Hallo,
nun habe ich seit gestern den Vista Recovery Trojaner auf meinem PC, konnte die typischen Fehlermeldungen schon vermeiden, da ich einen scan und eine bereinigung durch Dr. Web durchgeführt habe. Unten finden sie den OTL-Custom-log.OTL Logfile:

OTL logfile created on: 12.06.2011 09:52:31 - Run 1
OTL by OldTimer - Version 3.2.24.0     Folder = C:\Users\Jan Lorenz\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 69,60% Memory free
6,69 Gb Paging File | 5,69 Gb Available in Paging File | 85,11% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465,75 Gb Total Space | 41,60 Gb Free Space | 8,93% Space Free | Partition Type: NTFS
Drive H: | 1397,26 Gb Total Space | 643,30 Gb Free Space | 46,04% Space Free | Partition Type: NTFS
 
Computer Name: WINDOWS-SLV5UWZ | User Name: Jan Lorenz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2011.06.12 09:33:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Jan Lorenz\Desktop\OTL.exe
PRC - [2011.04.30 13:10:55 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011.03.21 23:10:00 | 001,230,704 | ---- | M] () -- C:\Program Files\DivX\DivX Update\DivXUpdate.exe
PRC - [2011.03.16 16:15:43 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2010.12.25 17:28:47 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010.12.08 18:01:42 | 002,984,856 | ---- | M] () -- C:\Program Files\Pando Networks\Media Booster\PMB.exe
PRC - [2010.01.22 23:30:05 | 002,927,104 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2010.01.14 23:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2008.12.30 11:01:52 | 017,059,840 | R--- | M] (VIA) -- C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe
PRC - [2008.12.19 08:41:36 | 000,221,184 | ---- | M] () -- C:\Windows\system\cm106eye.exe
PRC - [2008.04.04 20:37:59 | 000,088,584 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\Gaming Software\LWEMon.exe
PRC - [2008.01.19 09:38:38 | 001,008,184 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Windows Defender\MSASCui.exe
PRC - [2008.01.19 09:33:01 | 000,088,064 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\audiodg.exe
PRC - [2007.09.17 11:01:56 | 002,852,112 | ---- | M] (Logitech(c)) -- C:\Program Files\Logitech\Z Cinema\Z Cinema.exe
PRC - [2006.06.23 11:24:12 | 000,343,552 | ---- | M] (AVM Berlin GmbH) -- C:\Program Files\avmwlanstick\FRITZWLanMini.exe
PRC - [2006.03.06 17:31:52 | 001,122,304 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\G-series Software\LGDCore.exe
PRC - [2006.03.06 17:17:24 | 000,307,200 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\G-series Software\Applets\LCDPop3\LCDPOP3.exe
PRC - [2006.03.06 17:16:48 | 000,378,880 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\G-series Software\Applets\LCDCountdown\LCDCountdown.exe
PRC - [2006.03.06 17:16:12 | 000,198,656 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\G-series Software\Applets\LCDClock.exe
PRC - [2006.03.06 17:15:42 | 000,289,792 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\G-series Software\Applets\LCDMedia.exe
PRC - [2006.03.06 17:14:58 | 000,497,152 | ---- | M] (Logitech Inc.) -- C:\Program Files\Logitech\G-series Software\LCDMon.exe
PRC - [2004.03.25 12:35:26 | 001,732,608 | ---- | M] (Adobe Systems) -- C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe
PRC - [2002.06.04 12:57:04 | 000,901,214 | ---- | M] () -- C:\Program Files\AT-AR215\AT-AR215 USB ADSL WAN Adapter\DSLMON.exe
PRC - [2002.01.28 02:26:46 | 000,147,456 | -H-- | M] () -- C:\Windows\autoclk.exe
 
 
========== Modules (SafeList) ==========
 
MOD - [2011.06.12 09:33:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Jan Lorenz\Desktop\OTL.exe
MOD - [2010.08.31 17:39:57 | 001,684,480 | ---- | M] (Microsoft Corporation) -- C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6001.18523_none_5cdd65e20837faf2\comctl32.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2011.06.02 10:57:29 | 000,403,240 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2011.04.30 13:10:55 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011.03.16 16:15:43 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2009.02.19 00:21:00 | 002,769,658 | ---- | M] (INCA Internet Co., Ltd.) [On_Demand | Stopped] -- C:\Windows\System32\GameMon.des -- (npggsvc)
SRV - [2008.01.19 09:38:24 | 000,272,952 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2004.03.25 12:35:26 | 000,061,440 | ---- | M] (Adobe Sytems) [On_Demand | Stopped] -- C:\Program Files\Adobe\Adobe Version Cue\service\VersionCue.exe -- (AdobeVersionCue)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011.03.16 16:15:44 | 000,137,656 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011.02.23 08:27:00 | 010,468,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2010.12.25 17:28:47 | 000,061,960 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010.09.25 18:23:47 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV - [2010.09.25 18:23:46 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV - [2010.01.31 16:27:46 | 000,691,696 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\System32\Drivers\sptd.sys -- (sptd)
DRV - [2009.10.01 18:03:12 | 001,515,520 | ---- | M] (C-Media Electronics Inc) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\CM106.sys -- (USBMULCD)
DRV - [2009.08.05 07:18:22 | 000,048,640 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L1E60x86.sys -- (L1E)
DRV - [2009.05.11 11:12:49 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2008.12.19 05:40:06 | 000,923,136 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2008.01.25 00:09:34 | 000,048,904 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmXlCore.sys -- (WmXlCore)
DRV - [2008.01.25 00:09:24 | 000,014,728 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmVirHid.sys -- (WmVirHid)
DRV - [2008.01.25 00:09:04 | 000,028,168 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmFilter.sys -- (WmFilter)
DRV - [2008.01.25 00:08:54 | 000,019,336 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\WmBEnum.sys -- (WmBEnum)
DRV - [2007.08.22 16:26:32 | 000,018,448 | ---- | M] (SRS Labs, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ZCinema_SRS_i386.sys -- (ZCinema_TSHD)
DRV - [2007.06.29 14:47:34 | 000,034,304 | ---- | M] (AMD, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AmdLLD.sys -- (AmdLLD)
DRV - [2006.10.18 14:44:48 | 000,007,680 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor)
DRV - [2006.04.06 01:00:00 | 000,264,704 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB)
DRV - [2002.05.17 01:20:20 | 000,214,105 | ---- | M] (Analog Devices Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\adiusbaw.sys -- (adiusbaw)
DRV - [2002.04.29 02:52:38 | 000,032,023 | ---- | M] (Analog Deivces) [Kernel | Auto | Stopped] -- C:\Windows\System32\drivers\adildr.sys -- (ADILOADER) General Purpose USB Driver (adildr.sys)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.tf2.de/news/"
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24
FF - prefs.js..extensions.enabledItems: {23fcfd51-4958-4f00-80a3-ae97e717ed8b}:2.1.1.94
 
FF - HKLM\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files\DivX\DivX Plus Web Player\firefox\html5video [2011.04.14 14:21:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Firefox\Extensions\\{6904342A-8307-11DF-A508-4AE2DFD72085}: C:\Program Files\DivX\DivX Plus Web Player\firefox\wpa [2011.04.14 14:21:57 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.06.03 07:53:58 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.06.03 07:53:58 | 000,000,000 | ---D | M]
 
[2010.02.04 20:46:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Jan Lorenz\AppData\Roaming\mozilla\Extensions
[2010.02.04 20:46:34 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Jan Lorenz\AppData\Roaming\mozilla\Extensions\songbird@songbirdnest.com
[2011.06.03 09:25:51 | 000,000,000 | -H-D | M] (No name found) -- C:\Users\Jan Lorenz\AppData\Roaming\mozilla\Firefox\Profiles\3hx82ugf.default\extensions
[2010.04.28 14:15:36 | 000,000,000 | -H-D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Jan Lorenz\AppData\Roaming\mozilla\Firefox\Profiles\3hx82ugf.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2011.04.18 15:34:58 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.06.21 16:10:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.14 23:33:14 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
[2010.11.27 14:46:00 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}
[2010.12.20 15:12:04 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}
[2011.04.18 15:34:59 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}
File not found (No name found) -- 
() (No name found) -- C:\USERS\JAN LORENZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3HX82UGF.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
() (No name found) -- C:\USERS\JAN LORENZ\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\3HX82UGF.DEFAULT\EXTENSIONS\{E4A8A97B-F2ED-450B-B12D-EE082BA24781}.XPI
[2011.04.29 12:04:49 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2011.04.18 15:34:29 | 000,472,808 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2009.10.06 11:40:40 | 000,098,304 | ---- | M] (OGPlanet Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npOGPPlugin.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Adobe PDF Reader Link Helper) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (DivX HiQ) - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - No CLSID value found.
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [2kadiras] C:\Windows\2kadiras.exe ()
O4 - HKLM..\Run: [AdobeVersionCue] C:\Program Files\Adobe\Adobe Version Cue\ControlPanel\VersionCueTray.exe (Adobe Systems)
O4 - HKLM..\Run: [amd_dc_opt] C:\Program Files\AMD\Dual-Core Optimizer\amd_dc_opt.exe (AMD)
O4 - HKLM..\Run: [autoclk] C:\Windows\autoclk.exe ()
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\FRITZWLanMini.exe (AVM Berlin GmbH)
O4 - HKLM..\Run: [Cm106Sound]  File not found
O4 - HKLM..\Run: [DivXUpdate] C:\Program Files\DivX\DivX Update\DivXUpdate.exe ()
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [Launch LCDMon] C:\Program Files\Logitech\G-series Software\LCDMon.exe (Logitech Inc.)
O4 - HKLM..\Run: [Launch LGDCore] C:\Program Files\Logitech\G-series Software\LGDCore.exe (Logitech Inc.)
O4 - HKLM..\Run: [Start WingMan Profiler] C:\Program Files\Logitech\Gaming Software\LWEMon.exe (Logitech Inc.)
O4 - HKLM..\Run: [UVS12 Preload] C:\Program Files\Corel\Corel VideoStudio 12\uvPL.exe (Corel TW Corp.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [ICQ]  File not found
O4 - HKCU..\Run: [Pando Media Booster] C:\Program Files\Pando Networks\Media Booster\PMB.exe ()
O4 - HKCU..\Run: [PlayNC Launcher]  File not found
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} -  File not found
O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} -  File not found
O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Program Files\ICQ7.5\ICQ.exe (ICQ, LLC.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Program Files\Bonjour\mdnsNSP.dll (Apple Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Domains: fritz.repeater ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range2 ([*] in Lokales Intranet)
O16 - DPF: {784797A8-342D-4072-9486-03C8D0F2F0A1} https://www.battlefieldheroes.com/static/updater/BFHUpdater_5.0.31.0.cab (Battlefield Heroes Updater)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\Jan Lorenz\Pictures\MOUSTACHES.jpg
O24 - Desktop BackupWallPaper: C:\Users\Jan Lorenz\Pictures\MOUSTACHES.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{626f9f9c-6fb8-11df-b22f-ef3a954a3480}\Shell - "" = AutoRun
O33 - MountPoints2\{626f9f9c-6fb8-11df-b22f-ef3a954a3480}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{70e4ec22-0f5a-11df-a679-000000000000}\Shell - "" = AutoRun
O33 - MountPoints2\{70e4ec22-0f5a-11df-a679-000000000000}\Shell\AutoRun\command - "" = F:\setup.exe
O33 - MountPoints2\{901f618d-6f48-11df-a5ea-fa6f2d79cc84}\Shell - "" = AutoRun
O33 - MountPoints2\{901f618d-6f48-11df-a5ea-fa6f2d79cc84}\Shell\AutoRun\command - "" = G:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias -  File not found
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpReg: msnmsgr - hkey= - key= - C:\Program Files\Windows Live\Messenger\msnmsgr.exe (Microsoft Corporation)
MsConfig - StartUpReg: NCsoft Launcher - hkey= - key= - C:\Program Files\NCSoft\Launcher\NCLauncher.exe (NCSoft)
 
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {2179C5D3-EBFF-11CF-B6FD-00AA00B4E220} - 
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 11.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {2F6EFCE6-10DF-49F9-9E64-9AE3775B2588} - Microsoft .NET Framework 1.1 Security Update (KB2416447)
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460)
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA848-CC51-11CF-AAFA-00AA00B6015C} - 
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\system32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework
ActiveX: {CDD7975E-60F8-41d5-8149-19E51D6F71D0} - Windows Movie Maker v2.1
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - C:\Windows\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\system32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - RunDLL32 IEDKCS32.DLL,BrandIE4 SIGNUP
 
