 00000000 ____D C:\Program Files\Microsoft Office
2016-09-22 18:44 - 2013-12-28 23:04 - 00000000 ____D C:\Users\King Haze\AppData\Roaming\TS3Client
2016-09-22 18:30 - 2016-08-04 12:00 - 00000000 ___RD C:\Users\King Haze\Desktop\Games
2016-09-16 14:33 - 2014-10-04 21:29 - 00000000 ____D C:\ProgramData\Origin
2016-09-16 14:32 - 2014-10-04 21:31 - 00000000 ____D C:\Users\King Haze\AppData\Roaming\Origin
2016-09-16 14:17 - 2014-10-04 21:29 - 00000000 ____D C:\Program Files\Origin
2016-09-16 14:17 - 2013-12-28 20:52 - 00000000 ____D C:\Users\King Haze
2016-09-13 14:20 - 2013-12-28 21:00 - 00796352 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2016-09-13 14:20 - 2013-12-28 21:00 - 00142528 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2016-09-13 14:20 - 2013-12-28 21:00 - 00000000 ____D C:\Windows\system32\Macromed
2016-09-11 10:53 - 2016-08-30 17:45 - 00000000 ____D C:\Users\King Haze\AppData\Local\dxhr
2016-09-11 10:50 - 2014-04-11 18:37 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GOG.com
2016-09-11 10:50 - 2014-04-11 18:36 - 00000000 ____D C:\GOG Games
2016-09-11 10:50 - 2009-07-14 06:52 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Games
2016-09-11 10:32 - 2009-07-14 04:37 - 00000000 ____D C:\Windows\LiveKernelReports
2016-09-11 01:41 - 2014-01-08 15:05 - 00000000 ____D C:\Users\King Haze\AppData\Roaming\uTorrent
==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======
2016-07-17 13:35 - 2016-08-01 21:31 - 0000134 _____ () C:\Users\King Haze\AppData\Roaming\CSharpAnalytics-MeasurementQueue
2016-07-17 11:13 - 2016-08-01 21:31 - 0000443 _____ () C:\Users\King Haze\AppData\Roaming\CSharpAnalytics-MeasurementSession
2013-12-31 00:36 - 2014-10-05 01:05 - 0138056 _____ () C:\Users\King Haze\AppData\Roaming\PnkBstrK.sys
2006-12-11 20:13 - 2006-12-11 20:13 - 0097336 _____ (Un4seen Developments) C:\Users\King Haze\AppData\Local\bass.dll
2006-12-11 20:13 - 2006-12-11 20:13 - 0013872 _____ (Un4seen Developments) C:\Users\King Haze\AppData\Local\basscd.dll
2007-08-13 18:46 - 2007-08-13 18:46 - 0102912 _____ (Albert L Faber) C:\Users\King Haze\AppData\Local\CDRip.dll
2014-06-01 06:50 - 2014-06-01 06:50 - 0003584 _____ () C:\Users\King Haze\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2007-08-13 18:46 - 2007-08-13 18:46 - 0155136 _____ () C:\Users\King Haze\AppData\Local\lame_enc.dll
2007-01-18 22:09 - 2007-01-18 22:09 - 0623616 _____ (Ivan Bischof ©2003 - 2005) C:\Users\King Haze\AppData\Local\No23 Recorder.exe
2005-08-23 23:34 - 2005-08-23 23:34 - 0029184 _____ () C:\Users\King Haze\AppData\Local\no23xwrapper.dll
2006-10-26 02:06 - 2006-10-26 02:06 - 0015872 _____ () C:\Users\King Haze\AppData\Local\ogg.dll
2015-01-12 14:29 - 2016-08-20 13:31 - 0001485 _____ () C:\Users\King Haze\AppData\Local\RecConfig.xml
2015-05-31 00:01 - 2016-05-11 18:32 - 0007615 _____ () C:\Users\King Haze\AppData\Local\Resmon.ResmonCfg
2006-10-26 02:06 - 2006-10-26 02:06 - 0143872 _____ () C:\Users\King Haze\AppData\Local\vorbis.dll
2006-10-26 02:06 - 2006-10-26 02:06 - 0064000 _____ () C:\Users\King Haze\AppData\Local\vorbisenc.dll
2006-10-26 02:06 - 2006-10-26 02:06 - 0019456 _____ () C:\Users\King Haze\AppData\Local\vorbisfile.dll
Einige Dateien in TEMP:
====================
C:\Users\King Haze\AppData\Local\Temp\131144884690305829.exe
C:\Users\King Haze\AppData\Local\Temp\49f4f964ca5e2cb26657bac991c10e7e.dll
C:\Users\King Haze\AppData\Local\Temp\ed6e8e8c4b588010c8f64663407c6196.dll
C:\Users\King Haze\AppData\Local\Temp\jre-8u101-windows-au.exe
C:\Users\King Haze\AppData\Local\Temp\proxy_vole196755273912063042.dll
C:\Users\King Haze\AppData\Local\Temp\proxy_vole2498957098586415027.dll
C:\Users\King Haze\AppData\Local\Temp\proxy_vole3320793795331912142.dll
C:\Users\King Haze\AppData\Local\Temp\yiey0l6p.dll
==================== Bamital & volsnap ======================
(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)
C:\Windows\explorer.exe => Datei ist digital signiert
C:\Windows\system32\winlogon.exe => Datei ist digital signiert
C:\Windows\system32\wininit.exe => Datei ist digital signiert
C:\Windows\system32\svchost.exe => Datei ist digital signiert
C:\Windows\system32\services.exe => Datei ist digital signiert
C:\Windows\system32\User32.dll => Datei ist digital signiert
C:\Windows\system32\userinit.exe => Datei ist digital signiert
C:\Windows\system32\rpcss.dll => Datei ist digital signiert
C:\Windows\system32\dnsapi.dll => Datei ist digital signiert
C:\Windows\system32\Drivers\volsnap.sys => Datei ist digital signiert
LastRegBack: 2016-10-05 15:39
==================== Ende vom FRST.txt ============================
Code:
ATTFilter Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x86) Version: 09-10-2016
durchgeführt von King Haze (10-10-2016 22:00:53)
Gestartet von C:\Users\King Haze\Downloads
Microsoft Windows 7 Professional Service Pack 1 (X86) (2013-12-28 18:52:39)
Start-Modus: Normal
==========================================================
==================== Konten: =============================
Administrator (S-1-5-21-2290024371-3984154701-145341786-500 - Administrator - Disabled)
ASPNET (S-1-5-21-2290024371-3984154701-145341786-1003 - Limited - Enabled)
Gast (S-1-5-21-2290024371-3984154701-145341786-501 - Limited - Disabled)
King Haze (S-1-5-21-2290024371-3984154701-145341786-1000 - Administrator - Enabled) => C:\Users\King Haze
==================== Sicherheits-Center ========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)
AS: Windows Defender (Enabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installierte Programme ======================
(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)
Adobe Acrobat Reader DC - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.017.20053 - Adobe Systems Incorporated)
Adobe Flash Player 23 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 23.0.0.162 - Adobe Systems Incorporated)
Adobe Flash Player 23 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 23.0.0.162 - Adobe Systems Incorporated)
Audacity 2.0.5 (HKLM\...\Audacity_is1) (Version: 2.0.5 - Audacity Team)
Avira (HKLM\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Battle for Wesnoth 1.10.4 (HKLM\...\Battle for Wesnoth 1.10.4) (Version: 1.10.4 - )
Battle for Wesnoth 1.12.2 (HKLM\...\Battle for Wesnoth 1.12.2) (Version: 1.12.2 - )
Battle for Wesnoth 1.12.4 (HKLM\...\Battle for Wesnoth 1.12.4) (Version: 1.12.4 - )
Battle.net (HKLM\...\Battle.net) (Version: - Blizzard Entertainment)
Battlelog Web Plugins (HKLM\...\Battlelog Web Plugins) (Version: 2.5.1 - EA Digital Illusions CE AB)
BitRaider Streaming Client (HKLM\...\BitRaider Streaming Client) (Version: 1.3.3.4098 - BitRaider, LLC)
Blacklight: Retribution (HKLM\...\Steam App 209870) (Version: - Zombie, Inc.)
Bloody Walls (HKLM\...\Steam App 531960) (Version: - L. Stotch)
Boid (HKLM\...\Steam App 314010) (Version: - Mokus)
Borderlands 2 (HKLM\...\Steam App 49520) (Version: - Gearbox Software)
Card Hunter (HKLM\...\Steam App 293260) (Version: - Blue Manchu)
CCleaner (HKLM\...\CCleaner) (Version: 5.19 - Piriform)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.7.6321 - CDBurnerXP)
Chronicle: RuneScape Legends (HKLM\...\Steam App 205890) (Version: - Jagex)
CLEO 4.3 (HKLM\...\{A8F37EB0-C741-41D7-8CAB-5B40ECEEF094}_is1) (Version: 4.3 - Seemann, Deji, Alien)
Counter-Strike: Global Offensive (HKLM\...\Steam App 730) (Version: - Valve)
Creativerse (HKLM\...\Steam App 280790) (Version: - Playful Corporation)
Curse (HKLM\...\{1F2611FB-6F69-4AA8-BECD-243BD8CB45F3}) (Version: 6.0.0.0 - Curse)
Deus Ex - HDTP Release 3 (HKLM\...\HDTPr2_is1) (Version: 1.0 - HDTP Team)
Deus Ex GOTY (HKLM\...\GOGPACKDEUSEX_is1) (Version: 2.0.0.11 - GOG.com)
Deus Ex New Vision (HKLM\...\Deus Ex New Vision) (Version: 1.5 - DaveW)
Dirty Bomb (HKLM\...\Steam App 333930) (Version: - Splash Damage®)
Discord (HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\Discord) (Version: 0.0.296 - Hammer & Chisel, Inc.)
