BKA Virus mal da mal nicht

OTL logfile created on: 04.03.2013 08:53:47 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\DjPenny\Desktop
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 3,10 Gb Available Physical Memory | 77,51% Memory free
8,00 Gb Paging File | 7,23 Gb Available in Paging File | 90,46% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 553,32 Gb Free Space | 59,41% Space Free | Partition Type: NTFS
 
Computer Name: DJPENNY-PC | User Name: DjPenny | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.03.04 08:22:28 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\DjPenny\Desktop\OTL.exe
PRC - [2013.02.27 08:43:19 | 000,917,400 | ---- | M] (Mozilla Corporation) -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2013.02.27 08:43:19 | 003,067,288 | ---- | M] () -- C:\Program Files (x86)\Mozilla Firefox\mozjs.dll
MOD - [2012.08.22 05:15:38 | 000,374,120 | ---- | M] () -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\Nv3DVStreaming.dll
 
 
========== Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 02:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2013.02.27 08:43:19 | 000,115,608 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.02.26 23:58:13 | 000,251,248 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.01.31 12:11:06 | 002,561,488 | ---- | M] () [Auto | Stopped] -- C:\ProgramData\Browser Manager\2.6.1123.78\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.exe -- (Browser Manager)
SRV - [2013.01.08 12:55:20 | 000,161,536 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.12.28 11:08:01 | 000,107,832 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrB.exe -- (PnkBstrB)
SRV - [2012.12.28 11:07:51 | 000,066,872 | ---- | M] () [Auto | Stopped] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2012.12.14 10:17:04 | 003,467,768 | ---- | M] (TeamViewer GmbH) [Auto | Stopped] -- C:\Program Files (x86)\TeamViewer\Version8\TeamViewer_Service.exe -- (TeamViewer8)
SRV - [2012.10.24 11:17:41 | 000,529,744 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Stopped] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2012.08.22 14:46:00 | 001,258,856 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.08.22 05:16:00 | 000,382,312 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.07.27 21:51:26 | 000,063,960 | ---- | M] (Adobe Systems Incorporated) [Auto | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.12.28 10:54:47 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.07.03 16:25:16 | 000,189,288 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2009.11.24 01:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.23 16:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.07.14 02:52:21 | 000,106,576 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2009.07.14 02:52:21 | 000,028,752 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2009.07.14 02:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:47:48 | 000,077,888 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.14 02:47:48 | 000,023,104 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2009.07.14 02:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 21:35:42 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2009.06.10 21:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2005.03.29 01:30:38 | 000,008,192 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://search.babylon.com/?affID=109958&tt=120912_cpc_3812_2&babsrc=HP_ss&mntrId=f20f42ad000000000000e0cb4ec8a7e3
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,BrowserMngr Start Page = hxxp://search.babylon.com/?affID=109958&tt=120912_cpc_3812_2&babsrc=HP_ss&mntrId=f20f42ad000000000000e0cb4ec8a7e3
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2269050
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3E 5A A1 B1 83 8E CD 01  [binary data]
IE - HKCU\..\URLSearchHook: {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
IE - HKCU\..\SearchScopes,bProtectorDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,BrowserMngrDefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes,DefaultScope = {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://search.babylon.com/?q={searchTerms}&affID=109958&tt=120912_cpc_3812_2&babsrc=SP_ss&mntrId=f20f42ad000000000000e0cb4ec8a7e3
IE - HKCU\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2269050
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Search the web (Babylon)"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..browser.startup.homepage: "hxxp://de.search.yahoo.com/firefox/?fr=foxload-sfp"
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.4.3
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:19.0
FF - prefs.js..sweetim.toolbar.previous.browser.search.defaultenginename: "Search the web (Babylon)"
 
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_6_602_171.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_171.dll ()
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.9.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.9.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.02.27 08:43:19 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 19.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
 
[2012.09.09 13:09:17 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DjPenny\AppData\Roaming\mozilla\Extensions
[2013.03.01 08:37:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DjPenny\AppData\Roaming\mozilla\Firefox\Profiles\ip7k4aoo.default\extensions
[2013.02.14 19:51:04 | 000,000,000 | ---D | M] (DVDVideoSoftTB DE) -- C:\Users\DjPenny\AppData\Roaming\mozilla\Firefox\Profiles\ip7k4aoo.default\extensions\{0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff}
[2013.02.28 23:31:19 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\DjPenny\AppData\Roaming\mozilla\Firefox\Profiles\ip7k4aoo.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013.02.12 18:18:44 | 000,000,000 | ---D | M] (DVDVideoSoftTB) -- C:\Users\DjPenny\AppData\Roaming\mozilla\Firefox\Profiles\ip7k4aoo.default\extensions\{872b5b88-9db5-4310-bdd0-ac189557e5f5}
[2012.12.11 23:30:55 | 000,000,000 | ---D | M] ("DVDVideoSoft YouTube MP3 and Video Download") -- C:\Users\DjPenny\AppData\Roaming\mozilla\Firefox\Profiles\ip7k4aoo.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2013.01.27 12:25:08 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\DjPenny\AppData\Roaming\mozilla\Firefox\Profiles\ip7k4aoo.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2013.01.29 10:50:32 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\DjPenny\AppData\Roaming\mozilla\Firefox\Profiles\ip7k4aoo.default\extensions\ich@maltegoetz.de
[2013.03.01 08:37:16 | 000,000,000 | ---D | M] (No name found) -- C:\Users\DjPenny\AppData\Roaming\mozilla\Firefox\Profiles\ip7k4aoo.default\extensions\staged
[2012.12.11 23:30:54 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\DjPenny\AppData\Roaming\mozilla\firefox\profiles\ip7k4aoo.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.03.01 08:37:16 | 000,269,007 | ---- | M] () (No name found) -- C:\Users\DjPenny\AppData\Roaming\mozilla\firefox\profiles\ip7k4aoo.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2012.12.01 08:33:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2012.10.30 11:17:34 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\mozilla firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2012.12.01 08:33:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions
[2012.12.01 08:33:14 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Program Files (x86)\mozilla firefox\distribution\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013.02.27 08:43:19 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2012.12.01 08:34:45 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.12.01 08:34:45 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2012.12.01 08:34:45 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2012.12.01 08:34:45 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.12.01 08:34:45 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.12.01 08:34:45 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009.06.10 22:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DVDVideoSoftTB DE Toolbar) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (no name) - {2EECD738-5844-4a99-B4B6-146BF802613B} - No CLSID value found.
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O2 - BHO: (Skype Browser Helper) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB DE Toolbar) - {0027da2d-c9f2-4b0b-ae05-e2cd1bdb6cff} - C:\Program Files (x86)\DVDVideoSoftTB_DE\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (DVDVideoSoftTB Toolbar) - {872b5b88-9db5-4310-bdd0-ac189557e5f5} - C:\Program Files (x86)\DVDVideoSoftTB\prxtbDVDV.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (no name) - {98889811-442D-49dd-99D7-DC866BE87DBC} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4 - HKCU..\Run: [DAEMON Tools Lite] C:\Program Files (x86)\DAEMON Tools Lite\DTLite.exe (DT Soft Ltd)
O4 - HKCU..\Run: [Steam] C:\Program Files (x86)\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\DjPenny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\CurseClientStartup.ccip ()
O4 - Startup: C:\Users\DjPenny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.4.1.lnk = C:\Program Files (x86)\OpenOffice.org 3\program\quickstart.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLUA = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DjPenny\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\DjPenny\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9:64bit: - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra Button: Skype Click to Call - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{D6A94F7E-47CE-43BF-94FA-4A2E09DFE358}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer x64\skypeieplugin.dll (Skype Technologies S.A.)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - AppInit_DLLs: (c:\progra~3\browse~1\261123~1.78\{16cdf~1\browse~1.dll) - c:\ProgramData\Browser Manager\2.6.1123.78\{16cdff19-861d-48e3-a751-d99a27784753}\browsemngr.dll ()
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (C:\PROGRA~3\0827911.bat) - C:\ProgramData\0827911.bat ()
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O33 - MountPoints2\{5b1783a0-4f36-11e2-93b0-e0cb4ec8a7e3}\Shell - "" = AutoRun
O33 - MountPoints2\{5b1783a0-4f36-11e2-93b0-e0cb4ec8a7e3}\Shell\AutoRun\command - "" = E:\RunGame.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
 