Drivers32: msacm.dvacm - C:\Program Files\Common Files\Ulead Systems\VIO\DVACM.acm (Corel TW Corp.)
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.lhacm - C:\Windows\System32\lhacm.acm (Microsoft Corporation)
Drivers32: msacm.MPEGacm - C:\Program Files\Common Files\Ulead Systems\MPEG\MPEGACM.acm (Ulead Systems, Inc.)
Drivers32: msacm.ulmp3acm - C:\Program Files\Common Files\Ulead Systems\MPEG\ulmp3acm.acm (Ulead systems)
Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.)
Drivers32: VIDC.FPS1 - C:\Windows\System32\frapsvid.dll (Beepa P/L)
Drivers32: vidc.i420 - C:\Windows\System32\i420vfw.dll (www.helixcommunity.org)
Drivers32: vidc.tscc - C:\Windows\System32\tsccvid.dll (TechSmith Corporation)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2011.06.12 09:50:51 | 000,580,608 | ---- | C] (OldTimer Tools) -- C:\Users\Jan Lorenz\Desktop\OTL.exe
[2011.06.11 18:32:46 | 000,000,000 | -H-D | C] -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Windows Vista Restore
[2011.06.11 18:32:29 | 000,379,904 | -H-- | C] (Microsoft Corporation) -- C:\ProgramData\33611512.exe
[2011.06.08 17:54:11 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Games for Windows Marketplace
[2011.06.08 16:05:47 | 000,000,000 | -H-D | C] -- C:\Users\Jan Lorenz\Desktop\Terraria
[2011.06.08 12:12:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2011.06.08 12:12:04 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Skype
[2011.06.08 12:12:01 | 000,000,000 | R--D | C] -- C:\Program Files\Skype
[2011.06.03 07:55:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\iTunes
[2011.06.03 07:54:56 | 000,000,000 | ---D | C] -- C:\Program Files\iPod
[2011.06.03 07:54:55 | 000,000,000 | ---D | C] -- C:\Program Files\iTunes
[2011.06.03 07:53:48 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\QuickTime
[2011.06.03 07:51:07 | 000,000,000 | ---D | C] -- C:\Program Files\Bonjour
[2011.06.03 07:22:42 | 000,000,000 | -H-D | C] -- C:\Users\Jan Lorenz\Desktop\Test Drive Unlimited 2
[2011.05.25 16:40:18 | 000,000,000 | -HSD | C] -- C:\ProgramData\DSS
[2011.05.25 16:39:07 | 000,000,000 | -H-D | C] -- C:\Users\Jan Lorenz\AppData\Roaming\Lionhead Studios
[2011.05.25 14:10:33 | 000,000,000 | ---D | C] -- C:\Program Files\Fable III
[2011.05.24 09:39:10 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ICQ7.5
[2011.05.24 09:38:34 | 000,000,000 | -H-D | C] -- C:\Program Files\ICQ7.5
[2011.05.23 17:59:38 | 000,000,000 | -H-D | C] -- C:\Users\Jan Lorenz\AppData\Roaming\NVIDIA
[2011.05.15 15:20:33 | 000,000,000 | -H-D | C] -- C:\Users\Jan Lorenz\Documents\My Cheat Tables
[2011.05.15 15:08:33 | 000,000,000 | ---D | C] -- C:\Program Files\Cheat Engine 6
[2011.05.14 13:25:48 | 000,000,000 | -H-D | C] -- C:\Users\Jan Lorenz\Desktop\USBSICHERUNG
[2011.05.13 13:55:52 | 000,000,000 | -H-D | C] -- C:\ProgramData\Skype Extras
[2007.08.13 18:46:00 | 000,102,912 | -H-- | C] (Albert L Faber) -- C:\Users\Jan Lorenz\AppData\Local\CDRip.dll
[2007.01.18 22:09:54 | 000,623,616 | -H-- | C] (Ivan Bischof ©2003 - 2005) -- C:\Users\Jan Lorenz\AppData\Local\No23 Recorder.exe
[2006.12.11 20:13:14 | 000,013,872 | -H-- | C] (Un4seen Developments) -- C:\Users\Jan Lorenz\AppData\Local\basscd.dll
[2006.12.11 20:13:12 | 000,097,336 | -H-- | C] (Un4seen Developments) -- C:\Users\Jan Lorenz\AppData\Local\bass.dll
[5 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2011.06.12 09:54:45 | 000,681,176 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.06.12 09:54:45 | 000,640,206 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.06.12 09:54:45 | 000,148,446 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.06.12 09:54:45 | 000,122,090 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.06.12 09:48:35 | 000,004,048 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.06.12 09:48:35 | 000,004,048 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.06.12 09:48:25 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2011.06.12 09:48:11 | 3486,724,096 | -HS- | M] () -- C:\hiberfil.sys
[2011.06.12 09:33:42 | 000,580,608 | ---- | M] (OldTimer Tools) -- C:\Users\Jan Lorenz\Desktop\OTL.exe
[2011.06.12 06:53:01 | 369,316,304 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2011.06.11 18:54:34 | 000,000,392 | -H-- | M] () -- C:\ProgramData\33611512
[2011.06.11 18:41:40 | 000,000,112 | -H-- | M] () -- C:\ProgramData\~33611512
[2011.06.11 18:41:39 | 000,000,128 | -H-- | M] () -- C:\ProgramData\~33611512r
[2011.06.11 18:40:43 | 000,053,098 | -H-- | M] () -- C:\ProgramData\nvModes.dat
[2011.06.11 18:40:42 | 000,053,098 | -H-- | M] () -- C:\ProgramData\nvModes.001
[2011.06.11 18:32:46 | 000,000,593 | -H-- | M] () -- C:\Users\Jan Lorenz\Desktop\Windows Vista Restore.lnk
[2011.06.08 23:46:28 | 000,139,128 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2011.06.08 23:46:19 | 000,215,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr
[2011.06.08 23:42:26 | 000,215,128 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0
[2011.05.31 09:46:40 | 000,148,992 | -H-- | M] () -- C:\Users\Jan Lorenz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011.05.25 14:18:57 | 000,000,000 | -H-- | M] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2011.05.25 14:05:15 | 004,936,973 | -H-- | M] () -- C:\Users\Jan Lorenz\Desktop\world1.png
[2011.05.23 14:03:26 | 000,000,708 | -H-- | M] () -- C:\Users\Jan Lorenz\Desktop\WorldView - Verknüpfung.lnk
[2011.05.19 09:59:23 | 000,001,474 | -H-- | M] () -- C:\Users\Jan Lorenz\Desktop\ICQ.lnk
[2011.05.18 21:50:45 | 000,057,199 | -H-- | M] () -- C:\Users\Jan Lorenz\Documents\mathemerkhilfe.pdf
[2011.05.16 14:51:16 | 000,014,590 | -H-- | M] () -- C:\Users\Jan Lorenz\Desktop\HABA-Anschreiben.odt
[2011.05.16 13:17:37 | 000,138,063 | -H-- | M] () -- C:\Users\Jan Lorenz\Documents\thumbs_EMOK Picdump 189_113.jpg
[2011.05.15 15:08:36 | 000,000,826 | -H-- | M] () -- C:\Users\Jan Lorenz\Desktop\Cheat Engine.lnk
[5 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[4 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2011.06.12 06:53:03 | 3486,724,096 | -HS- | C] () -- C:\hiberfil.sys
[2011.06.11 23:43:13 | 369,316,304 | ---- | C] () -- C:\Windows\MEMORY.DMP
[2011.06.11 18:32:47 | 000,000,128 | -H-- | C] () -- C:\ProgramData\~33611512r
[2011.06.11 18:32:47 | 000,000,112 | -H-- | C] () -- C:\ProgramData\~33611512
[2011.06.11 18:32:46 | 000,000,593 | -H-- | C] () -- C:\Users\Jan Lorenz\Desktop\Windows Vista Restore.lnk
[2011.06.11 18:32:32 | 000,000,392 | -H-- | C] () -- C:\ProgramData\33611512
[2011.05.25 14:18:57 | 000,000,000 | -H-- | C] () -- C:\Windows\System32\drivers\Msft_User_WpdMtpDr_01_00_00.Wdf
[2011.05.25 14:05:13 | 004,936,973 | -H-- | C] () -- C:\Users\Jan Lorenz\Desktop\world1.png
[2011.05.23 14:03:26 | 000,000,708 | -H-- | C] () -- C:\Users\Jan Lorenz\Desktop\WorldView - Verknüpfung.lnk
[2011.05.18 21:50:45 | 000,057,199 | -H-- | C] () -- C:\Users\Jan Lorenz\Documents\mathemerkhilfe.pdf
[2011.05.16 14:48:11 | 000,014,590 | -H-- | C] () -- C:\Users\Jan Lorenz\Desktop\HABA-Anschreiben.odt
[2011.05.16 13:17:21 | 000,138,063 | -H-- | C] () -- C:\Users\Jan Lorenz\Documents\thumbs_EMOK Picdump 189_113.jpg
[2011.05.15 15:08:36 | 000,000,826 | -H-- | C] () -- C:\Users\Jan Lorenz\Desktop\Cheat Engine.lnk
[2011.04.26 23:34:58 | 000,000,059 | ---- | C] () -- C:\Windows\RUNAWAY.INI
[2011.04.09 18:55:28 | 000,179,261 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2011.03.18 14:45:28 | 000,000,022 | -HS- | C] () -- C:\Users\Jan Lorenz\AppData\Roaming\Sys2662.Config.Repository.bin
[2011.03.03 21:47:26 | 000,016,384 | ---- | C] () -- C:\Windows\System32\FileOps.exe
[2011.02.25 17:55:32 | 000,021,840 | ---- | C] () -- C:\Windows\System32\SIntfNT.dll
[2011.02.25 17:55:32 | 000,017,212 | ---- | C] () -- C:\Windows\System32\SIntf32.dll
[2011.02.25 17:55:32 | 000,012,067 | ---- | C] () -- C:\Windows\System32\SIntf16.dll
[2011.02.25 17:47:37 | 000,036,266 | ---- | C] () -- C:\Windows\DIIUnin.dat
[2010.12.11 09:38:17 | 000,000,098 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\fusioncache.dat
[2010.09.25 18:23:47 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.09.25 18:23:46 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.08.31 18:48:52 | 002,434,856 | ---- | C] () -- C:\Windows\System32\pbsvc_bc2.exe
[2010.07.18 14:01:24 | 000,104,020 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat
[2010.06.03 22:27:35 | 000,097,312 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin
[2010.04.03 19:05:07 | 000,143,360 | ---- | C] () -- C:\Windows\Vmix106.dll
[2010.04.03 19:05:00 | 000,552,960 | ---- | C] () -- C:\Windows\System32\Cmeau106.exe
[2010.04.03 19:05:00 | 000,000,863 | ---- | C] () -- C:\Windows\Cm106.ini.cfl
[2010.04.03 19:04:02 | 000,000,163 | ---- | C] () -- C:\Windows\Cm106.ini.imi
[2010.04.03 19:04:01 | 000,303,104 | ---- | C] () -- C:\Windows\System32\CmiInstallResAll.dll
[2010.04.03 19:04:01 | 000,002,391 | ---- | C] () -- C:\Windows\Cm106.ini.cfg
[2010.02.27 00:18:39 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.02.18 21:51:58 | 000,080,384 | ---- | C] () -- C:\Windows\gamedelete.exe
[2010.02.17 18:34:24 | 000,138,056 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Roaming\PnkBstrK.sys
[2010.02.17 18:34:08 | 002,427,248 | ---- | C] () -- C:\Windows\System32\pbsvc_heroes.exe
[2010.02.14 15:29:42 | 000,209,040 | ---- | C] () -- C:\Windows\System32\IVIresizeW7.dll
[2010.02.14 15:29:42 | 000,204,944 | ---- | C] () -- C:\Windows\System32\IVIresizeA6.dll
[2010.02.14 15:29:42 | 000,196,752 | ---- | C] () -- C:\Windows\System32\IVIresizeP6.dll
[2010.02.14 15:29:42 | 000,196,752 | ---- | C] () -- C:\Windows\System32\IVIresizeM6.dll
[2010.02.14 15:29:42 | 000,192,656 | ---- | C] () -- C:\Windows\System32\IVIresizePX.dll
[2010.02.14 15:29:42 | 000,024,720 | ---- | C] () -- C:\Windows\System32\IVIresize.dll
[2010.02.09 20:22:09 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2010.02.08 15:45:09 | 000,139,128 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys
[2010.02.08 15:19:35 | 000,215,128 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2010.02.08 15:19:33 | 000,075,136 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe
[2010.02.08 15:19:32 | 002,373,712 | ---- | C] () -- C:\Windows\System32\pbsvc.exe
[2010.02.01 19:44:31 | 000,106,605 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2010.02.01 19:44:31 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2010.01.31 16:54:32 | 000,000,369 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Roaming\burnaware.ini
[2010.01.23 00:28:12 | 000,053,098 | -H-- | C] () -- C:\ProgramData\nvModes.001
[2010.01.22 23:46:46 | 000,053,098 | -H-- | C] () -- C:\ProgramData\nvModes.dat
[2010.01.22 23:26:38 | 000,148,992 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2010.01.22 21:32:22 | 000,000,000 | ---- | C] () -- C:\Windows\nsreg.dat
[2010.01.22 21:15:02 | 000,000,064 | ---- | C] () -- C:\Windows\adidsl.ini
[2010.01.22 21:15:00 | 000,127,456 | ---- | C] () -- C:\Windows\System32\IPDETECT.EXE
[2010.01.22 21:15:00 | 000,046,892 | ---- | C] () -- C:\Windows\System32\ADADIX16.DLL
[2010.01.22 21:15:00 | 000,032,768 | ---- | C] () -- C:\Windows\2kadiras.exe
[2010.01.22 21:15:00 | 000,000,355 | ---- | C] () -- C:\Windows\adiras.ini
[2010.01.22 21:14:59 | 000,147,456 | -H-- | C] () -- C:\Windows\autoclk.exe
[2010.01.22 21:14:59 | 000,022,395 | ---- | C] () -- C:\Windows\System32\drivers\fpga.bin
[2010.01.22 20:39:15 | 000,001,746 | ---- | C] () -- C:\Windows\Language_trs.ini
[2010.01.22 20:38:58 | 000,007,680 | ---- | C] () -- C:\Windows\System32\drivers\ASACPI.sys
[2010.01.22 20:38:50 | 000,034,388 | ---- | C] () -- C:\Windows\Ascd_tmp.ini
[2010.01.22 20:38:50 | 000,010,296 | ---- | C] () -- C:\Windows\System32\drivers\ASUSHWIO.SYS
[2010.01.22 19:35:54 | 000,000,680 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\d3d9caps.dat
[2008.12.19 08:42:28 | 000,000,518 | ---- | C] () -- C:\Windows\cm106.ini
[2007.08.13 18:46:00 | 000,155,136 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\lame_enc.dll
[2006.11.02 17:33:31 | 000,681,176 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2006.11.02 17:33:31 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2006.11.02 17:33:31 | 000,148,446 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2006.11.02 17:33:31 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,275,552 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,640,206 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,122,090 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2006.10.26 02:06:48 | 000,064,000 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\vorbisenc.dll
[2006.10.26 02:06:48 | 000,019,456 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\vorbisfile.dll
[2006.10.26 02:06:46 | 000,143,872 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\vorbis.dll
[2006.10.26 02:06:36 | 000,015,872 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\ogg.dll
[2005.08.23 23:34:06 | 000,029,184 | -H-- | C] () -- C:\Users\Jan Lorenz\AppData\Local\no23xwrapper.dll
 
