Code:
OTL logfile created on: 30.04.2011 17:32:38 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\XXX\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 57,05 Gb Free Space | 24,50% Space Free | Partition Type: NTFS
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
PRC - C:\Program Files\Steam\Steam.exe (Valve Corporation)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
PRC - C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
PRC - C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
PRC - C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
PRC - C:\Program Files\Unlocker\UnlockerAssistant.exe ()
PRC - C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
PRC - C:\Program Files\Avira\AntiVir Desktop\avshadow.exe (Avira GmbH)
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
PRC - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
PRC - C:\Program Files\Logitech\SetPoint\SetPoint.exe (Logitech, Inc.)
PRC - C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
PRC - C:\Program Files\Common Files\Logishrd\KHAL2\KHALMNPR.exe (Logitech, Inc.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.bin (OpenOffice.org)
PRC - C:\Program Files\OpenOffice.org 3\program\soffice.exe (OpenOffice.org)
PRC - C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
PRC - C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
PRC - C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
PRC - C:\Program Files\DT\Speedport W 100 Stick\Wifiusb.exe (TECOM)
========== Modules (SafeList) ==========
MOD - C:\Users\XXX\Downloads\OTL.exe (OldTimer Tools)
MOD - C:\Windows\winsxs\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.6002.18305_none_5cb72f2a088b0ed3\comctl32.dll (Microsoft Corporation)
========== Win32 Services (SafeList) ==========
SRV - (Steam Client Service) -- C:\Program Files\Common Files\Steam\SteamService.exe (Valve Corporation)
SRV - (TeamViewer6) -- C:\Program Files\TeamViewer\Version6\TeamViewer_Service.exe (TeamViewer GmbH)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (Hamachi2Svc) -- C:\Program Files\LogMeIn Hamachi\hamachi-2.exe (LogMeIn Inc.)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (ICQ Service) -- C:\Program Files\ICQ6Toolbar\ICQ Service.exe ()
SRV - (npggsvc) -- C:\Windows\System32\GameMon.des (INCA Internet Co., Ltd.)
SRV - (nSvcIp) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcIp.exe ()
SRV - (ForceWare Intelligent Application Manager (IAM)) ForceWare Intelligent Application Manager (IAM) -- C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nSvcAppFlt.exe ()
SRV - (LBTServ) -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe (Logitech, Inc.)
SRV - (Stereo Service) -- C:\Program Files\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe (NVIDIA Corporation)
SRV - (AVM WLAN Connection Service) -- C:\Program Files\avmwlanstick\WLanNetService.exe (AVM Berlin)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\MpSvc.dll (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (atksgt) -- C:\Windows\System32\drivers\atksgt.sys ()
DRV - (lirsgt) -- C:\Windows\System32\drivers\lirsgt.sys ()
DRV - (atikmdag) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (hamachi) -- C:\Windows\System32\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (NVNET) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (NVENETFD) -- C:\Windows\System32\drivers\nvmfdx32.sys (NVIDIA Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (nvsmu) -- C:\Windows\System32\drivers\nvsmu.sys (NVIDIA Corporation)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (LMouKE) -- C:\Windows\System32\drivers\LMouKE.Sys (Logitech, Inc.)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (L8042mou) -- C:\Windows\System32\drivers\L8042mou.Sys (Logitech, Inc.)
DRV - (L8042Kbd) -- C:\Windows\System32\drivers\L8042Kbd.sys (Logitech, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (fwlanusbn) -- C:\Windows\System32\drivers\fwlanusbn.sys (AVM GmbH)
DRV - (avmeject) -- C:\Windows\System32\drivers\avmeject.sys (AVM Berlin)
DRV - (sfdrv01) StarForce Protection Environment Driver (version 1.x) -- C:\Windows\System32\drivers\sfdrv01.sys (Protection Technology (StarForce))
DRV - (sfhlp02) StarForce Protection Helper Driver (version 2.x) -- C:\Windows\System32\drivers\sfhlp02.sys (Protection Technology (StarForce))
DRV - (sfvfs02) StarForce Protection VFS Driver (version 2.x) -- C:\Windows\System32\drivers\sfvfs02.sys (Protection Technology)
DRV - (PRISM_A02) -- C:\Windows\System32\drivers\PRISMA02.sys (Conexant Systems, Inc.)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKLM\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKLM\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://search.qip.ru
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Secondary Start Pages = [Binary data over 100 bytes]
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://search.conduit.com?SearchSource=10&ctid=CT2475029
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = hxxp://search.qip.ru/ie
IE - HKCU\..\URLSearchHook: - Reg Error: Key error. File not found
IE - HKCU\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKCU\..\URLSearchHook: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
IE - HKCU\..\URLSearchHook: {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "QIP Search"
FF - prefs.js..browser.search.defaultthis.engineName: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.search.defaulturl: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&SearchSource=3&q={searchTerms}"
FF - prefs.js..browser.search.order.1: "Search the web (Babylon)"
FF - prefs.js..browser.search.selectedEngine: "MyAshampoo Customized Web Search"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..extensions.enabledItems: {59c81df5-4b7a-477b-912d-4e0fdf64e5f2}:0.9.86.1
FF - prefs.js..extensions.enabledItems: {e4a8a97b-f2ed-450b-b12d-ee082ba24781}:0.9.2
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1
FF - prefs.js..extensions.enabledItems: {7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}:1.1.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20
FF - prefs.js..extensions.enabledItems: {b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}:6.0.21
FF - prefs.js..extensions.enabledItems: {32a1fd71-835e-4b11-8e54-886fda0b4c89}:1.1
FF - prefs.js..extensions.enabledItems: engine@conduit.com:3.3.3.2
FF - prefs.js..extensions.enabledItems: {a1e75a0e-4397-4ba8-bb50-e19fb66890f4}:3.3.3.2
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.6
FF - prefs.js..keyword.URL: "hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2475029&q="
FF - prefs.js..network.proxy.backup.ftp: ""
FF - prefs.js..network.proxy.backup.ftp_port: 0
FF - prefs.js..network.proxy.backup.gopher: ""
FF - prefs.js..network.proxy.backup.gopher_port: 0
FF - prefs.js..network.proxy.backup.socks: ""
FF - prefs.js..network.proxy.backup.socks_port: 0
FF - prefs.js..network.proxy.backup.ssl: ""
FF - prefs.js..network.proxy.backup.ssl_port: 0
FF - prefs.js..network.proxy.ftp: "128.220.231.4"
FF - prefs.js..network.proxy.ftp_port: 3124
FF - prefs.js..network.proxy.gopher: "128.220.231.4"
FF - prefs.js..network.proxy.gopher_port: 3124
FF - prefs.js..network.proxy.share_proxy_settings: true
FF - prefs.js..network.proxy.socks: "128.220.231.4"
FF - prefs.js..network.proxy.socks_port: 3124
FF - prefs.js..network.proxy.ssl: "128.220.231.4"
FF - prefs.js..network.proxy.ssl_port: 3124
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2011.04.30 10:45:01 | 000,000,000 | ---D | M]
FF - HKLM\software\mozilla\Mozilla Firefox 4.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2011.04.30 10:44:57 | 000,000,000 | ---D | M]
[2009.01.07 01:06:14 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Extensions
[2011.04.29 11:44:28 | 000,000,000 | ---D | M] (No name found) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions
[2011.02.01 00:44:57 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{20a82645-c095-46ed-80e3-08825760534b}
[2010.09.18 10:16:59 | 000,000,000 | ---D | M] (QipAuthorizer) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{32a1fd71-835e-4b11-8e54-886fda0b4c89}
[2011.04.29 09:54:13 | 000,000,000 | ---D | M] (ChatZilla [de]) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{59c81df5-4b7a-477b-912d-4e0fdf64e5f2}
[2011.02.01 00:44:50 | 000,000,000 | ---D | M] (Destroy the Web) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{7BDB48D1-CD94-4B99-A5A4-E418B9EE6532}
[2011.04.29 09:54:19 | 000,000,000 | ---D | M] (MyAshampoo Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{a1e75a0e-4397-4ba8-bb50-e19fb66890f4}
[2010.05.31 16:58:33 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}
[2011.04.29 09:54:16 | 000,000,000 | ---D | M] (myBabylon EnglishBB Community Toolbar) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{b2e293ee-fd7e-4c71-a714-5f4750d8d7b7}
[2011.04.22 17:50:11 | 000,000,000 | ---D | M] (Adblock Plus) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}
[2011.04.29 09:54:14 | 000,000,000 | ---D | M] (Greasemonkey) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}
[2011.04.29 09:54:18 | 000,000,000 | ---D | M] (Conduit Engine) -- C:\Users\XXX\AppData\Roaming\mozilla\Firefox\Profiles\n3jvvnj1.default\extensions\engine@conduit.com
[2010.12.15 17:12:32 | 000,000,923 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\conduit.xml
[2011.04.24 22:15:50 | 000,001,056 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\icqplugin.xml
[2010.10.14 12:52:01 | 000,002,062 | ---- | M] () -- C:\Users\XXX\AppData\Roaming\Mozilla\Firefox\Profiles\n3jvvnj1.default\searchplugins\qip-search.xml
[2011.04.30 10:45:01 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\Mozilla Firefox\extensions
[2010.07.16 11:56:32 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}
[2010.08.21 11:14:49 | 000,000,000 | ---D | M] (Java Console) -- C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA}
File not found (No name found) --
[2011.04.14 18:40:03 | 000,142,296 | ---- | M] (Mozilla Foundation) -- C:\Program Files\Mozilla Firefox\components\browsercomps.dll
[2010.07.17 05:00:04 | 000,423,656 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\Mozilla Firefox\plugins\npdeployJava1.dll
[2010.01.01 10:00:00 | 000,001,392 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\amazondotcom-de.xml
[2010.08.02 14:40:19 | 000,002,226 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\babylon.xml
[2010.01.01 10:00:00 | 000,002,252 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\bing.xml
[2010.01.01 10:00:00 | 000,001,153 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\eBay-de.xml
[2010.01.01 10:00:00 | 000,006,805 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\leo_ende_de.xml
[2010.01.01 10:00:00 | 000,001,178 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\wikipedia-de.xml
[2010.01.01 10:00:00 | 000,001,105 | ---- | M] () -- C:\Program Files\Mozilla Firefox\searchplugins\yahoo-de.xml
O1 HOSTS File: ([2006.09.18 23:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O1 - Hosts: ::1 localhost
O2 - BHO: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O2 - BHO: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O2 - BHO: (QIPBHO Class) - {A55F9C95-2BB1-4EA2-BC77-DFAAB78832CE} - C:\Users\XXX\AppData\Roaming\Microsoft\Internet Explorer\qipsearchbar.dll (qip.ru)
O3 - HKLM\..\Toolbar: (Conduit Engine) - {30F9B915-B755-4826-820B-08FBA6BD249D} - C:\Program Files\ConduitEngine\ConduitEngine.dll (Conduit Ltd.)
O3 - HKLM\..\Toolbar: (ICQToolBar) - {855F3B16-6D32-4FE6-8A56-BBB695989046} - C:\Program Files\ICQ6Toolbar\ICQToolBar.dll (ICQ)
O3 - HKLM\..\Toolbar: (MyAshampoo Toolbar) - {a1e75a0e-4397-4ba8-bb50-e19fb66890f4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O3 - HKCU\..\Toolbar\WebBrowser: (MyAshampoo Toolbar) - {A1E75A0E-4397-4BA8-BB50-E19FB66890F4} - C:\Program Files\MyAshampoo\tbMyAs.dll (Conduit Ltd.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files\avmwlanstick\WLanGUI.exe (AVM Berlin)
O4 - HKLM..\Run: [Kernel and Hardware Abstraction Layer] C:\Windows\KHALMNPR.Exe (Logitech, Inc.)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] C:\Program Files\LogMeIn Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [UnlockerAssistant] C:\Program Files\Unlocker\UnlockerAssistant.exe ()
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKCU..\Run: [auditask] File not found
O4 - HKCU..\Run: [Steam] C:\Program Files\Steam\steam.exe (Valve Corporation)
O4 - Startup: C:\Users\XXX\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe ()
O8 - Extra context menu item: Free YouTube Download - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\youtubedownload.htm ()
O8 - Extra context menu item: Free YouTube to Mp3 Converter - C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O9 - Extra Button: ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.2 - {72EFBFE4-C74F-4187-AEFD-73EA3BE968D6} - C:\Program Files\ICQ7.2\ICQ.exe (ICQ, LLC.)
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000005 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000006 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000017 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O10 - Protocol_Catalog9\Catalog_Entries\000000000018 - C:\Program Files\NVIDIA Corporation\NetworkAccessManager\bin32\nvLsp.dll (NVIDIA)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-0016-0000-0001-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_01-windows-i586.cab (Java Plug-in 1.6.0_01)
O16 - DPF: {CAFEEFAC-0016-0000-0021-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_21-windows-i586.cab (Java Plug-in 1.6.0_21)
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} hxxp://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab (Oberon Flash Game Host)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\XXX\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{2093246f-dc05-11dd-8eff-001e90f7e9a3}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{27a4deb1-eca6-11de-9468-001c4afc5051}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell - "" = AutoRun
O33 - MountPoints2\{3606af13-828e-11de-bdcc-001c4afc5051}\Shell\AutoRun\command - "" = E:\LaunchU3.exe -a
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\AutoRun\command - "" = I:\installer.exe
O33 - MountPoints2\{823e65cf-ca16-11de-9806-00191548cc45}\Shell\verb\command - "" = I:\installer.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\AutoRun\command - "" = L:\autorun.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\directx\command - "" = L:\DirectX9\dxsetup.exe
O33 - MountPoints2\{90ec5506-0b2b-11de-ac5a-001e90f7e9a3}\Shell\setup\command - "" = L:\setup.exe
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell - "" = AutoRun
O33 - MountPoints2\{af9c9acf-4235-11df-ab32-001e90f7e9a3}\Shell\AutoRun\command - "" = K:\pushinst.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\pushinst.exe
O34 - HKLM BootExecute: (autocheck autochk *) - File not found
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
========== Files/Folders - Created Within 30 Days ==========
[2011.04.30 17:00:33 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\Malwarebytes
[2011.04.30 17:00:22 | 000,038,224 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbamswissarmy.sys
[2011.04.30 17:00:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\Malwarebytes' Anti-Malware
[2011.04.30 17:00:21 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2011.04.30 17:00:18 | 000,020,952 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2011.04.30 17:00:17 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2011.04.30 14:14:46 | 000,000,000 | ---D | C] -- C:\Program Files\Deep Silver
[2011.04.30 14:13:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\Deep Silver
[2011.04.30 13:18:02 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{ADC7B78E-C2D0-4BC1-8454-C1571DBFA712}