CREATERESTOREPOINT
Unable to start System Restore Service. Error code 1084
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.03.04 08:25:38 | 004,732,416 | ---- | C] (AVAST Software) -- C:\Users\DjPenny\Desktop\aswMBR.exe
[2013.03.04 08:22:26 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\DjPenny\Desktop\OTL.exe
[2013.03.03 15:05:06 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Fraps
[2013.03.01 12:36:53 | 000,000,000 | ---D | C] -- C:\Users\DjPenny\Documents\My Cheat Tables
[2013.03.01 12:35:54 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Cheat Engine 6.2
[2013.03.01 12:35:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Cheat Engine 6.2
[2013.02.26 07:55:24 | 000,071,680 | ---- | C] (Beepa P/L) -- C:\Windows\SysNative\frapsv64.dll
[2013.02.26 07:55:22 | 000,065,536 | ---- | C] (Beepa P/L) -- C:\Windows\SysWow64\frapsvid.dll
[2013.02.26 01:18:41 | 000,000,000 | ---D | C] -- C:\ProgramData\TERA
[2013.02.26 01:18:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
[2013.02.26 01:18:36 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\TERA
[2013.02.19 12:35:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Skype
[2013.02.19 12:35:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Skype
[2013.02.16 14:02:45 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Logs
[2013.02.08 19:30:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\searchplugins
[2013.02.08 19:30:42 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\Extensions
[2013.02.05 14:44:52 | 000,000,000 | ---D | C] -- C:\Users\DjPenny\Documents\SimCity 4
[2013.02.05 14:44:45 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Maxis
[2013.02.05 14:40:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Maxis
[2013.02.02 12:55:55 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\InstallShield
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.03.04 08:32:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.03.04 08:32:23 | 3220,529,152 | -HS- | M] () -- C:\hiberfil.sys
[2013.03.04 08:27:00 | 004,732,416 | ---- | M] (AVAST Software) -- C:\Users\DjPenny\Desktop\aswMBR.exe
[2013.03.04 08:22:28 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\DjPenny\Desktop\OTL.exe
[2013.03.04 08:21:19 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.03.04 08:21:19 | 000,014,016 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.03.04 08:16:52 | 095,023,320 | ---- | M] () -- C:\ProgramData\0827911.pad
[2013.03.03 20:15:28 | 000,015,144 | ---- | M] () -- C:\Users\DjPenny\Desktop\Bewerbung.odt
[2013.03.03 20:13:37 | 000,002,968 | ---- | M] () -- C:\Users\DjPenny\Documents\Bewerbung.odt
[2013.03.03 15:58:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.03.03 15:05:06 | 000,000,562 | ---- | M] () -- C:\Users\Public\Desktop\Fraps.lnk
[2013.03.01 18:39:51 | 000,002,782 | ---- | M] () -- C:\ProgramData\0827911.js
[2013.03.01 18:39:51 | 000,001,041 | ---- | M] () -- C:\Users\DjPenny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2013.03.01 18:39:51 | 000,000,153 | ---- | M] () -- C:\ProgramData\0827911.reg
[2013.03.01 18:39:51 | 000,000,062 | ---- | M] () -- C:\ProgramData\0827911.bat
[2013.03.01 18:39:49 | 000,094,208 | ---- | M] () -- C:\Users\DjPenny\1197280.dll
[2013.03.01 12:35:55 | 000,001,089 | ---- | M] () -- C:\Users\DjPenny\Desktop\Cheat Engine.lnk
[2013.02.28 23:29:52 | 000,000,847 | ---- | M] () -- C:\Users\DjPenny\Desktop\Demon Slayer - Anmeldeclient.lnk
[2013.02.26 07:55:24 | 000,071,680 | ---- | M] (Beepa P/L) -- C:\Windows\SysNative\frapsv64.dll
[2013.02.26 07:55:22 | 000,065,536 | ---- | M] (Beepa P/L) -- C:\Windows\SysWow64\frapsvid.dll
[2013.02.19 12:35:52 | 000,002,517 | ---- | M] () -- C:\Users\Public\Desktop\Skype.lnk
[2013.02.05 14:40:12 | 000,000,533 | ---- | M] () -- C:\Windows\eReg.dat
[2 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.03.03 20:13:43 | 000,015,144 | ---- | C] () -- C:\Users\DjPenny\Desktop\Bewerbung.odt
[2013.03.03 20:13:37 | 000,002,968 | ---- | C] () -- C:\Users\DjPenny\Documents\Bewerbung.odt
[2013.03.03 15:05:06 | 000,000,562 | ---- | C] () -- C:\Users\Public\Desktop\Fraps.lnk
[2013.03.01 18:39:51 | 000,002,782 | ---- | C] () -- C:\ProgramData\0827911.js
[2013.03.01 18:39:51 | 000,001,041 | ---- | C] () -- C:\Users\DjPenny\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\runctf.lnk
[2013.03.01 18:39:51 | 000,000,153 | ---- | C] () -- C:\ProgramData\0827911.reg
[2013.03.01 18:39:51 | 000,000,062 | ---- | C] () -- C:\ProgramData\0827911.bat
[2013.03.01 18:39:50 | 095,023,320 | ---- | C] () -- C:\ProgramData\0827911.pad
[2013.03.01 18:39:49 | 000,094,208 | ---- | C] () -- C:\Users\DjPenny\1197280.dll
[2013.03.01 12:35:55 | 000,001,089 | ---- | C] () -- C:\Users\DjPenny\Desktop\Cheat Engine.lnk
[2013.02.05 14:40:12 | 000,000,533 | ---- | C] () -- C:\Windows\eReg.dat
[2012.12.28 11:07:53 | 000,107,832 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.12.28 11:07:51 | 002,250,024 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2012.12.28 11:07:51 | 000,066,872 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.12.24 22:02:28 | 095,023,320 | ---- | C] () -- C:\ProgramData\dsgsdgdsgdsgw.pad
[2012.08.22 05:16:24 | 000,429,416 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
 