========== LOP Check ==========
 
[2011.04.24 17:30:14 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\.minecraft
[2011.04.24 13:45:37 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\.Nitrous
[2011.04.01 16:58:10 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Atari
[2011.04.19 11:30:49 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Audacity
[2010.12.22 15:09:54 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Beat Hazard
[2010.12.22 14:44:55 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Chime
[2010.02.12 21:27:33 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\DAEMON Tools Lite
[2010.06.24 15:26:40 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Downloaded Installations
[2011.03.24 18:34:28 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\EvaBox
[2010.05.18 13:54:43 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\GetRightToGo
[2011.01.14 20:33:06 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Hi-Rez Studios
[2010.12.25 17:03:28 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Hothead Games
[2011.06.11 15:24:08 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\ICQ
[2011.06.02 15:04:40 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\IrfanView
[2010.01.22 20:54:56 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Leadertech
[2011.05.25 16:39:07 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Lionhead Studios
[2010.05.12 16:42:04 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\LolClient
[2010.01.23 01:10:40 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2011.03.07 19:15:00 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Mumble
[2010.02.11 14:14:15 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\OpenOffice.org
[2010.12.22 13:45:35 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Polynomial
[2010.04.20 20:13:14 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\runic games
[2010.02.04 20:46:22 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Songbird2
[2010.01.23 19:01:51 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\TS3Client
[2010.06.18 13:44:46 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Ubisoft
[2010.02.14 17:14:14 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Ulead Systems
[2010.09.08 18:53:05 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\WB Games
[2011.06.12 09:30:57 | 000,032,602 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2011.04.24 17:30:14 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\.minecraft
[2011.04.24 13:45:37 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\.Nitrous
[2011.03.24 18:40:18 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Adobe
[2011.03.24 18:40:21 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\AdobeAUM
[2010.07.05 15:47:49 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Apple Computer
[2011.04.01 16:58:10 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Atari
[2011.04.19 11:30:49 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Audacity
[2010.12.24 16:28:35 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Avira
[2010.12.22 15:09:54 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Beat Hazard
[2010.12.22 14:44:55 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Chime
[2010.02.12 21:27:33 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\DAEMON Tools Lite
[2010.11.28 20:58:37 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\DivX
[2010.06.24 15:26:40 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Downloaded Installations
[2011.04.29 12:35:13 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\dvdcss
[2011.03.24 18:34:28 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\EvaBox
[2010.05.18 13:54:43 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\GetRightToGo
[2011.01.14 20:33:06 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Hi-Rez Studios
[2010.12.25 17:03:28 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Hothead Games
[2011.06.11 15:24:08 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\ICQ
[2010.01.22 19:35:58 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Identities
[2011.06.02 15:04:40 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\IrfanView
[2010.01.22 20:54:56 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Leadertech
[2011.05.25 16:39:07 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Lionhead Studios
[2010.05.12 16:42:04 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\LolClient
[2010.01.23 01:10:40 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\LolClient.F24C99354F615F3BAB18AE7B93E3F9B9E8784FA6.1
[2010.01.22 21:26:56 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Macromedia
[2006.11.02 14:37:34 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Media Center Programs
[2010.05.09 14:07:58 | 000,000,000 | --SD | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft
[2010.12.11 13:32:28 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Mozilla
[2011.03.07 19:15:00 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Mumble
[2011.05.23 17:59:38 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\NVIDIA
[2010.02.11 14:14:15 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\OpenOffice.org
[2010.12.22 13:45:35 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Polynomial
[2010.04.20 20:13:14 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\runic games
[2010.08.31 18:54:03 | 000,000,000 | RH-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\SecuROM
[2011.06.12 09:51:59 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Skype
[2011.06.12 08:04:39 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\skypePM
[2010.02.04 20:46:22 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Songbird2
[2010.09.04 22:03:15 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Sun
[2010.04.02 22:12:52 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\teamspeak2
[2010.01.23 19:01:51 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\TS3Client
[2010.06.18 13:44:46 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Ubisoft
[2010.02.14 17:14:14 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Ulead Systems
[2010.09.17 14:04:48 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\vlc
[2010.09.08 18:53:05 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\WB Games
[2010.05.09 14:18:08 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\Winamp
[2010.01.27 14:55:15 | 000,000,000 | -H-D | M] -- C:\Users\Jan Lorenz\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2011.04.24 13:36:23 | 000,909,157 | -H-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\.minecraft\texturepacks\mcpatcher-2.0.0-beta4.exe
[2011.03.24 18:35:36 | 001,736,704 | -H-- | M] (Adobe Systems Incorporated) -- C:\Users\Jan Lorenz\AppData\Roaming\EvaBox\InDesign2\#PROGRAMFILES#\Adobe\Adobe InDesign CS\InDesign.exe
[2010.02.17 18:58:13 | 000,038,784 | -H-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2010.02.08 15:23:57 | 000,003,584 | RH-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{121634B0-2F4B-11D3-ADA3-00C04F52DD52}\Icon386ED4E3.exe
[2010.03.09 20:27:42 | 000,003,262 | RH-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{22B0E143-2B0B-435B-9F56-136A3D16065F}\controlPanelIcon.exe
[2010.03.09 20:27:42 | 000,010,134 | RH-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{22B0E143-2B0B-435B-9F56-136A3D16065F}\SystemFolder_msiexec.exe
[2010.05.12 09:47:17 | 000,090,112 | RH-- | M] (InstallShield Software Corp.) -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\ARPPRODUCTICON.exe
[2010.05.12 09:47:18 | 000,090,112 | RH-- | M] (InstallShield Software Corp.) -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut1_870013DB984D42A89E638673D8B2775A.exe
[2010.05.12 09:47:18 | 000,040,960 | RH-- | M] (InstallShield Software Corp.) -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut2_870013DB984D42A89E638673D8B2775A.exe
[2010.05.12 09:47:18 | 000,090,112 | RH-- | M] (InstallShield Software Corp.) -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\NewShortcut3_870013DB984D42A89E638673D8B2775A.exe
[2010.05.12 09:47:18 | 000,008,854 | RH-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{870013DB-984D-42A8-9E63-8673D8B2775A}\Uninstall_Stubbs_The_870013DB984D42A89E638673D8B2775A.exe
[2010.02.28 18:14:16 | 000,040,960 | RH-- | M] (InstallShield Software Corp.) -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\ARPPRODUCTICON.exe
[2010.02.28 18:14:16 | 000,040,960 | RH-- | M] (InstallShield Software Corp.) -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\NewShortcut1_9559F7CA5E344237A2D9D856464AD727.exe
[2010.02.28 18:14:16 | 000,008,854 | RH-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{9559F7CA-5E34-4237-A2D9-D856464AD727}\Uninstall_Project64__9559F7CA5E344237A2D9D856464AD727.exe
[2010.07.11 16:40:33 | 000,010,134 | RH-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\Microsoft\Installer\{9FD6F1A8-5550-46AF-8509-271DF0E768B5}\ARPPRODUCTICON.exe
[2009.11.11 13:18:30 | 000,428,032 | -H-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\runic games\torchlight\mods\cm-tl33trn\cm-tl33trn.exe
[2009.11.08 23:40:10 | 000,216,576 | -H-- | M] () -- C:\Users\Jan Lorenz\AppData\Roaming\runic games\torchlight\mods\torchlight_mod_manager\Torchlight Mod Manager\Torchlight Mod Manager.exe
 
< %SYSTEMDRIVE%\*.exe >
[2007.11.07 09:03:18 | 000,562,688 | ---- | M] (Microsoft Corporation) -- C:\install.exe
 
