| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Malwarebytes berichtWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
13.12.2012, 18:45
| #1 |
| |  Malwarebytes bericht Hi community, ich wollte letztens einen film angucken und dann stand da: video not found, hab bei google geguckt und da stand, dass ich einen virus hab und dass ich Malwarebytes installieren soll und die viren löschen soll und dann den bericht hierreinkopieren soll, ich weiß zwar nicht warum, aber ich mach es einfach mal: Malwarebytes Anti-Malware 1.65.1.1000 www.malwarebytes.org Datenbank Version: v2012.12.13.09 Windows 7 x86 NTFS Internet Explorer 9.0.8112.16421 Juli :: JULI-PC [Administrator] 13.12.2012 18:13:05 mbam-log-2012-12-13 (18-13-05).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 202836 Laufzeit: 5 Minute(n), 2 Sekunde(n) Infizierte Speicherprozesse: 1 C:\ProgramData\IBUpdaterService\ibsvc.exe (PUP.InstallBrain) -> 496 -> Löschen bei Neustart. Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 2 HKLM\SYSTEM\CurrentControlSet\Services\IBUpdaterService (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt. HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Updater Service (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt. Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 1 C:\ProgramData\IBUpdaterService (PUP.InstallBrain) -> Löschen bei Neustart. Infizierte Dateien: 3 C:\Users\Juli\Downloads\ADLSoft_UnCompressor.exe (PUP.Adware.InstallCore) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\ProgramData\IBUpdaterService\ibsvc.exe (PUP.InstallBrain) -> Löschen bei Neustart. C:\ProgramData\IBUpdaterService\repository.xml (PUP.InstallBrain) -> Erfolgreich gelöscht und in Quarantäne gestellt. (Ende) |
|
13.12.2012, 19:53
| #2 |
| /// Malware-holic   | Malwarebytes bericht Hi
__________________wer illegale Angebote wie Kinox.to nutzt, muss sich über Malware nicht wundern, vor allem, wenn er nicht mal windows updatet. So was kann leicht mal teuer werden. Entweder, wenn man beim Onlinebanking beklaut wird, mit seinen Daten missbrauch betrieben wird, oder, wenn man einfach nur beim schauen illegaler Streams / Filme erwischt wird, das kann gut und gern einige tausend € kosten. Aufpassen sollte man auch bei angeboten mit pornografischem Inhalt. Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
C:\Windows\system32\*.tsp
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
13.12.2012, 20:38
| #3 |
| | Malwarebytes bericht OTL.txt:OTL Logfile:
__________________Code:
ATTFilter OTL logfile created on: 13.12.2012 20:21:06 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Juli\Desktop Professional (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,14 Gb Available Physical Memory | 57,10% Memory free 4,00 Gb Paging File | 2,92 Gb Available in Paging File | 73,01% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 148,95 Gb Total Space | 68,39 Gb Free Space | 45,92% Space Free | Partition Type: NTFS Computer Name: JULI-PC | User Name: Juli | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.12.13 20:11:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Juli\Desktop\OTL.exe PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe PRC - [2012.09.29 19:54:26 | 000,766,536 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe PRC - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe PRC - [2012.09.02 12:21:22 | 001,890,744 | ---- | M] (Bandoo Media, inc) -- C:\Programme\Searchqu Toolbar\Datamngr\datamngrUI.exe PRC - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.04.13 14:02:34 | 001,808,784 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft IntelliPoint\ipoint.exe PRC - [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft\BingBar\SeaPort.EXE PRC - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () -- C:\Programme\ICQ6Toolbar\ICQ Service.exe PRC - [2010.10.06 21:28:12 | 003,768,176 | ---- | M] (Stardock) -- C:\Programme\Stardock\ObjectDockFree\ObjectDock.exe PRC - [2010.09.21 13:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE PRC - [2010.09.21 13:03:14 | 000,193,408 | ---- | M] (Microsoft Corp.) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE PRC - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeCam\MSCamS32.exe PRC - [2010.03.04 22:38:00 | 000,071,096 | ---- | M] () -- C:\Programme\CDBurnerXP\NMSAccessU.exe PRC - [2010.01.15 13:49:20 | 000,255,536 | ---- | M] (McAfee, Inc.) -- C:\Programme\McAfee Security Scan\2.0.181\SSScheduler.exe PRC - [2009.11.05 21:45:55 | 001,505,144 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft IntelliType Pro\itype.exe PRC - [2009.11.05 21:45:55 | 000,444,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft IntelliType Pro\dpupdchk.exe PRC - [2009.10.20 03:18:00 | 000,360,448 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2009.10.20 03:17:30 | 000,172,032 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2009.09.28 11:48:08 | 000,264,040 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft LifeChat\LifeChat.exe PRC - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) -- C:\Programme\Windows Media Player\wmpnetwk.exe PRC - [2009.07.14 02:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2009.04.15 22:52:06 | 000,091,432 | ---- | M] (CyberLink Corp.) -- C:\Programme\CyberLink\PowerDVD8\PDVD8Serv.exe PRC - [2009.02.26 14:24:50 | 000,097,680 | ---- | M] (Microsoft Corporation) -- C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE PRC - [2006.06.23 11:24:12 | 000,343,552 | ---- | M] (AVM Berlin GmbH) -- C:\Programme\avmwlanstick\FRITZWLanMini.exe ========== Modules (No Company Name) ========== MOD - [2012.02.16 22:13:28 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\2df79ab909c782d3796e4107d040327d\System.Web.ni.dll MOD - [2012.02.16 22:13:23 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0a894f77b9aa64acbd3ce791916357d8\System.Runtime.Remoting.ni.dll MOD - [2012.02.16 22:13:09 | 012,431,360 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\ff30db6905f8ec024fc808ed8779c0f3\System.Windows.Forms.ni.dll MOD - [2012.02.16 22:13:03 | 001,586,688 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\a09ee392fa90849f2e9313a1ebbe0279\System.Drawing.ni.dll MOD - [2012.02.16 22:13:00 | 005,452,800 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\d49f4cb0755ccc34cd35ff96dc2ef9e3\System.Xml.ni.dll MOD - [2012.02.16 22:12:57 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\15742b3597258ce67cbe219005c197e5\System.Configuration.ni.dll MOD - [2012.02.16 22:12:54 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\1f14b3e1ee0847f8662f513e67f92547\System.ni.dll MOD - [2011.10.13 14:39:20 | 011,490,304 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\1b31ced9bb880d94fff1c6d47c16a81e\mscorlib.ni.dll MOD - [2011.07.18 22:04:08 | 000,296,448 | ---- | M] () -- C:\Programme\Notepad++\NppShell_04.dll MOD - [2011.05.28 21:04:56 | 000,140,288 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll MOD - [2010.10.04 18:54:31 | 000,053,760 | ---- | M] () -- C:\Programme\Stardock\ObjectDockFree\zlib.dll MOD - [2010.10.04 18:54:29 | 000,807,936 | ---- | M] () -- C:\Programme\Stardock\ObjectDockFree\CrashRpt.dll MOD - [2010.10.04 18:54:29 | 000,675,840 | ---- | M] () -- C:\Programme\Stardock\ObjectDockFree\DockShellHook.dll MOD - [2010.10.04 18:54:22 | 000,094,208 | ---- | M] () -- C:\Programme\Stardock\ObjectDockFree\Docklets\Clock\Clock.dll MOD - [2010.07.07 16:31:29 | 000,241,664 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiDesk.HydraVision.Dashboard\2.0.3579.36914__90ba9c70f846762e\CLI.Aspect.MultiDesk.HydraVision.Dashboard.dll MOD - [2010.07.07 16:31:29 | 000,212,992 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MDProp.HydraVision.Dashboard\2.0.3579.36913__90ba9c70f846762e\CLI.Aspect.MDProp.HydraVision.Dashboard.dll MOD - [2010.07.07 16:31:29 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiDesk.HydraVision.Runtime\2.0.3579.36914__90ba9c70f846762e\CLI.Aspect.MultiDesk.HydraVision.Runtime.dll MOD - [2010.07.07 16:31:29 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MDProp.HydraVision.Runtime\2.0.3579.36913__90ba9c70f846762e\CLI.Aspect.MDProp.HydraVision.Runtime.dll MOD - [2010.07.07 16:31:29 | 000,012,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeskMan.HydraVision.Shared\2.0.3579.36912__90ba9c70f846762e\CLI.Aspect.DeskMan.HydraVision.Shared.dll MOD - [2010.07.07 16:31:29 | 000,010,240 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MDProp.HydraVision.Shared\2.0.3579.36913__90ba9c70f846762e\CLI.Aspect.MDProp.HydraVision.Shared.dll MOD - [2010.07.07 16:31:29 | 000,009,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MultiDesk.HydraVision.Shared\2.0.3579.36914__90ba9c70f846762e\CLI.Aspect.MultiDesk.HydraVision.Shared.dll MOD - [2010.07.07 16:31:28 | 001,695,744 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Wizard\2.0.3579.36926__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Wizard.dll MOD - [2010.07.07 16:31:28 | 000,823,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Dashboard\2.0.3579.36850__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:28 | 000,643,072 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Dashboard\2.0.3579.36906__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:28 | 000,491,520 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Wizard\2.0.3579.36895__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Wizard.dll MOD - [2010.07.07 16:31:28 | 000,409,600 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Wizard\2.0.3579.36871__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Wizard.dll MOD - [2010.07.07 16:31:28 | 000,368,640 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime\2.0.3579.36805__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,356,352 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Dashboard\2.0.3579.36862__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:28 | 000,311,296 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HydraVision.Wizard\2.0.3579.36915__90ba9c70f846762e\CLI.Aspect.HydraVision.Wizard.dll MOD - [2010.07.07 16:31:28 | 000,204,800 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Wizard\2.0.3579.36824__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Wizard.dll MOD - [2010.07.07 16:31:28 | 000,163,840 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeskMan.HydraVision.Dashboard\2.0.3579.36913__90ba9c70f846762e\CLI.Aspect.DeskMan.HydraVision.Dashboard.dll MOD - [2010.07.07 16:31:28 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Grid.HydraVision.Dashboard\2.0.3579.36908__90ba9c70f846762e\CLI.Aspect.Grid.HydraVision.Dashboard.dll MOD - [2010.07.07 16:31:28 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Wizard\2.0.3579.36863__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Wizard.dll MOD - [2010.07.07 16:31:28 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Runtime\2.0.3579.36906__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,077,824 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Runtime\2.0.3579.36876__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,073,728 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard\2.0.3579.36813__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:28 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Runtime\2.0.3579.36862__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Runtime\2.0.3579.36857__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Welcome.Graphics.Dashboard\2.0.3579.36896__90ba9c70f846762e\CLI.Aspect.Welcome.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:28 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Runtime\2.0.3579.36848__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard\2.0.3579.36819__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.dll MOD - [2010.07.07 16:31:28 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Grid.HydraVision.Runtime\2.0.3579.36909__90ba9c70f846762e\CLI.Aspect.Grid.HydraVision.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeskMan.HydraVision.Runtime\2.0.3579.36912__90ba9c70f846762e\CLI.Aspect.DeskMan.HydraVision.