========== ZeroAccess Check ==========
 
[2009.07.14 05:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
 
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2009.07.14 02:41:54 | 014,161,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2009.07.14 02:16:14 | 012,866,560 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2009.07.14 02:15:20 | 000,605,696 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
 
========== LOP Check ==========
 
[2012.12.03 15:14:09 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\.minecraft
[2013.01.17 13:04:35 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\7road
[2012.12.01 23:23:10 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\com.aspiro.wimp.de.25F5C0086CDE1F22CA0B92A487729991CA6CD013.1
[2012.12.28 10:56:25 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\DAEMON Tools Lite
[2012.09.14 17:14:59 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\Downloaded Installations
[2012.11.10 07:57:24 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\DVDVideoSoft
[2012.11.10 07:57:18 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\DVDVideoSoftIEHelpers
[2013.01.09 22:40:20 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\Hi-Rez Studios
[2012.10.04 05:33:15 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\Leadertech
[2012.09.09 16:38:33 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\LolClient
[2012.10.05 12:09:02 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\OpenOffice.org
[2013.01.06 13:49:20 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\Origin
[2012.09.26 14:19:56 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\SplitMediaLabs
[2012.10.18 13:43:05 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\TeamViewer
[2013.03.03 14:17:55 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\TS3Client
[2013.02.08 14:26:31 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Roaming\uTorrent
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %SYSTEMDRIVE%\*. >
[2012.09.09 13:06:57 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin
[2011.11.20 11:50:00 | 000,000,000 | ---D | M] -- C:\alaplaya
[2012.07.17 11:14:02 | 000,000,000 | ---D | M] -- C:\Crash
[2010.10.05 20:20:55 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen
[2012.09.18 10:13:42 | 000,000,000 | ---D | M] -- C:\download
[2012.08.21 22:36:37 | 000,000,000 | -HSD | M] -- C:\found.000
[2011.04.29 17:19:06 | 000,000,000 | ---D | M] -- C:\Fraps
[2012.03.27 12:23:41 | 000,000,000 | ---D | M] -- C:\game
[2012.10.30 11:00:57 | 000,000,000 | ---D | M] -- C:\Games
[2011.04.09 00:54:51 | 000,000,000 | ---D | M] -- C:\Hotspot Shield
[2011.02.02 14:39:33 | 000,000,000 | RH-D | M] -- C:\MSOCache
[2012.04.10 02:42:29 | 000,000,000 | ---D | M] -- C:\Nexon
[2010.10.05 20:42:33 | 000,000,000 | ---D | M] -- C:\NVIDIA
[2009.07.14 04:20:08 | 000,000,000 | ---D | M] -- C:\PerfLogs
[2011.11.23 21:54:55 | 000,000,000 | ---D | M] -- C:\Poker
[2012.12.10 12:32:18 | 000,000,000 | R--D | M] -- C:\Program Files
[2013.03.01 12:35:52 | 000,000,000 | R--D | M] -- C:\Program Files (x86)
[2013.03.02 10:06:55 | 000,000,000 | -H-D | M] -- C:\ProgramData
[2010.10.05 20:20:55 | 000,000,000 | -HSD | M] -- C:\Programme
[2011.11.20 16:10:56 | 000,000,000 | ---D | M] -- C:\Programs
[2011.10.14 13:45:18 | 000,000,000 | ---D | M] -- C:\PWRD
[2012.09.09 13:04:33 | 000,000,000 | -HSD | M] -- C:\Recovery
[2012.07.19 02:35:46 | 000,000,000 | ---D | M] -- C:\Riot Games
[2012.07.21 09:16:41 | 000,000,000 | ---D | M] -- C:\Root
[2012.03.01 17:33:30 | 000,000,000 | ---D | M] -- C:\Spiele Christian
[2013.03.03 16:00:54 | 000,000,000 | -HSD | M] -- C:\System Volume Information
[2012.09.09 13:19:28 | 000,000,000 | ---D | M] -- C:\temp
[2012.10.30 11:00:41 | 000,000,000 | R--D | M] -- C:\Users
[2013.03.04 08:32:24 | 000,000,000 | ---D | M] -- C:\Windows
[2012.09.09 14:13:54 | 000,000,000 | ---D | M] -- C:\Windows.old
 
< %PROGRAMFILES%\*.exe >
 
< %LOCALAPPDATA%\*.exe >
 
< %systemroot%\*. /mp /s >
 
< %windir%\installer\*. /5 >
 
< %localappdata%\*. /5 >
[2013.03.04 08:07:54 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Local\Deployment
[2013.03.03 16:00:58 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Local\ElevatedDiagnostics
[2013.03.03 21:16:09 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Local\PMB Files
[2013.03.04 08:53:15 | 000,000,000 | ---D | M] -- C:\Users\DjPenny\AppData\Local\Temp

< End of report >
         

OTL Extras logfile created on: 04.03.2013 08:23:00 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\DjPenny\Downloads
64bit- Ultimate Edition  (Version = 6.1.7600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.7600.16385)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,79 Gb Available Physical Memory | 69,68% Memory free
8,00 Gb Paging File | 6,65 Gb Available in Paging File | 83,22% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 931,41 Gb Total Space | 553,05 Gb Free Space | 59,38% Space Free | Partition Type: NTFS
Drive E: | 641,28 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
 
