| HalloX1990 | 20.07.2013 11:13 |
Das sind allerdings zuviele Zeichen und ich bekomme die Info, die Logs als Archiv anzuhängen ? Ich mache nun einfach zwei Posts draus.
Kann ich den PC übrigens nutzen, solange das Problem bearbeitet wird, oder laufe ich Gefahr, das z.B. Log-in Passwörter etc in falsche Hände gelangen ?
Extras Code:
OTL Extras logfile created on: 20.07.2013 00:10:21 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = Z:\Trojaner Board Programme
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
8,00 Gb Total Physical Memory | 6,05 Gb Available Physical Memory | 75,57% Memory free
10,00 Gb Paging File | 7,98 Gb Available in Paging File | 79,81% Paging File free
Paging file location(s): c:\pagefile.sys 2048 2048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,53 Gb Total Space | 3,71 Gb Free Space | 6,24% Space Free | Partition Type: NTFS
Drive G: | 688,22 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive R: | 135,72 Gb Total Space | 1,35 Gb Free Space | 1,00% Space Free | Partition Type: NTFS
Drive Z: | 97,75 Gb Total Space | 8,24 Gb Free Space | 8,43% Space Free | Partition Type: NTFS
Computer Name: CARPEDIEM | User Name: K | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
.url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = htmlfile] -- C:\Program Files\Internet Explorer\iexplore.exe (Microsoft Corporation)
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- R:\Mozilla\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "R:\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "R:\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "Z:\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "Z:\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- "R:\Microsoft Office\Office14\msohtmed.exe" %1 (Microsoft Corporation)
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- "R:\Microsoft Office\Office14\msohtmed.exe" /p %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "Z:\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" (VideoLAN)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "Z:\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" (VideoLAN)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{03EC9074-0840-4A5E-8C01-25E77D57A532}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{09ADAA60-946B-4563-B0DF-03ACEA7F3E1B}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework64\v4.0.30319\smsvchost.exe |
"{104EDB9E-3193-4326-AF33-708F96B04735}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{151C5C9E-1167-4C26-8128-27DE7FBD3BAE}" = lport=6004 | protocol=17 | dir=in | app=r:\microsoft office\office14\outlook.exe |
"{18825E51-FE15-4DF2-A1AD-CF7C4A8E2487}" = rport=80 | protocol=6 | dir=out | app=r:\steam\steamapps\common\warframe\warframe.exe |
"{1A4AFB7B-7E1D-4342-964D-A8B7D854451A}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe |
"{1E1228AF-ECCA-4AD3-A778-81072C8908BF}" = lport=67 | protocol=17 | dir=in | name=rtldhcp-port |
"{28220421-E589-4675-AAB8-D961C2DED3AF}" = rport=138 | protocol=17 | dir=out | app=system |
"{367248EB-6BB1-4BFF-9E0B-2A992F11EFB4}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{3C6AF7FF-63B6-48B2-ABD8-095F8AD92117}" = lport=138 | protocol=17 | dir=in | app=system |
"{56515D11-242F-41AB-80EB-D0E1A628D210}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{5D02B701-A934-4F43-94E2-92CBAC491132}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe |
"{5D73F37A-12F4-49A5-ABC8-F6A995BFBA7F}" = lport=10243 | protocol=6 | dir=in | app=system |
"{60219D22-7F17-42CC-9272-AE9D8DC384B3}" = lport=139 | protocol=6 | dir=in | app=system |
"{668B15F4-412C-4653-A2AF-32FBB9B36007}" = rport=137 | protocol=17 | dir=out | app=system |
"{6964B9C8-E3FC-4F58-A842-3719C3F5DD3B}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe |
"{6ADED509-8E54-4C67-8984-43BC83391C9D}" = rport=80 | protocol=6 | dir=out | app=r:\steam\steamapps\common\warframe\warframe.x64.exe |
"{6E952DD3-C1B3-4061-A919-F586D0EF4AEF}" = lport=68 | protocol=17 | dir=in | name=rtldhcp-port-2 |
"{762B2C9B-7E3B-4836-BB85-C2ED072E32B3}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{7BD3F538-90D9-4C58-A656-BC9F5402D104}" = lport=2869 | protocol=6 | dir=in | app=system |
"{80AFFA58-1678-44CE-896D-EB8375EB8930}" = lport=4000 | protocol=6 | dir=out | app=c:\program files (x86)\dll-files.com fixer\dllfixer.exe |
"{814E5B8A-7441-4A56-807B-FC48D71883D0}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{866AE956-0601-4FEF-88E0-A492885E5F1B}" = lport=53 | protocol=6 | dir=in | name=rtldns-port |
"{89B52819-53E9-4D23-B53F-424592A89809}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{90093921-9F03-489F-98A9-A5A82AE603CA}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{978FD291-1B9B-4C13-B7B6-1E430D38BEBC}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{99A2C1FA-C039-418A-AEDE-9C4805F5B477}" = lport=1542 | protocol=17 | dir=in | name=realtek wps udp prot |
"{9D345F78-ED51-4D7C-AC94-AB7B7216893C}" = rport=10243 | protocol=6 | dir=out | app=system |
"{9DBB513C-78D2-43FC-AE43-003C6436DB00}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{ABE3EFAB-F3C6-454B-988F-6997F7943C95}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ACCCDA1B-CF26-4CE7-BD6A-A43C3640439B}" = lport=137 | protocol=17 | dir=in | app=system |
"{AD35D270-CC95-4DDC-B569-4C1E060835D0}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{B28B4DAA-F164-44B7-A689-5A43F25E8970}" = rport=139 | protocol=6 | dir=out | app=system |
"{B5A4386E-66A6-40CB-BE23-F80AFC803634}" = lport=2869 | protocol=6 | dir=in | app=system |
"{B80DCA76-9A80-48DB-8AC6-81AD7FFDC1DC}" = lport=rpc | protocol=6 | dir=in | app=r:\sisoftware sandra lite 2012.sp1c\wnt500x64\rpcsandrasrv.exe |
"{B943BE3A-8A69-403C-89C8-B9788CC4AE73}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{BDD8C180-3D47-4960-B46C-15B107F47F10}" = rport=445 | protocol=6 | dir=out | app=system |
"{C2F91682-ECC6-4C26-BD38-25D1B6332AC8}" = lport=1542 | protocol=6 | dir=in | name=realtek wps tcp prot |
"{C4C75F8E-1250-49D9-80F0-458C59D602A9}" = lport=53 | protocol=17 | dir=in | name=realtek ap udp prot |
"{EF7C21F7-05F9-4EA0-8FD5-023B3AFE3DAD}" = lport=445 | protocol=6 | dir=in | app=system |
"{F4B23E78-D9B6-4810-8A90-1A261A1EFFB5}" = lport=53 | protocol=17 | dir=in | name=rtldns-port-2 |
"{FD1E3AFA-504D-4163-AA7B-26CA4BC62691}" = rport=80 | protocol=6 | dir=out | app=r:\steam\steamapps\common\warframe\tools\launcher.exe |
"{FD4BC17B-3FA5-4EAB-83C4-1151CDB9CB2B}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0022CE8C-5701-404C-8E3B-98E22B69B40C}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{002EDD9A-3B60-4ED8-86C4-56CA3146EAC3}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\orcs must die 2\build\release\orcsmustdie2.exe |
"{0340E960-024D-432F-89AD-3DBBCE930842}" = protocol=6 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{03E9D524-EB33-4216-A89C-1636DFE49459}" = protocol=58 | dir=in | app=system |
"{0759AC7C-00A9-4021-A2C8-C3B7D919E351}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{0805A13A-948A-4721-B0E8-2F1D3DB08B6B}" = protocol=6 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe |
"{08D1D10C-382F-4C05-87F9-ECCAF077061D}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\brawl busters\bin\pblauncher.exe |
"{09F2C52F-A85F-45A4-B79C-8C48F7B0D9FA}" = protocol=6 | dir=in | app=r:\vindictus eu\en-eu\nmservice.exe |
"{0B893FDB-415D-4489-987B-F60F361204E3}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{0D426C48-34E5-4030-8779-812A0A276022}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{113EEB1B-E969-407D-829C-44E7C1179609}" = protocol=6 | dir=in | app=r:\starcraft ii\versions\base15405\sc2.exe |
"{12C570BC-56FA-4EF4-9F33-A9344B5B6EEA}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{12F2C9B3-1059-44D9-B81F-1E860D5051F6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{143ED5BB-C5BF-4EEF-B38A-92F8C2339798}" = protocol=17 | dir=in | app=r:\starcraft ii\starcraft ii.exe |
"{16838E49-BE72-4BDF-A294-7391CA190AF1}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{179D668A-E0B4-471D-8F7F-C33A24DFC93E}" = protocol=17 | dir=in | app=c:\program files (x86)\realtek\11n usb wireless lan utility\rtwlan.exe |
"{1E6BBFCF-01DF-4113-9817-1BA423B10ECF}" = protocol=58 | dir=out | name=@iphlpsvc.dll,-503 |
"{1EF0D3D1-1D1D-43EC-9DB0-0B32ABD87312}" = protocol=17 | dir=in | app=r:\vindictus eu\en-eu\nmservice.exe |
"{2054887B-E288-4DD8-8022-A1323B9877B1}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{22161AB7-D407-4ED5-A562-465D2455450B}" = protocol=6 | dir=in | app=r:\mass effect 2\masseffect2launcher.exe |
"{23A4CDB1-941B-4312-BA43-6B9E5E12C290}" = protocol=6 | dir=in | app=z:\diablo iii\diablo iii.exe |
"{245AE70F-2440-40EB-9C03-5B62DD74D633}" = protocol=17 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe |
"{2656F467-72AE-437A-BDF6-D8359D402C01}" = protocol=17 | dir=in | app=r:\starcraft ii\versions\base15405\sc2.exe |
"{26DE9217-01D3-439B-8A45-DC737A3D647C}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\warframe\warframe.exe |
"{27666962-949C-484C-B417-CB0C1DF4B058}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{2C385A83-A6CA-4343-9112-CD709B0A5839}" = protocol=6 | dir=out | app=system |