DNDownloader version 1.2 (HKLM\...\DNDownloader_is1) (Version: 1.2 - )
Don't Starve (HKLM\...\GOGPACKDONTSTARVE_is1) (Version: 2.7.0.16 - GOG.com)
Dr. Langeskov, The Tiger, and The Terribly Cursed Emerald: A Whirlwind Heist (HKLM\...\Steam App 409160) (Version: - Crows Crows Crows)
Dragon Age 2 (HKLM\...\{94C4C4F4-56FB-4032-908D-826220CBB97F}_is1) (Version: 1.04 - Bioware)
Dragon Age: Origins (HKLM\...\{AEC81925-9C76-4707-84A9-40696C613ED3}) (Version: 1.04 - Electronic Arts, Inc.)
Dragonball Xenoverse (HKLM\...\Dragonball Xenoverse_is1) (Version: - )
Dragonball Xenoverse Update 6 MULTi2 1.0 (HKLM\...\Dragonball Xenoverse Update 6 MULTi2 1.0) (Version: - )
Duelyst (HKLM\...\Steam App 291410) (Version: - Counterplay Games Inc.)
Dungeon Defenders II (HKLM\...\Steam App 236110) (Version: - Trendy Entertainment)
Dxtory version 2.0.126 (HKLM\...\Dxtory2.0_is1) (Version: 2.0.126 - ExKode Co. Ltd.)
Electric Highways (HKLM\...\Steam App 412140) (Version: - Zykov Eddy)
Endless Sky (HKLM\...\Steam App 404410) (Version: - Michael Zahniser)
EpicGear Meduza HDST Mouse (HKLM\...\InstallShield_{D348D476-3A04-4AA0-B094-954138A844CF}) (Version: 1.00.0000 - Epicgear)
Fallout Mod Manager 0.13.21 (HKLM\...\Generic Mod Manager_is1) (Version: - Q, Timeslip)
Far Cry 3 (HKLM\...\{E3B9C5A9-BD7A-4B56-B754-FAEA7DD6FA88}) (Version: 1.04 - Ubisoft)
Fraps (remove only) (HKLM\...\Fraps) (Version: - )
Free YouTube to MP3 Converter version 3.12.56.301 (HKLM\...\Free YouTube to MP3 Converter_is1) (Version: 3.12.56.301 - DVDVideoSoft Ltd.)
Guild Wars 2 (HKLM\...\Guild Wars 2) (Version: - NCsoft Corporation, Ltd.)
Hearthstone (HKLM\...\Hearthstone) (Version: - Blizzard Entertainment)
Heroes of the Storm (HKLM\...\Heroes of the Storm) (Version: - Blizzard Entertainment)
Hi-Rez Studios Authenticate and Update Service (HKLM\...\{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}) (Version: 3.0.0.0 - Hi-Rez Studios)
Hitman Absolution (HKLM\...\Hitman Absolution_is1) (Version: - )
HitmanPro 3.7 (HKLM\...\HitmanPro37) (Version: 3.7.14.280 - SurfRight B.V.)
inSSIDer Home (HKLM\...\{9E54E4AE-B67A-4925-8E92-0E1F9817FD73}) (Version: 3.1.2.1 - MetaGeek, LLC)
Intel(R) Control Center (HKLM\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1011 - Intel Corporation)
Intel(R) Management Engine Components (HKLM\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.0.10.1372 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 2.5.0.19 - Intel Corporation)
Java 8 Update 101 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F32180101F0}) (Version: 8.0.1010.13 - Oracle Corporation)
JDownloader 2 (HKLM\...\jdownloader2) (Version: 2.0 - AppWork GmbH)
LAME v3.99.3 (for Windows) (HKLM\...\LAME_is1) (Version: - )
League of Legends (HKLM\...\League of Legends 3.0.1) (Version: 3.0.1 - Riot Games )
League of Legends (Version: 3.0.1 - Riot Games ) Hidden
Life Is Strange™ (HKLM\...\Steam App 319630) (Version: - DONTNOD Entertainment)
LIMBO (HKLM\...\Steam App 48000) (Version: - Playdead)
LogMeIn Hamachi (HKLM\...\LogMeIn Hamachi) (Version: 2.2.0.410 - LogMeIn, Inc.)
LogMeIn Hamachi (Version: 2.2.0.410 - LogMeIn, Inc.) Hidden
Magic Duels (HKLM\...\Steam App 316010) (Version: - Stainless Games Ltd.)
Malwarebytes Anti-Malware Version 2.2.1.1043 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.2.1.1043 - Malwarebytes)
Mass Effect (HKLM\...\Steam App 17460) (Version: - BioWare)
Mass Effect 2 (HKLM\...\Steam App 24980) (Version: - BioWare)
Mass Effect™ 3 (HKLM\...\{534A31BD-20F4-46b0-85CE-09778379663C}) (Version: 1.05.0.0 - Electronic Arts)
MechWarrior Online (HKLM\...\Steam App 342200) (Version: - Piranha Games Inc.)
Meduza HDST Mouse (Version: 1.00.0000 - Epicgear) Hidden
Microsoft .NET Framework 1.1 (HKLM\...\{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}) (Version: 1.1.4322 - Microsoft)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft ASP.NET MVC 4 Runtime (HKLM\...\{3FE312D5-B862-40CE-8E4E-A6D8ABF62736}) (Version: 4.0.40804.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Office 365 ProPlus - de-de (HKLM\...\O365ProPlusRetail - de-de) (Version: 16.0.6741.2071 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\OneDriveSetup.exe) (Version: 17.3.5951.0827 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM\...\{f65db027-aff3-4070-886a-0d87064aabb1}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual C++ 2015 Redistributable (x86) - 14.0.24210 (HKLM\...\{23658c02-145e-483d-ba6b-1eb82c580529}) (Version: 14.0.24210.0 - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Minecraft1.7.2 (HKLM\...\Minecraft1.7.2) (Version: - )
Moirai (HKLM\...\Steam App 496920) (Version: - Chris Johnson)
Monaco (HKLM\...\Steam App 113020) (Version: - Pocketwatch Games)
Mozilla Firefox 48.0 (x86 de) (HKLM\...\Mozilla Firefox 48.0 (x86 de)) (Version: 48.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 29.0.1 - Mozilla)
Nexus Mod Manager (HKLM\...\6af12c54-643b-4752-87d0-8335503010de_is1) (Version: 0.51.0 - Black Tree Gaming)
No23 Recorder (HKLM\...\{22B0E143-2B0B-435B-9F56-136A3D16065F}) (Version: 2.1.0.3 - No23)
NVIDIA GeForce Experience 2.9.1.22 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.GFExperience) (Version: 2.9.1.22 - NVIDIA Corporation)
NVIDIA Grafiktreiber 365.10 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 365.10 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.34.4 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.34.4 - NVIDIA Corporation)
NVIDIA PhysX-Systemsoftware 9.15.0428 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX) (Version: 9.15.0428 - NVIDIA Corporation)
Office 16 Click-to-Run Extensibility Component (Version: 16.0.6701.1041 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Licensing Component (Version: 16.0.6701.1041 - Microsoft Corporation) Hidden
Office 16 Click-to-Run Localization Component (Version: 16.0.6701.1041 - Microsoft Corporation) Hidden
Open Broadcaster Software (HKLM\...\Open Broadcaster Software) (Version: - )
OpenAL (HKLM\...\OpenAL) (Version: - )
OpenOffice 4.1.1 (HKLM\...\{ACD0FFF9-6B35-43C1-82DB-9FF6990E8602}) (Version: 4.11.9775 - Apache Software Foundation)
Orcs Must Die! Unchained (HKLM\...\Steam App 427270) (Version: - Robot Entertainment)
Origin (HKLM\...\Origin) (Version: 9.4.22.2815 - Electronic Arts, Inc.)
Outlast: Whistleblower (HKLM\...\T3V0bGFzdFdoaXN0bGVibG93ZXI=_is1) (Version: 1 - )
Path of Exile (HKLM\...\Steam App 238960) (Version: - Grinding Gear Games)
PAYDAY 2 (HKLM\...\Steam App 218620) (Version: - OVERKILL - a Starbreeze Studio.)
PCSX2 - Playstation 2 Emulator (HKLM\...\pcsx2) (Version: - )
Planescape Torment (HKLM\...\Planescape Torment_is1) (Version: - GOG.com)
Portal 2 (HKLM\...\Steam App 620) (Version: - Valve)
Razer Cortex (HKLM\...\Razer Cortex_is1) (Version: 6.0.29.0 - Razer Inc.)
RE_BH 6 AIO [W.B] (Version: 1.0 - Warlord Blade) Hidden
Realtek Ethernet Controller Driver (HKLM\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.72.410.2013 - Realtek)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6959 - Realtek Semiconductor Corp.)
Relic Hunters Zero (HKLM\...\Steam App 382490) (Version: - Rogue Snail)
RIFT (HKLM\...\Steam App 39120) (Version: - Trion Worlds)
S.T.A.L.K.E.R. - Shadow of Chernobyl (HKLM\...\S.T.A.L.K.E.R. - Shadow of Chernobyl_is1) (Version: 1.0000 - THQ)
S.T.A.L.K.E.R.: Lost Alpha version 1.3003 (HKLM\...\S.T.A.L.K.E.R.: Lost Alpha_is1) (Version: 1.3003 - dezowave)
Saints Row IV (HKLM\...\Steam App 206420) (Version: - Deep Silver Volition)
Samsung_MonSetup (HKLM\...\{8EA79DBF-D637-448A-89D6-410A087A4493}) (Version: 1.00.0000 - Samsung)
SHIELD Streaming (Version: 4.1.0260 - NVIDIA Corporation) Hidden
SHIELD Wireless Controller Driver (Version: 2.9.1.22 - NVIDIA Corporation) Hidden
SkySaga Infinite Isles (HKLM\...\SkySaga Infinite Isles 1.0.3652.0) (Version: 1.0.3652.0 - Radiant Worlds)
SkySaga Infinite Isles (Version: 1.0.3652.0 - Radiant Worlds) Hidden
SMITE (HKLM\...\Steam App 386360) (Version: - Hi-Rez Studios)
Sniper Elite V2 (HKLM\...\Steam App 63380) (Version: - Rebellion)
Splinter Cell Pandora Tomorrow (HKLM\...\{084A9731-D05B-4ADA-B4A0-0ADD25FD7152}) (Version: 1.00.000 - )
Spotify (HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\Spotify) (Version: 1.0.13.108.gcd94e7db - Spotify AB)
Star Wars: The Old Republic (HKLM\...\{3B11D799-48E0-48ED-BFD7-EA655676D8BB}) (Version: 1.00 - Electronic Arts, Inc.)
