Also erstmal danke dir für die schnelle Antwort. Klasse! :daumenhoc
Hier ist als erstes das Malwarebytes-Logfile: Code:
Malwarebytes Anti-Malware 1.75.0.1300
www.malwarebytes.org
Datenbank Version: v2013.05.13.05
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
*** :: FABIANPC [Administrator]
13.05.2013 17:30:08
mbam-log-2013-05-13 (17-30-08).txt
Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 221856
Laufzeit: 6 Minute(n), 46 Sekunde(n)
Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)
Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)
Infizierte Dateien: 1
C:\Users\***\AppData\Local\Temp\addlyrics1030.exe (Trojan.StartPage) -> Erfolgreich gelöscht und in Quarantäne gestellt.
(Ende) Dann hier sind die Avira-Logs: Code:
Exportierte Ereignisse:
13.05.2013 17:20 [System Scanner] Malware gefunden
Die Datei 'C:\Users\
\AppData\LocalLow\Sun\Java\Deployment\cache\6.0\30\274cc81e-2a65b7f1'
enthielt einen Virus oder unerwünschtes Programm 'JAVA/Inject.AU' [virus].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '5799ab1f.qua'
verschoben!
12.05.2013 19:53 [System Scanner] Malware gefunden
Die Datei 'C:\Users\***\AppData\Local\Microsoft\Windows\Temporary
Internet Files\Content.IE5\C09DHDH8\yontoosetup[1].exe'
enthielt einen Virus oder unerwünschtes Programm 'ADWARE/Yontoo.Gen' [adware].
Durchgeführte Aktion(en):
Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '54617aa3.qua'
verschoben!
12.05.2013 19:52 [Echtzeit Scanner] Malware gefunden
In der Datei 'C:\Users\
\AppData\Local\Temp\E8FFCAF8\YontooSetup.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Yontoo.Gen' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern
12.05.2013 19:52 [Echtzeit Scanner] Malware gefunden
In der Datei 'C:\Users\
\AppData\Local\Microsoft\Windows\Temporary Internet
Files\Content.IE5\C09DHDH8\yontoosetup[1].exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Yontoo.Gen' [adware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
12.05.2013 19:52 [Echtzeit Scanner] Malware gefunden
In der Datei 'C:\Users\
\AppData\Local\Temp\E8FFCAF8\YontooSetup.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Yontoo.Gen' [adware]
gefunden.
Ausgeführte Aktion: Übergeben an Scanner
12.05.2013 19:52 [Echtzeit Scanner] Malware gefunden
In der Datei 'C:\Users\***\AppData\Local\Temp\E8FFCAF8\up.exe'
wurde ein Virus oder unerwünschtes Programm 'ADWARE/Yontoo.Gen' [adware]
gefunden.
Ausgeführte Aktion: Zugriff verweigern dann ist hier das OTL-Logfile OTL.Txt Code:
OTL logfile created on: 14.05.2013 14:34:36 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,98 Gb Total Physical Memory | 6,51 Gb Available Physical Memory | 81,61% Memory free
15,96 Gb Paging File | 14,35 Gb Available in Paging File | 89,91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 107,41 Gb Total Space | 11,09 Gb Free Space | 10,32% Space Free | Partition Type: NTFS
Drive D: | 149,90 Gb Total Space | 146,61 Gb Free Space | 97,81% Space Free | Partition Type: NTFS
Drive E: | 192,35 Gb Total Space | 192,26 Gb Free Space | 99,95% Space Free | Partition Type: NTFS
Computer Name: FABIANPC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_11_7_700_169.exe (Adobe Systems, Inc.)
PRC - C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
========== Modules (No Company Name) ==========
MOD - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
MOD - C:\Program Files (x86)\Mozilla Firefox\mozjs.dll ()
========== Services (SafeList) ==========
SRV:64bit: - (AMD External Events Utility) -- C:\Windows\SysNative\atiesrxx.exe (AMD)
SRV - (BEService) -- C:\Program Files (x86)\Common Files\BattlEye\BEService.exe ()
SRV - (MozillaMaintenance) -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (Akamai) -- c:\program files (x86)\common files\akamai/netsession_win_ca0e279.dll ()
SRV - (SkypeUpdate) -- C:\Program Files (x86)\Skype\Updater\Updater.exe (Skype Technologies)
SRV - (HiPatchService) -- C:\Program Files (x86)\Hi-Rez Studios\HiPatchService.exe (Hi-Rez Studios)
SRV - (AntiVirService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (clr_optimization_v4.0.30319_32) -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe (Microsoft Corporation)
SRV - (clr_optimization_v2.0.50727_32) -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe (Microsoft Corporation)
========== Driver Services (SafeList) ==========
DRV:64bit: - (avipbb) -- C:\Windows\SysNative\drivers\avipbb.sys (Avira GmbH)
DRV:64bit: - (avgntflt) -- C:\Windows\SysNative\drivers\avgntflt.sys (Avira GmbH)
DRV:64bit: - (amdkmdag) -- C:\Windows\SysNative\drivers\atikmdag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (amdkmdap) -- C:\Windows\SysNative\drivers\atikmpag.sys (Advanced Micro Devices, Inc.)
DRV:64bit: - (AtiHDAudioService) -- C:\Windows\SysNative\drivers\AtihdW76.sys (Advanced Micro Devices)
DRV:64bit: - (Fs_Rec) -- C:\Windows\SysNative\drivers\fs_rec.sys (Microsoft Corporation)
DRV:64bit: - (avkmgr) -- C:\Windows\SysNative\drivers\avkmgr.sys (Avira GmbH)
DRV:64bit: - (amdsata) -- C:\Windows\SysNative\drivers\amdsata.sys (Advanced Micro Devices)
DRV:64bit: - (amdxata) -- C:\Windows\SysNative\drivers\amdxata.sys (Advanced Micro Devices)
DRV:64bit: - (BCM43XX) -- C:\Windows\SysNative\drivers\BCMWL664.SYS (Broadcom Corporation)
DRV:64bit: - (HpSAMD) -- C:\Windows\SysNative\drivers\HpSAMD.sys (Hewlett-Packard Company)
DRV:64bit: - (TsUsbFlt) -- C:\Windows\SysNative\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV:64bit: - (MEIx64) -- C:\Windows\SysNative\drivers\HECIx64.sys (Intel Corporation)
DRV:64bit: - (L1C) -- C:\Windows\SysNative\drivers\L1C60x64.sys (Atheros Communications, Inc.)