[2011.04.30 11:49:01 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\bitComposer Games
[2011.04.30 11:48:51 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Roaming\ProtectDISC
[2011.04.30 11:45:36 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programme\bitComposer Games
[2011.04.30 11:39:47 | 000,000,000 | ---D | C] -- C:\Program Files\bitComposer Games
[2011.04.29 23:31:44 | 000,000,000 | --SD | C] -- C:\Users\XXX\Desktop\Feelings
[2011.04.29 22:30:30 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5BE83DA6-9AF3-415D-81CE-182E14DE44AA}
[2011.04.27 12:42:11 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{C0EF2A53-44CD-4000-9251-86DEC5DC10FE}
[2011.04.27 11:23:59 | 004,240,384 | ---- | C] (Microsoft) -- C:\Windows\System32\GameUXLegacyGDFs.dll
[2011.04.27 11:23:59 | 000,028,672 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\Apphlpdm.dll
[2011.04.27 11:23:36 | 000,876,032 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\XpsPrint.dll
[2011.04.26 10:42:23 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{05C5AE65-6FDC-4543-83BA-E69A8A629E5F}
[2011.04.25 14:02:24 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{482AC479-AEAB-4231-82FB-D4948B7A1653}
[2011.04.24 18:59:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{2B075415-F68A-444D-8F24-2FA5FF01BBFD}
[2011.04.24 15:05:59 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\100DEADRABBITS_the american wet dream_xalaniconx@DIS
[2011.04.24 14:51:31 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\100DeadRabbits - Teeth
[2011.04.24 14:18:25 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Guardians
[2011.04.23 23:28:44 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5AC403B2-7548-4F0C-8171-7D7E52048DB4}
[2011.04.23 11:28:08 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{8DDAC91D-E5DA-4293-A810-7187B1E60BA1}
[2011.04.22 23:27:37 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{9085AAC8-98AB-453A-AEF1-AE6DEF16C948}
[2011.04.22 11:26:03 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{D88CF7C9-F665-437C-ABE9-2DA5C71E18E9}
[2011.04.21 19:38:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{35D3369E-B044-4644-8D38-9EA34716CD37}
[2011.04.20 22:33:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{6E1E6C04-96E8-4ACC-A6E3-FB23F9F86367}
[2011.04.20 10:32:16 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{BC16BF92-09F2-4566-9F81-E45DE69DF619}
[2011.04.19 16:26:55 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{3FF9804E-B80D-4DFD-91C6-56CB09E907EE}
[2011.04.18 16:18:30 | 004,223,008 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\NVStWiz.exe
[2011.04.18 16:15:25 | 000,705,536 | ---- | C] (NVIDIA Corporation) -- C:\Windows\System32\cohelper.dll
[2011.04.18 13:09:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{C88ADE74-5F43-47A1-BE6F-A9599E07B0B2}
[2011.04.17 08:54:23 | 000,000,000 | ---D | C] -- C:\ProgramData\Electronic Arts
[2011.04.17 08:54:22 | 000,000,000 | ---D | C] -- C:\ProgramData\EA Core
[2011.04.17 08:54:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\Documents\Electronic Arts
[2011.04.17 08:41:59 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft WSE
[2011.04.13 18:42:45 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{F830BCC6-F6FE-4A04-BC6F-AB57CCCC0B60}
[2011.04.13 17:02:16 | 000,512,000 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\jscript.dll
[2011.04.13 17:02:16 | 000,430,080 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\vbscript.dll
[2011.04.13 17:02:08 | 000,671,232 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mstime.dll
[2011.04.13 17:02:08 | 000,389,632 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\html.iec
[2011.04.13 17:02:07 | 000,471,040 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\msfeeds.dll
[2011.04.13 17:02:07 | 000,380,928 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieapfltr.dll
[2011.04.13 17:02:07 | 000,193,024 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\iepeers.dll
[2011.04.13 17:02:07 | 000,078,336 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\ieencode.dll
[2011.04.13 17:02:02 | 002,041,856 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\win32k.sys
[2011.04.13 17:00:59 | 000,292,864 | ---- | C] (Adobe Systems Incorporated) -- C:\Windows\System32\atmfd.dll
[2011.04.13 17:00:58 | 000,034,304 | ---- | C] (Adobe Systems) -- C:\Windows\System32\atmlib.dll
[2011.04.13 17:00:41 | 001,162,240 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42u.dll
[2011.04.13 17:00:41 | 001,136,640 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\mfc42.dll
[2011.04.13 17:00:32 | 000,025,088 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\dnscacheugc.exe
[2011.04.11 19:02:35 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{8BBF2F40-8056-457B-BB84-D590D20D6117}
[2011.04.11 15:00:31 | 000,000,000 | ---D | C] -- C:\Program Files\TeamViewer
[2011.04.10 14:27:59 | 000,000,000 | ---D | C] -- C:\Program Files\Firefly Studios
[2011.04.09 15:55:04 | 000,000,000 | ---D | C] -- C:\Users\XXX\Desktop\Projekt 'Gone Forever'
[2011.04.06 19:58:41 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{116E227F-EEB5-4BB3-B04B-A003F6C6F66C}
[2011.04.05 19:01:05 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{508B8996-0C4E-4F5E-9B7E-56AA9ACCC308}
[2011.04.04 20:33:25 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{219C707D-BEE3-41A1-BBAA-321FDD8F0C02}
[2011.04.03 18:52:00 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{B053FA9C-42BC-45BE-85E2-4D8544D0FC4C}
[2011.04.02 21:54:09 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{B46EE753-F79E-435F-AB28-1878D5345107}
[2011.03.31 18:02:21 | 000,000,000 | ---D | C] -- C:\Users\XXX\AppData\Local\{5B2588FF-3BC2-413B-B3FE-9C281814D2B7}
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2011.04.30 17:30:22 | 000,001,096 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job
[2011.04.30 17:30:20 | 000,032,879 | ---- | M] () -- C:\ProgramData\nvModes.dat
[2011.04.30 17:30:19 | 000,032,879 | ---- | M] () -- C:\ProgramData\nvModes.001
[2011.04.30 17:27:29 | 000,001,092 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job
[2011.04.30 17:25:11 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2011.04.30 17:25:10 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2011.04.30 17:24:52 | 1878,163,456 | -HS- | M] () -- C:\hiberfil.sys
[2011.04.30 17:00:22 | 000,000,866 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.30 11:52:30 | 000,004,096 | ---- | M] () -- C:\Users\Public\Documents\00001BF6.LCS
[2011.04.30 11:45:36 | 000,001,043 | ---- | M] () -- C:\Users\XXX\Desktop\Starte Wildlife Park 3 Demo.lnk
[2011.04.30 10:41:10 | 000,670,708 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2011.04.30 10:41:10 | 000,631,438 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2011.04.30 10:41:10 | 000,143,876 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2011.04.30 10:41:10 | 000,118,064 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2011.04.27 16:46:21 | 000,511,290 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042711_164511.jpg
[2011.04.25 15:43:36 | 000,244,711 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042511_154240.jpg
[2011.04.24 23:35:13 | 000,235,916 | ---- | M] () -- C:\Users\XXX\Documents\WoWScrnShot_042411_233235.jpg
[2011.04.22 12:19:05 | 000,001,356 | ---- | M] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2011.04.17 08:41:00 | 000,002,019 | ---- | M] () -- C:\Users\Public\Desktop\Die*Sims™*Mittelalter.lnk
[2011.04.13 17:29:54 | 000,254,160 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2011.04.11 18:33:44 | 034,741,575 | ---- | M] () -- C:\Users\XXX\Documents\coole gang - bitte abspielen.mp4
[2011.04.11 15:00:39 | 000,000,915 | ---- | M] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.04.09 15:36:49 | 000,208,896 | ---- | M] () -- C:\Users\XXX\Desktop\skype remix.MSWMM