Computer Name: DJPENNY-PC | User Name: DjPenny | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01  [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{16084072-3C78-4789-B653-10D36406BCF1}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{1A12469D-3542-4C5E-8DE2-F0331BE2EF60}" = lport=138 | protocol=17 | dir=in | app=system | 
"{1D79B6B2-AE9B-4F9F-B575-05FABF93372B}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{3170761A-5F5D-444C-8BA7-CF9E983424FB}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{3A8A9249-1D86-441E-A7D7-F98978AA51BF}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3B542162-69FA-4CEB-928E-77EEE07094F3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{43B4DFCB-C93E-4BC3-8E92-E7CE21816CFF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{50B28662-1DF9-47DF-B796-68A45321BB6F}" = lport=139 | protocol=6 | dir=in | app=system | 
"{51E53141-1D51-46FF-A1B9-F1A3770B3C51}" = lport=56175 | protocol=17 | dir=in | name=pando media booster | 
"{5FEEF3DA-5EA8-45F5-8850-80C64B886CAD}" = rport=137 | protocol=17 | dir=out | app=system | 
"{6553EE23-B452-4856-BD8C-51E700406E15}" = rport=139 | protocol=6 | dir=out | app=system | 
"{6D42F240-DD6A-4BC9-B814-3D950001FD73}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{7A08B4F1-BD80-41F1-9E7C-3200107C7B64}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{80A36439-956F-4904-85CA-200C602D43C3}" = lport=56175 | protocol=6 | dir=in | name=pando media booster | 
"{A204B8DA-A3CE-4CD1-982B-359A8BF5A770}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A67F5DA6-6F7E-4ED1-8B75-7FE200ECC0EF}" = rport=138 | protocol=17 | dir=out | app=system | 
"{A76BA776-DEA8-461F-A5C3-3C54A1ABB842}" = rport=445 | protocol=6 | dir=out | app=system | 
"{A90F7B95-4399-41C5-8186-0DAA9FBEBDED}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{C5989B5C-293B-4EF3-96B8-BE6405863A3B}" = lport=56175 | protocol=6 | dir=in | name=pando media booster | 
"{C8205326-A9BF-46BE-9719-BB88443387C5}" = lport=137 | protocol=17 | dir=in | app=system | 
"{D5B05371-7AD6-4B24-9991-597AD028EAED}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{DE32AF50-3B52-4301-9E7A-4CCCD531D578}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{E2129CA0-33EE-43D3-8D57-8C778CA4DF7F}" = lport=56175 | protocol=17 | dir=in | name=pando media booster | 
"{F7B0C07B-D38D-4525-8B48-63424D8886AE}" = lport=445 | protocol=6 | dir=in | app=system | 
"{F9F2D809-A574-4AFF-BA7E-62A44BF161FF}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{095A3B5D-4A0B-42FB-B857-9C98D9BDE261}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{09A1A75F-D7BD-4E53-A54E-C1B95A3935F7}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\global agenda live\binaries\launcherbin\hirezlauncherui.exe | 
"{0D86FFE2-834B-4DB0-A91D-211098182897}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\jedi academy\gamedata\jamp.exe | 
"{0DC71C44-50B2-4A76-B0BD-03B06ED02F44}" = protocol=6 | dir=out | app=system | 
"{1D3AF02C-905A-4DEE-8B9F-A81FABA33A8B}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{1D501D98-287B-4E55-A3C4-2D3F49F5A015}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{1D731ECB-01AC-480F-B38F-5479F75ED7B6}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{1F0EA10C-ABEC-40CB-9D2E-43C1F62D9E9C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{1F19FF17-4070-4176-9F91-3E9621740BD9}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe | 
"{206004C4-FC6C-4205-8324-F9AC2E8060FB}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{24231D28-E6CA-48C3-AE3D-22268DCC3920}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\fc2editor.exe | 
"{243AFC73-0F83-447C-B481-7815F55DDA4C}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe | 
"{273A9F30-677F-41C2-BECB-745679EB3186}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe | 
"{287A87B1-3C03-4C94-844E-7387CCFE7BE0}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6sp.exe | 
"{28C7893D-8073-4DBF-B5FC-5FCFCE9D6261}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{2FEBB923-7F1F-4A24-97ED-58D2F52F07E2}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"{301514DB-FB06-44A3-A07F-FC814C4F34D5}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | 
"{31373CDE-F590-483E-8C8B-BB21ACFE2561}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | 
"{3273FD9A-2A08-47A4-B3F3-DBC689821136}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 
"{3ADBA73E-A7D3-42ED-9DE4-4898C8DCD4AA}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{3BDDFAEE-253B-4EC9-8367-80EAE74620A3}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\risen 2\system\risen2.exe | 
"{455364D9-297E-4E8D-9118-FF1D7B0ED520}" = protocol=6 | dir=in | app=c:\games\star wars-the old republic\launcher.exe | 
"{45C74148-D926-4339-A36C-F5F0645E1D32}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{4D2842CD-5464-4287-83D2-BFB9C9BB2C61}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{4F6A1B05-71B3-47B6-861B-2199CA96E8EE}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6mp.exe | 
"{4F9E48D6-94F5-4E78-B63D-60ACBF1905D3}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | 
"{4FC5A7B5-37EE-43A4-8EF2-4A3AA926BC05}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{50570BF3-09EA-46FD-9CA4-C69DB38EBACC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{506153E3-1BFC-4472-ABC5-20077BAC0EE9}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe | 
"{50E21BA8-5B64-4D05-BC75-EBD81D61BA44}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\farcry2.exe | 
"{50F8CA18-FE31-43EC-8014-59118B439BB8}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\fc2launcher.exe | 
"{51107B9F-6D47-436F-9EFA-E88BD7D776FC}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6zm.exe | 
"{57E20570-BEB4-4438-B72E-AB97FD1DA267}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{5867290A-417F-45F9-A98D-F6BC85BBAE51}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{5BC25F28-A17D-480D-A56C-684236BE2D88}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | 
"{5DE515D3-FE7E-4D73-A011-52BFCA2DCE56}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{5F5E066B-CC43-40B5-B739-3C5075A381B2}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{5FFA2131-F41F-4267-8AB5-AEF8AF4CF21B}" = protocol=17 | dir=in | app=c:\users\djpenny\appdata\local\apps\2.0\g9nhma2e.nen\pztn4hcp.w8j\curs..tion_9e9e83ddf3ed3ead_0005.0001_f88ee66177b243ac\curseclient.exe | 
"{60B7BA24-6D7B-415C-99B9-9A702DF52D12}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6zm.exe | 
"{637E4A59-F535-436A-B6DC-6AA840FAB517}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\farcry2.exe | 
"{645A2310-CC23-4C2E-B2E3-1B68455F10E8}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{6D91C085-C70D-4B8B-AC97-24309602DA1D}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | 
"{6E08AC65-0676-4423-A590-6E7E3914B7FC}" = protocol=17 | dir=in | app=c:\games\star wars-the old republic\launcher.exe | 
"{70B1F737-5E0D-4B07-AF78-5DFBA391B3D0}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\crazyp226\counter-strike source\hl2.exe | 
"{742B5FF9-4F5B-42CD-8808-18416C1468EC}" = protocol=6 | dir=in | app=c:\users\djpenny\appdata\local\apps\2.0\g9nhma2e.nen\pztn4hcp.w8j\curs..tion_9e9e83ddf3ed3ead_0005.0001_f98d05d4713e76ec\curseclient.exe | 