DRV:64bit: - (ss_bmdm) -- C:\Windows\SysNative\drivers\ss_bmdm.sys (MCCI Corporation)
DRV:64bit: - (ss_bbus) -- C:\Windows\SysNative\drivers\ss_bbus.sys (MCCI)
DRV:64bit: - (ss_bmdfl) -- C:\Windows\SysNative\drivers\ss_bmdfl.sys (MCCI Corporation)
DRV:64bit: - (xusb21) -- C:\Windows\SysNative\drivers\xusb21.sys (Microsoft Corporation)
DRV:64bit: - (amdsbs) -- C:\Windows\SysNative\drivers\amdsbs.sys (AMD Technologies Inc.)
DRV:64bit: - (LSI_SAS2) -- C:\Windows\SysNative\drivers\lsi_sas2.sys (LSI Corporation)
DRV:64bit: - (stexstor) -- C:\Windows\SysNative\drivers\stexstor.sys (Promise Technology)
DRV:64bit: - (ebdrv) -- C:\Windows\SysNative\drivers\evbda.sys (Broadcom Corporation)
DRV:64bit: - (b06bdrv) -- C:\Windows\SysNative\drivers\bxvbda.sys (Broadcom Corporation)
DRV:64bit: - (b57nd60a) -- C:\Windows\SysNative\drivers\b57nd60a.sys (Broadcom Corporation)
DRV:64bit: - (hcw85cir) -- C:\Windows\SysNative\drivers\hcw85cir.sys (Hauppauge Computer Works, Inc.)
DRV:64bit: - (hamachi) -- C:\Windows\SysNative\drivers\hamachi.sys (LogMeIn, Inc.)
DRV - (WIMMount) -- C:\Windows\SysWOW64\drivers\wimmount.sys (Microsoft Corporation)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
IE - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.t-online.de/
IE - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = B6 02 5F 45 C1 A0 CD 01 [binary data]
IE - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
========== FireFox ==========
FF - prefs.js..browser.search.useDBForOrder: "false"
FF - prefs.js..browser.startup.homepage: "hxxp://www.t-online.de/"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_169.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll (Nexon)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.04.12 16:26:11 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.04.12 16:26:11 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
[2013.02.09 20:07:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2013.04.12 16:26:08 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions
[2013.04.12 16:26:11 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2013.02.01 21:33:32 | 000,001,392 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2013.02.01 21:33:32 | 000,002,465 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2013.02.01 21:33:32 | 000,001,153 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2013.02.01 21:33:32 | 000,006,805 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2013.02.01 21:33:32 | 000,001,178 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2013.02.01 21:33:32 | 000,001,105 | ---- | M] () -- C:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
========== Chrome ==========
CHR - homepage:
CHR - homepage:
CHR - Extension: YouTube = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo\4.2.5_0\
CHR - Extension: Google-Suche = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf\0.0.0.19_0\
CHR - Extension: Google Mail = C:\Users\***\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia\7_0\
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4:64bit: - HKLM..\Run: [Logitech Download Assistant] C:\Windows\SysNative\LogiLDA.dll (Logitech, Inc.)
O4:64bit: - HKLM..\Run: [RtHDVBg] C:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [AMD AVT] C:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\.DEFAULT..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-18..\RunOnce: [SPReview] "C:\Windows\System32\SPReview\SPReview.exe" /sp:1 /errorfwlink:"hxxp://go.microsoft.com/fwlink/?LinkID=122915" /build:7601 File not found
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000 File not found
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKU\.DEFAULT\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\.DEFAULT\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-18\..Trusted Domains: sony.com ([]* in Trusted sites)
O15 - HKU\S-1-5-19\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-19\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: clonewarsadventures.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: freerealms.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: soe.com ([]* in )
O15 - HKU\S-1-5-20\..Trusted Domains: sony.com ([]* in )
O15 - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKU\S-1-5-21-3487882854-2216797950-3624459367-1000\..Trusted Domains: sony.com ([]* in Trusted sites)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.254
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{9988BDEE-F0ED-4BE9-B0FA-051A2F10DFC2}: DhcpNameServer = 192.168.1.254
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.05.14 14:30:13 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2013.05.04 21:00:21 | 000,000,000 | ---D | C] -- C:\Users\***\Documents\BIS Core Engine
[2013.05.01 16:35:13 | 000,000,000 | ---D | C] -- C:\Users\***\Desktop\ACE Backups
[2013.04.30 23:03:21 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Play withSIX
[2013.04.30 23:02:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SIX Networks
[2013.04.30 23:02:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\SIX Networks
[2013.04.17 17:16:53 | 000,311,200 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2013.04.17 17:16:51 | 000,188,832 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2013.04.17 17:16:51 | 000,188,320 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2013.04.17 17:16:51 | 000,108,448 | ---- | C] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013.04.17 17:12:40 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Common Files\Java
[2013.04.17 17:12:20 | 000,263,584 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.04.17 17:12:18 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.04.17 17:12:18 | 000,174,496 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.04.17 17:12:18 | 000,095,648 | ---- | C] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.04.17 17:12:02 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Java
[2013.04.15 18:01:21 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Sony Online Entertainment
[2012.10.02 19:30:46 | 671,261,856 | ---- | C] (InstallShield Software Corporation) -- C:\Program Files\S4League.exe
========== Files - Modified Within 30 Days ==========
[2013.05.14 14:30:15 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2013.05.14 14:21:31 | 000,014,592 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.14 14:21:31 | 000,014,592 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.14 14:19:58 | 001,612,484 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.05.14 14:19:58 | 000,696,870 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.05.14 14:19:58 | 000,652,148 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.05.14 14:19:58 | 000,148,134 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.05.14 14:19:58 | 000,121,080 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.05.14 14:13:36 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.14 14:13:29 | 2133,217,279 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.13 17:28:05 | 000,001,113 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.05.07 17:33:56 | 000,001,443 | ---- | M] () -- C:\Users\***\AppData\Local\recently-used.xbel