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Runtime\2.0.3579.36814__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,011,776 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Runtime\2.0.3579.36908__90ba9c70f846762e\CLI.Caste.HydraVision.Runtime.dll MOD - [2010.07.07 16:31:28 | 000,010,240 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Grid.HydraVision.Shared\2.0.3579.36908__90ba9c70f846762e\CLI.Aspect.Grid.HydraVision.Shared.dll MOD - [2010.07.07 16:31:28 | 000,008,704 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Shared\2.0.3579.36907__90ba9c70f846762e\CLI.Caste.HydraVision.Shared.dll MOD - [2010.07.07 16:31:28 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Wizard\2.0.3579.36912__90ba9c70f846762e\CLI.Caste.HydraVision.Wizard.dll MOD - [2010.07.07 16:31:28 | 000,007,680 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.HydraVision.Dashboard\2.0.3579.36908__90ba9c70f846762e\CLI.Caste.HydraVision.Dashboard.dll MOD - [2010.07.07 16:31:27 | 001,138,688 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysManager2.Graphics.Dashboard\2.0.3579.36922__90ba9c70f846762e\CLI.Aspect.DisplaysManager2.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:27 | 000,573,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Dashboard\2.0.3579.36825__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:27 | 000,393,216 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Dashboard\2.0.3579.36849__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:27 | 000,368,640 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Dashboard\2.0.3579.36844__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:27 | 000,270,336 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CrossDisplay.Graphics.Dashboard\1.0.0.0__90ba9c70f846762e\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:27 | 000,196,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.InfoCentre.Graphics.Dashboard\2.0.3579.36825__90ba9c70f846762e\CLI.Aspect.InfoCentre.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:27 | 000,147,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Shared\2.0.3574.20469__90ba9c70f846762e\CLI.Caste.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,098,304 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation\2.0.3574.20459__90ba9c70f846762e\CLI.Foundation.dll MOD - [2010.07.07 16:31:27 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Runtime\2.0.3579.36849__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Runtime.dll MOD - [2010.07.07 16:31:27 | 000,094,208 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Dashboard\2.0.3579.36855__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Dashboard.dll MOD - [2010.07.07 16:31:27 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceTV.Graphics.Shared\2.0.3574.20535__90ba9c70f846762e\CLI.Aspect.DeviceTV.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.OverDrive5.Graphics.Shared\2.0.3574.20569__90ba9c70f846762e\CLI.Aspect.OverDrive5.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.MMVideo.Graphics.Shared\2.0.3574.20496__90ba9c70f846762e\CLI.Aspect.MMVideo.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Runtime\2.0.3579.36848__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Runtime.dll MOD - [2010.07.07 16:31:27 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.Radeon3D.Graphics.Shared\2.0.3574.20534__90ba9c70f846762e\CLI.Aspect.Radeon3D.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0601\2.0.2573.17685__90ba9c70f846762e\DEM.Graphics.I0601.dll MOD - [2010.07.07 16:31:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.TransCode.Graphics.Shared\2.0.3574.20557__90ba9c70f846762e\CLI.Aspect.TransCode.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Runtime\2.0.3579.36855__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Runtime.dll MOD - [2010.07.07 16:31:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Runtime\2.0.3579.36829__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Runtime.dll MOD - [2010.07.07 16:31:27 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Runtime\2.0.3579.36849__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Runtime.dll MOD - [2010.07.07 16:31:27 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Runtime\2.0.3579.36856__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Runtime.dll MOD - [2010.07.07 16:31:27 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation\2.0.3574.20454__90ba9c70f846762e\LOG.Foundation.dll MOD - [2010.07.07 16:31:27 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\NEWAEM.Foundation\2.0.3574.20457__90ba9c70f846762e\NEWAEM.Foundation.dll MOD - [2010.07.07 16:31:27 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.XManifest\2.0.3574.20638__90ba9c70f846762e\CLI.Foundation.XManifest.dll MOD - [2010.07.07 16:31:27 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysColour2.Graphics.Shared\2.0.3574.20529__90ba9c70f846762e\CLI.Aspect.DisplaysColour2.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared\2.0.3574.20492__90ba9c70f846762e\CLI.Component.Dashboard.Shared.dll MOD - [2010.07.07 16:31:27 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DisplaysOptions.Graphics.Shared\2.0.3574.20532__90ba9c70f846762e\CLI.Aspect.DisplaysOptions.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0703\2.0.2651.18802__90ba9c70f846762e\DEM.Graphics.I0703.dll MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared\2.0.3574.20491__90ba9c70f846762e\CLI.Component.Wizard.Shared.dll MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared\2.0.3574.20472__90ba9c70f846762e\CLI.Component.Client.Shared.dll MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.HotkeysHandling.Graphics.Shared\2.0.3574.20506__90ba9c70f846762e\CLI.Aspect.HotkeysHandling.Graphics.Shared.dll MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Hotkeys.Shared\2.0.3574.20483__90ba9c70f846762e\AEM.Plugin.Hotkeys.Shared.dll MOD - [2010.07.07 16:31:27 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Actions.CCAA.Shared\2.0.3574.20475__90ba9c70f846762e\AEM.Actions.CCAA.Shared.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Foundation\2.0.3574.20501__90ba9c70f846762e\MOM.Foundation.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics.I0706\2.0.2743.23304__90ba9c70f846762e\DEM.Graphics.I0706.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Graphics\2.0.3574.20524__90ba9c70f846762e\DEM.Graphics.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\DEM.Foundation\2.0.2573.17684__90ba9c70f846762e\DEM.Foundation.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared\2.0.3574.20485__90ba9c70f846762e\CLI.Component.Runtime.Shared.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Wizard.Shared\2.0.3574.20528__90ba9c70f846762e\CLI.Caste.Graphics.Wizard.Shared.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Dashboard.Shared\2.0.3574.20495__90ba9c70f846762e\CLI.Caste.Graphics.Dashboard.Shared.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.WinMessages.Shared\2.0.3574.20511__90ba9c70f846762e\AEM.Plugin.WinMessages.Shared.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.REG.Shared\2.0.3574.20570__90ba9c70f846762e\AEM.Plugin.REG.Shared.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.GD.Shared\2.0.3574.20566__90ba9c70f846762e\AEM.Plugin.GD.Shared.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.EEU.Shared\2.0.3574.20505__90ba9c70f846762e\AEM.Plugin.EEU.Shared.dll MOD - [2010.07.07 16:31:27 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.DPPE.Shared\2.0.3574.20565__90ba9c70f846762e\AEM.Plugin.DPPE.Shared.dll MOD - [2010.07.07 16:31:27 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\atixclib\1.0.0.0__90ba9c70f846762e\atixclib.dll MOD - [2010.07.07 16:31:26 | 001,220,608 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard\2.0.3579.36809__90ba9c70f846762e\CLI.Component.Dashboard.dll MOD - [2010.07.07 16:31:26 | 000,651,264 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Implementation\2.0.3579.36920__90ba9c70f846762e\ResourceManagement.Foundation.Implementation.dll MOD - [2010.07.07 16:31:26 | 000,565,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Systemtray\2.0.3579.36885__90ba9c70f846762e\CLI.Component.Systemtray.dll MOD - [2010.07.07 16:31:26 | 000,405,504 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard\2.0.3579.36819__90ba9c70f846762e\CLI.Component.Wizard.dll MOD - [2010.07.07 16:31:26 | 000,106,496 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\MOM.Implementation\2.0.3579.36890__90ba9c70f846762e\MOM.Implementation.dll MOD - [2010.07.07 16:31:26 | 000,065,536 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation\2.0.3579.36889__90ba9c70f846762e\LOG.Foundation.Implementation.dll MOD - [2010.07.07 16:31:26 | 000,061,440 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Server\2.0.3579.36801__90ba9c70f846762e\APM.Server.dll MOD - [2010.07.07 16:31:26 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.SkinFactory\2.0.3579.36804__90ba9c70f846762e\CLI.Component.SkinFactory.dll MOD - [2010.07.07 16:31:26 | 000,057,344 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime\2.0.3579.36802__90ba9c70f846762e\CLI.Component.Runtime.dll MOD - [2010.07.07 16:31:26 | 000,053,248 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCRT.Graphics.Shared\2.0.3574.20530__90ba9c70f846762e\CLI.Aspect.DeviceCRT.Graphics.Shared.dll MOD - [2010.07.07 16:31:26 | 000,049,152 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceDFP.Graphics.Shared\2.0.3574.20502__90ba9c70f846762e\CLI.Aspect.DeviceDFP.Graphics.Shared.dll MOD - [2010.07.07 16:31:26 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Shared.Private\2.0.3574.20509__90ba9c70f846762e\CLI.Component.Runtime.Shared.Private.dll MOD - [2010.07.07 16:31:26 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server\2.0.3579.36802__90ba9c70f846762e\AEM.Server.dll MOD - [2010.07.07 16:31:26 | 000,045,056 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Plugin.Source.Kit.Server\2.0.3579.36901__90ba9c70f846762e\AEM.Plugin.Source.Kit.Server.dll MOD - [2010.07.07 16:31:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Foundation.Private\2.0.3574.20476__90ba9c70f846762e\CLI.Foundation.Private.dll MOD - [2010.07.07 16:31:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Client.Shared.Private\2.0.3574.20487__90ba9c70f846762e\CLI.Component.Client.Shared.Private.dll MOD - [2010.07.07 16:31:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceProperty.Graphics.Shared\2.0.3574.20489__90ba9c70f846762e\CLI.Aspect.DeviceProperty.Graphics.Shared.dll MOD - [2010.07.07 16:31:26 | 000,040,960 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceCV.Graphics.Shared\2.0.3574.20496__90ba9c70f846762e\CLI.Aspect.DeviceCV.Graphics.Shared.dll MOD - [2010.07.07 16:31:26 | 000,036,864 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Private\2.0.3574.20464__90ba9c70f846762e\LOG.Foundation.Private.dll MOD - [2010.07.07 16:31:26 | 000,032,768 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ATICCCom\2.0.0.0__90ba9c70f846762e\ATICCCom.dll MOD - [2010.07.07 16:31:26 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.DeviceLCD.Graphics.Shared\2.0.3574.20525__90ba9c70f846762e\CLI.Aspect.DeviceLCD.Graphics.Shared.dll MOD - [2010.07.07 16:31:26 | 000,028,672 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Aspect.CustomFormats.Graphics.Shared\2.0.3574.20482__90ba9c70f846762e\CLI.Aspect.CustomFormats.Graphics.Shared.dll MOD - [2010.07.07 16:31:26 | 000,024,576 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Wizard.Shared.Private\2.0.3574.20498__90ba9c70f846762e\CLI.Component.Wizard.Shared.Private.dll MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\ResourceManagement.Foundation.Private\2.0.3574.20480__90ba9c70f846762e\ResourceManagement.Foundation.Private.dll MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\LOG.Foundation.Implementation.Private\2.0.3574.20494__90ba9c70f846762e\LOG.Foundation.Implementation.Private.dll MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Dashboard.Shared.Private\2.0.3574.20499__90ba9c70f846762e\CLI.Component.Dashboard.Shared.Private.dll MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Caste.Graphics.Runtime.Shared.Private\2.0.3574.20537__90ba9c70f846762e\CLI.Caste.Graphics.Runtime.Shared.Private.dll MOD - [2010.07.07 16:31:26 | 000,020,480 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\APM.Foundation\2.0.3574.20504__90ba9c70f846762e\APM.Foundation.dll MOD - [2010.07.07 16:31:26 | 000,019,456 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CCC.Implementation\2.0.3579.36890__90ba9c70f846762e\CCC.Implementation.dll MOD - [2010.07.07 16:31:26 | 000,016,384 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\AEM.Server.Shared\2.0.3574.20484__90ba9c70f846762e\AEM.Server.Shared.dll