"{75B56DDC-54E9-4F2B-857B-443924AC8762}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{77599DD0-7C0D-49C6-BF92-233B8706A05F}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5mp.exe | 
"{7AF71323-DB9E-4E10-A820-B94DDE747FDD}" = protocol=17 | dir=in | app=c:\games\star wars-the old republic\launcher.exe | 
"{7D2C8580-6BFD-42AB-BC5C-CF4687A1C38D}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"{80C2346B-1CD2-4709-8FE5-98F6F88230C7}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{80CB72E2-2C2D-4CC3-B3F1-DF5A19F3F534}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{87FBFBF6-00C1-4866-B16A-035040A4E8B8}" = protocol=6 | dir=in | app=c:\users\djpenny\appdata\local\apps\2.0\g9nhma2e.nen\pztn4hcp.w8j\curs..tion_9e9e83ddf3ed3ead_0005.0001_f88ee66177b243ac\curseclient.exe | 
"{8C1A29D6-FCB3-4B9D-B30C-B92A4CA86C71}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{8E86AE70-D508-4088-9D97-7F9493B68B51}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{9B1110DA-8911-458C-84C5-B65DB3515367}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\dota 2 beta\dota.exe | 
"{9D711DBC-35BA-469A-9208-B3CFD8AA52BD}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6mp.exe | 
"{A1641AC2-6CC3-4E5D-96DA-D7547E19CA0D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\skyrim\skyrimlauncher.exe | 
"{A2896D63-ECD2-484C-B7E0-6235F02FFFE1}" = protocol=6 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{A53CF8AD-4C9F-494B-8FB1-8CB89BF61F79}" = protocol=17 | dir=in | app=c:\users\djpenny\appdata\local\apps\2.0\g9nhma2e.nen\pztn4hcp.w8j\curs..tion_9e9e83ddf3ed3ead_0005.0001_f98d05d4713e76ec\curseclient.exe | 
"{A7EDB7BC-5483-4243-B32B-9B7F88C7D269}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\left 4 dead 2\left4dead2.exe | 
"{A9DEC494-A3A8-42CD-BA13-9C4D33649C83}" = protocol=17 | dir=in | app=c:\program files (x86)\diablo iii\diablo iii.exe | 
"{AA3E157C-406A-4DA5-9734-36555EE260FF}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe | 
"{AA78AC4D-8945-4E2A-B464-91E536E299CA}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{AB7535E8-502A-482E-8DA8-8EE1E1F73097}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"{AB7C1F6E-8D27-4879-8341-95049089EC85}" = protocol=17 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer.exe | 
"{B067D2B3-4E93-4213-8ED1-719CB99C5EB4}" = protocol=6 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | 
"{B186A7C1-1664-4078-965E-6753C28ABB0F}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{B1B8D6EC-A74E-43CD-95EE-E02D690207FE}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\magicka\magicka.exe | 
"{B30B6EE9-331F-4B0B-85F4-DE224E9A855A}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | 
"{B7B3AED9-6468-401F-A435-61387F7AD928}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\global agenda live\binaries\launcherbin\hirezlauncherui.exe | 
"{B90D2AD9-1176-4B57-80D0-5B0F412DA24C}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | 
"{BA5D78BF-C263-471B-B982-EF3C94C95A16}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty modern warfare 3\iw5sp.exe | 
"{BB974668-C1CF-4F6A-9866-EA8BFBDA1441}" = protocol=6 | dir=in | app=c:\games\star wars-the old republic\launcher.exe | 
"{BC1DB84B-9FE9-45F2-A478-CAE9BDB28A77}" = protocol=6 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\fc2launcher.exe | 
"{BD977C2A-D042-40B8-AFC7-1ECD98D24532}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{BDAD1CF1-2766-4539-8710-DBB056594694}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\jedi academy\gamedata\jamp.exe | 
"{BF3F289C-4CC0-4637-8E42-925E48E2BBDD}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | 
"{C36CAA65-0A1E-44F5-9713-B9FA17375D60}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{C3C9F02C-5EB8-49EF-9B83-7CCC214980DD}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{C55F6B07-D0BF-407F-9A34-516D2995C27E}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1544\agent.exe | 
"{C5FBA7B3-63A9-47C0-9420-A0182505A840}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\call of duty black ops ii\t6sp.exe | 
"{C8905E7E-37E4-433D-82CD-8860B2DBFE67}" = protocol=17 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 
"{C9855BA7-019B-4DD9-B091-805E29D36D36}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe | 
"{CD8B5430-800D-43C6-B87D-F96F4088286B}" = protocol=17 | dir=in | app=c:\program files (x86)\ubisoft\far cry 2\bin\fc2editor.exe | 
"{CFB50B6D-4197-457F-AE50-7C45E7C4143B}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\risen 2\system\risen2.exe | 
"{D0C8E71E-6C0D-4B92-86F1-9E74F1E715EA}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\jedi academy\gamedata\jasp.exe | 
"{D0D7C0C9-7E0A-4284-AE04-6AFD2B9C2432}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii.exe | 
"{D1E72393-C847-42DF-BB64-B2E15B2426D5}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | 
"{D3107687-4DE2-4D9B-958B-185788807E91}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\metro 2033\metro2033.exe | 
"{D34CCF61-1CDD-4465-9D44-BA3A593663B5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{DCC9E0D9-3C21-4B3B-8894-8F7BF6D6928D}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe | 
"{DE5D0CEE-7F42-4242-86C4-C1BF75A3070F}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | 
"{E1BF2C74-405E-4C35-A8A6-AC918D36725D}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\crazyp226\counter-strike source\hl2.exe | 
"{E3825AF1-EBA9-49B0-84D8-792DF2B55706}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\metro 2033\metro2033.exe | 
"{E53FB41F-1680-4C87-A344-B2A5C1BE5C7E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe | 
"{EC5F6AB4-F2D0-45BF-9BB4-04A32D023958}" = protocol=17 | dir=in | app=c:\program files (x86)\utorrent\utorrent.exe | 
"{FCA4F050-BE2D-4540-8353-07BA06F8AF5F}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\jedi academy\gamedata\jasp.exe | 
"{FE71EAE2-C29B-4D8F-9182-4A0DF9459110}" = protocol=6 | dir=in | app=c:\program files (x86)\teamviewer\version8\teamviewer_service.exe | 
"{FF1B0F9E-323F-4FF0-86C1-BF8D1194E36A}" = protocol=6 | dir=in | app=c:\program files (x86)\starcraft ii\starcraft ii public test.exe | 
"TCP Query User{076FB058-362F-4E02-9983-9F898928B5EF}C:\program files (x86)\steam\steam.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"TCP Query User{0BEB9712-149C-4DA0-A311-8A8FCCF24F7D}C:\users\djpenny\downloads\downloader_warcraft3_the_frozen_throne_dede.exe" = protocol=6 | dir=in | app=c:\users\djpenny\downloads\downloader_warcraft3_the_frozen_throne_dede.exe | 
"TCP Query User{193349E9-572B-4D69-9C81-22DBB7196CAF}C:\program files (x86)\lolreplay\lolreplay.exe" = protocol=6 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe | 
"TCP Query User{1BE08A67-4F63-4322-B8E9-6833961D8F40}C:\program files (x86)\warcraft iii\war3.exe" = protocol=6 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe | 
"TCP Query User{2D8C76B6-AB98-44AD-AE2E-C960CB4FD549}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"TCP Query User{4F77525D-9E6C-4267-B480-43A87C8B5F7D}C:\program files\java\jre7\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"TCP Query User{6243F8D1-3A4F-4CF7-9442-A4CC011828C4}C:\users\djpenny\downloads\downloader_warcraft3_reign_of_chaos_dede.exe" = protocol=6 | dir=in | app=c:\users\djpenny\downloads\downloader_warcraft3_reign_of_chaos_dede.exe | 