[2013.04.30 23:51:15 | 000,000,339 | ---- | M] () -- C:\Windows\SysWow64\checkFileList.lst
[2013.04.22 20:37:49 | 000,005,632 | ---- | M] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2013.04.19 22:55:34 | 000,007,601 | ---- | M] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg
[2013.04.17 17:42:25 | 000,691,592 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerApp.exe
[2013.04.17 17:42:25 | 000,071,048 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
[2013.04.17 17:16:46 | 001,092,512 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\npDeployJava1.dll
[2013.04.17 17:16:46 | 000,971,680 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\deployJava1.dll
[2013.04.17 17:16:46 | 000,311,200 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaws.exe
[2013.04.17 17:16:46 | 000,188,832 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\javaw.exe
[2013.04.17 17:16:46 | 000,188,320 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\java.exe
[2013.04.17 17:16:46 | 000,108,448 | ---- | M] (Oracle Corporation) -- C:\Windows\SysNative\WindowsAccessBridge-64.dll
[2013.04.17 17:12:06 | 000,095,648 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
[2013.04.17 17:12:05 | 000,866,720 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\npDeployJava1.dll
[2013.04.17 17:12:05 | 000,788,896 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\deployJava1.dll
[2013.04.17 17:12:05 | 000,263,584 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaws.exe
[2013.04.17 17:12:05 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\javaw.exe
[2013.04.17 17:12:05 | 000,174,496 | ---- | M] (Oracle Corporation) -- C:\Windows\SysWow64\java.exe
[2013.04.14 19:35:32 | 000,418,592 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
========== Files Created - No Company Name ==========
[2013.05.07 17:33:56 | 000,001,443 | ---- | C] () -- C:\Users\***\AppData\Local\recently-used.xbel
[2013.04.30 23:51:15 | 000,000,339 | ---- | C] () -- C:\Windows\SysWow64\checkFileList.lst
[2013.02.12 05:15:04 | 000,007,601 | ---- | C] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg
[2013.02.12 02:23:32 | 001,589,650 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.12.22 00:47:23 | 000,005,632 | ---- | C] () -- C:\Users\***\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.10.05 19:33:56 | 639,177,656 | ---- | C] () -- C:\Program Files\Crossfire_Install_1100.exe
[2012.10.02 19:21:32 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.06.11 18:50:16 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.06.11 18:50:16 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.05.10 16:35:16 | 000,029,184 | ---- | C] () -- C:\Windows\SysWow64\kdbsdk32.dll
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
========== ZeroAccess Check ==========
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2013.05.13 21:28:54 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\.minecraft
[2013.01.08 22:42:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Blender Foundation
[2013.02.17 00:36:13 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Dev-Cpp
[2013.02.12 19:01:38 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2013.04.02 20:23:29 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FileZilla
[2013.04.30 23:03:49 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Play withSIX
[2013.05.13 21:33:42 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\TS3Client
========== Purity Check ==========
< End of report > und zu guter Letzt noch das Logfile Extras.Txt von OTL Code:
OTL Extras logfile created on: 14.05.2013 14:34:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
7,98 Gb Total Physical Memory | 6,51 Gb Available Physical Memory | 81,61% Memory free
15,96 Gb Paging File | 14,35 Gb Available in Paging File | 89,91% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 107,41 Gb Total Space | 11,09 Gb Free Space | 10,32% Space Free | Partition Type: NTFS
Drive D: | 149,90 Gb Total Space | 146,61 Gb Free Space | 97,81% Space Free | Partition Type: NTFS
Drive E: | 192,35 Gb Total Space | 192,26 Gb Free Space | 99,95% Space Free | Partition Type: NTFS
Computer Name: FABIANPC | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
[HKEY_USERS\S-1-5-21-3487882854-2216797950-3624459367-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1C534149-C77F-448B-93C1-C4002D771C69}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{1E5325CF-9E63-4549-AD8E-8B02BAB80567}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{2989367A-87AF-4B1E-A17B-C2BBF4AE25D0}" = lport=2869 | protocol=6 | dir=in | app=system |
"{2DF178EA-6332-438F-9BA4-612C2DEF7877}" = lport=445 | protocol=6 | dir=in | app=system |
"{2FE6EE93-441E-4AD5-BBBE-E2228C77EC0E}" = rport=139 | protocol=6 | dir=out | app=system |
"{33402E67-6EE5-4705-9F54-EC7B6E0328F2}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{36C107DC-923C-499D-A11A-ABDF3D3BC219}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{4CB04819-2362-4CA2-A822-A47CFE01AA4C}" = rport=138 | protocol=17 | dir=out | app=system |
"{50622794-D68D-4A87-B37E-846D0589974C}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5C5D2203-9FF8-4233-A3EB-1FA46503066A}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{5E53281B-9765-42DA-88F0-3784EDE981FD}" = lport=10243 | protocol=6 | dir=in | app=system |
"{6EDE23D4-8ED5-431A-9CFB-60D3AD86BB6E}" = lport=137 | protocol=17 | dir=in | app=system |
"{7337E661-8CC9-46BA-A691-C67E171A1073}" = lport=139 | protocol=6 | dir=in | app=system |
"{73471736-7FAA-491A-9334-D8D167461D32}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{7E1311F6-9C36-4B9D-B900-F5BB3DC5EC85}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{893F82E7-C99F-4F68-A987-28C34BE96484}" = lport=49400 | protocol=6 | dir=in | name=akamai netsession interface |
"{93038BDE-5D5A-4350-83B9-9416EA456363}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A84DE343-04D0-4AC7-9075-FB9435FC2E2B}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C59C0770-EE39-4652-A921-45C6FE797340}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{D69567EA-4AA7-46E0-92CE-72A6E2F5092D}" = rport=137 | protocol=17 | dir=out | app=system |
"{D9616694-3461-46C8-8F1F-E095D1DF8937}" = lport=138 | protocol=17 | dir=in | app=system |
"{E7EE3D79-AC36-47BC-B05B-435296D777CF}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F3057216-C7B8-4873-B137-EDD870350E10}" = rport=10243 | protocol=6 | dir=out | app=system |