MOD - [2010.07.07 16:31:26 | 000,007,168 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\CLI.Component.Runtime.Extension.EEU\2.0.3579.36802__90ba9c70f846762e\CLI.Component.Runtime.Extension.EEU.dll MOD - [2010.06.03 12:46:00 | 000,067,872 | ---- | M] () -- C:\Programme\Common Files\Apple\Apple Application Support\zlib1.dll MOD - [2009.10.01 15:45:50 | 000,016,384 | R--- | M] () -- C:\Programme\ATI Technologies\ATI.ACE\Branding\Branding.dll MOD - [2009.07.14 09:47:13 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2009.07.14 09:47:12 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll ========== Services (SafeList) ========== SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service) SRV - [2012.09.29 19:54:26 | 000,676,936 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2012.09.29 19:54:26 | 000,399,432 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler) SRV - [2012.09.25 15:22:17 | 001,737,728 | ---- | M] (Lavasoft Limited ) [On_Demand | Stopped] -- C:\Programme\Lavasoft\Ad-Aware\AAWService.exe -- (Lavasoft Ad-Aware Service) SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2012.03.09 15:38:14 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2012.02.29 07:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Programme\Skype\Updater\Updater.exe -- (SkypeUpdate) SRV - [2011.07.20 05:18:24 | 000,440,696 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\OFFICE12\ODSERV.EXE -- (odserv) SRV - [2011.02.28 17:44:14 | 000,183,560 | ---- | M] (Microsoft Corporation.) [On_Demand | Stopped] -- C:\Programme\Microsoft\BingBar\BBSvc.EXE -- (BBSvc) SRV - [2011.02.25 09:46:22 | 000,249,648 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft\BingBar\SeaPort.EXE -- (SeaPort) SRV - [2010.11.21 10:49:24 | 000,247,608 | ---- | M] () [Auto | Running] -- C:\Programme\ICQ6Toolbar\ICQ Service.exe -- (ICQ Service) SRV - [2010.09.22 23:21:24 | 001,493,352 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Windows Live\Family Safety\fsssvc.exe -- (fsssvc) SRV - [2010.09.22 15:33:04 | 000,051,040 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc) SRV - [2010.09.21 13:03:14 | 001,710,464 | ---- | M] (Microsoft Corp.) [Auto | Running] -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE -- (wlidsvc) SRV - [2010.05.20 15:27:24 | 000,139,632 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Microsoft LifeCam\MSCamS32.exe -- (MSCamSvc) SRV - [2010.03.04 22:38:00 | 000,071,096 | ---- | M] () [Auto | Running] -- C:\Programme\CDBurnerXP\NMSAccessU.exe -- (NMSAccess) SRV - [2010.01.15 13:49:20 | 000,227,232 | ---- | M] (McAfee, Inc.) [On_Demand | Stopped] -- C:\Programme\McAfee Security Scan\2.0.181\McCHSvc.exe -- (McComponentHostService) SRV - [2009.10.20 03:17:30 | 000,172,032 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2009.07.14 02:14:47 | 001,121,280 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Media Player\wmpnetwk.exe -- (WMPNetworkSvc) SRV - [2006.10.26 13:03:08 | 000,145,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE -- (ose) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\npf.sys -- (NPF) DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\EagleNT.sys -- (EagleNT) DRV - File not found [Kernel | On_Demand | Stopped] -- system32\DRIVERS\bcmwlhigh6.sys -- (BCMH43XX) DRV - [2012.09.29 19:54:26 | 000,022,856 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2011.08.04 11:45:08 | 000,015,232 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Programme\Lavasoft\Ad-Aware\kernexplorer.sys -- (Lavasoft Kernexplorer) DRV - [2011.05.18 08:09:04 | 000,040,320 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\dc3d.sys -- (dc3d) DRV - [2010.07.06 18:28:45 | 000,064,288 | ---- | M] (Lavasoft AB) [File_System | Boot | Running] -- C:\Windows\System32\drivers\Lbd.sys -- (Lbd) DRV - [2010.05.20 15:27:24 | 000,030,576 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nx6000.sys -- (MSHUSBVideo) DRV - [2009.11.12 13:48:56 | 000,007,168 | ---- | M] () [File_System | On_Demand | Stopped] -- C:\Windows\System32\drivers\StarOpen.sys -- (StarOpen) DRV - [2009.10.20 03:49:30 | 005,089,280 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [2009.09.30 15:33:56 | 000,104,976 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2009.07.14 02:19:10 | 000,175,824 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vmbus.sys -- (vmbus) DRV - [2009.07.14 02:19:10 | 000,040,896 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\vmstorfl.sys -- (storflt) DRV - [2009.07.14 02:19:10 | 000,028,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\storvsc.sys -- (storvsc) DRV - [2009.07.14 00:51:11 | 000,034,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb) DRV - [2009.07.14 00:28:47 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\vms3cap.sys -- (s3cap) DRV - [2009.07.14 00:28:45 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2009.07.13 23:02:52 | 000,347,264 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvm62x32.sys -- (NVENETFD) DRV - [2006.04.06 01:00:00 | 000,264,704 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB) DRV - [2004.08.13 08:56:20 | 000,005,810 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\ASACPI.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\URLSearchHook: - No CLSID value found IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKLM\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.) IE - HKLM\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC IE - HKLM\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=362&systemid=406&sr=0&q={searchTerms} IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.searchnu.com/406 IE - HKCU\..\URLSearchHook: - No CLSID value found IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) IE - HKCU\..\URLSearchHook: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.) IE - HKCU\..\SearchScopes,DefaultScope = {9BB47C17-9C68-4BB3-B188-DD9AF0FD2406} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC IE - HKCU\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd IE - HKCU\..\SearchScopes\{9BB47C17-9C68-4BB3-B188-DD9AF0FD2406}: "URL" = hxxp://dts.search-results.com/sr?src=ieb&appid=362&systemid=406&sr=0&q={searchTerms} IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2431245 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Search Results" FF - prefs.js..browser.search.defaultthis.engineName: "softonic-de3 Customized Web Search" FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2431245&SearchSource=3&q={searchTerms}" FF - prefs.js..browser.search.order.1: "Search Results" FF - prefs.js..browser.search.selectedEngine: "Search Results" FF - prefs.js..browser.startup.homepage: "hxxp://www.searchnu.com/406" FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.2.5.2 FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {800b5000-a755-47e1-992b-48a1c1357f07}:1.1.9 FF - prefs.js..extensions.enabledItems: {cc05a3e3-64c3-4af2-bfc1-af0d66b69065}:3.2.5.2 FF - prefs.js..extensions.enabledItems: {82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}:6.3.0.11079 FF - prefs.js..extensions.enabledItems: {1FD91A9C-410C-4090-BBCC-55D3450EF433}:1.0 FF - prefs.js..extensions.enabledItems: {99079a25-328f-4bd4-be04-00955acaa0a7}:4.6.1.01 FF - prefs.js..extensions.enabledItems: {EB9394A3-4AD6-4918-9537-31A1FD8E8EDF}:2.0 FF - prefs.js..keyword.URL: "hxxp://dts.search-results.com/sr?src=ffb&appid=362&systemid=406&sr=0&q=" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_2_202_235.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll (Oracle Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3508.1109: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKCU\Software\MozillaPlugins\@Skype Limited.com/Facebook Video Calling Plugin: C:\Users\Juli\AppData\Local\Facebook\Video\Skype\npFacebookVideoCalling.dll (Skype Limited) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Juli\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Juli\AppData\Local\Google\Update\1.3.21.123\npGoogleUpdate3.dll (Google Inc.) FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.05.22 13:51:21 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.6.28\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012.08.18 13:39:11 | 000,000,000 | ---D | M] [2012.09.09 14:52:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Juli\AppData\Roaming\mozilla\Extensions [2012.12.13 17:45:18 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions [2011.10.25 13:25:30 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} [2012.09.09 14:52:13 | 000,000,000 | ---D | M] (Searchqu Toolbar) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{99079a25-328f-4bd4-be04-00955acaa0a7} [2010.10.02 16:30:18 | 000,000,000 | ---D | M] ("Free YouTube Download (Free Studio) Menu") -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.03.13 20:01:45 | 000,000,000 | ---D | M] (softonic-de3 Community Toolbar) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} [2011.10.18 12:51:07 | 000,000,000 | ---D | M] (DealPly) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\{EB9394A3-4AD6-4918-9537-31A1FD8E8EDF} [2011.03.13 20:01:45 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\engine@conduit.com [2012.12.13 17:45:19 | 000,000,000 | ---D | M] (Yontoo) -- C:\Users\Juli\AppData\Roaming\mozilla\Firefox\Profiles\mug1ub3j.default\extensions\plugin@yontoo.com [2010.12.08 15:47:52 | 000,000,927 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\conduit.xml [2012.11.22 12:35:08 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-1.xml [2011.10.02 18:55:01 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-10.xml [2011.10.08 18:48:35 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-11.xml [2011.10.17 21:10:06 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-12.xml [2011.12.26 20:47:20 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-13.xml [2012.02.11 11:56:51 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-14.xml [2012.02.26 14:55:41 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-15.xml [2012.03.29 18:58:46 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-16.xml [2012.09.14 15:56:08 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-17.xml [2011.02.23 16:47:14 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-2.xml [2011.02.25 13:05:20 | 000,000,656 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-3.xml [2011.03.14 15:41:39 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-4.xml [2011.03.28 17:04:32 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-5.xml [2011.04.01 16:12:48 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-6.xml [2011.05.06 19:34:58 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-7.xml [2011.06.29 15:38:41 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-8.xml [2011.08.22 14:35:06 | 000,000,950 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin-9.xml [2011.03.30 14:14:34 | 000,001,042 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\icqplugin.xml [2011.10.17 21:08:53 | 000,002,520 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\SearchResults.xml [2012.09.09 14:52:07 | 000,002,519 | ---- | M] () -- C:\Users\Juli\AppData\Roaming\mozilla\firefox\profiles\mug1ub3j.default\searchplugins\Search_Results.xml [2012.11.22 12:35:07 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2012.10.31 10:50:22 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Programme\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2011.02.23 10:10:53 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions\talkback@mozilla.org [2012.10.31 10:50:22 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A} [2012.09.09 14:52:17 | 000,000,000 | ---D | M] (DataMngr) -- C:\PROGRAM FILES\SEARCHQU TOOLBAR\DATAMNGR\FIREFOXEXTENSION [2011.10.02 18:54:49 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2011.10.02 18:54:49 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2011.10.02 18:54:49 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2011.10.17 21:08:53 | 000,002,520 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\SearchResults.xml [2012.09.09 14:52:07 | 000,002,519 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\Search_Results.xml [2011.10.02 18:54:49 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2011.10.02 18:54:49 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml ========== Chrome ========== CHR - homepage: hxxp://www.searchnu.com/406 CHR - default_search_provider: Search Results () CHR - default_search_provider: search_url = hxxp://dts.search-results.com/sr?src=crb&appid=362&systemid=406&sr=0&q={searchTerms} CHR - default_search_provider: suggest_url = CHR - homepage: hxxp://www.searchnu.com/406 CHR - plugin: Remoting Viewer (Enabled) = internal-remoting-viewer CHR - plugin: Native Client (Enabled) = C:\Users\Juli\AppData\Local\Google\Chrome\Application\23.0.1271.64\ppGoogleNaClPluginChrome.dll CHR - plugin: Chrome PDF Viewer (Enabled) = C:\Users\Juli\AppData\Local\Google\Chrome\Application\23.0.1271.64\pdf.