StarCraft II (HKLM\...\StarCraft II) (Version: - Blizzard Entertainment)
Steam (HKLM\...\Steam) (Version: - Valve Corporation)
Super-Charger (HKLM\...\{7CDF10DD-A9B5-4DA3-AB95-E193248D4369}_is1) (Version: 1.2.018 - MSI)
Sven Co-op (HKLM\...\Steam App 225840) (Version: - Sven Co-op Team)
System Requirements Lab CYRI (HKLM\...\{19B0831B-0C18-4103-86E4-90FCD04CD3B9}) (Version: 6.0.12.5 - Husdawg, LLC)
System Requirements Lab for Intel (HKLM\...\{1EBDF6D2-CEA0-484C-A23E-2DDAD7FD0DD0}) (Version: 4.5.22.0 - Husdawg, LLC)
Team Fortress 2 (HKLM\...\Steam App 440) (Version: - Valve)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.15 - TeamSpeak Systems GmbH)
The Expendabros (HKLM\...\Steam App 312990) (Version: - Free Lives)
The Walking Dead - Season 2 (HKLM\...\The Walking Dead - Season 2_R.G. Mechanics_is1) (Version: - R.G. Mechanics, spider91)
Thunder Master v1.9 (HKLM\...\{EE04522C-0814-4B63-AE57-0B63E5A355BB}_is1) (Version: 1.9.7.4 - Palit Microsystems Ltd.)
Tom Clancy's Splinter Cell (HKLM\...\Uplay Install 109) (Version: - Ubisoft)
Tom Clancys Splinter Cell Chaos Theory MULTi6 - ElAmigos Version 1.05.157 (HKLM\...\{B26428C7-19FA-41C9-8948-DA42A80738D4}_is1) (Version: 1.05.157 - Ubisoft)
TP-LINK TL-WN781ND Driver (HKLM\...\{87C7B472-9BC2-43C8-9F03-86D2908E1A51}) (Version: 1.3.1 - TP-LINK)
Transmissions: Element 120 (HKLM\...\Steam App 365300) (Version: - Shokunin)
Tunngle beta (HKLM\...\Tunngle beta_is1) (Version: - Tunngle.net GmbH)
Unity Web Player (HKU\S-1-5-21-2290024371-3984154701-145341786-1000\...\UnityWebPlayer) (Version: 5.3.5f1 - Unity Technologies ApS)
Unturned (HKLM\...\Steam App 304930) (Version: - Nelson Sexton)
Uplay (HKLM\...\Uplay) (Version: 21.1 - Ubisoft)
VGA Boost (HKLM\...\{809ACFAE-9A4D-4C60-9223-D8B615CD8CBA}}_is1) (Version: 1.0.0.5 - MSI)
VirtualCloneDrive (HKLM\...\VirtualCloneDrive) (Version: 5.4.7.0 - Elaborate Bytes)
Vulkan Run Time Libraries 1.0.8.1 (HKLM\...\VulkanRT1.0.8.1) (Version: 1.0.8.1 - LunarG, Inc.)
Warcraft III eSK 1.26.0.6401 (HKLM\...\Warcraft III eSK 1.26.0.6401) (Version: - )
Warcraft III Reign of Chaos & The Frozen Throne (HKLM\...\Warcraft III Reign of Chaos & The Frozen Throne) (Version: - )
Warframe (HKLM\...\Steam App 230410) (Version: - Digital Extremes)
Winamp (HKLM\...\Winamp) (Version: 5.666 - Nullsoft, Inc)
Windows Live ID Sign-in Assistant (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)
WinRAR 5.01 (32-Bit) (HKLM\...\WinRAR archiver) (Version: 5.01.0 - win.rar GmbH)
XCOM: Enemy Unknown (HKLM\...\Steam App 200510) (Version: - Firaxis Games)
Xiph.Org Open Codecs 0.85.17777 (HKLM\...\Open Codecs) (Version: 0.85.17777 - Xiph.Org)
YAWLE 0.5b (HKLM\...\Yawle_0.3b) (Version: - )
==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
CustomCLSID: HKU\S-1-5-21-2290024371-3984154701-145341786-1000_Classes\CLSID\{444785F1-DE89-4295-863A-D46C3A781394}\InprocServer32 -> C:\Users\King Haze\AppData\LocalLow\Unity\WebPlayer\loader\UnityWebPluginAX.ocx (Unity Technologies ApS)
==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
Task: {16A29C3F-CE41-4FAA-A392-3D8B11101635} - System32\Tasks\{AF2EA78A-951E-4613-87F6-3509A1D28393} => pcalua.exe -a "d:\program files\hi-rez studios\HiRezGamesDiagAndSupport.exe" -c uninstall=402
Task: {1E2282BC-E8DB-4833-BA6D-E00C3BF928DF} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2016-09-13] (Adobe Systems Incorporated)
Task: {2EDB5D3D-D706-4D1C-9A8C-FEEC603098B7} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2016-06-10] (Piriform Ltd)
Task: {57FC6433-E11B-40DD-B122-D8F6FFFF3A09} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentLogOn2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-09-05] (Microsoft Corporation)
Task: {6F000B63-6529-47B5-8B01-0430453D95AF} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonx86\Microsoft Shared\Office16\OLicenseHeartbeat.exe [2016-09-05] (Microsoft Corporation)
Task: {953934DB-AAA9-4582-8D04-E71B3F81238C} - System32\Tasks\AVAST Software\Avast settings backup => C:\Program Files\Common Files\AV\avast! Antivirus\backup.exe [2016-06-03] (AVAST Software)
Task: {96BE8AAE-BAF4-4FD8-8AEF-56E354A0F223} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-09-04] (Microsoft Corporation)
Task: {A12C1782-AEE2-4924-8382-09F77582A172} - System32\Tasks\{0673662D-D139-4954-8D14-B63BA1BC66CE} => pcalua.exe -a "C:\Users\King Haze\Downloads\dxwebsetup(1).exe" -d "C:\Users\King Haze\Downloads"
Task: {C02E1E04-3986-42E5-AE97-20B240390DD7} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Common Files\Microsoft Shared\ClickToRun\OfficeC2RClient.exe [2016-09-04] (Microsoft Corporation)
Task: {CB357DDA-1DBD-4048-A727-30403449E685} - System32\Tasks\{F255CCAF-9B4E-494F-AD7F-FD8AFEEEA648} => pcalua.exe -a "C:\Program Files\MonitorDriver\MonSetup.exe" -d "C:\Users\King Haze\Desktop"
Task: {D0850805-2C34-4B11-8F59-6A1FE909BE5D} - System32\Tasks\Microsoft\Office\OfficeTelemetryAgentFallBack2016 => C:\Program Files\Microsoft Office\root\Office16\msoia.exe [2016-09-05] (Microsoft Corporation)
Task: {D2297DAC-AA39-4F61-9113-D2534373015E} - System32\Tasks\{98C6A655-E96E-44C4-90FC-1670DE772DB2} => pcalua.exe -a "C:\Users\King Haze\Downloads\NewSRInstaller-v1.1-MadeByChewbacca-YurixyWorks\New Summoners Rift Installer.exe" -d "C:\Users\King Haze\Downloads\NewSRInstaller-v1.1-MadeByChewbacca-YurixyWorks"
Task: {EE37BCF6-EB6E-41B5-AC0B-877FEFA1564F} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2016-09-16] (Adobe Systems Incorporated)
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
==================== Verknüpfungen =============================
(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)
==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============
2016-05-05 17:16 - 2016-02-12 04:36 - 00005120 _____ () C:\GeDoSaTo\gedoshim.dll
2015-07-08 14:55 - 2016-04-27 13:22 - 00122936 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax.dll
2016-04-28 05:30 - 2016-09-04 20:53 - 00144576 _____ () C:\Program Files\Common Files\Microsoft Shared\ClickToRun\ApiClient.dll
2015-07-08 14:56 - 2016-01-12 06:43 - 00018880 _____ () C:\Program Files\NVIDIA Corporation\Update Core\detoured.dll
2013-12-28 21:34 - 2013-05-17 01:05 - 01199576 ____R () C:\Program Files\Intel\Intel(R) Management Engine Components\LMS\ACE.dll
==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [322]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [322]
AlternateDataStreams: C:\Users\King Haze:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [322]
AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
AlternateDataStreams: C:\ProgramData\Application Data:NT2 [322]
AlternateDataStreams: C:\Users\King Haze\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\King Haze\Anwendungsdaten:NT2 [322]
AlternateDataStreams: C:\Users\King Haze\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\King Haze\AppData\Roaming:NT2 [322]
==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\Hamachi2Svc => ""="Service"
==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)
==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)
IE trusted site: HKU\.DEFAULT\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\.DEFAULT\...\freerealms.com -> freerealms.com
IE trusted site: HKU\.DEFAULT\...\soe.com -> soe.com
IE trusted site: HKU\.DEFAULT\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-19\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-19\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-19\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-19\...\sony.com -> sony.com
IE trusted site: HKU\S-1-5-20\...\clonewarsadventures.com -> clonewarsadventures.com
IE trusted site: HKU\S-1-5-20\...\freerealms.com -> freerealms.com
IE trusted site: HKU\S-1-5-20\...\soe.com -> soe.com
IE trusted site: HKU\S-1-5-20\...\sony.com -> sony.com
==================== Hosts Inhalt: ===============================
(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)
2009-07-14 04:04 - 2009-06-10 23:39 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Andere Bereiche ============================
(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)
HKU\S-1-5-21-2290024371-3984154701-145341786-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Desktop-Hintergrund.bmp
DNS Servers: 192.168.178.1
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 0)
Windows Firewall ist aktiviert.