 
< MD5 for: AGP440.SYS  >
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_f750e484\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6001.18000_none_ba12ed3bbeb0d97a\AGP440.sys
[2008.01.19 09:42:25 | 000,056,376 | ---- | M] (Microsoft Corporation) MD5=13F9E33747E6B41A3FF305C37DB0D360 -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.0.6002.18005_none_bbfe6647bbd2a4c6\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\drivers\AGP440.sys
[2006.11.02 11:49:52 | 000,053,864 | ---- | M] (Microsoft Corporation) MD5=EF23439CDD587F64C2C1B8825CEAD7D8 -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_920a2c1f\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.04.11 08:32:26 | 000,019,944 | ---- | M] (Microsoft Corporation) MD5=1F05B78AB91C9075565A9D8A4B880BC4 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_mshdc.inf_31bf3856ad364e35_6.0.6002.18005_none_df23a1261eab99e8\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\drivers\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_cc18792d\atapi.sys
[2008.01.19 09:41:30 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=2D9C903DC76A66813D350A562DE40ED9 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6001.18000_none_dd38281a2189ce9c\atapi.sys
[2006.11.02 11:49:36 | 000,019,048 | ---- | M] (Microsoft Corporation) MD5=4F4FCB8B6EA06784FB6D475B7EC7300F -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_c6c2e699\atapi.sys
[2010.01.22 23:31:35 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_7de13c21\atapi.sys
[2010.01.22 23:31:35 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=B35CFCEF838382AB6490B321C87EDF17 -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.16632_none_db337a442479c42c\atapi.sys
[2010.01.22 23:31:34 | 000,021,560 | ---- | M] (Microsoft Corporation) MD5=E03E8C99D15D0381E02743C36AFC7C6F -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.0.6000.20757_none_dbac78a93da31a8b\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\System32\cngaudit.dll
[2006.11.02 11:46:03 | 000,011,776 | ---- | M] (Microsoft Corporation) MD5=7F15B4953378C8B5161D65C26D5FED4D -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.0.6000.16386_none_e62d292932a96ce6\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_c9df7691\iaStorV.sys
[2008.01.19 09:42:51 | 000,235,064 | ---- | M] (Intel Corporation) MD5=54155EA1B0DF185878E0FC9EC3AC3A14 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.0.6001.18000_none_af11527887c7fa8f\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\drivers\iaStorV.sys
[2006.11.02 11:51:25 | 000,232,040 | ---- | M] (Intel Corporation) MD5=C957BF4B5D80B46C5017BF0101E6C906 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_37cdafa4\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2006.11.02 11:46:11 | 000,559,616 | ---- | M] (Microsoft Corporation) MD5=889A2C9F2AACCD8F64EF50AC0B3D553B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6000.16386_none_fb80f5473b0ed783\netlogon.dll
[2009.04.11 08:28:23 | 000,592,896 | ---- | M] (Microsoft Corporation) MD5=95DAECF0FB120A7B5DA679CC54E37DDE -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6002.18005_none_ffa3304f351bb3a3\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\System32\netlogon.dll
[2008.01.19 09:35:36 | 000,592,384 | ---- | M] (Microsoft Corporation) MD5=A8EFC0B6E75B789F7FD3BA5025D4E37F -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.0.6001.18000_none_fdb7b74337f9e857\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\drivers\nvstor.sys
[2006.11.02 11:50:13 | 000,040,040 | ---- | M] (NVIDIA Corporation) MD5=9E0BA19A28C498A6D323D065DB76DFFC -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_733654ff\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_31c3d71d\nvstor.sys
[2008.01.19 09:42:09 | 000,045,112 | ---- | M] (NVIDIA Corporation) MD5=ABED0C09758D1D97DB0042DBB2688177 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.0.6001.18000_none_39dac327befea467\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\System32\scecli.dll
[2008.01.19 09:36:19 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=28B84EB538F7E8A0FE8B9299D591E0B9 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6001.18000_none_380de25bd91b6f12\scecli.dll
[2006.11.02 11:46:12 | 000,176,640 | ---- | M] (Microsoft Corporation) MD5=80E2839D05CA5970A86D7BE2A08BFF61 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6000.16386_none_35d7205fdc305e3e\scecli.dll
[2009.04.11 08:28:24 | 000,177,152 | ---- | M] (Microsoft Corporation) MD5=8FC182167381E9915651267044105EE1 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.0.6002.18005_none_39f95b67d63d3a5e\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.01.22 22:14:16 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=63B4F59D7C89B1BF5277F1FFEFD491CD -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16438_none_cb39bc5b7047127e\user32.dll
[2009.04.11 08:28:25 | 000,627,712 | ---- | M] (Microsoft Corporation) MD5=75510147B94598407666F4802797C75A -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6002.18005_none_cf23e54d6a7e4a7e\user32.dll
[2010.01.22 22:14:16 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=9D9F061EDA75425FC67F0365E3467C86 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.20537_none_cbc258dc896598f1\user32.dll
[2006.11.02 11:46:13 | 000,633,856 | ---- | M] (Microsoft Corporation) MD5=E698A5437B89A285ACA3FF022356810A -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6000.16386_none_cb01aa4570716e5e\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\System32\user32.dll
[2008.01.19 09:36:46 | 000,627,200 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.0.6001.18000_none_cd386c416d5c7f32\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\System32\userinit.exe
[2008.01.19 09:33:33 | 000,025,088 | ---- | M] (Microsoft Corporation) MD5=0E135526E9785D085BCD9AEDE6FBCBF9 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6001.18000_none_dc28ba15d1aff80b\userinit.exe
[2006.11.02 11:45:50 | 000,024,576 | ---- | M] (Microsoft Corporation) MD5=22027835939F86C3E47AD8E3FBDE3D11 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.0.6000.16386_none_d9f1f819d4c4e737\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\System32\wininit.exe
[2008.01.19 09:33:37 | 000,096,768 | ---- | M] (Microsoft Corporation) MD5=101BA3EA053480BB5D957EF37C06B5ED -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6001.18000_none_30f2b8cf0450a6a2\wininit.exe
[2006.11.02 11:45:57 | 000,095,744 | ---- | M] (Microsoft Corporation) MD5=D4385B03E8CCCEE6F0EE249F827C1F3E -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.0.6000.16386_none_2ebbf6d3076595ce\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2009.04.11 08:28:13 | 000,314,368 | ---- | M] (Microsoft Corporation) MD5=898E7C06A350D4A1A64A9EA264D55452 -- C:\Windows\SoftwareDistribution\Download\cde11068f5b77b180111333ef9781925\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6002.18005_none_71ae7a22d2134741\winlogon.exe
[2006.11.02 11:45:57 | 000,308,224 | ---- | M] (Microsoft Corporation) MD5=9F75392B9128A91ABAFB044EA350BAAD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6000.16386_none_6d8c3f1ad8066b21\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\System32\winlogon.exe
[2008.01.19 09:33:37 | 000,314,880 | ---- | M] (Microsoft Corporation) MD5=C2610B6BDBEFC053BBDAB4F1B965CB24 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.0.6001.18000_none_6fc30116d4f17bf5\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2006.11.02 10:58:26 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=84620AECDCFD2A7A14E6263927D8C0ED -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6000.16386_none_4d4fded8cae2956d\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2008.01.19 07:56:49 | 000,015,872 | ---- | M] (Microsoft Corporation) MD5=E3A3CB253C0EC2494D4A61F5E43A389C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.0.6001.18000_none_4f86a0d4c7cda641\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
[2010.01.31 16:27:46 | 000,691,696 | ---- | M] () Unable to obtain MD5 -- C:\Windows\System32\drivers\sptd.sys
 
< %systemroot%\System32\config\*.sav >
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\COMPONENTS.SAV
[2006.11.02 12:34:05 | 000,020,480 | ---- | M] () -- C:\Windows\System32\config\DEFAULT.SAV
[2006.11.02 12:34:05 | 000,008,192 | ---- | M] () -- C:\Windows\System32\config\SECURITY.SAV
[2006.11.02 12:34:08 | 010,133,504 | ---- | M] () -- C:\Windows\System32\config\SOFTWARE.SAV
[2006.11.02 12:34:08 | 001,826,816 | ---- | M] () -- C:\Windows\System32\config\SYSTEM.SAV
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[4 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ]

< End of report >
         

--- --- ---

Nun habe ich doch leichte Angst ob mein Pc jemals wieder ganz davon befreit ist.

Danke im vorraus.

EDIT: Momentan leidet mein Pc noch unter einem schwarzen DesktopHintergrund, es werden keine Dateien in Ordnern angezeigt (ausser ich stelle es so ein, dass unsichtbare Dateien angezeigt werden) und es werden nicht alle Desktop-Shortcuts angezeigt, selbst wenn ich unsichtbare dateien anzeigen lasse.

Sorry Beitrag ging nichtmehr editieren, hier noch das OTL-Extras, per USB-Stick auf den Laptop geschoben (hoffe ich mache nichts falsch)OTL EXTRAS Logfile:

OTL Extras logfile created on: 12.06.2011 09:52:31 - Run 1
OTL by OldTimer - Version 3.2.24.0     Folder = C:\Users\Jan Lorenz\Desktop
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,25 Gb Total Physical Memory | 2,26 Gb Available Physical Memory | 69,60% Memory free
6,69 Gb Paging File | 5,69 Gb Available in Paging File | 85,11% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 465,75 Gb Total Space | 41,60 Gb Free Space | 8,93% Space Free | Partition Type: NTFS
Drive H: | 1397,26 Gb Total Space | 643,30 Gb Free Space | 46,04% Space Free | Partition Type: NTFS
 