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Users\Juli\AppData\Local\Google\Chrome\Application\23.0.1271.64\gcswf32.dll CHR - plugin: Shockwave Flash (Enabled) = C:\Windows\system32\Macromed\Flash\NPSWF32.dll CHR - plugin: Skype Toolbars (Enabled) = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\5.6.0.8442_0\npSkypeChromePlugin.dll CHR - plugin: Adobe Acrobat (Enabled) = C:\Program Files\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll CHR - plugin: 2007 Microsoft Office system (Enabled) = C:\Program Files\Mozilla Firefox\plugins\NPOFF12.DLL CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin2.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin3.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin4.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin5.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin6.dll CHR - plugin: QuickTime Plug-in 7.6.9 (Enabled) = C:\Program Files\Mozilla Firefox\plugins\npqtplugin7.dll CHR - plugin: Java(TM) Platform SE 7 U2 (Enabled) = C:\Program Files\Java\jre7\bin\new_plugin\npjp2.dll CHR - plugin: Pando Web Plugin (Enabled) = C:\Program Files\Pando Networks\Media Booster\npPandoWebPlugin.dll CHR - plugin: Windows Live\u0099 Photo Gallery (Enabled) = C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll CHR - plugin: iTunes Application Detector (Enabled) = C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll CHR - plugin: Google Update (Enabled) = C:\Users\Juli\AppData\Local\Google\Update\1.3.21.79\npGoogleUpdate3.dll CHR - plugin: Silverlight Plug-In (Enabled) = c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll CHR - plugin: Default Plug-in (Enabled) = default_plugin CHR - Extension: YouTube = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\ CHR - Extension: YouTube = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_1\ CHR - Extension: Google-Suche = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\ CHR - Extension: Google-Suche = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_1\ CHR - Extension: DealPly = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\gaiilaahiahdejapggenmdmafpmbipje\3.0.7.2_0\ CHR - Extension: Skype Click to Call = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\ CHR - Extension: Google Mail = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\ CHR - Extension: Google Mail = C:\Users\Juli\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_1\ O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.) O2 - BHO: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () O2 - BHO: (DataMngr) - {9D717F81-9148-4f12-8568-69135F087DB0} - C:\Programme\Searchqu Toolbar\Datamngr\BrowserConnection.dll (Bandoo Media, inc) O2 - BHO: (Windows Live Messenger Companion Helper) - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O2 - BHO: (DealPly) - {A6174F27-1FFF-E1D6-A93F-BA48AD5DD448} - C:\Programme\DealPly\DealPlyIE.dll (DealPly Technologies Ltd) O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O2 - BHO: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.) O2 - BHO: (Bing Bar Helper) - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation) O2 - BHO: (Yontoo) - {FD72061E-9FDE-484D-A58A-0BAB4151CAD8} - C:\Programme\Yontoo\YontooIEClient.dll (Yontoo LLC) O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ) O3 - HKLM\..\Toolbar: (Bing Bar) - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.) O3 - HKLM\..\Toolbar: (Searchqu Toolbar) - {99079a25-328f-4bd4-be04-00955acaa0a7} - C:\Programme\Searchqu Toolbar\Datamngr\ToolBar\searchqudtx.dll () O3 - HKLM\..\Toolbar: (softonic-de3 Toolbar) - {cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.) O3 - HKLM\..\Toolbar: (no name) - 10 - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (softonic-de3 Toolbar) - {CC05A3E3-64C3-4AF2-BFC1-AF0D66B69065} - C:\Programme\softonic-de3\prxtbsof2.dll (Conduit Ltd.) O4 - HKLM..\Run: [AVMWlanClient] C:\Programme\avmwlanstick\FRITZWLanMini.exe (AVM Berlin GmbH) O4 - HKLM..\Run: [DATAMNGR] C:\Programme\Searchqu Toolbar\Datamngr\datamngrUI.exe (Bandoo Media, inc) O4 - HKLM..\Run: [LifeCam] C:\Program Files\Microsoft LifeCam\LifeExp.exe (Microsoft Corporation) O4 - HKLM..\Run: [LifeChat] C:\Program Files\Microsoft LifeChat\LifeChat.exe (Microsoft Corporation) O4 - HKLM..\Run: [PDVD8LanguageShortcut] C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.) O4 - HKLM..\Run: [RemoteControl8] C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKLM..\Run: [UpdatePSTShortCut] C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.) O4 - HKCU..\Run: [DriverFinder] C:\Program Files\DriverFinder\DriverFinder.exe File not found O4 - HKCU..\Run: [Facebook Update] C:\Users\Juli\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.) O4 - HKCU..\Run: [ICQ] "C:\Program Files\ICQ7.4\ICQ.exe" silent loginmode=4 File not found O4 - HKCU..\Run: [Spotify] C:\Users\Juli\AppData\Roaming\Spotify\Spotify.exe (Spotify Ltd) O4 - HKCU..\Run: [Video Performer63615.exe] C:\Users\Juli\AppData\Local\Temp\Video Performer63615.exe () O4 - Startup: C:\Users\Juli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk = C:\Programme\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation) O4 - Startup: C:\Users\Juli\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Stardock ObjectDock.lnk = C:\Programme\Stardock\ObjectDockFree\ObjectDock.exe (Stardock) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideSCAHealth = 1 O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\Juli\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm () O8 - Extra context menu item: Nach Microsoft E&xel exportieren - C:\Programme\Microsoft Office\Office12\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\Windows Live\Companion\companionlang.dll,-600 - {0000036B-C524-4050-81A0-243669A86B9F} - C:\Programme\Windows Live\Companion\companioncore.dll (Microsoft Corporation) O9 - Extra Button: @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Program Files\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1003 - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Programme\Windows Live\Writer\WriterBrowserExtension.dll (Microsoft Corporation) O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\Programme\Microsoft Office\Office12\ONBttnIE.dll (Microsoft Corporation) O9 - Extra Button: ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra 'Tools' menuitem : ICQ7.5 - {7578ADEA-D65F-4C89-A249-B1C88B6FFC20} - C:\Programme\ICQ7.5\ICQ.exe (ICQ, LLC.) O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\Programme\Microsoft Office\Office12\REFIEBAR.DLL (Microsoft Corporation) O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Bonjour\mdnsNSP.dll (Apple Inc.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 10.2.0) O16 - DPF: {CAFEEFAC-0017-0000-0002-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_02-windows-i586.cab (Java Plug-in 1.7.0_02) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D4051BE0-0BEB-4BB0-A78B-3674CAE4463F}: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F77253D4-B622-48D6-8073-A50984E4CB6B}: DhcpNameServer = 192.168.2.1 O18 - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation) O18 - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - C:\Programme\Windows Live\Messenger\msgrapp.dll (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Programme\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.) O18 - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - C:\Programme\Windows Live\Mail\mailcomm.dll (Microsoft Corporation) O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation) O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation) O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~2\Datamngr\datamngr.dll) - C:\Programme\Searchqu Toolbar\Datamngr\datamngr.dll (Bandoo Media, inc) O20 - AppInit_DLLs: (C:\PROGRA~1\SEARCH~2\Datamngr\IEBHO.dll) - C:\Programme\Searchqu Toolbar\Datamngr\IEBHO.dll (Bandoo Media, inc) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O22 - SharedTaskScheduler: {1984D045-52CF-49cd-DB77-08F378FEA4DB} - ObjectDockShellExt - C:\Programme\Stardock\ObjectDockFree\ODMenu.dll (Stardock) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{a00bc207-89d6-11df-a1fa-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{a00bc207-89d6-11df-a1fa-806e6f6e6963}\Shell\AutoRun\command - "" = "D:\Diablo III Setup.exe" O33 - MountPoints2\{cddca44c-34a9-11e1-af13-485b39a96ddd}\Shell - "" = AutoRun O33 - MountPoints2\{cddca44c-34a9-11e1-af13-485b39a96ddd}\Shell\AutoRun\command - "" = F:\pushinst.exe O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (lsdelete) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.12.13 20:11:33 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Juli\Desktop\OTL.exe [2012.12.13 17:45:57 | 000,000,000 | ---D | C] -- C:\Users\Juli\AppData\Roaming\PerformerSoft [2012.12.13 17:45:06 | 000,000,000 | ---D | C] -- C:\Program Files\Yontoo [2012.12.13 17:45:04 | 000,017,464 | ---- | C] (PerformerSoft LLC) -- C:\Windows\System32\roboot.exe [2012.12.13 17:44:51 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer [2012.12.13 17:43:56 | 000,000,000 | ---D | C] -- C:\Program Files\File Scout [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012.12.13 20:14:02 | 000,003,758 | ---- | M] () -- C:\Users\Juli\Desktop\otlfix.jpg [2012.12.13 20:11:36 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Juli\Desktop\OTL.exe [2012.12.13 19:47:00 | 000,001,116 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000UA.job [2012.12.13 19:08:01 | 000,000,924 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000UA.job [2012.12.13 19:01:22 | 000,015,152 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.12.13 19:01:22 | 000,015,152 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.12.13 18:54:00 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.12.13 18:53:58 | 1610,051,584 | -HS- | M] () -- C:\hiberfil.sys [2012.12.13 18:08:29 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012.12.12 22:08:00 | 000,000,902 | ---- | M] () -- C:\Windows\tasks\FacebookUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000Core.job [2012.12.12 21:49:28 | 000,002,477 | ---- | M] () -- C:\Users\Juli\Desktop\Google Chrome.lnk [2012.12.12 21:47:00 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000Core.job [2012.12.07 16:20:23 | 000,000,064 | ---- | M] () -- C:\Windows\System32\rp_stats.dat [2012.12.07 16:20:23 | 000,000,044 | ---- | M] () -- C:\Windows\System32\rp_rules.dat [2012.12.07 11:49:26 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.12.07 11:49:26 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.12.07 11:49:26 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.12.07 11:49:26 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.12.02 20:58:10 | 000,382,792 | ---- | M] () -- C:\Users\Juli\Desktop\Präventionen für Sportverletzungen.odp [2012.12.02 20:24:20 | 000,539,665 | ---- | M] () -- C:\Users\Juli\Desktop\Scan0012.jpg [1 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2012.12.13 20:14:04 | 000,003,758 | ---- | C] () -- C:\Users\Juli\Desktop\otlfix.jpg [2012.12.02 20:57:48 | 000,382,792 | ---- | C] () -- C:\Users\Juli\Desktop\Präventionen für Sportverletzungen.odp [2012.12.02 20:23:58 | 000,539,665 | ---- | C] () -- C:\Users\Juli\Desktop\Scan0012.jpg [2012.10.29 21:09:53 | 000,003,584 | ---- | C] () -- C:\Users\Juli\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2012.01.01 22:41:03 | 000,138,160 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2012.01.01 22:41:00 | 000,271,200 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2012.01.01 22:40:34 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe [2012.01.01 21:20:22 | 000,097,312 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin [2011.10.26 15:08:34 | 000,150,996 | ---- | C] () -- C:\Windows\System32\drivers\RTAIODAT.DAT [2011.08.05 11:27:58 | 000,016,432 | ---- | C] () -- C:\Windows\System32\lsdelete.exe [2011.08.04 11:45:50 | 000,000,064 | ---- | C] () -- C:\Windows\System32\rp_stats.dat [2011.08.04 11:45:50 | 000,000,044 | ---- | C] () -- C:\Windows\System32\rp_rules.dat [2011.05.18 13:48:29 | 000,037,153 | ---- | C] () -- C:\Users\Juli\energy-report.html [2011.04.08 14:04:20 | 000,100,600 | -H-- | C] () -- C:\Windows\System32\mlfcache.dat [2011.03.30 13:33:55 | 000,000,056 | -H-- | C] () -- C:\Windows\System32\ezsidmv.dat ========== ZeroAccess Check ========== [2009.07.14 05:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shell32.dll -- [2012.01.04 10:03:45 | 012,868,096 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 02:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both ========== LOP Check ========== [2012.04.10 00:52:28 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Ad-Aware Antivirus [2010.07.07 17:53:53 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Canneverbe Limited [2011.04.18 11:58:32 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\DriverFinder [2012.03.11 21:41:26 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\DVDVideoSoft [2012.03.11 21:41:13 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\DVDVideoSoftIEHelpers [2012.07.22 16:16:16 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\ICQ [2010.07.14 17:12:01 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\LolClient [2012.05.24 20:28:12 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\LolClient2 [2012.08.06 14:00:54 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Notepad++ [2012.12.13 17:59:09 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\PerformerSoft [2012.12.13 19:46:02 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Spotify [2011.05.06 19:30:51 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Stardock [2011.10.18 19:56:51 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\TeamViewer [2012.08.06 15:39:14 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Teeworlds [2012.10.03 18:21:57 | 000,000,000 | ---D | M] -- C:\Users\Juli\AppData\Roaming\Windows Live Writer ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2010.07.07 16:11:06 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2010.07.07 16:10:56 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2011.12.05 15:52:34 | 000,000,000 | ---D | M] -- C:\Fraps [2010.07.11 16:27:19 | 000,000,000 | RH-D | M] -- C:\MSOCache [2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.12.13 19:47:09 | 000,000,000 | R--D | M] -- C:\Program Files [2012.12.13 20:05:02 | 000,000,000 | -H-D | M] -- C:\ProgramData [2010.07.07 16:10:56 | 000,000,000 | -HSD | M] -- C:\Programme [2010.07.07 16:10:56 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.03.23 17:10:37 | 000,000,000 | ---D | M] -- C:\Riot Games [2012.12.13 20:22:38 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2010.07.07 16:11:01 | 000,000,000 | R--D | M] -- C:\Users [2012.12.13 18:53:58 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < C:\Windows\system32\*.tsp > [2009.07.14 02:14:11 | 000,030,720 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\hidphone.tsp [2009.07.14 02:14:11 | 000,038,912 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\kmddsp.tsp [2009.07.14 02:14:11 | 000,050,688 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\ndptsp.tsp [2009.07.14 02:14:11 | 000,082,432 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\remotesp.tsp [2009.07.14 02:14:11 | 000,281,088 | ---- | M] (Microsoft Corporation) -- C:\Windows\system32\unimdm.tsp [1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] [2009.07.14 05:53:46 | 000,032,640 | ---- | C] () -- C:\Windows\Tasks\SCHEDLGU.TXT [2009.07.14 05:53:47 | 000,000,006 | -H-- | C] () -- C:\Windows\Tasks\SA.DAT [2011.05.08 14:02:54 | 000,001,064 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000Core.job [2011.05.08 14:02:54 | 000,001,116 | ---- | C] () -- C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000UA.job [2012.11.01 22:03:18 | 000,000,902 | ---- | C] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000Core.job [2012.11.01 22:03:19 | 000,000,924 | ---- | C] () -- C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-506384821-2703844005-285274219-1000UA.job < MD5 for: AGP440.SYS > [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2009.07.14 02:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys < MD5 for: ATAPI.SYS > [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2009.07.14 02:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009.07.14 02:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: EXPLORER.EXE > [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe [2009.07.14 02:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_518afd35db100430\explorer.exe [2011.02.26 06:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_525b5180f3f95373\explorer.exe [2009.10.31 06:45:39 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_51a66d6ddafc2ed1\explorer.exe [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\explorer.exe [2011.02.26 06:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_51a3a583dafd0cef\explorer.exe [2010.11.20 13:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe [2009.08.03 06:49:47 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_526619d4f3f142e6\explorer.exe [2009.08.03 06:35:50 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_51e07e31dad00878\explorer.exe [2009.10.31 07:00:51 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_52283b2af41f3691\explorer.exe < MD5 for: IASTORV.SYS > [2011.03.11 06:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys [2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys [2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys [2011.03.11 06:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys [2011.03.11 06:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009.07.14 02:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2010.11.20 13:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys [2011.03.11 06:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010.11.20 13:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009.07.14 02:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2011.03.11 06:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys [2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys [2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys [2011.03.11 06:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys [2011.03.11 06:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys [2011.03.11 06:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys [2010.11.20 13:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009.07.14 02:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys < MD5 for: SCECLI.DLL > [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009.07.14 02:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll [2010.11.20 13:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll < MD5 for: USER32.DLL > [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009.07.14 02:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll [2010.11.20 13:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll < MD5 for: USERINIT.EXE > [2010.11.20 13:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009.07.14 02:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WINLOGON.EXE > [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe [2009.10.28 07:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009.10.28 06:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2010.11.20 13:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\SoftwareDistribution\Download\18e2c83e42cc8f0cc17b5dbfaf982690\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe [2012.09.29 19:54:26 | 000,218,184 | ---- | M] () MD5=8846E87210AD131CF71E3E2E49F647B0 -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009.07.14 02:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009.07.14 00:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\system32\*.dll /lockedfiles > [2009.10.20 03:18:28 | 000,446,464 | ---- | M] (Advanced Micro Devices, Inc.) Unable to obtain MD5 -- C:\Windows\system32\ATIDEMGX.dll [2012.02.18 20:29:49 | 000,118,784 | ---- | M] (Microsoft Corporation) Unable to obtain MD5 -- C:\Windows\system32\iepeers.dll [1 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < %USERPROFILE%\*.* > [2011.05.18 13:48:29 | 000,037,153 | ---- | M] () -- C:\Users\Juli\energy-report.html [2012.12.13 20:31:11 | 002,883,584 | -HS- | M] () -- C:\Users\Juli\ntuser.dat [2012.12.13 20:31:11 | 000,262,144 | -HS- | M] () -- C:\Users\Juli\ntuser.dat.LOG1 [2010.07.07 16:11:01 | 000,000,000 | -HS- | M] () -- C:\Users\Juli\ntuser.dat.LOG2 [2011.02.15 17:22:49 | 000,065,536 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{1def9879-3916-11e0-b7c7-485b39a96ddd}.TM.blf [2011.02.15 17:22:49 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{1def9879-3916-11e0-b7c7-485b39a96ddd}.TMContainer00000000000000000001.regtrans-ms [2011.02.15 17:22:49 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{1def9879-3916-11e0-b7c7-485b39a96ddd}.TMContainer00000000000000000002.regtrans-ms [2010.07.07 16:33:33 | 000,065,536 | -HS- | M] () -- C:\Users\Juli\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TM.blf [2010.07.07 16:33:33 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000001.regtrans-ms [2010.07.07 16:33:33 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\NTUSER.DAT{6cced2f1-6e01-11de-8bed-001e0bcd1824}.TMContainer00000000000000000002.regtrans-ms [2011.02.19 12:41:49 | 000,065,536 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{9eb43cd9-3c19-11e0-9cbe-485b39a96ddd}.TM.blf [2011.02.19 12:41:49 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{9eb43cd9-3c19-11e0-9cbe-485b39a96ddd}.TMContainer00000000000000000001.regtrans-ms [2011.02.19 12:41:49 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{9eb43cd9-3c19-11e0-9cbe-485b39a96ddd}.TMContainer00000000000000000002.regtrans-ms [2011.02.14 16:26:06 | 000,065,536 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{be784bbc-3840-11e0-9371-485b39a96ddd}.TM.blf [2011.02.14 16:26:06 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{be784bbc-3840-11e0-9371-485b39a96ddd}.TMContainer00000000000000000001.regtrans-ms [2011.02.14 16:26:06 | 000,524,288 | -HS- | M] () -- C:\Users\Juli\ntuser.dat{be784bbc-3840-11e0-9371-485b39a96ddd}.TMContainer00000000000000000002.regtrans-ms [2010.07.07 16:11:01 | 000,000,020 | -HS- | M] () -- C:\Users\Juli\ntuser.ini < %USERPROFILE%\Local Settings\Temp\*.exe > < %USERPROFILE%\Local Settings\Temp\*.dll > < %USERPROFILE%\Application Data\*.exe > < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < End of report > |
|
13.12.2012, 20:39
| #4 |
| | Malwarebytes bericht Extra.txt: Extra.txt:OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 13.12.2012 20:21:06 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Juli\Desktop
Professional (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,14 Gb Available Physical Memory | 57,10% Memory free
4,00 Gb Paging File | 2,92 Gb Available in Paging File | 73,01% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 148,95 Gb Total Space | 68,39 Gb Free Space | 45,92% Space Free | Partition Type: NTFS
Computer Name: JULI-PC | User Name: Juli | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = ChromiumHTML] -- Reg Error: Key error. File not found
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- "C:\Program Files\File Scout\filescout.exe" /open "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [OneNote.Open] -- C:\PROGRA~1\MICROS~1\Office12\ONENOTE.EXE "%L" (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"AntiVirusDisableNotify" = 0
"AntiVirusOverride" = 1
"FirewallDisableNotify" = 0
"FirewallOverride" = 1
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0007633D-1A44-4183-A1DF-93373B91821A}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{02D35978-DC78-4C31-A23D-78C83F854328}" = rport=10243 | protocol=6 | dir=out | app=system |
"{05BE383F-B5EF-416E-961F-0EF8E6ED7968}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{09BF7534-E102-4413-B986-26BDBD613992}" = lport=6957 | protocol=6 | dir=in | name=league of legends launcher |
"{0AF83C3E-E9BF-481E-972D-336A237BB5F8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{0CE876DC-7A46-4FB5-81A1-85448E68452A}" = lport=58733 | protocol=17 | dir=in | name=pando media booster |