[2011.04.02 19:57:51 | 261,414,153 | ---- | M] () -- C:\Windows\MEMORY.DMP
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2011.04.30 17:00:22 | 000,000,866 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes' Anti-Malware.lnk
[2011.04.30 11:48:58 | 000,004,096 | ---- | C] () -- C:\Users\Public\Documents\00001BF6.LCS
[2011.04.30 11:45:36 | 000,001,043 | ---- | C] () -- C:\Users\XXX\Desktop\Starte Wildlife Park 3 Demo.lnk
[2011.04.30 10:45:08 | 000,000,818 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2011.04.27 16:45:56 | 000,511,290 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042711_164511.jpg
[2011.04.25 15:43:09 | 000,244,711 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042511_154240.jpg
[2011.04.24 23:34:53 | 000,235,916 | ---- | C] () -- C:\Users\XXX\Documents\WoWScrnShot_042411_233235.jpg
[2011.04.18 16:15:25 | 000,006,136 | ---- | C] () -- C:\Windows\System32\drivers\nvphy.bin
[2011.04.17 08:41:00 | 000,002,019 | ---- | C] () -- C:\Users\Public\Desktop\Die*Sims™*Mittelalter.lnk
[2011.04.11 18:16:56 | 034,741,575 | ---- | C] () -- C:\Users\XXX\Documents\coole gang - bitte abspielen.mp4
[2011.04.11 15:00:39 | 000,000,927 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TeamViewer 6.lnk
[2011.04.11 15:00:39 | 000,000,915 | ---- | C] () -- C:\Users\Public\Desktop\TeamViewer 6.lnk
[2011.04.09 15:36:49 | 000,208,896 | ---- | C] () -- C:\Users\XXX\Desktop\skype remix.MSWMM
[2010.12.31 22:37:03 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2010.11.14 14:13:57 | 000,000,034 | ---- | C] () -- C:\Windows\cdplayer.ini
[2010.10.23 16:14:44 | 000,000,222 | ---- | C] () -- C:\Users\XXX\AppData\Local\Temp1812435.dat
[2010.10.14 02:36:44 | 000,179,263 | ---- | C] () -- C:\Windows\System32\xlive.dll.cat
[2010.07.21 14:12:13 | 000,032,879 | ---- | C] () -- C:\ProgramData\nvModes.dat
[2010.07.21 14:12:13 | 000,032,879 | ---- | C] () -- C:\ProgramData\nvModes.001
[2010.07.01 16:07:53 | 000,000,009 | ---- | C] () -- C:\Windows\ULEAD32.INI
[2010.04.07 23:09:58 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys
[2010.04.07 23:09:57 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys
[2010.04.07 14:19:36 | 000,015,573 | ---- | C] () -- C:\Windows\System32\drivers\fwlanusbn.bin
[2010.02.11 07:30:38 | 000,159,744 | ---- | C] () -- C:\Windows\System32\atitmmxx.dll
[2010.01.12 15:29:44 | 000,000,410 | ---- | C] () -- C:\Windows\{27018D57-D152-44EF-BCE0-5E3B3445EABE}_WiseFW.ini
[2009.12.28 15:13:00 | 000,000,161 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\default.rss
[2009.12.28 15:13:00 | 000,000,000 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\downloads.m3u
[2009.11.19 15:26:56 | 000,000,041 | -HS- | C] () -- C:\ProgramData\.zreglib
[2009.08.04 19:36:49 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll
[2009.08.04 19:36:49 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin
[2009.06.16 22:24:04 | 000,027,648 | ---- | C] () -- C:\Windows\System32\AVSredirect.dll
[2009.04.24 00:29:16 | 000,189,051 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat
[2009.02.20 19:18:46 | 000,097,792 | ---- | C] () -- C:\Users\XXX\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2009.01.01 22:55:13 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2008.12.28 12:01:04 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin
[2008.12.27 12:13:43 | 000,000,713 | ---- | C] () -- C:\Windows\disney.ini
[2008.12.13 21:00:45 | 000,022,328 | ---- | C] () -- C:\Users\XXX\AppData\Roaming\PnkBstrK.sys
[2008.12.13 21:00:30 | 000,107,832 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe
[2008.12.12 16:52:21 | 000,045,568 | ---- | C] () -- C:\Windows\UniFish3.exe
[2008.12.12 16:22:15 | 000,001,356 | ---- | C] () -- C:\Users\XXX\AppData\Local\d3d9caps.dat
[2008.10.07 09:13:30 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll
[2008.10.07 09:13:22 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll
[2008.10.07 09:13:20 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll
[2008.01.21 09:15:58 | 000,670,708 | ---- | C] () -- C:\Windows\System32\perfh007.dat
[2008.01.21 09:15:58 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat
[2008.01.21 09:15:58 | 000,143,876 | ---- | C] () -- C:\Windows\System32\perfc007.dat
[2008.01.21 09:15:58 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat
[2006.11.02 14:57:28 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat
[2006.11.02 14:47:37 | 000,254,160 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2006.11.02 14:35:32 | 000,005,632 | ---- | C] () -- C:\Windows\System32\sysprepMCE.dll
[2006.11.02 12:33:01 | 000,631,438 | ---- | C] () -- C:\Windows\System32\perfh009.dat
[2006.11.02 12:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat
[2006.11.02 12:33:01 | 000,118,064 | ---- | C] () -- C:\Windows\System32\perfc009.dat
[2006.11.02 12:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat
[2006.11.02 12:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat
[2006.11.02 10:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin
[2006.11.02 10:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT
[2006.11.02 09:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini
[2006.11.02 09:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat
[2002.09.18 00:45:00 | 000,119,808 | ---- | C] () -- C:\Windows\lsb_un20.exe
[1996.04.03 21:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys
========== LOP Check ==========
[2011.01.27 20:17:05 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\.minecraft
[2010.08.02 14:48:01 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\AnvSoft
[2011.03.20 12:29:19 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Ashampoo
[2011.03.20 12:01:24 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Canneverbe Limited
[2009.07.14 12:49:29 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Command & Conquer 3 Kanes Rache
[2009.07.09 16:13:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Command & Conquer 3 Tiberium Wars
[2010.12.02 15:48:26 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1
[2011.02.18 19:19:23 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\DVDVideoSoftIEHelpers
[2011.03.26 12:34:03 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\gtk-2.0
[2011.04.26 11:09:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ICQ
[2010.12.24 22:42:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Leadertech
[2010.07.03 22:41:33 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\LolClient
[2009.10.29 15:18:16 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\MP3Rocket
[2010.11.14 14:16:44 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\NCH Swift Sound
[2010.09.16 14:28:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Notepad++
[2009.02.24 21:46:15 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\OpenOffice.org
[2010.06.13 20:39:54 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\phonostar GmbH
[2009.08.22 14:08:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Propellerhead Software
[2011.04.30 11:48:51 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\ProtectDISC
[2010.07.13 22:14:07 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Publish Providers
[2010.09.18 10:17:42 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\QIP
[2010.07.13 22:14:50 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Sony
[2010.05.13 13:53:37 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\SPORE Creature Creator
[2011.04.11 15:01:00 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TeamViewer
[2009.12.26 00:58:01 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\Teeworlds
[2010.05.31 17:33:10 | 000,000,000 | ---D | M] -- C:\Users\XXX\AppData\Roaming\TS3Client
[2011.04.30 17:23:51 | 000,032,634 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 64 bytes -> C:\Users\XXX\I've been looking for Grindcore.avi:TOC.WMV