"TCP Query User{B814F66B-1AD3-4592-AFD8-269C5B2ADD4C}C:\program files (x86)\steam\steamapps\common\global agenda live\binaries\globalagenda.exe" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\global agenda live\binaries\globalagenda.exe | 
"TCP Query User{BEB34F28-4282-4380-AA7D-D29A068BE6B5}C:\windows\system32\java.exe" = protocol=6 | dir=in | app=c:\windows\system32\java.exe | 
"TCP Query User{D00BE002-1547-427D-8E28-3D2FD7EB3265}C:\program files (x86)\tera\tera-launcher.exe" = protocol=6 | dir=in | app=c:\program files (x86)\tera\tera-launcher.exe | 
"UDP Query User{5AAE706E-2150-48A8-AD49-F9D55F229869}C:\program files (x86)\warcraft iii\war3.exe" = protocol=17 | dir=in | app=c:\program files (x86)\warcraft iii\war3.exe | 
"UDP Query User{77A61E35-FA56-4487-B476-F4ACA60DC3C7}C:\program files (x86)\steam\steamapps\common\global agenda live\binaries\globalagenda.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\global agenda live\binaries\globalagenda.exe | 
"UDP Query User{84A2A741-9597-4AF4-96E4-734C0FAB1C1F}C:\users\djpenny\downloads\downloader_warcraft3_the_frozen_throne_dede.exe" = protocol=17 | dir=in | app=c:\users\djpenny\downloads\downloader_warcraft3_the_frozen_throne_dede.exe | 
"UDP Query User{8DB3551D-EA75-4207-8B73-602DBE86E799}C:\program files (x86)\tera\tera-launcher.exe" = protocol=17 | dir=in | app=c:\program files (x86)\tera\tera-launcher.exe | 
"UDP Query User{B451CBCA-9186-41FD-9B21-DABC2D830AB5}C:\program files (x86)\lolreplay\lolreplay.exe" = protocol=17 | dir=in | app=c:\program files (x86)\lolreplay\lolreplay.exe | 
"UDP Query User{BE6A37D7-F820-4546-9D4E-64E1CA4A705D}C:\program files (x86)\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files (x86)\java\jre7\bin\javaw.exe | 
"UDP Query User{C4411436-48D3-4C7F-AB5B-A9E8686D17A3}C:\program files (x86)\steam\steam.exe" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | 
"UDP Query User{DAFE148A-1E6A-4D19-ABC4-52A34D097134}C:\windows\system32\java.exe" = protocol=17 | dir=in | app=c:\windows\system32\java.exe | 
"UDP Query User{DBCA6834-629B-4FF1-B112-9A45D648DA98}C:\program files\java\jre7\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre7\bin\javaw.exe | 
"UDP Query User{F97A999E-9667-4177-A4D4-41D23C23F244}C:\users\djpenny\downloads\downloader_warcraft3_reign_of_chaos_dede.exe" = protocol=17 | dir=in | app=c:\users\djpenny\downloads\downloader_warcraft3_reign_of_chaos_dede.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219
"{23170F69-40C1-2702-0920-000001000000}" = 7-Zip 9.20 (x64 edition)
"{26A24AE4-039D-4CA4-87B4-2F86417009FF}" = Java 7 Update 9 (64-bit)
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.02
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.02
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.02
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.02
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{CD95F661-A5C4-44F5-A6AA-ECDD91C240D3}" = WinZip 16.5
"Logitech Gaming Software" = Logitech Gaming Software 8.35
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"WinRAR archiver" = WinRAR 4.20 (64-Bit)
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08A25478-C5DD-4EA7-B168-3D687CA987FF}" = Die Sims™ 3 Traumsuite-Accessoires
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}" = Browser Manager
"{19BFDA5D-1FE2-4F25-97F9-1A79DD04EE20}" = Microsoft XNA Framework Redistributable 3.1
"{1C9B6173-6DC9-4EEE-9EFC-6BA115CFBE43}" = Die Sims™ 3 Diesel Accessoires
"{2303AEEA-0FA8-4AFD-80A9-8F86BA4B44D2}" = OpenOffice.org 3.4.1
"{26A24AE4-039D-4CA4-87B4-2F83217009FF}" = Java 7 Update 9
"{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{3F0D0ABE-CDAF-431A-00BC-CBBE018EA74E}" = SimCity 4 Deluxe
"{45057FCE-5784-48BE-8176-D9D00AF56C3C}" = Die Sims™ 3 Late Night
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4DAC7A70-AD1B-0946-8756-0C7F70D08329}" = WiMP 2.1.3
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.1
"{71828142-5A24-4BD0-97E7-976DA08CE6CF}" = Die Sims™ 3 Luxus-Accessoires
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7B11296A-F894-449C-8DF6-6AAAA7D4D118}" = Die Sims™ 3 Stadt-Accessoires
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{910F4A29-1134-49E0-AD8B-56E4A3152BD1}" = Die Sims™ 3 Traumkarrieren
"{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B2506E3-9A3F-45B5-96BF-509CAD584650}" = Die Sims™ 3 Katy Perry Süße Welt
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A2S166A0-F031-4E27-A057-C69733219434}_is1" = TERA
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch
"{B37DAFA5-717D-41F8-BDFB-3A4B68C0B3A1}" = Die Sims™ 3 Supernatural
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{BA26FFA5-6D47-47DB-BE56-34C357B5F8CC}" = Die Sims™ 3 Reiseabenteuer
"{C05D8CDB-417D-4335-A38C-A0659EDFD6B8}" = Die Sims™ 3
"{C12631C6-804D-4B32-B0DD-8A496462F106}" = Die Sims™ 3 Einfach tierisch
"{C3592426-531E-4110-911D-BFECE2CE284C}" = osu!
"{D68006E1-F774-4504-9ECF-03B67793C475}" = XSplit
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E6B88BD6-E4B2-4701-A648-B6DAC6E491CC}" = Die Sims™ 3 Lebensfreude
"{ED436EA8-4145-4703-AE5D-4D09DD24AF5A}" = Die Sims™ 3 Gib Gas-Accessoires
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F2835483-37F2-4123-B4FE-0E77D58447F2}" = Far Cry 2
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Cheat Engine 6.2_is1" = Cheat Engine 6.2
"com.aspiro.wimp.de.25F5C0086CDE1F22CA0B92A487729991CA6CD013.1" = WiMP 2.1.3
"DAEMON Tools Lite" = DAEMON Tools Lite
"Diablo II" = Diablo II
"Diablo III" = Diablo III
"DVDVideoSoftTB Toolbar" = DVDVideoSoftTB Toolbar
"DVDVideoSoftTB_DE Toolbar" = DVDVideoSoftTB DE Toolbar
"Fraps" = Fraps
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.11.35.1031
"LOLReplay" = LOLReplay
"Mozilla Firefox 19.0 (x86 de)" = Mozilla Firefox 19.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"StarCraft II" = StarCraft II
"Steam App 17020" = Global Agenda
"Steam App 202970" = Call of Duty: Black Ops II
"Steam App 202990" = Call of Duty: Black Ops II - Multiplayer
"Steam App 212910" = Call of Duty: Black Ops II - Zombies
"Steam App 240" = Counter-Strike: Source
"Steam App 40390" = Risen 2 - Dark Waters
"Steam App 42680" = Call of Duty: Modern Warfare 3
"Steam App 42690" = Call of Duty: Modern Warfare 3 - Multiplayer
"Steam App 42910" = Magicka
"Steam App 43110" = Metro 2033
"Steam App 550" = Left 4 Dead 2
"Steam App 570" = Dota 2
"Steam App 6020" = Star Wars Jedi Knight: Jedi Academy
"Steam App 72850" = The Elder Scrolls V: Skyrim
"Steam App 730" = Counter-Strike: Global Offensive
"TeamViewer 8" = TeamViewer 8
"uTorrent" = µTorrent
"Warcraft III" = Warcraft III
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"101a9f93b8f0bb6f" = Curse Client
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 25.02.2013 19:33:12 | Computer Name = DjPenny-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: League of Legends.exe, Version: 3.2.0.40,
 Zeitstempel: 0x51254b8f  Name des fehlerhaften Moduls: unknown, Version: 0.0.0.0,
 Zeitstempel: 0x00000000  Ausnahmecode: 0xc0000005  Fehleroffset: 0x5b000000  ID des fehlerhaften
 Prozesses: 0x14e4  Startzeit der fehlerhaften Anwendung: 0x01ce13ab9cabefda  Pfad der
 fehlerhaften Anwendung: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.214\deploy\League
 of Legends.exe  Pfad des fehlerhaften Moduls: unknown  Berichtskennung: b7e90fc2-7fa3-11e2-a2af-e0cb4ec8a7e3
 