"{0D9061FF-489C-455A-A0D9-756A5B1FBF4C}" = lport=8390 | protocol=17 | dir=in | name=league of legends game client |
"{0E33750E-D5ED-47A7-997D-D41CC84132E1}" = lport=8393 | protocol=17 | dir=in | name=league of legends lobby |
"{0F3B0277-ED5E-492F-B981-D6158AA24968}" = lport=6962 | protocol=17 | dir=in | name=league of legends launcher |
"{132C1743-A9B2-4BEE-8C87-D8EE28C3191C}" = lport=6909 | protocol=6 | dir=in | name=league of legends launcher |
"{1E302115-A555-4B5C-8E89-A087F518EE75}" = lport=6981 | protocol=6 | dir=in | name=league of legends launcher |
"{1EEA2316-1AE2-4D07-B19E-95FA0E91D439}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher |
"{221D9152-7D94-4460-9777-CD53EDF852C5}" = lport=6982 | protocol=17 | dir=in | name=league of legends launcher |
"{23379463-8EBC-4EB9-BDEB-173199B17718}" = lport=8398 | protocol=17 | dir=in | name=league of legends launcher |
"{276B5604-C8CE-46EE-BCDC-F8559E6C5019}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{27939A87-2491-4D31-89B9-CD2DF7BEFC35}" = lport=6897 | protocol=17 | dir=in | name=league of legends launcher |
"{291468E4-EDC1-4C1E-A811-3D56CD6154B9}" = lport=137 | protocol=17 | dir=in | app=system |
"{30F50554-D354-4B5B-A00B-36AA8CFDB8BA}" = rport=139 | protocol=6 | dir=out | app=system |
"{31995171-9E9C-4525-9B7F-FF5AD4E09EB7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{34033F15-55FB-44D9-83C3-5713D7627B4E}" = lport=6900 | protocol=17 | dir=in | name=league of legends launcher |
"{3633D287-6354-4D91-9A37-5B4916368613}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{382D24E9-D162-4E8D-AEAF-850A6CA96CCF}" = lport=6913 | protocol=6 | dir=in | name=league of legends launcher |
"{3EBCAD7C-99C2-4BC3-A0A8-F86BB9C6929F}" = lport=138 | protocol=17 | dir=in | app=system |
"{4138D379-BE1B-400A-B908-4657A75E79B3}" = lport=57682 | protocol=17 | dir=in | name=pando media booster |
"{416C18EB-0A03-4D3C-B8AF-FC7A91CA77B8}" = lport=6910 | protocol=17 | dir=in | name=league of legends launcher |
"{41B313CD-13FA-4356-93C4-CD0DC4C9CAD9}" = lport=6982 | protocol=6 | dir=in | name=league of legends launcher |
"{41E89051-D054-43FE-BA5D-C6EB110EFAF2}" = lport=6974 | protocol=6 | dir=in | name=league of legends launcher |
"{42297800-81D4-43F3-B7EE-6529FB2441EF}" = lport=58994 | protocol=6 | dir=in | name=pando media booster |
"{44D03B70-5432-4405-87BF-C3B80F685A43}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{45F05930-9690-4F8B-AD23-790E518D4A33}" = lport=6900 | protocol=6 | dir=in | name=league of legends launcher |
"{4DC81FAE-3602-4CFC-8D52-68464EC0F87D}" = lport=8397 | protocol=6 | dir=in | name=league of legends launcher |
"{4DF8EFAA-573C-4895-B2EB-255158B1152D}" = rport=137 | protocol=17 | dir=out | app=system |
"{4F81B8D2-1D62-4B8D-916C-7A7BA1EC66CB}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher |
"{563E44FA-6BAB-43CB-8770-6A2D0BFCA7A9}" = lport=8398 | protocol=6 | dir=in | name=league of legends launcher |
"{616FF4CD-17A5-46CA-86DE-4FADB109E70A}" = lport=6957 | protocol=17 | dir=in | name=league of legends launcher |
"{62F33DAA-7A75-4141-9091-90A5B643229B}" = lport=57682 | protocol=6 | dir=in | name=pando media booster |
"{63FEA214-126B-481D-A4F3-EEA60F430A03}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{68DB6C8F-2C46-4C07-9A44-8F3BE3DBC32B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6A318DE9-BEE1-495D-80B5-A36A810B92E1}" = lport=8393 | protocol=6 | dir=in | name=league of legends lobby |
"{6CBEB9CE-1172-41AA-AAF4-86582FADA49F}" = lport=6919 | protocol=17 | dir=in | name=league of legends launcher |
"{6F3B3B82-E681-4FE7-A81C-296CB0ED6179}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{6F810CB5-7E97-4568-9F0B-83780EEAAB11}" = lport=139 | protocol=6 | dir=in | app=system |
"{7501E91C-CFD4-4BDF-A058-922193CB7CD1}" = lport=6928 | protocol=17 | dir=in | name=league of legends launcher |
"{7807D179-693E-4369-A43C-B98A363F154A}" = lport=6910 | protocol=6 | dir=in | name=league of legends launcher |
"{786194ED-1362-460D-A2FE-8F232118E5D2}" = lport=6909 | protocol=17 | dir=in | name=league of legends launcher |
"{788B08FD-C190-4B23-BEE0-63D4BDA14B73}" = lport=58733 | protocol=6 | dir=in | name=pando media booster |
"{78BF0405-AA78-4209-85BD-6EA204644426}" = lport=57682 | protocol=6 | dir=in | name=pando media booster |
"{797B1F13-18B3-4899-AD96-A8A5FDA92425}" = lport=6913 | protocol=17 | dir=in | name=league of legends launcher |
"{7BE22AF6-4928-42FF-936E-4CDF01E3A30A}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher |
"{7CF45026-A245-42A7-BB3E-BF7A7EE975B6}" = lport=6926 | protocol=17 | dir=in | name=league of legends launcher |
"{801EDCB7-F0DC-4E4F-95C0-E0EB9EA564CF}" = rport=445 | protocol=6 | dir=out | app=system |
"{810C5C9B-2899-4D4E-9264-EC2622002C34}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher |
"{82B381DE-74B8-47D1-A2C8-EAB43224908B}" = lport=8303 | protocol=17 | dir=in | name=elite blocker2 |
"{893CD072-233A-4BFD-9CED-3091CE7AFE74}" = lport=6926 | protocol=6 | dir=in | name=league of legends launcher |
"{894CD151-7247-4698-9420-E7274C7D3A74}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{898462BE-3A1F-4CEE-BCE1-D4947CC0C09C}" = lport=6884 | protocol=17 | dir=in | name=league of legends launcher |
"{8A4F9C78-DAB9-4CAD-BFEB-52002AC7F8F6}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{8D74E92C-952E-4E9F-B0B9-628DAE1CC872}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{8EA8C0F0-3B00-4ECF-8452-3A1B3B140B77}" = rport=8303 | protocol=17 | dir=out | name=elite blocker2 |
"{8EE55384-E6B1-4E71-A398-573E5629F2DE}" = lport=57682 | protocol=17 | dir=in | name=pando media booster |
"{8F2B77B8-D4C9-4110-A6B3-B790A5EEC29A}" = lport=6884 | protocol=6 | dir=in | name=league of legends launcher |
"{8F715028-A31D-4BDB-BFE1-5687453EC185}" = lport=10243 | protocol=6 | dir=in | app=system |
"{90E7CC3C-4B4B-49E3-83A5-3A0B079985CA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A029ECE6-4028-4612-BBCA-626A166EE7F8}" = lport=58994 | protocol=17 | dir=in | name=pando media booster |
"{A1843C0F-9243-480B-B363-205E69DE8A27}" = rport=138 | protocol=17 | dir=out | app=system |
"{A33024D7-61B6-4FCD-9193-05D173167E43}" = lport=58994 | protocol=17 | dir=in | name=pando media booster |
"{A535DE85-B786-454F-9A6B-78C8F731C440}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{B1AC1A48-062F-45B5-BB12-5BB607EB3111}" = lport=58994 | protocol=6 | dir=in | name=pando media booster |
"{B52D390D-3B5F-4A2C-846E-57A2A2B62BCB}" = lport=6962 | protocol=6 | dir=in | name=league of legends launcher |
"{B5319170-E846-4AEA-A48C-346E820B9EAD}" = lport=6981 | protocol=17 | dir=in | name=league of legends launcher |
"{B949A0A3-BA0D-4CDD-98E6-BD1CBE91AFB9}" = lport=6919 | protocol=6 | dir=in | name=league of legends launcher |
"{BAC4803D-61DB-4812-9C03-268B338BD726}" = rport=8303 | protocol=6 | dir=out | name=elite blocker |
"{BBDAACA3-DD5F-41F4-A309-CC3B5C6D3EBC}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{BC8C9DEC-A1B3-44E6-A3C8-F954E66C0E5C}" = lport=8397 | protocol=17 | dir=in | name=league of legends launcher |
"{BD605D56-8AD3-40A3-81FB-CC6BB311789D}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher |
"{C1B97C15-8078-4C4D-A8C6-336FCA540EE5}" = lport=6974 | protocol=17 | dir=in | name=league of legends launcher |
"{C63A01BC-32C1-448A-BA68-162710284768}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D35B68AC-4593-44A9-B2FC-32A77CAE8EF9}" = lport=6897 | protocol=6 | dir=in | name=league of legends launcher |
"{D5AC0420-D596-4025-B7C3-A270EDC78358}" = lport=6883 | protocol=17 | dir=in | name=league of legends launcher |
"{D71BC3B9-AAD7-4AA4-A46A-7F89E4870830}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D71E764F-01B7-4252-AEAC-94F6A66F7D43}" = lport=58733 | protocol=6 | dir=in | name=pando media booster |
"{D7A76BF2-996C-4347-A45B-7AF100DF639B}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{DAC5EB64-CC5E-4D17-8851-D5010AD6E3B1}" = lport=8390 | protocol=6 | dir=in | name=league of legends game client |
"{E30ED459-3C02-46B4-ABCF-6BB2A799D8D5}" = lport=445 | protocol=6 | dir=in | app=system |
"{E65FF183-75FC-4360-B4C4-9A22CFA3D893}" = lport=58733 | protocol=17 | dir=in | name=pando media booster |
"{E931DB36-409C-423D-B3C1-FB824074C2B4}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{E9E65677-4B93-4BAA-B487-45A16F6DFCD1}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{EA7BE8FF-9E4D-42DC-8AE1-E4AFA08B66E8}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{EC6AA8F7-478E-4302-9A39-C17536A4BF1D}" = lport=8303 | protocol=6 | dir=in | name=elite blocker |
"{ECE45DB9-F0A9-484B-AB6E-12E6FBC8BC88}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher |
"{EF6DF789-1CC9-42B3-9B56-54D4DA0FE66A}" = lport=6928 | protocol=6 | dir=in | name=league of legends launcher |
"{F523E788-E245-413A-A1B4-52C14C53FCE2}" = lport=6883 | protocol=6 | dir=in | name=league of legends launcher |
"{F802AA55-5E8D-40A4-9E2F-7E3A6EA4DE3F}" = lport=2869 | protocol=6 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{06EF281B-0109-48F7-A214-F70105B1EBC4}" = protocol=6 | dir=in | app=c:\program files\gameforge4d\elsword_de\data\x2.exe |
"{0D6134D3-A335-432D-96A8-EB251917884A}" = protocol=17 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe |
"{0FB77932-289F-4965-91FA-BD5A6C97755C}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{12521BF1-BFE3-4311-8714-AD89A36C3D08}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"{1368F58F-1660-4A4D-9E8A-97D468A8DCC6}" = protocol=6 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"{162A4277-DCF4-4940-8B55-CBACD1CEFF66}" = dir=in | app=c:\program files\skype\plugin manager\skypepm.exe |
"{17CA3AF5-E529-4381-AAD9-1DCC7CAC33CB}" = protocol=17 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe |
"{1AEB8CBC-0CFC-4E60-AEDC-217E210CCD3A}" = protocol=6 | dir=in | app=c:\program files\searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{1AFF6F95-D946-4BEE-86A2-C07D2713D28A}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"{2008205D-4DD1-44E5-BB82-A1FA8FCE22B4}" = protocol=17 | dir=in | app=c:\program files\gameforge4d\elsword_de\data\x2.exe |
"{235C12EB-7585-484E-ACD7-296BA95238C1}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{2569931C-C195-4BF6-A8A6-1A67B114C4AB}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{25E7AD6A-73CC-4B77-B83F-3420A4032C5F}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe |
"{262706BE-EBF4-49C4-B909-7ABD1B008274}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.998\agent.exe |
"{26E13305-AC10-4373-9384-E1A993BB17E7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{2899B4E8-29CD-4657-886A-6FAD4B6B9D19}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{2A1E4F28-3965-4438-9D10-94EA6C9632C9}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{2C2BCB67-F092-4486-9422-542E656D7EE5}" = dir=in | app=c:\program files\windows live\mesh\moe.exe |
"{3387057B-3F8D-4EA4-AA5E-95F037667145}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{36934C93-F494-4C26-A745-D25DAA3DAEBF}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{418174BD-4C80-4054-80EE-46EFF2F8D7DC}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{442B81E6-CE8E-4A64-8455-CC9EC4A8C43B}" = dir=in | app=c:\users\juli\appdata\local\facebook\video\skype\facebookvideocalling.exe |
"{44E39CA4-50AB-4D27-8864-905405F887F9}" = protocol=6 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{460ECC15-A8F1-47D6-9E72-730E0E2B56EF}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{472536CF-E3FF-4C48-B68C-39FFC424FAC1}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{494443C2-AE9C-43BD-890C-1D3A74CD08E2}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{4BDAD8A5-9B74-4AE8-8B3A-EEA512C4AFEF}" = protocol=17 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe |
"{4E5AF366-4553-4D71-AB0F-A9A425A05957}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{52B6A95D-34C8-4764-B178-3BAE1D8B7361}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{52EFBB52-EA28-4576-A8D7-D204245A0EA3}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{58CBCE6F-F5A5-4BCD-A794-AFFDDD1A2D5F}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6076F113-7C5D-4E27-9E14-0BA0B5A3E4F0}" = protocol=6 | dir=out | app=system |
"{61D84C3A-F720-4B6A-BE66-9E7DB20D831C}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.976\agent.exe |