@Alternate Data Stream - 24 bytes -> C:\Windows:8917AFFB20020C2F
< End of report > Code:
OTL Extras logfile created on: 30.04.2011 17:32:38 - Run 1
OTL by OldTimer - Version 3.2.22.3 Folder = C:\Users\XXX\Downloads
Windows Vista Home Premium Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,00 Gb Total Physical Memory | 1,00 Gb Available Physical Memory | 41,00% Memory free
4,00 Gb Paging File | 3,00 Gb Available in Paging File | 68,00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 232,88 Gb Total Space | 57,05 Gb Free Space | 24,50% Space Free | Partition Type: NTFS
Computer Name: XXX | User Name: XXX | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
"DoNotAllowExceptions" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 1
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0306F3E2-9C81-406F-A37F-7A3BBBBEA536}" = lport=8395 | protocol=6 | dir=in | name=league of legends launcher |
"{174C0CE7-0769-447A-A02B-1D386E4EF259}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) |
"{1A59280C-1696-4CEB-BC34-A5C5D8F22363}" = rport=445 | protocol=6 | dir=out | app=system |
"{20FADCBB-9755-4E52-93F5-BCE7B4059346}" = lport=138 | protocol=17 | dir=in | app=system |
"{2A538D11-AAE4-473F-80EA-FD9B8A469BFD}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{2D14A448-6CE3-437B-87DC-7D855E123E3B}" = lport=8395 | protocol=17 | dir=in | name=league of legends launcher |
"{3D7BEC21-3A78-4A54-B297-CE5B8FFB66CA}" = rport=137 | protocol=17 | dir=out | app=system |
"{5129C9C2-C1CA-4ECA-84F1-D188C5ED5D88}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{5BCC88C8-E477-4AAE-BF86-478B56A31C74}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe |
"{61C6220F-2710-45AB-843D-9C8B086365F2}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{63680296-963E-4DDB-B29F-730F80968A89}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{6C6B9830-B4AA-4A0D-B20F-9130F1EF05F0}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{6C85F2CA-C9E1-43BD-AE68-AD499E2F2492}" = lport=8396 | protocol=6 | dir=in | name=league of legends launcher |
"{7508B32D-AFA7-4670-BA46-3ECF0C7739CE}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{76396E19-DA5D-4F85-9095-A64C740EBA23}" = lport=139 | protocol=6 | dir=in | app=system |
"{95732DBD-26A8-466D-8DD0-CA8CC9897CF0}" = lport=445 | protocol=6 | dir=in | app=system |
"{A7EEA845-722D-4997-93FA-84FE37C3F725}" = lport=8396 | protocol=17 | dir=in | name=league of legends launcher |
"{BCD479E1-438D-4CAC-B7C0-0C918610E009}" = lport=8394 | protocol=17 | dir=in | name=league of legends launcher |
"{C013AB1A-19B9-4B21-BF71-E6D2A9E5C514}" = rport=139 | protocol=6 | dir=out | app=system |
"{C30A0653-8CEC-4D48-BD61-10E7E50B93A3}" = lport=8394 | protocol=6 | dir=in | name=league of legends launcher |
"{C4DA8887-3DC1-433E-BF28-4BA6A5CA04F8}" = lport=137 | protocol=17 | dir=in | app=system |
"{CDD1BD0B-323F-484F-B20E-23E3070FDAE7}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) |
"{DDA27137-DEFD-4147-B86C-9A05A3E4D119}" = rport=138 | protocol=17 | dir=out | app=system |
"{E12D4EC0-06C8-4AE6-A19D-24012871C2C8}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{F1B93033-C511-449D-9347-4A55334EFE82}" = lport=3724 | protocol=6 | dir=in | name=blizzard downloader: 3724 |
"{F2A662CE-F5D6-41D0-8A8A-BB4C1D13AF2D}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe |
"{F37D1D76-0C45-41FF-9351-0A9423C17C28}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{FFF66874-9EC2-467B-A684-B93AD924D95D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{026ED4C1-ACA5-4880-AFD6-EC42668F1FD5}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe |
"{02D46EE0-531C-44F2-AA52-7E74DB80CE9A}" = protocol=17 | dir=in | app=c:\users\XXX\downloads\videoconverter_setup.exe |
"{033E345A-D14A-4845-BF33-677C5C05A34D}" = protocol=17 | dir=in | app=c:\program files\xblades\xblades.exe |
"{0DE67D9C-B036-4D2E-AF52-EAA4EFFF24DA}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe |
"{1192FAD7-4433-4B3C-AB71-049DF46C9682}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\counter-strike source\hl2.exe |
"{11B34716-2180-44EB-878A-B554D58EAC8A}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{15636E99-7007-4C20-8D38-DFE3F0C70BA0}" = protocol=6 | dir=in | app=c:\program files\steam\steam.exe |
"{1936A750-313A-4716-B4CC-F3CAB39E73FD}" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.exe |
"{1C050A66-4A43-4F98-BAB2-1A996251322F}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{1CEB9585-239D-4B60-A17B-046A171E67D2}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe |
"{1FB2D413-CF84-4E5C-975B-85D702FBAEFF}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{22DFB616-4127-4B5B-B089-033B0E3F4AEB}" = protocol=6 | dir=in | app=c:\program files\xblades\xblades.exe |
"{2723388B-69A8-4D53-B9E9-468651868567}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{28D41F80-ABA0-478F-B2FB-B9A3F4E84A65}" = protocol=6 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-dede-downloader.exe |
"{2F6F3C9A-1DDC-4103-8033-BE35FE37757D}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe |
"{35FFA151-248C-4688-AA55-16EE1D26EE84}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\counter-strike source\hl2.exe |
"{36E65C6F-E605-4639-B4D0-D34095C99C6E}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforever.exe |
"{3AE11712-6623-4DA1-9D1C-A5D14F547812}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{3C1E1DED-8A85-4B04-82F8-9B0B62D3159C}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\common\trackmania nations forever\tmforeverlauncher.exe |
"{45123B98-5E9E-4CD5-9AA5-AA6098381015}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{4681CEF1-EDF5-430B-BE16-1D333A5B077F}" = protocol=6 | dir=in | app=c:\program files\league of legends\air\lolclient.exe |
"{4A8311B6-84E1-4631-8C69-27885997BD84}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe |
"{4E8D8DC3-F2EC-4DFA-93A0-30085E0B28A3}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{4EAE00CC-CC21-4AC9-A6EE-C22BF18577CC}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{5A0A1DA6-3147-48F6-B736-D41A10A02F40}" = protocol=17 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe |
"{5A9AC4DA-365F-4AF4-9E58-0584FDF319A5}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{5B9D6F4A-460D-4892-8EF0-EAB9ACD70147}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{5CF91297-9EB2-4D06-A270-C59546292762}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{5F7980C2-65B0-419D-A5D3-20828EE35C5D}" = protocol=17 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe |
"{60A16EB2-3B4B-45DD-A02B-F810E0725B4B}" = dir=in | app=c:\program files\electronic arts\command & conquer 3 kanes rache\retailexe\1.0\cnc3ep1.dat |
"{633D1A6E-9C2C-42EB-B4C5-0B96E4008B61}" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.patch.exe |
"{63929DF8-31FD-4AB7-9A5A-905483011616}" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe |
"{68D59BB1-380A-4F9D-AE88-40E357BC9251}" = protocol=17 | dir=in | app=c:\program files\league of legends\game\league of legends.exe |
"{6BF52568-5F84-4D97-B213-2B9FDD329D29}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{72FEB34F-2937-4CC8-88AF-F5F36ED87A8E}" = protocol=6 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{7812A4ED-2E36-4800-B35F-06825B62E3E7}" = protocol=6 | dir=in | app=c:\users\XXX\downloads\videoconverter_setup.exe |
"{7882FE34-498D-4923-BF0D-B3272D19A094}" = protocol=6 | dir=in | app=c:\program files\xblades\launcher.exe |
"{7C37BCC0-285D-41A8-AE44-3B6D8A48335C}" = protocol=6 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{80493DB6-F4F9-47FC-ADA4-EF20461E5F14}" = protocol=17 | dir=in | app=c:\programdata\nexonus\ngm\ngm.exe |
"{893F9885-C70D-4586-BA44-C1D43EDBCD17}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstra.exe |