==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==
MSCONFIG\Services: DAUpdaterSvc => 3
MSCONFIG\Services: Hamachi2Svc => 2
MSCONFIG\Services: LMIGuardianSvc => 2
MSCONFIG\Services: MBAMScheduler => 2
MSCONFIG\Services: MBAMService => 2
MSCONFIG\Services: PnkBstrA => 2
MSCONFIG\Services: Razer Game Scanner Service => 2
MSCONFIG\Services: RzKLService => 2
MSCONFIG\Services: TunngleService => 3
MSCONFIG\startupfolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^TP-LINK Wireless Configuration Utility.lnk => C:\Windows\pss\TP-LINK Wireless Configuration Utility.lnk.CommonStartup
MSCONFIG\startupreg: Akamai NetSession Interface => "C:\Users\King Haze\AppData\Local\Akamai\netsession_win.exe"
MSCONFIG\startupreg: amd_dc_opt => C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe
MSCONFIG\startupreg: Avira Systray => C:\Program Files\Avira\My Avira\Avira.OE.Systray.exe
MSCONFIG\startupreg: CCleaner Monitoring => "C:\Program Files\CCleaner\CCleaner.exe" /MONITOR
MSCONFIG\startupreg: DAEMON Tools Lite => "C:\Program Files\DAEMON Tools Lite\DTLite.exe" -autorun
MSCONFIG\startupreg: Discord => C:\Users\King Haze\AppData\Local\Discord\app-0.0.295\Discord.exe
MSCONFIG\startupreg: GarenaPlus => "C:\Program Files\Garena Plus\GarenaMessenger.exe" -autolaunch
MSCONFIG\startupreg: LogMeIn Hamachi Ui => "C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe" --auto-start
MSCONFIG\startupreg: MyComGames => "C:\Users\King Haze\AppData\Local\MyComGames\MyComGames.exe" -autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\King Haze\AppData\Roaming\Spotify\SpotifyWebHelper.exe"
MSCONFIG\startupreg: VirtualCloneDrive => "C:\Program Files\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe" /s
MSCONFIG\startupreg: WLAN Optimizer => C:\Users\King Haze\Downloads\wopt021\WLAN Optimizer.exe
==================== FirewallRules (Nicht auf der Ausnahmeliste) ===============
(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)
FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{95E47FEA-A545-461B-B87E-70D896E4B644}] => (Allow) C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
FirewallRules: [{66A5FE03-F7AD-4113-8A55-158F4A57E412}] => (Allow) D:\Programme\Winamp\winamp.exe
FirewallRules: [{7A7A5404-DDA0-4425-B89B-0AF311E8B1F6}] => (Allow) D:\Programme\Winamp\winamp.exe
FirewallRules: [{47D110E2-A70F-420D-B30D-372F12D98046}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{EE5B334E-A5CE-4F5F-8E59-E215B132ECC4}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{EA6619CE-B85F-4345-90EB-B87D3DCC27B2}] => (Allow) D:\Program Files\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{2D7C67BD-548F-4118-AA9E-335ED7C626B6}] => (Allow) D:\Program Files\Steam\SteamApps\common\Team Fortress 2\hl2.exe
FirewallRules: [{07870B6F-6C3B-4726-A180-BB33C92A44E6}] => (Allow) C:\Windows\System32\PnkBstrA.exe
FirewallRules: [{B62DAF84-16F6-47E2-BCBA-CF5A10A90326}] => (Allow) C:\Windows\System32\PnkBstrA.exe
FirewallRules: [{41F32E1D-9161-4128-A5FD-5DFB681AC32E}] => (Allow) C:\Windows\System32\PnkBstrB.exe
FirewallRules: [{41BEF963-2E94-4E7F-B8F2-80FCCDAFDDF8}] => (Allow) C:\Windows\System32\PnkBstrB.exe
FirewallRules: [{32E6557B-3D9E-4379-97D6-FB41571A60E6}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\farcry3.exe
FirewallRules: [{D22DC451-512C-4844-AAB5-C44D0D01FE20}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\farcry3.exe
FirewallRules: [{120008A2-B0A4-4EAD-9C19-13B92D911F84}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\farcry3_d3d11.exe
FirewallRules: [{D8D415BA-6160-42F7-B35A-68370FF7D071}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\farcry3_d3d11.exe
FirewallRules: [{58D38450-3B17-4ACB-8796-21AF1C2E77BD}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\FC3Updater.exe
FirewallRules: [{C90067C7-226B-4150-850E-6215F19A90E3}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\FC3Updater.exe
FirewallRules: [{1DCE4A5B-2489-4311-8D55-E5BDF63B32B1}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\FC3Editor.exe
FirewallRules: [{BD70F1AE-1302-41BE-9E8B-DEB9E476F983}] => (Allow) D:\Program Files\Ubisoft\FarCry 3\bin\FC3Editor.exe
FirewallRules: [{7D76562B-1476-43D3-AC4D-6B27C3DBF000}] => (Allow) D:\Program Files\Steam\SteamApps\common\blacklightretribution\Blacklight Retribution.exe
FirewallRules: [{2B69FB67-543D-4450-8F75-E0A3F737AFF3}] => (Allow) D:\Program Files\Steam\SteamApps\common\blacklightretribution\Blacklight Retribution.exe
FirewallRules: [TCP Query User{E87269CC-0B9C-4611-9C73-DF9D36EE4D2A}D:\programme\outlast\outlast\binaries\win32\olgame.exe] => (Allow) D:\programme\outlast\outlast\binaries\win32\olgame.exe
FirewallRules: [UDP Query User{72B842FA-D136-4755-B36E-6E2A4D26DEF2}D:\programme\outlast\outlast\binaries\win32\olgame.exe] => (Allow) D:\programme\outlast\outlast\binaries\win32\olgame.exe
FirewallRules: [{45213D07-6AD7-41B3-A963-3911242DF487}] => (Allow) C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe
FirewallRules: [{9D5B4CFA-40C8-421E-92D0-E8D1A9A23F6B}] => (Allow) C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\XR_3DA.exe
FirewallRules: [{F0334ED5-FDFF-45FB-9F58-4A61455F205B}] => (Allow) C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe
FirewallRules: [{84D3C170-63DD-4FF5-BD72-254C666D8CE2}] => (Allow) C:\Program Files\THQ\S.T.A.L.K.E.R. - Shadow of Chernobyl\bin\dedicated\XR_3DA.exe
FirewallRules: [TCP Query User{A2A8CD81-E07A-4F93-9210-169C5FBF822C}C:\games\the stanley parable\stanley.exe] => (Block) C:\games\the stanley parable\stanley.exe
FirewallRules: [UDP Query User{B61D3FF5-40CE-465E-A9AA-2553BB98FAB6}C:\games\the stanley parable\stanley.exe] => (Block) C:\games\the stanley parable\stanley.exe
FirewallRules: [{37F7DA4F-DDA4-484D-A443-18882140A472}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{787FC88C-9510-4DE2-A0C7-09A4A8CE9346}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{2B7D7B46-581E-4299-B478-F69161C5EB58}] => (Allow) C:\Program Files\Tunngle\TnglCtrl.exe
FirewallRules: [{7FBB25AB-FC43-474F-9BC1-BBB875183FBF}] => (Allow) C:\Program Files\Tunngle\TnglCtrl.exe
FirewallRules: [{288F009E-9323-4C61-A3B1-A8B276A028E2}] => (Allow) C:\Program Files\Tunngle\Tunngle.exe
FirewallRules: [{295F0203-A546-43FA-B3B5-A35FA4D3D10F}] => (Allow) C:\Program Files\Tunngle\Tunngle.exe
FirewallRules: [{FA38561D-B169-4F3E-AD33-EF5D58BC1425}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{CDCED1DB-24C6-4724-B002-E0E36B7C7C4B}] => (Allow) D:\Program Files\Steam\Steam.exe
FirewallRules: [{32C02294-276F-4370-A921-2E3CB386B02B}] => (Allow) D:\Program Files\Steam\bin\steamwebhelper.exe
FirewallRules: [{4F962B2F-97CB-4C12-9841-110B4A44188B}] => (Allow) D:\Program Files\Steam\bin\steamwebhelper.exe
FirewallRules: [TCP Query User{7EFB85FA-B8E6-4B97-9E44-1F55BBB3F8B8}C:\program files\warcraft iii reign of chaos & the frozen throne\war3.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\war3.exe
FirewallRules: [UDP Query User{6B7574CE-6FD5-4E3A-AAB0-4E33F9E559B9}C:\program files\warcraft iii reign of chaos & the frozen throne\war3.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\war3.exe
FirewallRules: [TCP Query User{45AE972B-32C7-40C5-9713-0C7CB2FCE602}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\war3.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\war3.exe
FirewallRules: [UDP Query User{7A36CB57-4E07-4A91-9EBE-33B7486392BB}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\war3.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\war3.exe
FirewallRules: [TCP Query User{547AB8C3-A76C-485E-83F8-FE2A6287F503}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\yawle.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\yawle.exe
FirewallRules: [UDP Query User{54E96C63-09A0-4C17-A430-8550A1A10644}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\yawle.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\yawle.exe
FirewallRules: [{D1E0AC19-A31E-48CB-AEF7-C7D4DD6AF8CA}] => (Allow) C:\Program Files\Warcraft III Reign of Chaos & The Frozen Throne\Warcraft III Frozen Throne eSK\Frozen Throne.exe