Computer Name: WINDOWS-SLV5UWZ | User Name: Jan Lorenz | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Browse with &IrfanView] -- "C:\Program Files\IrfanView\i_view32.exe" "%1 /thumbs" (Irfan Skiljan)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
"C:\Program Files\NCsoft\Exteel (US)\System\Exteel.exe" = C:\Program Files\NCsoft\Exteel (US)\System\Exteel.exe:*:Enabled:Exteel
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
"C:\Program Files\NCsoft\Exteel (US)\System\Exteel.exe" = C:\Program Files\NCsoft\Exteel (US)\System\Exteel.exe:*:Enabled:Exteel
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{08008F9A-566B-4ADB-B397-51CF8D55271F}" = lport=8397 | protocol=17 | dir=in | name=league of legends launcher | 
"{0CA85ED4-0DE2-4A43-B294-82D4C1B4CD62}" = lport=6946 | protocol=6 | dir=in | name=league of legends launcher | 
"{0FA9C39D-1D00-471F-8FED-683DDA5057BE}" = lport=6983 | protocol=17 | dir=in | name=league of legends launcher | 
"{1596508D-020B-465A-AE3D-695661B8C5A2}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client | 
"{1F6020DB-E86E-432E-945D-DD6BE8A4E540}" = lport=8397 | protocol=6 | dir=in | name=league of legends launcher | 
"{288D60AE-1380-4E4D-8B68-2599963145A1}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{290A1EC1-8DCF-4C9D-A1D0-E6BA9B645FE0}" = lport=6930 | protocol=17 | dir=in | name=league of legends launcher | 
"{335E84A5-6F7A-41E6-9754-2792AFFE53FE}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{3943AA21-E13E-472A-B23B-AB4682F8F07F}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher | 
"{3B7F23B9-3F34-4373-BAD2-0BD194993B52}" = lport=6961 | protocol=17 | dir=in | name=league of legends launcher | 
"{3E1CC1F2-4475-4DD7-A5B1-7FB7F793B765}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher | 
"{3F6DF80D-1D2D-40A2-BDAF-D8A206FF6DD6}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{45B3D4E1-ECC0-4BB6-B2EE-CFDE4C3EBEC0}" = lport=6931 | protocol=17 | dir=in | name=league of legends launcher | 
"{5A19DBAD-DCF7-493E-9D5E-57C4980A354E}" = lport=6983 | protocol=6 | dir=in | name=league of legends launcher | 
"{5FCF3913-DE0A-4C7C-B31C-05D6DE153208}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{62898FC8-390B-4D2C-A69E-72ECE9CFD77F}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher | 
"{68F9818D-43B1-432D-B1F0-C9D8F5A0CD98}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client | 
"{6A4A2E07-7F06-420E-89D5-7956F571B1BA}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher | 
"{7576569F-545C-4064-8079-8AF5D780A58A}" = lport=6902 | protocol=6 | dir=in | name=league of legends launcher | 
"{7832D0FE-D1DA-4043-9E0A-177FE291E07F}" = lport=6952 | protocol=6 | dir=in | name=league of legends launcher | 
"{7F7B46B8-10BA-42F9-A713-0540F99130A2}" = lport=6957 | protocol=17 | dir=in | name=league of legends launcher | 
"{8A0EF1DE-7328-4D91-AEBE-A08F0ED86288}" = lport=6952 | protocol=17 | dir=in | name=league of legends launcher | 
"{8B6E1CDF-1C55-486A-AEF7-7D3455123198}" = lport=6967 | protocol=6 | dir=in | name=league of legends launcher | 
"{8D0C45E8-2DA3-4E94-BEF3-10132FBDB226}" = lport=6946 | protocol=17 | dir=in | name=league of legends launcher | 
"{9198E21B-3246-45BF-8B10-9BEA4088B693}" = lport=6931 | protocol=6 | dir=in | name=league of legends launcher | 
"{991CF6FB-9FB6-4417-A5BA-38397CA7FC0C}" = lport=6930 | protocol=6 | dir=in | name=league of legends launcher | 
"{9A17F113-FD54-4D16-B34C-B514B02F63A8}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby | 
"{9A468F3A-D79A-4E76-80A3-4212F7CB0CA2}" = lport=8397 | protocol=17 | dir=in | name=league of legends launcher | 
"{9B8E2475-8EA7-497B-A81B-B8B640A85FB6}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=svchost.exe | 
"{9BADC99F-E16D-431C-BF8F-39645955B8B2}" = lport=6957 | protocol=6 | dir=in | name=league of legends launcher | 
"{AC3B6F8A-1504-43A2-B262-C4DEC6F9BCEA}" = lport=6967 | protocol=17 | dir=in | name=league of legends launcher | 
"{AD6A9D0B-3464-4CE3-BB09-471AB48D483B}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher | 
"{B2E84345-C258-475D-B40E-6B1507CC9F7D}" = lport=6902 | protocol=17 | dir=in | name=league of legends launcher | 
"{B3936B5D-15FF-478B-B584-920A5A59D74C}" = lport=8397 | protocol=6 | dir=in | name=league of legends launcher | 
"{B7F0FCD9-84ED-44F7-BF3C-AA41FB646F9F}" = lport=6961 | protocol=6 | dir=in | name=league of legends launcher | 
"{BFA85365-C1F7-4950-9CB6-7FFAE45A6DA7}" = lport=8398 | protocol=17 | dir=in | name=league of legends launcher | 
"{D115A7A6-C3A6-42AF-86DB-C797A7C7A16E}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher | 
"{D61EE4D5-1018-442E-A0EC-5E0DE398A140}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client | 
"{DB3C25EA-827D-4F2D-AF90-B088A655F234}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client | 
"{E5676AA7-1EAD-48D9-AA9B-ACF7EB4BBFAC}" = lport=8398 | protocol=6 | dir=in | name=league of legends launcher | 
"{E9B89EED-4B60-4F35-B683-DC2FD645C022}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby | 
"{EBD561EF-B5A4-41EC-ADF0-A25846539A25}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby | 
"{F9B32FD9-F530-4A3B-B973-92EF89F817F8}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{02789B1A-4937-43FB-90FF-1C8E512D24DA}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\mass effect 2\masseffect2launcher.exe | 
"{0400CC3B-49D9-4079-9FB1-50B60A30A0D3}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\street fighter iv\sf4launcher.exe | 
"{044C756E-95CF-402E-BD2B-3D6C73E85B98}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\runaway a road adventure\runaway.exe | 
"{04D36470-784F-4552-89F7-DC864BFCDB7C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 
"{07BFF41A-CC2C-4847-A2F7-0F0D14D8BFBB}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{080637F1-0457-4DD3-9B6E-4B2EBD597981}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{0975523D-4112-43BD-B6AA-EB6169226A5D}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\dogfighter\bin\x86_vc8\dogfightersteam.exe | 
"{097DD8A4-DC1E-46CB-8BAA-0F03568B6801}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{09CB3608-15E7-4AC8-B984-41A175F84A49}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe | 
"{0A2F58D1-BFCF-4DA8-850C-9513A015C804}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\uplauncher.exe | 
"{0EEC6944-4895-4602-A04A-56FADB92B831}" = protocol=17 | dir=in | app=c:\program files\ubisoft\prince of persia the forgotten sands\gamesettings.exe | 
"{0F84C7EB-8378-4BC8-850C-7D220EF4DE7D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\bit.trip runner\runner.exe | 
"{14AF4D21-94AE-4700-80C7-B03B7883B0A4}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\darwinia\darwinia.exe | 
"{153F6C03-0001-45DA-BD29-18B01F1C32BC}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\shank\bin\shank.exe | 
"{180E1BB5-82A9-4812-9C58-9C3599199F8A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\bullet candy\bullet candy.exe | 
"{194FDEF2-8F2E-401C-AFDE-F5C8BCFFCEF4}" = protocol=6 | dir=in | app=c:\program files\ubisoft\prince of persia the forgotten sands\gu.exe | 
"{1A1F0A74-F098-49B6-9201-B7223BCC78B2}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{1A9ADC0A-3D3B-44BB-900E-CC0EF848C7EB}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\audiosurf\engine\questviewer.exe | 
"{1ECA8618-624D-4709-A4E5-91E0D0C6C490}" = protocol=17 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{1F48D67A-95AE-49F6-A976-38D0BF4DDBD8}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe | 
"{2162E2DA-5474-42B0-A6B2-A73EB8482144}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{241A3356-DE43-492F-89CC-525B3006A520}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\shank\bin\shank.exe | 
"{285D7F50-77F1-40C2-9B89-FDC62269FD72}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\alien swarm\srcds.exe | 
"{28C477C2-2062-4B0D-A069-1649B5763000}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{2B07B85A-71BE-4EF2-97AC-C7C0A69E2438}" = protocol=6 | dir=in | app=c:\program files\stunlock studios\bloodline champions\binary\bloodlinechampionsloader.exe | 
"{2B73783B-7BAD-4DC2-9FC7-5EEBA3DEB415}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\poker night at the inventory\celebritypoker.exe | 
"{2C9E9973-7B70-4005-A8C0-A9A964259068}" = protocol=6 | dir=in | app=c:\program files\codemasters\f1 2010\f1_2010_game.exe | 
"{2EF6DAF9-6DAE-4D93-88B0-201363D15C25}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\portal 2\portal2.exe | 
"{2F2DA934-DD43-4508-8434-E8A3E969AFF1}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe | 
"{2FDC8401-F805-46B2-A11D-1DB2EE1BBBE2}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\plants vs zombies\plantsvszombies.exe | 
"{3510835D-7658-4776-AB8F-C6B16CE3C96A}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{35F40955-6664-49D1-ACA9-70A8BCD1F485}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\everyday shooter\everydayshooter.exe | 
"{365A3E65-94B3-499F-A6E1-6761F186CD05}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\system protocol one\sp1.exe | 
"{373400E7-DA06-46A4-BFCA-74076FD905AE}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{37D0E2E5-B040-49D2-8D7A-8B5ECE8DA329}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\hacker evolution\hacker evolution.exe | 
"{3930CBA4-C6F0-4D76-B1D4-35A0D29F824F}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\flight_control_hd\flightcontrol_win32.exe | 
"{39FB48E8-5EF2-4DB0-B0CF-32A3925406F7}" = protocol=17 | dir=in | app=c:\program files\stunlock studios\bloodline champions\binary\bloodlinechampionsloader.exe | 
"{3A2F32F8-7148-438E-887F-0416708D180D}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\123kickit\123kickit.exe | 
"{3E6346D8-AF5B-4263-A5AE-93F20E42FDFE}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\runaway the dream of the turtle\runawaytdott.exe | 
"{3F4D6B17-8C0B-4DF4-818C-2C39356C29C6}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{3F55B2C8-0C0E-4690-AC6A-2C264D05B8C5}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\blinx151\counter-strike source\hl2.exe | 
"{4151A9D2-48E1-4029-A9D0-637EB37D309F}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\hammerfight\hammerfight.exe | 
"{42246089-5B0A-4762-96EE-AA73E38972D6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe | 
"{42695B73-61C2-46DB-8BAE-28674A4390D9}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{436C7715-4516-423F-820A-EF24D7D0B2A5}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\killingfloor\system\killingfloor.exe | 
"{4384CE16-6F9F-4D32-87F4-A379E20F1EBA}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\hoard\win32\reuben.exe | 
"{47363D7C-DCDC-401D-82DD-A39DA7F9824F}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\magicka\magicka.exe | 
"{48032BE4-0BAA-4BF8-AED5-ED37805E755A}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\bit.trip runner\runner.exe | 
"{488DCB50-670B-49FE-B22E-1AE35F941992}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\blinx151\counter-strike source\hl2.exe | 
"{4DFE50EF-E6D8-4439-9284-12D5D18D82D1}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\eufloria\eufloria.exe | 
"{50130544-E710-46CD-A471-472D89D6DCD8}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\magicka\magicka.exe | 
"{503BFE48-FBEA-42EE-91F2-D758FA4D5ABE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\launcheflc.exe | 
"{50DBDA59-944E-40E8-9674-FB2CE69E8CAC}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\hacker evolution\hacker evolution.exe | 
"{55BD7DC3-2ED6-413D-AB63-169220448567}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{563C9C0C-B8F2-41F0-A830-9E91EC6D8F60}" = protocol=6 | dir=in | app=c:\program files\league of legends\lol.launcher.exe | 
"{571E07FB-3F4D-44DF-B991-E6E8957C018F}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\mass effect 2\masseffect2launcher.exe | 
"{578817D8-4523-40E3-A4C7-829873A27D9F}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\cogs\cogs.exe | 
"{57D07F27-9D02-4E6A-AE65-EF0D7EA16E9C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\hacker evolution\hacker evolution mod editor.exe | 
"{59249EDB-7FC9-4878-92EA-6EE0D682BC00}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\geometry wars\geometrywars.exe | 
"{5A3EE145-BFD2-4AA1-8488-7712309CC5F9}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\hoard\win32\reuben.exe | 
"{5A66AEE7-CBB4-40A8-A19D-13CD3CAA79F3}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\launcheflc.exe | 
"{5F3E80FB-A711-476E-9A28-370E1BD81B6D}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{612494E7-A732-44BA-A606-A8567036BDF0}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\beat hazard\beathazard.exe | 
"{6474B096-0C76-43A5-8966-74212CCC42B6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\chime\chime.exe | 
"{64AE44DD-DB4B-4CA6-A1E8-4AD714A0BB7B}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\audiosurf\engine\questviewer.exe | 
"{6636B99C-8B17-4E6A-9FD8-00FE05D975DE}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{67DF900B-9EDB-4E75-A832-422F822C796C}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battlefield bad company 2\bfbc2updater.exe | 
"{688F6CCB-E5B8-4BA5-A0E1-993C440C3CEE}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{6D7257A7-88C2-440B-91E7-F7809CED49B7}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{6FEDDEE2-4F59-4048-8340-3536704671C0}" = protocol=17 | dir=in | app=c:\program files\ubisoft\prince of persia the forgotten sands\uplaybrowser.exe | 
"{71C3E501-C968-4A53-ACBA-4E8F451F9A72}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\monday night combat\binaries\win32\mnc.exe | 
"{725E43DA-15D8-444A-A459-4837AEA62158}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{75C94B8F-6004-435C-8A1C-E54DA767A9C9}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{76018578-7B2D-42BB-B4FF-65951EC1B8B1}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\the maw\themaw.exe | 
"{78F32C94-62DC-48DC-BD77-8585E3F28C0B}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\aaaaaaaaaaaaaaaaaaaaaaaaa!!!\main.exe | 
"{7929EEC8-3E4E-48E3-9F16-B9FD706959CB}" = protocol=6 | dir=in | app=c:\program files\ubisoft\tom clancy's splinter cell conviction\src\system\conviction_game.exe | 
"{7BBC8CE1-C391-4240-996A-078C9D2281D4}" = protocol=6 | dir=in | app=c:\program files\icq7.0\icq.exe | 
"{7C7A1397-5E85-4C78-97F2-0B4168F8E8D8}" = protocol=17 | dir=in | app=c:\program files\codemasters\dirt2\dirt2_game.exe | 
"{7D5E2CB9-3901-4C82-ACB7-8FE40CB0A75E}" = protocol=17 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{7D870ED2-3328-4D86-8DE7-0F8F98F9AE22}" = protocol=17 | dir=in | app=c:\program files\ubisoft\prince of persia the forgotten sands\prince of persia.exe | 
"{7EC01A39-3745-496A-A147-661FF55C2B46}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\runaway the dream of the turtle\video card setup.exe | 