"{2DEDD79E-5134-48FA-BBCB-1233163ECEB0}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{2E9C32A5-3492-4B8E-82B0-BDF8EE53C194}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\warframe\warframe.x64.exe |
"{2EFFBF84-C88F-4500-BDFC-015F74212396}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{35FE07BD-C928-481F-8B5D-58D975C63A7A}" = protocol=6 | dir=in | app=r:\mass effect 1\mass effect\binaries\masseffect.exe |
"{363BF90D-F02A-4684-90BB-D89D4D6EC1EA}" = dir=in | app=r:\skype\phone\skype.exe |
"{3746768C-458F-431F-81C3-EB413E24E356}" = protocol=17 | dir=out | app=r:\steam\steamapps\common\warframe\warframe.x64.exe |
"{37AE9492-0F6D-4250-BA2F-56AA871DD227}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{39E0AA9C-C257-4BC5-AC63-65C3A1235B5A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{3CB0C8E4-E285-48B0-97A3-53112BCDAE8C}" = protocol=6 | dir=in | app=c:\users\k\appdata\local\akamai\netsession_win.exe |
"{3DB656B0-6B47-4AC3-A07F-A0FA40C7F92D}" = protocol=17 | dir=in | app=z:\diablo 3\diablo iii\diablo iii.exe |
"{3E4EEA2D-57E9-481E-A22C-F3C2D87A3C37}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{400C974D-3C63-4595-84B0-1A904BA84D1E}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{4075C9A6-6CC5-4214-B99F-7C6EEE3672BA}" = protocol=17 | dir=in | app=r:\mass effect 3\mass effect 3\binaries\win32\masseffect3.exe |
"{409169A4-A9F2-455B-9315-AB1AC442A951}" = protocol=6 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe |
"{42430B3C-9FE0-4461-A5E8-46D5F7EBB571}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\dota 2 beta\dota.exe |
"{46B2BA95-F2EA-4BCA-B5E9-3BF38C82A601}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe |
"{46C89427-6310-4DDD-ABAF-C9FC3FD5771B}" = protocol=6 | dir=out | app=%systemroot%\system32\wudfhost.exe |
"{4833266C-54E4-441E-859E-2080BE192988}" = protocol=17 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe |
"{487D8494-37AC-49A8-8440-F804E6C7413A}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\planetside 2\launchpad.exe |
"{48EC5C13-19B5-4864-8DC3-6FCD6C839031}" = protocol=17 | dir=in | app=c:\program files (x86)\expressfiles\expressdl.exe |
"{499BFFEA-EF88-4A0F-8D80-424F906B7C35}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{4CA4D952-9491-4B4C-9635-1C0D97246522}" = protocol=6 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{4E5F25E0-DAFF-46FE-8CAE-79D9FE436526}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\dota 2 beta\dota.exe |
"{556B6234-914C-4C81-A881-965471F87D61}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{56CA949A-1D57-46AA-B6A5-AD25B0851F93}" = protocol=17 | dir=in | app=c:\windows\syswow64\msiexec.exe |
"{59302405-7676-4D92-90BC-CECA0833BEED}" = protocol=17 | dir=in | app=r:\edeneternal\edeneternal-de\_launcher.exe |
"{5AF5427F-67DF-41EB-B827-A5773972ED9C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{5D0C41E1-1D36-4F00-9752-B85B3B62AE05}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{5DFA2F12-55EC-4BF2-85B1-69587D353D46}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{603A132B-B140-43CF-AD5E-4C4D53E725BE}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{6150D2B0-7F88-4D46-BE38-F2C1EEF49429}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{65064AB1-A1BF-4CEA-BA7F-AD9DC5B95CD7}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1675\agent.exe |
"{674499DD-3F47-40C6-B1F1-9F7C9AAFD3B9}" = protocol=6 | dir=in | app=r:\starcraft ii\starcraft ii.exe |
"{67DED5C1-C99C-4776-BE78-47851B1529CA}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{6C6CFDC4-D13B-4900-81EA-34FD2FA520C2}" = protocol=6 | dir=in | app=b:\downloads\videoconvertersdm.exe |
"{6D27BA5F-73B2-4271-82FE-BB3DED66514C}" = protocol=17 | dir=in | app=c:\program files (x86)\expressfiles\expressfiles.exe |
"{6D92EF4E-9245-44F8-B19A-6EBC62C565CB}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\torchlight ii\torchlight2demo.exe |
"{6DA72067-6EFB-4E97-8A3B-7B65262E4FAD}" = protocol=17 | dir=in | app=r:\microsoft office\office14\onenote.exe |
"{708C7345-25EE-4323-AA2C-9F36ADE923A1}" = protocol=17 | dir=out | app=r:\steam\steamapps\common\warframe\warframe.exe |
"{72C367B2-EA4A-418D-8F03-31CB73F74140}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{746EE179-DA01-4308-A66B-8F1700F3497F}" = protocol=17 | dir=in | app=r:\mass effect 2\masseffect2launcher.exe |
"{757D7E92-9BF3-4FB3-BE85-B876A84071A9}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\orcs must die 2\build\release\orcsmustdie2.exe |
"{76049B53-2FB0-4A4F-8A72-8C255E0637F0}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\brawl busters\bin\pblauncher.exe |
"{789861BE-5336-4554-9C7E-05922130D36E}" = protocol=17 | dir=in | app=c:\program files (x86)\sweetim\communicator\sweetpacksupdatemanager.exe |
"{7960689A-5C01-4A0D-A40D-6E09E23E9640}" = protocol=17 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{79FA511F-EAA2-48EA-B8FD-4659994BB62B}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{7AE4EE0A-C675-4275-8C64-6339F6CB7027}" = dir=in | app=c:\program files (x86)\realtek\11n usb wireless lan utility\rtldhcp.exe |
"{7E0B5BD5-CFB0-4B24-9DD6-78A7189505DF}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"{7EDBD380-5B6E-487C-B080-1A6A8FB9EB06}" = protocol=6 | dir=in | app=r:\sony\update service\update service.exe |
"{7F2F5FD9-3745-4DDD-A531-97FF51920B2F}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.954\agent.exe |
"{813E010C-F3D2-4986-90FE-5E0DE027AC30}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\torchlight ii\torchlight2demo.exe |
"{81944D1D-44E5-431C-9D4D-D65381E729F2}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1737\agent.exe |
"{82F93780-1977-4BCD-8AA1-99C582D5838F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{84FB5D5B-86A2-4917-BE01-641CA4DF88E9}" = protocol=17 | dir=in | app=r:\starcraft ii\starcraft ii public test.exe |
"{854AA40D-68DF-427B-BCB0-2479C71860B5}" = protocol=6 | dir=in | app=r:\steam\steam.exe |
"{8561ADF1-43F7-4FE5-BB00-610BDA243B56}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1225\agent.exe |
"{8658E204-5EB5-4A1A-B80A-AAF6C42373B3}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1675\agent.exe |
"{8687EAAD-3906-4761-9028-977628F05F32}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{889D18C6-98D5-41CA-93F4-B03890956456}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\warframe\tools\launcher.exe |
"{88A2B085-145C-4684-B769-7FC77834BDA0}" = protocol=17 | dir=in | app=c:\users\k\appdata\local\akamai\netsession_win.exe |
"{89DC63D4-9DE0-423D-BBA0-81FFCB5EAE8A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8B715EBD-8DDC-4AC1-822D-43C534CDB484}" = protocol=6 | dir=in | app=r:\mass effect 2\binaries\masseffect2.exe |
"{8D181B0C-964C-40F8-94DB-AB43C4370FCA}" = protocol=6 | dir=in | app=r:\mass effect 3\mass effect 3\binaries\win32\masseffect3.exe |
"{8DC08A7E-AB57-414B-9ADC-2E8C6BAAC24E}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\dark souls prepare to die edition\data\darksouls.exe |
"{936BBA05-6257-42CE-9E81-5135FA47E790}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{93702F4C-E16D-4702-A399-815C563203C3}" = protocol=17 | dir=in | app=r:\mass effect 2\binaries\masseffect2.exe |
"{93CFCE59-F957-4397-8649-02F557A77260}" = protocol=17 | dir=in | app=r:\steam\steam.exe |
"{97B4519C-B097-427A-A6E0-52F61B0CB3E0}" = protocol=17 | dir=in | app=r:\microsoft office\office14\groove.exe |
"{99A6A5D9-4E6A-44E5-BB08-2F1E094B5E6E}" = protocol=17 | dir=in | app=r:\sony\update service\update service.exe |
"{9B2931C6-D72D-4FEC-BB14-0B45709B4EB3}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"{9C22EA6B-4E9A-4B81-8046-06F34865C5AC}" = protocol=17 | dir=in | app=r:\mass effect 1\mass effect\binaries\masseffect.exe |
"{A0E7614A-A303-42CF-9401-4199D1698931}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{A151E97E-61A8-495E-B1E8-357752A1796C}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\brawl busters\bin\pbclient.exe |
"{A1C9157C-55B9-4A19-8A2D-D024FCA6FD7E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.524\agent.exe |
"{A390FCA5-8C95-4944-B60A-9395ED056B6A}" = protocol=17 | dir=in | app=r:\mass effect 1\mass effect\masseffectlauncher.exe |
"{A3E85977-4A0C-4FA1-9481-3885AE232515}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\brawl busters\bin\pbclient.exe |
"{A4D7F382-284F-4A5C-9BB4-E0D42D6C43E9}" = protocol=17 | dir=in | app=r:\star wars-the old republic\launcher.exe |
"{A5B091AF-18F9-4919-9111-9FA264706253}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\planetside 2\launchpad.exe |
"{AAA6D31B-7672-426A-9C78-C99B27675980}" = protocol=6 | dir=in | app=z:\diablo 3\diablo iii\diablo iii.exe |
"{AEAD95CF-9C0D-4F3C-9521-C9088108CF3D}" = protocol=6 | dir=in | app=c:\program files (x86)\realtek\11n usb wireless lan utility\rtwlan.exe |
"{AECEA470-0E27-43E4-B52D-36F7D2898956}" = protocol=6 | dir=in | app=c:\programdata\nexoneu\ngm\ngm.exe |
"{B1551ADE-7374-475A-988E-B15D22FD25B9}" = protocol=1 | dir=in | name=sisoftware sandra agent service (icmp-in) |
"{B99F3550-FD02-4444-A09E-B9099D84E83D}" = protocol=6 | dir=in | app=r:\microsoft office\office14\groove.exe |
"{BAF07E7A-FE85-4055-8A87-F46E53D56AD0}" = protocol=6 | dir=in | app=z:\bf3\battlefield 3\bf3.exe |