"{F9EF58B7-0BC7-409F-AD46-ADD343E42FB4}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{FB16D2A7-711A-40C6-8345-5F2EF65EE73E}" = rport=445 | protocol=6 | dir=out | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0858B517-9AF8-4DD0-8DC8-907E153EFA35}" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{0B778136-4275-4B05-9412-C438E685B95B}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{14ACC751-BCE3-495B-BBB6-3EC3A61653C2}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{1693BFFD-EB0C-4EBF-965A-2D438C53E397}" = protocol=6 | dir=in | app=c:\users\***\appdata\local\akamai\netsession_win.exe |
"{22343BC3-C10C-4D24-B592-06891DF9D4C4}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{2744886B-AEA4-488B-AFA7-F5D7B3160DD2}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{2CDF73F5-1ECF-44D7-9208-68CDB085E390}" = protocol=6 | dir=out | app=system |
"{2F2D1237-49E9-4051-BE69-F671484EF7DB}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{30088CC2-2811-4AD0-A780-3CBF304C15E1}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{398FCAAA-BC78-4C62-B6C4-CFC9A35B4AC5}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{4E1B84B6-1C66-4AA4-B640-6B145BF75EB4}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{599858F1-193D-4D6A-A493-72453CFFF381}" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.744\survivers_beta_3.exe |
"{5ABAEA88-54E4-47CB-8A64-5C4BD99E435D}" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe |
"{6571BED0-9AAF-4D65-B507-EC127E3C38EB}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{66DF3CE0-0869-4F69-9E28-0EE472C4E100}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{69B1997F-1670-420C-B6CD-C95B7271A837}" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2oa.exe |
"{79390E25-997C-494F-A2D5-9EE14BBDF1E5}" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{7DCA9224-80DB-4031-AAB8-1D3C02CE6A0E}" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.849\survivers_beta_3.exe |
"{89A7425A-EDD1-43F9-9BAD-54C4D27A878A}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{949A4145-54A6-454F-A4F2-AFC206D6112A}" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.744\survivers_beta_3.exe |
"{9DB5433C-E244-452B-B940-8409E7DC0826}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{9F7F1C24-B0F6-4614-A8E0-F40A02062953}" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe |
"{A0F320EE-8159-447D-9755-B85A399BD036}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{A7905E20-B3BD-4B80-9EBB-2DACB563724D}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{B10C6EED-D129-463B-985D-181114D0DFBC}" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.849\survivers_beta_3.exe |
"{B431DA5A-5A2B-4C0B-9E08-E4A2B86450FC}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{C17EB62A-119E-4D14-BFC7-EBAB07E86448}" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{C2052411-7E7D-4603-AC44-3981020C60DA}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{C5070CF1-4E2B-483F-88DE-5FA3B31B184A}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{CAC252B6-2F2A-4665-A958-1634F3E0D6D3}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{CBF1CBF4-B059-49CA-9540-2C563641451B}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{CC4427DB-92D9-4026-B623-0C03F12BEF38}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D3D53093-FC72-4DFD-AF09-CAE28F79A462}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{D954BF9C-ED8F-419F-948C-D162C0751DC6}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{E24B6989-E399-4610-961B-91A63D085B90}" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2oa.exe |
"{EAF3F451-FCBA-4A20-B7BD-971605595FF0}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{EDF521B1-BCCA-4FF6-807C-AF54865D5784}" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\nmservice.exe |
"{EE975136-2862-4610-9971-017627A500FD}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{EEACAF12-6363-4A77-9F05-B1FEEB24DC09}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{F81947A2-AF6D-43A2-949E-5993DDF51EAE}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{F921E920-9CE6-4821-8217-068E800D57F6}" = protocol=17 | dir=in | app=c:\users\***\appdata\local\akamai\netsession_win.exe |
"TCP Query User{00F40DAD-82EB-46D1-892F-92E91DFD8D72}C:\users\public\sony online entertainment\installed games\planetside 2 psg\planetside2.exe" = protocol=6 | dir=in | app=c:\users\public\sony online entertainment\installed games\planetside 2 psg\planetside2.exe |
"TCP Query User{03B48F63-D95A-4DEA-94E9-0A54E11F97E5}C:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=6 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"TCP Query User{1154F58D-A929-4AD6-9B44-DD74BB16ADAD}C:\users\***\appdata\local\temp\rar$exa0.136\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.136\survivers_beta_3.exe |
"TCP Query User{173E164A-A13D-4914-AF6C-F2D9892CB85F}C:\nexon\combat arms eu\engine.exe" = protocol=6 | dir=in | app=c:\nexon\combat arms eu\engine.exe |
"TCP Query User{1782C4E7-88A2-47D8-866F-278BED7909CA}C:\program files\bohemia interactive\arma 2\arma2.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe |
"TCP Query User{191E8ABA-9AF8-476D-8002-D422337080DA}C:\users\***\appdata\local\temp\rar$exa0.749\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.749\survivers_beta_3.exe |
"TCP Query User{210A6A2F-53E0-4B7B-BAEA-D48F1E729E69}C:\users\***\appdata\local\temp\rar$exa0.401\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.401\survivers_beta_3.exe |
"TCP Query User{22A1D9A4-F08A-4274-A042-2A4DF3E9E976}C:\users\***\appdata\local\temp\rar$exa0.866\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.866\survivers_beta_3.exe |
"TCP Query User{24039613-B3B1-440D-AE03-B84941DBAB8A}C:\users\***\appdata\local\temp\rar$exa0.390\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.390\survivers_beta_3.exe |
"TCP Query User{264A1BCC-A7B6-4289-AE61-A4D5AE03C930}C:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=6 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"TCP Query User{2944C669-4D29-4B4F-901C-716188A5CCA3}C:\program files\bohemia interactive\arma 2\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma 2\expansion\beta\arma2oa.exe |
"TCP Query User{41C08760-1B4D-4CF2-9E33-A411DCBD1069}C:\users\***\appdata\local\temp\rar$exa0.525\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.525\survivers_beta_3.exe |
"TCP Query User{4B33E0D4-6F57-4631-8CD3-319C51B3DB1A}C:\windows\syswow64\javaw.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\javaw.exe |
"TCP Query User{4B37627A-752C-49BE-9F71-CD247D12DFA6}C:\users\***\appdata\local\temp\rar$exa0.506\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.506\survivers_beta_3.exe |