Error - 26.02.2013 19:42:49 | Computer Name = DjPenny-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\SplitMediaLabs\XSplit\XSplitBroadcasterSrc.exe".  Die abhängige Assemblierung
 "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0"" konnte nicht gefunden
 werden.  Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
Error - 27.02.2013 09:35:14 | Computer Name = DjPenny-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: League of Legends.exe, Version: 3.2.0.40,
 Zeitstempel: 0x51254b8f  Name des fehlerhaften Moduls: ntdll.dll, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bdb3b  Ausnahmecode: 0xc0000005  Fehleroffset: 0x00038c39  ID des fehlerhaften
 Prozesses: 0x6cc  Startzeit der fehlerhaften Anwendung: 0x01ce14eef3101636  Pfad der
 fehlerhaften Anwendung: C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.214\deploy\League
 of Legends.exe  Pfad des fehlerhaften Moduls: C:\Windows\SysWOW64\ntdll.dll  Berichtskennung:
 83ee72a9-80e2-11e2-8f3c-e0cb4ec8a7e3
 
Error - 28.02.2013 13:51:52 | Computer Name = DjPenny-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\SplitMediaLabs\XSplit\XSplitBroadcasterSrc.exe".  Die abhängige Assemblierung
 "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0"" konnte nicht gefunden
 werden.  Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
Error - 01.03.2013 03:29:35 | Computer Name = DjPenny-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: Skype.exe, Version: 6.1.0.129, Zeitstempel:
 0x50ec1757  Name des fehlerhaften Moduls: Skype.exe, Version: 6.1.0.129, Zeitstempel:
 0x50ec1757  Ausnahmecode: 0xc0000005  Fehleroffset: 0x001ada10  ID des fehlerhaften Prozesses:
 0xb3c  Startzeit der fehlerhaften Anwendung: 0x01ce164e7a35fcde  Pfad der fehlerhaften
 Anwendung: C:\Program Files (x86)\Skype\Phone\Skype.exe  Pfad des fehlerhaften Moduls:
 C:\Program Files (x86)\Skype\Phone\Skype.exe  Berichtskennung: c3a71bd7-8241-11e2-b7de-e0cb4ec8a7e3
 