"{7F1FEBFF-E2B5-4F24-9D25-232EDBB91CEC}" = protocol=17 | dir=in | app=c:\program files\ubisoft\prince of persia the forgotten sands\gu.exe | 
"{80B4FC5B-83CB-44E6-B27F-F04B405B04EF}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\plain sight\plainsight.exe | 
"{82B59F7D-8282-4509-A404-F0F6BEC2F80B}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\bullet candy\bullet candy.exe | 
"{855E143E-7CEE-4C20-BA75-49F8BF4984D2}" = protocol=17 | dir=in | app=c:\program files\codemasters\f1 2010\f1_2010_game.exe | 
"{856C156A-AFE2-4759-A71E-B9F7B47130AC}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battlefield bad company 2\bfbc2updater.exe | 
"{870B636B-0DBA-475E-907E-8300D17DA9F7}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\toki tori\tokitori.exe | 
"{87576BB3-A991-4B22-ABF3-0B501D1CDC45}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{880275EB-5536-4E6D-A06B-E24D0D2B769D}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\runaway a road adventure\video card setup.exe | 
"{8877B309-3A3D-4A21-815E-2A061F628C03}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\uplink\uplink.exe | 
"{897527BC-D370-4EF6-AA6B-F6597839F078}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\grand theft auto iv\gtaiv\launchgtaiv.exe | 
"{8A07C7EA-E187-46AE-830E-677E6F1BD363}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\portal 2\portal2.exe | 
"{8CC2C9B9-A729-4E74-9FD8-F336259225D2}" = protocol=6 | dir=in | app=c:\program files\nexon\europe maplestory\maplestory.exe | 
"{8CD053B2-58D1-43CA-A189-B9D05697429F}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\blinx151\day of defeat source\hl2.exe | 
"{8D72CCA7-1DE5-4488-AFC0-21F9A1DA59E3}" = protocol=6 | dir=in | app=c:\program files\ubisoft\tom clancy's splinter cell conviction\src\system\gu.exe | 
"{8E2B432E-D301-4B08-A753-A617880F4597}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{9091D655-E6A5-4233-AEB0-BEA61450791F}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\dogfighter\bin\x86_vc8\dogfightersteam.exe | 
"{94600170-854D-43DE-8107-38E33BBF01E4}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\poker night at the inventory\celebritypoker.exe | 
"{94DF0477-6836-42EF-BF5B-9E037D201109}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\beat hazard\beathazard.exe | 
"{960A8A6D-5AC2-4406-90C2-A8007EC5C6A6}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{9690DCE4-6A5A-462B-99CC-9A153C4797F8}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\beat hazard\runme.exe | 
"{97EFA974-B6F0-4C7D-91CF-BE11BA68C844}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\galcon fusion\galconfusion.exe | 
"{98670CE9-C4FB-440F-AB84-5038F7F574B0}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\everyday shooter\everydayshooter.exe | 
"{99CF77CD-60E0-41D7-B734-FC6064650553}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\swarm arena\swarm.exe | 
"{9BCED8ED-07C5-404B-9B99-FFB9FD292E5E}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\hacker evolution\hacker evolution mod editor.exe | 
"{9CA18810-C286-4D34-865C-E34CE06D5B58}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\killingfloor\system\killingfloor.exe | 
"{9CA3C94C-C352-406B-8269-0D6AD81A7ABE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\mass effect 2\docs\ea help\electronic_arts_technical_support.htm | 
"{9CB9D936-A95E-4371-8A75-C9F15E609D97}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{9F98948B-5324-4AB8-A516-B5D32D1768C7}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\hammerfight\hammerfight.exe | 
"{A0647010-5099-4ACD-B483-52793B2E47C7}" = protocol=17 | dir=in | app=c:\program files\ubisoft\tom clancy's splinter cell conviction\src\system\gu.exe | 
"{A32DD699-86DB-4004-9409-FA8AC1318131}" = protocol=6 | dir=in | app=c:\program files\league of legends\lol.launcher.exe | 
"{A7C8E29A-20C2-47F4-A11B-8EBB11333C76}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\cogs\cogs.exe | 
"{AC03C08C-0E52-4DF3-BC3B-AECFD4E04548}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\mass effect 2\binaries\masseffect2.exe | 
"{AFE2EB82-4E43-48A8-A397-18C630CC3C95}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\chime\chime.exe | 
"{B07B2B18-BE03-47E1-B8DF-C884084327F9}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe | 
"{B0D2F1A3-B903-4C38-8272-CE2994273326}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\aaaaaaaaaaaaaaaaaaaaaaaaa!!!\main.exe | 
"{B14BB310-E924-4519-8E03-BA823409F8A2}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe | 
"{B24D0916-C102-4810-BBD0-581A71F959E2}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe | 
"{B296E407-1285-4800-B37D-FB9805375901}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe | 
"{B39DD912-140F-45C6-8980-3B9FFD650D81}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\rush\rush.exe | 
"{B42A6E75-5689-4409-864D-F2407E355990}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\123kickit\123kickit.exe | 
"{B453732A-B809-42BA-A203-240DC5736E71}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\system protocol one\sp1.exe | 
"{B573D16A-30D1-4101-BFCA-A18FDE2E1EB9}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\runaway a road adventure\runaway.exe | 
"{B617AF60-A7A3-430F-AECA-354EF47B9C69}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\darwinia\darwinia.exe | 
"{B6379637-4465-49A8-B548-318C928F10D4}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\toki tori\tokitori.exe | 
"{B771A967-A1EB-41D5-B942-2CE4E7734E52}" = protocol=6 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{B8E5FD76-ED8E-4D13-B487-7F1FDFE9176D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\beat hazard\beathazard.exe | 
"{B9905A94-562E-4CEA-A309-02C7D2DA1B29}" = protocol=6 | dir=in | app=c:\program files\ubisoft\prince of persia the forgotten sands\gamesettings.exe | 
"{BA157A14-C7AC-4AFB-902F-AF07AF42A796}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\plain sight\plainsight.exe | 
"{BC8D6FC6-032A-44E8-A270-75183ED8A48E}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\uplauncher.exe | 
"{BD328152-8843-4641-A221-34DABBA8E620}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\flight_control_hd\flightcontrol_win32.exe | 
"{BE2A1F91-9598-4B7A-A328-BA8EBEAF939C}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\mass effect 2\binaries\masseffect2.exe | 
"{BFE620D7-5B92-4777-AE02-F21AAE58607A}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\uplink\uplink.exe | 
"{C2EFC5F6-6D99-4025-A9A1-4158CDB8F57B}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\the maw\themaw.exe | 
"{C5B2B825-CDC0-4736-9747-9358FE0D3339}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\rhythm zone\rhythmzone.exe | 
"{C755345D-7D15-4263-A09A-CCA401A9ECE6}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\sam and max episode 4\sammax104.exe | 
"{C82B34D5-8BB9-4BD6-96B0-FC6172584158}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\mass effect 2\docs\ea help\electronic_arts_technical_support.htm | 
"{C873B032-340E-4DD5-8D9A-AEFDE6944D07}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{CA3A9923-2EAE-48C2-A40F-C3C35E0EE8BC}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe | 
"{CBF41605-4DBA-4242-A0A6-3316A257AEE1}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{CC76BE6A-9944-4B44-BDE6-C5DF5D3C7A3E}" = protocol=17 | dir=in | app=c:\program files\league of legends\lol.launcher.exe | 
"{CE3914EC-EB62-423F-9DB9-21E4E3B98FAC}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\lead and gold gangs of the wild west\lag_win32_public_dev.exe | 
"{CF98C03A-09E3-4F1E-9101-253389435B26}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\plants vs zombies\plantsvszombies.exe | 
"{CFB5FB0A-8ED6-4F66-A7FA-A629313C44CE}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 
"{D0668CD8-AD8F-48BA-B1D5-A7F799D29933}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\lead and gold gangs of the wild west\lag_win32_public_dev.exe | 
"{D1497A91-141D-4058-ADE9-98822A3DB1B4}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\geometry wars\geometrywars.exe | 
"{D35942CF-F761-4200-B7F9-9228EECD4639}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{D4FA6C69-C682-41A0-8AFB-0B4F4E1B1DE3}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe | 
"{D5779065-063C-423D-8BF1-D73BA10736B4}" = protocol=6 | dir=in | app=c:\program files\fable iii\fable3.exe | 
"{D72C942E-4F62-4FB3-8564-DB3B2CC32014}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\bit.trip beat\beat.exe | 
"{D73B8163-1410-4497-BC49-B3CB0F8D88E9}" = protocol=6 | dir=in | app=c:\program files\icq7.0\aolload.exe | 
"{D79F7D52-7F27-40CE-8926-9FE5C6D1D37B}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\blinx151\counter-strike source\hl2.exe | 
"{D7EF247F-6198-461D-8E75-5684ABE02268}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe | 
"{D959396F-3913-4D36-9441-7149E42FB552}" = protocol=17 | dir=in | app=c:\program files\nexon\europe maplestory\maplestory.exe | 
"{DBB32BF9-9A64-410F-908A-64106D707F02}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\sam and max episode 4\sammax104.exe | 
"{DD4DF177-6E95-4AFD-AB24-E1D98856E55A}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\beat hazard\runme.exe | 
"{DD8FF5FE-7BD5-47E6-ACC6-CBEA40C485C0}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\monday night combat\binaries\win32\mnc.exe | 
"{DE0C3FF0-6BEA-46C6-A8ED-0C204B9316A6}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe | 
"{E190C410-B201-4259-8C20-223D2A0CD679}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\street fighter iv\sf4launcher.exe | 
"{E227D70B-B239-4B13-B6EE-B718DC74FE40}" = protocol=6 | dir=in | app=c:\program files\codemasters\dirt2\dirt2_game.exe | 
"{E261F309-837D-49DB-82A5-0558503C605F}" = protocol=17 | dir=in | app=c:\program files\fable iii\fable3.exe | 
"{E3809758-AD99-4216-B046-0B76804B5665}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\swarm arena\swarm.exe | 
"{E5F8D2CB-6569-4FFF-9AA0-E3DD7AF3D0FE}" = protocol=6 | dir=in | app=c:\program files\ubisoft\prince of persia the forgotten sands\uplaybrowser.exe | 
"{E697E156-83AC-46F8-9DAD-987655B18804}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\runaway the dream of the turtle\video card setup.exe | 
"{E88B53BF-6067-4197-8D9F-38522C6FFDAE}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\bit.trip beat\beat.exe | 
"{E8DA878B-19C7-4E0C-AF35-1A0D509BF78F}" = protocol=17 | dir=in | app=c:\program files\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe | 
"{E908FB5B-FC8B-4716-9734-DF8DCCCCF0A7}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\grand theft auto iv\gtaiv\launchgtaiv.exe | 
"{E983111B-C6DE-4A21-8023-520FF92D3B49}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{E9889845-36B2-4434-AB86-9B88EAC7E108}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\runaway a road adventure\video card setup.exe | 
"{E9A3EBD5-55F4-45A9-AA0A-66CA14DED18C}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\alien swarm\srcds.exe | 
"{EB80555D-C45D-4DEF-A4DA-2A98AFFEBC75}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\runaway the dream of the turtle\runawaytdott.exe | 
"{ED3256AB-4DB3-4095-9944-25BA839185EF}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe | 
"{EDB8D810-28D2-4E8E-BE04-7F54B9472AEF}" = protocol=17 | dir=in | app=c:\program files\ubisoft\tom clancy's splinter cell conviction\src\system\conviction_game.exe | 
"{EDF9E031-D8F7-46EB-8B3F-4950C40EE4A5}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\rush\rush.exe | 
"{EE436A94-53B0-4C06-B37F-E0CF258E8E5C}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe | 
"{F06FEFF3-D7DB-4E44-8F33-D565F35B1224}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\rhythm zone\rhythmzone.exe | 
"{F1066157-3455-4E7D-A00E-F3975B1D7A9D}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe | 
"{F1178819-F7A1-42FF-8667-72872E8C55B4}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\eufloria\eufloria.exe | 
"{F51B1A39-C28F-48C3-9475-195841FB97BF}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe | 
"{F6564977-53EB-419D-B78A-53E3F96E0DF2}" = protocol=17 | dir=in | app=c:\program files\league of legends\lol.launcher.exe | 
"{F80095FE-4D59-423D-8ACA-206833F990F0}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\beat hazard\beathazard.exe | 
"{F91A0142-9E39-4A7A-B554-5029961620F8}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\blinx151\counter-strike source\hl2.exe | 
"{FA5D2E60-1364-4158-AA1C-8FA63ECEBC67}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\galcon fusion\galconfusion.exe | 
"{FB843823-CB0F-40F4-B8F8-0C5C58EA409F}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\blinx151\day of defeat source\hl2.exe | 
"{FCFEA714-C9F6-4EF3-AD1F-EB1B3E0ED306}" = protocol=6 | dir=in | app=c:\program files\ubisoft\prince of persia the forgotten sands\prince of persia.exe | 
"TCP Query User{054CA948-AD8C-4760-9838-B4A5153424BB}C:\program files\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe | 
"TCP Query User{079CC699-B2F2-49BF-8FD6-816254049388}C:\program files\steam\steamapps\common\global agenda live\binaries\globalagenda.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\global agenda live\binaries\globalagenda.exe | 
"TCP Query User{0B18DA1D-31AA-4E2C-8DA0-3F46F6036A5E}C:\program files\icq7.4\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"TCP Query User{3390ABE5-55DC-49BF-8FC9-162F4B7CF801}C:\program files\steam\steamapps\common\street fighter iv\streetfighteriv.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\street fighter iv\streetfighteriv.exe | 
"TCP Query User{43649808-CEE6-4191-932F-02C8743EA9E1}C:\program files\steam\steamapps\common\test drive unlimited 2\uplauncher.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\uplauncher.exe | 
"TCP Query User{45763E89-3AB6-49AC-9054-253680E322AC}C:\program files\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe" = protocol=6 | dir=in | app=c:\program files\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe | 
"TCP Query User{4BAA4EEA-8898-4ADB-83AF-218DB442FAD5}C:\program files\stunlock studios\bloodline champions beta\binary\bloodlinechampionsloader.exe" = protocol=6 | dir=in | app=c:\program files\stunlock studios\bloodline champions beta\binary\bloodlinechampionsloader.exe | 
"TCP Query User{57830F69-4969-4064-9914-A43188023324}C:\program files\steam\steamapps\blinx151\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\blinx151\team fortress 2\hl2.exe | 
"TCP Query User{5831796B-EBA7-40B2-BF18-377C3AE3F92F}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{66135706-6FF0-43A9-B62A-02E25766E0F3}C:\program files\bloodline champions\binary\bloodlinechampions.exe" = protocol=6 | dir=in | app=c:\program files\bloodline champions\binary\bloodlinechampions.exe | 
"TCP Query User{6B728A8D-CF57-4094-981F-C485538498BB}C:\program files\steam\steamapps\blinx151\team fortress 2\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\blinx151\team fortress 2\hl2.exe | 