"{BCEC881A-FE89-4FAA-B174-23EFE2DF34E3}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\orcs must die 2\build\release\orcsmustdie2.exe |
"{BDBBEA7A-4EE3-44EB-B3A9-4FEA4AC92ECA}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\dota 2 beta\dota.exe |
"{BFD543C7-EA71-4781-BAB6-B40D7BB551A7}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{C20D091E-8A53-4067-B05D-B72DE9C93207}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{C292203A-B072-4ABE-89F5-241E21153ECE}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{C5260B8B-E983-4133-A117-8AC407E58B35}" = protocol=6 | dir=in | app=r:\mass effect 1\mass effect\masseffectlauncher.exe |
"{C56C2485-0618-491A-BB64-A40BC7BF2EDB}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{C6CF5E6C-9677-4FA5-8E17-6AE100A09C83}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe |
"{CA989CEF-CF39-4781-ADBE-1D10F508EC9B}" = protocol=17 | dir=in | app=z:\bf3\battlefield 3\bf3.exe |
"{CE30F5AE-6405-4000-B28C-D3E4E3E17FCC}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe |
"{D02405C4-8538-4C3A-921F-D595A2166EC3}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\dota 2 beta\dota.exe |
"{D0390A6A-C611-4019-B17D-D79798075F41}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\orcs must die 2\build\release\orcsmustdie2.exe |
"{D4A1C9B5-1876-47A3-99A4-0948F6C20FEE}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{D4C9E568-6AF5-4A29-B1F2-641894A26E0D}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{D9201D71-3858-4D3C-AB34-78B5412D904B}" = protocol=6 | dir=in | app=r:\microsoft office\office14\onenote.exe |
"{DC1395E7-046D-45D1-979C-710E542D5AB2}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{E07BED0A-5F39-41B8-9731-F5CA30D83C89}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{E1175A1F-85CC-4632-A219-2F528AEA1120}" = protocol=6 | dir=in | app=c:\program files (x86)\sony ericsson\update engine\sony ericsson update engine.exe |
"{E26AFB84-A60E-43C4-9D0B-80417085A202}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{E670B5DE-710D-486D-A477-6403DDDFDD70}" = protocol=6 | dir=in | app=c:\program files (x86)\expressfiles\expressfiles.exe |
"{E6FF8922-E5C9-4F6D-9128-1E078A7AE9C9}" = protocol=17 | dir=in | app=b:\downloads\videoconvertersdm.exe |
"{EB7A5DB6-4E8A-47EB-A909-D14609813B66}" = protocol=6 | dir=in | app=r:\steam\steamapps\common\warframe\tools\launcher.exe |
"{EC1C0B3C-214D-4B5A-87E2-CB275610664D}" = protocol=17 | dir=in | app=z:\diablo iii\diablo iii.exe |
"{F2131161-D255-4CCA-8836-5FAB70967ECB}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{F2AF5ADE-67B7-4FDC-BD98-5B4E4C5828AF}" = protocol=6 | dir=in | app=r:\edeneternal\edeneternal-de\_launcher.exe |
"{F4055C89-C2F2-4983-BF61-A01330D065D9}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{F63D5DD8-4C20-4F24-A6D6-64A865DD0C1E}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1637\agent.exe |
"{FA0FB5D1-4940-48FD-8240-9CB3CF52BF19}" = protocol=6 | dir=in | app=c:\program files (x86)\expressfiles\expressdl.exe |
"{FB5C1886-797D-490F-AFC9-BC436924105F}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe |
"{FB7D1827-F48E-4FA2-B431-A6E8AAC46D0D}" = protocol=6 | dir=in | app=r:\starcraft ii\starcraft ii public test.exe |
"{FC0A6E4F-621F-41C4-8432-6F4D2C91C5E9}" = protocol=6 | dir=in | app=r:\star wars-the old republic\launcher.exe |
"{FCBD5D69-1B22-4440-B578-8CB9F1E23B30}" = protocol=17 | dir=in | app=r:\steam\steamapps\common\dark souls prepare to die edition\data\darksouls.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26A24AE4-039D-4CA4-87B4-2F86417015FF}" = Java 7 Update 15 (64-bit)
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5831C6D6-309D-DBB5-14F7-FEE57086CEE7}" = AMD Catalyst Install Manager
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{690285C2-2481-44FB-8402-162EA970A6DD}" = Logitech Gaming Software
"{6ce5bae9-d3ca-4b99-891a-1dc6c118a5fc}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{90140000-0011-0000-1000-0000000FF1CE}" = Microsoft Office Professional Plus 2010
"{90140000-0011-0000-1000-0000000FF1CE}_Office14.PROPLUS_{7BC9B5EB-125A-4E9B-97E1-8D85B5E960B8}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0015-0407-1000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-1000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-1000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-1000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-1000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-1000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-1000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-1000-0000000FF1CE}_Office14.PROPLUS_{70A3169E-288F-454F-A08D-20DF66639B50}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-1000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-1000-0000000FF1CE}_Office14.PROPLUS_{0242505C-4E90-407F-9299-B5B275F50D86}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-1000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-1000-0000000FF1CE}_Office14.PROPLUS_{B51389C8-2890-4633-81D8-47D2A7402274}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-1000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-1000-0000000FF1CE}_Office14.PROPLUS_{3013A793-10A7-4D1F-B8B4-2FAA82F4D259}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-1000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-1000-0000000FF1CE}_Office14.PROPLUS_{98782D5D-A9EE-43C6-88AD-B50AD8530E78}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0000-1000-0000000FF1CE}" = Microsoft Office Office 32-bit Components 2010
"{90140000-0043-0000-1000-0000000FF1CE}_Office14.PROPLUS_{E8B6D35B-0B6F-4DCE-9493-859BF3809A7F}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0043-0407-1000-0000000FF1CE}" = Microsoft Office Shared 32-bit MUI (German) 2010
"{90140000-0043-0407-1000-0000000FF1CE}_Office14.PROPLUS_{8DFD91C7-66AE-4E54-9901-5D5F401AD329}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0044-0407-1000-0000000FF1CE}" = Microsoft Office InfoPath MUI (German) 2010
"{90140000-0044-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-1000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-1000-0000000FF1CE}_Office14.PROPLUS_{8299B64F-1537-4081-974C-033EAB8F098E}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-1000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00BA-0407-1000-0000000FF1CE}" = Microsoft Office Groove MUI (German) 2010
"{90140000-00BA-0407-1000-0000000FF1CE}_Office14.PROPLUS_{BBBD3986-9A9D-402A-BA73-CCDE3EF0ED77}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90BF0360-A1DB-4599-A643-95AB90A52C1E}" = Microsoft_VC90_MFCLOC_x86_x64
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}" = Microsoft Visual C++ 2005 Redistributable (x64)
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.12.12
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.23.1
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"CPUID CPU-Z_is1" = CPUID CPU-Z 1.59
"Logitech Gaming Software" = Logitech Gaming Software 8.46
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Office14.PROPLUS" = Microsoft Office Professional Plus 2010
"Pen Tablet Driver" = Bamboo
"VLC media player" = VLC media player 2.0.6
"Wacom WebTabletPlugin for Internet Explorer and Netscape" = WebTablet FB Plugin 64 bit
"WinRAR archiver" = WinRAR 4.11 (64-Bit)
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{04A3A6B0-8E19-49BB-82FF-65C5A55F917D}" = Acronis*True*Image*Home 2011
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0E532C84-4275-41B3-9D81-D4A1A20D8EE7}" = PlayStation(R)Store
"{0E850E20-07C3-40E5-875B-9D7CC907D67A}" = Media Add-ons für Acronis True Image Home 2011
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{1111706F-666A-4037-7777-210328764D10}" = JavaFX 2.1.0
"{1B0FBB9A-995D-47cd-87CD-13E68B676E4F}" = Mass Effect
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{2397CAD4-2263-4CD0-96BE-E43A980B9C9A}_is1" = Geeks3D.com FurMark 1.9.2
"{259C0ABB-A3B2-4D70-008F-BF7EE491B70B}" = Need for Speed™ Carbon
"{26A24AE4-039D-4CA4-87B4-2F83217017FF}" = Java 7 Update 17
"{2CAB55FA-A147-4215-81A6-E9A9038B7970}" = Plus Pack für Acronis True Image Home 2011
"{30DD6255-BF58-4F07-AC03-68A73C5BCD5D}" = TP-LINK 150Mbps Mini Wireless N USB Adapter Driver
"{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}" = ANNO 1404 - Königsedition
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B271648-43CB-DD31-FF24-E7B06D3EE72A}" = Catalyst Control Center InstallProxy
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.5
"{517CC397-B22F-4593-8DCB-DE72CC541E9A}" = League of Legends
"{51C7AD07-C3F6-4635-8E8A-231306D810FE}" = Cisco LEAP Module
"{534A31BD-20F4-46b0-85CE-09778379663C}" = Mass Effect™ 3
"{5E21B617-F52E-BB10-92F9-C8AB2C799A8A}" = Adobe Download Assistant
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{64BF0187-F3D2-498B-99EA-163AF9AE6EC9}" = Cisco EAP-FAST Module
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{74EB3499-8B95-4B5C-96EB-7B342F3FD0C6}" = Adobe Photoshop CS6
"{75D84EF7-0D8C-4e70-B3FA-7B42A5D4E0EB}" = Mass Effect 2
"{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{84F7CAD9-2316-4701-B5CA-E90FD60029E9}" = ANNO 1602
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{8F3A1F92-C29F-4DF9-8459-B739A4831C69}_is1" = SUPER © +Recorder.2013.55 (Mar 7, 2013) Version +Recorder.2013.