Error - 01.03.2013 03:51:01 | Computer Name = DjPenny-PC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: sc.exe, Version: 6.1.7600.16385, 
Zeitstempel: 0x4a5bc3c1  Name des fehlerhaften Moduls: ADVAPI32.dll, Version: 6.1.7600.16385,
 Zeitstempel: 0x4a5bde6b  Ausnahmecode: 0xc0000005  Fehleroffset: 0x0000000000021a1f
ID
 des fehlerhaften Prozesses: 0x7e8  Startzeit der fehlerhaften Anwendung: 0x01ce165183d1404e
Pfad
 der fehlerhaften Anwendung: C:\Windows\system32\sc.exe  Pfad des fehlerhaften Moduls:
 C:\Windows\system32\ADVAPI32.dll  Berichtskennung: c274e8a5-8244-11e2-b7de-e0cb4ec8a7e3
 
Error - 02.03.2013 11:47:39 | Computer Name = DjPenny-PC | Source = Application Hang | ID = 1002
Description = Programm League of Legends.exe, Version 3.3.0.199 kann nicht mehr 
unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
 in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
 zu suchen.    Prozess-ID: 1840    Startzeit: 01ce175d3cc0cfc8    Endzeit: 12    Anwendungspfad:
 C:\Riot Games\League of Legends\RADS\solutions\lol_game_client_sln\releases\0.0.0.217\deploy\League
 of Legends.exe    Berichts-ID: 7f456a5a-8350-11e2-b42d-e0cb4ec8a7e3  
 
Error - 02.03.2013 14:21:35 | Computer Name = DjPenny-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\SplitMediaLabs\XSplit\XSplitBroadcasterSrc.exe".  Die abhängige Assemblierung
 "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0"" konnte nicht gefunden
 werden.  Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
Error - 02.03.2013 18:58:57 | Computer Name = DjPenny-PC | Source = MsiInstaller | ID = 11609
Description = 
 
Error - 03.03.2013 07:53:32 | Computer Name = DjPenny-PC | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "C:\Program Files
 (x86)\SplitMediaLabs\XSplit\XSplitBroadcasterSrc.exe".  Die abhängige Assemblierung
 "Native.XSplitBroadcaster.exe,type="win32",version="1.0.0.0"" konnte nicht gefunden
 werden.  Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".
 
Error - 04.03.2013 03:25:45 | Computer Name = DjPenny-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "C:\Users\DjPenny\Downloads\SoftonicDownloader_fuer_star-wars-an-empire-at-war.exe".
 Fehler in  Manifest- oder Richtliniendatei "" in Zeile .  Eine für die Anwendung erforderliche
 Komponentenversion steht in Konflikt mit  einer anderen, bereits aktiven Komponentenversion.
In
 Konflikt stehende Komponenten:.  Komponente 1: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_421189da2b7fabfc.manifest.
Komponente
 2: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7600.16385_none_fa645303170382f6.manifest.
 
[ System Events ]
Error - 13.02.2013 15:29:26 | Computer Name = DjPenny-PC | Source = Schannel | ID = 36887
Description = Es wurde eine schwerwiegende Warnung empfangen: 40.
 
Error - 13.02.2013 17:28:10 | Computer Name = DjPenny-PC | Source = Schannel | ID = 36887
Description = Es wurde eine schwerwiegende Warnung empfangen: 40.
 
Error - 17.02.2013 05:05:26 | Computer Name = DjPenny-PC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Search" wurde nicht richtig gestartet.
 
Error - 23.02.2013 21:47:26 | Computer Name = DjPenny-PC | Source = Service Control Manager | ID = 7023
Description = Der Dienst "Windows-Zeitgeber" wurde mit folgendem Fehler beendet:
   %%1115
 
Error - 28.02.2013 14:04:13 | Computer Name = DjPenny-PC | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 28.02.2013 14:07:01 | Computer Name = DjPenny-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 28.02.2013 14:13:25 | Computer Name = DjPenny-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 28.02.2013 14:16:56 | Computer Name = DjPenny-PC | Source = Disk | ID = 262151
Description = Fehlerhafter Block bei Gerät \Device\Harddisk0\DR0.
 
Error - 01.03.2013 03:28:24 | Computer Name = DjPenny-PC | Source = Service Control Manager | ID = 7009
Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst
 Windows Search erreicht.
 
Error - 01.03.2013 03:28:24 | Computer Name = DjPenny-PC | Source = Service Control Manager | ID = 7000
Description = Der Dienst "Windows Search" wurde aufgrund folgenden Fehlers nicht
 gestartet:   %%1053
 
 
< End of report >
         

aswMBR version 0.9.9.1707 Copyright(c) 2011 AVAST Software
Run date: 2013-03-04 08:59:17
-----------------------------
08:59:17.616    OS Version: Windows x64 6.1.7600 
08:59:17.616    Number of processors: 4 586 0x170A
08:59:17.616    ComputerName: DJPENNY-PC  UserName: DjPenny
08:59:18.739    Initialize success
09:00:15.991    AVAST engine defs: 13030301
09:00:30.109    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP2T0L0-4
09:00:30.109    Disk 0 Vendor: Hitachi_HDT721010SLA360 ST6OA3AA Size: 953869MB BusType: 3
09:00:30.124    Disk 0 MBR read successfully
09:00:30.124    Disk 0 MBR scan
09:00:30.124    Disk 0 Windows 7 default MBR code
09:00:30.140    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
09:00:30.156    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS       953767 MB offset 206848
09:00:30.187    Disk 0 scanning C:\Windows\system32\drivers
09:00:36.692    Service scanning
09:00:57.768    Modules scanning
09:00:57.768    Disk 0 trace - called modules:
09:00:57.783    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS intelide.sys PCIIDEX.SYS hal.dll atapi.sys 
09:00:57.783    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80046dd060]
09:00:57.783    3 CLASSPNP.SYS[fffff8800185143f] -> nt!IofCallDriver -> [0xfffffa800436a9b0]
09:00:57.799    5 ACPI.sys[fffff88000f1e781] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP2T0L0-4[0xfffffa8004473060]
09:00:59.063    AVAST engine scan C:\Windows
09:01:00.716    AVAST engine scan C:\Windows\system32
09:03:16.920    AVAST engine scan C:\Windows\system32\drivers
09:03:55.124    AVAST engine scan C:\Users\DjPenny
09:03:55.358    File: C:\Users\DjPenny\1197280.dll  **INFECTED** Win32:Reveton-NE [Trj]
09:05:03.000    File: C:\Users\DjPenny\AppData\Local\Temp\InstallShare16149\gutscheinfilter_q.exe  **INFECTED** Win32:Dropper-LTF [Drp]
09:05:15.324    File: C:\Users\DjPenny\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\1ede2ede-57c970d5  **INFECTED** Win32:Rootkit-gen [Rtk]
09:09:52.459    AVAST engine scan C:\ProgramData
09:12:04.466    Scan finished successfully
09:12:22.016    Disk 0 MBR has been saved successfully to "C:\Users\DjPenny\Desktop\MBR.dat"
09:12:22.016    The log file has been saved successfully to "C:\Users\DjPenny\Desktop\aswMBR.txt"