"{8CAD818C-11DB-4DCB-9594-B88D2A658BF4}" = protocol=17 | dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{8F8311A3-88A5-4DEC-A18C-49398312FFF0}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{8FF1D142-1DC0-4D1F-A611-3E91ABE3710D}" = protocol=17 | dir=in | app=c:\users\public\documents\blizzard entertainment\world of warcraft\wow-3.0.9.9551-to-3.1.0.9767-dede-downloader.exe |
"{90ABE924-5B74-4EC3-8A11-59A9D817C3A3}" = dir=in | app=c:\program files\pando networks\media booster\pmb.exe |
"{941E72A7-B732-48BD-86A0-74636C36AB45}" = protocol=17 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{96711F9A-9BA2-417D-8C57-939467A63F92}" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.patch.exe |
"{9804EE36-60D7-40B7-BE00-C435875ED7BA}" = protocol=6 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{A7AEEDB8-CC5F-4F38-A7AE-D0F585B2A59B}" = protocol=17 | dir=in | app=c:\program files\steam\steam.exe |
"{A9794E76-5C67-485F-9343-37B2DF3FEE56}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{B02FBC98-9680-4B46-9C11-B650946A4E85}" = protocol=6 | dir=in | app=c:\program files\thq\gas powered games\gpgnet\gpg.multiplayer.client.exe |
"{B28F880B-5827-46EA-BDB1-ECE1B1F3B141}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{B70582CF-8C63-47E8-9743-29EA07D3CD71}" = dir=in | app=c:\program files\windows live\messenger\msnmsgr.exe |
"{B7374434-FD22-4F78-9AF9-EB2A4F65193E}" = protocol=6 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{B9314FE6-35C8-41E3-81E5-ACFE5ECA4C7B}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\battleforge.exe |
"{BAE5740B-D651-4C1B-9FC3-E20EAC38EFFA}" = protocol=6 | dir=in | app=c:\program files\teamviewer\version6\teamviewer_service.exe |
"{BBE3DA33-6339-43B8-8EB3-7E9492CA9376}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{C9D08A51-3A75-4C0E-A951-D13F370F2394}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe |
"{CA19EF67-8578-4C94-A396-1ED3354062B2}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{CDED4011-291E-4ED0-AA1E-1DEBAF564622}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{D4EE839E-628B-4408-A92C-7AEC3AA91A84}" = protocol=17 | dir=in | app=c:\program files\icq7.2\aolload.exe |
"{DA10C03B-E910-41D4-9CD1-B20E34D775CA}" = protocol=17 | dir=in | app=c:\program files\icq7.2\icq.exe |
"{DD1C9532-CC97-4536-9D43-48D63F975EE2}" = protocol=6 | dir=in | app=c:\windows\system32\pnkbstrb.exe |
"{DE2A38A0-5B97-488C-B221-B38EC1BA4E19}" = protocol=17 | dir=in | app=c:\program files\league of legends\air\lolclient.exe |
"{E11952CB-32EE-4869-8472-3599A0CAC40C}" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.exe |
"{E88F6BAF-A7DC-44DB-9BB0-691FE107EABF}" = protocol=6 | dir=in | app=c:\program files\electronic arts\battleforge\bootstrapper.exe |
"{EA5476CB-0F15-4B59-BC12-C15F1C9A9208}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{F0E1C797-3798-4FD4-83BA-ECB93C4BEE02}" = protocol=6 | dir=in | app=c:\program files\league of legends\game\league of legends.exe |
"{F6793210-5083-44B9-BC24-6705378089C7}" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\day of defeat source\hl2.exe |
"{FA23EE17-2D14-4BD0-B19A-330AC70961AB}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{FB321834-4439-42FF-B2E3-DE99071311BB}" = protocol=17 | dir=in | app=c:\program files\xblades\launcher.exe |
"{FB543ABA-CFD2-468D-AB57-974A53DF8829}" = protocol=17 | dir=in | app=c:\program files\teamviewer\version6\teamviewer.exe |
"{FBA6D5D6-5F41-4D4D-9740-C43633D46FAE}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"TCP Query User{0A7F7F1A-AFFE-4DEB-BDEC-3A683E52CCDE}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"TCP Query User{1E3EF580-4046-4AFC-8A9D-B34E8CBF5953}C:\program files\world of warcraft official\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft official\launcher.exe |
"TCP Query User{2B1A9D42-B406-4B9F-B031-92878944A632}C:\program files\wow!!\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow!!\launcher.exe |
"TCP Query User{30B20F6E-AA97-43B7-A4D3-56FA43827575}C:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe |
"TCP Query User{33FBE456-D9D0-4734-93D7-2AAEAFC0AFE1}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe |
"TCP Query User{3517994D-5807-4968-B300-F93BF9761B4E}C:\program files\littlefighter2\lf2_v2.0\lf2.exe" = protocol=6 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0\lf2.exe |
"TCP Query User{4267079E-CD7F-486B-9483-5702051FF240}C:\users\public\games\world of warcraft trial\launcher.exe" = protocol=6 | dir=in | app=c:\users\public\games\world of warcraft trial\launcher.exe |
"TCP Query User{48C67306-C8BD-4257-AA48-6842897D0ACE}C:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe |
"TCP Query User{509C3A5A-CCF8-4BDF-8454-3D1B908BBD93}C:\program files\gamers.irc\mirc.exe" = protocol=6 | dir=in | app=c:\program files\gamers.irc\mirc.exe |
"TCP Query User{5B574814-344A-44BD-BE64-A72CEC694F48}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=6 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe |
"TCP Query User{5CD6A04B-0325-4227-ADC0-271992D9E17E}C:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe" = protocol=6 | dir=in | app=c:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe |
"TCP Query User{5ED840D9-C2AA-4576-B9A6-662499621B9C}C:\program files\serious sam 2\bin\sam2.exe" = protocol=6 | dir=in | app=c:\program files\serious sam 2\bin\sam2.exe |
"TCP Query User{72129B08-58E0-49AA-96C5-5A53408B38F2}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe |
"TCP Query User{72C9792B-9F0B-421A-B504-68CA3FDB1C28}C:\program files\icq6.5\icq.exe" = protocol=6 | dir=in | app=c:\program files\icq6.5\icq.exe |
"TCP Query User{8220C040-DA0E-4A77-8EA8-8946645D1ABD}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=6 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe |
"TCP Query User{84B5DDB1-DD3B-43AE-8D46-97148A8C48C3}C:\program files\world of warcraft\launcher.exe" = protocol=6 | dir=in | app=c:\program files\world of warcraft\launcher.exe |
"TCP Query User{8E066FF7-75F3-404F-9D77-BD616A6CE6DF}C:\program files\team17\worms armageddon\wa.exe" = protocol=6 | dir=in | app=c:\program files\team17\worms armageddon\wa.exe |
"TCP Query User{B900FD0D-2EC9-4C64-98A5-95451A119353}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"TCP Query User{C762DB23-97E0-4515-B723-7CFAFF4B65F4}C:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe" = protocol=6 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe |
"TCP Query User{C7D26486-55DC-4E02-941D-3DA3246CE344}C:\program files\google\google earth\client\googleearth.exe" = protocol=6 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"TCP Query User{C9B404A0-1EA7-49EC-8FFF-6B66FF17F24A}C:\program files\empire interactive\flatout2\flatout2.exe" = protocol=6 | dir=in | app=c:\program files\empire interactive\flatout2\flatout2.exe |
"TCP Query User{DDD412BA-714F-48E0-8B36-4D08A9B1FB3A}C:\program files\thq\dawn of war - dark crusade\darkcrusade.exe" = protocol=6 | dir=in | app=c:\program files\thq\dawn of war - dark crusade\darkcrusade.exe |
"TCP Query User{E105AABD-474C-4A8A-9643-2AB97AAF2ECE}C:\program files\electronic arts\armies of exigo\exigo.exe" = protocol=6 | dir=in | app=c:\program files\electronic arts\armies of exigo\exigo.exe |
"TCP Query User{EC6B5404-064C-43AA-B441-1E91F3C0DBBF}C:\program files\wow!!!\dark-thunder\launcher.exe" = protocol=6 | dir=in | app=c:\program files\wow!!!\dark-thunder\launcher.exe |
"TCP Query User{EF9BB07E-8868-4A67-B258-DD80C184BF80}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=6 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe |
"TCP Query User{FE3C417D-E0C6-4CC6-950F-7A1574F3CD98}C:\program files\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=6 | dir=in | app=c:\program files\unreal tournament 3 (lg)\binaries\ut3.exe |
"UDP Query User{0E4B664C-2F7F-4079-8B76-47D25CC92D9B}C:\program files\team17\worms armageddon\wa.exe" = protocol=17 | dir=in | app=c:\program files\team17\worms armageddon\wa.exe |