"{90DFD61B-8224-00C6-3D69-A983B60A394E}" = Bamboo Dock
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A0087DDE-69D0-11E2-AD57-43CA6188709B}" = Adobe AIR
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.7) - Deutsch
"{B6659DD8-00A7-4A24-BBFB-C1F6982E5D66}" = PlayStation(R)Network Downloader
"{B6D38690-755E-4F40-A35A-23F8BC2B86AC}" = Microsoft_VC90_MFCLOC_x86
"{B8ABD8C7-991E-4A70-B5A3-20C6FC680680}" = LogMeIn Hamachi
"{BFEAAE77-BD7F-4534-B286-9C5CB4697EB1}" = PDF Settings CS6
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CFEF8DB5-B45E-4b05-90BE-D02AA6F45354}" = Firefall
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{ED5776D5-59B4-46B7-AF81-5F2D94D7C640}" = Cisco PEAP Module
"{F09EF8F2-0976-42C1-8D9D-8DF78337C6E3}" = Sony PC Companion 2.10.165
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F2508213-9989-4E85-A078-72BE483917EF}" = Microsoft Games for Windows - LIVE Redistributable
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Akamai" = Akamai NetSession Interface Service
"AMP WinOFF" = AMP WinOFF 5.0.1
"Bamboo Dock" = Bamboo Dock
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"Battlelog Web Plugins" = Battlelog Web Plugins
"com.adobe.downloadassistant.AdobeDownloadAssistant" = Adobe Download Assistant
"DAEMON Tools Lite" = DAEMON Tools Lite
"Donald Duck" = Disneys Donald Duck
"ESN Sonar-0.70.4" = ESN Sonar
"Flashtool" = Flashtool
"Fraps" = Fraps
"Free YouTube Download_is1" = Free YouTube Download version 3.2.1.320
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.2.430
"Guild Wars" = GUILD WARS
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"League of Legends 3.0.1" = League of Legends
"LogMeIn Hamachi" = LogMeIn Hamachi
"LOLReplay" = LOLReplay
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Mozilla Firefox 15.0 (x86 de)" = Mozilla Firefox 15.0 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NIS" = Norton Internet Security
"Notepad++" = Notepad++
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"Open Codecs" = Xiph.Org Open Codecs 0.85.17777
"OpenAL" = OpenAL
"Origin" = Origin
"Picasa 3" = Picasa 3
"PrecisionX" = EVGA Precision X 3.0.4
"ProtectDisc Driver 11" = ProtectDisc Driver, Version 11
"PunkBusterSvc" = PunkBuster Services
"RollerCoaster Tycoon 3_is1" = RollerCoaster Tycoon 3
"SixaxisPairTool_is1" = SixaxisPairTool 0.2.3
"SpeedFan" = SpeedFan (remove only)
"StarCraft II" = StarCraft II
"Steam App 201790" = Orcs Must Die! 2
"Steam App 219850" = Torchlight II Demo
"Steam App 49520" = Borderlands 2
"Steam App 570" = Dota 2
"Update Engine" = Sony Ericsson Update Engine
"Update Service" = Sony Mobile Update Service
"Wacom WebTabletPlugin for Internet Explorer and Netscape" = WebTablet FB Plugin 32 bit
"wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1" = Bamboo Dock
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Mozilla Firefox 22.0 (x86 de)" = Mozilla Firefox 22.0 (x86 de)
"TeamSpeak 3 Client" = TeamSpeak 3 Client
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 19.07.2013 16:55:39 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 19.07.2013 17:26:14 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 19.07.2013 17:26:14 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 19.07.2013 17:26:14 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 19.07.2013 17:37:19 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 19.07.2013 17:37:19 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 19.07.2013 17:37:19 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
Error - 19.07.2013 18:14:21 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 19.07.2013 18:14:21 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3012
Description = Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung
werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter
ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste
DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich
und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.
Error - 19.07.2013 18:14:21 | Computer Name = CarpeDiem | Source = Microsoft-Windows-LoadPerf | ID = 3011
Description = Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren
für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.
[ System Events ]
Error - 19.07.2013 16:47:40 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB-Miniredirector-Wrapper und -Modul" ist vom Dienst
"Umgeleitetes Puffersubsystem" abhängig, der aufgrund folgenden Fehlers nicht gestartet
wurde: %%31
Error - 19.07.2013 16:47:40 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB 1.x-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper
und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 19.07.2013 16:47:40 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7001
Description = Der Dienst "SMB 2.0-Miniredirector" ist vom Dienst "SMB-Miniredirector-Wrapper
und -Modul" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 19.07.2013 16:47:40 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7001
Description = Der Dienst "NLA (Network Location Awareness)" ist vom Dienst "Netzwerkspeicher-Schnittstellendienst"
abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068
Error - 19.07.2013 16:47:40 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7026
Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:
AFD BHDrvx64 ccSet_NIS DfsC discache eeCtrl IDSVia64 NetBIOS NetBT nsiproxy Psched rdbss spldr
SRTSP
SRTSPX
SymIM
SymIRON
SymNetS
tdx
vwififlt
Wanarpv6
WfpLwf
Error - 19.07.2013 16:48:44 | Computer Name = CarpeDiem | Source = DCOM | ID = 10005
Description =
Error - 19.07.2013 16:52:11 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern
Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
Management Console (MMC).
Error - 19.07.2013 16:52:11 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1069
Error - 19.07.2013 18:09:56 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7038
Description = Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser"
mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: %%1330 Vergewissern
Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft
Management Console (MMC).