"{66F513A6-8151-4A71-A2DA-6BEFD155273D}" = protocol=6 | dir=in | app=c:\riot games\league of legends\game\league of legends.exe |
"{69B46F99-E9BA-4639-89CF-A4B7C62318C0}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{6B9EA090-A424-4618-99A7-BB737FB758EB}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{6F9A75D1-2BB5-4343-868B-6F112FB8B86D}" = protocol=17 | dir=in | app=c:\users\juli\appdata\roaming\spotify\spotify.exe |
"{73493254-B34D-4E7F-8C3E-5CD01FADEB9F}" = protocol=6 | dir=in | app=c:\program files\windows ilivid toolbar\datamngr\toolbar\dtuser.exe |
"{74FDECE1-9F0E-4242-8468-FC443629DE48}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{75A9951C-FC48-4979-8653-F2403A4A8757}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{793D8D13-6DC1-4E06-BBAB-5D76D070C371}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{7C6242AC-CD0F-4918-87E6-641F815B4DF2}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7D4B3BD8-1722-4D3B-A922-0AFF9CC87F29}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{7D74ADC9-8A21-445E-ACD7-3D7354785C52}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{7DD4976B-7193-4D81-9F84-5B291C83C0B1}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{8142F2A7-2340-40D7-AEA5-B55BCF803125}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{82B05BF0-EC8F-4F01-9F90-71F9EE306B13}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{84609F01-B07A-40FC-BADE-984F74C6E8D2}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{85CD23C0-FA7F-432E-AECB-2E19D0764513}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{8BB6ED1E-7617-4643-95FC-BBD2382A2B0D}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{8D80F179-5F7B-4AA1-8438-744A5C374B5A}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{931E9345-9235-4375-838C-4A0355547905}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeexp.exe |
"{931FC0A7-6EC3-4BAA-B7B1-FB0AB45EFEFE}" = protocol=17 | dir=in | app=c:\program files\microsoft office\office12\onenote.exe |
"{93ADC9A0-F91A-4BC2-95DF-7AB632C20CB0}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{97F5C3B6-9400-469D-9D02-500B8487AAD3}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{98E62A52-E9E8-4315-9F28-7FE796F4027C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{A218C91F-8386-4070-9CBA-B6E225AC85B9}" = protocol=6 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{A2FDD89C-1519-41E0-856F-A69026C8E7BE}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe |
"{A35B42FE-42B7-4088-9D8F-243D0CC65AC1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{A4E67FA9-C096-4062-B910-7870FC182D4C}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{A76028C7-74D4-4BB6-AF4C-1EA1D44FC268}" = dir=in | app=c:\program files\itunes\itunes.exe |
"{A79E80CE-2A9A-4673-B509-E2208EAA7AFA}" = protocol=6 | dir=in | app=c:\riot games\league of legends\lol.launcher.exe |
"{A8CFC5EC-14E5-46C4-836D-6A6A6743AE32}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifetray.exe |
"{AF0A7B7E-6E43-4144-B16A-28B69969B5EE}" = protocol=17 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{B161A211-2D2E-46EC-AB4F-5FDDA1D5C90C}" = protocol=17 | dir=in | app=c:\program files\microsoft lifecam\lifecam.exe |
"{B5C45758-C1EE-46BF-B2F3-B711386AD901}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{B62721CE-3B82-4F81-9035-001C6832BA35}" = protocol=6 | dir=in | app=c:\users\juli\appdata\roaming\spotify\spotify.exe |
"{B6661706-6185-4DFF-B5D3-07822FFE43FC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{BA4B773C-F7FB-4768-9335-98C71EA76179}" = protocol=17 | dir=in | app=c:\program files\bonjour\mdnsresponder.exe |
"{C08510E9-DBEF-4E19-9232-6558F5084329}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C25305E1-8490-40BB-9E78-5EB3036A8CA0}" = protocol=17 | dir=in | app=c:\program files\windows ilivid toolbar\datamngr\toolbar\dtuser.exe |
"{C4387DF6-02B1-492B-B02D-FC482074B9FD}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{C5390CB0-DF1B-4FD9-BD76-66137DE9CF11}" = protocol=6 | dir=in | app=c:\program files\icq7.5\icq.exe |
"{C5EC2D60-0421-4C95-A1E6-EA79A586058A}" = protocol=6 | dir=in | app=c:\program files\srware iron\iron.exe |
"{C6659329-ACAC-4787-937F-E7794AD8A085}" = protocol=17 | dir=in | app=c:\program files\searchqu toolbar\datamngr\toolbar\dtuser.exe |
"{C954400A-8C51-46CA-9563-F24FC793FA2C}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CABC9B84-2F15-44A9-9FB9-16A998549DA3}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{CABE93A8-4E83-4FC1-BCD5-E3576F5B4830}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{D3033945-B352-40AF-A20F-662E16B71A24}" = protocol=6 | dir=in | app=c:\program files\microsoft lifecam\lifeenc2.exe |
"{D5649A3B-E0DA-4B08-94A3-7702EEA84830}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{DC6B8A9B-CEE6-40EC-AC93-9B86AA64F400}" = protocol=17 | dir=in | app=c:\program files\srware iron\iron.exe |
"{DDC0CAA1-9BA3-4DBC-8742-5467A964EE88}" = dir=in | app=c:\program files\cyberlink\powerdvd8\powerdvd8.exe |
"{DF06FEB4-F36A-44D7-BF11-AD5DF8F1BAC4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{E2A4F47D-16E9-4E53-AC9E-2F0CC84D0D2A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{E32A80AB-8435-4411-9F17-00E57C327BB8}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe |
"{E7EABA95-E6BA-4ECA-A670-1AA219A6987B}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{E8C9B1E8-9048-4C36-A942-2B9DE057468F}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe |
"{EA09853D-B98F-4935-AD51-3B557C83F278}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{EA83F750-245A-42E3-A342-109CE0006C97}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{EA8D9BB8-687A-4471-B463-5E5995FAD09F}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe |
"{EC3E4C96-B2DD-4358-A97D-276B6AF22F71}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{F08FA180-DB19-44E3-9AE8-5835A1C15632}" = protocol=17 | dir=in | app=c:\program files\diablo iii\diablo iii.exe |
"{F204EB20-A7E6-44CC-993E-D6B66ACCDCA2}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F4BB3868-BEC2-4820-A8F2-B26B8297A00A}" = protocol=6 | dir=in | app=c:\riot games\league of legends\air\lolclient.exe |
"{FAC6FB8A-A80E-45C2-94F9-D4942C3EE49C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"TCP Query User{0616F539-65BB-4C0D-9ADF-9ED31DAC5F7A}C:\users\juli\desktop\teeworlds\data\3509_server.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\teeworlds\data\3509_server.exe |
"TCP Query User{2D12814A-C506-41EA-A716-03C8E4D1DE18}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"TCP Query User{6A41BB9C-1FC9-4168-8740-CB5E0E4938A0}C:\program files\metin2\metin2.bin" = protocol=6 | dir=in | app=c:\program files\metin2\metin2.bin |
"TCP Query User{7B041B1B-B56B-475A-AE98-57B843C74703}C:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv.exe |
"TCP Query User{84BF7D81-B2C7-415C-9F6F-3A29F7220632}C:\program files\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files\lolreplay\lolreplay.exe |
"TCP Query User{96FDBC56-D83F-4623-A7E3-4C5BA11DFD8A}C:\users\juli\desktop\teeworlds\3477_server.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\teeworlds\3477_server.exe |
"TCP Query User{B13CED52-09C4-4577-9D7C-C3C1A46ADAF8}C:\program files\metin2\metin2.exe" = protocol=6 | dir=in | app=c:\program files\metin2\metin2.exe |
"TCP Query User{B5B8251F-0471-457A-9547-DF55AB809BD7}C:\users\juli\desktop\cod 4-lan version\iw3mp.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\cod 4-lan version\iw3mp.exe |
"TCP Query User{B8E067E6-4B85-4012-80E4-F45F920F1ED1}C:\users\juli\desktop\warcraft 3 lan\warcraft iii lan\war3.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\warcraft 3 lan\warcraft iii lan\war3.exe |
"TCP Query User{C375DDAC-B5FD-4297-A8EA-0EDCF011FF10}C:\users\juli\desktop\call of duty - world at war\codwawmp.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\call of duty - world at war\codwawmp.exe |
"TCP Query User{C7E1564A-B74F-43AE-9064-806C736F2331}C:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv_ddrace.exe" = protocol=6 | dir=in | app=c:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv_ddrace.exe |
"UDP Query User{10CC45C7-A340-4815-8905-ACBB0D92DF0D}C:\programdata\battle.net\agent\agent.1040\agent.exe" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"UDP Query User{12B84900-C9AD-428F-A7D3-8B2130926E78}C:\users\juli\desktop\warcraft 3 lan\warcraft iii lan\war3.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\warcraft 3 lan\warcraft iii lan\war3.exe |
"UDP Query User{1ABAF7C5-CC71-4C44-B779-45F1BA7974F3}C:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv.exe |
"UDP Query User{1CE89E52-1BF6-41C3-BB56-99607394DA99}C:\program files\metin2\metin2.exe" = protocol=17 | dir=in | app=c:\program files\metin2\metin2.exe |
"UDP Query User{23C82EC5-FF8E-4A3F-9EB4-953CF7E792F3}C:\program files\metin2\metin2.bin" = protocol=17 | dir=in | app=c:\program files\metin2\metin2.bin |
"UDP Query User{2698BCED-63D9-4E81-96CE-270F28123172}C:\users\juli\desktop\cod 4-lan version\iw3mp.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\cod 4-lan version\iw3mp.exe |
"UDP Query User{48DF35F4-6C98-4BF5-891D-0C1DE6668540}C:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv_ddrace.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\teeworlds\teeworlds-0.5.2-win32\teeworlds_srv_ddrace.exe |
"UDP Query User{5C5A98A9-D46D-4BB6-A29A-8F48120B47C1}C:\users\juli\desktop\teeworlds\3477_server.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\teeworlds\3477_server.exe |
"UDP Query User{744C7760-F131-4F2D-84CC-AA2B29C4137A}C:\users\juli\desktop\call of duty - world at war\codwawmp.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\call of duty - world at war\codwawmp.exe |
"UDP Query User{BF278268-0998-4689-B3CA-8208D37A6240}C:\users\juli\desktop\teeworlds\data\3509_server.exe" = protocol=17 | dir=in | app=c:\users\juli\desktop\teeworlds\data\3509_server.exe |
"UDP Query User{F96D378C-DCAE-482F-AFA0-1FF76D51B03B}C:\program files\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files\lolreplay\lolreplay.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02602409-9189-4567-BC07-562605243B69}" = Windows Live Remote Client Resources
"{041F8509-D5F5-E79D-02ED-589B620DFF60}" = CCC Help Thai
"{0481A2EA-DA1D-4D10-A7C3-F8237948F6B5}" = Messenger Companion
"{07425A09-9981-A75B-FE4B-F1B6EEEEF588}" = CCC Help Czech
"{08CCA2C2-CA38-1C55-FC24-A8011DF249BC}" = CCC Help German
"{0AF5AD01-AD58-C2C3-D80A-85EAB670A826}" = Catalyst Control Center InstallProxy
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{11E94FDB-C895-45F1-B756-1C9B8C36C8F1}" = Microsoft IntelliType Pro 7.1
"{141893BD-9F35-2D0F-AFD0-8A04D33C545F}" = CCC Help Hungarian
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{19A4A990-5343-4FF7-B3B5-6F046C091EDF}" = Windows Live Remote Client
"{1DDB95A4-FD7B-4517-B3F1-2BCAA96879E6}" = Windows Live Writer Resources
"{1F6AB0E7-8CDD-4B93-8A23-AA9EB2FEFCE4}" = Junk Mail filter update
"{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = LG Power Tools
"{1FF713E1-FE5E-4AD0-9C8C-B2E877846B45}" = Catalyst Control Center - Branding
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{227E8782-B2F4-4E97-B0EE-49DE9CC1C0C0}" = Windows Live Remote Service
"{23F97773-A8A6-83AC-F7E3-5DAC32AB1237}" = CCC Help Dutch
"{24364652-56E2-6E22-0D47-66069386D85E}" = ccc-core-static
"{26A24AE4-039D-4CA4-87B4-2F83217002FF}" = Java(TM) 7 Update 2
"{2A697B53-0DE3-42DA-B41D-C3F804B1C538}" = iTunes
"{2A981294-F14C-4F0F-9627-D793270922F8}" = Bonjour
"{2B4E24A0-A06F-488D-87D8-16738E5E1104}" = Windows Live Family Safety
"{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = LG CyberLink PowerDVD
"{2C13F8C1-570B-42A9-87B4-8C7903ECD602}" = ObjectDock Free
"{2DC94AFD-A6E2-4AB4-9132-4A3F8E07B386}" = Apple Application Support
"{2DCAE285-1FCC-71CF-A53C-B95036961954}" = CCC Help Chinese Standard
"{32DECFFD-0271-BD79-DC07-9AE9B263C5BB}" = CCC Help Spanish
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3977C85E-C4AA-4559-741E-E6A643C3B6CE}" = CCC Help Greek
"{3A65A74A-5B6E-451A-92D8-50F1182BBE9A}" = Windows Live Remote Service Resources
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3CE220CE-D879-28C9-AB5A-A677DC3AA80A}" = Catalyst Control Center Graphics Full Existing
"{3D4D4CBF-79F3-4E38-A1DC-30646F030443}" = Microsoft LifeChat
"{49BFAFC6-B39E-F4E9-15D9-A870AA6201A5}" = CCC Help Finnish
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{56D65EF0-E8D8-C918-B008-9B9B9EDAE295}" = CCC Help Portuguese
"{57752979-A1C9-4C02-856B-FBB27AC4E02C}" = QuickTime
"{5FC7AB5C-61FC-42DF-A923-5139BCF10D42}" = Microsoft LifeCam
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{64BF17B6-2812-2F90-02D7-A8AF5E8A8018}" = Catalyst Control Center Graphics Light
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{6D9AA6EA-198D-9DA2-48AE-DDABD242861F}" = CCC Help Korean
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{71BE93ED-5BDB-D29E-F987-E99DA69E4E2C}" = CCC Help Norwegian
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{752C1E4E-B4D6-B8B0-9A33-946E4AD6DFE7}" = CCC Help English
"{7578ADEA-D65F-4C89-A249-B1C88B6FFC20}" = ICQ7.5
"{76A315B7-E848-E23C-5D66-21B923B5ECBC}" = ATI Catalyst Install Manager
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{77F8A71E-3515-4832-B8B2-2F1EDBD2E0F1}" = Bing Bar
"{78A96B4C-A643-4D0F-98C2-A8E16A6669F9}" = Windows Live Messenger Companion Core
"{7BC71286-FADF-D923-578F-C508687A6360}" = Catalyst Control Center Graphics Previews Vista
"{7E265513-8CDA-4631-B696-F40D983F3B07}_is1" = CDBurnerXP
"{809A7654-ABB4-6BC8-74AD-75A24F10100E}" = Catalyst Control Center Graphics Full New
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{859D4022-B76D-40DE-96EF-C90CDA263F44}" = Windows Live Writer
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{87BB78C4-F36D-4D93-A7C7-F80F18219848}" = AMD DnD V1.0.19
"{889DF117-14D1-44EE-9F31-C5FB5D47F68B}" = Yontoo 1.10.03
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8BEFCC62-D379-A975-4E54-4A53B30A531F}" = CCC Help Chinese Traditional
"{8C6D6116-B724-4810-8F2D-D047E6B7D68E}" = Mesh Runtime
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007
"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{939628A7-8A3A-9041-8048-EA5515A58364}" = ATI AVIVO Codecs
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9C2F9B2C-1585-43AD-9EF9-48AAD60DFC04}" = Microsoft IntelliPoint 8.1
"{9D56775A-93F3-44A3-8092-840E3826DE30}" = Windows Live Mail
"{A71D5E81-B967-43DB-93D7-FD31BFB95748}" = MobileMe Control Panel
"{A726AE06-AAA3-43D1-87E3-70F510314F04}" = Windows Live Writer
"{A7400060-6326-9CA7-A7C2-645489937792}" = CCC Help Russian
"{A7952011-A626-AF5C-F818-3125E977B0A6}" = CCC Help French
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAAFC670-569B-4A2F-82B4-42945E0DE3EF}" = Windows Live Writer
"{AB3C288F-94D9-43EB-43A9-70EFAEA6612A}" = CCC Help Italian
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{ACFBE99B-6981-4513-B17E-A2683CEB9EE5}" = Windows Live Mesh
"{ADD5DB49-72CF-11D8-9D75-000129760D75}" = LG CyberLink PowerBackup
"{AF844339-2F8A-4593-81B3-9F4C54038C4E}" = Windows Live MIME IFilter
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B1239994-A850-44E2-BED8-E70A21124E16}" = Windows Live Mail
"{B194272D-1F92-46DF-99EB-8D5CE91CB4EC}" = Adobe AIR
"{B3BC9DB1-0B0A-48B0-B86B-EA77CAA7F800}" = Microsoft Corporation
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{B7C29974-4D97-D5D7-7212-BF04B4A05858}" = CCC Help Turkish
"{B92C5909-1D37-4C51-8397-A28BB28E5DC3}" = Facebook Video Calling 1.2.0.287
"{C1FF64D2-942A-CEE3-8B4B-8C2EFC88DD37}" = Catalyst Control Center Graphics Previews Common
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C41300B9-185D-475E-BFEC-39EF732F19B1}" = Apple Software Update
"{C5398A89-516C-4DAF-BA07-EE7949090E56}" = Windows Live Mesh ActiveX control for remote connections
"{C59CF2CE-B302-4833-AA35-E0E07D8EBC52}_is1" = SRWare Iron 10.0.650.0
"{C5A245AA-8C8B-7854-8957-4F5C0A80E6B1}" = CCC Help Danish
"{CACAEB5F-174D-4C7C-AC56-A33289A807CA}" = Apple Mobile Device Support
"{CB0A385F-F761-EA8E-B1BA-61CF54CAEF37}" = CCC Help Japanese
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D558831D-DE89-44DC-1D71-ED17D95DE6C7}" = HydraVision
"{D5DA695C-089A-4A13-0F8D-B7F967DE828B}" = CCC Help Swedish
"{D72C0FA9-FF2C-C710-C7A0-364FEAAE4B65}" = ccc-utility
"{DB6BB57C-2647-74DC-7CCD-2AD92238AF0C}" = Catalyst Control Center Core Implementation
"{DD41811D-6C9B-279E-3EB8-B5AA84F75759}" = Catalyst Control Center Localization All
"{DECDCB7C-58CC-4865-91AF-627F9798FE48}" = Windows Live Mesh
"{DED53B0B-B67C-4244-AE6A-D6FD3C28D1EF}" = Ad-Aware
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.8
"{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}" = Microsoft SQL Server 2005 Compact Edition [ENU]
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F53D678E-238F-4A71-9742-08BB6774E9DC}" = Windows Live Family Safety
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F8B68C6A-CE50-8748-6002-6E65E4AC3209}" = CCC Help Polish
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FD020AE5-B9EA-243E-1BEC-B0F52157AB30}" = Catalyst Control Center HydraVision Full
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"Ad-Aware" = Ad-Aware
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"CCleaner" = CCleaner
"ClearProg" = ClearProg 1.5.1 Beta 6
"DealPly" = DealPly
"Diablo III" = Diablo III
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.10.17.221
"GeoGebra" = GeoGebra
"HOMESTUDENTR" = Microsoft Office Home and Student 2007
"ICQToolbar" = ICQ Toolbar
"InstallShield_{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}" = LG Power Tools
"InstallShield_{2BF2E31F-B8BB-40A7-B650-98D28E0F7D47}" = LG CyberLink PowerDVD
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.1.1000
"McAfee Security Scan" = McAfee Security Scan Plus
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft IntelliPoint 8.1" = Microsoft IntelliPoint 8.1
"Mozilla Firefox (3.6.28)" = Mozilla Firefox (3.6.28)
"Notepad++" = Notepad++
"ObjectDock Free" = ObjectDock Free
"Searchqu Toolbar" = Searchqu Toolbar
"softonic-de3 Toolbar" = softonic-de3 Toolbar
"Uninstall_is1" = Uninstall 1.0.0.1
"VLC media player" = VideoLAN VLC media player 0.8.6b
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.01 (32-Bit)
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Google Chrome" = Google Chrome
"Spotify" = Spotify
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 18.12.2011 07:44:41 | Computer Name = Juli-PC | Source = Application Hang | ID = 1002
Description = Programm metin2client.bin, Version 0.0.0.0 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: f28 Startzeit:
01ccbd7a047380c0 Endzeit: 12 Anwendungspfad: C:\Program Files\Metin2\metin2client.bin
Berichts-ID:
Error - 18.12.2011 07:46:44 | Computer Name = Juli-PC | Source = Application Hang | ID = 1002
Description = Programm metin2client.bin, Version 0.0.0.0 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: e7c Startzeit:
01ccbd7a74441360 Endzeit: 162 Anwendungspfad: C:\Program Files\Metin2\metin2client.bin
Berichts-ID:
Error - 18.12.2011 07:50:52 | Computer Name = Juli-PC | Source = Application Hang | ID = 1002
Description = Programm metin2client.bin, Version 0.0.0.0 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: dac Startzeit:
01ccbd7ac4494e20 Endzeit: 12 Anwendungspfad: C:\Program Files\Metin2\metin2client.bin
Berichts-ID:
Error - 20.12.2011 11:22:37 | Computer Name = Juli-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 23.12.2011 11:17:16 | Computer Name = Juli-PC | Source = Lavasoft Ad-Aware Service | ID = 0
Description =
Error - 23.12.2011 17:12:22 | Computer Name = Juli-PC | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest- oder Richtliniendatei "C:\Program
Files\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" in Zeile 2. Mehrere
requestedPrivileges-Elemente sind nicht im Manifest zulässig.
Error - 26.12.2011 15:39:00 | Computer Name = Juli-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Skype.exe, Version: 5.5.0.124, Zeitstempel:
0x4e96a02b Name des fehlerhaften Moduls: Skype.exe, Version: 5.5.0.124, Zeitstempel:
0x4e96a02b Ausnahmecode: 0xc0000005 Fehleroffset: 0x00f58d70 ID des fehlerhaften Prozesses:
0x880 Startzeit der fehlerhaften Anwendung: 0x01ccc405c46f8fe0 Pfad der fehlerhaften
Anwendung: C:\Program Files\Skype\Phone\Skype.exe Pfad des fehlerhaften Moduls:
C:\Program Files\Skype\Phone\Skype.exe Berichtskennung: 41aa7d80-2ff9-11e1-b36f-485b39a96ddd
Error - 27.12.2011 12:28:49 | Computer Name = Juli-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: metin2.exe, Version: 0.0.0.0, Zeitstempel:
0x4e408722 Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16695, Zeitstempel:
0x4cc7ab44 Ausnahmecode: 0xc0000005 Fehleroffset: 0x0002fa7b ID des fehlerhaften Prozesses:
0xdd4 Startzeit der fehlerhaften Anwendung: 0x01ccc4b493108ad0 Pfad der fehlerhaften
Anwendung: C:\Program Files\Metin2\metin2.exe Pfad des fehlerhaften Moduls: C:\Windows\SYSTEM32\ntdll.dll
Berichtskennung:
da7fc5c0-30a7-11e1-ad4a-485b39a96ddd
Error - 29.12.2011 13:30:02 | Computer Name = Juli-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: fraps.exe, Version: 3.4.6.13747,
Zeitstempel: 0x4e34fb43 Name des fehlerhaften Moduls: fraps.exe, Version: 3.4.6.13747,
Zeitstempel: 0x4e34fb43 Ausnahmecode: 0xc0000005 Fehleroffset: 0x00011ad9 ID des fehlerhaften
Prozesses: 0xaa0 Startzeit der fehlerhaften Anwendung: 0x01ccc64f5793372c Pfad der
fehlerhaften Anwendung: C:\Fraps\fraps.exe Pfad des fehlerhaften Moduls: C:\Fraps\fraps.exe
Berichtskennung:
bd0231bc-3242-11e1-86dd-485b39a96ddd
Error - 01.01.2012 15:52:15 | Computer Name = Juli-PC | Source = SideBySide | ID = 16842827
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files\Skype\Toolbars\Internet
Explorer\SkypeIEPluginBroker.exe". Fehler in Manifest- oder Richtliniendatei "C:\Program
Files\Skype\Toolbars\Internet Explorer\SkypeIEPluginBroker.exe" in Zeile 2. Mehrere
requestedPrivileges-Elemente sind nicht im Manifest zulässig.
[ Media Center Events ]
Error - 01.10.2010 10:03:18 | Computer Name = Juli-PC | Source = MCUpdate | ID = 0
Description = 16:03:18 - Fehler beim Herstellen der Internetverbindung. 16:03:18
- Serververbindung konnte nicht hergestellt werden..
Error - 01.10.2010 10:03:27 | Computer Name = Juli-PC | Source = MCUpdate | ID = 0
Description = 16:03:23 - Fehler beim Herstellen der Internetverbindung. 16:03:23
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 11.12.2012 08:44:45 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
Error - 11.12.2012 09:28:41 | Computer Name = Juli-PC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?11.?12.?2012 um 14:27:24 unerwartet heruntergefahren.
Error - 11.12.2012 09:28:58 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
Error - 11.12.2012 12:38:57 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
Error - 11.12.2012 15:28:03 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
Error - 12.12.2012 10:33:12 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
Error - 12.12.2012 16:07:06 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
Error - 13.12.2012 10:36:48 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
Error - 13.12.2012 13:10:05 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
Error - 13.12.2012 13:54:15 | Computer Name = Juli-PC | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
luafv
< End of report >
|
|
13.12.2012, 20:44
| #5 |
| /// Malware-holic | Malwarebytes bericht hi dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O4 - HKCU..\Run: [Video Performer63615.exe] C:\Users\Juli\AppData\Local\Temp\Video Performer63615.exe ()
:Files
:Commands
[EMPTYFLASH]
[emptytemp]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! Drücke bitte die  + E Taste.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
13.12.2012, 22:10
| #6 |
| | Malwarebytes bericht Der Upload hat erfolgreich geklappt. und jetzt? |
|
14.12.2012, 13:42
| #7 | |
| /// Malware-holic | Malwarebytes bericht Hallo, combofix: Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
14.12.2012, 15:28
| #8 |
| | Malwarebytes bericht also soll ich jetzt den ordner noch mal uploaden oder dieses combofix benutzen? btw. ich glaube, dass ich kein virus mehr hab, weil das video geht jetzt wieder, und ich hab schon alle gefundenen viren mit dem programm " malwarebytes anti-malware " gelöscht sorry bin neu |
|
14.12.2012, 15:47
| #9 |
| /// Malware-holic | Malwarebytes bericht Wieso noch mal uploaden, steht doch oben, was zu tun ist.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Malwarebytes bericht |
| administrator, anti-malware, autostart, bericht, dateien, einfach, explorer, film, found, gelöscht, gen, google, ibupdaterservice, kopieren, löschen, malwarebytes, microsoft, not, quarantäne, services, software, speicher, version, video, viren, virus, warum |
Linear-Darstellung