FirewallRules: [{A01507DB-6299-4C12-B05E-77011B76BB92}] => (Allow) C:\Program Files\Warcraft III Reign of Chaos & The Frozen Throne\Warcraft III Frozen Throne eSK\Frozen Throne.exe
FirewallRules: [{B71434FC-BBD9-4DCB-8461-F2F4B700C23E}] => (Allow) C:\Program Files\Warcraft III Reign of Chaos & The Frozen Throne\Warcraft III Frozen Throne eSK\Frozen Throne.exe
FirewallRules: [{40B77E29-A7AB-46A4-8CC9-EF0C7A85E31B}] => (Allow) C:\Program Files\Warcraft III Reign of Chaos & The Frozen Throne\Warcraft III Frozen Throne eSK\Frozen Throne.exe
FirewallRules: [TCP Query User{FA880C85-47B8-4DCB-ACD5-A8101C9D9631}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\nirvana.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\nirvana.exe
FirewallRules: [UDP Query User{D211DF2B-C85F-47AF-B234-7865FDBA6E46}C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\nirvana.exe] => (Allow) C:\program files\warcraft iii reign of chaos & the frozen throne\warcraft iii frozen throne esk\nirvana.exe
FirewallRules: [{07826E19-D989-47A7-966E-EE67F3E5102A}] => (Allow) C:\Program Files\Battle.net\Battle.net.exe
FirewallRules: [{5157BDAD-FD1B-4526-9744-87F56E9DF5C7}] => (Allow) C:\Program Files\Battle.net\Battle.net.exe
FirewallRules: [{298DEB91-9A44-4B35-A458-478B358A289A}] => (Allow) C:\Program Files\Hearthstone\Hearthstone.exe
FirewallRules: [{34B4AC82-12E0-47A8-A3C1-5D6CE51C9630}] => (Allow) C:\Program Files\Hearthstone\Hearthstone.exe
FirewallRules: [{85B2E2CA-C8B7-431E-B41D-3F5F6EFCAE15}] => (Allow) C:\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{666843BE-849A-4D84-8504-6D93EE60DEF8}] => (Allow) C:\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Launcher.exe
FirewallRules: [{03D9A59B-6E34-4B17-A131-2A740D769B24}] => (Allow) C:\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{AA0E8EBD-A4DF-4CD8-B878-667B0301BC18}] => (Allow) C:\Steam\SteamApps\common\Borderlands 2\Binaries\Win32\Borderlands2.exe
FirewallRules: [{1256E77A-D8C2-4434-89A1-C579EC2C1552}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [{AFAA881B-9F0D-4DE2-B01B-939970EAA68F}] => (Allow) C:\Program Files\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{5CF49325-8A71-4DBF-A21D-8334F45F0BBB}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{F5765E85-A311-4D21-BE9B-E406D969AFED}C:\program files\mozilla firefox\firefox.exe] => (Allow) C:\program files\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{AF2E0868-2307-4AF5-90AF-9517288D0E04}C:\program files\wb games\batman arkham city goty\binaries\win32\batmanac_o.exe] => (Allow) C:\program files\wb games\batman arkham city goty\binaries\win32\batmanac_o.exe
FirewallRules: [TCP Query User{60B7BCFE-252C-4A7E-B466-98D3F3D9B38B}C:\steam\steamapps\common\cryptic studios\neverwinter\live\gameclient.exe] => (Allow) C:\steam\steamapps\common\cryptic studios\neverwinter\live\gameclient.exe
FirewallRules: [UDP Query User{774CA783-5F8B-47DF-B9CF-E067A2B28BB8}C:\steam\steamapps\common\cryptic studios\neverwinter\live\gameclient.exe] => (Allow) C:\steam\steamapps\common\cryptic studios\neverwinter\live\gameclient.exe
FirewallRules: [{8DA416F8-5458-4C23-AF33-AA039965B1C3}] => (Allow) C:\Program Files\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{13C30349-17D0-40FD-81B6-589CC9E5AA4E}] => (Allow) C:\Program Files\Dragon Age\bin_ship\daorigins.exe
FirewallRules: [{F8FF2EA9-ECFE-435B-B0A0-B64A6414714F}] => (Allow) C:\Program Files\Dragon Age\DAOriginsLauncher.exe
FirewallRules: [{0BF63947-C866-42AD-8747-4E03DB2E4F18}] => (Allow) C:\Program Files\Dragon Age\DAOriginsLauncher.exe
FirewallRules: [TCP Query User{D22ADA01-C8D1-4B42-8882-585AA15FA11A}C:\program files\dragon age\bin_ship\daorigins.exe] => (Allow) C:\program files\dragon age\bin_ship\daorigins.exe
FirewallRules: [UDP Query User{ACD3783B-D206-4607-B927-16C4D14B7ABE}C:\program files\dragon age\bin_ship\daorigins.exe] => (Allow) C:\program files\dragon age\bin_ship\daorigins.exe
FirewallRules: [{05D16A60-7406-4EB2-9F2B-06A231B1376C}] => (Allow) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{E0A7BB86-16D7-4793-8E41-9B53DF3E884E}] => (Allow) C:\Program Files\NVIDIA Corporation\NetService\NvNetworkService.exe
FirewallRules: [{0AD16971-B7FB-4D36-9188-0F7A6EFBAF9C}] => (Allow) C:\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{C9637076-4BAE-455E-94C4-FFEE3BAC3B32}] => (Allow) C:\Steam\SteamApps\common\Unturned\Unturned.exe
FirewallRules: [{815FA5B9-674A-4D01-941F-E7D8055ED069}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{FD43D18F-692F-4EA8-9E5A-99534609666C}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamNetworkService.exe
FirewallRules: [{425C2EC1-1B3D-4B5F-A8CF-4E9F3269A995}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\NvStreamUserAgent.exe
FirewallRules: [{081DF930-D6A6-489E-9D13-C5A062B557A2}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{40DF7ACC-966D-4CE9-9EC6-EF6A4D38403D}] => (Allow) C:\Program Files\NVIDIA Corporation\NvStreamSrv\nvstreamer.exe
FirewallRules: [{E97155BF-E4EB-4C75-A4C5-615F9BFD5E2F}] => (Allow) C:\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe
FirewallRules: [{3B53BE49-D1A0-4637-9352-462A01ECB0AD}] => (Allow) C:\Steam\SteamApps\common\Sniper Elite V2\Launcher\SniperV2Launcher.exe
FirewallRules: [{18E826B1-811A-45C8-9D6E-8BD9310BB388}] => (Allow) D:\Program Files\Steam\SteamApps\common\blacklightretribution\Binaries\Win32\FoxGame-win32-Shipping.exe
FirewallRules: [{CF82F166-0AAF-48BD-8C50-0C7089205990}] => (Allow) D:\Program Files\Steam\SteamApps\common\blacklightretribution\Binaries\Win32\FoxGame-win32-Shipping.exe
FirewallRules: [{0402840F-977B-4222-843E-B9EB7C503980}] => (Allow) C:\Steam\SteamApps\common\Monaco\MONACO.exe
FirewallRules: [{7F3EF5FB-D5F1-4DA5-B85D-F7E2A4E45F98}] => (Allow) C:\Steam\SteamApps\common\Monaco\MONACO.exe
FirewallRules: [{803738DD-D413-4864-9B4C-7A5D9888BF12}] => (Allow) C:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [{A828308A-0C78-41E1-9865-7A2B104E933E}] => (Allow) C:\Steam\SteamApps\common\Counter-Strike Global Offensive\csgo.exe
FirewallRules: [TCP Query User{B5B73691-E70B-4704-9E79-23FF046E8D2B}C:\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe] => (Allow) C:\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe
FirewallRules: [UDP Query User{6DC783E1-E37B-4F8A-A959-4B36AD283301}C:\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe] => (Allow) C:\steam\steamapps\common\sniper elite v2\bin\sniperelitev2.exe
FirewallRules: [TCP Query User{373BC5E1-36A6-436B-869C-7FA510DE085C}D:\games\civilization v\civilization v\civilizationv.exe] => (Allow) D:\games\civilization v\civilization v\civilizationv.exe
FirewallRules: [UDP Query User{23F2FF4E-B2B3-4F66-87ED-C310F84C95BF}D:\games\civilization v\civilization v\civilizationv.exe] => (Allow) D:\games\civilization v\civilization v\civilizationv.exe
FirewallRules: [{A500BC6E-A87F-4012-A466-948CD63F7201}] => (Allow) C:\Steam\SteamApps\common\PAYDAY 2\payday2_win32_release.exe
FirewallRules: [{695D525B-AEE8-4B7C-9EB9-FF9E8CE96A85}] => (Allow) C:\Steam\SteamApps\common\PAYDAY 2\payday2_win32_release.exe
FirewallRules: [{AFE55187-985B-4DCE-BA11-CA7852C3169D}] => (Allow) C:\Steam\SteamApps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{7433EB07-F396-4E0E-8AE3-34E4CFB62A39}] => (Allow) C:\Steam\SteamApps\common\Path of Exile\PathOfExileSteam.exe
FirewallRules: [{C42CD5CE-0ACE-4AA1-B40D-0030F86329EA}] => (Allow) C:\Steam\SteamApps\common\SMITE\Binaries\Win32\HirezBridge.exe
FirewallRules: [{AE21A960-03F0-46F3-BAFE-A83BD11516FF}] => (Allow) C:\Steam\SteamApps\common\SMITE\Binaries\Win32\HirezBridge.exe
FirewallRules: [TCP Query User{C6B143BE-D3A5-4521-9EB0-35ABC3A28BC1}C:\steam\steamapps\common\smite\binaries\win32\smite.exe] => (Allow) C:\steam\steamapps\common\smite\binaries\win32\smite.exe
FirewallRules: [UDP Query User{8DFAAE30-907A-4E36-8327-59319C831829}C:\steam\steamapps\common\smite\binaries\win32\smite.exe] => (Allow) C:\steam\steamapps\common\smite\binaries\win32\smite.exe
FirewallRules: [{10C99F19-BC6E-4B96-A917-11469EEFA1F5}] => (Allow) C:\Steam\SteamApps\common\Dungeon Defenders 2\DunDefLauncher.exe
FirewallRules: [{1F7746E6-50B9-492B-8589-ED738F146CED}] => (Allow) C:\Steam\SteamApps\common\Dungeon Defenders 2\DunDefLauncher.exe