"TCP Query User{6E9CF2C0-9732-4573-855F-4AAC0B62F0FA}C:\program files\2k games\gearbox software\borderlands\binaries\borderlands.exe" = protocol=6 | dir=in | app=c:\program files\2k games\gearbox software\borderlands\binaries\borderlands.exe | 
"TCP Query User{769481AB-33DF-41D1-BBD2-2906663FE066}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"TCP Query User{88851066-C4FF-4E03-8735-F45E25151397}C:\program files\icq7.409_59_12\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq7.409_59_12\icq.exe | 
"TCP Query User{89418771-FAB0-45A0-9FED-AA8C1735A0EA}C:\program files\ubisoft\assassin's creed ii\assassinscreediigame.exe" = protocol=6 | dir=in | app=c:\program files\ubisoft\assassin's creed ii\assassinscreediigame.exe | 
"TCP Query User{8CB62ECC-C187-4228-89CE-E54592108F23}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"TCP Query User{AA4325E4-3A33-43D0-A43A-BF0106C2AB6A}C:\program files\fable iii\fable3.exe" = protocol=6 | dir=in | app=c:\program files\fable iii\fable3.exe | 
"TCP Query User{B412A31F-966A-41C1-84BF-C6921F458CF6}C:\program files\codemasters\der herr der ringe online\lotroclient.exe" = protocol=6 | dir=in | app=c:\program files\codemasters\der herr der ringe online\lotroclient.exe | 
"TCP Query User{B4B9C8B1-3169-47AC-AC7E-B57C7CD89B13}C:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe | 
"TCP Query User{BB95EE83-D9F5-481D-B2CB-228E29E981A1}C:\program files (x86)\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe" = protocol=6 | dir=in | app=c:\program files (x86)\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe | 
"TCP Query User{BFDB012E-5F5B-44DF-A4D6-2361206F8EF2}C:\program files\steam\steamapps\common\test drive unlimited 2\testdrive2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\testdrive2.exe | 
"TCP Query User{C1EE6EDC-60B7-4046-A87F-680E4CA13A93}C:\program files\steam\steamapps\common\test drive unlimited 2\testdrive2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\testdrive2.exe | 
"TCP Query User{CBFA5713-BB98-49E0-9960-DB44B7031CA5}C:\program files\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe | 
"TCP Query User{DCB41544-1658-4303-AEAD-4E13B9C91A0C}C:\program files\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{03B2227A-FFBE-46C7-84AE-96987F32E8A3}C:\program files\fable iii\fable3.exe" = protocol=17 | dir=in | app=c:\program files\fable iii\fable3.exe | 
"UDP Query User{0CA4281C-D015-4590-AFB5-C387D240DED9}C:\program files\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe" = protocol=17 | dir=in | app=c:\program files\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe | 
"UDP Query User{14F1A963-B377-4E68-8BFE-4D467C8F6834}C:\program files\steam\steamapps\common\global agenda live\binaries\globalagenda.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\global agenda live\binaries\globalagenda.exe | 
"UDP Query User{29758862-C666-43E9-ABBB-CD220349178B}C:\program files\icq7.409_59_12\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.409_59_12\icq.exe | 
"UDP Query User{2A8C024A-BB9E-4C42-A30F-722B99C9A072}C:\program files\2k games\gearbox software\borderlands\binaries\borderlands.exe" = protocol=17 | dir=in | app=c:\program files\2k games\gearbox software\borderlands\binaries\borderlands.exe | 
"UDP Query User{2FD4CD63-6AF8-4EA4-9FEE-86DA5B2E543B}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{4876B0E8-BF91-435C-B42F-759BAEE5FEEA}C:\program files\codemasters\der herr der ringe online\lotroclient.exe" = protocol=17 | dir=in | app=c:\program files\codemasters\der herr der ringe online\lotroclient.exe | 
"UDP Query User{51FF6425-B329-49B8-A9D4-1D33DCFD790E}C:\program files\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\grand theft auto iv\gtaiv\gtaiv.exe | 
"UDP Query User{5B452075-A23B-4F1C-B07F-28ECC2F442F6}C:\program files\steam\steamapps\common\test drive unlimited 2\testdrive2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\testdrive2.exe | 
"UDP Query User{61E26339-5E63-4358-9D57-5CE3E938C5E9}C:\program files (x86)\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe" = protocol=17 | dir=in | app=c:\program files (x86)\2k games\gearbox software\borderlands goty edition\binaries\borderlands.exe | 
"UDP Query User{672B7164-3C6C-434C-AD9D-BA6DB74282E1}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{758AC05C-3A25-411D-9C2E-C52CBDE3B572}C:\program files\bloodline champions\binary\bloodlinechampions.exe" = protocol=17 | dir=in | app=c:\program files\bloodline champions\binary\bloodlinechampions.exe | 
"UDP Query User{9190EC45-1FBC-4C97-97C1-1239802472B8}C:\program files\stunlock studios\bloodline champions beta\binary\bloodlinechampionsloader.exe" = protocol=17 | dir=in | app=c:\program files\stunlock studios\bloodline champions beta\binary\bloodlinechampionsloader.exe | 
"UDP Query User{98A4701D-B766-4251-B97E-2DE39734B2FE}C:\program files\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\_uplauncher.exe | 
"UDP Query User{9A0649BA-9967-4FFC-A2FE-1DF972F052C2}C:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\battlefield bad company 2\bfbc2game.exe | 
"UDP Query User{A6088D5F-60B1-4702-A94B-85C212DB9C7E}C:\program files\steam\steamapps\common\test drive unlimited 2\uplauncher.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\uplauncher.exe | 
"UDP Query User{A80E1F3A-2784-4B42-85E9-E0A118B32672}C:\program files\steam\steamapps\common\street fighter iv\streetfighteriv.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\street fighter iv\streetfighteriv.exe | 
"UDP Query User{A8D08A69-4F05-4E0E-B1D7-76D546D50F9E}C:\program files\steam\steamapps\blinx151\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\blinx151\team fortress 2\hl2.exe | 
"UDP Query User{BB7D5B4B-B81A-435F-A34A-B3D354594E3C}C:\program files\steam\steamapps\common\test drive unlimited 2\testdrive2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\test drive unlimited 2\testdrive2.exe | 
"UDP Query User{C5E2A6FE-7477-498D-9CB7-9F3D61F6D34F}C:\program files\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre6\bin\javaw.exe | 
"UDP Query User{E76DD533-64A0-4723-ADE8-CE32D3898AEC}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe | 
"UDP Query User{EAB4D965-C4F9-4805-87A9-CE0E8DAAB5CF}C:\program files\ubisoft\assassin's creed ii\assassinscreediigame.exe" = protocol=17 | dir=in | app=c:\program files\ubisoft\assassin's creed ii\assassinscreediigame.exe | 
"UDP Query User{F249F07D-C6F5-4300-8743-DD8BB9FB77DB}C:\program files\icq7.4\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq7.4\icq.exe | 
"UDP Query User{FFE28A62-56B5-4FA4-ABC0-61A0465F52B9}C:\program files\steam\steamapps\blinx151\team fortress 2\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\blinx151\team fortress 2\hl2.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}" = Windows Live ID Sign-in Assistant
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{121634B0-2F4B-11D3-ADA3-00C04F52DD52}" = Windows Installer Clean Up
"{1632FD86-1BA4-4FC4-8B25-A8C655D63F68}" = Sid Meier's Pirates!
"{192A107E-C6B9-41B9-BDBF-38E3AA226054}" = OpenOffice.org 3.2
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.30319
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{22B0E143-2B0B-435B-9F56-136A3D16065F}" = No23 Recorder
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83216024FF}" = Java(TM) 6 Update 24
"{2BFC7AA0-544C-4E3A-8796-67F3BE655BE9}" = Microsoft XNA Framework Redistributable 4.0
"{3175E049-F9A9-4A3D-8F19-AC9FB04514D1}" = Windows Live Communications Platform
"{35CB6715-41F8-4F99-8881-6FC75BF054B0}" = Oblivion
"{3AC8457C-0385-4BEA-A959-E095F05D6D67}" = Battlefield: Bad Company™ 2
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D1A8E16-10A6-43E0-90BE-0A0474A637A7}" = Z Cinema
"{3D3E663D-4E7E-4577-A560-7ECDDD45548A}" = PVSonyDll
"{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}" = NVIDIA PhysX
"{434D0831-3E0C-4D03-A5D4-5E1000008400}" = F1 2010
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4AE3A0CB-87B0-4F51-BECD-3D1F8DFDD62F}" = AT-AR215 USB ADSL WAN Adapter
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"{4D96D2F0-8FB4-45C2-9B80-2DCB88016316}_is1" = Machinarium
"{5335DADB-34BA-4AE8-A519-648D78498846}" = Skype™ 5.3
"{54948AF6-4D45-4871-A295-F9FF06EF3AFE}_is1" = Team Fortress 2 Uncut Launcher v4.0
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5A080213-5AEC-4BF2-BB32-796EB0E421EC}" = Logitech G-series Keyboard Software
"{5DAFC60E-E6E3-40CA-8CC0-4F71511F6A30}_is1" = Full Pipe
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{5F8E2CBB-949D-4175-AC98-5ADE7F6C9697}" = NCsoft Launcher
"{64B20B36-AEE7-4DD4-897C-C5DA5C218F60}" = Logitech Gaming Software 5.02
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6C90C4C4-559D-4FE8-A4BF-37550E74D1FC}" = Bloodline Champions
"{71A88700-6CC4-4DA8-9B2A-1ADB24C6028B}_is1" = Borderlands GotY Edition
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37}" = ICQ7.4
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{853A4763-6643-4604-8D64-28BDD8925F4C}" = Apple Application Support
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{870013DB-984D-42A8-9E63-8673D8B2775A}" = Stubbs The Zombie
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9559F7CA-5E34-4237-A2D9-D856464AD727}" = Project64 1.6
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9FD6F1A8-5550-46AF-8509-271DF0E768B5}" = Dual-Core Optimizer
"{A0494B41-EBD7-4C0D-91B7-DC39741B27BB}" = Express Gate
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A10D9B03-AABB-47D7-8A30-2FEA97E70BC7}" = Quake Live Mozilla Plugin
"{A129D1F2-CAC4-4AD7-B26D-3C6411B87DCC}" = Psychonauts
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A589DA26-51BD-475D-8C32-E19E34145842}" = Camtasia Studio 6
"{AC76BA86-7AD7-1033-7B44-A81100000003}" = Adobe Reader 8.1.1
"{AED2DD42-9853-407E-A6BC-8A1D6B715909}" = Windows Live Messenger
"{BD009869-6498-4CF9-9016-E9EA6E3742B2}" = The Whispered World
"{C2E4B5BD-32DB-4817-A060-341AB17C3F90}" = Bonjour
"{C3592426-531E-4110-911D-BFECE2CE284C}" = osu!
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C5334C85-F601-427C-85F7-CDD9FDC8C69F}" = StubbsPatchInstaller
"{C5A8DF48-580B-44D3-B2B2-E965A9368F28}" = LEGO® Harry Potter™: Die Jahre 1-4
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CAFA57E8-8927-4912-AFCF-B0AA3837E989}" = Windows Live Essentials
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D2041A37-5FEC-49F0-AE5C-3F2FFDFAA4F4}" = Windows Live Call
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.4.4 Game
"{D52ECEBC-9B20-41A5-81C4-A62DE2367419}" = Adobe Creative Suite
"{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}" = Windows Media Encoder 9 Series
"{EAEAAF8C-8E86-4CAC-AC08-1A33EDCA34AC}" = Prince of Persia The Forgotten Sands™
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F0FDF9C9-1DDC-401F-B638-36F1CAE8A875}" = VideoStudio
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"{F59A9E08-A6A4-4ACF-91F2-D0344956C30B}" = iTunes
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"4f6dcc3b-179d-4b1b-80f0-b6083a0b3ce6_is1" = Der Herr der Ringe Online v03.02.04.8010
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"Adobe SVG Viewer" = Adobe SVG Viewer 3.0
"AhnLab Online Security" = AhnLab Online Security
"Audacity 1.3 Beta (Unicode)_is1" = Audacity 1.3.11 (Unicode)
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"BurnAware Free_is1" = BurnAware Free 2.4.3
"CCleaner" = CCleaner
"Cheat Engine 6.0_is1" = Cheat Engine 6.0
"C-Media CM106 Like Sound Driver" = USB Multi-Channel Audio Device
"Diablo II" = Diablo II
"DivX Setup.divx.com" = DivX-Setup
"Europe MapleStory for Vista_is1" = Europe MapleStory for Vista
"Fraps" = Fraps (remove only)
"GFWL_{434D0831-3E0C-4D03-A5D4-5E1000008400}" = F1 2010
"GFWL_{4D53090A-9B45-437B-A66A-831000008300}" = Fable III
"Guild Wars" = GUILD WARS
"Heart Of Darkness" = Heart Of Darkness
"Icy Tower v1.5_is1" = Icy Tower v1.5
"InstallShield_{1632FD86-1BA4-4FC4-8B25-A8C655D63F68}" = Sid Meier's Pirates!
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallShield_{F0FDF9C9-1DDC-401F-B638-36F1CAE8A875}" = Corel VideoStudio 12
"IrfanView" = IrfanView (remove only)
"JDownloader" = JDownloader
"jv16 PowerTools 2011" = jv16 PowerTools 2011
"League of Legends_is1" = League of Legends
"MegamanX8" = Megaman X8
"MegaTrainer eXperience_is1" = MegaTrainer eXperience V1.0.4.5
"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Mini Ninjas" = Mini Ninjas 1.0
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"Mumble" = Mumble and Murmur
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"OpenAL" = OpenAL
"Patrimonium_is1" = Patrimonium 1.04
"PunkBusterSvc" = PunkBuster Services
"Recettear: An Item Shop's Tale_is1" = Recettear: An Item Shop's Tale
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"RPG Maker 2000  Vampires" = RPG Maker 2000 -  Vampires Dawn
"Runic Games Torchlight" = Torchlight
"Songbird-release-1700" = Songbird 1.7.3 (Build 1700)
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 105600" = Terraria
"Steam App 12210" = Grand Theft Auto IV
"Steam App 12220" = Grand Theft Auto: Episodes from Liberty City
"Steam App 1250" = Killing Floor
"Steam App 12900" = Audiosurf
"Steam App 15520" = AaAaAA!!! - A Reckless Disregard for Gravity
"Steam App 15540" = 1... 2... 3... KICK IT! (Drop That Beat Like an Ugly Baby)
"Steam App 16300" = Everyday Shooter
"Steam App 18040" = DeathSpank
"Steam App 18050" = DeathSpank: Thongs Of Virtue
"Steam App 21660" = Street Fighter IV
"Steam App 240" = Counter-Strike: Source
"Steam App 24980" = Mass Effect 2
"Steam App 26000" = The Maw
"Steam App 31280" = Poker Night at the Inventory
"Steam App 3590" = Plants vs. Zombies: Game of the Year
"Steam App 38700" = Toki Tori
"Steam App 38720" = RUSH
"Steam App 38900" = Rhythm Zone
"Steam App 40800" = Super Meat Boy
"Steam App 40930" = The Misadventures of P.B. Winterbottom
"Steam App 42120" = Lead and Gold - Gangs of the Wild West
"Steam App 42500" = DogFighter
"Steam App 42910" = Magicka
"Steam App 440" = Team Fortress 2
"Steam App 46600" = Swarm Arena
"Steam App 49600" = Beat Hazard
"Steam App 55000" = Flotilla
"Steam App 6120" = Shank
"Steam App 62000" = Flight Control HD
"Steam App 62100" = Chime
"Steam App 63200" = Monday Night Combat
"Steam App 63700" = BIT.TRIP BEAT
"Steam App 63710" = BIT.TRIP RUNNER
"Steam App 7210" = Runaway: A Road Adventure
"Steam App 7220" = Runaway: The Dream of the Turtle
"Steam App 8230" = Sam & Max 104: Abe Lincoln Must Die!
"Steam App 9930" = Test Drive Unlimited 2
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"Windows Media Encoder 9" = Windows Media Encoder 9 Series
"WinLiveSuite_Wave3" = Windows Live Essentials
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 08.06.2011 10:08:38 | Computer Name = WINDOWS-SLV5UWZ | Source = .NET Runtime | ID = 1026
Description = 
 