"TCP Query User{57158C4F-7255-42D6-8BCC-0961AE9B72BB}C:\windows\syswow64\javaw.exe" = protocol=6 | dir=in | app=c:\windows\syswow64\javaw.exe |
"TCP Query User{5FF98193-A1BD-49DE-B624-1AC06EC07867}C:\users\***\appdata\local\temp\rar$exa0.464\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.464\survivers_beta_3.exe |
"TCP Query User{72B7A82A-A7D2-4BDE-86BF-5851236900B8}C:\users\***\documents\arma 2\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=c:\users\***\documents\arma 2\expansion\beta\arma2oa.exe |
"TCP Query User{7B7AD8AB-E812-436E-ADBA-041EE3E2A6E0}C:\users\***\appdata\local\temp\rar$exa0.817\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.817\survivers_beta_3.exe |
"TCP Query User{85DDF396-6E6E-46BA-9BFD-B3CC14AA98FF}C:\users\***\appdata\local\temp\rar$exa0.744\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.744\survivers_beta_3.exe |
"TCP Query User{865670C0-91DE-4606-B4F8-7319D34915D9}C:\users\***\appdata\local\temp\rar$exa0.632\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.632\survivers_beta_3.exe |
"TCP Query User{88F913BC-4119-4A33-B0DA-43D2075CD4F2}C:\program files (x86)\microsoft office\office12\groove.exe" = protocol=6 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"TCP Query User{89A2C1F8-B5D2-4FF2-B389-067E34660BA4}C:\users\***\appdata\local\temp\rar$exa0.092\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.092\survivers_beta_3.exe |
"TCP Query User{8DB21A71-ADEA-40ED-AC9C-77D835638F0A}C:\users\***\appdata\local\temp\rar$exa0.299\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.299\survivers_beta_3.exe |
"TCP Query User{8FAB6164-D080-4633-9A72-969C42436BBC}C:\users\***\appdata\local\akamai\netsession_win.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\akamai\netsession_win.exe |
"TCP Query User{B7044A1D-5348-4CF0-A7A6-8536F500C575}C:\users\***\appdata\local\temp\rar$exa0.388\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.388\survivers_beta_3.exe |
"TCP Query User{C49E57EF-A31C-4E88-9EBE-A86C9DBC0E77}C:\users\***\appdata\local\temp\rar$exa0.087\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.087\survivers_beta_3.exe |
"TCP Query User{CB1F6C97-E4C4-4F40-885A-5757C30D5E86}C:\program files\bohemia interactive\arma 2\expansion\beta\arma2oa.exe" = protocol=6 | dir=in | app=c:\program files\bohemia interactive\arma 2\expansion\beta\arma2oa.exe |
"TCP Query User{E29AF909-FB21-4C00-8BAA-1187460D8232}C:\users\***\appdata\local\play withsix\tools\mingw\bin\rsync.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\play withsix\tools\mingw\bin\rsync.exe |
"TCP Query User{E5E0BDA9-B549-4068-A473-AEE982DBB9F9}C:\users\***\appdata\local\temp\rar$exa0.485\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.485\survivers_beta_3.exe |
"TCP Query User{EFB769BE-9621-49B5-8597-B6333174CBD7}C:\users\***\appdata\local\temp\rar$exa0.849\survivers_beta_3.exe" = protocol=6 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.849\survivers_beta_3.exe |
"UDP Query User{098CE094-1C10-44B7-B456-5D4C03C59184}C:\users\***\appdata\local\temp\rar$exa0.401\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.401\survivers_beta_3.exe |
"UDP Query User{166B1167-03C4-438F-AC8D-A43DC5CFF5F8}C:\users\***\appdata\local\temp\rar$exa0.632\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.632\survivers_beta_3.exe |
"UDP Query User{1B138BA1-15D9-44D0-9186-0DAFB3E694A7}C:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=17 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"UDP Query User{2BCA51CB-E85A-4953-B75F-0EDBCD1A7F8F}C:\users\***\appdata\local\temp\rar$exa0.464\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.464\survivers_beta_3.exe |
"UDP Query User{306A328A-3868-41D9-ABC9-06EC79C8FB21}C:\program files (x86)\microsoft office\office12\groove.exe" = protocol=17 | dir=in | app=c:\program files (x86)\microsoft office\office12\groove.exe |
"UDP Query User{418ADE93-AFFA-4EE3-8ED3-D2EC6AC89118}C:\users\***\appdata\local\temp\rar$exa0.390\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.390\survivers_beta_3.exe |
"UDP Query User{4594B0A5-D048-4719-82DB-AE14E97FE955}C:\users\***\appdata\local\temp\rar$exa0.866\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.866\survivers_beta_3.exe |
"UDP Query User{6502AF5D-65BC-4245-885D-E5A43DCA1B9B}C:\windows\syswow64\javaw.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\javaw.exe |
"UDP Query User{6CDF1634-DDB2-479B-9AC9-3609A2A6F5F0}C:\users\***\appdata\local\temp\rar$exa0.506\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.506\survivers_beta_3.exe |
"UDP Query User{7A063FFC-F667-4FC1-860D-CCE149A7B850}C:\windows\syswow64\javaw.exe" = protocol=17 | dir=in | app=c:\windows\syswow64\javaw.exe |
"UDP Query User{85511B2A-2E57-4C62-A0BD-64101D71A5A2}C:\nexon\combat arms eu\engine.exe" = protocol=17 | dir=in | app=c:\nexon\combat arms eu\engine.exe |
"UDP Query User{85E93ED6-2062-4364-906A-E5CE4658CD5D}C:\users\***\appdata\local\temp\rar$exa0.744\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.744\survivers_beta_3.exe |
"UDP Query User{8BCA4980-D65F-4453-B79E-449FB12E2873}C:\users\***\appdata\local\temp\rar$exa0.485\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.485\survivers_beta_3.exe |
"UDP Query User{91C9A3C2-70F2-4BD3-AA67-60B64E6B5698}C:\users\***\appdata\local\temp\rar$exa0.817\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.817\survivers_beta_3.exe |
"UDP Query User{9E2112AF-8B6E-4762-9F2E-4152E088F736}C:\users\***\appdata\local\temp\rar$exa0.299\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.299\survivers_beta_3.exe |
"UDP Query User{AD3D3F84-FAA1-4F1A-9E0E-AE2699D3F1A3}C:\users\***\documents\arma 2\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=c:\users\***\documents\arma 2\expansion\beta\arma2oa.exe |
"UDP Query User{B1B9D4E7-7154-4EB4-9444-8F4364E8D07F}C:\users\***\appdata\local\temp\rar$exa0.749\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.749\survivers_beta_3.exe |
"UDP Query User{B2E940D3-BBBF-48A6-82DC-1F7B8EB41A50}C:\users\***\appdata\local\akamai\netsession_win.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\akamai\netsession_win.exe |
"UDP Query User{B674428D-4832-4904-B3AB-5B8D021FB2C7}C:\users\***\appdata\local\temp\rar$exa0.388\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.388\survivers_beta_3.exe |
"UDP Query User{B7E68C79-491D-468A-A146-29115750F22E}C:\program files\bohemia interactive\arma 2\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma 2\expansion\beta\arma2oa.exe |
"UDP Query User{C5C5A012-5AF2-4672-943F-9FD6C735A2DF}C:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe" = protocol=17 | dir=in | app=c:\program files (x86)\hi-rez studios\hirezgames\tribes\binaries\win32\tribesascend.exe |