FirewallRules: [{69AB5A32-303A-467B-B2A2-9CA3155F89B8}] => (Allow) C:\Steam\SteamApps\common\Endless Sky\EndlessSky.exe
FirewallRules: [{476F1030-C818-47E7-9FD4-18DE15E2E184}] => (Allow) C:\Steam\SteamApps\common\Endless Sky\EndlessSky.exe
FirewallRules: [{110F2A23-2AD2-4850-AA84-DCFEC2A4FE14}] => (Allow) C:\Steam\SteamApps\common\Electric Highways\Electric Highways.exe
FirewallRules: [{8ECFE623-FBC2-4DB1-A154-E2A8797B5047}] => (Allow) C:\Steam\SteamApps\common\Electric Highways\Electric Highways.exe
FirewallRules: [{78A6DA5D-B46F-4235-9020-10829DD7C21E}] => (Allow) C:\Steam\SteamApps\common\Saints Row IV\SaintsRowIV.exe
FirewallRules: [{1D14D1B2-895D-4413-B633-121E119D6A05}] => (Allow) C:\Steam\SteamApps\common\Saints Row IV\SaintsRowIV.exe
FirewallRules: [{40F112E2-7CCE-46EA-91B1-BED3DD591BEE}] => (Allow) C:\Steam\SteamApps\common\Dr Langeskov The Tiger and The Terribly Cursed Emerald A Whirlwind Heist\DrLangeskov.exe
FirewallRules: [{0533B9CC-C753-4D44-8249-2A27AE97BF02}] => (Allow) C:\Steam\SteamApps\common\Dr Langeskov The Tiger and The Terribly Cursed Emerald A Whirlwind Heist\DrLangeskov.exe
FirewallRules: [{59699C8A-D010-48BB-97D7-F45B349935F8}] => (Allow) C:\Steam\SteamApps\common\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{831C93F6-431B-4697-BDCD-F71849E3DE6F}] => (Allow) C:\Steam\SteamApps\common\Mass Effect 2\Binaries\MassEffect2.exe
FirewallRules: [{4016DE2C-FCF3-4417-A670-064E1DA6C8CF}] => (Allow) C:\Steam\SteamApps\common\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{D566C3D7-B159-4B24-B9BA-2D1A0D1D851F}] => (Allow) C:\Steam\SteamApps\common\Mass Effect 2\MassEffect2Launcher.exe
FirewallRules: [{EE36377F-FA81-4866-BE87-FDF564BEE576}] => (Allow) C:\Steam\SteamApps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe
FirewallRules: [{A517CAA9-E2FA-4AD7-836D-B00D83A9B911}] => (Allow) C:\Steam\SteamApps\common\XCom-Enemy-Unknown\Binaries\Win32\XComGame.exe
FirewallRules: [{F78AA34E-76B6-4A18-BA62-8AEAFA9E354F}] => (Allow) C:\Steam\SteamApps\common\MechWarrior Online\Bin32\MWOClient.exe
FirewallRules: [{3FC821B5-FE0E-47C4-AEDA-E88FB8501612}] => (Allow) C:\Steam\SteamApps\common\MechWarrior Online\Bin32\MWOClient.exe
FirewallRules: [TCP Query User{B944C513-41D6-43FB-966C-CA956BF5CBD3}C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Allow) C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe
FirewallRules: [UDP Query User{D3F7EEDB-4DA2-4DCB-AB9F-EE6788DF62A3}C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Allow) C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe
FirewallRules: [{86B8475A-ED5B-40C9-94E2-EB0A3BBDD648}] => (Allow) C:\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{0A8A6895-0BE4-468D-80E6-5C378E777B54}] => (Allow) C:\Steam\SteamApps\common\Portal 2\portal2.exe
FirewallRules: [{9756525B-5163-4574-A503-E8F99F0D69A2}] => (Allow) C:\Steam\SteamApps\common\Sven Co-op\svencoop.exe
FirewallRules: [{86F1D273-703E-47C3-BE1F-49F8C5F2D5C4}] => (Allow) C:\Steam\SteamApps\common\Sven Co-op\svencoop.exe
FirewallRules: [{5F3BD67E-6AE7-4D2B-9B52-2C9E953E10A1}] => (Allow) C:\Steam\SteamApps\common\Creativerse\Creativerse.exe
FirewallRules: [{8351E608-3F49-4AF0-94B4-396EA41415B1}] => (Allow) C:\Steam\SteamApps\common\Creativerse\Creativerse.exe
FirewallRules: [{7F63D697-F89A-45B0-91B7-0CBCE764DDE7}] => (Allow) C:\Steam\SteamApps\common\CardHunter\CardHunter.exe
FirewallRules: [{CCFDE491-7AFD-4F81-BF24-9765D43FAD03}] => (Allow) C:\Steam\SteamApps\common\CardHunter\CardHunter.exe
FirewallRules: [{4EA48A06-E7F1-41D4-BC68-2BAC2521E187}] => (Allow) D:\Program Files\Steam\SteamApps\common\RIFT\riftpatchlive.exe
FirewallRules: [{96088CF2-0E48-4E2D-B1B7-637973452D21}] => (Allow) D:\Program Files\Steam\SteamApps\common\RIFT\riftpatchlive.exe
FirewallRules: [{CDD78ABE-B94C-4EFB-8DBA-2D7B8EF7E8E6}] => (Allow) D:\Program Files\Steam\SteamApps\common\OrcsMustDieUnchained\Dashboard\Bin\SpitfireDashboard.exe
FirewallRules: [{DB69DF6D-60BB-4BDB-8F77-BEF02DC6E641}] => (Allow) D:\Program Files\Steam\SteamApps\common\OrcsMustDieUnchained\Dashboard\Bin\SpitfireDashboard.exe
FirewallRules: [TCP Query User{093587EA-7457-4898-8439-D95C61D12AFE}D:\program files\steam\steamapps\common\orcsmustdieunchained\binaries\win32\spitfiregame.exe] => (Allow) D:\program files\steam\steamapps\common\orcsmustdieunchained\binaries\win32\spitfiregame.exe
FirewallRules: [UDP Query User{ED14B75B-31E4-468F-96B9-046D9AD3BF65}D:\program files\steam\steamapps\common\orcsmustdieunchained\binaries\win32\spitfiregame.exe] => (Allow) D:\program files\steam\steamapps\common\orcsmustdieunchained\binaries\win32\spitfiregame.exe
FirewallRules: [TCP Query User{560149C9-AF46-4502-92CB-DA9A282797E6}C:\program files\java\jre1.8.0_91\bin\jp2launcher.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\jp2launcher.exe
FirewallRules: [UDP Query User{6F1AECFE-7AC4-461D-AA11-ADFCDE5A4BFF}C:\program files\java\jre1.8.0_91\bin\jp2launcher.exe] => (Allow) C:\program files\java\jre1.8.0_91\bin\jp2launcher.exe
FirewallRules: [{B0E34543-8AC1-4DE3-B043-50A94A893242}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\outlook.exe
FirewallRules: [{42E75E4D-E21D-4AF8-9B5E-442D10261388}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{2B2BE28A-04F0-49D3-9A14-27A87ABA2FB3}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{E4F5A3B7-CC32-4AB2-9CF6-E6A67C0F8F74}] => (Allow) D:\Program Files\Steam\SteamApps\common\Mass Effect\Binaries\MassEffect.exe
FirewallRules: [{5166BBD2-CA71-4293-BF15-6A2F23DA3BE1}] => (Allow) D:\Program Files\Steam\SteamApps\common\Mass Effect\Binaries\MassEffect.exe
FirewallRules: [{99279482-5243-47B1-B051-5EDEBDDE3561}] => (Allow) D:\Program Files\Steam\SteamApps\common\Magic Duels\MagicDuels.exe
FirewallRules: [{8169D75B-74E8-4AB1-B786-7C46EEB5D7CF}] => (Allow) D:\Program Files\Steam\SteamApps\common\Magic Duels\MagicDuels.exe
FirewallRules: [{5D171A16-1562-4080-81D9-17F3205AA9FE}] => (Allow) C:\Steam\SteamApps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{27C1D9B0-92C5-4CC4-B20C-B40BE0EB1A73}] => (Allow) C:\Steam\SteamApps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{FF30C975-D7CC-40A8-AAB3-ABE6AC297E53}] => (Allow) C:\Program Files\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe
FirewallRules: [{A9E93BE3-7CED-42BC-A106-9DB30B36D727}] => (Allow) C:\Program Files\Origin Games\Mass Effect 3\Binaries\Win32\MassEffect3.exe
FirewallRules: [{C5A24F35-10ED-4C36-B5FA-C6EF274B4B31}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\Lync.exe
FirewallRules: [{81079A2A-76C9-4991-9DE2-EEA90A0C3E65}] => (Allow) C:\Program Files\Microsoft Office\root\Office16\UcMapi.exe
FirewallRules: [{A1AC4DE5-F77A-48FD-807F-513854ECE29C}] => (Allow) D:\Program Files\Steam\SteamApps\common\Limbo\limbo.exe
FirewallRules: [{2675A5DA-DDFC-4616-A01F-5C7206183971}] => (Allow) D:\Program Files\Steam\SteamApps\common\Limbo\limbo.exe
FirewallRules: [{7DDFD7D5-6E6C-4955-B660-6C9150BABA5F}] => (Allow) D:\Program Files\Steam\SteamApps\common\Broforce The Expendables Missions\Expendabros.exe
FirewallRules: [{02527521-750C-4045-AA52-27A0455A82FF}] => (Allow) D:\Program Files\Steam\SteamApps\common\Broforce The Expendables Missions\Expendabros.exe
FirewallRules: [{6432CAA8-A8E1-4009-A410-D0997F0C6473}] => (Allow) D:\Program Files\Steam\SteamApps\common\Transmissions Element 120\hl2.exe
FirewallRules: [{EBD7C577-680B-491E-A886-9DC89353D6BE}] => (Allow) D:\Program Files\Steam\SteamApps\common\Transmissions Element 120\hl2.exe
FirewallRules: [{6211CD23-60C8-4E78-9AF2-7B677A2A7778}] => (Allow) D:\Program Files\Steam\SteamApps\common\Relic Hunters Zero\RelicHuntersZero.exe
FirewallRules: [{D10E21B2-C031-47A1-AE73-8A1AFD6F1BCE}] => (Allow) D:\Program Files\Steam\SteamApps\common\Relic Hunters Zero\RelicHuntersZero.exe
FirewallRules: [{3688A76F-83E4-459B-B5DA-7EC31B0FFFD7}] => (Allow) D:\Program Files\Steam\SteamApps\common\Boid\Boid.exe
FirewallRules: [{0B7A584C-AF5A-4ED6-A33A-7837C494C4CC}] => (Allow) D:\Program Files\Steam\SteamApps\common\Boid\Boid.exe
FirewallRules: [{B4428D9C-CFF4-4B5B-BA0C-04B907C9B75B}] => (Allow) D:\Program Files\Steam\SteamApps\common\Chronicle\Chronicle.exe
FirewallRules: [{7E75A19D-BEA2-4C04-A779-19A646334863}] => (Allow) D:\Program Files\Steam\SteamApps\common\Chronicle\Chronicle.exe
FirewallRules: [{F2F03D14-73EF-423D-A82A-DC1AEBB5CD6E}] => (Allow) C:\Program Files\Radiant Worlds\SkySaga Infinite Isles\SkySagaLauncher.exe
FirewallRules: [{D2263C7D-E5E7-40DF-9C6A-BA60B32077C9}] => (Allow) C:\Program Files\Radiant Worlds\SkySaga Infinite Isles\Client\SkySaga.exe
FirewallRules: [{74805831-0251-4DCF-8A51-4D3A1AC9E4C2}] => (Allow) D:\Program Files\Steam\SteamApps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{F7155883-F7C0-495E-84CF-40F1E4943BD4}] => (Allow) D:\Program Files\Steam\SteamApps\common\Life Is Strange\Binaries\Win32\LifeIsStrange.exe
FirewallRules: [{BDBFF1AF-ED70-47DE-A6F7-BBA571B3434D}] => (Allow) D:\Program Files\Steam\SteamApps\common\Magic Duels\MagicDuels.exe
FirewallRules: [{9009C425-ED7A-4EF9-B97B-C9FD17AEA7F8}] => (Allow) D:\Program Files\Steam\SteamApps\common\Magic Duels\MagicDuels.exe
FirewallRules: [{05C7F461-4EF2-496F-8DB6-568C7F0A9525}] => (Allow) D:\Program Files\Steam\SteamApps\common\Moirai\Moirai.exe
FirewallRules: [{FF0A7691-BD2A-4F78-9A21-B30F87612FCF}] => (Allow) D:\Program Files\Steam\SteamApps\common\Moirai\Moirai.exe
FirewallRules: [TCP Query User{49A2912B-6D0C-4F54-86FD-A47CA362F189}C:\program files\ubisoft\splinter cell pandora tomorrow\pandora.exe] => (Allow) C:\program files\ubisoft\splinter cell pandora tomorrow\pandora.exe
FirewallRules: [UDP Query User{01582EBD-A094-4698-9A49-04B34885FA36}C:\program files\ubisoft\splinter cell pandora tomorrow\pandora.exe] => (Allow) C:\program files\ubisoft\splinter cell pandora tomorrow\pandora.exe
FirewallRules: [TCP Query User{B2B68182-A621-4F10-96B9-8856C556A35A}C:\program files\ubisoft\splinter cell chaos theory\system\splintercell3.exe] => (Block) C:\program files\ubisoft\splinter cell chaos theory\system\splintercell3.exe
FirewallRules: [UDP Query User{0B28F234-A8C7-4A49-8C15-269D16EDC3DB}C:\program files\ubisoft\splinter cell chaos theory\system\splintercell3.exe] => (Block) C:\program files\ubisoft\splinter cell chaos theory\system\splintercell3.exe
FirewallRules: [{5C4A4C48-D793-44B3-BAE1-44F8154619A6}] => (Allow) D:\Program Files\Steam\SteamApps\common\SKILL\Binaries\Win32\sf2.exe
FirewallRules: [{A1071E04-4315-4B30-B5F1-0C3F4E61B7E7}] => (Allow) D:\Program Files\Steam\SteamApps\common\SKILL\Binaries\Win32\sf2.exe
FirewallRules: [TCP Query User{0E5B99F6-E28F-4E59-AC7A-5B45FB493846}D:\program files\ubisoft\farcry 3\bin\farcry3.exe] => (Block) D:\program files\ubisoft\farcry 3\bin\farcry3.exe
FirewallRules: [UDP Query User{3A3C3834-7AAD-42C5-B1C2-8A8C2F51D653}D:\program files\ubisoft\farcry 3\bin\farcry3.exe] => (Block) D:\program files\ubisoft\farcry 3\bin\farcry3.exe
FirewallRules: [{1140F6D7-668D-4101-A002-57DC25AF5F2A}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{EB2FC75D-0951-4275-A8D4-1740455083CF}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{1890CAD8-6288-4996-AC69-45F031F7B38B}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{67CC658A-E44E-4885-8CF1-4BE1754674D8}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{CDF50E2C-9521-44D1-B060-A0AF02E5F8C2}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{7B1C55DD-4CB9-4A81-A701-8447A0B323FC}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{8B568A3D-DFCA-4350-B8ED-35243932A0AC}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{043295F3-57B2-4460-963D-553081DBB3DC}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{37E7B099-2FCC-4536-B895-429C0C3B7867}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.exe
FirewallRules: [{F3C2A8A9-0F97-413C-BBBC-1452B59CA877}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Warframe.x64.exe
FirewallRules: [{03F95123-2C9B-47F7-AA32-703D149A1C21}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Tools\Launcher.exe
FirewallRules: [{CF84095C-B5EC-406D-B416-ECC5197A778D}] => (Allow) D:\Program Files\Steam\steamapps\common\Warframe\Tools\RemoteCrashSender.exe
FirewallRules: [{18D7775B-4896-4169-9298-6F9B505E0402}] => (Allow) D:\Program Files\Steam\SteamApps\common\Duelyst\Duelyst.exe
FirewallRules: [{451A2FF3-9A64-44AA-A267-DC897689FBD9}] => (Allow) D:\Program Files\Steam\SteamApps\common\Duelyst\Duelyst.exe
FirewallRules: [{66100AAE-7C98-4308-A2FC-9AFC6850F2C7}] => (Allow) C:\Steam\SteamApps\common\Sven Co-op\svends.exe
FirewallRules: [{E1AECCDC-B175-469B-BF81-480685B0C887}] => (Allow) C:\Steam\SteamApps\common\Sven Co-op\svends.exe
FirewallRules: [{C8E72231-25A6-4486-99AC-35B58E9FAAAA}] => (Allow) C:\Steam\SteamApps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{6129AF73-DB33-4E0C-873C-17CBA7D59320}] => (Allow) C:\Steam\SteamApps\common\Dirty Bomb\Binaries\Win32\ShooterGame-Win32-Shipping.exe
FirewallRules: [{CB53CED4-9280-43F7-8D67-D4D0954FB334}] => (Allow) D:\Program Files\Steam\SteamApps\common\Bloody Walls\game.exe
FirewallRules: [{3FF20F30-4699-4E25-919D-149313A10611}] => (Allow) D:\Program Files\Steam\SteamApps\common\Bloody Walls\game.exe
FirewallRules: [TCP Query User{D5868C5A-C105-4B63-96A8-F299F32A9E78}C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Allow) C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe
FirewallRules: [UDP Query User{E74BF54C-B0A1-49EF-B884-41C07362F292}C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe] => (Allow) C:\steam\steamapps\common\xcom-enemy-unknown\xew\binaries\win32\xcomew.exe
==================== Wiederherstellungspunkte =========================
23-09-2016 10:25:04 Geplanter Prüfpunkt
01-10-2016 19:53:06 Prüfpunkt von HitmanPro
01-10-2016 19:54:12 Prüfpunkt von HitmanPro
01-10-2016 20:19:38 Prüfpunkt von HitmanPro
09-10-2016 04:22:54 Geplanter Prüfpunkt
10-10-2016 11:51:50 Malwarebytes Anti-Rootkit Restore Point
10-10-2016 16:33:02 JRT Pre-Junkware Removal
==================== Fehlerhafte Geräte im Gerätemanager =============
Name:
Description:
Class Guid:
Manufacturer:
Service:
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.
Name: Hamachi Network Interface
Description: Hamachi Network Interface
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: LogMeIn, Inc.
Service: hamachi
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.
==================== Fehlereinträge in der Ereignisanzeige: =========================
Applikationsfehler:
==================
Error: (10/10/2016 08:03:13 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Ereignisfilter mit Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" nicht reaktiviert werden aufgrund des Fehlers 0x80041003. Ereignisse können nicht durch diesen Filter geschickt werden, bis dieses Problem gelöst ist.
Error: (10/10/2016 05:15:46 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\outlast whistleblower\Binaries\Win64\OLGame_R.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/10/2016 05:15:46 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\program files\outlast whistleblower\Binaries\Win64\OLGame.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/10/2016 05:15:33 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\Steam\steamapps\common\mechwarrior online\Bin64\MWOClient.exe".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/10/2016 05:15:33 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "c:\Steam\steamapps\common\mechwarrior online\Bin64\CrashSender1402.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/10/2016 05:15:10 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "d:\program files\Steam\steamapps\common\Warframe\Warframe.x64.exe".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
Error: (10/10/2016 12:31:10 PM) (Source: Office 2016 Licensing Service) (EventID: 0) (User: )
Description: Event-ID 0
Error: (10/10/2016 11:54:58 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: Ereignisfilter mit Abfrage "SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 99" konnte im Namespace "//./root/CIMV2" nicht reaktiviert werden aufgrund des Fehlers 0x80041003. Ereignisse können nicht durch diesen Filter geschickt werden, bis dieses Problem gelöst ist.
Error: (10/10/2016 11:51:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddWin32ServiceFiles: Unable to back up image of service Avast Antivirus since QueryServiceConfig API failed
System Error:
Das System kann die angegebene Datei nicht finden.
.
Error: (10/10/2016 11:51:56 AM) (Source: Microsoft-Windows-CAPI2) (EventID: 513) (User: )
Description: Fehler beim Kryptografiedienst während der Verarbeitung des "OnIdentity()"-Aufrufobjekts "System Writer".
Details:
AddLegacyDriverFiles: Unable to back up image of binary avast! VM Monitor.
System Error:
Das System kann die angegebene Datei nicht finden.
.
Systemfehler:
=============
Error: (10/10/2016 08:02:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Origin Web Helper Service" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.
Error: (10/10/2016 08:02:12 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Origin Web Helper Service erreicht.
Error: (10/10/2016 04:33:22 PM) (Source: Service Control Manager) (EventID: 7034) (User: )
Description: Dienst "NVIDIA Display Driver Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert.
Error: (10/10/2016 11:54:26 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen (Anwendungsspezifisch) wird der SID (S-1-5-18) für Benutzer NT-AUTORITÄT\SYSTEM von Adresse LocalHost (unter Verwendung von LRPC) keine Berechtigung zum Start (Lokal) für die COM-Serveranwendung mit CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
und APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungsprogramm für Komponentendienste geändert werden.
Error: (10/10/2016 11:54:03 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Origin Web Helper Service" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.
Error: (10/10/2016 11:54:03 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Origin Web Helper Service erreicht.
Error: (10/10/2016 11:15:55 AM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen (Anwendungsspezifisch) wird der SID (S-1-5-18) für Benutzer NT-AUTORITÄT\SYSTEM von Adresse LocalHost (unter Verwendung von LRPC) keine Berechtigung zum Start (Lokal) für die COM-Serveranwendung mit CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
und APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungsprogramm für Komponentendienste geändert werden.
Error: (10/10/2016 11:13:44 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Origin Web Helper Service" wurde aufgrund folgenden Fehlers nicht gestartet:
Der Dienst antwortete nicht rechtzeitig auf die Start- oder Steuerungsanforderung.
Error: (10/10/2016 11:13:44 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Origin Web Helper Service erreicht.
Error: (10/09/2016 08:02:40 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: Durch die Berechtigungseinstellungen (Anwendungsspezifisch) wird der SID (S-1-5-18) für Benutzer NT-AUTORITÄT\SYSTEM von Adresse LocalHost (unter Verwendung von LRPC) keine Berechtigung zum Start (Lokal) für die COM-Serveranwendung mit CLSID
{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}
und APPID
{344ED43D-D086-4961-86A6-1106F4ACAD9B}
gewährt. Die Sicherheitsberechtigung kann mit dem Verwaltungsprogramm für Komponentendienste geändert werden.
CodeIntegrity:
===================================
Date: 2016-09-08 20:36:16.822
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-08 20:36:16.666
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-07 12:58:48.181
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-07 12:58:48.103
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-06 12:45:18.727
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-06 12:45:18.665
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-05 18:51:42.401
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-05 18:51:42.354
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-04 21:19:25.353
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswKbd.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2016-09-04 21:19:25.306
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume3\Windows\System32\drivers\aswSnx.sys" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i5-4570 CPU @ 3.20GHz
Prozentuale Nutzung des RAM: 28%
Installierter physikalischer RAM: 3544.07 MB
Verfügbarer physikalischer RAM: 2545.46 MB
Summe virtueller Speicher: 7086.45 MB
Verfügbarer virtueller Speicher: 5969.24 MB
==================== Laufwerke ================================
Drive c: () (Fixed) (Total:638.54 GB) (Free:117.39 GB) NTFS
Drive d: () (Fixed) (Total:292.87 GB) (Free:93.09 GB) NTFS
==================== MBR & Partitionstabelle ==================
========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: DF39E75C)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=292.9 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=638.5 GB) - (Type=07 NTFS)
==================== Ende vom Addition.txt ============================
|
|
10.10.2016, 22:25
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | bidr.trellian.com redirect im Firefox Browser FRST-Fix Virenscanner jetzt bitte komplett deaktivieren, damit sichergestellt ist, dass der Fix sauber durchläuft! Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster. Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument Code:
ATTFilter ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
GroupPolicyScripts: Beschränkung <======= ACHTUNG
FF Extension: (youtubereplay) - C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\Extensions\jid0-VuYraOOT2NM2AcnQwG4APKol3Vs@jetpack.xpi [2016-04-27]
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [322]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [322]
AlternateDataStreams: C:\Users\King Haze:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [322]
AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
AlternateDataStreams: C:\ProgramData\Application Data:NT2 [322]
AlternateDataStreams: C:\Users\King Haze\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\King Haze\Anwendungsdaten:NT2 [322]
AlternateDataStreams: C:\Users\King Haze\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\King Haze\AppData\Roaming:NT2 [322]
emptytemp:
Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
__________________ Logfiles bitte immer in CODE-Tags posten |
|
11.10.2016, 20:09
| #15 |
| | bidr.trellian.com redirect im Firefox Browser Fixlog.txt : Code:
ATTFilter Entferungsergebnis von Farbar Recovery Scan Tool (x86) Version: 09-10-2016
durchgeführt von King Haze (11-10-2016 21:03:23) Run:2
Gestartet von C:\Users\King Haze\Downloads
Geladene Profile: King Haze (Verfügbare Profile: King Haze)
Start-Modus: Normal
==============================================
fixlist Inhalt:
*****************
ShellIconOverlayIdentifiers: [00avast] -> {472083B0-C522-11CF-8763-00608CC02F24} => Keine Datei
GroupPolicyScripts: Beschränkung <======= ACHTUNG
FF Extension: (youtubereplay) - C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\Extensions\jid0-VuYraOOT2NM2AcnQwG4APKol3Vs@jetpack.xpi [2016-04-27]
AlternateDataStreams: C:\ProgramData:NT [40]
AlternateDataStreams: C:\ProgramData:NT2 [322]
AlternateDataStreams: C:\Users\All Users:NT [40]
AlternateDataStreams: C:\Users\All Users:NT2 [322]
AlternateDataStreams: C:\Users\King Haze:Heroes & Generals [38]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\ProgramData\Anwendungsdaten:NT2 [322]
AlternateDataStreams: C:\ProgramData\Application Data:NT [40]
AlternateDataStreams: C:\ProgramData\Application Data:NT2 [322]
AlternateDataStreams: C:\Users\King Haze\Anwendungsdaten:NT [40]
AlternateDataStreams: C:\Users\King Haze\Anwendungsdaten:NT2 [322]
AlternateDataStreams: C:\Users\King Haze\AppData\Roaming:NT [40]
AlternateDataStreams: C:\Users\King Haze\AppData\Roaming:NT2 [322]
emptytemp:
*****************
"HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\ShellIconOverlayIdentifiers\00avast" => Schlüssel erfolgreich entfernt
HKCR\CLSID\{472083B0-C522-11CF-8763-00608CC02F24} => Schlüssel nicht gefunden.
C:\Windows\system32\GroupPolicy\Machine => erfolgreich verschoben
C:\Windows\system32\GroupPolicy\GPT.ini => erfolgreich verschoben
C:\Users\King Haze\AppData\Roaming\Mozilla\Firefox\Profiles\rzo4dl8b.default\Extensions\jid0-VuYraOOT2NM2AcnQwG4APKol3Vs@jetpack.xpi => erfolgreich verschoben
C:\ProgramData => ":NT" ADS erfolgreich entfernt.
C:\ProgramData => ":NT2" ADS erfolgreich entfernt.
"C:\Users\All Users" => ":NT" ADS nicht gefunden.
"C:\Users\All Users" => ":NT2" ADS nicht gefunden.
C:\Users\King Haze => ":Heroes & Generals" ADS erfolgreich entfernt.
"C:\ProgramData\Anwendungsdaten" => ":NT" ADS nicht gefunden.
"C:\ProgramData\Anwendungsdaten" => ":NT2" ADS nicht gefunden.
"C:\ProgramData\Application Data" => ":NT" ADS nicht gefunden.
"C:\ProgramData\Application Data" => ":NT2" ADS nicht gefunden.
C:\Users\King Haze\Anwendungsdaten => ":NT" ADS erfolgreich entfernt.
C:\Users\King Haze\Anwendungsdaten => ":NT2" ADS erfolgreich entfernt.
"C:\Users\King Haze\AppData\Roaming" => ":NT" ADS nicht gefunden.
"C:\Users\King Haze\AppData\Roaming" => ":NT2" ADS nicht gefunden.
=========== EmptyTemp: ==========
BITS transfer queue => 8388608 B
DOMStoree, IE Recovery, AppCache, Feeds Cache, Thumbcache, IconCache => 35015758 B
Java, Flash, Steam htmlcache => 394191337 B
Windows/system/drivers => 14070169 B
Edge => 0 B
Chrome => 0 B
Firefox => 417415013 B
Opera => 0 B
Temp, IE cache, history, cookies, recent:
Default => 0 B
Public => 0 B
ProgramData => 0 B
systemprofile => 0 B
LocalService => 0 B
NetworkService => 87694 B
King Haze => 314576571 B
RecycleBin => 2704 B
EmptyTemp: => 1.1 GB temporäre Dateien entfernt.
================================
Das System musste neu gestartet werden.
==== Ende vom Fixlog 21:03:54 ====
|
|
| Themen zu bidr.trellian.com redirect im Firefox Browser |
| .com, anti-malware, aufsetzen, avast, blockiert, browser, daten, fehlermeldung, firefox, löschen, lösung, malware, malwarebytes, meldung, mozilla, neu, nicht mehr, recovery, redirect, scan, screenshot, seite, suche, tool, werbung |
Linear-Darstellung