"UDP Query User{1A194E0A-557C-4BC4-A94B-FDDD43E76D12}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{2BF720B7-D3CC-4459-B078-5587C3433836}C:\program files\world of warcraft official\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft official\launcher.exe |
"UDP Query User{2EF47BD3-7CD5-4622-9FFC-DA877C2FC2A5}C:\program files\unreal tournament 3 (lg)\binaries\ut3.exe" = protocol=17 | dir=in | app=c:\program files\unreal tournament 3 (lg)\binaries\ut3.exe |
"UDP Query User{3C2A5A80-28FD-4E56-B7F6-0AF2F31DE6DC}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe |
"UDP Query User{3EA1DB5B-999A-4B96-BF1C-CC2529BD8880}C:\program files\serious sam 2\bin\sam2.exe" = protocol=17 | dir=in | app=c:\program files\serious sam 2\bin\sam2.exe |
"UDP Query User{47C9E7F5-6D1C-4951-8D70-47D662A2F224}C:\program files\electronic arts\armies of exigo\exigo.exe" = protocol=17 | dir=in | app=c:\program files\electronic arts\armies of exigo\exigo.exe |
"UDP Query User{509C7ECC-B927-4912-A9BF-D392F4F045C6}C:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex05.148\wow-dede-installer-downloader.exe |
"UDP Query User{5F4DE307-1049-40C9-9C9B-79DC2C5D720F}C:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe" = protocol=17 | dir=in | app=c:\nexon\nexon_eu_downloader\nexon_eu_downloader_engine.exe |
"UDP Query User{6E5926F5-740B-464F-B49A-82D6CAEB1DCC}C:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe" = protocol=17 | dir=in | app=c:\users\XXX\appdata\local\temp\rar$ex04.234\wow-burningcrusade-dede-installer-downloader.exe |
"UDP Query User{753C0D5E-8AE4-4823-8187-5300BD1F9A5F}C:\program files\littlefighter2\lf2_v2.0\lf2.exe" = protocol=17 | dir=in | app=c:\program files\littlefighter2\lf2_v2.0\lf2.exe |
"UDP Query User{784BCB21-66C5-4DA6-85FE-14B86E464B54}C:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe" = protocol=17 | dir=in | app=c:\program files\steam\steamapps\txnudel18\half-life 2 deathmatch\hl2.exe |
"UDP Query User{79704B58-23A6-431E-842F-140B3F018B2B}C:\users\public\games\world of warcraft trial\launcher.exe" = protocol=17 | dir=in | app=c:\users\public\games\world of warcraft trial\launcher.exe |
"UDP Query User{7DC24D1B-25C7-4870-8C26-552066C0DE24}C:\program files\google\google earth\client\googleearth.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\client\googleearth.exe |
"UDP Query User{85145550-EF6C-433E-9AF0-6C356E4B62A0}C:\program files\google\google earth\plugin\geplugin.exe" = protocol=17 | dir=in | app=c:\program files\google\google earth\plugin\geplugin.exe |
"UDP Query User{8E55ED00-C2ED-4FE4-8F53-08ACF5F346F8}C:\program files\thq\dawn of war - dark crusade\darkcrusade.exe" = protocol=17 | dir=in | app=c:\program files\thq\dawn of war - dark crusade\darkcrusade.exe |
"UDP Query User{91CDE51B-CAC0-40A1-AEC8-8089DA2DE7D2}C:\program files\java\jre1.6.0_01\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_01\bin\javaw.exe |
"UDP Query User{A80B53FD-002D-4C41-94AE-B69361E5D66A}C:\program files\wow!!\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow!!\launcher.exe |
"UDP Query User{AD0AD7E4-9EF2-4251-BFC6-DA44B684B83F}C:\program files\icq6.5\icq.exe" = protocol=17 | dir=in | app=c:\program files\icq6.5\icq.exe |
"UDP Query User{AFB0FA4D-A7FA-4484-A515-D2FE470EBB01}C:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\wow-3.3.3.11723-to-3.3.5.12213-dede-downloader.exe |
"UDP Query User{B084B04E-6142-4FA5-970E-95604CDE2C42}C:\program files\gamers.irc\mirc.exe" = protocol=17 | dir=in | app=c:\program files\gamers.irc\mirc.exe |
"UDP Query User{B665952B-7990-43DE-BFEE-E3D1B52573BD}C:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe" = protocol=17 | dir=in | app=c:\program files\games-masters.com\cabal online (europe)\launcher\update\estdnheadless.exe |
"UDP Query User{B894E9CB-C207-49AF-B787-849D364475D5}C:\program files\duty calls\binaries\win32\dutycalls.exe" = protocol=17 | dir=in | app=c:\program files\duty calls\binaries\win32\dutycalls.exe |
"UDP Query User{C9E0E35A-9F73-4091-97F2-17E482EDAE7A}C:\program files\empire interactive\flatout2\flatout2.exe" = protocol=17 | dir=in | app=c:\program files\empire interactive\flatout2\flatout2.exe |
"UDP Query User{CCAA270A-C7F1-481E-8356-BF42EA1796D5}C:\program files\world of warcraft\launcher.exe" = protocol=17 | dir=in | app=c:\program files\world of warcraft\launcher.exe |
"UDP Query User{FE47344A-4F02-44F0-98AC-67AF7A7FFB7A}C:\program files\wow!!!\dark-thunder\launcher.exe" = protocol=17 | dir=in | app=c:\program files\wow!!!\dark-thunder\launcher.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{0125D081-30D0-4A97-82A8-C28D444B6256}" = Microsoft SQL Server Compact 3.5 SP2 DEU
"{0138F525-6C8A-333F-A105-14AE030B9A54}" = Visual C++ 9.0 CRT (x86) WinSXS MSM
"{01521746-02A6-4A72-00BD-A285DF6B80C6}" = Die Sims 2: Wilde Campus-Jahre
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04B45310-A5FE-4425-BFCA-1A6D8920DE74}" = OpenOffice.org 3.0
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{086BADF8-9B1F-4E89-B207-2EDA520972D6}" = Grand Theft Auto San Andreas
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0AEB967F-1D12-43C8-A59C-D93DA8EE4A4E}" = Duty Calls
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{0C826C5B-B131-423A-A229-C71B3CACCD6A}" = CDDRV_Installer
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{196BB40D-1578-3D01-B289-BEFC77A11A1E}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.30319
"{1D328E11-3B0C-388C-835D-C9C20E8C7734}" = Microsoft Help Viewer 1.0 Language Pack - DEU
"{1FDA5A37-B22D-43FF-B582-B8964050DC13}" = Microsoft Games for Windows - LIVE Redistributable
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{26A24AE4-039D-4CA4-87B4-2F83216017FF}" = Java(TM) 6 Update 21
"{27018D57-D152-44EF-BCE0-5E3B3445EABE}" = X-Blades
"{3101CB58-3482-4D21-AF1A-7057FC935355}" = KhalInstallWrapper
"{3248F0A8-6813-11D6-A77B-00B0D0160010}" = Java(TM) SE Runtime Environment 6 Update 1
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{4286E640-B5FB-11DF-AC4B-005056C00008}" = Google Earth
"{46C045BF-2B3F-4BC4-8E4C-00E0CF8BD9DB}" = Adobe AIR
"{47C39E4A-28F2-33B1-B9B7-97F24E52D917}" = Microsoft Help Viewer 1.0
"{47FDEFC7-BFE6-FD75-41D1-28DD572BD2D9}" = ATI Catalyst Install Manager
"{4817189D-1785-4627-A33C-39FD90919300}" = Die Sims™ 2 Haustiere
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{5A08C9D1-37AD-4A8D-90D3-33F92C578AA5}" = Microsoft SQL Server System CLR Types
"{5DD4FCBD-A3C1-4155-9E17-4161C70AAABA}" = Segoe UI
"{5EE3204B-EF7D-4D3E-91A8-5863910CDF6C}" = Speedport W 100 Stick
"{5EE7D259-D137-4438-9A5F-42F432EC0421}" = VC80CRTRedist - 8.0.50727.4053
"{616C6F39-4CE1-3434-A665-2F6A04C09A7F}" = Microsoft Visual Studio 2010 ADO.NET Entity Framework Tools
"{61AD15B2-50DB-4686-A739-14FE180D4429}" = Windows Live ID Sign-in Assistant
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{68A35043-C55A-4237-88C9-37EE1C63ED71}" = Microsoft Visual J# 2.0 Redistributable Package
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6E7DD182-9FC6-4651-0095-2E666CC6AF35}" = Die Sims 2
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser and SDK
"{72263053-50D1-4598-9502-51ED64E54C51}" = Borland Delphi 7
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EFBFE4-C74F-4187-AEFD-73EA3BE968D6}" = ICQ7.2
"{7B3577F5-1D82-4C9B-008B-69D026FD8BCA}" = Die Sims 2: Open For Business
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"{7E641E46-81DB-4D1D-906A-48342523051C}" = FlatOut2
"{80464ABC-A520-453F-A383-6E7B92E0C3B3}" = Armies of Exigo
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83BEEFB4-8C28-4F4F-8A9D-E0D1ADCE335B}" = Die*Sims*Mittelalter
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{86A4C6D9-29EE-4719-AFA1-BA3341862B83}" = Microsoft Games for Windows - LIVE
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{873E4648-6F6E-47F6-A7B2-A6F8DFABDCE6}" = Windows Live Messenger
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8A06714C-F24B-4144-9BA2-788B5DD4F270}_is1" = ICQ Ignore Checker 1.3