"UDP Query User{CF3273B7-00F6-4808-BF66-966B94ACF8BB}C:\users\public\sony online entertainment\installed games\planetside 2 psg\planetside2.exe" = protocol=17 | dir=in | app=c:\users\public\sony online entertainment\installed games\planetside 2 psg\planetside2.exe |
"UDP Query User{CF4A06A7-1186-4EF7-909C-E6F938E9C9A1}C:\program files\bohemia interactive\arma 2\arma2.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma 2\arma2.exe |
"UDP Query User{D2D9A987-726F-40B3-BBC6-8802EE9302AE}C:\users\***\appdata\local\temp\rar$exa0.525\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.525\survivers_beta_3.exe |
"UDP Query User{D4C43620-057D-4AFE-886B-4859CCE0EFD6}C:\users\***\appdata\local\temp\rar$exa0.092\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.092\survivers_beta_3.exe |
"UDP Query User{E2255119-40CD-4F74-91BD-A5EE6F87C62D}C:\users\***\appdata\local\temp\rar$exa0.849\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.849\survivers_beta_3.exe |
"UDP Query User{E4CF7929-1BCC-4A29-8A72-17FB56B81D0A}C:\users\***\appdata\local\play withsix\tools\mingw\bin\rsync.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\play withsix\tools\mingw\bin\rsync.exe |
"UDP Query User{E905B2D7-971B-47F0-B4F4-778D40839A78}C:\users\***\appdata\local\temp\rar$exa0.136\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.136\survivers_beta_3.exe |
"UDP Query User{EEA10589-E355-4E88-B890-A749CAD16560}C:\users\***\appdata\local\temp\rar$exa0.087\survivers_beta_3.exe" = protocol=17 | dir=in | app=c:\users\***\appdata\local\temp\rar$exa0.087\survivers_beta_3.exe |
"UDP Query User{FB7C0679-E9C6-47CF-8A2D-8A6FB71EDE54}C:\program files\bohemia interactive\arma 2\expansion\beta\arma2oa.exe" = protocol=17 | dir=in | app=c:\program files\bohemia interactive\arma 2\expansion\beta\arma2oa.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02382870-19C7-3ACD-BBAE-F6E3760947DC}" = Microsoft .NET Framework 4 Extended DEU Language Pack
"{031BF995-4361-6F87-1C15-FD6103B67B5F}" = AMD Accelerated Video Transcoding
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{26A24AE4-039D-4CA4-87B4-2F86417021FF}" = Java 7 Update 21 (64-bit)
"{38CF3033-36AA-7083-2AAB-35E5BBD62F1E}" = AMD Drag and Drop Transcoding
"{503F672D-6C84-448A-8F8F-4BC35AC83441}" = AMD APP SDK Runtime
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90120000-002A-0000-1000-0000000FF1CE}" = Microsoft Office Office 64-bit Components 2007
"{90120000-002A-0407-1000-0000000FF1CE}" = Microsoft Office Shared 64-bit MUI (German) 2007
"{AC2AAFF8-6719-A420-AB9F-7E5F5E6CA46A}" = AMD Catalyst Install Manager
"{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"{FF0E1F56-A1FE-56EC-C33D-578F3E5C5C15}" = ccc-utility64
"{FFA1864E-ADC4-66F6-CC60-877E06EE47E3}" = AMD Media Foundation Decoders
"Blender" = Blender
"GIMP-2_is1" = GIMP 2.8.2
"HyperCam 2" = HyperCam 2
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Microsoft .NET Framework 4 Extended DEU Language Pack" = Microsoft .NET Framework 4 Extended DEU Language Pack
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Acer Crystal Eye Webcam
"{12F4B10F-2B95-0D9B-ED71-296DA3C20F09}" = CCC Help Czech
"{26A0582C-03C1-BB0A-EC77-22BC17A4A601}" = Catalyst Control Center Graphics Previews Common
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{289AC7E0-0AEE-4a7b-913C-709D9803D23E}" = Nexon Game Manager
"{29157928-F504-238C-47C7-5389C0F3D6BF}" = CCC Help Swedish
"{2B512D86-0BEE-1F51-FDB7-D414C0D6A40E}" = CCC Help Portuguese
"{3A5D79AA-13D7-74FD-1850-E356528DE1A0}" = CCC Help Japanese
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF010}" = Tribes Ascend
"{3C87E0FF-BC0A-4F5E-951B-68DC3F8DF1FC}" = Hi-Rez Studios Authenticate and Update Service
"{4082C4D2-9299-AECE-0116-B894D3898F2F}" = Catalyst Control Center
"{42DCB650-F003-4535-A5CD-32AD815CD2DD}" = Play withSIX
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.3
"{63738E95-2626-0C13-B682-DCA526B3B3B8}" = CCC Help French
"{648B59AA-B9BF-CBB9-3123-DCEDF669534B}" = CCC Help Turkish
"{663E92C0-0141-0307-6F04-4465EE0002B2}" = CCC Help Italian
"{6879F7F5-E63B-3DCC-DF23-30C4703547D6}" = CCC Help Finnish
"{6E19AEFD-7F83-4563-A7B5-F61CABF02400}" = DayZ Commander
"{6EB88C92-7828-A799-7A87-AEAA798055FA}" = CCC Help Dutch
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{716E0306-8318-4364-8B8F-0CC4E9376BAC}" = MSXML 4.0 SP2 Parser und SDK
"{7CFC3EF7-41DB-10A6-C7FC-92AD2778043F}" = CCC Help Chinese Traditional
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{90120000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2007
"{90120000-0015-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007
"{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007
"{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2007
"{90120000-0019-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2007
"{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007
"{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007
"{90120000-001F-0407-0000-0000000FF1CE}_ENTERPRISE_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007
"{90120000-001F-0409-0000-0000000FF1CE}_ENTERPRISE_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007
"{90120000-001F-040C-0000-0000000FF1CE}_ENTERPRISE_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007
"{90120000-001F-0410-0000-0000000FF1CE}_ENTERPRISE_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)
"{90120000-002A-0000-1000-0000000FF1CE}_ENTERPRISE_{664655D8-B9BB-455D-8A58-7EAF7B0B2862}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002A-0407-1000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007
"{90120000-0030-0000-0000-0000000FF1CE}" = Microsoft Office Enterprise 2007
"{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-0044-0407-0000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2007
"{90120000-0044-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007
"{90120000-006E-0407-0000-0000000FF1CE}_ENTERPRISE_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007
"{90120000-00A1-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90120000-00BA-0407-0000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2007
"{90120000-00BA-0407-0000-0000000FF1CE}_ENTERPRISE_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)
"{90287FB1-220B-C54D-9374-070F6BCEFF7C}" = CCC Help Norwegian
"{907F9C22-CD5B-2864-2FBB-6B1DFCEE0787}" = CCC Help Russian
"{92858613-6C37-1DBB-1DF6-2D2832FD5F2D}" = Catalyst Control Center Localization All
"{942641F2-705E-3E66-5D39-BC3AFB476B3A}" = CCC Help Chinese Standard
"{95B90127-0B66-CE91-BFB7-CBA49AC39C0E}" = CCC Help Korean
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9FF01926-E64F-EBCB-CAB8-F8C005BE0A8B}" = CCC Help Polish
"{A1974D99-9FF0-9075-CBF4-F579D0717E84}" = CCC Help Thai
"{AE683B25-6D74-AE98-F9A9-E07FB9EF5B62}" = CCC Help English
"{B3DAF54F-DB25-4586-9EF1-96D24BB14088}" = Windows Movie Maker 2.6
"{B51C71F3-FA38-627E-1BDD-57831EB4F259}" = CCC Help German
"{CF45E5AA-4F5D-1188-CAA6-C2DE5ABBB389}" = Catalyst Control Center InstallProxy
"{D56B4299-B2B4-4822-ED77-945B0CCF2192}" = CCC Help Greek
"{D6930099-BDDA-A5BA-16E0-291C0A6899C9}" = CCC Help Danish
"{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}" = Microsoft XNA Framework Redistributable 4.0 Refresh
"{DDF6EED9-EBA0-4EB2-9778-347BFFB9307D}" = S4 League_EU
"{E09D83E8-40D2-5E4E-2138-77B6022F6049}" = CCC Help Spanish
"{E2F7EB9D-B814-1474-86AB-69BA1872CE1A}" = CCC Help Hungarian
"{E72F1051-B87E-4EF4-AE9F-8FDD229CC438}" = Catalyst Control Center - Branding
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Akamai" = Akamai NetSession Interface
"ArmA 2" = ArmA 2 Uninstall
"ARMA 2 Operation Arrowhead" = ARMA 2 Operation Arrowhead Uninstall
"Avira AntiVir Desktop" = Avira Free Antivirus
"BattlEye" = BattlEye Uninstall
"BattlEye for A2" = BattlEye Uninstall
"BattlEye for OA" = BattlEye for OA Uninstall
"Combat Arms EU" = Combat Arms EU
"Crossfire Europe" = Crossfire Europe
"ENTERPRISE" = Microsoft Office Enterprise 2007
"EPSON Scanner" = EPSON Scan
"FileZilla Client" = FileZilla Client 3.6.0.2
"InstallShield_{01FB4998-33C4-4431-85ED-079E3EEFE75D}" = Acer Crystal Eye Webcam
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Mozilla Firefox 20.0.1 (x86 de)" = Mozilla Firefox 20.0.1 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"WinRAR archiver" = WinRAR 4.20 (32-Bit)
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-3487882854-2216797950-3624459367-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"soe-PlanetSide 2 PSG" = PlanetSide 2
"TeamSpeak 3 Client" = TeamSpeak 3 Client
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 30.04.2013 17:53:57 | Computer Name = FabianPC | Source = Application Hang | ID = 1002
Description = Programm Play withSIX.exe, Version 1.3.0.450 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf
in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: 1f74 Startzeit: 01ce45ed2049f20c Endzeit: 39 Anwendungspfad:
C:\Program Files (x86)\SIX Networks\Play withSIX\Play withSIX.exe Berichts-ID: 73866d39-b1e0-11e2-a6e1-dc0ea10dd45d
Error - 30.04.2013 17:57:24 | Computer Name = FabianPC | Source = Application Hang | ID = 1002
Description = Programm arma2oa.exe, Version 1.62.103.718 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1e08 Startzeit:
01ce45ed871b7d25 Endzeit: 51 Anwendungspfad: C:\Users\***\Documents\arma
2\expansion\beta\arma2oa.exe Berichts-ID:
Error - 30.04.2013 20:24:09 | Computer Name = FabianPC | Source = Application Hang | ID = 1002
Description = Programm arma2oa.exe, Version 1.62.103.718 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 1a34 Startzeit:
01ce460219e87bef Endzeit: 15 Anwendungspfad: C:\Users\***\Documents\arma
2\expansion\beta\arma2oa.exe Berichts-ID: 6f545a83-b1f5-11e2-a6e1-dc0ea10dd45d
Error - 01.05.2013 11:43:40 | Computer Name = FabianPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 20.0.1.4847,
Zeitstempel: 0x51650aee Name des fehlerhaften Moduls: xul.dll, Version: 20.0.1.4847,
Zeitstempel: 0x51650a09 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b10e8 ID des fehlerhaften
Prozesses: 0xfa8 Startzeit der fehlerhaften Anwendung: 0x01ce468238e0104f Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Pfad
des fehlerhaften Moduls: C:\Program Files (x86)\Mozilla Firefox\xul.dll Berichtskennung:
e4973953-b275-11e2-a6e1-dc0ea10dd45d
Error - 04.05.2013 15:00:10 | Computer Name = FabianPC | Source = Application Hang | ID = 1002
Description = Programm SndVol.exe, Version 6.1.7601.17514 kann nicht mehr unter
Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in
der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem
zu suchen. Prozess-ID: 1240 Startzeit: 01ce48f989029b19 Endzeit: 31 Anwendungspfad:
C:\Windows\system32\SndVol.exe Berichts-ID: d1d846a8-b4ec-11e2-9b22-dc0ea10dd45d
Error - 05.05.2013 13:03:19 | Computer Name = FabianPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 20.0.1.4847,
Zeitstempel: 0x51650aee Name des fehlerhaften Moduls: xul.dll, Version: 20.0.1.4847,
Zeitstempel: 0x51650a09 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b10e8 ID des fehlerhaften
Prozesses: 0x1220 Startzeit der fehlerhaften Anwendung: 0x01ce49b08fc859b6 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Pfad
des fehlerhaften Moduls: C:\Program Files (x86)\Mozilla Firefox\xul.dll Berichtskennung:
aee3963c-b5a5-11e2-bd21-dc0ea10dd45d
Error - 06.05.2013 15:31:42 | Computer Name = FabianPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 20.0.1.4847,
Zeitstempel: 0x51650aee Name des fehlerhaften Moduls: xul.dll, Version: 20.0.1.4847,
Zeitstempel: 0x51650a09 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b10e8 ID des fehlerhaften
Prozesses: 0x8a8 Startzeit der fehlerhaften Anwendung: 0x01ce4a8ed9ef13c2 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Pfad
des fehlerhaften Moduls: C:\Program Files (x86)\Mozilla Firefox\xul.dll Berichtskennung:
93f80a7e-b683-11e2-8e2f-dc0ea10dd45d
Error - 07.05.2013 12:16:32 | Computer Name = FabianPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 20.0.1.4847,
Zeitstempel: 0x51650aee Name des fehlerhaften Moduls: xul.dll, Version: 20.0.1.4847,
Zeitstempel: 0x51650a09 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b10e8 ID des fehlerhaften
Prozesses: 0x1590 Startzeit der fehlerhaften Anwendung: 0x01ce4b3b30dd737e Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Pfad
des fehlerhaften Moduls: C:\Program Files (x86)\Mozilla Firefox\xul.dll Berichtskennung:
7aa3429e-b731-11e2-8e2f-dc0ea10dd45d
Error - 09.05.2013 15:27:12 | Computer Name = FabianPC | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: firefox.exe, Version: 20.0.1.4847,
Zeitstempel: 0x51650aee Name des fehlerhaften Moduls: xul.dll, Version: 20.0.1.4847,
Zeitstempel: 0x51650a09 Ausnahmecode: 0xc0000005 Fehleroffset: 0x000b10e8 ID des fehlerhaften
Prozesses: 0x6a8 Startzeit der fehlerhaften Anwendung: 0x01ce4ceb0aac9d45 Pfad der
fehlerhaften Anwendung: C:\Program Files (x86)\Mozilla Firefox\firefox.exe Pfad
des fehlerhaften Moduls: C:\Program Files (x86)\Mozilla Firefox\xul.dll Berichtskennung:
72616fa5-b8de-11e2-83ce-dc0ea10dd45d
Error - 12.05.2013 10:54:09 | Computer Name = FabianPC | Source = Application Hang | ID = 1002
Description = Programm javaw.exe, Version 7.0.210.11 kann nicht mehr unter Windows
ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung,
um nach weiteren Informationen zum Problem zu suchen. Prozess-ID: 13e0 Startzeit:
01ce4f206d69dd9c Endzeit: 28 Anwendungspfad: C:\Windows\SysWOW64\javaw.exe Berichts-ID:
[ Media Center Events ]
Error - 14.10.2012 02:14:37 | Computer Name = FabianPC | Source = MCUpdate | ID = 0
Description = 08:14:37 - Fehler beim Herstellen der Internetverbindung. 08:14:37
- Serververbindung konnte nicht hergestellt werden..
Error - 14.10.2012 03:19:00 | Computer Name = FabianPC | Source = MCUpdate | ID = 0
Description = 08:14:42 - Fehler beim Herstellen der Internetverbindung. 08:14:42
- Serververbindung konnte nicht hergestellt werden..
Error - 08.11.2012 12:21:16 | Computer Name = FabianPC | Source = MCUpdate | ID = 0
Description = 03:00:57 - Fehler beim Herstellen der Internetverbindung. 03:00:57
- Serververbindung konnte nicht hergestellt werden..
Error - 18.11.2012 11:58:31 | Computer Name = FabianPC | Source = MCUpdate | ID = 0
Description = 16:58:30 - Fehler beim Herstellen der Internetverbindung. 16:58:30
- Serververbindung konnte nicht hergestellt werden..
Error - 24.02.2013 11:10:54 | Computer Name = FabianPC | Source = MCUpdate | ID = 0
Description = 16:10:43 - Fehler beim Herstellen der Internetverbindung. 16:10:48
- Serververbindung konnte nicht hergestellt werden..
Error - 17.03.2013 07:59:00 | Computer Name = FabianPC | Source = MCUpdate | ID = 0
Description = 12:58:57 - Fehler beim Herstellen der Internetverbindung. 12:58:59
- Serververbindung konnte nicht hergestellt werden..
Error - 01.04.2013 04:35:59 | Computer Name = FabianPC | Source = MCUpdate | ID = 0
Description = 10:35:58 - Fehler beim Herstellen der Internetverbindung. 10:35:58
- Serververbindung konnte nicht hergestellt werden..
Error - 17.04.2013 10:58:42 | Computer Name = FabianPC | Source = MCUpdate | ID = 0
Description = 16:58:41 - Fehler beim Herstellen der Internetverbindung. 16:58:41
- Serververbindung konnte nicht hergestellt werden..
[ System Events ]
Error - 22.04.2013 14:22:26 | Computer Name = FabianPC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Funktionssuche-Ressourcenveröffentlichung" wurde unerwartet
beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error - 22.04.2013 14:22:26 | Computer Name = FabianPC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows-Dienst für Schriftartencache" wurde unerwartet
beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden
in 60000 Millisekunden durchgeführt: Neustart des Diensts.
Error - 22.04.2013 14:22:26 | Computer Name = FabianPC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "SSDP-Suche" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt:
Neustart des Diensts.
Error - 22.04.2013 14:22:26 | Computer Name = FabianPC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "UPnP-Gerätehost" wurde unerwartet beendet. Dies ist bereits
1 Mal vorgekommen. Folgende Korrekturmaßnahmen werden in 100 Millisekunden durchgeführt:
Neustart des Diensts.
Error - 22.04.2013 14:22:26 | Computer Name = FabianPC | Source = Service Control Manager | ID = 7031
Description = Der Dienst "Windows-Sofortverbindung - Konfigurationsregistrierungsstelle"
wurde unerwartet beendet. Dies ist bereits 1 Mal vorgekommen. Folgende Korrekturmaßnahmen
werden in 120000 Millisekunden durchgeführt: Neustart des Diensts.
Error - 22.04.2013 14:22:26 | Computer Name = FabianPC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "SSDP-Suche" Korrekturmaßnahmen (Neustart des Diensts) durchzuführen,
ist fehlgeschlagen. Fehler: %%1056
Error - 22.04.2013 14:23:26 | Computer Name = FabianPC | Source = Service Control Manager | ID = 7032
Description = Der Versuch des Dienststeuerungs-Managers, nach dem unerwarteten Beenden
des Dienstes "Windows-Dienst für Schriftartencache" Korrekturmaßnahmen (Neustart
des Diensts) durchzuführen, ist fehlgeschlagen. Fehler: %%1056
Error - 27.04.2013 05:43:55 | Computer Name = FabianPC | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?27.?04.?2013 um 11:42:38 unerwartet heruntergefahren.
Error - 12.05.2013 04:00:09 | Computer Name = FabianPC | Source = DCOM | ID = 10010
Description =
Error - 13.05.2013 10:07:37 | Computer Name = FabianPC | Source = Service Control Manager | ID = 7022
Description = Der Dienst "Windows Update" wurde nicht richtig gestartet.
< End of report > Ich hab mir deine Punkte zum OTL-Scan durchgelesen und die bebilderte Anleitung auch.
Auf dieser soll man die LOP Prüfung und Purity Prüfung auch auswählen was ich gemacht habe. Weis nicht ob das richtig ist, da du es nicht in deinen Punkten erwähnt hast aber ich hoffe das stellt kein Problem dar.
Vielen Dank nochmal für deine schnelle Antwort
mfg. _Bytes_ |