Error - 09.06.2011 14:44:15 | Computer Name = WINDOWS-SLV5UWZ | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung hl2.exe, Version 0.0.0.0, Zeitstempel 0x4dcc2d22,
 fehlerhaftes Modul filesystem_steam.dll_unloaded, Version 0.0.0.0, Zeitstempel 
0x4defe148, Ausnahmecode 0xc0000005, Fehleroffset 0x6bd5ce49,  Prozess-ID 0x168c, 
Anwendungsstartzeit 01cc26d00d526c2d.
 
Error - 09.06.2011 15:07:19 | Computer Name = WINDOWS-SLV5UWZ | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mnc.exe, Version 1.0.5694.0, Zeitstempel 0x4dd31b11,
 fehlerhaftes Modul kernel32.dll, Version 6.0.6001.18215, Zeitstempel 0x49953395,
 Ausnahmecode 0xe06d7363, Fehleroffset 0x000442eb,  Prozess-ID 0x324, Anwendungsstartzeit
 01cc26d6ec35d7fd.
 
Error - 09.06.2011 15:07:25 | Computer Name = WINDOWS-SLV5UWZ | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mnc.exe, Version 1.0.5694.0, Zeitstempel 0x4dd31b11,
 fehlerhaftes Modul kernel32.dll, Version 6.0.6001.18215, Zeitstempel 0x49953395,
 Ausnahmecode 0xe06d7363, Fehleroffset 0x000442eb,  Prozess-ID 0x324, Anwendungsstartzeit
 01cc26d6ec35d7fd.
 
Error - 09.06.2011 15:07:31 | Computer Name = WINDOWS-SLV5UWZ | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung mnc.exe, Version 1.0.5694.0, Zeitstempel 0x4dd31b11,
 fehlerhaftes Modul mnc.exe, Version 1.0.5694.0, Zeitstempel 0x4dd31b11, Ausnahmecode
 0xc0000005, Fehleroffset 0x0109eb93,  Prozess-ID 0x324, Anwendungsstartzeit 01cc26d6ec35d7fd.
 
Error - 10.06.2011 09:44:48 | Computer Name = WINDOWS-SLV5UWZ | Source = Application Hang | ID = 1002
Description = Programm TestDrive2.exe, Version 0.1.5.1 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 9c0  Anfangszeit: 01cc27745869d0e4  Zeitpunkt der Beendigung:
 190
 
Error - 10.06.2011 10:04:38 | Computer Name = WINDOWS-SLV5UWZ | Source = Application Hang | ID = 1002
Description = Programm MapleStory.exe, Version 1.0.0.1 arbeitet nicht mehr mit Windows
 zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
 für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
 zu suchen.  Prozess-ID: 150c  Anfangszeit: 01cc27771c21cf94  Zeitpunkt der Beendigung:
 39
 
Error - 11.06.2011 16:22:19 | Computer Name = WINDOWS-SLV5UWZ | Source = EventSystem | ID = 4609
Description = 
 
Error - 11.06.2011 17:43:59 | Computer Name = WINDOWS-SLV5UWZ | Source = EventSystem | ID = 4609
Description = 
 
Error - 11.06.2011 17:48:05 | Computer Name = WINDOWS-SLV5UWZ | Source = EventSystem | ID = 4609
Description = 
 
[ System Events ]
Error - 11.06.2011 17:48:52 | Computer Name = WINDOWS-SLV5UWZ | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 11.06.2011 17:48:54 | Computer Name = WINDOWS-SLV5UWZ | Source = Service Control Manager | ID = 7001
Description = 
 
Error - 12.06.2011 00:53:13 | Computer Name = WINDOWS-SLV5UWZ | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am 12.06.2011 um 06:46:52 unerwartet heruntergefahren.
 
Error - 12.06.2011 00:53:14 | Computer Name = WINDOWS-SLV5UWZ | Source = HTTP | ID = 15016
Description = 
 
Error - 12.06.2011 00:53:57 | Computer Name = WINDOWS-SLV5UWZ | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 12.06.2011 02:52:38 | Computer Name = WINDOWS-SLV5UWZ | Source = Service Control Manager | ID = 7011
Description = 
 
Error - 12.06.2011 03:28:29 | Computer Name = WINDOWS-SLV5UWZ | Source = HTTP | ID = 15016
Description = 
 
Error - 12.06.2011 03:28:50 | Computer Name = WINDOWS-SLV5UWZ | Source = Service Control Manager | ID = 7000
Description = 
 
Error - 12.06.2011 03:48:33 | Computer Name = WINDOWS-SLV5UWZ | Source = HTTP | ID = 15016
Description = 
 
Error - 12.06.2011 03:49:07 | Computer Name = WINDOWS-SLV5UWZ | Source = Service Control Manager | ID = 7000
Description = 
 
 
< End of report >
         

--- --- ---

Eine Bereinigung ist mitunter mit viel Arbeit für Dich verbunden.

• Bitte arbeite alle Schritte der Reihe nach ab.
• Lese die Anleitungen sorgfältig. Sollte es Probleme geben, bitte stoppen und hier so gut es geht beschreiben.
• Nur Scanns durchführen zu denen Du von einem Helfer aufgefordert wirst.
• Bitte kein Crossposting ( posten in mehreren Foren).
• Installiere oder Deinstalliere während der Bereinigung keine Software ausser Du wurdest dazu aufgefordert.
• Lese Dir die Anleitung zuerst vollständig durch. Sollte etwas unklar sein, frage bevor Du beginnst.
• Poste die Logfiles direkt in deinen Thread. Nicht anhängen ausser ich fordere Dich dazu auf. Erschwert mir nämlich das auswerten.

Hinweis: Ich kann Dir niemals eine Garantie geben, dass ich auch alles finde. Eine Formatierung ist meist der Schnellere und immer der sicherste Weg.
Solltest Du Dich für eine Bereinigung entscheiden, arbeite solange mit, bis dir jemand vom Team sagt, dass Du clean bist.

Vista und Win7 User
Alle Tools mit Rechtsklick "als Administrator ausführen" starten.

Schritt 1

Downloade Dir bitte Malwarebytes

• Installiere das Programm in den vorgegebenen Pfad.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Starte Malwarebytes, klicke auf Aktualisierung --> Suche nach Aktualisierung
• Wenn das Update beendet wurde, aktiviere Quick-Scan durchführen und drücke auf Scannen.
• Wenn der Scan beendet ist, klicke auf Ergebnisse anzeigen.
• Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
• Poste das Logfile, welches sich in Notepad öffnet, hier in den Thread.
• Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Schritt 2

Bitte

• alle anderen Scanner gegen Viren, Spyware, usw. deaktivieren,
• keine bestehende Verbindung zu einem Netzwerk/Internet (WLAN nicht vergessen),
• nichts am Rechner arbeiten,
• nach jedem Scan der Rechner neu gestarten.

Gmer scannen lassen

• Lade Dir Gmer von dieser Seite herunter
  (auf den Button Download EXE drücken) und das Programm auf dem Desktop speichern.
• Alle anderen Programme sollen geschlossen sein.
• Starte gmer.exe (Programm hat einen willkürlichen Programm-Namen).
  Vista und Win7 User mit Rechtsklick und als Administrator starten.
• Sollte sich ein Fenster mit folgender Warnung öffnen:

  WARNING !!!
  GMER has found system modification, which might have been caused by ROOTKIT activity.
  Do you want to fully scan your system ?

  Unbedingt auf "No" klicken.
• Entferne rechts den Haken bei:

  • IAT/EAT
  • Alle Festplatten ausser die Systemplatte (normalerweise ist nur C:\ angehackt)
  • Show all (sollte abgehackt sein)

• Starte den Scan mit "Scan". Mache nichts am Computer während der Scan läuft.
• Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Schritt 3

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

• Starte bitte die OTL.exe.
  Vista und Win7 User mit Rechtsklick "als Administrator starten"
• Kopiere nun den Inhalt in die Textbox.

activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
explorer.exe
regedit.exe
winlogon.exe
wininit.exe
userinit.exe
/md5stop
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT
         

• Schliesse bitte nun alle Programme. (Wichtig)
• Klicke nun bitte auf den Quick Scan Button.
• Kopiere nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread