| |
| |||||||
Log-Analyse und Auswertung: Ukash Virus - Malwarebytes erfolgreich - wirklich sicher?Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
29.07.2012, 10:48
| #1 |
| |  Ukash Virus - Malwarebytes erfolgreich - wirklich sicher? Hier die OTL Logs: Code:
ATTFilter OTL logfile created on: 29.07.2012 11:36:06 - Run 1 OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Artillery\Downloads 64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,91 Gb Total Physical Memory | 5,56 Gb Available Physical Memory | 70,31% Memory free 15,82 Gb Paging File | 13,25 Gb Available in Paging File | 83,73% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 1570,04 Gb Total Space | 1447,92 Gb Free Space | 92,22% Space Free | Partition Type: NTFS Drive D: | 135,12 Gb Total Space | 134,89 Gb Free Space | 99,83% Space Free | Partition Type: NTFS Drive E: | 931,51 Gb Total Space | 572,07 Gb Free Space | 61,41% Space Free | Partition Type: NTFS Drive G: | 97,76 Gb Total Space | 9,56 Gb Free Space | 9,78% Space Free | Partition Type: NTFS Drive I: | 292,97 Gb Total Space | 8,72 Gb Free Space | 2,98% Space Free | Partition Type: NTFS Drive J: | 29,65 Gb Total Space | 29,15 Gb Free Space | 98,30% Space Free | Partition Type: FAT32 Drive Z: | 931,51 Gb Total Space | 190,62 Gb Free Space | 20,46% Space Free | Partition Type: NTFS Computer Name: PC | User Name: Artillery | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Artillery\Downloads\OTL.exe (OldTimer Tools) PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Windows\SysWOW64\PnkBstrA.exe () PRC - C:\Users\Artillery\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) PRC - C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) PRC - C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) PRC - C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\AAM Updates Notifier.exe (Adobe Systems Incorporated) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) PRC - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) PRC - C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin) PRC - C:\Program Files (x86)\avmwlanstick\WLanNetService.exe (AVM Berlin) PRC - C:\Program Files (x86)\Biet-O-Matic\Biet-O-Matic.exe (www.bid-o-matic.org) PRC - C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\BoostSpeed.exe (AVG) PRC - E:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org) PRC - E:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org) PRC - C:\Program Files (x86)\Personal SmartCheck\SmCh_svc.exe (URL Toy Software) ========== Modules (No Company Name) ========== MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll () MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll () MOD - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll () MOD - C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madExcept_.bpl () MOD - C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madBasic_.bpl () MOD - C:\Program Files (x86)\AVG\AVG PC Tuneup 2011\madDisAsm_.bpl () MOD - E:\Program Files\OpenOffice.org 3\program\libxml2.dll () ========== Win32 Services (SafeList) ========== SRV:64bit: - (SbieSvc) -- C:\Program Files\Sandboxie\SbieSvc.exe (SANDBOXIE L.T.D) SRV:64bit: - (ndassvc) -- C:\Program Files\NDAS\System\ndassvc.exe (XIMETA, Inc.) SRV:64bit: - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV:64bit: - (AppMgmt) -- C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation) SRV - (AdobeFlashPlayerUpdateSvc) -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe (Adobe Systems Incorporated) SRV - (Steam Client Service) -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe (Valve Corporation) SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation) SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_4f7fccd.dll () SRV - (Skype C2C Service) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe (Skype Technologies S.A.) SRV - (MBAMService) -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (PnkBstrA) -- C:\Windows\SysWOW64\PnkBstrA.exe () SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies) SRV - (BstHdLogRotatorSvc) -- C:\Program Files (x86)\BlueStacks\HD-LogRotatorService.exe (BlueStack Systems, Inc.) SRV - (BstHdAndroidSvc) -- C:\Program Files (x86)\BlueStacks\HD-Service.exe (BlueStack Systems, Inc.) SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesService64.exe (TuneUp Software) SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (SamsungAllShareV2.0) -- C:\Program Files (x86)\Samsung\AllShare\AllShareDMS\AllShareDMS.exe (Samsung Electronics Co., Ltd.) SRV - (SimpleSlideShowServer) -- C:\Program Files (x86)\Samsung\AllShare\AllShareSlideShowService.exe (Samsung Electronics Co., Ltd.) SRV - (nvUpdatusService) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe (NVIDIA Corporation) SRV - (Stereo Service) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation) SRV - (Futuremark SystemInfo Service) -- C:\Program Files (x86)\Futuremark\Futuremark SystemInfo\FMSISvc.exe (Futuremark Corporation) SRV - (UNS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe (Intel Corporation) SRV - (LMS) -- C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe (Intel Corporation) SRV - (AVM WLAN Connection Service) -- C:\Program Files (x86)\avmwlanstick\WLanNetService.exe (AVM Berlin) SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation) SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation) SRV - (SmartCheckSvc) -- C:\Program Files (x86)\Personal SmartCheck\SmCh_svc.exe (URL Toy Software) ========== Driver Services (SafeList) ========== DRV:64bit: - (MBAMProtector) -- C:\Windows\SysNative\drivers\mbam.sys (Malwarebytes Corporation) DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH) DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH) DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation) DRV:64bit: - (usbUDisc) -- C:\Windows\SysNative\drivers\USBDrv_AMD64.sys (Scott) DRV:64bit: - (NVHDA) -- C:\Windows\SysNative\drivers\nvhda64v.sys (NVIDIA Corporation) DRV:64bit: - (vidsflt58) -- C:\Windows\SysNative\drivers\vsflt58.sys (Acronis) DRV:64bit: - (fltsrv) -- C:\Windows\SysNative\drivers\fltsrv.sys (Acronis) DRV:64bit: - (sptd) -- C:\Windows\SysNative\drivers\sptd.sys () DRV:64bit: - (SbieDrv) -- C:\Program Files\Sandboxie\SbieDrv.sys (SANDBOXIE L.T.D) DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH) DRV:64bit: - (HWiNFO32) -- C:\Program Files\HWiNFO64\HWiNFO64A.SYS (REALiX(tm)) DRV:64bit: - (igfx) -- C:\Windows\SysNative\drivers\igdkmd64.sys (Intel Corporation) DRV:64bit: - (epmntdrv) -- C:\Windows\SysNative\epmntdrv.sys () DRV:64bit: - (EuGdiDrv) -- C:\Windows\SysNative\EuGdiDrv.sys () DRV:64bit: - (taphss) -- C:\Windows\SysNative\drivers\taphss.sys (AnchorFree Inc) DRV:64bit: - (RTL8167) -- C:\Windows\SysNative\drivers\Rt64win7.sys (Realtek ) DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices) DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices) DRV:64bit: - (EtronXHCI) -- C:\Windows\SysNative\drivers\EtronXHCI.sys (Etron Technology Inc) DRV:64bit: - (EtronHub3) -- C:\Windows\SysNative\drivers\EtronHub3.sys (Etron Technology Inc) DRV:64bit: - (MAUSBFASTTRACKPRO) -- C:\Windows\SysNative\drivers\MAudioFastTrackPro.sys (Avid Technology, Inc.) DRV:64bit: - (tap0901) -- C:\Windows\SysNative\drivers\tap0901.sys (The OpenVPN Project) DRV:64bit: - (RdpVideoMiniport) -- C:\Windows\SysNative\drivers\rdpvideominiport.sys (Microsoft Corporation) DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation) DRV:64bit: - (tsusbhub) -- C:\Windows\SysNative\drivers\tsusbhub.sys (Microsoft Corporation) DRV:64bit: - (Synth3dVsc) -- C:\Windows\SysNative\drivers\Synth3dVsc.sys (Microsoft Corporation) DRV:64bit: - (dmvsc) -- C:\Windows\SysNative\drivers\dmvsc.sys (Microsoft Corporation) DRV:64bit: - (terminpt) -- C:\Windows\SysNative\drivers\terminpt.sys (Microsoft Corporation) DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company) DRV:64bit: - (TsUsbGD) -- C:\Windows\SysNative\drivers\TsUsbGD.sys (Microsoft Corporation) DRV:64bit: - (FWLANUSB) -- C:\Windows\SysNative\drivers\fwlanusb.sys (AVM GmbH) DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation) DRV:64bit: - (SSPORT) -- C:\Windows\SysNative\drivers\SSPORT.sys (Samsung Electronics) DRV:64bit: - (lfsfilt) -- C:\Windows\SysNative\drivers\lfsfilt.sys (XIMETA, Inc.) DRV:64bit: - (lpx) -- C:\Windows\SysNative\drivers\lpx6x.sys (XIMETA, Inc.) DRV:64bit: - (ndasbus) -- C:\Windows\SysNative\drivers\ndasbus.sys (XIMETA, Inc.) DRV:64bit: - (ndasfat) -- C:\Windows\SysNative\drivers\ndasfat.sys (Windows (R) Codename Longhorn DDK provider) DRV:64bit: - (ndasfs) -- C:\Windows\SysNative\drivers\ndasfs.sys (XIMETA, Inc.) DRV:64bit: - (ndasrofs) -- C:\Windows\SysNative\drivers\ndasrofs.sys (XIMETA, Inc.) DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.) DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation) DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology) DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation) DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation) DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation) DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.) DRV - (BstHdDrv) -- C:\Program Files (x86)\BlueStacks\HD-Hypervisor-amd64.sys (BlueStack Systems) DRV - (TuneUpUtilitiesDrv) -- C:\Program Files (x86)\TuneUp Utilities 2012\TuneUpUtilitiesDriver64.sys (TuneUp Software) DRV - (epmntdrv) -- C:\Windows\SysWOW64\epmntdrv.sys () DRV - (EuGdiDrv) -- C:\Windows\SysWOW64\EuGdiDrv.sys () DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation) DRV - (ASPI32) -- C:\Windows\SysWow64\drivers\ASPI32.SYS (Adaptec) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm IE - HKLM\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2319825 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 01 A8 AF E9 07 6D CD 01 [binary data] IE - HKCU\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local> IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = 203.232.208.116:8080 ========== FireFox ========== FF - user.js - File not found FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_3_300_268.dll File not found FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_268.dll () FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.102.0: C:\Program Files (x86)\Battlelog Web Plugins\1.102.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll File not found FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.118.0: C:\Program Files (x86)\Battlelog Web Plugins\1.118.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll (ESN Social Software AB) FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files (x86)\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll (Foxit Corporation) FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=1.6.0_32: C:\Windows\SysWOW64\npdeployJava1.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3555.0308: C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKCU\Software\MozillaPlugins\@unity3d.com/UnityPlayer,version=1.0: C:\Users\Artillery\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS) FF - HKCU\Software\MozillaPlugins\@us-w1.rockmelt.com/RockMelt Update;version=8: C:\Users\Artillery\AppData\Local\RockMelt\Update\1.2.189.1\npRockMeltOneClick8.dll (RockMelt Inc.) FF - HKCU\Software\MozillaPlugins\facebook.com/fbDesktopPlugin: C:\Users\Artillery\AppData\Local\Facebook\Messenger\2.1.4587.0\npFbDesktopPlugin.dll (Facebook, Inc.) 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 10.0a1\extensions\\Components: C:\PROGRAM FILES\NIGHTLY\COMPONENTS [2011.11.14 23:20:47 | 000,000,000 | ---D | M] 64bit-FF - HKEY_LOCAL_MACHINE\software\mozilla\Nightly 10.0a1\extensions\\Plugins: C:\PROGRAM FILES\NIGHTLY\PLUGINS FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.22 12:34:11 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 15.0\extensions\\Components: C:\Program Files (x86)\Mozilla Thunderbird\components [2012.07.23 13:29:49 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 14.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012.07.22 12:34:11 | 000,000,000 | ---D | M] [2012.02.07 22:13:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Extensions [2012.02.07 22:13:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Extensions\ideskbrowser@haufe.de [2012.07.28 23:43:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions [2012.07.01 18:01:28 | 000,000,000 | ---D | M] (Forecastfox) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions\{0538E3E3-7E9B-4d49-8831-A227C80A7AD3} [2012.04.16 16:37:34 | 000,000,000 | ---D | M] (Tradesignal Online Chart) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions\{1acd747e-8470-11db-96a9-00e08161165f} [2012.06.19 12:06:05 | 000,000,000 | ---D | M] (AddThis) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions\{3e0e7d2a-070f-4a47-b019-91fe5385ba79} [2012.07.28 23:43:16 | 000,000,000 | ---D | M] (Winload) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions\{40c3cc16-7269-4b32-9531-17f2950fb06f} [2011.12.06 11:57:02 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2012.05.20 19:09:20 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2011.10.11 11:52:42 | 000,000,000 | ---D | M] (Battlefield Play4Free) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions\battlefieldplay4free@ea.com [2012.06.08 16:11:26 | 000,000,000 | ---D | M] (FoxyProxy Standard) -- C:\Users\Artillery\AppData\Roaming\Mozilla\Firefox\Profiles\9kva2m5q.default\extensions\foxyproxy@eric.h.jung [2012.07.17 15:31:48 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions [2012.07.17 15:32:01 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.07.22 12:34:11 | 000,136,672 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll [2012.06.18 12:01:42 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml [2012.06.18 12:01:42 | 000,002,252 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml [2012.06.18 12:01:42 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml [2012.06.18 12:01:42 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml [2012.06.18 12:01:42 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml [2012.06.18 12:01:42 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2:64bit: - BHO: (no name) - {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} - No CLSID value found. O2 - BHO: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.) O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O3 - HKLM\..\Toolbar: (Winload Toolbar) - {40c3cc16-7269-4b32-9531-17f2950fb06f} - C:\Program Files (x86)\Winload\prxtbWinl.dll (Conduit Ltd.) O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated) O4:64bit: - HKLM..\Run: [CDAServer] C:\Program Files\Common Files\Common Desktop Agent\CDASrv.exe () O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [IgfxTray] C:\Windows\SysNative\igfxtray.exe (Intel Corporation) O4:64bit: - HKLM..\Run: [M-Audio Taskbar Icon] C:\Windows\SysNative\M-AudioTaskBarIcon.exe (Avid Technology, Inc.) O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation) O4 - HKLM..\Run: [AdobeCS5.5ServiceManager] "C:\Program Files (x86)\Common Files\Adobe\CS5.5ServiceManager\CS5.5ServiceManager.exe" -launchedbylogin File not found O4 - HKLM..\Run: [AllShareAgent] C:\Program Files (x86)\Samsung\AllShare\AllShareAgent.exe (Samsung Electronics Co., Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\WLanGUI.exe (AVM Berlin) O4 - HKLM..\Run: [lxdeamon] C:\Program Files (x86) (x86)\Lexmark 4800 Series\lxdeamon.exe () O4 - HKLM..\Run: [lxdemon.exe] C:\Program Files (x86) (x86)\Lexmark 4800 Series\lxdemon.exe () O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [WinampAgent] C:\Program Files (x86)\Winamp\winampa.exe (Nullsoft, Inc.) O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Artillery\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc) O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd) O4 - Startup: C:\Users\Artillery\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Artillery\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.) O4 - Startup: C:\Users\Artillery\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.2.lnk = E:\Program Files\OpenOffice.org 3\program\quickstart.exe () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\run: Visual Drive = C:\Users\ARTILL~1\AppData\Local\Temp\N9TM8DD9P7.exe O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1 O8:64bit: - Extra context menu item: Free YouTube Download - C:\Users\Artillery\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Artillery\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\Artillery\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Artillery\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O9 - Extra Button: PokerStars - {3AD14F0C-ED16-4e43-B6D8-661B03F6A1EF} - C:\Program Files (x86)\PokerStars\PokerStarsUpdate.exe (PokerStars) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: PokerStars.net - {FA9B9510-9FCB-4ca0-818C-5D0987B47C4D} - C:\Program Files (x86)\PokerStars.NET\PokerStarsUpdate.exe (PokerStars) O1364bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15 - HKCU\..Trusted Domains: samsungsetup.com ([www] http in Trusted sites) O16:64bit: - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16:64bit: - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16:64bit: - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32) O16 - DPF: {CAFEEFAC-0016-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_02-windows-i586.cab (Java Plug-in 1.6.0_02) O16 - DPF: {CAFEEFAC-0016-0000-0004-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_04-windows-i586.cab (Java Plug-in 1.6.0_04) O16 - DPF: {CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_32-windows-i586.cab (Java Plug-in 1.6.0_32) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1CB617CC-DC3A-4196-A0B5-94FB41D61A2B}: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E4D21A06-65DC-44A3-8004-C744184F0921}: DhcpNameServer = 192.168.2.1 O18:64bit: - Protocol\Handler\haufereader - No CLSID value found O18:64bit: - Protocol\Handler\skype4com - No CLSID value found O18:64bit: - Protocol\Handler\skype-ie-addon-data - No CLSID value found O18:64bit: - Protocol\Handler\wlpg - No CLSID value found O18 - Protocol\Handler\haufereader - No CLSID value found O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - C:\Windows\SysNative\nvinitx.dll (NVIDIA Corporation) O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - C:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation) O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation) O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22:64bit: - SharedTaskScheduler: {E31004D1-A431-41B8-826F-E902F9D95C81} - Windows DreamScene - C:\Windows\SysNative\DreamScene.dll (Microsoft Corporation) O22:64bit: - SharedTaskScheduler: {EC654325-1273-C2A9-2B7C-45D29BCE68FB} - Deskscapes - No CLSID value found. O27:64bit: - HKLM IFEO\allshare.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\facebookmessenger.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\hd-apkhandler.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\hd-startlauncher.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\ndasbind.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\ndasmgmt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27:64bit: - HKLM IFEO\setup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\allshare.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\facebookmessenger.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\hd-apkhandler.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\hd-startlauncher.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\ndasbind.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\ndasmgmt.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O27 - HKLM IFEO\setup.exe: Debugger - C:\Program Files (x86)\TuneUp Utilities 2012\TUAutoReactivator64.exe (TuneUp Software) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - E:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{ab305f62-f45e-11e0-929c-00040ec79dbc}\Shell - "" = AutoRun O33 - MountPoints2\{ab305f62-f45e-11e0-929c-00040ec79dbc}\Shell\AutoRun\command - "" = H:\pushinst.exe O34 - HKLM BootExecute: (autocheck autochk *) O35:64bit: - HKLM\..comfile [open] -- "%1" %* O35:64bit: - HKLM\..exefile [open] -- "%1" %* O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ========== Files/Folders - Created Within 30 Days ========== [2012.07.29 11:15:50 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Roaming\Malwarebytes [2012.07.29 11:15:42 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2012.07.29 11:15:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.07.29 11:15:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware [2012.07.29 11:15:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2012.07.29 00:02:14 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Sardu [2012.07.28 23:45:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Conduit [2012.07.28 23:43:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Optimizer Pro [2012.07.28 23:43:18 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Optimizer Pro [2012.07.28 23:43:12 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Winload [2012.07.28 23:43:12 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Local\Conduit [2012.07.24 09:12:22 | 000,000,000 | ---D | C] -- C:\ProgramData\PSC [2012.07.24 09:12:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\URLToy Software [2012.07.24 09:12:17 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Personal SmartCheck [2012.07.24 02:22:23 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Facebook [2012.07.24 02:21:56 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012.07.23 22:45:22 | 000,034,656 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\TURegOpt.exe [2012.07.23 22:45:22 | 000,025,952 | ---- | C] (TuneUp Software) -- C:\Windows\SysNative\authuitu.dll [2012.07.23 22:45:22 | 000,021,344 | ---- | C] (TuneUp Software) -- C:\Windows\SysWow64\authuitu.dll [2012.07.23 22:45:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012 [2012.07.23 22:45:14 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Roaming\TuneUp Software [2012.07.23 22:45:13 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TuneUp Utilities 2012 [2012.07.23 22:45:03 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2012.07.23 22:44:59 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} [2012.07.23 22:44:59 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2012.07.21 11:42:43 | 000,000,000 | --SD | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.4 [2012.07.21 11:42:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\OpenOffice.org 3 [2012.07.21 11:41:25 | 000,000,000 | ---D | C] -- C:\Users\Artillery\Desktop\OpenOffice.org 3.4 (de) Installation Files [2012.07.20 11:29:46 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Local\{B6695B28-75A6-47B6-9ADA-87727757A3E5} [2012.07.20 11:29:36 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Local\{6F1F6951-5392-459B-8A6A-DDD3FBE6A812} [2012.07.20 11:19:56 | 000,000,000 | ---D | C] -- C:\Windows\de [2012.07.20 11:19:07 | 000,000,000 | ---D | C] -- C:\Windows\en [2012.07.20 11:18:11 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Microsoft SQL Server Compact Edition [2012.07.20 11:16:54 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Windows Live [2012.07.20 11:16:52 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2012.07.20 11:15:47 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Local\Windows Live [2012.07.20 11:15:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Windows Live [2012.07.17 15:31:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype [2012.07.17 15:31:41 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype [2012.07.14 08:21:52 | 000,294,912 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\browserchoice.exe [2012.07.14 08:19:45 | 000,248,320 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieui.dll [2012.07.14 08:19:45 | 000,237,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\url.dll [2012.07.14 08:19:45 | 000,231,936 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\url.dll [2012.07.14 08:19:45 | 000,176,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieui.dll [2012.07.14 08:19:45 | 000,173,056 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ieUnatt.exe [2012.07.14 08:19:45 | 000,142,848 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\ieUnatt.exe [2012.07.14 08:19:45 | 000,096,768 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\mshtmled.dll [2012.07.14 08:19:45 | 000,073,216 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\mshtmled.dll [2012.07.14 08:19:44 | 002,311,680 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript9.dll [2012.07.14 08:19:44 | 001,494,528 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\inetcpl.cpl [2012.07.14 08:19:44 | 001,427,968 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\inetcpl.cpl [2012.07.14 08:19:44 | 000,818,688 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\jscript.dll [2012.07.14 08:19:44 | 000,716,800 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\jscript.dll [2012.07.11 11:28:37 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Local\Apple Computer [2012.07.11 03:33:11 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\msxml3r.dll [2012.07.11 03:33:11 | 000,002,048 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\msxml3r.dll [2012.07.11 03:33:09 | 000,307,200 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\ncrypt.dll [2012.07.11 03:33:07 | 001,462,272 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\crypt32.dll [2012.07.11 03:33:07 | 000,140,288 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cryptnet.dll [2012.07.11 03:33:04 | 001,133,568 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysNative\cdosys.dll [2012.07.11 03:33:04 | 000,805,376 | ---- | C] (Microsoft Corporation) -- C:\Windows\SysWow64\cdosys.dll [2012.07.10 09:48:44 | 000,000,000 | ---D | C] -- C:\Users\Artillery\Documents\Downloads [2012.07.09 15:09:09 | 000,000,000 | ---D | C] -- C:\Program Files\Windows XP Mode [2012.07.07 13:38:15 | 000,000,000 | ---D | C] -- C:\Users\Artillery\AppData\Roaming\Wireshark [2012.07.07 11:03:18 | 000,000,000 | ---D | C] -- C:\Program Files\Wireshark [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.07.29 11:32:48 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.07.29 11:32:48 | 000,021,072 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.07.29 11:29:49 | 001,613,340 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI [2012.07.29 11:29:49 | 000,696,832 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat [2012.07.29 11:29:49 | 000,652,150 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat [2012.07.29 11:29:49 | 000,148,128 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat [2012.07.29 11:29:49 | 000,121,082 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat [2012.07.29 11:25:03 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.07.29 11:24:47 | 2077,061,119 | -HS- | M] () -- C:\hiberfil.sys [2012.07.29 11:15:42 | 000,001,138 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.28 23:46:41 | 000,000,009 | ---- | M] () -- C:\END [2012.07.28 23:43:19 | 000,001,081 | ---- | M] () -- C:\Users\Artillery\Desktop\Optimizer Pro.lnk [2012.07.28 23:29:18 | 004,503,728 | ---- | M] () -- C:\ProgramData\257294sak952992.pad [2012.07.28 22:51:00 | 000,000,830 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job [2012.07.28 22:43:00 | 000,000,944 | ---- | M] () -- C:\Windows\tasks\RockMeltUpdateTaskUserS-1-5-21-1157435081-115103392-260508646-1000UA.job [2012.07.28 22:19:35 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr [2012.07.28 22:19:35 | 000,283,304 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe [2012.07.28 22:19:21 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0 [2012.07.28 09:43:00 | 000,000,892 | ---- | M] () -- C:\Windows\tasks\RockMeltUpdateTaskUserS-1-5-21-1157435081-115103392-260508646-1000Core.job [2012.07.26 23:51:07 | 000,426,184 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe [2012.07.26 23:51:07 | 000,070,344 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl [2012.07.26 01:43:26 | 000,002,336 | ---- | M] () -- C:\Users\Artillery\Desktop\RockMelt.lnk [2012.07.24 10:24:04 | 000,001,154 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1157435081-115103392-260508646-1000UA.job [2012.07.24 10:24:04 | 000,001,132 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-1157435081-115103392-260508646-1000Core.job [2012.07.24 08:49:59 | 000,310,344 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT [2012.07.23 22:45:19 | 000,002,232 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2012.07.23 22:45:19 | 000,002,214 | ---- | M] () -- C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk [2012.07.23 13:29:51 | 000,002,099 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk [2012.07.21 11:43:44 | 000,002,300 | ---- | M] () -- C:\Users\Artillery\Documents\Neue Datenbank.odb [2012.07.21 11:42:43 | 000,001,172 | ---- | M] () -- C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk [2012.07.17 15:31:41 | 000,002,547 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk [2012.07.12 12:44:41 | 000,000,688 | ---- | M] () -- C:\Users\Artillery\Documents\tom808kit.di [2012.07.08 20:54:00 | 000,722,949 | ---- | M] () -- C:\Users\Artillery\Documents\wohnzimmerneu!.sh3d [2012.07.07 23:11:05 | 000,472,222 | ---- | M] () -- C:\Users\Artillery\Documents\schlafzimmer.sh3d [2012.07.06 21:53:10 | 000,028,183 | ---- | M] () -- C:\Users\Artillery\Documents\RS4238592524.pdf [2012.07.05 13:08:38 | 000,026,558 | ---- | M] () -- C:\Users\Artillery\Documents\Bestellbestaetigung.pdf [2012.07.03 13:46:44 | 000,024,904 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys [2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.07.29 11:15:42 | 000,001,138 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.07.28 23:43:19 | 000,001,081 | ---- | C] () -- C:\Users\Artillery\Desktop\Optimizer Pro.lnk [2012.07.28 23:43:16 | 000,000,009 | ---- | C] () -- C:\END [2012.07.28 23:28:20 | 004,503,728 | ---- | C] () -- C:\ProgramData\257294sak952992.pad [2012.07.23 22:45:19 | 000,002,232 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp 1-Klick-Wartung.lnk [2012.07.23 22:45:19 | 000,002,226 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk [2012.07.23 22:45:19 | 000,002,214 | ---- | C] () -- C:\Users\Public\Desktop\TuneUp Utilities 2012.lnk [2012.07.23 13:29:51 | 000,002,099 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Thunderbird.lnk [2012.07.21 11:43:32 | 000,002,300 | ---- | C] () -- C:\Users\Artillery\Documents\Neue Datenbank.odb [2012.07.21 11:42:43 | 000,001,172 | ---- | C] () -- C:\Users\Public\Desktop\OpenOffice.org 3.4.lnk [2012.07.20 11:18:41 | 000,001,326 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Movie Maker.lnk [2012.07.20 11:18:23 | 000,001,399 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Live Photo Gallery.lnk [2012.07.12 12:44:41 | 000,000,688 | ---- | C] () -- C:\Users\Artillery\Documents\tom808kit.di [2012.07.08 20:54:00 | 000,722,949 | ---- | C] () -- C:\Users\Artillery\Documents\wohnzimmerneu!.sh3d [2012.07.07 11:03:27 | 000,001,551 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Wireshark.lnk [2012.07.06 21:53:09 | 000,028,183 | ---- | C] () -- C:\Users\Artillery\Documents\RS4238592524.pdf [2012.07.05 13:08:37 | 000,026,558 | ---- | C] () -- C:\Users\Artillery\Documents\Bestellbestaetigung.pdf [2012.06.25 11:06:29 | 000,004,608 | ---- | C] () -- C:\Users\Artillery\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.06.24 20:36:55 | 000,650,752 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll [2012.06.24 20:36:55 | 000,243,200 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll [2012.06.24 20:36:55 | 000,178,688 | ---- | C] () -- C:\Windows\SysWow64\unrar.dll [2012.06.24 20:36:54 | 000,079,872 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2012.06.21 10:37:14 | 003,166,792 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe [2012.05.03 16:19:13 | 000,000,032 | R--- | C] () -- C:\ProgramData\hash.dat [2012.02.29 14:26:56 | 000,416,064 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe [2012.01.21 13:08:57 | 000,000,001 | ---- | C] () -- C:\Users\Artillery\uappset.bin [2012.01.04 17:52:18 | 000,000,031 | ---- | C] () -- C:\Windows\QUICKEN.INI [2012.01.03 09:28:06 | 002,570,286 | ---- | C] () -- C:\Windows\SysWow64\abgx360.exe [2011.11.24 14:50:37 | 001,590,298 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2011.11.08 17:31:39 | 000,000,001 | ---- | C] () -- C:\Users\Artillery\AppData\Local\RawCopy.sourcedisk.index [2011.11.08 17:31:25 | 000,000,001 | ---- | C] () -- C:\Users\Artillery\AppData\Local\RawCopy.1.02.agreement [2011.11.03 12:58:27 | 000,002,382 | ---- | C] () -- C:\Windows\Sandboxie.ini [2011.10.31 20:55:49 | 001,895,936 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdeserv.dll [2011.10.31 20:55:49 | 001,501,696 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdeusb1.dll [2011.10.31 20:55:49 | 001,065,984 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdehbn3.dll [2011.10.31 20:55:49 | 000,980,992 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdepmui.dll [2011.10.31 20:55:49 | 000,879,104 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdelmpm.dll [2011.10.31 20:55:49 | 000,541,184 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdeinpa.dll [2011.10.31 20:55:49 | 000,524,288 | ---- | C] () -- C:\Windows\SysWow64\lxdeinst.dll [2011.10.31 20:55:49 | 000,509,440 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdeiesc.dll [2011.10.31 20:55:49 | 000,047,104 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdeprox.dll [2011.10.31 20:55:48 | 001,489,408 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdecomc.dll [2011.10.31 20:55:48 | 000,563,200 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdecomm.dll [2011.10.26 15:08:55 | 000,668,672 | ---- | C] ( ) -- C:\Windows\SysWow64\lxdehcp.dll [2011.10.26 15:08:55 | 000,299,520 | ---- | C] () -- C:\Windows\SysWow64\lxdegrd.dll [2011.10.23 17:10:02 | 000,283,304 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe [2011.10.23 17:10:01 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe [2011.10.14 17:52:28 | 002,469,760 | ---- | C] () -- C:\Windows\SysWow64\BootMan.exe [2011.10.14 17:52:28 | 000,086,408 | ---- | C] () -- C:\Windows\SysWow64\setupempdrv03.exe [2011.10.14 17:52:28 | 000,019,840 | ---- | C] () -- C:\Windows\SysWow64\EuEpmGdi.dll [2011.10.14 17:52:28 | 000,014,216 | ---- | C] () -- C:\Windows\SysWow64\epmntdrv.sys [2011.10.14 17:52:28 | 000,008,456 | ---- | C] () -- C:\Windows\SysWow64\EuGdiDrv.sys [2011.10.11 21:47:40 | 000,015,873 | ---- | C] () -- C:\Windows\SysWow64\Inetde.dll [2011.10.11 18:28:49 | 157,329,084 | ---- | C] () -- C:\Users\Artillery\AnotherEarthDreamII.Dream [2011.09.19 15:03:40 | 000,045,056 | ---- | C] () -- C:\Windows\SysWow64\rtvcvfw32.dll [2011.08.31 19:51:16 | 000,963,116 | ---- | C] () -- C:\Windows\SysWow64\igkrng600.bin [2011.08.31 19:51:16 | 000,216,000 | ---- | C] () -- C:\Windows\SysWow64\igfcg600m.bin [2011.08.31 19:51:16 | 000,145,804 | ---- | C] () -- C:\Windows\SysWow64\igcompkrng600.bin [2011.08.31 19:46:00 | 000,056,832 | ---- | C] () -- C:\Windows\SysWow64\igdde32.dll [2011.08.31 19:26:20 | 013,903,872 | ---- | C] () -- C:\Windows\SysWow64\ig4icd32.dll ========== Alternate Data Streams ========== @Alternate Data Stream - 144 bytes -> C:\ProgramData\TEMP:0B4227B4 @Alternate Data Stream - 115 bytes -> C:\ProgramData\TEMP:B755D674 @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:A9ABA3FF < End of report > Code:
ATTFilter OTL Extras logfile created on: 29.07.2012 11:36:06 - Run 1
OTL by OldTimer - Version 3.2.55.0 Folder = C:\Users\Artillery\Downloads
64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,91 Gb Total Physical Memory | 5,56 Gb Available Physical Memory | 70,31% Memory free
15,82 Gb Paging File | 13,25 Gb Available in Paging File | 83,73% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 1570,04 Gb Total Space | 1447,92 Gb Free Space | 92,22% Space Free | Partition Type: NTFS
Drive D: | 135,12 Gb Total Space | 134,89 Gb Free Space | 99,83% Space Free | Partition Type: NTFS
Drive E: | 931,51 Gb Total Space | 572,07 Gb Free Space | 61,41% Space Free | Partition Type: NTFS
Drive G: | 97,76 Gb Total Space | 9,56 Gb Free Space | 9,78% Space Free | Partition Type: NTFS
Drive I: | 292,97 Gb Total Space | 8,72 Gb Free Space | 2,98% Space Free | Partition Type: NTFS
Drive J: | 29,65 Gb Total Space | 29,15 Gb Free Space | 98,30% Space Free | Partition Type: FAT32
Drive Z: | 931,51 Gb Total Space | 190,62 Gb Free Space | 20,46% Space Free | Partition Type: NTFS
Computer Name: PC | User Name: Artillery | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistBinTube] -- C:\Program Files (x86)\BinTube\BinTube Usenet Reader\binplayer.exe -p "%1" (BinTube LLC)
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithBinTube] -- C:\Program Files (x86)\BinTube\BinTube Usenet Reader\bintube.exe "%1" (BinTube.com)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistBinTube] -- C:\Program Files (x86)\BinTube\BinTube Usenet Reader\binplayer.exe -p "%1" (BinTube LLC)
Directory [AddToPlaylistVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithBinTube] -- C:\Program Files (x86)\BinTube\BinTube Usenet Reader\bintube.exe "%1" (BinTube.com)
Directory [PlayWithVLC] -- "C:\Program Files (x86)\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Directory [Winamp.Bookmark] -- "C:\Program Files (x86)\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "C:\Program Files (x86)\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "C:\Program Files (x86)\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{09F9F5E2-7FFD-4357-BDDC-67A3E867C560}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0D85DE54-F66E-4D86-9D6D-6251AD7DE2E3}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{0DB03968-8B98-4F1F-927F-60FC0FF1D699}" = rport=10243 | protocol=6 | dir=out | app=system |
"{1157C68E-6C86-42DD-855E-DC26B086F26A}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{12CEC391-BD7B-4BE0-9E25-D124586EAFA9}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{1385F674-44CC-49BE-8245-865B1684B334}" = lport=445 | protocol=6 | dir=in | app=system |
"{142D83B6-7825-4B16-98A4-3C5ACCF18C43}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{244CAFE7-CFAF-45DF-94EF-D60EC2DB7E2C}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{281A338B-597A-4861-9D97-E9FDB086CD5D}" = lport=138 | protocol=17 | dir=in | app=system |
"{29CC4D7B-ECC5-4862-BE26-FC40BFB677E8}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{2B4EC21B-E77C-4330-87AB-1499CB95B7A6}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{30319EAD-82A3-44A2-A559-AD397D49BDAA}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{34A0B0B0-14A7-40E4-82C4-EFC4CB9FFD2F}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{36B1B56B-D06E-48E8-9884-C35F3B92815D}" = lport=139 | protocol=6 | dir=in | app=system |
"{3CB210D5-9412-45DD-8507-5C303DABB699}" = lport=2869 | protocol=6 | dir=in | app=system |
"{529D3C3F-C2BD-43B4-A5D5-03E5AA3983D9}" = rport=137 | protocol=17 | dir=out | app=system |
"{5B6E92EF-F206-4EF0-9D05-E71C4EEF7BFB}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{627B6E54-435A-4E49-8DF7-146E616AC28D}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{733D81F4-8955-4175-B55F-F9E9D1D8987B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7509F17A-5DA3-4E51-AC08-C51EE80B974F}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{780383C1-10CB-4A77-A6FB-A7C673E22646}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{7D84F708-21C8-4A1A-B08E-A93598438704}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{7F95250A-016E-4741-B9C4-B66EA5A877A5}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8FF135C4-40C2-40EE-956C-9C3F31137F42}" = lport=10243 | protocol=6 | dir=in | app=system |
"{91F88097-058A-4A5A-91C9-F61464DC4127}" = rport=138 | protocol=17 | dir=out | app=system |
"{A304EDCB-1564-4DC0-A02F-35B0CE099F00}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{AEABECF1-8AB4-478A-8DAF-51686962B280}" = lport=55461 | protocol=6 | dir=in | name=akamai netsession interface |
"{B41AF288-B958-4092-9F12-ED771E88A634}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{B4948C52-333A-46FA-94EF-0B4565D63551}" = rport=445 | protocol=6 | dir=out | app=system |
"{B577B041-97C4-42B1-8519-852D735F85FE}" = lport=137 | protocol=17 | dir=in | app=system |
"{BA22AFE4-BFE5-4F5F-9409-FB7703FE65DB}" = rport=139 | protocol=6 | dir=out | app=system |
"{C0AAA33A-2CB4-4AB1-B2D5-C874EF6BEA56}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{C1DF978D-23F6-4622-81CC-04C3030583B2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E5D91646-90B2-421C-8172-A4B5AE227C4C}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E984AB0C-D6BE-4A75-82D3-EF953BE6E165}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{EAFDBE38-F309-4728-88CA-65F38E7859CD}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{023CCF39-9226-43B7-90CE-A01807E68CB0}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{056A4B5C-F083-4F93-86D7-9AC488D3CD64}" = protocol=6 | dir=in | app=c:\users\artillery\appdata\roaming\dropbox\bin\dropbox.exe |
"{0B13D25B-0B9D-4BB5-B0F9-6C780C9B7901}" = protocol=17 | dir=in | app=c:\program files (x86) (x86)\lexmark 4800 series\lxdemon.exe |
"{0D17E1DF-797D-4CDD-A57E-86C29E41F70B}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{132FDA70-3BD6-4456-9FF6-ED17D046825F}" = protocol=6 | dir=in | app=c:\program files (x86) (x86)\lexmark 4800 series\lxdeamon.exe |
"{138521A6-F251-4375-A42A-49BA7F5FE64B}" = protocol=17 | dir=in | app=g:\games\tom clancy's ghost recon future soldier\future soldier.exe |
"{16320D5F-7099-4EEE-9C90-26739C127763}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{1972AD17-37D7-4A31-BA46-E1B6166D05FC}" = protocol=17 | dir=in | app=g:\diablo iii\diablo iii.exe |
"{1C1C91CA-66DE-4D4B-A2E5-1BF742F0DF73}" = protocol=6 | dir=in | app=e:\program files\steam\steamapps\common\rage\rage.exe |
"{1CE48B3D-C4AC-4F48-BB24-E34521C71E52}" = protocol=6 | dir=in | app=g:\games\mp3\playmaxpayne3.exe |
"{216E632C-3E74-47A7-8DC8-7ED7AF0DAAB6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{21EFBE8F-A4BE-498D-972D-87330B837821}" = dir=in | app=c:\program files (x86)\windows live\contacts\wlcomm.exe |
"{23AB1439-CDF4-46A8-88DF-F008086D1DCB}" = protocol=17 | dir=in | app=c:\program files\common files\common desktop agent\cdasrv.exe |
"{267D3B65-F6C5-481B-93CF-CB4CC900F7E3}" = protocol=6 | dir=in | app=g:\games\shank 2\shank 2\bin\shank2.exe |
"{273A8A50-760B-4A7D-8422-FCBC86512937}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2C193B09-9073-4996-837A-1C4AF8F74C86}" = dir=in | app=c:\program files (x86)\samsung\allshare\allsharedms\allsharedms.exe |
"{2CE546CA-14F6-439C-9AA8-5B1B68BE020F}" = protocol=6 | dir=in | app=c:\program files (x86) (x86)\lexmark 4800 series\lxdemon.exe |
"{2F153387-1CBC-4902-8A12-221A58562637}" = protocol=17 | dir=in | app=g:\games\tom clancy's ghost recon future soldier\gu.exe |
"{30681167-877E-4B20-83E6-5021457C4D6D}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{33D8A88D-41D9-4771-BE29-0EA114FCC181}" = protocol=6 | dir=in | app=e:\program files\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{363DCF45-9257-44F1-8618-EEB37E38A36B}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{3ADB5FBB-3BB8-441F-9CC6-126065F1A656}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3D17295F-D4E3-46FA-AED2-2FC5818838C0}" = protocol=6 | dir=in | app=g:\games\apache air assault\launcher.exe |
"{44DEC817-2BBE-41DE-9B28-FEBD40070F73}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{46024A31-4C1B-49A1-8B15-299765367081}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\cdas2pc\cdas2pc.exe |
"{461F7D55-5C10-43BC-ACE0-95A609E96017}" = protocol=17 | dir=in | app=e:\program files\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe |
"{4E2F1081-07AB-4E30-8981-266931D6B5AF}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{50794560-D89C-41C7-8096-A32DBD2300E2}" = protocol=17 | dir=in | app=g:\games\shank 2\shank 2\bin\shank2.exe |
"{5245ECEF-9B22-4540-9FC8-4856C0EEAEEF}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{535D2659-1EB8-4319-AD02-BC9BB30D34D6}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\idsalert.exe |
"{5867301B-8694-43EE-A1A6-1FC4F1B1690B}" = protocol=17 | dir=in | app=g:\origin\games\battlefield 3\bf3.exe |
"{58B7CF8A-A34D-4200-9AE4-01496AF95689}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\idsalert.exe |
"{5901ACD0-A33F-44BF-B614-DAF7E3B2CEC2}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5A019C5F-5029-498E-99B1-3A2F13C75846}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{5C4D0EC1-F367-45B6-9AD9-AD07EBB47E56}" = dir=in | app=c:\program files (x86)\samsung\allshare\allshareagent.exe |
"{610B2165-3400-48D3-A7B8-E43A214E9180}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\cdas2pc\cdas2pc.exe |
"{64FF14DA-61F9-4EE2-8E7B-1F2611BF76E9}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{6660165F-9C09-47FB-856D-4F53224D43E7}" = protocol=6 | dir=in | app=g:\games\tom clancy's ghost recon future soldier\gu.exe |
"{686C36A9-D1DB-4194-A690-D4DE68144BDD}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{691EA4F5-A341-4DD2-B5BA-B91F26BD28D4}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{6946353B-D009-4F76-85F9-E905A929E097}" = protocol=6 | dir=in | app=g:\games\apache air assault\yuplay\yuplay.exe |
"{6B8C9921-1C8E-48D7-93A4-03A1ED1F9704}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{77C25DED-DB71-4A5F-96B7-4BA74911E87A}" = protocol=17 | dir=in | app=e:\program files\steam\steam.exe |
"{780F83E3-BEA2-443D-83F3-B28A1AA44DE3}" = protocol=17 | dir=in | app=e:\program files\steam\steamapps\common\rage\rage.exe |
"{7B7AD479-244B-4E7E-BCC3-72A4959D1965}" = protocol=17 | dir=in | app=g:\games\apache air assault\yuplay\yuplay.exe |
"{7F0825F7-6B2B-4152-9F99-CE463718CC6F}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8A860536-D3A4-4DA7-B875-9620F36F51A7}" = protocol=6 | dir=in | app=g:\games\tom clancy's ghost recon future soldier\future soldier.exe |
"{8C09B967-AB2A-47BA-A4F7-E87537E5A615}" = protocol=17 | dir=in | app=c:\users\artillery\appdata\roaming\dropbox\bin\dropbox.exe |
"{8C884BA0-4DE6-441E-87AB-C89E8BA8E8B7}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{8CD83370-A67D-4FDE-B595-DEA8FD076B5C}" = protocol=6 | dir=in | app=e:\program files\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe |
"{8F698E1D-D9CD-4D08-80A3-EFB6F3D90E3E}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{8FD21020-7AAA-412F-B540-7FF64EBCA879}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\ubisoft game launcher\ubisoftgamelauncher.exe |
"{94B729B7-E14B-4CDF-A6BC-251F043D695F}" = protocol=6 | dir=in | app=e:\program files\steam\steam.exe |
"{9B203195-8EDD-4BE8-A52A-504A03DBC612}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{A08BFB03-44F3-4E1B-83A8-90A7887696BE}" = protocol=6 | dir=out | app=system |
"{A1CB1EEF-6749-4692-A2B5-56A6919CF69A}" = protocol=6 | dir=in | app=g:\origin\games\battlefield 3\bf3.exe |
"{A488AD35-1F27-466B-AC75-AA9F9B833AEB}" = protocol=17 | dir=in | app=e:\program files\steam\steamapps\common\call of duty modern warfare 3\iw5mp_server.exe |
"{A6B093F6-9701-41B9-9989-E8FBB4EDDD76}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{A8D338CF-1A24-40FB-9B9B-EB0B08998F03}" = protocol=17 | dir=in | app=g:\games\mp3\playmaxpayne3.exe |
"{AEB2047B-CDB5-4110-B108-B384F6CC7160}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{B138E7B1-598D-450F-A2CE-A54A9A805DCA}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{B57D4915-65EA-43FA-8F91-61B9B077DFAC}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{B5DDC3B3-2CD5-456C-831F-97869EF71C78}" = protocol=6 | dir=in | app=e:\program files\steam\steamapps\common\jabiademo\jaggedalliancebiademo.exe |
"{B839310F-1F0D-4A3A-9BFC-8B7CB65F370B}" = protocol=17 | dir=in | app=c:\users\artillery\appdata\local\akamai\netsession_win.exe |
"{B9CDB6FE-C079-42A0-9E90-19C7114E55F5}" = protocol=6 | dir=in | app=c:\users\artillery\appdata\local\akamai\netsession_win.exe |
"{C25648D3-EF34-4538-B117-4967B930D12C}" = protocol=17 | dir=in | app=c:\program files (x86) (x86)\lexmark 4800 series\lxdeamon.exe |
"{C360FE2A-7A73-4311-BF96-6B98AF8032E5}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{C8B6EB28-2612-4833-8103-A109FDF88F54}" = dir=in | app=c:\program files (x86)\samsung\allshare\allshare.exe |
"{C9F67FBA-73B6-4BFC-92E6-83B012B9DD09}" = protocol=6 | dir=in | app=c:\program files (x86) (x86)\lexmark 4800 series\frun.exe |
"{CB20A3F8-78E2-41FF-9548-4D15A8E0CF2A}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{CC2E6A8F-CF52-45EC-88CC-A5E24CAA1552}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\ids.application.exe |
"{CD6E7802-3250-4C47-95CF-82DD54BEA388}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{D49297E7-8706-449D-9E5D-FD86B340D020}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{D62F4E88-FC79-42B8-A2F1-6949EF23166F}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\ids.application.exe |
"{D9E6F1B7-95E4-4190-9C77-52AABE282F45}" = protocol=17 | dir=in | app=g:\games\apache air assault\launcher.exe |
"{DB9B45C3-26F8-44A9-B22A-C73C14FA5096}" = protocol=6 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\ordersupplies.exe |
"{DB9D229A-E2BE-4112-95B6-539A7D99EF13}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{E20BC43A-C2DC-47B7-98EA-BD1E72D50C75}" = protocol=17 | dir=in | app=c:\program files (x86) (x86)\lexmark 4800 series\frun.exe |
"{E481E2F3-0C04-488D-A1B6-EC269FF8E42A}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{EA2D1112-6217-40D2-8266-E96F1F327007}" = protocol=6 | dir=in | app=c:\program files\common files\common desktop agent\cdasrv.exe |
"{EBAE3757-A2D5-4E46-8400-6928D18001A4}" = protocol=17 | dir=in | app=e:\program files\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{ED7E3A02-69B1-4330-9972-E836026A25F8}" = protocol=17 | dir=in | app=e:\program files\steam\steamapps\common\jabiademo\jaggedalliancebiademo.exe |
"{F0CEF323-1E33-4407-928A-AC2FA0F8CE90}" = protocol=17 | dir=in | app=c:\program files (x86)\samsung\easy printer manager\ordersupplies.exe |
"{F686DF70-CC5D-4105-8CDC-492A1F76FA2D}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{F76BFA59-832D-438C-94A5-C3E05F41C7FD}" = protocol=6 | dir=in | app=e:\program files\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe |
"{F9B7A2F8-0B3A-4023-957E-DF1704A55852}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe |
"{F9EB6BCB-7CA7-4FE6-A7DC-0FF81513C821}" = protocol=6 | dir=in | app=g:\diablo iii\diablo iii.exe |
"TCP Query User{02A314C2-13C2-421E-A4F1-0D799ABD61BF}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"TCP Query User{140E238D-C911-4783-B109-2001D0AB34A9}C:\udk\renegade x black dawn\binaries\win32\udk.exe" = protocol=6 | dir=in | app=c:\udk\renegade x black dawn\binaries\win32\udk.exe |
"TCP Query User{198C1E27-A5AC-44B1-83EE-4AF6928EAFF4}C:\users\artillery\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\artillery\appdata\local\akamai\netsession_win.exe |
"TCP Query User{1AC78596-AEBE-4CFA-ABE7-2354660BE1C4}C:\program files (x86)\livezilla\livezilla server admin.exe" = protocol=6 | dir=in | app=c:\program files (x86)\livezilla\livezilla server admin.exe |
"TCP Query User{2888E4B5-F8FA-4A72-A863-C2C4A9981203}G:\games\wcsaga\wcsaga_sse2.exe" = protocol=6 | dir=in | app=g:\games\wcsaga\wcsaga_sse2.exe |
"TCP Query User{46CE20C6-EF3B-4657-B18B-6213F0567D4F}C:\program files (x86)\email-business\emailspider\emailspider.exe" = protocol=6 | dir=in | app=c:\program files (x86)\email-business\emailspider\emailspider.exe |
"TCP Query User{4FE28143-7850-4BA9-8FBB-8A90FDB34E85}G:\games\mp3\maxpayne3.exe" = protocol=6 | dir=in | app=g:\games\mp3\maxpayne3.exe |
"TCP Query User{56927541-8B8F-41C3-8737-9077C2F75D4D}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=6 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe |
"TCP Query User{572F9107-6888-47BE-AE3D-7516DB5443D2}C:\users\artillery\downloads\diablo-iii-setup-engb.exe" = protocol=6 | dir=in | app=c:\users\artillery\downloads\diablo-iii-setup-engb.exe |
"TCP Query User{62DF69B0-CC33-472D-B241-49BC8E77B316}G:\games\tom clancy's ghost recon future soldier\future soldier.exe" = protocol=6 | dir=in | app=g:\games\tom clancy's ghost recon future soldier\future soldier.exe |
"TCP Query User{65C3F7A0-6872-4F2D-8C43-B508D433C355}C:\users\artillery\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=6 | dir=in | app=c:\users\artillery\appdata\roaming\dropbox\bin\dropbox.exe |
"TCP Query User{70470312-60DE-462D-B99D-01C07F750A75}G:\games\saints row the third\saintsrowthethird_dx11.exe" = protocol=6 | dir=in | app=g:\games\saints row the third\saintsrowthethird_dx11.exe |
"TCP Query User{740A7EC6-549A-49A8-948F-8ABCE136A0B8}G:\games\mp3\maxpayne3.exe" = protocol=6 | dir=in | app=g:\games\mp3\maxpayne3.exe |
"TCP Query User{91105491-2C3A-417E-AF79-5E74442BD3E4}G:\games\sol exodus\binaries\win32\solexodus.exe" = protocol=6 | dir=in | app=g:\games\sol exodus\binaries\win32\solexodus.exe |
"TCP Query User{9876F0E7-AC29-438C-B86B-274906986157}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{AED49DC7-2517-4A70-8738-F05D7935BC71}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"TCP Query User{BC07BA06-D9C5-40A7-92D7-F647F86B59D0}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"TCP Query User{C7C1E7FC-BA0A-46F9-879C-CADC28F2AAE1}G:\origin\games\battlefield 3\bf3.exe" = protocol=6 | dir=in | app=g:\origin\games\battlefield 3\bf3.exe |
"TCP Query User{D28EF9D0-4D68-4884-A31D-9D84303E17EA}G:\orcs must die!\build\release\orcsmustdie.exe" = protocol=6 | dir=in | app=g:\orcs must die!\build\release\orcsmustdie.exe |
"TCP Query User{D7D3E046-4F66-4EB3-BCCE-5626BD85A2A2}G:\games\mass effect 2 deluxe edition\binaries\masseffect2.exe" = protocol=6 | dir=in | app=g:\games\mass effect 2 deluxe edition\binaries\masseffect2.exe |
"UDP Query User{12138691-EDA9-4668-A0A0-406F40773337}G:\games\mp3\maxpayne3.exe" = protocol=17 | dir=in | app=g:\games\mp3\maxpayne3.exe |
"UDP Query User{2368DF61-F5B0-4672-B3E4-CC45FF5D62F1}G:\origin\games\battlefield 3\bf3.exe" = protocol=17 | dir=in | app=g:\origin\games\battlefield 3\bf3.exe |
"UDP Query User{25E5B5F4-8433-485E-912A-CAE07B959DD0}C:\program files (x86)\livezilla\livezilla server admin.exe" = protocol=17 | dir=in | app=c:\program files (x86)\livezilla\livezilla server admin.exe |
"UDP Query User{2C81D7F4-FF61-4C9F-B900-D217DF8751E7}G:\games\mass effect 2 deluxe edition\binaries\masseffect2.exe" = protocol=17 | dir=in | app=g:\games\mass effect 2 deluxe edition\binaries\masseffect2.exe |
"UDP Query User{2E0BC9A1-523D-479A-995F-6AD137B2D360}G:\games\mp3\maxpayne3.exe" = protocol=17 | dir=in | app=g:\games\mp3\maxpayne3.exe |
"UDP Query User{512C6DF2-06A8-418D-BFDA-CC888508E721}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"UDP Query User{5664C683-AC2D-4522-8BD5-91C5F9F7EFFB}C:\users\artillery\downloads\diablo-iii-setup-engb.exe" = protocol=17 | dir=in | app=c:\users\artillery\downloads\diablo-iii-setup-engb.exe |
"UDP Query User{5A41A398-E185-4785-8E4F-E2497A2235A4}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{61845478-7F36-4ACB-9A5C-029EEA98620A}C:\programdata\battle.net\agent\agent.976\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"UDP Query User{6C40F354-8B7B-467D-8BAE-EE2E286387BB}C:\programdata\electronic arts\need for speed world\data\nfsw.exe" = protocol=17 | dir=in | app=c:\programdata\electronic arts\need for speed world\data\nfsw.exe |
"UDP Query User{72BC5003-D5B1-4C39-9201-2DE95DDE9F07}G:\games\saints row the third\saintsrowthethird_dx11.exe" = protocol=17 | dir=in | app=g:\games\saints row the third\saintsrowthethird_dx11.exe |
"UDP Query User{79D769E6-1FD2-424F-B2E7-1012B0034B34}G:\games\wcsaga\wcsaga_sse2.exe" = protocol=17 | dir=in | app=g:\games\wcsaga\wcsaga_sse2.exe |
"UDP Query User{7BB6CC8E-A3EB-43A4-BF8E-6A91855350B4}C:\users\artillery\appdata\roaming\dropbox\bin\dropbox.exe" = protocol=17 | dir=in | app=c:\users\artillery\appdata\roaming\dropbox\bin\dropbox.exe |
"UDP Query User{7BED43A5-AF3E-4B3A-B46A-2CBBC26B57A7}G:\orcs must die!\build\release\orcsmustdie.exe" = protocol=17 | dir=in | app=g:\orcs must die!\build\release\orcsmustdie.exe |
"UDP Query User{A739EA34-1F98-4A92-9EA4-4244D917758D}C:\udk\renegade x black dawn\binaries\win32\udk.exe" = protocol=17 | dir=in | app=c:\udk\renegade x black dawn\binaries\win32\udk.exe |
"UDP Query User{AED066F2-A405-4CA5-81F0-A91AB66E7DFD}G:\games\tom clancy's ghost recon future soldier\future soldier.exe" = protocol=17 | dir=in | app=g:\games\tom clancy's ghost recon future soldier\future soldier.exe |
"UDP Query User{B7E15F9B-C17E-4C59-BF45-0D84DC34AEC0}C:\users\artillery\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\artillery\appdata\local\akamai\netsession_win.exe |
"UDP Query User{D59BBB92-1F12-49ED-8219-2413FABB833E}C:\program files (x86)\java\jre6\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre6\bin\javaw.exe |
"UDP Query User{D777EFD2-E105-43D3-B0D3-2C80DDB6EDE6}G:\games\sol exodus\binaries\win32\solexodus.exe" = protocol=17 | dir=in | app=g:\games\sol exodus\binaries\win32\solexodus.exe |
"UDP Query User{F73AD3BD-5CBA-4D70-946F-83A1161A3DD2}C:\program files (x86)\email-business\emailspider\emailspider.exe" = protocol=17 | dir=in | app=c:\program files (x86)\email-business\emailspider\emailspider.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{027E5FAB-1476-4C59-AAB4-32EF28520399}" = Windows Live Language Selector
"{031A0E14-0413-4C97-9772-2639B782F46F}" = Common Desktop Agent
"{1374CC63-B520-4f3f-98E8-E9020BF01CFF}" = Windows XP Mode
"{1ACC8FFB-9D84-4C05-A4DE-D28A9BC91698}" = Windows Live ID Sign-in Assistant
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{26A24AE4-039D-4CA4-87B4-2F86416031FF}" = Java(TM) 6 Update 31 (64-bit)
"{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{73089240-023C-11E0-9AE3-2BA1DFD72085}" = M-Audio FastTrackPro Driver 6.0.7 (x64)
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Driver 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Control Panel 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Graphics Driver 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller Driver 296.10
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX System Software 9.12.0213
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.7.11
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD Audio Driver 1.3.12.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{D06E205A-1BF7-48D5-BD7F-E072D0FD6A67}" = NDAS Software 3.72.2080
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{F6FD24B4-34A3-4635-8ECD-7B5C791EAE5F}" = Wing Commander Saga 1.0.2.7795
"HWiNFO64_is1" = HWiNFO64 Version 3.88
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Nightly 10.0a1 (x64 en-US)" = Nightly 10.0a1 (x64 en-US)
"Recuva" = Recuva
"Sandboxie" = Sandboxie 3.60 (64-bit)
"UDK-f391ce3c-f263-4060-a718-519f5481ff74" = Renegade X Black Dawn
"WinRAR archiver" = WinRAR 4.01 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{013C24A4-F144-4D49-AD8D-71452D635621}" = PhoenixUSBPro
"{0215A652-E081-4B09-9333-DC85AAB67FFA}" = Adobe Dreamweaver CS5.5
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0F32914F-A633-4516-B531-7084C8F19F93}" = Haufe iDesk-Browser
"{19BA08F7-C728-469C-8A35-BFBD3633BE08}" = Windows Live Movie Maker
"{1AA94747-3BF6-4237-9E1A-7B3067738FE1}" = Max Payne 3
"{1D081AB0-B1CC-11E0-80C0-005056B12123}" = Haufe iDesk-Service
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{20B1B020-DEAE-48D1-9960-D4C3185D758B}" = Phase 5 HTML-Editor
"{21AE04E8-EBF6-40DB-9AA9-B7A80C5D057D}" = mkv2vob
"{26A24AE4-039D-4CA4-87B4-2F83216032FF}" = Java(TM) 6 Update 32
"{2EA870FA-585F-4187-903D-CB9FFD21E2E0}" = DHTML Editing Component
"{2EEEC858-21F8-419B-8FE2-820621BFFCD7}" = GetDataBack for FAT
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2
"{3248F0A8-6813-11D6-A77B-00B0D0160040}" = Java(TM) 6 Update 4
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{34F4D9A4-42C2-4348-BEF4-E553C84549E7}" = Windows Live Photo Gallery
"{3521BDBD-D453-5D9F-AA55-44B75D214629}" = Adobe Community Help
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{39AF5C9F-9673-438F-BBF9-47690B989F7F}" = QuickSteuer 2012
"{46EDCFA5-7EDB-46A9-B093-1C6237470CEC}" = 3DMark 11
"{47FA2C44-D148-4DBC-AF60-B91934AA4842}" = Adobe AIR
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4A49BF17-D3D0-49F1-B17E-ACAE15F94CE2}}_is1" = New Star Soccer 5 v1.07
"{4C552FD3-2CCD-4E00-AC64-0681DBB3F8B5}" = OpenOffice.org 3.4
"{50316C0A-CC2A-460A-9EA5-F486E54AC17D}_is1" = AVG PC Tuneup 2011
"{56582EEA-3AEF-4D84-8B9D-C87A3CD9250F}" = GetDataBack for NTFS
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{579684A4-DDD5-4CA3-9EA8-7BE7D9593DB4}" = Windows Live UX Platform Language Pack
"{5C83944D-5319-4AD6-A803-C08446B27596}" = BlueStacks
"{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6C11089A-E23F-4E9B-B12C-316BF1A4376B}" = Pdfedit
"{6D87CAD9-9B94-4421-A439-B25F8DE14575}" = Tom Clancy's Ghost Recon Future Soldier
"{6F11C5C2-3102-4937-92F2-E920791FE2FD}" = d trader extended
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{80F87DA8-24AD-4A3E-BF06-BD9496B8F797}" = DruckShop Etiketten
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{8496B9A5-F260-4DF0-BCB3-4BA59FDC10BB}" = MOUSE Editor
"{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver
"{888F1505-C2B3-4FDE-835D-36353EBD4754}" = Ubisoft Game Launcher
"{8927E07C-97F7-4A54-88FB-D976F50DD46E}" = Turbo Lister 2
"{8B5C3072-487F-4D07-92B8-9C60082E3D6A}_is1" = Personal SmartCheck
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{969E11AA-8F3A-F162-1A5A-0965E216B6CE}" = Adobe Download Assistant
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9FB9BA8A-E711-40E6-BBF0-77ED60A2940F}" = Facebook Messenger 2.1.4587.0
"{A0E7A72E-FEFF-47BA-B893-1697CCAE5FE2}" = calibre
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B7B8D9A9-EFCB-4c2f-8117-7A2A32D0BC58}" = Shank 2
"{BDE646E8-86E0-50E1-37BC-0AEBB2185D76}" = Adobe Widget Browser
"{BEE64C14-BEF1-4610-8A68-A16EAA47B882}" = Futuremark SystemInfo
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C40C3C3D-97CF-44B5-836C-766E374464B3}" = 3DMark Vantage
"{C4C91E02-D4E2-481E-BCBA-7D90CC8D43E1}" = LiveZilla
"{C61B2B59-75D2-4203-B589-E0102C3A6F32}" = QuickSteuer Wissens-Center 2012
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D436F577-1695-4D2F-8B44-AC76C99E0002}" = Windows Live Photo Common
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D7BF3B76-EEF9-4868-9B2B-42ABF60B279A}" = Microsoft_VC80_CRT_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{DA909E62-3B45-4BA1-8B58-FCAEBA4BCEC9}" = NVIDIA PhysX
"{DBCC73BA-C69A-4BF5-B4BF-F07501EE7039}" = AnswerWorks 5.0 English Runtime
"{DF47ACA3-7C78-4C08-8007-AC682563C9F1}" = Samsung AllShare
"{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E259DE5F-4980-4882-85D0-312F82721ED5}" = Quicken 2011
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{E622ECC4-4310-4D7B-B401-159E0C22516A}" = YAMAHA VST Plugin Final Master Trial
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.9
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F3C2ECAA-1B4D-4B75-9105-106B0D03EF02}" = Lexware Info Service
"{F6995FC4-2D91-4169-B3C4-7C51B7123902}" = Lexware online banking
"{F7311566-7EA9-4213-A7F8-E0C237EFAD16}" = UFO Extraterrestrials Gold
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FE044230-9CA5-43F7-9B58-5AC5A28A1F33}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"abgx360" = abgx360 v1.0.6
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Afterburner" = MSI Afterburner 2.2.1
"Akamai" = Akamai NetSession Interface Service
"ASIO4ALL" = ASIO4ALL
"Avira AntiVir Desktop" = Avira Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"Battlelog Web Plugins" = Battlelog Web Plugins
"BayCalculator_is1" = BayCalculator - Deinstallation
"Biet-O-Matic v2.14.8" = Biet-O-Matic v2.14.8
"BinTube Accelerator" = BinTube Accelerator
"BinTube Usenet Reader" = BinTube Usenet Reader 3.7.5.0
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Cities XL 2012" = Cities XL 2012
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"com.adobe.WidgetBrowser.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Widget Browser
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo III" = Diablo III
"EASEUS Partition Master Home Edition_is1" = EASEUS Partition Master 9.1.0 Home Edition
"EasyBCD" = EasyBCD 2.1
"EmailSpider Gold_is1" = EmailSpider Gold 11
"ESN Sonar-0.70.4" = ESN Sonar
"FileZilla Client" = FileZilla Client 3.2.7.1
"FL Studio 10" = FL Studio 10
"Foxit Reader_is1" = Foxit Reader 5.0
"Fraps" = Fraps
"Free YouTube Download_is1" = Free YouTube Download version 3.0.18.1123
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.17.221
"IL Download Manager" = IL Download Manager
"ImgBurn" = ImgBurn
"InstallShield_{8496B9A5-F260-4DF0-BCB3-4BA59FDC10BB}" = Mouse Editor
"InstallShield_{DF47ACA3-7C78-4C08-8007-AC682563C9F1}" = Samsung AllShare
"InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}" = Etron USB3.0 Host Controller
"InstallShield_{E259DE5F-4980-4882-85D0-312F82721ED5}" = Quicken Deluxe 2011
"iZotope Ozone 4_is1" = iZotope Ozone 4
"KLiteCodecPack_is1" = K-Lite Mega Codec Pack 8.9.2
"KProbe" = KProbe 2.5.2
"Lexmark 4800 Series" = Lexmark 4800 Series
"Live 8.2" = Live 8.2
"LiveZilla" = LiveZilla
"LogoMaker_is1" = LogoMaker 3.0
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.62.0.1300
"MetaTrader - AAAFx" = MetaTrader - AAAFx
"MetaTrader - Forex Place" = MetaTrader - Forex Place
"Mozilla Firefox 14.0.1 (x86 de)" = Mozilla Firefox 14.0.1 (x86 de)
"Mozilla Thunderbird 15.0 (x86 en-US)" = Mozilla Thunderbird 15.0 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Optimizer Pro_is1" = Optimizer Pro v3.0
"Origin" = Origin
"PokerStars" = PokerStars
"PokerStars.net" = PokerStars.net
"PS3 Media Server" = PS3 Media Server
"PunkBusterSvc" = PunkBuster Services
"QuicktimeAlt_is1" = QuickTime Alternative 3.2.2
"reFX Nexus_is1" = reFX Nexus VSTi RTAS v2.2.0
"reFX Vanguard_is1" = reFX Vanguard VSTi RTAS v1.8.0
"Rockstar Games Social Club" = Rockstar Games Social Club
"Samsung Easy Printer Manager" = Samsung Easy Printer Manager
"Samsung Printer Live Update" = Samsung Printer Live Update
"SitNGoWizard" = SitNGo Wizard
"Steam App 204920" = Jagged Alliance - Back in Action Demo
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42750" = Call of Duty: Modern Warfare 3 - Dedicated Server
"Steam App 9200" = RAGE
"Sweet Home 3D_is1" = Sweet Home 3D version 3.5
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"uTorrent" = µTorrent
"VLC media player" = VLC media player 1.1.11
"WaveLabPro" = WaveLab 6
"Waves L3 16" = Waves L3 16
"Waves Mercury Bundle" = Waves Mercury Bundle
"Winamp" = Winamp
"WinLiveSuite" = Windows Live Essentials
"Winload Toolbar" = Winload Toolbar
"Wireshark" = Wireshark 1.8.0 (64-bit)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
"RockMelt" = RockMelt
"UnityWebPlayer" = Unity Web Player
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 24.07.2012 12:08:04 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Faulting application name: FlashPlayerPlugin_11_3_300_265.exe, version:
11.3.300.265, time stamp: 0x4febd5ac Faulting module name: NPSWF32_11_3_300_265.dll,
version: 11.3.300.265, time stamp: 0x4febd798 Exception code: 0xc0000005 Fault offset:
0x000d6da0 Faulting process id: 0x16b4 Faulting application start time: 0x01cd6986387beefc
Faulting
application path: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
Faulting
module path: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll Report
Id: bf87d422-d5a9-11e1-9777-002522d2f5b9
Error - 25.07.2012 04:35:28 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Faulting application name: FlashPlayerPlugin_11_3_300_265.exe, version:
11.3.300.265, time stamp: 0x4febd5ac Faulting module name: NPSWF32_11_3_300_265.dll,
version: 11.3.300.265, time stamp: 0x4febd798 Exception code: 0xc0000005 Fault offset:
0x001d1e2f Faulting process id: 0x1ae0 Faulting application start time: 0x01cd69b68d0757e9
Faulting
application path: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
Faulting
module path: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_3_300_265.dll Report
Id: af885939-d633-11e1-9777-002522d2f5b9
Error - 25.07.2012 04:35:30 | Computer Name = PC | Source = Application Error | ID = 1000
Description = Faulting application name: FlashPlayerPlugin_11_3_300_265.exe, version:
11.3.300.265, time stamp: 0x4febd5ac Faulting module name: FlashPlayerPlugin_11_3_300_265.exe,
version: 11.3.300.265, time stamp: 0x4febd5ac Exception code: 0xc0000005 Fault offset:
0x0003ebea Faulting process id: 0x1d54 Faulting application start time: 0x01cd69b68cedb509
Faulting
application path: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
Faulting
module path: C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_3_300_265.exe
Report
Id: b07c0b9a-d633-11e1-9777-002522d2f5b9
Error - 25.07.2012 08:38:07 | Computer Name = PC | Source = WinMgmt | ID = 10
Description =
Error - 28.07.2012 17:32:04 | Computer Name = PC | Source = WinMgmt | ID = 10
Description =
Error - 28.07.2012 18:00:06 | Computer Name = PC | Source = WinMgmt | ID = 10
Description =
Error - 28.07.2012 18:23:28 | Computer Name = PC | Source = WinMgmt | ID = 10
Description =
Error - 29.07.2012 05:13:15 | Computer Name = PC | Source = WinMgmt | ID = 10
Description =
Error - 29.07.2012 05:23:03 | Computer Name = PC | Source = WinMgmt | ID = 10
Description =
Error - 29.07.2012 05:26:37 | Computer Name = PC | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 01.07.2012 12:01:30 | Computer Name = PC | Source = Service Control Manager | ID = 7001
Description = The Peernetzwerk-Gruppenzuordnung service depends on the Peer Name
Resolution-Protokoll service which failed to start because of the following error:
%%-2140993535
Error - 01.07.2012 12:01:30 | Computer Name = PC | Source = Service Control Manager | ID = 7023
Description = The Peer Name Resolution-Protokoll service terminated with the following
error: %%-2140993535
Error - 01.07.2012 12:02:42 | Computer Name = PC | Source = Service Control Manager | ID = 7038
Description = The nvUpdatusService service was unable to log on as .\UpdatusUser
with the currently configured password due to the following error: %%1330 To ensure
that the service is configured properly, use the Services snap-in in Microsoft
Management Console (MMC).
Error - 01.07.2012 12:02:42 | Computer Name = PC | Source = Service Control Manager | ID = 7000
Description = The NVIDIA Update Service Daemon service failed to start due to the
following error: %%1069
Error - 02.07.2012 02:59:28 | Computer Name = PC | Source = PNRPSvc | ID = 102
Description =
Error - 02.07.2012 02:59:28 | Computer Name = PC | Source = PNRPSvc | ID = 102
Description =
Error - 02.07.2012 02:59:28 | Computer Name = PC | Source = Service Control Manager | ID = 7001
Description = The Peernetzwerk-Gruppenzuordnung service depends on the Peer Name
Resolution-Protokoll service which failed to start because of the following error:
%%-2140993535
Error - 02.07.2012 02:59:28 | Computer Name = PC | Source = Service Control Manager | ID = 7023
Description = The Peer Name Resolution-Protokoll service terminated with the following
error: %%-2140993535
Error - 02.07.2012 02:59:28 | Computer Name = PC | Source = Service Control Manager | ID = 7001
Description = The Peernetzwerk-Gruppenzuordnung service depends on the Peer Name
Resolution-Protokoll service which failed to start because of the following error:
%%-2140993535
Error - 02.07.2012 02:59:28 | Computer Name = PC | Source = Service Control Manager | ID = 7023
Description = The Peer Name Resolution-Protokoll service terminated with the following
error: %%-2140993535
< End of report >
|
|
30.07.2012, 13:48
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Ukash Virus - Malwarebytes erfolgreich - wirklich sicher? Auch du postest keine vernünftige Beschreibung!
__________________ Einfach nur die Logs hinknallen und "Uksah Virus" ist nicht gerade das, was man unter einer vernünftigen Information versteht! Zudem hast du kein Malwarebytes-Log gepostet! Ohne die Logs von Malwarebytes und Co wird das hier nichts.  Alles von Malwarebytes (und evtl. anderen Scannern) muss hier gepostet werden. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
__________________ |
|
| Themen zu Ukash Virus - Malwarebytes erfolgreich - wirklich sicher? |
| akamai, antivir, application/pdf:, askbar, avg pc tuneup, avira, battle.net, bho, black, bluestacks, call of duty, conduit, converter, desktop, error, failed, firefox, flash player, helper, home, install.exe, langs, launch, logfile, mozilla, mp3, nexus, nvidia update, origin, plug-in, realtek, recuva, registry, scan, searchscopes, security, snap-in, software, svchost.exe, updates, virus, windows, windows xp, winload toolbar |
Linear-Darstellung