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8AF3E926-ED59-11D4-A44B-0000E86D2305}" = Ulead GIF Animator 5 Test
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{90687432-4103-416F-B0C9-649D8CBD986F}" = Wildlife Park 2 Demo
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9580813D-94B1-4C28-9426-A441E2BB29A5}" = Counter-Strike: Source
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9DBCF44B-77AC-81D8-0F8E-1E60D6330AC2}" = Catalyst Control Center InstallProxy
"{9E012857-0B5E-40A0-A36A-36751966A79B}_is1" = ICQ Status Checker 1.7
"{a0fe116e-9a8a-466f-aee0-625cb7c207e3}" = Microsoft Visual C++ 2005 Redistributable - KB2467175
"{A106D33E-6B43-42C0-9BFC-D03303261FA7}" = Microsoft SQL Server 2008 R2 Management Objects
"{A498D9EB-927B-459B-85D6-DD6EF8C2C564}" = erLT
"{A8F2089B-1F79-4BF6-B385-A2C2B0B9A74D}" = ImagXpress
"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper
"{A93944F2-D2D4-4750-BFE7-9A288FEAF2CF}" = Apple Application Support
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A94000000001}" = Adobe Reader 9.4.4 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B7E38540-E355-3503-AFD7-635B2F2F76E1}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4974
"{B83FC356-B7C0-441F-8A4D-D71E088E7974}" = NVIDIA PhysX
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C580908C-B3BA-4C19-BD60-16F02F272201}" = BattleForge™
"{C911A0C2-2236-3164-AA47-F2566C01AE5E}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE4A3D0F-D1B0-47D1-BF99-3E957C548D12}" = LogMeIn Hamachi
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{CFCB8616-A5D1-4281-80E8-389F685BFAE2}" = Visual Studio 2010 Tools for SQL Server Compact 3.5 SP2 DEU
"{CFEF48A8-BFB8-3EAC-8BA5-DE4F8AA267CE}" = Microsoft .NET Framework 4 Multi-Targeting Pack
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{D81641E8-ABF1-3D07-803B-60E8FC619368}" = Microsoft Visual C# 2010 Express - DEU
"{DA507A38-4B2A-40C0-90AC-E30AAA0B757C}" = Vegas Movie Studio Platinum 9.0
"{DFEF49D9-FC95-4301-99B9-2FB91C6ABA06}" = Die Sims™ 2 Vier Jahreszeiten
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E3E71D07-CD27-46CB-8448-16D4FB29AA13}" = Microsoft WSE 3.0 Runtime
"{E633D396-5188-4E9D-8F6B-BFB8BF3467E8}" = Skype™ 5.1
"{EB4DF488-AAEF-406F-A341-CB2AAA315B90}" = Windows Live Messenger
"{ECEE0279-785F-4CB3-9F28-E69813234BF8}" = SPORE™ Labor Basisversion
"{F29B21BD-CAA6-445F-8EF7-A7E2B9D8B14E}" = Logitech SetPoint
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F7529650-B9DB-481B-0089-A2AC3C2821C1}" = Die Sims 2: Nightlife
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{F9D54D77-01A4-7D34-6F3C-EDC9F8F466E3}" = Fragen-Lern-CD 4.0
"7-Zip" = 7-Zip 9.14 beta
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 10 Plugin
"Adobe Shockwave Player" = Adobe Shockwave Player 11.5
"AnalogX AutoTune" = AnalogX AutoTune
"Any Video Converter_is1" = Any Video Converter 3.0.3
"Ashampoo Burning Studio 2010 Advanced_is1" = Ashampoo Burning Studio 2010 Advanced 9.25
"Audiograbber" = Audiograbber 1.83 SE
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMWLANCLI" = AVM FRITZ!WLAN
"CABAL Online (Europe)_is1" = CABAL Online
"CABAL Online: Illusion Castle Patch_is1" = Cabal Online Europe - Illusion Castle
"CABAL Online_is1" = CABAL Online
"conduitEngine" = Conduit Engine
"de.3m5.wendel.flcd.FLCDB.4E7DF207D694E815646D9C9DD7DC91A41EB7FD23.1" = Fragen-Lern-CD 4.0
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"Fraps" = Fraps (remove only)
"Free Audio CD Burner_is1" = Free Audio CD Burner version 1.4.7
"Free Video to Flash Converter_is1" = Free Video to Flash Converter version 4.2
"Free Video to JPG Converter_is1" = Free Video to JPG Converter version 1.5
"Free Video to MP3 Converter_is1" = Free Video to MP3 Converter version 3.2
"Free YouTube Download_is1" = Free YouTube Download 2.10
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.9.35.324
"GoldWave v5.56" = GoldWave v5.56
"ICQToolbar" = ICQ Toolbar
"InstallShield_{5EE3204B-EF7D-4D3E-91A8-5863910CDF6C}" = Speedport W 100 Stick
"InstallShield_{7CFA46E3-CC2F-4355-82AE-6012DC3633FD}" = NVIDIA ForceWare Network Access Manager
"League of Legends_is1" = League of Legends
"LogMeIn Hamachi" = LogMeIn Hamachi
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
"Microsoft Help Viewer 1.0" = Microsoft Help Viewer 1.0
"Microsoft Help Viewer 1.0 Language Pack - DEU" = Microsoft Help Viewer 1.0 Language Pack - DEU
"Microsoft Visual C# 2010 Express - DEU" = Microsoft Visual C# 2010 Express - DEU
"Microsoft Visual J# 2.0 Redistributable Package" = Microsoft Visual J# 2.0 Redistributable Package
"Mortal Kombat_is1" = Mortal Kombat
"Mozilla Firefox 4.0.1 (x86 de)" = Mozilla Firefox 4.0.1 (x86 de)
"MyAshampoo Toolbar" = MyAshampoo Toolbar
"Notepad++" = Notepad++
"NVIDIA Display Control Panel" = NVIDIA Display Control Panel
"NVIDIA Drivers" = NVIDIA Drivers
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Pivot 2.3.0 Deutsch" = Pivot 2.3.0 Deutsch
"Plants vs. Zombies" = Plants vs. Zombies
"Steam App 11020" = TrackMania Nations Forever
"Steam App 240" = Counter-Strike: Source
"Steam App 300" = Day of Defeat: Source
"Teamspeak 2 RC2_is1" = TeamSpeak 2 RC2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"TeamViewer 6" = TeamViewer 6
"Tunatic" = Tunatic
"Ulead GIF Animator Lite Edition 1.0" = Ulead GIF Animator Lite Edition 1.0
"Uninstall_is1" = Uninstall 1.0.0.1
"Unlocker" = Unlocker 1.9.0
"VLC media player" = VLC media player 1.1.7
"WavePad" = WavePad Sound Editor
"Wildlife Park 3 Demo_is1" = Wildlife Park 3 Demo v1.03
"WinGimp-2.0_is1" = GIMP 2.6.8
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR
"World of Warcraft" = World of Warcraft
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"GeoGebra WebStart" = GeoGebra WebStart
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 01.10.2010 09:22:14 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 01.10.2010 09:22:14 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 01.10.2010 09:22:15 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description =
Error - 01.10.2010 11:04:53 | Computer Name = XXX | Source = Application Hang | ID = 1002
Description = Programm battleforge.exe, Version 1.2.0.0 arbeitet nicht mehr mit
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
das Problem zu suchen. Prozess-ID: 17fc Anfangszeit: 01cb616e57efe5ef Zeitpunkt der
Beendigung: 1725
Error - 02.10.2010 03:32:49 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 02.10.2010 03:32:49 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 02.10.2010 03:33:16 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description =
Error - 02.10.2010 07:51:42 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 02.10.2010 07:51:42 | Computer Name = XXX | Source = Microsoft-Windows-CAPI2 | ID = 131083
Description =
Error - 02.10.2010 07:52:42 | Computer Name = XXX | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 30.04.2011 11:38:06 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
Error - 30.04.2011 11:38:50 | Computer Name = XXX | Source = Ntfs | ID = 262199
Description = Die Dateisystemstruktur auf dem Datenträger ist beschädigt und unbrauchbar.
Führen
Sie chkdsk auf Volume "\Device\HarddiskVolume1" aus.
< End of report > Code:
Malwarebytes' Anti-Malware 1.50.1.1100
www.malwarebytes.org
Datenbank Version: 6478
Windows 6.0.6002 Service Pack 2
Internet Explorer 7.0.6002.18005
30.04.2011 17:21:45
mbam-log-2011-04-30 (17-21-45).txt
Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 151646
Laufzeit: 11 Minute(n), 18 Sekunde(n)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
c:\Users\XXX\AppData\Local\Temp\comver.dll (Adware.GameSpyArcade) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Roaming\avdrn.dat (Malware.Trace) -> Quarantined and deleted successfully.
c:\Users\XXX\AppData\Roaming\fvgqad.dat (Malware.Trace) -> Quarantined and deleted successfully. |