Error - 19.07.2013 18:09:56 | Computer Name = CarpeDiem | Source = Service Control Manager | ID = 7000
Description = Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden
Fehlers nicht gestartet: %%1069
< End of report >
OTL Code:
OTL logfile created on: 20.07.2013 00:10:21 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = Z:\Trojaner Board Programme
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16635)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
8,00 Gb Total Physical Memory | 6,05 Gb Available Physical Memory | 75,57% Memory free
10,00 Gb Paging File | 7,98 Gb Available in Paging File | 79,81% Paging File free
Paging file location(s): c:\pagefile.sys 2048 2048 [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 59,53 Gb Total Space | 3,71 Gb Free Space | 6,24% Space Free | Partition Type: NTFS
Drive G: | 688,22 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive R: | 135,72 Gb Total Space | 1,35 Gb Free Space | 1,00% Space Free | Partition Type: NTFS
Drive Z: | 97,75 Gb Total Space | 8,24 Gb Free Space | 8,43% Space Free | Partition Type: NTFS
Computer Name: CARPEDIEM | User Name: K | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - [2013.07.19 23:19:09 | 000,602,112 | ---- | M] (OldTimer Tools) -- Z:\Trojaner Board Programme\OTL.exe
PRC - [2013.07.06 13:15:38 | 000,920,472 | ---- | M] (Mozilla Corporation) -- R:\Mozilla\firefox.exe
PRC - [2013.06.05 01:01:52 | 004,489,472 | ---- | M] (Akamai Technologies, Inc.) -- C:\Users\K\AppData\Local\Akamai\netsession_win.exe
PRC - [2013.05.21 06:44:22 | 000,144,368 | R--- | M] (Symantec Corporation) -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe
PRC - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2013.03.14 22:07:46 | 000,383,264 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2013.02.14 08:05:44 | 000,523,264 | ---- | M] (LOL Replay) -- Z:\LOLReplay\LOLRecorder.exe
PRC - [2013.02.11 03:24:21 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2012.11.12 15:22:38 | 002,254,768 | ---- | M] (LogMeIn Inc.) -- Z:\Hamachi\hamachi-2-ui.exe
PRC - [2012.10.16 11:39:00 | 000,646,744 | ---- | M] () -- C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
PRC - [2012.10.08 16:15:50 | 000,039,808 | ---- | M] (Wacom Technology) -- C:\Programme\Tablet\Pen\WacomHost.exe
PRC - [2012.06.12 01:12:43 | 003,246,040 | ---- | M] (Acronis) -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
PRC - [2011.09.22 22:21:12 | 000,395,344 | ---- | M] (Acronis) -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
PRC - [2011.09.22 22:20:44 | 005,587,832 | ---- | M] (Acronis) -- R:\Acronis\TrueImageHome\TrueImageMonitor.exe
========== Modules (No Company Name) ==========
MOD - [2013.07.13 03:31:23 | 002,297,856 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Core\2c5c86bb5156ff508ca8045aff50a482\System.Core.ni.dll
MOD - [2013.07.13 03:31:20 | 000,368,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\a2920ed81e097f8551231a9350697bbd\PresentationFramework.Aero.ni.dll
MOD - [2013.07.13 03:31:01 | 014,340,096 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationFramewo#\fc4a8709f71eba20cc71c7905bba3dee\PresentationFramework.ni.dll
MOD - [2013.07.13 03:30:51 | 012,436,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\178644ab40108f3becd8b91049a254c3\System.Windows.Forms.ni.dll
MOD - [2013.07.13 03:30:47 | 001,593,344 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\bfa7a95284aec941f4b03bae0debe07c\System.Drawing.ni.dll
MOD - [2013.07.13 03:30:45 | 012,238,336 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\PresentationCore\ef17be93e209cc95b9768c7822530432\PresentationCore.ni.dll
MOD - [2013.07.13 03:30:38 | 003,348,480 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\WindowsBase\c25666b99761bc42322bae2e59968df8\WindowsBase.ni.dll
MOD - [2013.07.13 03:30:34 | 005,464,064 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\32066405eb9ab14056b2af3115d2a6de\System.Xml.ni.dll
MOD - [2013.07.13 03:30:32 | 000,978,432 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\9e24b9ffd816c0c90efc4d3fc9fd745f\System.Configuration.ni.dll
MOD - [2013.07.13 03:30:31 | 007,989,760 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\187c13e8967097d2ed1e5f123e7d890a\System.ni.dll
MOD - [2013.07.13 03:30:26 | 011,499,520 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\9a6c1b7af18b4d5a91dc7f8d6617522f\mscorlib.ni.dll
MOD - [2013.07.06 13:15:38 | 003,285,912 | ---- | M] () -- R:\Mozilla\mozjs.dll
MOD - [2013.02.14 08:05:36 | 000,311,808 | ---- | M] () -- Z:\LOLReplay\LOLUtils.dll
MOD - [2012.10.16 11:39:00 | 000,646,744 | ---- | M] () -- C:\Program Files (x86)\Bamboo Dock\BambooCore.exe
MOD - [2012.05.30 08:51:08 | 000,699,280 | R--- | M] () -- C:\PROGRAM FILES (X86)\NORTON INTERNET SECURITY\ENGINE\20.4.0.40\wincfi39.dll
MOD - [2011.09.22 22:20:28 | 011,233,136 | ---- | M] () -- C:\Program Files (x86)\Acronis\TrueImageHome\Common\ti_managers.dll
MOD - [2010.11.13 02:08:41 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll
========== Services (SafeList) ==========
SRV:64bit: - [2012.04.06 04:16:02 | 000,236,544 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\SysNative\atiesrxx.exe -- (AMD External Events Utility)
SRV - [2013.07.01 16:26:51 | 004,569,856 | ---- | M] () [Auto | Running] -- c:\program files (x86)\common files\akamai/netsession_win_8fa3539.dll -- (Akamai)
SRV - [2013.06.12 14:45:33 | 000,256,904 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.06.07 00:06:24 | 000,543,656 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.06.03 16:21:54 | 000,162,408 | R--- | M] (Skype Technologies) [Auto | Stopped] -- R:\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.05.21 06:44:22 | 000,144,368 | R--- | M] (Symantec Corporation) [Auto | Running] -- C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\ccSvcHst.exe -- (NIS)
SRV - [2013.05.10 09:57:22 | 000,065,640 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Stopped] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2013.03.15 07:53:06 | 001,266,464 | ---- | M] (NVIDIA Corporation) [Auto | Stopped] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013.03.14 22:07:46 | 000,383,264 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2013.02.11 03:24:21 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2013.02.04 18:43:22 | 000,155,824 | ---- | M] (Avanquest Software) [On_Demand | Stopped] -- C:\Program Files (x86)\Sony\Sony PC Companion\PCCService.exe -- (Sony PC Companion)
SRV - [2012.11.14 14:45:32 | 000,619,904 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\Tablet\Pen\WTabletServiceCon.exe -- (WTabletServiceCon)
SRV - [2012.11.12 15:22:38 | 002,452,912 | ---- | M] (LogMeIn Inc.) [Auto | Running] -- Z:\Hamachi\hamachi-2.exe -- (Hamachi2Svc)
SRV - [2012.09.20 14:33:22 | 050,899,608 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- R:\Microsoft Office\Office14\GROOVE.EXE -- (Microsoft SharePoint Workspace Audit Service)
SRV - [2012.08.25 04:00:40 | 000,114,144 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.06.12 01:12:43 | 003,246,040 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe -- (afcdpsrv)
SRV - [2011.09.22 22:21:28 | 001,114,280 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2010.01.09 22:34:24 | 004,925,184 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE -- (osppsvc)
SRV - [2010.01.09 22:20:56 | 000,174,440 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Programme\Common Files\Microsoft Shared\Source Engine\OSE.EXE -- (ose64)
SRV - [2009.08.18 13:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2013.06.25 12:39:04 | 000,052,320 | ---- | M] (hxxp://libusb-win32.sourceforge.net) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\libusb0.sys -- (libusb0)
DRV:64bit: - [2013.06.24 22:47:38 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\seehcri.sys -- (seehcri)
DRV:64bit: - [2013.06.19 14:28:05 | 000,177,312 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\SYMEVENT64x86.SYS -- (SymEvent)
DRV:64bit: - [2013.05.23 07:25:28 | 001,139,800 | ---- | M] (Symantec Corporation) [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symefa64.sys -- (SymEFA)
DRV:64bit: - [2013.05.21 07:02:00 | 000,493,656 | ---- | M] (Symantec Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symds64.sys -- (SymDS)
DRV:64bit: - [2013.05.16 07:02:14 | 000,796,760 | ---- | M] (Symantec Corporation) [File_System | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1404000.028\srtsp64.sys -- (SRTSP)
DRV:64bit: - [2013.04.25 02:43:56 | 000,433,752 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1404000.028\symnets.sys -- (SymNetS)
DRV:64bit: - [2013.04.16 04:41:14 | 000,169,048 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1404000.028\ccsetx64.sys -- (ccSet_NIS)
DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013.03.05 04:14:18 | 000,043,680 | R--- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\SymIMV.sys -- (SymIM)
DRV:64bit: - [2013.03.05 03:40:08 | 000,224,416 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1404000.028\ironx64.sys -- (SymIRON)
DRV:64bit: - [2013.03.05 03:21:35 | 000,036,952 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\NISx64\1404000.028\srtspx64.sys -- (SRTSPX)
DRV:64bit: - [2013.01.22 00:47:52 | 000,027,760 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggsemc.sys -- (ggsemc)
DRV:64bit: - [2013.01.22 00:47:52 | 000,014,448 | ---- | M] (Sony Ericsson Mobile Communications) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ggflt.sys -- (ggflt)
DRV:64bit: - [2013.01.17 21:15:12 | 000,066,800 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGSHidFilt.Sys -- (LGSHidFilt)
DRV:64bit: - [2012.12.19 07:41:52 | 000,194,488 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.10.12 09:54:54 | 000,015,776 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wacomrouterfilter.sys -- (wacomrouterfilter)
DRV:64bit: - [2012.10.12 09:20:38 | 000,081,312 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wachidrouter.sys -- (WacHidRouter)
DRV:64bit: - [2012.10.12 09:20:38 | 000,013,728 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidkmdf.sys -- (hidkmdf)
DRV:64bit: - [2012.06.12 01:12:43 | 000,285,280 | ---- | M] (Acronis) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\afcdp.sys -- (afcdp)
DRV:64bit: - [2012.06.12 01:12:41 | 001,263,200 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\tdrpm273.sys -- (tdrpman273)
DRV:64bit: - [2012.06.12 01:12:40 | 000,970,336 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\timntr.sys -- (timounter)
DRV:64bit: - [2012.06.12 01:12:38 | 000,277,088 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\snapman.sys -- (snapman)
DRV:64bit: - [2012.05.11 01:02:27 | 000,283,200 | ---- | M] (DT Soft Ltd) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\dtsoftbus01.sys -- (dtsoftbus01)
DRV:64bit: - [2012.04.06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (atikmdag)
DRV:64bit: - [2012.04.06 07:22:40 | 011,174,400 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmdag.sys -- (amdkmdag)
DRV:64bit: - [2012.04.06 03:10:44 | 000,343,040 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\atikmpag.sys -- (amdkmdap)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2012.02.23 14:32:04 | 000,095,760 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\AtihdW76.sys -- (AtiHDAudioService)
DRV:64bit: - [2012.02.22 21:55:36 | 000,314,016 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2012.02.22 21:55:36 | 000,043,680 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2011.09.21 11:25:54 | 000,021,992 | ---- | M] (CPUID) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\cpuz135_x64.sys -- (cpuz135)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010.11.05 11:13:10 | 000,694,376 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rtl8192su.sys -- (RTL8192su)
DRV:64bit: - [2010.02.24 12:20:40 | 000,191,616 | ---- | M] (Protect Software GmbH) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\acedrv11.sys -- (acedrv11)
DRV:64bit: - [2010.02.18 09:18:24 | 000,046,136 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdiox64.sys -- (amdiox64)
DRV:64bit: - [2009.11.25 21:06:02 | 001,276,928 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV:64bit: - [2009.11.24 02:38:00 | 000,016,008 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGVirHid.sys -- (LGVirHid)
DRV:64bit: - [2009.11.24 02:37:50 | 000,022,408 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LGBusEnum.sys -- (LGBusEnum)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.06.10 22:35:35 | 000,408,960 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvm62x64.sys -- (NVENETFD)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.04.30 14:06:58 | 000,339,360 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\nvmf6264.sys -- (NVNET)
DRV:64bit: - [2009.03.18 16:35:42 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\hamachi.sys -- (hamachi)
DRV - [2013.07.10 02:11:59 | 002,098,776 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130719.016\ex64.sys -- (NAVEX15)
DRV - [2013.07.10 02:11:59 | 000,126,040 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\VirusDefs\20130719.016\eng64.sys -- (NAVENG)
DRV - [2013.05.31 18:58:18 | 001,393,240 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\BASHDefs\20130715.001\BHDrvx64.sys -- (BHDrvx64)
DRV - [2012.10.23 19:05:44 | 000,513,184 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\Definitions\IPSDefs\20130718.001\IDSviA64.sys -- (IDSVia64)
DRV - [2012.08.18 03:00:00 | 000,484,512 | ---- | M] (Symantec Corporation) [Kernel | System | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys -- (eeCtrl)
DRV - [2012.08.09 14:54:04 | 000,138,912 | ---- | M] (Symantec Corporation) [Kernel | On_Demand | Running] -- C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys -- (EraserUtilRebootDrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = Preserve
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 3F 45 88 C5 C2 EE CD 01 [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = <local>
========== FireFox ==========
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_7_700_224.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.15.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.15.2: Z:\Java\bin\plugin2\npjp2.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: R:\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.6: Z:\VLC\npvlc.dll (VideoLAN)
FF:64bit: - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.2: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF:64bit: - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect64.dll (Adobe Systems)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_7_700_224.dll ()
FF - HKLM\Software\MozillaPlugins\@esn.me/esnsonar,version=0.70.4: C:\Program Files (x86)\Battlelog Web Plugins\Sonar\0.70.4\npesnsonar.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.110.0: C:\Program Files (x86)\Battlelog Web Plugins\1.110.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=1.122.0: C:\Program Files (x86)\Battlelog Web Plugins\1.122.0\npesnlaunch.dll File not found
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.4: C:\Program Files (x86)\Battlelog Web Plugins\2.1.4\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@esn/esnlaunch,version=2.1.7: C:\Program Files (x86)\Battlelog Web Plugins\2.1.7\npesnlaunch.dll (ESN Social Software AB)
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: R:\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.17.2: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.17.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll File not found
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKLM\Software\MozillaPlugins\@playstation.com/PsndlCheck,version=1.00: C:\Program Files (x86)\Sony\PLAYSTATION Network Downloader\nppsndl.dll (Sony Computer Entertainment Inc.)
FF - HKLM\Software\MozillaPlugins\@protectdisc.com/NPMPDRM: C:\Program Files (x86)\Common Files\mpDRM\NPMPDRM.dll ( )
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.2: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\adobe.com/AdobeAAMDetect: C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\CCM\Utilities\npAdobeAAMDetect32.dll (Adobe Systems)
FF - HKCU\Software\MozillaPlugins\pandonetworks.com/PandoWebPlugin: C:\Program Files (x86)\Pando Networks\Media Booster\npPandoWebPlugin.dll (Pando Networks)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{2D3F3651-74B9-4795-BDEC-6DA2F431CB62}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\coFFPlgn\ [2013.07.20 00:07:47 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\ff\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{BBDA0591-3099-440a-AA10-41764D9DB4DB}: C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_20.1.0.24\IPSFFPlgn\ [2012.10.24 18:26:59 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Components: R:\Mozilla\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 15.0\extensions\\Plugins: R:\Mozilla\plugins [2013.07.06 13:15:35 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: R:\Mozilla\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: R:\Mozilla\plugins [2013.07.06 13:15:35 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Components: R:\Mozilla\components
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 22.0\extensions\\Plugins: R:\Mozilla\plugins [2013.07.06 13:15:35 | 000,000,000 | ---D | M]
[2012.01.30 21:39:58 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Extensions
[2013.07.10 13:57:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\4xh1b7px.default\extensions
[2013.07.10 14:19:17 | 000,000,000 | ---D | M] (WebCake) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\4xh1b7px.default\extensions\plugin@getwebcake.com
[2012.12.08 15:22:51 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\ij9ke9cb.Test\extensions
[2012.01.30 21:40:00 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\ij9ke9cb.Test\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013.07.10 14:19:17 | 000,000,000 | ---D | M] (WebCake) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\ij9ke9cb.Test\extensions\plugin@getwebcake.com
[2013.06.20 00:23:05 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\ntwhzn6q.Standard-Benutzer\extensions
[2013.05.10 12:19:51 | 000,000,000 | ---D | M] (Yahoo! Toolbar) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\ntwhzn6q.Standard-Benutzer\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
[2013.07.10 14:19:17 | 000,000,000 | ---D | M] (WebCake) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\ntwhzn6q.Standard-Benutzer\extensions\plugin@getwebcake.com
[2013.07.10 13:57:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\zlh6tra1.default\extensions
[2013.07.10 14:19:17 | 000,000,000 | ---D | M] (WebCake) -- C:\Users\K\AppData\Roaming\mozilla\Firefox\Profiles\zlh6tra1.default\extensions\plugin@getwebcake.com
[2013.07.03 12:37:57 | 000,671,953 | ---- | M] () (No name found) -- C:\Users\K\AppData\Roaming\mozilla\firefox\profiles\ij9ke9cb.Test\extensions\webbooster@iminent.com.xpi
[2013.06.20 00:23:05 | 000,043,476 | ---- | M] () (No name found) -- C:\Users\K\AppData\Roaming\mozilla\firefox\profiles\ntwhzn6q.Standard-Benutzer\extensions\privateTab@infocatcher.xpi
[2013.06.08 22:26:16 | 000,004,525 | ---- | M] () (No name found) -- C:\Users\K\AppData\Roaming\mozilla\firefox\profiles\ntwhzn6q.Standard-Benutzer\extensions\youtubeunblocker@unblocker.yt.xpi
[2013.06.13 11:52:40 | 000,350,663 | ---- | M] () (No name found) -- C:\Users\K\AppData\Roaming\mozilla\firefox\profiles\ntwhzn6q.Standard-Benutzer\extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi
[2013.04.18 01:11:12 | 000,282,569 | ---- | M] () (No name found) -- C:\Users\K\AppData\Roaming\mozilla\firefox\profiles\ntwhzn6q.Standard-Benutzer\extensions\{46551EC9-40F0-4e47-8E18-8E5CF550CFB8}.xpi
[2012.12.23 16:23:36 | 000,030,502 | ---- | M] () (No name found) -- C:\Users\K\AppData\Roaming\mozilla\firefox\profiles\ntwhzn6q.Standard-Benutzer\extensions\{888d99e7-e8b5-46a3-851e-1ec45da1e644}.xpi
[2012.12.12 18:38:12 | 000,036,098 | ---- | M] () (No name found) -- C:\Users\K\AppData\Roaming\mozilla\firefox\profiles\ntwhzn6q.Standard-Benutzer\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}.xpi
[2013.05.10 12:19:49 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\K\AppData\Roaming\mozilla\firefox\profiles\ntwhzn6q.Standard-Benutzer\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
O1 HOSTS File: ([2009.06.10 23:00:26 | 000,000,824 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O2:64bit: - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - R:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - Z:\Java\bin\ssv.dll File not found
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - R:\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - Z:\Java\bin\jp2ssv.dll File not found
O2:64bit: - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll File not found
O2 - BHO: (Norton Identity Protection) - {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
O2 - BHO: (Norton Vulnerability Protection) - {6D53EC84-6AAE-4787-AEEE-F4628F01010C} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\IPS\IPSBHO.DLL (Symantec Corporation)
O2 - BHO: (Groove GFS Browser Helper) - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\PROGRA~2\MICROS~1\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (DVDVideoSoft WebPageAdjuster Class) - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll File not found
O3 - HKLM\..\Toolbar: (Norton Toolbar) - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\20.4.0.40\coIEPlg.dll (Symantec Corporation)
O4:64bit: - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [BCSSync] R:\Microsoft Office\Office14\BCSSync.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Launch LCore] C:\Program Files\Logitech Gaming Software\LCore.exe (Logitech Inc.)
O4:64bit: - HKLM..\Run: [VIAAUD] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VIAAUD.exe File not found
O4 - HKLM..\Run: [AdobeCS6ServiceManager] C:\Program Files (x86)\Common Files\Adobe\CS6ServiceManager\CS6ServiceManager.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [BambooCore] C:\Program Files (x86)\Bamboo Dock\BambooCore.exe ()
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKLM..\Run: [LogMeIn Hamachi Ui] Z:\Hamachi\hamachi-2-ui.exe (LogMeIn Inc.)
O4 - HKLM..\Run: [SwitchBoard] C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe (Adobe Systems Incorporated)
O4 - HKLM..\Run: [TrueImageMonitor.exe] R:\Acronis\TrueImageHome\TrueImageMonitor.exe (Acronis)
O4 - HKCU..\Run: [AdobeBridge] File not found
O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\K\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc.)
O4 - HKCU..\Run: [RESTART_STICKY_NOTES] C:\Windows\System32\StikyNot.exe File not found
O4 - HKCU..\Run: [Sony PC Companion] C:\Program Files (x86)\Sony\Sony PC Companion\PCCompanion.exe (Sony)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O8:64bit: - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200 File not found
O8:64bit: - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm File not found
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm File not found
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\SysWow64\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Free YouTube Download - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytvdownloader.htm File not found
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\freeytmp3downloader.htm File not found
O9:64bit: - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - R:\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - R:\Microsoft Office\Office14\ONBttnIE.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - R:\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra 'Tools' menuitem : Verknüpfte &OneNote-Notizen - {789FE86F-6FC4-46A1-9849-EDE0DB0C95CA} - R:\Microsoft Office\Office14\ONBttnIELinkedNotes.dll (Microsoft Corporation)
O9:64bit: - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll File not found
O9:64bit: - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns64.dll File not found
O9 - Extra Button: Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll File not found
O9 - Extra 'Tools' menuitem : Free YouTube Download - {EE932B49-D5C0-4D19-A3DA-CE0849258DE6} - C:\Program Files (x86)\Common Files\DVDVideoSoft\bin\IEDownloadMenuAndBtns.dll File not found
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000007 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000008 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: clonewarsadventures.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: freerealms.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: soe.com ([]* in Trusted sites)
O15 - HKCU\..Trusted Domains: sony.com ([]* in Trusted sites)
O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{500A26D3-82C5-42F1-9127-7CA9DE21A49A}: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A1CE1F40-6735-444F-BB85-4A94F59AB7F3}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - C:\Programme\Common Files\Microsoft Shared\Help\hxds.dll (Microsoft Corporation)
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\ms-help - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - AppInit_DLLs: (c:\progra~2\optimi~1\optpro~1.dll) - File not found
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28:64bit: - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - R:\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
O28 - HKLM ShellExecuteHooks: {B5A7F190-DDA6-4420-B3BA-52453494E6CD} - C:\PROGRA~2\MICROS~1\Office14\GROOVEEX.DLL (Microsoft Corporation)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2001.11.16 02:05:00 | 000,595,456 | R--- | M] (MAX DESIGN) - G:\Autorun.exe -- [ CDFS ]
O32 - AutoRun File - [2001.11.16 02:05:00 | 000,000,766 | R--- | M] () - G:\Autorun.ico -- [ CDFS ]
O32 - AutoRun File - [2001.11.16 02:05:00 | 000,000,045 | R--- | M] () - G:\Autorun.inf -- [ CDFS ]
O33 - MountPoints2\{09595dbc-48d3-11e1-ab79-002522d5e445}\Shell - "" = AutoRun
O33 - MountPoints2\{09595dbc-48d3-11e1-ab79-002522d5e445}\Shell\AutoRun\command - "" = E:\SETUP.EXE
O33 - MountPoints2\{09595dbc-48d3-11e1-ab79-002522d5e445}\Shell\configure\command - "" = E:\SETUP.EXE
O33 - MountPoints2\{09595dbc-48d3-11e1-ab79-002522d5e445}\Shell\install\command - "" = E:\SETUP.EXE
O33 - MountPoints2\{0cf3f0ef-484e-11e1-a8fb-806e6f6e6963}\Shell - "" = AutoRun
O33 - MountPoints2\{0cf3f0ef-484e-11e1-a8fb-806e6f6e6963}\Shell\AutoRun\command - "" = G:\Autorun.exe -- [2001.11.16 02:05:00 | 000,595,456 | R--- | M] (MAX DESIGN)
O33 - MountPoints2\{14d72354-c938-11e2-b8d1-002522fa314a}\Shell - "" = AutoRun
O33 - MountPoints2\{14d72354-c938-11e2-b8d1-002522fa314a}\Shell\AutoRun\command - "" = E:\pushinst.exe
O33 - MountPoints2\{c2be7f0f-5fd8-11e2-83a9-002522fa314a}\Shell - "" = AutoRun
O33 - MountPoints2\{c2be7f0f-5fd8-11e2-83a9-002522fa314a}\Shell\AutoRun\command - "" = E:\Startme.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2013.07.19 23:03:51 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Malwarebytes
[2013.07.19 23:03:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.07.19 23:03:43 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.07.19 23:03:42 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2013.07.19 23:03:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Malwarebytes' Anti-Malware
[2013.07.11 18:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\TEMP
[2013.07.11 18:07:52 | 000,000,000 | ---D | C] -- C:\ProgramData\Logs
[2013.07.11 18:07:51 | 000,019,392 | ---- | C] (Dll-Files.com) -- C:\Windows\SysNative\roboot64.exe
[2013.07.11 14:42:02 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\League of Legends
[2013.07.11 14:41:48 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Local\PMB Files
[2013.07.11 14:41:47 | 000,000,000 | ---D | C] -- C:\ProgramData\PMB Files
[2013.07.11 14:41:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Pando Networks
[2013.07.11 14:34:21 | 000,000,000 | -HSD | C] -- C:\Windows\SysWow64\AI_RecycleBin
[2013.07.11 14:32:03 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Riot Games
[2013.07.10 14:07:46 | 000,000,000 | ---D | C] -- C:\Users\K\Local Settings
[2013.07.10 14:06:20 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\BrowserDefender
[2013.07.10 14:06:08 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Local\Programs
[2013.07.10 14:05:44 | 000,000,000 | ---D | C] -- C:\ProgramData\BrowserDefender
[2013.07.10 14:04:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LyricsPal
[2013.07.10 13:57:56 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Iminent
[2013.07.10 13:57:55 | 000,000,000 | ---D | C] -- C:\ProgramData\Iminent
[2013.07.10 13:57:54 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl
[2013.07.10 13:57:52 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Iminent
[2013.07.10 13:57:25 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\WebCake
[2013.07.10 13:57:21 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\LyricsContainer
[2013.07.10 13:57:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Tarma Installer
[2013.07.10 01:13:45 | 000,000,000 | ---D | C] -- B:\Eigene Dokumente\ANNO 1404 Venedig
[2013.07.10 00:51:50 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Ubisoft
[2013.07.10 00:47:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Solidshield
[2013.07.09 23:47:52 | 000,000,000 | ---D | C] -- B:\Eigene Dokumente\Amazon Downloader Logs
[2013.06.25 12:38:10 | 000,076,384 | ---- | C] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\SysNative\libusb0.dll
[2013.06.25 12:38:10 | 000,052,320 | ---- | C] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\SysNative\drivers\libusb0.sys
[2013.06.25 12:36:46 | 000,067,680 | ---- | C] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\SysWow64\libusb0.dll
[2013.06.25 12:36:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\SixaxisPairTool
[2013.06.24 23:37:07 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Flashtool
[2013.06.24 22:47:38 | 000,034,032 | ---- | C] (Sony Ericsson Mobile Communications) -- C:\Windows\SysNative\drivers\seehcri.sys
[2013.06.24 19:36:03 | 000,000,000 | ---D | C] -- C:\Users\K\.swt
[2013.06.24 15:10:41 | 000,000,000 | ---D | C] -- C:\Users\K\.android
[2013.06.24 14:21:59 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Sony
[2013.06.24 14:21:56 | 000,000,000 | ---D | C] -- C:\ProgramData\Sony
[2013.06.23 18:56:56 | 000,000,000 | ---D | C] -- C:\Users\K\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Sony Mobile
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2013.07.20 00:07:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.07.20 00:07:40 | 2146,934,783 | -HS- | M] () -- C:\hiberfil.sys
[2013.07.19 23:45:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2013.07.19 23:37:22 | 008,862,284 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.07.19 23:37:22 | 003,053,502 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.07.19 23:37:22 | 002,694,436 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.07.19 23:37:22 | 002,410,172 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.07.19 23:37:22 | 000,006,458 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.07.19 23:18:30 | 000,000,128 | ---- | M] () -- C:\Users\K\defogger_reenable
[2013.07.19 23:03:43 | 000,001,109 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.07.19 22:57:14 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.07.19 22:57:14 | 000,014,608 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.07.19 22:35:07 | 001,925,889 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1404000.028\Cat.DB
[2013.07.17 22:55:43 | 000,163,062 | ---- | M] () -- C:\ProgramData\2433f433
[2013.07.13 03:26:58 | 005,035,272 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2013.07.11 22:43:24 | 000,276,148 | ---- | M] () -- B:\Eigene Dokumente\ts3_clientui-win64-1365064384-2013-07-11 22_43_24.024414.dmp
[2013.07.11 14:42:03 | 000,001,389 | ---- | M] () -- C:\Users\Public\Desktop\League of Legends.lnk
[2013.07.10 21:41:20 | 000,000,975 | ---- | M] () -- C:\Users\K\Desktop\Anno 1404.lnk
[2013.07.06 00:46:14 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2013.07.06 00:46:14 | 000,291,088 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2013.07.06 00:45:56 | 000,280,904 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2013.06.27 09:43:02 | 000,000,306 | RHS- | M] () -- C:\ProgramData\ntuser.pol
[2013.06.25 15:35:22 | 008,056,281 | ---- | M] () -- C:\Users\K\Desktop\RecoverX.zip
[2013.06.25 12:39:04 | 000,076,384 | ---- | M] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\SysNative\libusb0.dll
[2013.06.25 12:39:04 | 000,052,320 | ---- | M] (hxxp://libusb-win32.sourceforge.net) -- C:\Windows\SysNative\drivers\libusb0.sys
[2013.06.24 22:47:38 | 000,034,032 | ---- | M] (Sony Ericsson Mobile Communications) -- C:\Windows\SysNative\drivers\seehcri.sys
[2013.06.24 15:14:56 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_Kernel_WinUsb_01009.Wdf
[2013.06.24 14:21:59 | 000,002,098 | ---- | M] () -- C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
[2013.06.24 10:59:46 | 000,000,000 | -H-- | M] () -- C:\Windows\SysNative\drivers\Msft_User_wpdcomp_01_09_00.Wdf
[2013.06.23 18:56:56 | 000,000,681 | ---- | M] () -- C:\Users\K\Desktop\Update Service.lnk
[2013.06.20 12:19:36 | 000,014,818 | ---- | M] () -- C:\Windows\SysNative\drivers\NISx64\1404000.028\VT20130115.021
[4 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
========== Files Created - No Company Name ==========
[2013.07.19 23:18:30 | 000,000,128 | ---- | C] () -- C:\Users\K\defogger_reenable
[2013.07.19 23:03:43 | 000,001,109 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2013.07.17 22:55:43 | 000,163,062 | ---- | C] () -- C:\ProgramData\2433f433
[2013.07.11 22:43:24 | 000,276,148 | ---- | C] () -- B:\Eigene Dokumente\ts3_clientui-win64-1365064384-2013-07-11 22_43_24.024414.dmp
[2013.07.11 14:34:20 | 000,001,389 | ---- | C] () -- C:\Users\Public\Desktop\League of Legends.lnk
[2013.07.10 21:41:20 | 000,000,975 | ---- | C] () -- C:\Users\K\Desktop\Anno 1404.lnk
[2013.06.26 01:44:32 | 006,040,792 | ---- | C] () -- B:\Eigene Dokumente\com.android.vending-4.1.10.apk
[2013.06.25 15:36:07 | 008,056,281 | ---- | C] () -- C:\Users\K\Desktop\RecoverX.zip
[2013.06.25 12:38:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol
[2013.06.24 15:14:56 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_Kernel_WinUsb_01009.Wdf
[2013.06.24 14:21:59 | 000,002,098 | ---- | C] () -- C:\Users\Public\Desktop\Sony PC Companion 2.1.lnk
[2013.06.24 10:59:46 | 000,000,000 | -H-- | C] () -- C:\Windows\SysNative\drivers\Msft_User_wpdcomp_01_09_00.Wdf
[2013.06.23 18:56:56 | 000,000,681 | ---- | C] () -- C:\Users\K\Desktop\Update Service.lnk
[2013.05.19 17:59:48 | 000,000,040 | ---- | C] () -- C:\Windows\nfsc_patch.ini
[2013.05.19 16:33:44 | 000,010,240 | ---- | C] () -- C:\Windows\SysWow64\vidx16.dll
[2013.05.19 16:32:43 | 000,000,853 | ---- | C] () -- C:\Windows\disney.ini
[2013.04.08 21:31:54 | 000,188,416 | RHS- | C] () -- C:\Windows\SysWow64\winDCE32.dll
[2013.04.08 21:31:54 | 000,107,520 | RHS- | C] () -- C:\Windows\SysWow64\TAKDSDecoder.dll
[2013.03.07 19:15:53 | 000,451,072 | ---- | C] () -- C:\Windows\SysWow64\ISSRemoveSP.exe
[2012.05.11 00:22:01 | 000,000,132 | ---- | C] () -- C:\Users\K\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2012.05.07 21:51:27 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin
[2012.04.29 14:13:28 | 000,001,069 | ---- | C] () -- C:\Users\K\AppData\Roaming\EasyToolz.ini
[2012.04.25 19:43:17 | 000,032,256 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll
[2012.04.06 03:29:34 | 000,204,952 | ---- | C] () -- C:\Windows\SysWow64\ativvsvl.dat
[2012.04.06 03:29:34 | 000,157,144 | ---- | C] () -- C:\Windows\SysWow64\ativvsva.dat
[2012.02.27 23:08:33 | 000,000,089 | ---- | C] () -- C:\Users\K\AppData\Local\fusioncache.dat
[2012.02.27 23:07:56 | 001,619,106 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2012.02.18 19:14:31 | 000,000,064 | ---- | C] () -- C:\Windows\GPlrLanc.dat
[2012.01.30 19:59:26 | 000,007,641 | ---- | C] () -- C:\Users\K\AppData\Local\Resmon.ResmonCfg
[2012.01.30 19:02:03 | 000,291,088 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.01.30 19:02:01 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2011.09.13 00:06:16 | 000,003,917 | ---- | C] () -- C:\Windows\SysWow64\atipblag.dat
========== ZeroAccess Check ==========
[2011.11.17 08:41:18 | 000,000,000 | -HSD | M] -- C:\Windows\Installer\{a2ed12e9-0e29-1a2a-3360-d5cdd2150f93}\L
[2012.07.28 22:32:43 | 000,002,048 | -HS- | M] () -- C:\Users\K\AppData\Local\{a2ed12e9-0e29-1a2a-3360-d5cdd2150f93}\@
[2011.11.17 08:41:18 | 000,000,000 | -HSD | M] -- C:\Users\K\AppData\Local\{a2ed12e9-0e29-1a2a-3360-d5cdd2150f93}\L
[2011.11.17 08:41:18 | 000,000,000 | -HSD | M] -- C:\Users\K\AppData\Local\{a2ed12e9-0e29-1a2a-3360-d5cdd2150f93}\U
[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.02.27 07:52:56 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.02.27 06:55:05 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2013.02.28 17:44:59 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\.minecraft
[2012.01.27 13:43:04 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Acronis
[2012.07.11 17:32:07 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Akyn
[2012.10.11 17:13:13 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Atari
[2012.02.26 19:52:53 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Babylon
[2012.05.04 16:34:34 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2012.07.23 12:28:34 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Cool Record Edit Pro
[2012.04.28 16:35:52 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\CPUControl
[2012.05.11 01:01:53 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\DAEMON Tools Lite
[2012.05.10 23:39:06 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Dexpot
[2013.05.13 23:45:42 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\DVDVideoSoft
[2013.02.14 18:04:59 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.07.23 11:46:28 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Free Sound Recorder
[2013.07.10 14:13:02 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\igdhbblpcellaljokkpfhcjlagemhgjl
[2013.07.10 13:57:56 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Iminent
[2012.10.11 17:12:38 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Leadertech
[2012.01.27 12:42:26 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\LolClient
[2012.06.02 23:11:07 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\LolClient2
[2012.08.01 00:08:28 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\MediaMonkey
[2012.02.24 15:36:02 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Notepad++
[2012.07.11 19:13:17 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Ocusk
[2013.06.04 13:20:05 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Origin
[2013.04.13 16:55:50 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\PDAppFlex
[2012.10.10 17:36:06 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\ProtectDISC
[2012.11.10 14:37:11 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\RIFT
[2013.07.11 14:41:41 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Riot Games
[2013.01.16 17:34:24 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Sony
[2013.04.16 23:35:54 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\TeamViewer
[2012.07.28 22:45:47 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Tific
[2013.05.20 15:40:43 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Tropico 4 Demo
[2012.06.20 19:14:34 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\TrueCrypt
[2013.07.13 23:12:00 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\TS3Client
[2013.07.10 00:55:38 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Ubisoft
[2013.04.13 17:12:30 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Wacom
[2013.04.13 17:13:34 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\wacomid-desktop-launcher.DCFD4B89A63EE70BC162777F06D4B93B6397AEC7.1
[2013.07.10 14:19:17 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\WebCake
[2012.10.06 12:27:47 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\Wildlife Park 2
[2012.07.28 19:45:51 | 000,000,000 | ---D | M] -- C:\Users\K\AppData\Roaming\xsecva
========== Purity Check ==========
< End of report >
|
AdwCleaner auf deinen Desktop.
FRST 32-Bit | FRST 64-Bit
SecurityCheck und:
