Solved Freemium Free Paperball - Software Updater

-Z3RO- · Jan 5, 2014

Hi,

I have already looked for an answer to this problem but so far the general suggestion was to remove the folder "C:\Programme\SoftwareUpdate". It seemed to work at first but came back after the 3rd time or so of starting the Computer up again.

I just went through your 4 Step Guid and after the Restart The Malwarebytes initiated it did not come back. However I figured it might be a good idea to let you have a look at the log files to see if everything is indeed clean now.

I attached an image of the popup I get / got upon starting the computer.

Thank you in advance.

Here are the logs:

mbam-log-2014-01-05 (14-57-16)
--------------------------------------------

Malwarebytes Anti-Malware (Trial) 1.75.0.1300
www.malwarebytes.org

Database version: v2014.01.05.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
Dustin :: DUSTIN-PC [administrator]

Protection: Enabled

05.01.2014 14:57:16
mbam-log-2014-01-05 (14-57-16).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM
Scan options disabled: P2P
Objects scanned: 258946
Time elapsed: 7 minute(s), 21 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 31
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{68B81CCD-A80C-4060-8947-5AE69ED01199} (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E6B969FB-6D33-48d2-9061-8BBD4899EB08} (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0000435.BHO (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0000435.BHO.1 (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0000435.FBApi (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0000435.FBApi.1 (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0000435.Sandbox (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0000435.Sandbox.1 (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0033426.BHO (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0033426.BHO.1 (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0033426.Sandbox (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCR\CrossriderApp0033426.Sandbox.1 (PUP.Optional.CrossRider.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\XBV6RD5SZF (Trojan.FakeAlert) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Quarantined and deleted successfully.
HKCU\Software\Iminent (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully.
HKCU\Software\InstallCore\1I1T1Q1S (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\INSTALLCORE (PUP.Optional.InstallCore.A) -> Quarantined and deleted successfully.
HKCU\Software\InstalledBrowserExtensions\Plus HD (PUP.Optional.PlusHD.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\qvo6Software (PUP.Optional.qvo6.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86} (PUP.Optional.Qone8) -> Quarantined and deleted successfully.
HKLM\Software\Iminent (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110011041135} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKCR\CLSID\{11111111-1111-1111-1111-110011041135} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKCR\TypeLib\{44444444-4444-4444-4444-440044044435} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKCR\Interface\{55555555-5555-5555-5555-550055045535} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Settings\{11111111-1111-1111-1111-110011041135} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110011041135} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110011041135} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{11111111-1111-1111-1111-110311341126} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\Stats\{11111111-1111-1111-1111-110311341126} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{11111111-1111-1111-1111-110311341126} (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.

Registry Values Detected: 2
HKCU\Software\InstallCore|tb (PUP.Optional.InstallCore.A) -> Data: zr2X2X1G1S1F2V1S2Q0V -> Quarantined and deleted successfully.
HKLM\SOFTWARE\Mozilla\Firefox\extensions|{336D0C35-8A85-403a-B9D2-65C292C39087} (PUP.Optional.Incredibar) -> Data: C:\Program Files\Web Assistant\Firefox -> Quarantined and deleted successfully.

Registry Data Items Detected: 3
HKCU\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Page_URL (Hijack.StartPage) -> Bad: (http://www.qvo6.com/?utm_source=b&u...ADS-00M2B0_WD-WCAV5112488224882&ts=1373535849) Good: (http://www.google.com) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main|Default_Page_URL (Hijack.StartPage) -> Bad: (http://www.qvo6.com/?utm_source=b&u...ADS-00M2B0_WD-WCAV5112488224882&ts=1373535849) Good: (http://www.google.com) -> Quarantined and repaired successfully.
HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes|DefaultScope (PUP.Optional.Qone8) -> Bad: ({33BB0A4E-99AF-4226-BDF6-49120163DE86}) Good: ({0633EE93-D776-472f-A0FF-E1416B8B2E3A}) -> Quarantined and repaired successfully.

Folders Detected: 5
C:\Users\Dustin\AppData\Local\DownloadGuide (PUP.Optional.DownloadGuide.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Local\DownloadGuide\Offers (PUP.Optional.DownloadGuide.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Roaming\Dealply (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Roaming\Dealply\UpdateProc (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\LyricsFan (PUP.Optional.LyricsFan.A) -> Quarantined and deleted successfully.

Files Detected: 21
C:\ProgramData\CodecUpdate\ix_updater.exe (Trojan.Dropper.H) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Roaming\Dealply\UpdateProc\UpdateTask.exe (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\WDesktop.Updater.exe (PUP.Optional.WebCake.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\Downloads\FreeScreenVideoRecorder.exe (PUP.Optional.OpenCandy) -> Quarantined and deleted successfully.
C:\Users\Dustin\Downloads\Java(1).exe (PUP.Optional.DomaIQ) -> Quarantined and deleted successfully.
C:\Users\Dustin\Downloads\Java.exe (PUP.Optional.DomaIQ) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Local\DownloadGuide\Offers\iminent.exe (PUP.Optional.Iminent.A) -> Quarantined and deleted successfully.
C:\Windows\Tasks\Plus-HD-2.3-chromeinstaller.job (PUP.Optional.PlusHD.A) -> Quarantined and deleted successfully.
C:\Windows\Tasks\Plus-HD-2.3-codedownloader.job (PUP.Optional.PlusHD.A) -> Quarantined and deleted successfully.
C:\Windows\Tasks\Plus-HD-2.3-enabler.job (PUP.Optional.PlusHD.A) -> Quarantined and deleted successfully.
C:\Windows\Tasks\Plus-HD-2.3-firefoxinstaller.job (PUP.Optional.PlusHD.A) -> Quarantined and deleted successfully.
C:\Windows\Tasks\Plus-HD-2.3-updater.job (PUP.Optional.PlusHD.A) -> Quarantined and deleted successfully.
C:\Windows\Tasks\{22116563-108C-42c0-A7CE-60161B75E508}.job (Trojan.Downloader) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Mozilla Firefox\browser\searchplugins\qvo6.xml (PUP.Optional.qvo6.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Local\DownloadGuide\amazon.ico (PUP.Optional.DownloadGuide.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Local\DownloadGuide\icq_setup.exe (PUP.Optional.DownloadGuide.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Local\DownloadGuide\Offers\autocompletepro.exe (PUP.Optional.DownloadGuide.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Local\DownloadGuide\Offers\washandgo.exe (PUP.Optional.DownloadGuide.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Roaming\Dealply\UpdateProc\config.dat (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Users\Dustin\AppData\Roaming\Dealply\UpdateProc\TTL.DAT (PUP.Optional.DealPly.A) -> Quarantined and deleted successfully.
C:\Program Files (x86)\Codec-V\Codec-V.dll (PUP.Optional.CrossRider.M) -> Quarantined and deleted successfully.

(end)

protection-log-2014-01-05
----------------------------------

2014/01/05 14:56:32 +0100 DUSTIN-PC Dustin MESSAGE Starting protection
2014/01/05 14:56:32 +0100 DUSTIN-PC Dustin MESSAGE Protection started successfully
2014/01/05 14:56:32 +0100 DUSTIN-PC Dustin MESSAGE Starting IP protection
2014/01/05 14:56:42 +0100 DUSTIN-PC Dustin MESSAGE IP Protection started successfully
2014/01/05 14:56:56 +0100 DUSTIN-PC Dustin MESSAGE Starting database refresh
2014/01/05 14:56:56 +0100 DUSTIN-PC Dustin MESSAGE Stopping IP protection
2014/01/05 14:56:58 +0100 DUSTIN-PC Dustin MESSAGE IP Protection stopped successfully
2014/01/05 14:57:00 +0100 DUSTIN-PC Dustin MESSAGE Database refreshed successfully
2014/01/05 14:57:00 +0100 DUSTIN-PC Dustin MESSAGE Starting IP protection
2014/01/05 14:57:01 +0100 DUSTIN-PC Dustin MESSAGE IP Protection started successfully
2014/01/05 15:11:06 +0100 DUSTIN-PC (null) MESSAGE Starting protection
2014/01/05 15:11:06 +0100 DUSTIN-PC (null) MESSAGE Protection started successfully
2014/01/05 15:11:06 +0100 DUSTIN-PC (null) MESSAGE Starting IP protection
2014/01/05 15:11:08 +0100 DUSTIN-PC Dustin MESSAGE IP Protection started successfully

attach
--------

.
UNLESS SPECIFICALLY INSTRUCTED, DO NOT POST THIS LOG.
IF REQUESTED, ZIP IT UP & ATTACH IT
.
DDS (Ver_2012-11-20.01)
.
Microsoft Windows 7 Home Premium
Boot Device: \Device\HarddiskVolume1
Install Date: 11.11.2009 16:56:15
System Uptime: 05.01.2014 15:10:36 (0 hours ago)
.
Motherboard: ASUSTeK Computer INC. | | P7P55D
Processor: Intel(R) Core(TM) i5 CPU 750 @ 2.67GHz | LGA1156 | 1173/133mhz
.
==== Disk Partitions =========================
.
C: is FIXED (NTFS) - 98 GiB total, 16,793 GiB free.
D: is CDROM (CDFS)
E: is FIXED (NTFS) - 601 GiB total, 341,192 GiB free.
F: is FIXED (NTFS) - 932 GiB total, 391,936 GiB free.
.
==== Disabled Device Manager Items =============
.
==== System Restore Points ===================
.
RP644: 31.12.2013 20:03:40 - DirectX wurde installiert
RP645: 01.01.2014 19:00:45 - Windows-Sicherung
RP646: 05.01.2014 02:19:22 - DirectX wurde installiert
.
==== Installed Programs ======================
.
7-Zip 9.20
Adobe Acrobat 9 Pro - English, Français, Deutsch
Adobe Acrobat 9.5.5 - CPSID_83708
Adobe AIR
Adobe Community Help
Adobe Creative Suite 5 Design Premium
Adobe Flash Player 11 ActiveX
Adobe Flash Player 11 Plugin
Adobe Media Player
Adobe Photoshop Lightroom 5 64-bit
Adobe Reader XI (11.0.01) - Deutsch
America's Army 3
America's Army: Proving Grounds Beta
Apple Application Support
Apple Mobile Device Support
Apple Software Update
Arma 2: Operation Arrowhead
Arma 2: Operation Arrowhead Beta
Ashampoo Burning Studio 2013 v.11.0.6
ASIO4ALL
Bandicam
Bandisoft MPEG-1 Decoder
BattlEye for OA Uninstall
Blender
Borderlands 2
Call of Duty: Modern Warfare 2
Call of Duty: Modern Warfare 2 - Multiplayer
Capture NX 2
CEWE FOTOBUCH PRO
Codec-V
Corel Paint Shop Pro Photo X2
DiRT2
DiskMax 4.71
DivX Setup
DivxToDVD 0.5.2b
Dropbox
Dropbox Export Plug-in version 1.5.0 for Adobe Lightroom
EZ-RC
FileZilla Client 3.7.1
Firestorm-Release (remove only)
Free Download Manager 3.9.2
Google Chrome
Grand Theft Auto IV
Grand Theft Auto: Episodes from Liberty City
Hitman: Absolution
Hitman: Sniper Challenge
HP Officejet 4620 series - Grundlegende Software für das Gerät
HP Officejet 4620 series Hilfe
HP Photo Creations
HP Update
HPDiagnosticAlert
I.R.I.S. OCR
Java 7 Update 21 (64-bit)
Java 7 Update 45
Java Auto Updater
Junk Mail filter update
Kaspersky Internet Security 2013
L.A. Noire
LineIn plugin for WinAMP v1.80 (remove only)
Malwarebytes Anti-Malware version 1.75.0.1300
Max Payne 3
Men of War: Assault Squad
Microsoft .NET Framework 4 Client Profile
Microsoft .NET Framework 4 Extended
Microsoft Application Error Reporting
Microsoft Choice Guard
Microsoft Games for Windows - LIVE Redistributable
Microsoft Games for Windows Marketplace
Microsoft Silverlight
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
Microsoft Visual C++ 2005 Redistributable
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610
Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610
Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610
Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610
Microsoft_VC80_ATL_x86
Microsoft_VC80_ATL_x86_x64
Microsoft_VC80_CRT_x86
Microsoft_VC80_CRT_x86_x64
Microsoft_VC80_MFC_x86
Microsoft_VC80_MFC_x86_x64
Microsoft_VC80_MFCLOC_x86
Microsoft_VC80_MFCLOC_x86_x64
Microsoft_VC90_ATL_x86
Microsoft_VC90_ATL_x86_x64
Microsoft_VC90_CRT_x86
Microsoft_VC90_CRT_x86_x64
Microsoft_VC90_MFC_x86
Microsoft_VC90_MFC_x86_x64
Mirror's Edge™
Mozilla Firefox 26.0 (x86 de)
Mozilla Maintenance Service
Mozilla Thunderbird 17.0.5 (x86 de)
Mozilla Thunderbird 24.2.0 (x86 de)
MSVCRT
MSXML 4.0 SP2 (KB954430)
MSXML 4.0 SP2 (KB973688)
Need for Speed: Hot Pursuit
Nikon Message Center
Nikon Message Center 2
Nikon Movie Editor
Nikon Transfer
No More Room in Hell
NVIDIA 3D Vision Controller-Treiber 314.22
NVIDIA 3D Vision Treiber 331.65
NVIDIA Grafiktreiber 331.65
NVIDIA Install Application
NVIDIA PhysX
NVIDIA PhysX-Systemsoftware 9.12.1031
NVIDIA Stereoscopic 3D Driver
NVIDIA Systemsteuerung 331.65
NVIDIA Update 1.15.2
NVIDIA Update Components
OpenAL
OpenOffice 4.0.1
OpticFilm 8100
Option WWAN Driver 5.0.32.0 Installer
Option WWAN Driver 5.0.32.0 Installer
Origin
PAYDAY 2 Demo
PDF Settings CS5
Picture Control Utility
Picture Control Utility x64
Platform
Presto! PageManager 7.23
Prison Architect
PunkBuster Services
Python 2.6.4
QuickTime
RaidCall
Rapture3D 2.3.22 Game
Rockstar Games Social Club
Secure Eraser
Security Update for Microsoft .NET Framework 4 Client Profile (KB2160841)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2446708)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2478663)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2518870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2539636)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2572078)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2604121)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2633870)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656351)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656368v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2656405)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2686827)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2729449)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2736428)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2737019)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2742595)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2789642)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2804576)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2835393)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2840628v2)
Security Update for Microsoft .NET Framework 4 Client Profile (KB2858302v2)
Security Update for Microsoft .NET Framework 4 Extended (KB2487367)
Security Update for Microsoft .NET Framework 4 Extended (KB2656351)
Security Update for Microsoft .NET Framework 4 Extended (KB2736428)
Security Update for Microsoft .NET Framework 4 Extended (KB2742595)
Security Update for Microsoft .NET Framework 4 Extended (KB2858302v2)
SilverFast 8.0.1r5 (64bit)
Skype Click to Call
Skype™ 6.11
Space Engineers
SpeedFan (remove only)
Spyder4Elite
SpyderPRINT
SpyderStudio
Star Wars: The Old Republic
Steam
TeamSpeak 3 Client
The Cursed Crusade
The Stanley Parable
Trust 100K Series Webcam
Update for Microsoft .NET Framework 4 Client Profile (KB2468871)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939)
Update for Microsoft .NET Framework 4 Client Profile (KB2836939v3)
Update for Microsoft .NET Framework 4 Extended (KB2468871)
Update for Microsoft .NET Framework 4 Extended (KB2533523)
Update for Microsoft .NET Framework 4 Extended (KB2600217)
Update for Microsoft .NET Framework 4 Extended (KB2836939v3)
VC80CRTRedist - 8.0.50727.6195
VIA Plattform-Geräte-Manager
ViewNX 2
VSO CopyToDVD 4
Wacom Tablett
War Thunder
Warframe
WebTablet FB Plugin 32 bit
WebTablet FB Plugin 64 bit
WebTablet IE Plugin
WebTablet Netscape Plugin
Winamp
Winamp Detector Plug-in
Windows Live-Uploadtool
Windows Live Communications Platform
Windows Live Essentials
Windows Live ID Sign-in Assistant
Windows Live Mail
Xvid Video Codec
ZoneAlarm LTD Toolbar
.
==== End Of File ===========================

dds
------

DDS (Ver_2012-11-20.01) - NTFS_AMD64
Internet Explorer: 10.0.9200.16736 BrowserJavaVersion: 10.45.2
Run by Dustin at 15:23:43 on 2014-01-05
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4087.1977 [GMT 1:00]
.
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
.
============== Running Processes ===============
.
C:\Windows\system32\lsm.exe
C:\Windows\system32\svchost.exe -k DcomLaunch
C:\Windows\system32\nvvsvc.exe
C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
C:\Windows\system32\svchost.exe -k RPCSS
C:\Windows\System32\svchost.exe -k LocalServiceNetworkRestricted
C:\Windows\System32\svchost.exe -k LocalSystemNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalService
C:\Windows\system32\svchost.exe -k netsvcs
C:\Windows\system32\svchost.exe -k GPSvcGroup
C:\Program Files\Tablet\Wacom\WTabletServicePro.exe
C:\Windows\system32\svchost.exe -k NetworkService
C:\Windows\System32\spoolsv.exe
C:\Windows\system32\svchost.exe -k LocalServiceNoNetwork
C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe
E:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
E:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
C:\Windows\SysWOW64\PnkBstrA.exe
C:\Windows\SysWOW64\PSIService.exe
C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe
C:\Windows\system32\nvvsvc.exe
C:\Windows\system32\svchost.exe -k imgsvc
C:\Windows\system32\viakaraokesrv.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
C:\Windows\system32\taskhost.exe
C:\Windows\system32\Dwm.exe
C:\Windows\Explorer.EXE
E:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSvcM.exe
C:\Windows\system32\SearchIndexer.exe
C:\Windows\system32\svchost.exe -k NetworkServiceNetworkRestricted
C:\Windows\system32\svchost.exe -k LocalServiceAndNoImpersonation
C:\Windows\PixArt\PAC207\Monitor.exe
C:\Program Files\Tablet\Wacom\Wacom_TabletUser.exe
C:\Program Files\Tablet\Wacom\WacomHost.exe
C:\Program Files\Tablet\Wacom\Wacom_Tablet.exe
C:\Program Files\Tablet\Wacom\Wacom_TouchUser.exe
C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
C:\Program Files\NVIDIA Corporation\Display\nvtray.exe
C:\Windows\System32\spool\drivers\x64\3\WrtProc.exe
C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe
E:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe
C:\Program Files (x86)\HP\HP Software Update\hpwuschd2.exe
E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility.exe
C:\Users\Dustin\AppData\Roaming\Dropbox\bin\Dropbox.exe
C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Windows\system32\RunDll32.exe
C:\Program Files\Windows Media Player\wmpnetwk.exe
C:\Program Files\HP\HP Officejet 4620 series\bin\HPNetworkCommunicator.exe
C:\Windows\System32\svchost.exe -k LocalServicePeerNet
C:\Program Files\HP\HP Officejet 4620 series\Bin\HPNetworkCommunicator.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
C:\Windows\System32\svchost.exe -k secsvcs
C:\Windows\servicing\TrustedInstaller.exe
C:\Windows\system32\wuauclt.exe
E:\Programme\Malwarebytes' Anti-Malware\mbam.exe
C:\Windows\system32\svchost.exe -k SDRSVC
C:\Windows\system32\wbem\wmiprvse.exe
C:\Windows\System32\cscript.exe
.
============== Pseudo HJT Report ===============
.
uStart Page = about:blank
uSearch Bar = hxxp://www.google.com/ie
uSearch Page = hxxp://www.google.com
uDefault_Page_URL = hxxp://www.google.com
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = about:blank
mDefault_Page_URL = hxxp://www.google.com
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
BHO: Adobe PDF Link Helper: {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
BHO: DivX Plus Web Player HTML5 <video>: {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll
BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll
BHO: Adobe PDF Conversion Toolbar Helper: {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
BHO: Free Download Manager: {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Programme\Free Download Manager\iefdm2.dll
BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll
BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll
BHO: SmartSelect Class: {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
TB: Adobe PDF: {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
uRun: [Google Update] "C:\Users\Dustin\AppData\Local\Google\Update\GoogleUpdate.exe" /c
uRun: [HP Officejet 4620 series (NET)] "C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe" -deviceID "CN2BK242VZ05RT:NW" -scfn "HP Officejet 4620 series (NET)" -AutoStart 1
uRun: [Memory Cleaner] C:\Users\Dustin\AppData\Roaming\KoshyJohn.com\MemClean\MemClean.exe boot
uRun: [EA Core] "E:\Programme\EA Games\EADM\Core.exe" -silent
uRun: [AdobeBridge] "E:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe" -stealth
uRun: [Overwolf] C:\Program Files (x86)\Overwolf\Overwolf.exe -silent
mRun: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
mRun: [APSDaemon] "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
mRun: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
mRun: [HP Software Update] C:\Program Files (x86)\Hp\HP Software Update\HPWuSchd2.exe
mRun: [QuickTime Task] "E:\Programme\QuickTime\QTTask.exe" -atboottime
mRun: [AVP] "C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe"
mRun: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
StartupFolder: C:\Users\Dustin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\Dropbox.lnk - C:\Users\Dustin\AppData\Roaming\Dropbox\bin\Dropbox.exe
StartupFolder: C:\Users\Dustin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\KASPER~1.LNK - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\starter_avp.exe
StartupFolder: C:\Users\Dustin\AppData\Roaming\MICROS~1\Windows\STARTM~1\Programs\Startup\TINTEN~1.LNK - C:\Windows\System32\RunDll32.exe
StartupFolder: C:\PROGRA~3\MICROS~1\Windows\STARTM~1\Programs\Startup\SPYDER~1.LNK - E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility.exe
uPolicies-Explorer: DisableLocalMachineRun = dword:0
uPolicies-Explorer: DisableLocalMachineRunOnce = dword:0
uPolicies-Explorer: DisableCurrentUserRun = dword:0
uPolicies-Explorer: DisableCurrentUserRunOnce = dword:0
uPolicies-Explorer: NoDriveTypeAutoRun = dword:0
uPolicies-Explorer: NoFile = dword:0
uPolicies-Explorer: HideClock = dword:0
uPolicies-Explorer: NoDevMgrUpdate = dword:0
uPolicies-Explorer: NoDFSTab = dword:0
uPolicies-Explorer: NoWindowsUpdate = dword:0
uPolicies-Explorer: NoEncryptOnMove = dword:0
uPolicies-Explorer: NoRunasInstallPrompt = dword:0
uPolicies-Explorer: NoResolveTrack = dword:0
mPolicies-Explorer: NoActiveDesktop = dword:1
mPolicies-Explorer: NoViewOnDrive = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: DisableLocalMachineRun = dword:0
mPolicies-Explorer: DisableLocalMachineRunOnce = dword:0
mPolicies-Explorer: DisableCurrentUserRun = dword:0
mPolicies-Explorer: DisableCurrentUserRunOnce = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:60
mPolicies-Explorer: NoFile = dword:0
mPolicies-Explorer: HideClock = dword:0
mPolicies-Explorer: NoDevMgrUpdate = dword:0
mPolicies-Explorer: NoDFSTab = dword:0
mPolicies-Explorer: NoWindowsUpdate = dword:0
mPolicies-Explorer: NoEncryptOnMove = dword:0
mPolicies-Explorer: NoRunasInstallPrompt = dword:0
mPolicies-Explorer: NoResolveTrack = dword:0
mPolicies-Explorer: NoStartMenuSubFolders = dword:0
mPolicies-System: EnableUIADesktopToggle = dword:0
mPolicies-System: NoDispAppearancePage = dword:0
mPolicies-System: NoDispSettingsPage = dword:0
mPolicies-System: ConsentPromptBehaviorAdmin = dword:5
mPolicies-Explorer: NoViewOnDrive = dword:0
mPolicies-Explorer: NoDrives = dword:0
mPolicies-Explorer: DisableLocalMachineRun = dword:0
mPolicies-Explorer: DisableLocalMachineRunOnce = dword:0
mPolicies-Explorer: DisableCurrentUserRun = dword:0
mPolicies-Explorer: DisableCurrentUserRunOnce = dword:0
mPolicies-Explorer: NoDriveTypeAutoRun = dword:0
mPolicies-Explorer: NoFile = dword:0
mPolicies-Explorer: HideClock = dword:0
mPolicies-Explorer: NoDevMgrUpdate = dword:0
mPolicies-Explorer: NoDFSTab = dword:0
mPolicies-Explorer: NoWindowsUpdate = dword:0
mPolicies-Explorer: NoEncryptOnMove = dword:0
mPolicies-Explorer: NoRunasInstallPrompt = dword:0
mPolicies-Explorer: NoResolveTrack = dword:0
mPolicies-Explorer: NoStartMenuSubFolders = dword:0
mPolicies-System: NoDispAppearancePage = dword:0
IE: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm
IE: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Download all with Free Download Manager - E:\Programme\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - E:\Programme\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - E:\Programme\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - E:\Programme\Free Download Manager\dllink.htm
IE: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft &Excel exportieren - E:\PROGRA~1\Office\Office10\EXCEL.EXE/3000
IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - LocalServer32 - <no file>
IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll
TCP: NameServer = 192.168.1.1
TCP: Interfaces\{F408E428-6443-414B-B70B-740C91CB7122} : DHCPNameServer = 192.168.1.1
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll
SSODL: WebCheck - <orphaned>
x64-mStart Page = about:blank
x64-mDefault_Page_URL = hxxp://www.qvo6.com/?utm_source=b&utm_medium=cor&from=cor&uid=WDCXWD7500AADS-00M2B0_WD-WCAV5112488224882&ts=1373535849
x64-BHO: Content Blocker Plugin: {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll
x64-BHO: Virtual Keyboard Plugin: {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
x64-BHO: Java(tm) Plug-In SSV Helper: {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll
x64-BHO: Windows Live ID Sign-in Helper: {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
x64-BHO: Safe Money Plugin: {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll
x64-BHO: Webroot Vault: {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -
x64-BHO: Java(tm) Plug-In 2 SSV Helper: {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll
x64-BHO: URL Advisor Plugin: {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll
x64-Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe
x64-Run: [AdobeAAMUpdater-1.0] "C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe"
x64-Run: [WrtMon.exe] C:\Windows\System32\spool\drivers\x64\3\WrtMon.exe
x64-Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe -r
x64-IE: {0C4CC089-D306-440D-9772-464E226F6539} - {0BA14598-4178-4CE5-B1F1-B5C6408A3F2E} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll
x64-IE: {43699cd0-e34f-11de-8a39-0800200c9a66} - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} -
x64-IE: {CCF151D8-D089-449F-A5A4-D9909053F20F} - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll
x64-Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - <orphaned>
x64-SSODL: WebCheck - <orphaned>
.
================= FIREFOX ===================
.
FF - ProfilePath - C:\Users\Dustin\AppData\Roaming\Mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - plugin: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll
FF - plugin: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npdeployJava1.dll
FF - plugin: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll
FF - plugin: C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrlui.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll
FF - plugin: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll
FF - plugin: C:\Program Files (x86)\TabletPlugins\npwacom.dll
FF - plugin: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll
FF - plugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll
FF - plugin: C:\Users\Dustin\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll
FF - plugin: C:\Users\Dustin\AppData\Roaming\raidcall\plugins\nprcplugin.dll
FF - plugin: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll
FF - plugin: E:\Programme\Adobe\Acrobat 9 Pro\Acrobat\Air\nppdf32.dll
FF - plugin: E:\Programme\QuickTime\Plugins\npqtplugin.dll
FF - plugin: E:\Programme\QuickTime\Plugins\npqtplugin2.dll
FF - plugin: E:\Programme\QuickTime\Plugins\npqtplugin3.dll
FF - plugin: E:\Programme\QuickTime\Plugins\npqtplugin4.dll
FF - plugin: E:\Programme\QuickTime\Plugins\npqtplugin5.dll
FF - plugin: E:\Programme\QuickTime\Plugins\npqtplugin6.dll
FF - ExtSQL: 2013-11-26 16:03; {fe272bd1-5f76-4ea4-8501-a05d35d823fc}; C:\Users\Dustin\AppData\Roaming\Mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
.
---- FIREFOX POLICIES ----
FF - user.js: network.http.max-connections - 256
FF - user.js: network.http.max-connections-per-server - 48
FF - user.js: network.http.max-persistent-connections-per-proxy - 32
FF - user.js: network.http.max-persistent-connections-per-server - 18
.
============= SERVICES / DRIVERS ===============
.
R1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;C:\Windows\System32\drivers\klim6.sys [2012-8-2 29792]
R1 kltdi;kltdi;C:\Windows\System32\drivers\kltdi.sys [2013-5-2 54368]
R1 kneps;kneps;C:\Windows\System32\drivers\kneps.sys [2013-5-2 178448]
R2 AVP;Kaspersky Anti-Virus Service;C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe [2013-5-2 356128]
R2 GtDetectSc;GtDetectSc;C:\Program Files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [2009-5-4 809984]
R2 MBAMScheduler;MBAMScheduler;E:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe [2014-1-5 418376]
R2 MBAMService;MBAMService;E:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe [2014-1-5 701512]
R2 Skype C2C Service;Skype C2C Service;C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe [2012-10-2 3064000]
R2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2013-10-23 414496]
R2 VIAKaraokeService;VIA Karaoke digital mixer Service;C:\Windows\System32\ViakaraokeSrv.exe [2013-5-14 27768]
R2 WTabletServicePro;Wacom Professional Service;C:\Program Files\Tablet\Wacom\WTabletServicePro.exe [2013-5-14 621336]
R3 klkbdflt;Kaspersky Lab KLKBDFLT;C:\Windows\System32\drivers\klkbdflt.sys [2013-5-2 29280]
R3 klmouflt;Kaspersky Lab KLMOUFLT;C:\Windows\System32\drivers\klmouflt.sys [2013-5-2 29280]
R3 MBAMProtector;MBAMProtector;C:\Windows\System32\drivers\mbam.sys [2014-1-5 25928]
R3 RTL8167;Realtek 8167 NT Driver;C:\Windows\System32\drivers\Rt64win7.sys [2013-3-4 838216]
R3 VIAHdAudAddService;VIA High Definition Audio Driver Service;C:\Windows\System32\drivers\viahduaa.sys [2013-5-14 2206864]
S2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-3-18 130384]
S2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-3-18 138576]
S2 SkypeUpdate;Skype Updater;C:\Program Files (x86)\Skype\Updater\Updater.exe [2013-9-5 171680]
S3 dcscusb;Spyder3Print SR Spectrocolorimeter;C:\Windows\System32\drivers\dcscusb.sys [2009-5-29 14848]
S3 hidkmdf;KMDF Driver;C:\Windows\System32\drivers\hidkmdf.sys [2013-5-14 14136]
S3 PAC207;Trust 100K Series Webcam;C:\Windows\System32\drivers\PFC027.SYS [2010-7-13 686592]
S3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;C:\Windows\System32\drivers\rdpvideominiport.sys [2013-12-3 19456]
S3 Spyder4;Datacolor Spyder4;C:\Windows\System32\drivers\dccmtr.sys [2011-7-12 15360]
S3 SWDUMon;SWDUMon;C:\Windows\System32\drivers\SWDUMon.sys [2013-5-14 16152]
S3 SwitchBoard;SwitchBoard;C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [2010-2-19 517096]
S3 TsUsbFlt;TsUsbFlt;C:\Windows\System32\drivers\TsUsbFlt.sys [2013-12-3 57856]
S3 WacHidRouter;Wacom Hid Router;C:\Windows\System32\drivers\wachidrouter.sys [2013-5-14 89912]
S3 wacomrouterfilter;Wacom Router Filter Driver;C:\Windows\System32\drivers\wacomrouterfilter.sys [2013-5-14 15160]
S3 WinRing0_1_2_0;WinRing0_1_2_0;E:\Programme\RealTemp\WinRing0x64.sys [2008-7-26 14544]
.
=============== File Associations ===============
.
FileExt: .txt: txtfile=C:\Windows\SysWow64\NOTEPAD.EXE %1
FileExt: .ini: inifile=C:\Windows\SysWow64\NOTEPAD.EXE %1
FileExt: .inf: inffile=C:\Windows\SysWow64\NOTEPAD.EXE %1
FileExt: .js: jsfile="E:\Programme\Adobe\Adobe Dreamweaver CS5\Dreamweaver.exe","%1"
ShellExec: dreamweaver.exe: Open="E:\Programme\Adobe\Adobe Dreamweaver CS5\dreamweaver.exe", "%1"
.
=============== Created Last 30 ================
.
2014-01-05 13:56:22 -------- d-----w- C:\Users\Dustin\AppData\Roaming\Malwarebytes
2014-01-05 13:55:38 -------- d-----w- C:\ProgramData\Malwarebytes
2014-01-05 13:55:37 25928 ----a-w- C:\Windows\System32\drivers\mbam.sys
2014-01-05 01:22:10 -------- d-----w- C:\Users\Dustin\AppData\Local\ArmA 2 OA
2014-01-04 12:22:13 -------- d-----w- C:\Program Files (x86)\SoftwareUpdater
2014-01-03 09:03:43 -------- d-----w- C:\Users\Dustin\AppData\Roaming\ASCOMP Software
2014-01-01 19:05:21 -------- d-----w- C:\Users\Dustin\AppData\Roaming\raidcall
2013-12-31 23:23:46 -------- d-----w- C:\Program Files (x86)\BandiMPEG1
2013-12-29 19:17:03 -------- d-----w- C:\Windows\System32\IO
2013-12-21 10:16:48 -------- d-----w- C:\Users\Dustin\AppData\Local\SoftwareUpdater
2013-12-16 21:50:57 -------- d-----w- C:\Users\Dustin\AppData\Roaming\Telefónica
2013-12-16 21:50:56 -------- d-----w- C:\Users\Dustin\AppData\Roaming\TGCMLog
2013-12-16 21:50:47 -------- d-----w- C:\Program Files\Option
2013-12-16 21:50:26 123392 ----a-w- C:\Windows\System32\drivers\ZTEusbgps.sys
2013-12-16 21:50:22 -------- d-----w- C:\Windows\massfilter
2013-12-16 16:45:22 -------- d-----w- C:\ProgramData\Samsung
2013-12-16 12:24:48 -------- d-----w- C:\Windows\SysWow64\SupportAppPBHostless Modem
2013-12-16 12:24:45 -------- d-----w- C:\Program Files (x86)\Hostless Modem
2013-12-11 13:29:28 -------- d-----w- C:\Users\Dustin\AppData\Local\PAYDAY 2 (Demo)
.
==================== Find3M ====================
.
2014-01-04 19:38:15 291176 ----a-w- C:\Windows\SysWow64\PnkBstrB.xtr
2014-01-04 19:38:15 291176 ----a-w- C:\Windows\SysWow64\PnkBstrB.exe
2014-01-04 19:37:58 291096 ----a-w- C:\Windows\SysWow64\PnkBstrB.ex0
2014-01-03 13:41:04 952 --sha-w- C:\Windows\SysWow64\KGyGaAvL.sys
2013-12-11 09:58:58 29792 ----a-w- C:\Windows\System32\drivers\klim6.sys
2013-12-11 09:58:57 458336 ----a-w- C:\Windows\System32\drivers\kl1.sys
2013-12-10 20:42:34 71048 ----a-w- C:\Windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-10 20:42:34 692616 ----a-w- C:\Windows\SysWow64\FlashPlayerApp.exe
2013-11-19 02:33:38 267936 ----a-w- C:\Windows\System32\MpSigStub.exe
2013-10-23 08:20:10 6669600 ----a-w- C:\Windows\System32\nvcpl.dll
2013-10-23 08:20:07 3489568 ----a-w- C:\Windows\System32\nvsvc64.dll
2013-10-23 08:20:06 219424 ----a-w- C:\Windows\System32\nvmctray.dll
2013-10-23 08:20:05 922912 ----a-w- C:\Windows\System32\nvvsvc.exe
2013-10-23 08:20:05 63776 ----a-w- C:\Windows\System32\nvshext.dll
2013-10-23 08:20:05 2559776 ----a-w- C:\Windows\System32\nvsvcr.dll
2013-10-23 02:02:36 589600 ----a-w- C:\Windows\SysWow64\nvStreaming.exe
2013-10-20 07:50:50 96168 ----a-w- C:\Windows\SysWow64\WindowsAccessBridge-32.dll
2013-10-12 08:45:20 2241536 ----a-w- C:\Windows\System32\wininet.dll
2013-10-12 08:43:37 3959808 ----a-w- C:\Windows\System32\jscript9.dll
2013-10-12 08:43:32 67072 ----a-w- C:\Windows\System32\iesetup.dll
2013-10-12 08:43:32 136704 ----a-w- C:\Windows\System32\iesysprep.dll
2013-10-12 07:03:50 1767936 ----a-w- C:\Windows\SysWow64\wininet.dll
2013-10-12 07:02:33 2877952 ----a-w- C:\Windows\SysWow64\jscript9.dll
2013-10-12 07:02:29 61440 ----a-w- C:\Windows\SysWow64\iesetup.dll
2013-10-12 07:02:29 109056 ----a-w- C:\Windows\SysWow64\iesysprep.dll
2013-10-12 06:35:26 2706432 ----a-w- C:\Windows\System32\mshtml.tlb
2013-10-12 06:08:58 2706432 ----a-w- C:\Windows\SysWow64\mshtml.tlb
2013-10-12 05:44:38 89600 ----a-w- C:\Windows\System32\RegisterIEPKEYs.exe
2013-10-12 05:15:39 71680 ----a-w- C:\Windows\SysWow64\RegisterIEPKEYs.exe
2013-10-12 02:30:42 830464 ----a-w- C:\Windows\System32\nshwfp.dll
2013-10-12 02:29:21 859648 ----a-w- C:\Windows\System32\IKEEXT.DLL
2013-10-12 02:29:08 324096 ----a-w- C:\Windows\System32\FWPUCLNT.DLL
2013-10-12 02:03:08 656896 ----a-w- C:\Windows\SysWow64\nshwfp.dll
2013-10-12 02:01:25 216576 ----a-w- C:\Windows\SysWow64\FWPUCLNT.DLL
2013-10-11 20:48:07 29280 ----a-w- C:\Windows\System32\drivers\klmouflt.sys
2013-10-11 20:48:07 29280 ----a-w- C:\Windows\System32\drivers\klkbdflt.sys
2013-07-12 15:54:02 9842040 ----a-w- C:\Program Files (x86)\Common Files\wruninstall.exe
.
============= FINISH: 15:25:40,59 ===============

Broni · Jan 5, 2014

Welcome aboard

Please, observe following rules:

Read all of my instructions very carefully. Your mistakes during cleaning process may have very serious consequences, like unbootable computer.
If you're stuck, or you're not sure about certain step, always ask before doing anything else.
Please refrain from running any tools, fixes or applying any changes to your computer other than those I suggest.
Never run more than one scan at a time.
Keep updating me regarding your computer behavior, good, or bad.
The cleaning process, once started, has to be completed. Even if your computer appears to act better, it may still be infected. Once the computer is totally clean, I'll certainly let you know.
If you leave the topic without explanation in the middle of a cleaning process, you may not be eligible to receive any more help in malware removal forum.
I close my topics if you have not replied in 5 days. If you need more time, simply let me know. If I closed your topic and you need it to be reopened, simply PM me.

==================================

Download RogueKiller for 32bit or Roguekiller for 64bit to your Desktop.

Close all the running programs
Windows Vista/7 users: right click on RogueKiller.exe, click Run as Administrator
Otherwise just double-click on RogueKiller.exe
Pre-scan will start. Let it finish.
Click on SCAN button.
Wait until the Status box shows Scan Finished
Click on Delete.
Wait until the Status box shows Deleting Finished.
Click on Report and copy/paste the content of the Notepad into your next reply.
RKreport.txt could also be found on your desktop.
If more than one log is produced post all logs.
If RogueKiller has been blocked, do not hesitate to try a few times more. If really won't run, rename it to winlogon.exe (or winlogon.com) and try again

Create new restore point before proceeding with the next step....
How to: http://www.smartestcomputing.us.com/topic/63983-how-to-create-new-restore-point-all-windows/

Download Malwarebytes Anti-Rootkit (MBAR) from HERE

Unzip downloaded file.
Open the folder where the contents were unzipped and run mbar.exe
Follow the instructions in the wizard to update and allow the program to scan your computer for threats.
Click on the Cleanup button to remove any threats and reboot if prompted to do so.
Wait while the system shuts down and the cleanup process is performed.
Perform another scan with Malwarebytes Anti-Rootkit to verify that no threats remain. If they do, then click Cleanup once more and repeat the process.
When done, please post the two logs produced they will be in the MBAR folder..... mbar-log-xxxxx.txt and system-log.txt

Please download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

If normal mode still doesn't work, run the tool from safe mode.

When the scan is done Notepad will open with rKill log.
Post it in your next reply.

NOTE. rKill.txt log will also be present on your desktop.

-Z3RO- · Jan 5, 2014

I tried to run the RogueKiller several times... both the 32 and the 64 bit version, renaming it to winlogon.exe (or winlogon.com) as you suggested. However it always gets stuck in the prescan on :
Status
Überprüfe Prozesse...-> dllhost.exe
(yea, sorry, it shows up in german

)

should I just move on to the next steps?

Broni · Jan 5, 2014

Yes please.

-Z3RO- · Jan 6, 2014

The popup is back again

I made the restore point....
On to the next steps now....
mbar seems to work...

-Z3RO- · Jan 6, 2014

Ok... I jumped RogueKiller as you asked and went on to MBAR...

here are the logs:

log #1:a
mbar-log-2014-01-06 (17-36-28)
------------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1008
www.malwarebytes.org

Database version: v2014.01.06.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
Dustin :: DUSTIN-PC [administrator]

06.01.2014 17:36:28
mbar-log-2014-01-06 (17-36-28).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 284487
Time elapsed: 11 minute(s), 40 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 1
HKLM\SOFTWARE\MICROSOFT\INTERNET EXPLORER\MAIN|Default_Page_URL (Hijack.StartPage) -> Bad: (http://www.qvo6.com/?utm_source=b&u...ADS-00M2B0_WD-WCAV5112488224882&ts=1373535849) Good: (http://www.google.com) -> Replace on reboot.

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

log #2:
mbar-log-2014-01-06 (18-01-47)
------------------------------------------

Malwarebytes Anti-Rootkit BETA 1.07.0.1008
www.malwarebytes.org

Database version: v2014.01.06.05

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16736
Dustin :: DUSTIN-PC [administrator]

06.01.2014 18:01:47
mbar-log-2014-01-06 (18-01-47).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 284480
Time elapsed: 10 minute(s), 13 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

-Z3RO- · Jan 6, 2014

On to Rkill...
----------------

Rkill 2.6.4 by Lawrence Abrams (Grinler)
http://www.bleepingcomputer.com/
Copyright 2008-2014 BleepingComputer.com
More Information about Rkill can be found at this link:
http://www.bleepingcomputer.com/forums/topic308364.html

Program started at: 01/06/2014 06:20:35 PM in x64 mode.
Windows Version: Windows 7 Home Premium Service Pack 1

Checking for Windows services to stop:

* No malware services found to stop.

Checking for processes to terminate:

* No malware processes found to kill.

Checking Registry for malware related settings:

* No issues found in the Registry.

Resetting .EXE, .COM, & .BAT associations in the Windows Registry.

Performing miscellaneous checks:

* Windows Firewall Disabled

[HKLM\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = dword:00000000

Checking Windows Service Integrity:

* No issues found.

Searching for Missing Digital Signatures:

* No issues found.

Checking HOSTS File:

* No issues found.

Program finished at: 01/06/2014 06:20:43 PM
Execution time: 0 hours(s), 0 minute(s), and 8 seconds(s)

Broni · Jan 6, 2014

Please download ComboFix from Here, Here or Here to your Desktop.

**Note: In the event you already have Combofix, this is a new version that I need you to download. It is important that it is saved directly to your desktop**

Never rename Combofix unless instructed.
Close any open browsers.
Very Important! Temporarily disable your anti-virus and any anti-malware real-time protection before performing a scan. They can interfere with ComboFix or remove some of its embedded files which may cause "unpredictable results".
Click on this link to see a list of programs that should be disabled. The list is not all inclusive. If yours is not listed and you don't know how to disable it, please ask.
Close any open browsers.
WARNING: Combofix will disconnect your machine from the Internet as soon as it starts
Please do not attempt to re-connect your machine back to the Internet until Combofix has completely finished.
If there is no internet connection after running Combofix, then restart your computer to restore back your connection.
If the connection is not there use restore point you created prior to running Combofix.
Double click on combofix.exe & follow the prompts.

NOTE1. If Combofix asks you to install Recovery Console, please allow it.
NOTE 2. If Combofix asks you to update the program, always do so.

When finished, it will produce a report for you.
Please post the "C:\ComboFix.txt"

**Note 1: Do not mouseclick combofix's window while it's running. That may cause it to stall
**Note 2 for AVG and CA Internet Security (Total Defense Internet Security) users: ComboFix will not run until AVG/CA Internet Security is uninstalled as a protective measure against the anti-virus. This is because AVG/CA Internet Security "falsely" detects ComboFix (or its embedded files) as a threat and may remove them resulting in the tool not working correctly which in turn can cause "unpredictable results". Since AVG/CA Internet Security cannot be effectively disabled before running ComboFix, the author recommends you to uninstall AVG/CA Internet Security first.
Use AppRemover to uninstall it: https://www.techspot.com/downloads/5514-appremover.html
We can reinstall it when we're done with CF.
**Note 3: If you receive an error Illegal operation attempted on a registery key that has been marked for deletion, restart computer to fix the issue.
**Note 4: Some infections may take some significant time to be cured. As long as your computer clock is running Combofix is still working. Be patient.

Make sure, you re-enable your security programs, when you're done with Combofix.

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

NOTE.
If, for some reason, Combofix refuses to run, try the following...

Delete Combofix file, download fresh one, but rename combofix.exe to your_name.exe BEFORE saving it to your desktop.
Do NOT run it yet.
Download Rkill (courtesy of BleepingComputer.com) to your desktop.
There are 2 different versions. If one of them won't run then download and try to run the other one.
You only need to get one of these to run, not all of them. You may get warnings from your antivirus about this tool, ignore them or shutdown your antivirus.

rKill.exe: http://www.bleepingcomputer.com/download/rkill/dl/10/
iExplore.exe (renamed rKill.exe): http://www.bleepingcomputer.com/download/rkill/dl/11/

Restart computer in safe mode

Double-click on the Rkill desktop icon to run the tool.
If using Vista or Windows 7 right-click on it and choose Run As Administrator.
A black DOS box will briefly flash and then disappear. This is normal and indicates the tool ran successfully.
If not, delete the file, then download and use the one provided in Link 2.
Do not reboot until instructed.
If the tool does not run from any of the links provided, please let me know.

When the scan is done Notepad will open with rKill.txt log.
NOTE. rKill.txt log will also be present on your desktop.

Once you've gotten one of them to run, immediately run your_name.exe by double clicking on it.

IF you had to run rKill post BOTH logs, rKill.txt and Combofix.txt.

-Z3RO- · Jan 7, 2014

ComboFix
--------------

ComboFix 14-01-04.03 - Dustin 07.01.2014 9:29.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.4087.2419 [GMT 1:00]
ausgeführt von:: c:\users\Dustin\Desktop\ComboFix.exe
AV: Kaspersky Internet Security *Disabled/Updated* {C3113FBF-4BCB-4461-D78D-6EDFEC9593E5}
FW: Kaspersky Internet Security *Disabled* {FB2ABE9A-01A4-4539-FCD2-C7EA1246D49E}
SP: Kaspersky Internet Security *Disabled/Updated* {7870DE5B-6DF1-4BEF-ED3D-55AD9712D958}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\FindLyrics
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_omfoidjpeklpjhlhabhcomekbkclkbec_0
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_omfoidjpeklpjhlhabhcomekbkclkbec_0\18
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\databases\chrome-extension_omfoidjpeklpjhlhabhcomekbkclkbec_0\19
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\background.html
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\crossriderManifest.json
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\icons\actions\1.png
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\icons\icon128.png
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\icons\icon16.png
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\icons\icon48.png
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\api\chrome.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\api\cookie.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\api\message.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\app\background.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\app\extension.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\background.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\app_api.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\async_api.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\bg_app_api.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\cookie_store.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\crossriderAPI.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\data_store.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\delegate.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\events.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\installer.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\logging.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\onBGDocumentLoad.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\popupResource\newPopup.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\popupResource\popup.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\reports.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\util.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\js\lib\xhr.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\manifest.json
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.23.17_0\popup.html
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\background.html
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\crossriderManifest.json
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\manifest.xml
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins.json
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\1_base.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\101_cortica_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\102_dealply_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\103_intext_5_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\104_jollywallet_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\105_corticas_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\107_coupish_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\108_icm_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\116_ads_only_5_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\117_coupons_intext_ads_5_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\119_similar_web_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\120_luck_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\123_intext_adv_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\124_superfish_no_search_no_coupons_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\125_arcadi2_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\126_revizer_ws_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\127_revizer_p_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\128_superfish_pricora_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\129_widdit_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\13_CrossriderAppUtils.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\135_arcadi3_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\138_getdeal_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\14_CrossriderUtils.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\141_corticas_ru_m.js.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\142_intext_fa_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\155_ibario_pops_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\158_50onred_ads_only_no_fb_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\159_cortica_rollover_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\17_jQuery.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\170_icm1_5_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\171_arcadi2_sourceID_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\174_arcadi_serp_dynamic_id_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\19_CHAppAPIWrapper.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\21_debug.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\22_resources.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\28_initializer.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\4_jquery_1_7_1.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\47_resources_background.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\64_appApiMessage.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\7_hooks.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\72_appApiValidation.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\78_CrossriderInfo.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\80_CHPopupAppAPI.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\87_ginyas_wrapper.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\9_search_engine_hook.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\91_monetizationLoader.js.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\92_superfish_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\93_superfish_no_coupons_m.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\plugins\97_resourceApiWrapper.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\userCode\background.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\extensionData\userCode\extension.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\icons\actions\1.png
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\icons\icon128.png
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\icons\icon16.png
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\icons\icon48.png
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\api\chrome.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\api\cookie.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\api\message.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\api\pageAction.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\api\pageActionBG.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\background.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\app_api.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\bg_app_api.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\consts.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\cookie_store.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\crossriderAPI.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\delegate.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\events.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\extensionDataStore.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\installer.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\logFile.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\logging.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\onBGDocumentLoad.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\popupResource\newPopup.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\popupResource\popup.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\reports.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\storageWrapper.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\updateManager.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\util.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\lib\xhr.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\js\main.js
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\manifest.json
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\omfoidjpeklpjhlhabhcomekbkclkbec\1.25.81_0\popup.html
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omfoidjpeklpjhlhabhcomekbkclkbec
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omfoidjpeklpjhlhabhcomekbkclkbec\000005.ldb
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omfoidjpeklpjhlhabhcomekbkclkbec\000006.log
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omfoidjpeklpjhlhabhcomekbkclkbec\CURRENT
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omfoidjpeklpjhlhabhcomekbkclkbec\LOCK
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omfoidjpeklpjhlhabhcomekbkclkbec\LOG
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omfoidjpeklpjhlhabhcomekbkclkbec\LOG.old
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Extension Settings\omfoidjpeklpjhlhabhcomekbkclkbec\MANIFEST-000004
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_omfoidjpeklpjhlhabhcomekbkclkbec_0.localstorage-journal
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_omfoidjpeklpjhlhabhcomekbkclkbec_0.localstorage
c:\users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Preferences
c:\windows\msvcr71.dll
c:\windows\SysWow64\tmp95BF.tmp
c:\windows\SysWow64\tmp95C0.tmp
c:\windows\SysWow64\tmpCFCD.tmp
c:\windows\SysWow64\tmpCFED.tmp
c:\windows\wininit.ini
E:\install.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-12-07 bis 2014-01-07 ))))))))))))))))))))))))))))))
.
.
2014-01-06 16:36 . 2014-01-06 17:12 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-01-06 16:36 . 2014-01-06 17:01 117464 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-01-06 16:34 . 2014-01-06 16:35 89304 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-01-05 13:56 . 2014-01-05 13:56 -------- d-----w- c:\users\Dustin\AppData\Roaming\Malwarebytes
2014-01-05 13:55 . 2014-01-05 13:55 -------- d-----w- c:\programdata\Malwarebytes
2014-01-05 13:55 . 2013-04-04 13:50 25928 ----a-w- c:\windows\system32\drivers\mbam.sys
2014-01-05 01:22 . 2014-01-06 21:07 -------- d-----w- c:\users\Dustin\AppData\Local\ArmA 2 OA
2014-01-04 12:22 . 2014-01-04 12:22 -------- d-----w- c:\program files (x86)\SoftwareUpdater
2014-01-03 09:03 . 2014-01-03 09:03 -------- d-----w- c:\users\Dustin\AppData\Roaming\ASCOMP Software
2014-01-01 19:05 . 2014-01-01 19:05 -------- d-----w- c:\users\Dustin\AppData\Roaming\raidcall
2013-12-31 23:23 . 2013-12-31 23:23 -------- d-----w- c:\program files (x86)\BandiMPEG1
2013-12-29 19:17 . 2013-12-29 19:17 -------- d-----w- c:\windows\system32\IO
2013-12-21 10:16 . 2013-12-21 10:16 -------- d-----w- c:\users\Dustin\AppData\Local\SoftwareUpdater
2013-12-16 21:50 . 2013-12-16 21:50 -------- d-----w- c:\users\Dustin\AppData\Roaming\Telefónica
2013-12-16 21:50 . 2013-12-16 21:50 -------- d-----w- c:\users\Dustin\AppData\Roaming\TGCMLog
2013-12-16 21:50 . 2013-12-16 21:50 -------- d-----w- c:\program files\Option
2013-12-16 21:50 . 2012-01-11 09:32 123392 ----a-w- c:\windows\system32\drivers\ZTEusbgps.sys
2013-12-16 21:50 . 2013-12-16 21:50 -------- d-----w- c:\windows\massfilter
2013-12-16 16:45 . 2013-12-16 16:45 -------- d-----w- c:\programdata\Samsung
2013-12-16 12:24 . 2013-12-17 13:15 -------- d-----w- c:\windows\SysWow64\SupportAppPBHostless Modem
2013-12-16 12:24 . 2013-12-17 13:15 -------- d-----w- c:\program files (x86)\Hostless Modem
2013-12-11 13:29 . 2013-12-11 13:30 -------- d-----w- c:\users\Dustin\AppData\Local\PAYDAY 2 (Demo)
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-01-04 19:38 . 2012-11-21 19:48 291176 ----a-w- c:\windows\SysWow64\PnkBstrB.exe
2014-01-04 19:38 . 2010-01-13 13:10 291176 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr
2014-01-04 19:37 . 2012-11-21 19:48 291096 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0
2013-12-11 09:58 . 2012-08-02 13:09 29792 ----a-w- c:\windows\system32\drivers\klim6.sys
2013-12-11 09:58 . 2012-06-19 15:28 458336 ----a-w- c:\windows\system32\drivers\kl1.sys
2013-12-10 20:42 . 2012-10-18 11:41 71048 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2013-12-10 20:42 . 2012-10-18 11:41 692616 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-11-19 02:33 . 2009-11-13 19:05 267936 ----a-w- c:\windows\system32\MpSigStub.exe
2013-11-18 00:28 . 2013-12-01 23:25 10285968 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{C1A322A0-38E9-468C-BEA1-8E36213E7E29}\mpengine.dll
2013-11-07 15:00 . 2009-11-13 23:43 82896128 ----a-w- c:\windows\system32\MRT.exe
2013-10-27 08:12 . 2013-05-14 16:57 18286416 ----a-w- c:\windows\system32\nvwgf2umx.dll
2013-10-27 08:12 . 2013-05-14 16:57 15855568 ----a-w- c:\windows\SysWow64\nvwgf2um.dll
2013-10-27 08:12 . 2013-10-27 08:12 9480328 ----a-w- c:\windows\SysWow64\nvopencl.dll
2013-10-27 08:12 . 2013-10-27 08:12 11374520 ----a-w- c:\windows\system32\nvopencl.dll
2013-10-27 08:12 . 2013-10-27 08:12 30344480 ----a-w- c:\windows\system32\nvoglv64.dll
2013-10-27 08:12 . 2013-10-27 08:12 22933792 ----a-w- c:\windows\SysWow64\nvoglv32.dll
2013-10-27 08:12 . 2013-10-27 08:12 655136 ----a-w- c:\windows\system32\NvIFR64.dll
2013-10-27 08:12 . 2013-10-27 08:12 560416 ----a-w- c:\windows\SysWow64\NvIFR.dll
2013-10-27 08:12 . 2013-10-27 08:12 12572960 ----a-w- c:\windows\system32\drivers\nvlddmkm.sys
2013-10-27 08:12 . 2013-10-27 08:12 696096 ----a-w- c:\windows\system32\NvFBC64.dll
2013-10-27 08:12 . 2013-10-27 08:12 599840 ----a-w- c:\windows\SysWow64\NvFBC.dll
2013-10-27 08:12 . 2013-10-27 08:12 1884448 ----a-w- c:\windows\system32\nvdispco6433165.dll
2013-10-27 08:12 . 2013-10-27 08:12 18199872 ----a-w- c:\windows\system32\nvd3dumx.dll
2013-10-27 08:12 . 2013-10-27 08:12 1511712 ----a-w- c:\windows\system32\nvdispgenco6433165.dll
2013-10-27 08:12 . 2013-10-27 08:12 9524088 ----a-w- c:\windows\SysWow64\nvcuda.dll
2013-10-27 08:12 . 2013-10-27 08:12 3131680 ----a-w- c:\windows\system32\nvcuvid.dll
2013-10-27 08:12 . 2013-10-27 08:12 3124512 ----a-w- c:\windows\system32\nvcuvenc.dll
2013-10-27 08:12 . 2013-10-27 08:12 2946848 ----a-w- c:\windows\SysWow64\nvcuvid.dll
2013-10-27 08:12 . 2013-10-27 08:12 2747168 ----a-w- c:\windows\SysWow64\nvcuvenc.dll
2013-10-27 08:12 . 2013-10-27 08:12 11426568 ----a-w- c:\windows\system32\nvcuda.dll
2013-10-27 08:12 . 2013-02-25 22:32 15212336 ----a-w- c:\windows\SysWow64\nvd3dum.dll
2013-10-27 08:12 . 2013-10-27 08:12 25257248 ----a-w- c:\windows\system32\nvcompiler.dll
2013-10-27 08:12 . 2013-10-27 08:12 17560352 ----a-w- c:\windows\SysWow64\nvcompiler.dll
2013-10-27 08:12 . 2013-05-14 16:56 2695200 ----a-w- c:\windows\SysWow64\nvapi.dll
2013-10-27 08:12 . 2013-02-25 22:32 3067560 ----a-w- c:\windows\system32\nvapi64.dll
2013-10-23 08:20 . 2011-10-27 12:05 6669600 ----a-w- c:\windows\system32\nvcpl.dll
2013-10-23 08:20 . 2011-10-27 12:05 3489568 ----a-w- c:\windows\system32\nvsvc64.dll
2013-10-23 08:20 . 2011-10-27 12:05 219424 ----a-w- c:\windows\system32\nvmctray.dll
2013-10-23 08:20 . 2011-10-27 12:05 922912 ----a-w- c:\windows\system32\nvvsvc.exe
2013-10-23 08:20 . 2011-10-27 12:05 63776 ----a-w- c:\windows\system32\nvshext.dll
2013-10-23 08:20 . 2011-10-27 12:05 2559776 ----a-w- c:\windows\system32\nvsvcr.dll
2013-10-23 02:02 . 2013-10-23 02:02 589600 ----a-w- c:\windows\SysWow64\nvStreaming.exe
2013-10-20 07:50 . 2013-10-20 07:50 96168 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2013-10-12 22:59 . 2013-10-12 22:59 163504 ----a-w- c:\programdata\Microsoft\Windows\Sqm\Manifest\Sqm10145.bin
2013-10-12 08:45 . 2013-12-02 23:32 51712 ----a-w- c:\windows\system32\ie4uinit.exe
2013-10-12 08:45 . 2013-12-02 23:32 2241536 ----a-w- c:\windows\system32\wininet.dll
2013-10-12 08:45 . 2013-12-02 23:32 1364992 ----a-w- c:\windows\system32\urlmon.dll
2013-10-12 08:43 . 2013-12-02 23:32 19269632 ----a-w- c:\windows\system32\mshtml.dll
2013-10-12 08:43 . 2013-12-02 23:32 603136 ----a-w- c:\windows\system32\msfeeds.dll
2013-10-12 08:43 . 2013-12-02 23:32 855552 ----a-w- c:\windows\system32\jscript.dll
2013-10-12 08:43 . 2013-12-02 23:32 3959808 ----a-w- c:\windows\system32\jscript9.dll
2013-10-12 08:43 . 2013-12-02 23:32 53248 ----a-w- c:\windows\system32\jsproxy.dll
2013-10-12 08:43 . 2013-12-02 23:32 67072 ----a-w- c:\windows\system32\iesetup.dll
2013-10-12 08:43 . 2013-12-02 23:32 526336 ----a-w- c:\windows\system32\ieui.dll
2013-10-12 08:43 . 2013-12-02 23:32 39936 ----a-w- c:\windows\system32\iernonce.dll
2013-10-12 08:43 . 2013-12-02 23:32 136704 ----a-w- c:\windows\system32\iesysprep.dll
2013-10-12 08:43 . 2013-12-02 23:32 2648576 ----a-w- c:\windows\system32\iertutil.dll
2013-10-12 08:43 . 2013-12-02 23:32 15404544 ----a-w- c:\windows\system32\ieframe.dll
2013-10-12 07:03 . 2013-12-02 23:32 1767936 ----a-w- c:\windows\SysWow64\wininet.dll
2013-10-12 07:02 . 2013-12-02 23:32 2877952 ----a-w- c:\windows\SysWow64\jscript9.dll
2013-10-12 07:02 . 2013-12-02 23:32 61440 ----a-w- c:\windows\SysWow64\iesetup.dll
2013-10-12 07:02 . 2013-12-02 23:32 109056 ----a-w- c:\windows\SysWow64\iesysprep.dll
2013-10-12 06:35 . 2013-12-02 23:32 2706432 ----a-w- c:\windows\system32\mshtml.tlb
2013-10-12 06:08 . 2013-12-02 23:32 2706432 ----a-w- c:\windows\SysWow64\mshtml.tlb
2013-10-12 05:44 . 2013-12-02 23:32 89600 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2013-10-12 05:15 . 2013-12-02 23:32 71680 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2013-10-12 02:30 . 2013-12-02 22:57 830464 ----a-w- c:\windows\system32\nshwfp.dll
2013-10-12 02:29 . 2013-12-02 22:57 859648 ----a-w- c:\windows\system32\IKEEXT.DLL
2013-10-12 02:29 . 2013-12-02 22:57 324096 ----a-w- c:\windows\system32\FWPUCLNT.DLL
2013-10-12 02:03 . 2013-12-02 22:57 656896 ----a-w- c:\windows\SysWow64\nshwfp.dll
2013-10-12 02:01 . 2013-12-02 22:57 216576 ----a-w- c:\windows\SysWow64\FWPUCLNT.DLL
2013-10-11 20:48 . 2013-05-02 15:11 29280 ----a-w- c:\windows\system32\drivers\klmouflt.sys
2013-10-11 20:48 . 2013-05-02 15:11 29280 ----a-w- c:\windows\system32\drivers\klkbdflt.sys
2013-10-11 20:48 . 2013-07-31 07:38 626272 ----a-w- c:\windows\system32\drivers\klif.sys
2013-07-12 15:54 . 2013-07-12 15:54 9842040 ----a-w- c:\program files (x86)\Common Files\wruninstall.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Dustin\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Dustin\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 131248 ----a-w- c:\users\Dustin\AppData\Roaming\Dropbox\bin\DropboxExt.22.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"HP Officejet 4620 series (NET)"="c:\program files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe" [2011-12-18 2548072]
"Memory Cleaner"="c:\users\Dustin\AppData\Roaming\KoshyJohn.com\MemClean\MemClean.exe" [2013-02-03 791560]
"AdobeBridge"="e:\programme\Adobe\Adobe Bridge CS5\Bridge.exe" [2011-06-09 12002664]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2000-01-01 5299320]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-10-11 59280]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2013-04-04 958576]
"HP Software Update"="c:\program files (x86)\Hp\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]
"QuickTime Task"="e:\programme\QuickTime\QTTask.exe" [2013-05-01 421888]
"AVP"="c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe" [2013-10-11 356128]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2013-07-02 254336]
.
c:\users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Dustin\AppData\Roaming\Dropbox\bin\Dropbox.exe /systemstartup [2014-1-3 30714328]
Kaspersky Internet Security 2013.lnk - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\starter_avp.exe [2012-8-17 209336]
Tintenwarnungen überwachen - HP Officejet 4620 series (Netzwerk).lnk - c:\windows\system32\RunDll32.exe "c:\program files\HP\HP Officejet 4620 series\bin\HPStatusBL.dll",RunDLLEntry SERIALNUMBER=CN2BK242VZ05RT;CONNECTION=NW;MONITOR=1; [2009-7-14 45568]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
SpyderUtility.lnk - e:\programme\Spyder\Spyder4Elite\Utility\SpyderUtility.exe [2012-2-8 8241767]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
"ConsentPromptBehaviorAdmin"= 5 (0x5)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoEncryptOnMove"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
.
[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\policies\explorer]
"NoDevMgrUpdate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoEncryptOnMove"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
.
[HKEY_USERS\.default\software\microsoft\windows\currentversion\policies\explorer]
"DisableLocalMachineRun"= 0 (0x0)
"DisableLocalMachineRunOnce"= 0 (0x0)
"DisableCurrentUserRun"= 0 (0x0)
"DisableCurrentUserRunOnce"= 0 (0x0)
"NoFile"= 0 (0x0)
"HideClock"= 0 (0x0)
"NoDevMgrUpdate"= 0 (0x0)
"NoDFSTab"= 0 (0x0)
"NoEncryptOnMove"= 0 (0x0)
"NoResolveTrack"= 0 (0x0)
"NoStartMenuSubFolders"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring"=dword:00000001
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 Skype C2C Service;Skype C2C Service;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe;c:\programdata\Skype\Toolbars\Skype C2C Service\c2c_service.exe [x]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe;c:\program files (x86)\Skype\Updater\Updater.exe [x]
R3 dcscusb;Spyder3Print SR Spectrocolorimeter;c:\windows\system32\DRIVERS\dcscusb.sys;c:\windows\SYSNATIVE\DRIVERS\dcscusb.sys [x]
R3 hidkmdf;KMDF Driver;c:\windows\system32\DRIVERS\hidkmdf.sys;c:\windows\SYSNATIVE\DRIVERS\hidkmdf.sys [x]
R3 massfilter_hs;USB Mass Storage Filter Driver;c:\windows\system32\drivers\massfilter_hs.sys;c:\windows\SYSNATIVE\drivers\massfilter_hs.sys [x]
R3 PAC207;Trust 100K Series Webcam;c:\windows\system32\DRIVERS\PFC027.SYS;c:\windows\SYSNATIVE\DRIVERS\PFC027.SYS [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 Spyder4;Datacolor Spyder4;c:\windows\system32\DRIVERS\dccmtr.sys;c:\windows\SYSNATIVE\DRIVERS\dccmtr.sys [x]
R3 SWDUMon;SWDUMon;c:\windows\system32\DRIVERS\SWDUMon.sys;c:\windows\SYSNATIVE\DRIVERS\SWDUMon.sys [x]
R3 SwitchBoard;SwitchBoard;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe;c:\program files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 WacHidRouter;Wacom Hid Router;c:\windows\system32\DRIVERS\wachidrouter.sys;c:\windows\SYSNATIVE\DRIVERS\wachidrouter.sys [x]
R3 wacomrouterfilter;Wacom Router Filter Driver;c:\windows\system32\DRIVERS\wacomrouterfilter.sys;c:\windows\SYSNATIVE\DRIVERS\wacomrouterfilter.sys [x]
R3 WinRing0_1_2_0;WinRing0_1_2_0;e:\programme\RealTemp\WinRing0x64.sys;e:\programme\RealTemp\WinRing0x64.sys [x]
S1 KLIM6;Kaspersky Anti-Virus NDIS 6 Filter;c:\windows\system32\DRIVERS\klim6.sys;c:\windows\SYSNATIVE\DRIVERS\klim6.sys [x]
S1 kltdi;kltdi;c:\windows\system32\DRIVERS\kltdi.sys;c:\windows\SYSNATIVE\DRIVERS\kltdi.sys [x]
S1 kneps;kneps;c:\windows\system32\DRIVERS\kneps.sys;c:\windows\SYSNATIVE\DRIVERS\kneps.sys [x]
S2 GtDetectSc;GtDetectSc;c:\program files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe;c:\program files\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe [x]
S2 MBAMScheduler;MBAMScheduler;e:\programme\Malwarebytes' Anti-Malware\mbamscheduler.exe;e:\programme\Malwarebytes' Anti-Malware\mbamscheduler.exe [x]
S2 MBAMService;MBAMService;e:\programme\Malwarebytes' Anti-Malware\mbamservice.exe;e:\programme\Malwarebytes' Anti-Malware\mbamservice.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 VIAKaraokeService;VIA Karaoke digital mixer Service;c:\windows\system32\viakaraokesrv.exe;c:\windows\SYSNATIVE\viakaraokesrv.exe [x]
S2 WTabletServicePro;Wacom Professional Service;c:\program files\Tablet\Wacom\WTabletServicePro.exe;c:\program files\Tablet\Wacom\WTabletServicePro.exe [x]
S3 klkbdflt;Kaspersky Lab KLKBDFLT;c:\windows\system32\DRIVERS\klkbdflt.sys;c:\windows\SYSNATIVE\DRIVERS\klkbdflt.sys [x]
S3 klmouflt;Kaspersky Lab KLMOUFLT;c:\windows\system32\DRIVERS\klmouflt.sys;c:\windows\SYSNATIVE\DRIVERS\klmouflt.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys;c:\windows\SYSNATIVE\drivers\mbam.sys [x]
S3 pcouffin;VSO Software pcouffin;c:\windows\system32\Drivers\pcouffin.sys;c:\windows\SYSNATIVE\Drivers\pcouffin.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys;c:\windows\SYSNATIVE\DRIVERS\Rt64win7.sys [x]
S3 VIAHdAudAddService;VIA High Definition Audio Driver Service;c:\windows\system32\drivers\viahduaa.sys;c:\windows\SYSNATIVE\drivers\viahduaa.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-01-07 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-10-18 20:42]
.
2014-01-06 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3423161360-200612408-4252266538-1000Core.job
- c:\users\Dustin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-14 19:44]
.
2014-01-07 c:\windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3423161360-200612408-4252266538-1000UA.job
- c:\users\Dustin\AppData\Local\Google\Update\GoogleUpdate.exe [2011-12-14 19:44]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Dustin\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Dustin\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Dustin\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2013-09-10 23:54 164016 ----a-w- c:\users\Dustin\AppData\Roaming\Dropbox\bin\DropboxExt64.22.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"PAC207_Monitor"="c:\windows\PixArt\PAC207\Monitor.exe" [2007-12-10 323584]
"AdobeAAMUpdater-1.0"="c:\program files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe" [2010-03-06 500208]
"WrtMon.exe"="c:\windows\system32\spool\drivers\x64\3\WrtMon.exe" [2007-07-18 20480]
"HDAudDeck"="c:\program files (x86)\VIA\VIAudioi\VDeck\VDeck.exe" [2000-01-01 5299320]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = about:blank
uDefault_Search_URL = hxxp://www.google.com/ie
mStart Page = about:blank
mDefault_Page_URL = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Anti-Banner - c:\program files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm
IE: An vorhandene PDF-Datei anfügen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
IE: Download all with Free Download Manager - file://e:\programme\Free Download Manager\dlall.htm
IE: Download selected with Free Download Manager - file://e:\programme\Free Download Manager\dlselected.htm
IE: Download video with Free Download Manager - file://e:\programme\Free Download Manager\dlfvideo.htm
IE: Download with Free Download Manager - file://e:\programme\Free Download Manager\dllink.htm
IE: In Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
IE: Linkziel an vorhandene PDF-Datei anhängen - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
IE: Linkziel in Adobe PDF konvertieren - c:\program files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
IE: Nach Microsoft &Excel exportieren - e:\progra~1\Office\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\Dustin\AppData\Roaming\Mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - hxxps://www.google.de/
FF - ExtSQL: 2013-11-26 16:03; {fe272bd1-5f76-4ea4-8501-a05d35d823fc}; c:\users\Dustin\AppData\Roaming\Mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
FF - user.js: network.http.max-connections - 256
FF - user.js: network.http.max-connections-per-server - 48
FF - user.js: network.http.max-persistent-connections-per-proxy - 32
FF - user.js: network.http.max-persistent-connections-per-server - 18
.
.
------- Dateityp-Verknüpfung -------
.
inifile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1
JSEFile="%SystemRoot%\System32\WScript.exe" "%1" %*
txtfile=%SystemRoot%\SysWow64\NOTEPAD.EXE %1
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKCU-Run-EA Core - e:\programme\EA Games\EADM\Core.exe
Wow6432Node-HKCU-Run-Overwolf - c:\program files (x86)\Overwolf\Overwolf.exe
Wow6432Node-HKLM-Run-<NO NAME> - (no file)
HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start
AddRemove-PunkBusterSvc - c:\windows\system32\pbsvc_blr.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="FirefoxHTML"
.
[HKEY_USERS\S-1-5-21-3423161360-200612408-4252266538-1000\Software\SecuROM\License information*]
"datasecu"=hex:9b,78,c0,50,2c,5a,2a,69,73,f9,d1,59,2c,2c,3a,2a,3c,96,a8,75,c0,
ec,53,32,48,06,47,bc,9f,3a,71,5d,bd,cd,f4,88,df,06,67,f8,3a,f4,98,93,1f,21,\
"rkeysecu"=hex:b9,e4,ae,9e,53,55,e2,b0,51,fc,44,c7,9c,b5,8f,be
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_9_900_170_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_9_900_170.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2014-01-07 09:51:29
ComboFix-quarantined-files.txt 2014-01-07 08:51
.
Vor Suchlauf: 11 Verzeichnis(se), 21.311.848.448 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 21.181.931.520 Bytes frei
.
- - End Of File - - 5C27038C3DE6AB783452340E30F7571B
A36C5E4F47E84449FF07ED3517B43A31

Broni · Jan 7, 2014

Looks good.

Please download AdwCleaner by Xplode onto your desktop.

Close all open programs and internet browsers.
Double click on adwcleaner.exe to run the tool.
Click on Scan button.
When the scan has finished click on Clean button.
Your computer will be rebooted automatically. A text file will open after the restart.
Please post the contents of that logfile with your next reply.
You can find the logfile at C:\AdwCleaner[S1].txt as well.

Please download Junkware Removal Tool to your desktop.

Shut down your protection software now to avoid potential conflicts.
Run the tool by double-clicking it. If you are using Windows Vista, 7, or 8; instead of double-clicking, right-mouse click JRT.exe and select "Run as Administrator".
The tool will open and start scanning your system.
Please be patient as this can take a while to complete depending on your system's specifications.
On completion, a log (JRT.txt) is saved to your desktop and will automatically open.
Post the contents of JRT.txt into your next message.

Download OTL to your Desktop.
Alternate download: http://www.itxassociates.com/OT-Tools/OTL.exe

Double click on the icon to run it. Make sure all other windows are closed and to let it run uninterrupted.
Click the Scan All Users checkbox.
Click the Quick Scan button. Do not change any settings unless otherwise told to do so. The scan wont take long.
When the scan completes, it will open two notepad windows: OTL.txt and Extras.txt. These are saved in the same location as OTL.
Please copy (Edit->Select All, Edit->Copy) the contents of these files, one at a time, and post them back here.

-Z3RO- · Jan 8, 2014

The popup changed....
Either the antivirus softwear did something or (which I guess is more likely) they changed it and somehow it continues to get on my system

Here is the file...
Proceeding with the next steps now...

-Z3RO- · Jan 8, 2014

And here it goes....
The logs...

AdwCleaner[S0]
---------------------

# AdwCleaner v3.016 - Bericht erstellt am 08/01/2014 um 14:12:40
# Aktualisiert 23/12/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzername : Dustin - DUSTIN-PC
# Gestartet von : C:\Users\Dustin\Desktop\adwcleaner.exe
# Option : Löschen

***** [ Dienste ] *****

***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\eSafe
Ordner Gelöscht : C:\ProgramData\Premium
Ordner Gelöscht : C:\ProgramData\Tarma Installer
Ordner Gelöscht : C:\Program Files (x86)\Iminent
Ordner Gelöscht : C:\Program Files (x86)\MyPC Backup
Ordner Gelöscht : C:\Program Files (x86)\optimizer pro
Ordner Gelöscht : C:\Program Files (x86)\SoftwareUpdater
Ordner Gelöscht : C:\Program Files (x86)\Common Files\Software Update Utility
Ordner Gelöscht : C:\Program Files\SoftwareUpdater
Ordner Gelöscht : C:\Program Files\Web Assistant
Ordner Gelöscht : C:\Users\Dustin\AppData\Local\Ilivid Player
Ordner Gelöscht : C:\Users\Dustin\AppData\Local\jZip
Ordner Gelöscht : C:\Users\Dustin\AppData\Local\Software_Updater
Ordner Gelöscht : C:\Users\Dustin\AppData\Local\SoftwareUpdater
Ordner Gelöscht : C:\Users\Dustin\AppData\LocalLow\boost_interprocess
Ordner Gelöscht : C:\Users\Dustin\AppData\LocalLow\incredibar.com
Ordner Gelöscht : C:\Users\Dustin\AppData\Roaming\CheckPoint\ZoneAlarm LTD Toolbar
Ordner Gelöscht : C:\Users\Dustin\AppData\Roaming\DesktopIconForAmazon
Ordner Gelöscht : C:\Users\Dustin\AppData\Roaming\eIntaller
Ordner Gelöscht : C:\Users\Dustin\AppData\Roaming\OCS
Ordner Gelöscht : C:\Users\Dustin\AppData\Roaming\registry mechanic
Ordner Gelöscht : C:\Users\Dustin\AppData\Roaming\Systweak
Ordner Gelöscht : C:\Program Files (x86)\Mozilla Firefox\Extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1}
Ordner Gelöscht : C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj
Datei Gelöscht : C:\Windows\System32\roboot64.exe
Datei Gelöscht : C:\Users\Dustin\AppData\Roaming\Mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\searchplugins\MyStart Search.xml
Datei Gelöscht : C:\Users\Dustin\AppData\Roaming\Mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\user.js
Datei Gelöscht : C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Local Storage\chrome-extension_igdhbblpcellaljokkpfhcjlagemhgjl_0.localstorage
Datei Gelöscht : C:\Windows\System32\Tasks\FreeDriverScout
Datei Gelöscht : C:\Windows\System32\Tasks\Software Updater Ui
Datei Gelöscht : C:\Windows\System32\Tasks\Software Updater

***** [ Verknüpfungen ] *****

Verknüpfung Desinfiziert : C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EZ-RC\EZ-RC.lnk
Verknüpfung Desinfiziert : C:\Users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Internet Explorer.lnk
Verknüpfung Desinfiziert : C:\Users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Accessories\System Tools\Internet Explorer (No Add-ons).lnk
Verknüpfung Desinfiziert : C:\Users\Dustin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Google Chrome.lnk
Verknüpfung Desinfiziert : C:\Users\Dustin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Launch Internet Explorer Browser.lnk
Verknüpfung Desinfiziert : C:\Users\Dustin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk

***** [ Registrierungsdatenbank ] *****

Wert Gelöscht : [x64] HKLM\SOFTWARE\Mozilla\Firefox\Extensions [{336D0C35-8A85-403A-B9D2-65C292C39087}]
Wert Gelöscht : HKCU\Software\Mozilla\Firefox\Extensions [sparpilot@sparpilot.com]
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Google\Chrome\Extensions\dlnembnfbcpjnepmfjmngjenhhajpdfd
Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\jpnbdefcbnoefmmcpelplabbkfmfhlho
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\dnu.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\speedupmypc
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\askpartnercobrandingtool_rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\Iminent_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\incredibar_install_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\IncredibarToolbar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\WebCakeDesktop_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\MozillaPlugins\@checkpoint.com/FFApi
Schlüssel Gelöscht : HKLM\SYSTEM\CurrentControlSet\Services\Eventlog\Application\WsysSvc
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{608D3067-77E8-463D-9084-908966806826}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{6C259840-5BA8-46E6-8ED1-EF3BA47D8BA1}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{02054E11-5113-4BE3-8153-AA8DFB5D3761}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E1164984-B567-47BD-A7FF-240C2594404A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{22222222-2222-2222-2222-220022042235}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{33333333-3333-3333-3333-330033043335}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355345526}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066046635}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366346626}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077047735}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{2BF2028E-3F3C-4C05-AB45-B2F1DCFE0759}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{9C049BA6-EA47-4AC3-AED6-A66D8DC9E1D8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{DB538320-D3C5-433C-BCA9-C4081A054FCF}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Stats\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{0FB6A909-6086-458F-BD92-1F8EE10042A0}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3614D305-2DBB-4991-9297-750DD60FFC73}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{3B424109-6F99-4306-8F2B-0B2BB1C8C415}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{8C0EB0A9-265F-4D9D-AF96-0EF2403A73E8}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{9DF046E1-80F7-43E0-80C0-0AD696799C8F}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{D0FD0502-5878-441D-A3C0-9A4531C526CB}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{E3E46008-1902-41A7-91C7-26EC6E0B66D2}
Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{CFF4DB9B-135F-47C0-9269-B4C6572FD61A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{00000001-4FEF-40D3-B3FA-E0531B897F98}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\CLSID\{64697678-0000-0010-8000-00AA00389B71}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{021B4049-F57D-4565-A693-FD3B04786BFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0362AA09-808D-48E9-B360-FB51A8CBCE09}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{03E2A1F3-4402-4121-8B35-733216D61217}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{06844020-CD0B-3D3D-A7FE-371153013E49}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{0ADC01BB-303B-3F8E-93DA-12C140E85460}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{10D3722F-23E6-3901-B6C1-FF6567121920}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{1675E62B-F911-3B7B-A046-EB57261212F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{192929F2-9273-3894-91B0-F54671C4C861}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2932897E-3036-43D9-8A64-B06447992065}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{2DE92D29-A042-3C37-BFF8-07C7D8893EFA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{32B80AD6-1214-45F4-994E-78A5D482C000}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{3A8E103F-B2B7-3BEF-B3B0-88E29B2420E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{478CE5D3-D38E-3FFE-8DBE-8C4A0F1C4D8D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{48B7DA4E-69ED-39E3-BAD5-3E3EFF22CFB0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5982F405-44E4-3BBB-BAC4-CF8141CBBC5C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{5D8C3CC3-3C05-38A1-B244-924A23115FE9}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{641593AF-D9FD-30F7-B783-36E16F7A2E08}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{711FC48A-1356-3932-94D8-A8B733DBC7E4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{72227B7F-1F02-3560-95F5-592E68BACC0C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{7B5E8CE3-4722-4C0E-A236-A6FF731BEF37}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{890D4F59-5ED0-3CB4-8E0E-74A5A86E7ED0}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8C68913C-AC3C-4494-8B9C-984D87C85003}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{8D019513-083F-4AA5-933F-7D43A6DA82C4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{923F6FB8-A390-370E-A0D2-DD505432481D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9BBB26EF-B178-35D6-9D3D-B485F4279FE5}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{9E3B11F6-4179-4603-A71B-A55F4BCB0BEC}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A36867C6-302D-49FC-9D8E-1EB037B5F1AB}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A62DDBE0-8D2A-339A-B089-8CBCC5CD322A}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{A82AD04D-0B8E-3A49-947B-6A69A8A9C96D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ADEB3CC9-A05D-4FCC-BD09-9025456AA3EA}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{B06D4521-D09C-3F41-8E39-9D784CCA2A75}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C06DAD42-6F39-4CE1-83CC-9A8B9105E556}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{C2E799D0-43A5-3477-8A98-FC5F3677F35C}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D16107CD-2AD5-46A8-BA59-303B7C32C500}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D25B101F-8188-3B43-9D85-201F372BC205}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D2BA7595-5E44-3F1E-880F-03B3139FA5ED}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D35F5C81-17D9-3E1C-A1FC-4472542E1D25}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{D8FA96CA-B250-312C-AF34-4FF1DD72589D}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DAFC1E63-3359-416D-9BC2-E7DCA6F7B0F3}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{DC5E5C44-80FD-3697-9E65-9F286D92F3E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E1B4C9DE-D741-385F-981E-6745FACE6F01}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{E7B623F5-9715-3F9F-A671-D1485A39F8A2}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{ED916A7B-7C68-3198-B87D-2DABC30A5587}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{EFA1BDB2-BB3D-3D9A-8EB5-D0D22E0F64F4}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{F4CBF4DD-F8FE-35BA-BB7E-68304DAAB70B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{FC32005D-E27C-32E0-ADFA-152F598B75E7}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{55555555-5555-5555-5555-550355345526}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660066046635}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{66666666-6666-6666-6666-660366346626}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{77777777-7777-7777-7777-770077047735}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{33BB0A4E-99AF-4226-BDF6-49120163DE86}
Schlüssel Gelöscht : HKCU\Software\IM
Schlüssel Gelöscht : HKCU\Software\ImInstaller
Schlüssel Gelöscht : HKCU\Software\installedbrowserextensions
Schlüssel Gelöscht : HKCU\Software\jZip
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\Softonic
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\Software\eSafeSecControl
Schlüssel Gelöscht : HKLM\Software\SimplyGen
Schlüssel Gelöscht : HKLM\Software\systweak
Schlüssel Gelöscht : HKLM\Software\Uniblue
Schlüssel Gelöscht : HKLM\Software\Web Assistant
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Speedchecker Limited
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Web Assistant
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\ZoneAlarm LTD Toolbar

***** [ Browser ] *****

-\\ Internet Explorer v10.0.9200.16736

-\\ Mozilla Firefox v26.0 (de)

[ Datei : C:\Users\Dustin\AppData\Roaming\Mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\prefs.js ]

Zeile gelöscht : user_pref("extensions.crossrider.bic", "14154c08f3232a5b530031ef747fc680");

*************************

AdwCleaner[R0].txt - [19414 octets] - [08/01/2014 14:10:38]
AdwCleaner[S0].txt - [17936 octets] - [08/01/2014 14:12:40]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [17997 octets] ##########

-Z3RO- · Jan 8, 2014

JRT.txt
---------

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.1.0 (01.07.2014:1)
OS: Windows 7 Home Premium x64
Ran by Dustin on 08.01.2014 at 14:24:54,45
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

~~~ Services

~~~ Registry Values

~~~ Registry Keys

Successfully deleted: [Registry Key] HKEY_CLASSES_ROOT\CLSID\{FB684D26-01F4-4D9D-87CB-F486BEBA56DC}
Successfully deleted: [Registry Key] HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\InternetRegistry\REGISTRY\USER\S-1-5-21-3423161360-200612408-4252266538-1000\Software\web assistant

~~~ Files

Successfully deleted: [File] "C:\Users\Dustin\appdata\locallow\SkwConfig.bin"

~~~ Folders

Successfully deleted: [Folder] "C:\Users\Dustin\AppData\Roaming\getrighttogo"
Successfully deleted: [Folder] "C:\Users\Dustin\appdata\local\codec-v"
Successfully deleted: [Folder] "C:\Program Files (x86)\codec-v"

~~~ FireFox

Successfully deleted: [File] C:\user.js
Emptied folder: C:\Users\Dustin\AppData\Roaming\mozilla\firefox\profiles\12kgelzv.default-1380042919334\minidumps [46 files]

~~~ Event Viewer Logs were cleared

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 08.01.2014 at 14:43:02,21
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

-Z3RO- · Jan 8, 2014

OTL.txt (Part 1)
----------

OTL logfile created on: 08.01.2014 14:53:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Dustin\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16736)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,99 Gb Total Physical Memory | 2,36 Gb Available Physical Memory | 59,17% Memory free
7,98 Gb Paging File | 5,94 Gb Available in Paging File | 74,42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,56 Gb Total Space | 19,51 Gb Free Space | 19,99% Space Free | Partition Type: NTFS
Drive D: | 0,38 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 600,98 Gb Total Space | 340,60 Gb Free Space | 56,67% Space Free | Partition Type: NTFS
Drive F: | 931,51 Gb Total Space | 391,94 Gb Free Space | 42,08% Space Free | Partition Type: NTFS
Computer Name: DUSTIN-PC | User Name: Dustin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Processes (SafeList) ==========
PRC - File not found --
PRC - [2014.01.08 14:51:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Dustin\Desktop\OTL.exe
PRC - [2014.01.03 01:46:10 | 030,714,328 | ---- | M] (Dropbox, Inc.) -- C:\Users\Dustin\AppData\Roaming\Dropbox\bin\Dropbox.exe
PRC - [2013.10.27 09:12:26 | 001,364,256 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2013.10.23 03:02:32 | 000,414,496 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2013.10.11 21:45:39 | 000,356,128 | ---- | M] (Kaspersky Lab ZAO) -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe
PRC - [2013.07.05 12:32:01 | 000,076,888 | ---- | M] () -- C:\Windows\SysWOW64\PnkBstrA.exe
PRC - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) -- E:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2013.04.04 14:50:32 | 000,532,040 | ---- | M] (Malwarebytes Corporation) -- E:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe
PRC - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) -- E:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe
PRC - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2012.10.09 00:15:51 | 000,039,808 | ---- | M] (Wacom Technology) -- C:\Programme\Tablet\Wacom\WacomHost.exe
PRC - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe
PRC - [2012.02.08 13:11:24 | 008,241,767 | ---- | M] ( ) -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility.exe
PRC - [2011.06.09 22:52:40 | 012,002,664 | ---- | M] (Adobe Systems, Inc.) -- E:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe
PRC - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe
PRC - [2007.12.10 14:55:26 | 000,323,584 | ---- | M] (PixArt Imaging Incorporation) -- C:\Windows\PixArt\PAC207\Monitor.exe
PRC - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () -- C:\Windows\SysWOW64\PSIService.exe
========== Modules (No Company Name) ==========
MOD - [2014.01.03 01:45:04 | 003,558,400 | ---- | M] () -- C:\Users\Dustin\AppData\Roaming\Dropbox\bin\wxmsw28uh_vc.dll
MOD - [2013.10.19 00:55:02 | 025,100,288 | ---- | M] () -- C:\Users\Dustin\AppData\Roaming\Dropbox\bin\libcef.dll
MOD - [2012.08.17 20:38:56 | 000,479,160 | ---- | M] () -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\dblite.dll
MOD - [2012.02.07 13:59:26 | 012,977,947 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\RBScript.dll
MOD - [2012.02.07 13:59:26 | 000,761,856 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\XML.dll
MOD - [2012.02.07 13:59:26 | 000,274,432 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\CGamma.dll
MOD - [2012.02.07 13:59:26 | 000,098,304 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\Shell.dll
MOD - [2012.02.07 13:59:26 | 000,086,016 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\CSensor.dll
MOD - [2012.02.07 13:59:26 | 000,039,936 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\MBSRegistrationPlugin16724.dll
MOD - [2012.02.07 13:59:26 | 000,025,600 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\MBSPluginVersionPlugin16724.dll
MOD - [2012.02.07 13:59:25 | 000,151,552 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\RegEx.dll
MOD - [2012.02.07 13:59:25 | 000,139,264 | ---- | M] () -- E:\Programme\Spyder\Spyder4Elite\Utility\SpyderUtility Libs\Appearance Pak.dll
MOD - [2011.06.24 21:56:36 | 000,087,328 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
MOD - [2011.06.24 21:56:14 | 001,241,888 | ---- | M] () -- C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
MOD - [2011.06.09 22:52:42 | 002,748,416 | ---- | M] () -- E:\Programme\Adobe\Adobe Bridge CS5\libmysqld.dll
MOD - [2011.06.09 22:52:42 | 000,073,728 | ---- | M] () -- E:\Programme\Adobe\Adobe Bridge CS5\Symlib.dll
========== Services (SafeList) ==========
SRV:64bit: - [2000.01.01 01:00:00 | 000,027,768 | ---- | M] (VIA Technologies, Inc.) [Auto | Running] -- C:\Windows\SysNative\ViakaraokeSrv.exe -- (VIAKaraokeService)
SRV - [2014.01.06 22:52:16 | 000,569,768 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2013.12.11 13:18:38 | 000,119,408 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2013.12.10 21:42:34 | 000,257,416 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2013.10.27 09:12:26 | 001,364,256 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2013.10.23 03:02:32 | 000,414,496 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2013.10.11 21:45:39 | 000,356,128 | ---- | M] (Kaspersky Lab ZAO) [Auto | Running] -- C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe -- (AVP)
SRV - [2013.10.04 01:00:24 | 000,621,336 | ---- | M] (Wacom Technology, Corp.) [Auto | Running] -- C:\Programme\Tablet\Wacom\WTabletServicePro.exe -- (WTabletServicePro)
SRV - [2013.09.05 09:34:30 | 000,171,680 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2013.07.05 12:32:01 | 000,076,888 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PnkBstrA.exe -- (PnkBstrA)
SRV - [2013.04.04 14:50:32 | 000,701,512 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- E:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2013.04.04 14:50:32 | 000,418,376 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- E:\Programme\Malwarebytes' Anti-Malware\mbamscheduler.exe -- (MBAMScheduler)
SRV - [2012.12.18 20:08:28 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2012.10.02 12:13:44 | 003,064,000 | ---- | M] (Skype Technologies S.A.) [Auto | Running] -- C:\ProgramData\Skype\Toolbars\Skype C2C Service\c2c_service.exe -- (Skype C2C Service)
SRV - [2011.01.19 14:03:54 | 000,651,720 | ---- | M] (Macrovision Europe Ltd.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2010.03.18 13:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010.02.19 13:37:14 | 000,517,096 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Adobe\SwitchBoard\SwitchBoard.exe -- (SwitchBoard)
SRV - [2009.08.18 12:48:02 | 002,291,568 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE -- (wlidsvc)
SRV - [2009.06.10 22:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2009.05.04 15:47:36 | 000,809,984 | ---- | M] (OptionNV) [Auto | Running] -- C:\Programme\Option\Option WWAN Driver 5.0.32.0 Installer\GtDetectSc.exe -- (GtDetectSc)
SRV - [2007.06.05 13:20:32 | 000,177,704 | ---- | M] () [Auto | Running] -- C:\Windows\SysWOW64\PSIService.exe -- (ProtexisLicensing)
========== Driver Services (SafeList) ==========
DRV:64bit: - [2013.12.11 10:58:58 | 000,029,792 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\klim6.sys -- (KLIM6)
DRV:64bit: - [2013.12.11 10:58:57 | 000,458,336 | ---- | M] (Kaspersky Lab ZAO) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kl1.sys -- (kl1)
DRV:64bit: - [2013.10.11 21:48:07 | 000,029,280 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klmouflt.sys -- (klmouflt)
DRV:64bit: - [2013.10.11 21:48:07 | 000,029,280 | ---- | M] (Kaspersky Lab ZAO) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\klkbdflt.sys -- (klkbdflt)
DRV:64bit: - [2013.10.11 21:48:06 | 000,626,272 | ---- | M] (Kaspersky Lab ZAO) [File_System | System | Running] -- C:\Windows\SysNative\drivers\klif.sys -- (KLIF)
DRV:64bit: - [2013.09.18 23:12:14 | 000,089,912 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wachidrouter.sys -- (WacHidRouter)
DRV:64bit: - [2013.09.18 23:12:14 | 000,015,160 | ---- | M] (Wacom Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\wacomrouterfilter.sys -- (wacomrouterfilter)
DRV:64bit: - [2013.09.18 23:12:14 | 000,014,136 | ---- | M] (Windows (R) Win 7 DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hidkmdf.sys -- (hidkmdf)
DRV:64bit: - [2013.07.31 09:06:00 | 000,054,368 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kltdi.sys -- (kltdi)
DRV:64bit: - [2013.07.02 10:48:44 | 000,016,152 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\SWDUMon.sys -- (SWDUMon)
DRV:64bit: - [2013.05.02 16:11:42 | 000,178,448 | ---- | M] (Kaspersky Lab ZAO) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\kneps.sys -- (kneps)
DRV:64bit: - [2013.04.04 14:50:32 | 000,025,928 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2013.03.04 14:35:08 | 000,838,216 | ---- | M] (Realtek ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV:64bit: - [2013.02.12 05:12:06 | 000,019,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\usb8023x.sys -- (usb_rndisx)
DRV:64bit: - [2012.09.17 14:05:26 | 000,123,704 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\jraid.sys -- (JRAID)
DRV:64bit: - [2012.08.23 15:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)
DRV:64bit: - [2012.08.23 15:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2012.03.01 07:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.08.22 10:58:30 | 000,082,816 | ---- | M] (VSO Software) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\pcouffin.sys -- (pcouffin)
DRV:64bit: - [2011.06.02 14:56:52 | 000,015,360 | ---- | M] (Datacolor) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dccmtr.sys -- (Spyder4)
DRV:64bit: - [2011.03.11 07:41:14 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 07:41:14 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 14:33:36 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2009.07.16 10:38:40 | 000,015,416 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\ASACPI.sys -- (MTsensor)
DRV:64bit: - [2009.07.14 02:52:22 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 02:48:06 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 02:45:56 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 01:35:34 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 21:34:34 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 21:34:30 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 21:34:24 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 21:32:00 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.05.21 14:03:52 | 000,014,848 | ---- | M] (Datacolor) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\dcscusb.sys -- (dcscusb)
DRV:64bit: - [2008.06.27 07:51:10 | 000,088,632 | ---- | M] (Adobe Systems, Inc.) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\adfs.sys -- (adfs)
DRV:64bit: - [2008.02.13 12:17:10 | 000,686,592 | ---- | M] (PixArt Imaging Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\PFC027.SYS -- (PAC207)
DRV:64bit: - [2000.01.01 01:00:00 | 002,206,864 | ---- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2010.01.01 15:13:32 | 000,014,544 | ---- | M] (OpenLibSys.org) [Kernel | On_Demand | Stopped] -- E:\Programme\RealTemp\WinRing0x64.sys -- (WinRing0_1_2_0)
DRV - [2009.07.14 02:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
========== Standard Registry (SafeList) ==========
========== Internet Explorer ==========
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {33BB0A4E-99AF-4226-BDF6-49120163DE86}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = http://www.google.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKLM\..\SearchScopes,DefaultScope =
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKU\.DEFAULT\..\SearchScopes,DefaultScope =
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-18\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-19\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-20\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = D2 7C CC 3E 8F E5 CB 01 [binary data]
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Internet Explorer\Search,Default_Search_URL = http://www.google.com/ie
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Internet Explorer\Search,SearchAssistant = http://www.google.com/ie
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\..\SearchScopes,DefaultScope =
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\..\SearchScopes\{460782F1-5C6C-4046-AC59-4A02B05AD3DD}: "URL" = http://www.google.com/search?q={searchTerms}&sourceid=ie7&rls=com.microsoft:en-US&ie=utf8&oe=utf8
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = http://www.google.com/search?q={searc
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKU\S-1-5-21-3423161360-200612408-4252266538-1004\..\SearchScopes,DefaultScope =
========== FireFox ==========
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "https://www.google.de/"
FF - prefs.js..extensions.enabledAddons: anti_banner%40kaspersky.com:13.0.1.4372
FF - prefs.js..extensions.enabledAddons: ich%40maltegoetz.de:1.5.5
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:26.0
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.3: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_9_900_170.dll ()
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX VOD Helper,version=1.0.0: C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.45.2: C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\5.1.20913.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@raidcall.en/RCplugin: C:\Users\Dustin\AppData\Roaming\raidcall\plugins\nprcplugin.dll (Raidcall)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wacom-plugin,version=1.1.0.10: C:\Program Files (x86)\TabletPlugins\npwacom.dll (Wacom, Inc.)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.0.0.3: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\@wacom.com/wtPlugin,version=2.1.0.3: C:\Program Files (x86)\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKLM\Software\MozillaPlugins\Adobe Acrobat: E:\Programme\Adobe\Acrobat 9 Pro\Acrobat\Air\nppdf32.dll (Adobe Systems Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Users\Dustin\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Users\Dustin\AppData\Local\Google\Update\1.3.22.3\npGoogleUpdate3.dll (Google Inc.)
FF - HKCU\Software\MozillaPlugins\wacom.com/WacomTabletPlugin: C:\Program Files\TabletPlugins\npWacomTabletPlugin.dll (Wacom)
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{23fcfd51-4958-4f00-80a3-ae97e717ed8b}: C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\DivXHTML5 [2012.02.21 21:46:06 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{FFB96CC1-7EB3-449D-B827-DB661701C6BB}: C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\url_advisor@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\url_advisor@kaspersky.com [2013.12.11 10:59:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\virtual_keyboard@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\virtual_keyboard@kaspersky.com [2013.12.11 10:59:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\content_blocker@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\content_blocker@kaspersky.com [2013.12.11 10:59:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\anti_banner@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\anti_banner@kaspersky.com [2013.12.11 10:59:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\online_banking@kaspersky.com: C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\FFExt\online_banking@kaspersky.com [2013.12.11 10:59:00 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.12.11 13:18:32 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.12.29 21:06:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Components: E:\Programme\Mozilla-Thunderbird\components [2013.12.11 11:42:37 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 17.0.5\extensions\\Plugins: E:\Programme\Mozilla-Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 26.0\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2013.12.11 13:18:32 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 26.0\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins [2013.12.29 21:06:42 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 24.2.0\extensions\\Components: E:\Programme\Mozilla-Thunderbird\components [2013.12.11 11:42:37 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Thunderbird 24.2.0\extensions\\Plugins: E:\Programme\Mozilla-Thunderbird\plugins
[2009.11.13 22:46:32 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dustin\AppData\Roaming\mozilla\Extensions
[2014.01.03 22:42:25 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Dustin\AppData\Roaming\mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\extensions
[2013.12.12 10:55:31 | 000,000,000 | ---D | M] (ProxTube - Unblock YouTube) -- C:\Users\Dustin\AppData\Roaming\mozilla\Firefox\Profiles\12kgelzv.default-1380042919334\extensions\ich@maltegoetz.de
[2013.12.30 14:19:40 | 000,041,640 | ---- | M] () (No name found) -- C:\Users\Dustin\AppData\Roaming\mozilla\firefox\profiles\12kgelzv.default-1380042919334\extensions\{6BB5760D-F97E-421B-AF5B-8457A90C3CED}.xpi
[2014.01.03 22:42:25 | 000,555,162 | ---- | M] () (No name found) -- C:\Users\Dustin\AppData\Roaming\mozilla\firefox\profiles\12kgelzv.default-1380042919334\extensions\{fe272bd1-5f76-4ea4-8501-a05d35d823fc}.xpi
[2013.12.11 13:18:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions
[2013.12.11 13:18:34 | 000,000,000 | ---D | M] (Skype Click to Call) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{82AF8DCA-6DE9-405D-BD5E-43525BDAD38A}
[2013.12.11 13:18:34 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\extensions\{AB2CE124-6272-4b12-94A9-7303C7397BD1}
[2013.12.11 13:18:32 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak
[2013.12.11 13:18:32 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\Program Files (x86)\Mozilla Firefox\extensions\KavAntiBanner@kaspersky.ru_bak2
[2013.12.11 13:18:33 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak
[2013.12.11 13:18:33 | 000,000,000 | ---D | M] (Modul zur Link-Untersuchung) -- C:\Program Files (x86)\Mozilla Firefox\extensions\linkfilter@kaspersky.ru_bak2
[2013.12.11 13:18:32 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions
[2013.12.11 13:18:37 | 000,000,000 | ---D | M] (Default) -- C:\Program Files (x86)\Mozilla Firefox\browser\extensions\{972ce4c6-7e08-4474-a285-3208198ce6fd}
[2013.12.11 10:59:00 | 000,000,000 | ---D | M] (Anti-Banner) -- C:\PROGRAM FILES (X86)\KASPERSKY LAB\KASPERSKY INTERNET SECURITY 2013\FFEXT\ANTI_BANNER@KASPERSKY.COM
[2012.06.28 16:42:00 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files (x86)\mozilla firefox\plugins\npwachk.dll
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\dchlnpcodkpfdpacogkljefecpegganj\13.0.1.4190_0\
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hakdifolhalapjijoafobooafbilfakh\13.0.1.4190_0\
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\hghkgaeecgjhjkannahfamoehjmkjail\13.0.1.4190_0\
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\jagncdcchgajhfhijbbhecadmaiegcmh\13.0.1.4292_0\
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\lifbcibllhkdhoafpjfnlhfpfgnpldfl\6.3.0.11079_0\
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.4.11_0\
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda\0.0.5.0_0\
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nneajnkjbffgblleaoojgaacokifdkhm\2.1.2.145_0\
CHR - Extension: No name found = C:\Users\Dustin\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjldcfjmnllhmgjclecdnfampinooman\13.0.1.4190_0\
O1 HOSTS File: ([2014.01.07 09:41:20 | 000,000,027 | ---- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1 localhost
O2:64bit: - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corporation)
O2:64bit: - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2:64bit: - BHO: (Webroot Vault) - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\pkg\LPBar64.dll File not found
O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2:64bit: - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (DivX Plus Web Player HTML5 <video>) - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll (DivX, LLC)
O2 - BHO: (Content Blocker Plugin) - {5564CC73-EFA7-4CBF-918A-5CF7FBBFFF4F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\ContentBlocker\ie_content_blocker_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Virtual Keyboard Plugin) - {73455575-E40C-433C-9784-C78DC7761455} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Safe Money Plugin) - {9E6D0D23-3D72-4A94-AE1F-2D167624E3D9} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\OnlineBanking\online_banking_bho.dll (Kaspersky Lab ZAO)
O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O2 - BHO: (Free Download Manager) - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Programme\Free Download Manager\iefdm2.dll (FreeDownloadManager.ORG)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O2 - BHO: (URL Advisor Plugin) - {E33CF602-D945-461A-83F0-819F76A199F8} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O2 - BHO: (SmartSelect Class) - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O3 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [AdobeAAMUpdater-1.0] C:\Program Files (x86)\Common Files\Adobe\OOBE\PDApp\UWA\UpdaterStartupUtility.exe (Adobe Systems Incorporated)
O4:64bit: - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4:64bit: - HKLM..\Run: [PAC207_Monitor] C:\Windows\PixArt\PAC207\Monitor.exe (PixArt Imaging Incorporation)
O4:64bit: - HKLM..\Run: [WrtMon.exe] C:\Windows\SysNative\spool\drivers\x64\3\WrtMon.exe ()
O4 - HKLM..\Run: [] File not found
O4 - HKLM..\Run: [APSDaemon] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe (Apple Inc.)
O4 - HKLM..\Run: [AVP] C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\avp.exe (Kaspersky Lab ZAO)
O4 - HKLM..\Run: [HDAudDeck] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe (VIA)
O4 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000..\Run: [AdobeBridge] E:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe (Adobe Systems, Inc.)
O4 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000..\Run: [HP Officejet 4620 series (NET)] C:\Program Files\HP\HP Officejet 4620 series\Bin\ScanToPCActivationApp.exe (Hewlett-Packard Co.)
O4 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000..\Run: [Memory Cleaner] C:\Users\Dustin\AppData\Roaming\KoshyJohn.com\MemClean\MemClean.exe (KoshyJohn.com)
O4 - HKU\S-1-5-21-3423161360-200612408-4252266538-1004..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-3423161360-200612408-4252266538-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk = C:\Users\Dustin\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
O4 - Startup: C:\Users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Kaspersky Internet Security 2013.lnk = C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\starter_avp.exe (Kaspersky Lab ZAO)
O4 - Startup: C:\Users\UpdatusUser.Dustin-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uninstall Webroot RunOnce.lnk = C:\Program Files (x86)\Common Files\wruninstall.exe (Webroot Software, Inc.)
O6 - HKLM\Software\Policies\Microsoft\Internet Explorer\Restrictions present
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 60
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O7 - HKU\.DEFAULT\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\.DEFAULT\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-18\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0

-Z3RO- · Jan 8, 2014

OTL.txt (Part 2)
--------------------

O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-18\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-19\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKU\S-1-5-19\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O7 - HKU\S-1-5-20\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewOnDrive = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoControlPanel = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRun = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableLocalMachineRunOnce = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRun = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: DisableCurrentUserRunOnce = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoViewContextMenu = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoShellSearchButton = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFind = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoFile = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HideClock = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayContextMenu = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoTrayItemsDisplay = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetFolders = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoClose = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSetTaskbar = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDeletePrinter = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoChangeStartMenu = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLogoff = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: StartMenuLogoff = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWindowsUpdate = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoSaveSettings = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoStartMenuSubFolders = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDesktop = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispAppearancePage = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispBackgroundPage = 0
O7 - HKU\S-1-5-20\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoDispSettingsPage = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoLowDiskSpaceChecks = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDevMgrUpdate = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDFSTab = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoEncryptOnMove = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRunasInstallPrompt = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveSearch = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoResolveTrack = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoHardwareTab = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDrives = 0
O7 - HKU\S-1-5-21-3423161360-200612408-4252266538-1004\Software\Policies\Microsoft\Internet Explorer\Control Panel present
O8:64bit: - Extra context menu item: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm ()
O8:64bit: - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Download all with Free Download Manager - E:\Programme\Free Download Manager\dlall.htm ()
O8:64bit: - Extra context menu item: Download selected with Free Download Manager - E:\Programme\Free Download Manager\dlselected.htm ()
O8:64bit: - Extra context menu item: Download video with Free Download Manager - E:\Programme\Free Download Manager\dlfvideo.htm ()
O8:64bit: - Extra context menu item: Download with Free Download Manager - E:\Programme\Free Download Manager\dllink.htm ()
O8:64bit: - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\Office\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Add to Anti-Banner - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\ie_banner_deny.htm ()
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Download all with Free Download Manager - E:\Programme\Free Download Manager\dlall.htm ()
O8 - Extra context menu item: Download selected with Free Download Manager - E:\Programme\Free Download Manager\dlselected.htm ()
O8 - Extra context menu item: Download video with Free Download Manager - E:\Programme\Free Download Manager\dlfvideo.htm ()
O8 - Extra context menu item: Download with Free Download Manager - E:\Programme\Free Download Manager\dllink.htm ()
O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll (Adobe Systems Incorporated)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\Office\Office10\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Virtual Keyboard - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9:64bit: - Extra Button: Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\pkg\LPBar64.dll File not found
O9:64bit: - Extra 'Tools' menuitem : Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\pkg\LPBar64.dll File not found
O9:64bit: - Extra Button: URLs check - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\x64\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Virtual Keyboard - {0C4CC089-D306-440D-9772-464E226F6539} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\VirtualKeyboard\ie_virtual_keyboard_plugin.dll (Kaspersky Lab ZAO)
O9 - Extra Button: Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - Reg Error: Key error. File not found
O9 - Extra Button: URLs check - {CCF151D8-D089-449F-A5A4-D9909053F20F} - C:\Program Files (x86)\Kaspersky Lab\Kaspersky Internet Security 2013\IEExt\UrlAdvisor\klwtbbho.dll (Kaspersky Lab ZAO)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000005 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O10:64bit: - NameSpace_Catalog5\Catalog_Entries64\000000000006 [] - C:\Programme\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL (Microsoft Corporation)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F408E428-6443-414B-B70B-740C91CB7122}: DhcpNameServer = 192.168.1.1
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files (x86)\Common Files\Skype\Skype4COM.dll (Skype Technologies)
O20:64bit: - HKLM Winlogon: Shell - (Explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysWOW64\userinit.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29:64bit: - HKLM SecurityProviders - (msapsspc.dll) - File not found
O29:64bit: - HKLM SecurityProviders - (digest.dll) - File not found
O29:64bit: - HKLM SecurityProviders - (msnsspc.dll) - File not found
O29 - HKLM SecurityProviders - (msapsspc.dll) - File not found
O29 - HKLM SecurityProviders - (digest.dll) - File not found
O29 - HKLM SecurityProviders - (msnsspc.dll) - File not found
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.04.29 10:02:01 | 000,000,055 | R--- | M] () - D:\autorun.inf -- [ CDFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = ComFile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = ComFile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKU\.DEFAULT\...exe [@ = exefile] -- "%1" %*
O37 - HKU\S-1-5-18\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
========== Files/Folders - Created Within 30 Days ==========
[2014.01.08 14:51:31 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\Dustin\Desktop\OTL.exe
[2014.01.08 14:24:51 | 000,000,000 | ---D | C] -- C:\Windows\ERUNT
[2014.01.08 14:23:00 | 001,037,068 | ---- | C] (Thisisu) -- C:\Users\Dustin\Desktop\JRT.exe
[2014.01.08 14:10:32 | 000,000,000 | ---D | C] -- C:\AdwCleaner
[2014.01.07 18:02:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Bohemia Interactive Studio
[2014.01.07 09:52:21 | 000,000,000 | -HSD | C] -- C:\$RECYCLE.BIN
[2014.01.07 09:52:05 | 000,000,000 | ---D | C] -- C:\Windows\temp
[2014.01.07 09:27:04 | 000,518,144 | ---- | C] (SteelWerX) -- C:\Windows\SWREG.exe
[2014.01.07 09:27:04 | 000,406,528 | ---- | C] (SteelWerX) -- C:\Windows\SWSC.exe
[2014.01.07 09:27:04 | 000,060,416 | ---- | C] (NirSoft) -- C:\Windows\NIRCMD.exe
[2014.01.07 09:26:57 | 000,000,000 | ---D | C] -- C:\Qoobox
[2014.01.07 09:26:40 | 000,000,000 | ---D | C] -- C:\Windows\erdnt
[2014.01.07 09:25:06 | 005,160,001 | R--- | C] (Swearware) -- C:\Users\Dustin\Desktop\ComboFix.exe
[2014.01.06 18:17:47 | 001,937,144 | ---- | C] (Bleeping Computer, LLC) -- C:\Users\Dustin\Desktop\iExplore.exe
[2014.01.06 17:36:24 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes' Anti-Malware (portable)
[2014.01.06 17:36:23 | 000,117,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014.01.06 17:34:36 | 000,089,304 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014.01.06 17:34:33 | 000,000,000 | ---D | C] -- C:\Users\Dustin\Desktop\mbar
[2014.01.06 17:33:28 | 012,582,688 | ---- | C] (Malwarebytes Corp.) -- C:\Users\Dustin\Desktop\mbar-1.07.0.1008.exe
[2014.01.05 14:59:11 | 000,688,992 | R--- | C] (Swearware) -- C:\Users\Dustin\Desktop\dds.com
[2014.01.05 14:56:22 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Roaming\Malwarebytes
[2014.01.05 14:55:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2014.01.05 14:55:38 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2014.01.05 14:55:37 | 000,025,928 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2014.01.05 02:22:11 | 000,000,000 | ---D | C] -- C:\Users\Dustin\Documents\ArmA 2
[2014.01.05 02:22:10 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Local\ArmA 2 OA
[2014.01.05 02:21:58 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Bohemia Interactive
[2014.01.03 10:03:43 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Roaming\ASCOMP Software
[2014.01.03 10:03:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ASCOMP Software
[2014.01.01 20:05:21 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Roaming\raidcall
[2014.01.01 20:05:05 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\RaidCall
[2014.01.01 20:05:05 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\RaidCall
[2014.01.01 00:23:46 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\BandiMPEG1
[2013.12.29 20:17:03 | 000,000,000 | ---D | C] -- C:\Windows\SysNative\IO
[2013.12.16 22:50:57 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Roaming\Telefónica
[2013.12.16 22:50:56 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Roaming\TGCMLog
[2013.12.16 22:50:47 | 000,000,000 | ---D | C] -- C:\Program Files\Option
[2013.12.16 22:50:26 | 000,123,392 | ---- | C] (ZTE Incorporated) -- C:\Windows\SysNative\drivers\ZTEusbgps.sys
[2013.12.16 22:50:22 | 000,000,000 | ---D | C] -- C:\Windows\massfilter
[2013.12.16 17:45:22 | 000,000,000 | ---D | C] -- C:\ProgramData\Samsung
[2013.12.16 13:24:48 | 000,000,000 | ---D | C] -- C:\Windows\SysWow64\SupportAppPBHostless Modem
[2013.12.16 13:24:45 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Hostless Modem
[2013.12.12 10:48:22 | 000,000,000 | ---D | C] -- C:\Users\Dustin\Desktop\Tieckstr
[2013.12.11 14:29:28 | 000,000,000 | ---D | C] -- C:\Users\Dustin\AppData\Local\PAYDAY 2 (Demo)
[2013.12.11 13:18:32 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox
[2013.07.12 16:54:01 | 009,842,040 | ---- | C] (Webroot Software, Inc.) -- C:\Program Files (x86)\Common Files\wruninstall.exe
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
========== Files - Modified Within 30 Days ==========
[2014.01.08 14:51:31 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\Dustin\Desktop\OTL.exe
[2014.01.08 14:42:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job
[2014.01.08 14:28:38 | 000,001,124 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3423161360-200612408-4252266538-1000UA.job
[2014.01.08 14:24:22 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2014.01.08 14:24:22 | 000,014,800 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2014.01.08 14:23:01 | 001,037,068 | ---- | M] (Thisisu) -- C:\Users\Dustin\Desktop\JRT.exe
[2014.01.08 14:17:16 | 000,001,946 | ---- | M] () -- C:\Users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Tintenwarnungen überwachen - HP Officejet 4620 series (Netzwerk).lnk
[2014.01.08 14:16:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2014.01.08 14:16:22 | 3214,188,544 | -HS- | M] () -- C:\hiberfil.sys
[2014.01.08 14:06:43 | 000,034,516 | ---- | M] () -- C:\Users\Dustin\Desktop\freemium2.PNG
[2014.01.08 14:04:30 | 001,233,962 | ---- | M] () -- C:\Users\Dustin\Desktop\adwcleaner.exe
[2014.01.07 22:32:17 | 000,298,280 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.xtr
[2014.01.07 22:32:17 | 000,298,280 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2014.01.07 18:28:06 | 000,001,072 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskUserS-1-5-21-3423161360-200612408-4252266538-1000Core.job
[2014.01.07 09:41:20 | 000,000,027 | ---- | M] () -- C:\Windows\SysNative\drivers\etc\hosts
[2014.01.07 09:24:52 | 005,160,001 | R--- | M] (Swearware) -- C:\Users\Dustin\Desktop\ComboFix.exe
[2014.01.07 09:21:18 | 000,001,051 | ---- | M] () -- C:\Users\Dustin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Dropbox.lnk
[2014.01.07 09:20:47 | 000,001,021 | ---- | M] () -- C:\Users\Dustin\Desktop\Dropbox.lnk
[2014.01.06 18:17:57 | 001,937,144 | ---- | M] (Bleeping Computer, LLC) -- C:\Users\Dustin\Desktop\iExplore.exe
[2014.01.06 18:01:42 | 000,117,464 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\MBAMSwissArmy.sys
[2014.01.06 17:35:14 | 000,089,304 | ---- | M] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbamchameleon.sys
[2014.01.06 17:33:15 | 012,582,688 | ---- | M] (Malwarebytes Corp.) -- C:\Users\Dustin\Desktop\mbar-1.07.0.1008.exe
[2014.01.05 15:31:39 | 000,259,456 | ---- | M] () -- C:\Users\Dustin\Desktop\freemium.PNG
[2014.01.05 14:58:54 | 000,688,992 | R--- | M] (Swearware) -- C:\Users\Dustin\Desktop\dds.com
[2014.01.05 14:55:38 | 000,000,777 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014.01.04 20:38:15 | 000,291,176 | ---- | M] () -- C:\Windows\SysWow64\PnkBstrB.ex0
[2014.01.04 00:43:04 | 000,000,072 | ---- | M] () -- C:\Users\Dustin\AppData\Roaming\WB.CFG
[2014.01.03 14:41:04 | 000,000,952 | -HS- | M] () -- C:\Windows\SysWow64\KGyGaAvL.sys
[2014.01.03 14:36:16 | 000,001,029 | ---- | M] () -- C:\Users\Dustin\Desktop\Bandicam.lnk
[2014.01.03 10:03:32 | 000,000,829 | ---- | M] () -- C:\Users\Public\Desktop\Secure Eraser.lnk
[2014.01.01 20:05:06 | 000,000,703 | ---- | M] () -- C:\Users\Dustin\Desktop\RaidCall.lnk
[2013.12.17 13:48:54 | 001,613,412 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2013.12.17 13:48:54 | 000,696,848 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2013.12.17 13:48:54 | 000,652,166 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2013.12.17 13:48:54 | 000,148,144 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2013.12.17 13:48:54 | 000,121,098 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[2013.12.17 11:53:42 | 000,007,597 | ---- | M] () -- C:\Users\Dustin\AppData\Local\resmon.resmoncfg
[2013.12.16 11:19:12 | 000,001,547 | ---- | M] () -- C:\Users\Dustin\Desktop\Windows Media Player.lnk
[2013.12.11 10:58:58 | 000,029,792 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\klim6.sys
[2013.12.11 10:58:57 | 000,458,336 | ---- | M] (Kaspersky Lab ZAO) -- C:\Windows\SysNative\drivers\kl1.sys
[3 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
[1 C:\Windows\SysNative\drivers\*.tmp files -> C:\Windows\SysNative\drivers\*.tmp -> ]
========== Files Created - No Company Name ==========
[2014.01.08 14:06:43 | 000,034,516 | ---- | C] () -- C:\Users\Dustin\Desktop\freemium2.PNG
[2014.01.08 14:04:30 | 001,233,962 | ---- | C] () -- C:\Users\Dustin\Desktop\adwcleaner.exe
[2014.01.07 09:27:04 | 000,256,000 | ---- | C] () -- C:\Windows\PEV.exe
[2014.01.07 09:27:04 | 000,208,896 | ---- | C] () -- C:\Windows\MBR.exe
[2014.01.07 09:27:04 | 000,098,816 | ---- | C] () -- C:\Windows\sed.exe
[2014.01.07 09:27:04 | 000,080,412 | ---- | C] () -- C:\Windows\grep.exe
[2014.01.07 09:27:04 | 000,068,096 | ---- | C] () -- C:\Windows\zip.exe
[2014.01.05 15:31:39 | 000,259,456 | ---- | C] () -- C:\Users\Dustin\Desktop\freemium.PNG
[2014.01.05 14:55:38 | 000,000,777 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2014.01.03 14:36:14 | 000,001,029 | ---- | C] () -- C:\Users\Dustin\Desktop\Bandicam.lnk
[2014.01.03 10:03:30 | 000,000,829 | ---- | C] () -- C:\Users\Public\Desktop\Secure Eraser.lnk
[2014.01.01 20:05:05 | 000,000,703 | ---- | C] () -- C:\Users\Dustin\Desktop\RaidCall.lnk
[2013.12.20 21:44:04 | 000,000,072 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\WB.CFG
[2013.12.16 11:19:10 | 000,001,547 | ---- | C] () -- C:\Users\Dustin\Desktop\Windows Media Player.lnk
[2013.11.26 15:03:22 | 000,005,049 | ---- | C] () -- C:\ProgramData\nolecicr.ofg
[2013.11.25 22:06:11 | 000,004,576 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\CamStudio.cfg
[2013.11.25 22:06:10 | 000,065,633 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\Camdata.ini
[2013.11.25 22:06:10 | 000,000,408 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\CamShapes.ini
[2013.11.25 22:06:10 | 000,000,408 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\CamLayout.ini
[2013.11.25 21:35:07 | 000,000,096 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\version2.xml
[2013.08.05 07:15:08 | 000,066,104 | ---- | C] () -- C:\Windows\SysWow64\bdmpegv.dll
[2013.08.05 07:15:06 | 000,023,080 | ---- | C] () -- C:\Windows\SysWow64\bdmjpeg.dll
[2013.07.30 20:17:47 | 000,003,004 | ---- | C] () -- C:\Program Files (x86)\WebCakeLayers.crx
[2013.07.02 19:58:39 | 001,590,370 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI
[2013.07.02 19:55:51 | 003,130,440 | ---- | C] () -- C:\Windows\SysWow64\pbsvc_blr.exe
[2013.07.01 16:09:17 | 000,645,632 | ---- | C] () -- C:\Windows\SysWow64\xvidcore.dll
[2013.07.01 16:09:17 | 000,240,640 | ---- | C] () -- C:\Windows\SysWow64\xvidvfw.dll
[2013.05.14 17:00:36 | 000,338,432 | ---- | C] () -- C:\Windows\SysWow64\sqlite36_engine.dll
[2013.05.06 21:39:27 | 000,000,150 | ---- | C] () -- C:\Windows\A1CU.INI
[2013.04.25 19:29:51 | 000,000,268 | RH-- | C] () -- C:\Users\Dustin\AppData\Roaming\Iterate Items
[2013.04.25 19:28:41 | 000,000,268 | RH-- | C] () -- C:\Users\Dustin\AppData\Roaming\Jazz
[2013.04.25 19:28:41 | 000,000,268 | RH-- | C] () -- C:\Users\Dustin\AppData\Roaming\Internet Services
[2013.04.25 19:27:59 | 000,000,268 | RH-- | C] () -- C:\Users\Dustin\AppData\Roaming\Light Machine
[2012.11.21 20:48:52 | 000,298,280 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrB.exe
[2012.11.21 20:48:50 | 000,076,888 | ---- | C] () -- C:\Windows\SysWow64\PnkBstrA.exe
[2012.11.21 20:48:49 | 003,360,624 | ---- | C] () -- C:\Windows\SysWow64\pbsvc.exe
[2012.11.14 23:17:26 | 000,001,456 | ---- | C] () -- C:\Users\Dustin\AppData\Local\Adobe Für Web speichern 12.0 Prefs
[2012.11.14 23:12:51 | 000,000,132 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\Adobe GIF Format CS5 Prefs
[2012.10.16 12:53:06 | 000,003,584 | ---- | C] () -- C:\Users\Dustin\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2012.07.30 20:36:57 | 000,017,408 | ---- | C] () -- C:\Users\Dustin\AppData\Local\WebpageIcons.db
[2012.03.20 18:40:04 | 000,376,832 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\fontdb.mdb
[2011.08.22 10:58:29 | 000,007,859 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\pcouffin.cat
[2011.08.22 10:58:29 | 000,001,167 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\pcouffin.inf
[2011.01.21 03:37:21 | 000,000,132 | ---- | C] () -- C:\Users\Dustin\AppData\Roaming\Adobe PNG Format CS5 Prefs
[2010.02.14 10:42:33 | 000,007,597 | ---- | C] () -- C:\Users\Dustin\AppData\Local\resmon.resmoncfg
[2009.12.13 18:43:28 | 000,000,268 | RH-- | C] () -- C:\Users\Dustin\AppData\Roaming\Reverb
[2009.12.13 18:42:57 | 000,000,268 | RH-- | C] () -- C:\Users\Dustin\AppData\Roaming\Robot
[2009.12.13 18:22:43 | 000,000,268 | RH-- | C] () -- C:\Users\Dustin\AppData\Roaming\Image Units
========== ZeroAccess Check ==========
[2009.07.14 05:55:02 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64
[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64
"" = C:\Windows\SysNative\shell32.dll -- [2013.07.26 03:24:57 | 014,172,672 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2013.07.26 02:55:59 | 012,872,704 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 02:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 13:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64
"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 02:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
========== LOP Check ==========
[2013.05.06 21:40:38 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\.oit
[2013.05.14 17:04:05 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Abelssoft
[2014.01.03 10:03:43 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\ASCOMP Software
[2013.03.19 16:46:46 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Ashampoo
[2013.11.25 22:30:40 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\avidemux
[2013.12.02 20:25:27 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\BANDISOFT
[2012.10.25 14:37:09 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Blender Foundation
[2012.03.20 18:44:06 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\BorWare
[2011.12.12 19:26:05 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Catznip
[2011.04.05 01:36:28 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1
[2014.01.08 14:12:41 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\CheckPoint
[2013.04.23 20:52:25 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\com.adobe.DC3Module.AdobeADC
[2012.11.14 00:19:27 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\com.flashgallerycom.photoGalleryBuilder.BE456FDD426FDC61C9F8B47A33E5FBCFF9D5695C.1
[2014.01.08 14:17:49 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Dropbox
[2012.01.24 21:06:37 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\ExodusViewer
[2013.08.10 19:36:40 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\FileZilla
[2013.10.16 16:46:46 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Firestorm
[2013.09.20 12:41:28 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Free Download Manager
[2011.07.03 11:50:04 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\go
[2013.11.26 14:19:10 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\KoshyJohn.com
[2013.12.30 22:45:02 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\LaserSoft Imaging
[2009.12.11 23:15:47 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Meerkat
[2013.11.26 15:03:27 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\MOVAVI
[2013.05.06 21:18:22 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\NewSoft
[2009.12.13 18:43:30 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Nikon
[2011.01.20 00:53:54 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Notepad++
[2013.11.26 13:06:13 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\OBS
[2013.10.29 00:44:11 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\OpenOffice
[2011.02.25 22:27:08 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\OpenOffice.org
[2013.05.14 17:00:36 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Opera
[2013.03.16 23:08:10 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Origin
[2014.01.01 20:05:21 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\raidcall
[2009.12.14 16:19:49 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\SecondLife
[2010.01.27 18:19:48 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Soldat
[2013.11.11 21:41:27 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\SpaceEngineers
[2011.01.20 18:02:00 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\StageManager.BD092818F67280F4B42B04877600987F0111B594.1
[2011.03.18 21:07:35 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Steinberg
[2011.12.09 22:15:29 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\TeamViewer
[2013.12.16 22:50:57 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Telefónica
[2013.12.16 22:50:56 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\TGCMLog
[2013.05.14 11:09:25 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Thunderbird
[2010.09.19 14:43:08 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\TS3Client
[2013.01.18 12:59:23 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\ts3overlay
[2011.08.24 12:58:13 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\unknownware
[2011.02.20 20:14:49 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Vodafone
[2011.08.22 12:21:59 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Vso
[2011.02.11 17:04:58 | 000,000,000 | ---D | M] -- C:\Users\Dustin\AppData\Roaming\Wings3D
========== Purity Check ==========
========== Alternate Data Streams ==========
@Alternate Data Stream - 58 bytes -> C:\Users\Dustin\Desktop\Info.rtf:com.dropbox.attributes
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP

1B5B4F1

< End of report >

-Z3RO- · Jan 8, 2014

Extras.txt (Part 1)
-----------------------

OTL Extras logfile created on: 08.01.2014 14:53:37 - Run 1
OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\Dustin\Desktop
64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16736)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
3,99 Gb Total Physical Memory | 2,36 Gb Available Physical Memory | 59,17% Memory free
7,98 Gb Paging File | 5,94 Gb Available in Paging File | 74,42% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 97,56 Gb Total Space | 19,51 Gb Free Space | 19,99% Space Free | Partition Type: NTFS
Drive D: | 0,38 Mb Total Space | 0,00 Mb Free Space | 0,00% Space Free | Partition Type: CDFS
Drive E: | 600,98 Gb Total Space | 340,60 Gb Free Space | 56,67% Space Free | Partition Type: NTFS
Drive F: | 931,51 Gb Total Space | 391,94 Gb Free Space | 42,08% Space Free | Partition Type: NTFS
Computer Name: DUSTIN-PC | User Name: Dustin | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.html[@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
.url[@ = internetshortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation)
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\.DEFAULT\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-18\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
[HKEY_USERS\S-1-5-19\SOFTWARE\Classes\<extension>]
[HKEY_USERS\S-1-5-20\SOFTWARE\Classes\<extension>]
[HKEY_USERS\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [print] -- rundll32.exe %SystemRoot%\system32\mshtml.dll,PrintHTML "%1" (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation)
InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- E:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "E:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "E:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "E:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- "C:\Program Files\Internet Explorer\iexplore.exe" (Microsoft Corporation)
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
htmlfile [edit] -- Reg Error: Key error.
htmlfile [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
htmlfile [opennew] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
http [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
https [open] -- "C:\Program Files (x86)\Mozilla Firefox\firefox.exe" -osint -url "%1" (Mozilla Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [Bridge] -- E:\Programme\Adobe\Adobe Bridge CS5\Bridge.exe "%L" (Adobe Systems, Inc.)
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [Winamp.Bookmark] -- "E:\Programme\Winamp\winamp.exe" /BOOKMARK "%1" (Nullsoft, Inc.)
Directory [Winamp.Enqueue] -- "E:\Programme\Winamp\winamp.exe" /ADD "%1" (Nullsoft, Inc.)
Directory [Winamp.Play] -- "E:\Programme\Winamp\winamp.exe" "%1" (Nullsoft, Inc.)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Applications\iexplore.exe [open] -- "C:\Program Files\Internet Explorer\iexplore.exe" %1 (Microsoft Corporation)
CLSID\{871C5380-42A0-1069-A2EA-08002B30309D} [OpenHomePage] -- Reg Error: Value error.
========== Security Center Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
"FirewallDisableNotify" = 0
"AntiVirusDisableNotify" = 0
"UpdatesDisableNotify" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"AntiVirusDisableNotify" = 0
"FirewallDisableNotify" = 0
"FirewallOverride" = 0
"AntivirusOverride" = 0
"UacDisableNotify" = 0
"AntiSpywareDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"UpdatesDisableNotify" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 0
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
========== System Restore Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]
"DisableSR" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]
"Start" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]
"Start" = 2
========== Firewall Settings ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\DomainProfile]
[HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\WindowsFirewall\StandardProfile]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 0
========== Authorized Applications List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0B855148-89A2-4367-B060-B150FD8EC459}" = rport=137 | protocol=17 | dir=out | app=system |
"{213A0123-A04E-444D-9343-2C4D53030783}" = rport=139 | protocol=6 | dir=out | app=system |
"{227E726B-7D36-4363-9C5D-6D11CD24ED00}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{318AC548-AD71-4B65-B06C-BE4C5B26146D}" = rport=10243 | protocol=6 | dir=out | app=system |
"{66E943D0-79F0-4561-B3EF-C31CAE26F873}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{6C17071D-3086-46B8-B5DE-D2B766AA63BC}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 |
"{825DB3C9-0D29-4D45-AD9E-B0DF7956AE52}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{86880023-15FB-488A-850F-C7FF026314B9}" = lport=445 | protocol=6 | dir=in | app=system |
"{89DBF4AF-BE4B-41B0-8AD4-CDCB0F43A4EA}" = lport=10243 | protocol=6 | dir=in | app=system |
"{9002B8E7-F665-43DF-AF0E-8AE35700C4AE}" = lport=2869 | protocol=6 | dir=in | app=system |
"{95FA180A-4187-4EE7-A6DC-012CD9512F3E}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe |
"{A39C5EDE-8D23-4612-9A9A-58FCEFD4637B}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{ABC0EC33-0803-43D0-8B46-A6AD49EC085C}" = lport=137 | protocol=17 | dir=in | app=system |
"{B704C7BB-7D9F-43CC-9B25-F40B23F29F6E}" = rport=445 | protocol=6 | dir=out | app=system |
"{BD1C080C-4966-4CD0-840E-8FDF0D95F888}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{C1B2C527-6675-41B0-A44F-FB49DDE5C7E0}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{CB5E1266-D7F7-4FBD-A5B0-479EE8C5AB3D}" = rport=138 | protocol=17 | dir=out | app=system |
"{D08A8E8E-3877-4E2F-B91C-A7DFC5D93D18}" = lport=139 | protocol=6 | dir=in | app=system |
"{EEA81CD3-7784-49B5-B8F7-B9DE8DE036B2}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F2B3A142-9AFC-448C-8098-25F3CBD0DF4E}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe |
"{F3BECBC3-2F5E-4AA7-B366-B8FC32406E89}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe |
"{F6EA8319-3D4E-4B9B-9DB2-A6AF8DA737D2}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe |
"{FA72ABA4-F00E-4693-8258-EC835684E0DC}" = lport=138 | protocol=17 | dir=in | app=system |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{008E991C-2688-4DDF-B8F7-399231605F0D}" = protocol=17 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
"{00F6C579-6CF4-4C14-B64B-059BA4DA24B5}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{0487539E-CA60-46E5-A479-A8E38AE4F5D1}" = protocol=17 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{04AEC9D6-F22F-4189-BF02-3B110A982431}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{07D11987-FBA9-4F96-92A3-36AEBE034398}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{0A8D0E10-C823-4388-A36A-A866E9C8A5F5}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{0B387FB4-4531-4388-98F6-DD30ABAF4915}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\hl2.exe |
"{11479309-1EE0-4B79-8953-4BA3A8201B7D}" = protocol=6 | dir=in | app=c:\users\dustin\appdata\local\temp\7zs4079\hpdiagnosticcoreui.exe |
"{11786057-4254-4549-940E-52333F3D1CDD}" = protocol=6 | dir=out | app=system |
"{1393955A-E2CF-4719-A282-3E0BE05DB479}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\america's army\aapg\binaries\aalauncher32.exe |
"{13D1BCC3-AF38-4F66-A686-3260DDCAB2BD}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\men of war assault squad\mow_assault_squad.exe |
"{14D1725E-C37B-4059-B3AF-363FEC05E5CA}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{17D1B439-A620-48DE-A152-299B4D7AA1C4}" = protocol=6 | dir=in | app=e:\programme\steam\steam.exe |
"{18799458-0936-41CD-A9D2-A61220CB8C64}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{1E4E302B-B2C1-4FB2-A6FC-DF8A48B56D05}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\hl2.exe |
"{1F9CDF36-D3A1-4A4A-A032-C109B22BBB2D}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{231BC4D3-07A8-4FB1-9EFB-4328823CCB42}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\the stanley parable\stanley.exe |
"{23370B6C-90CE-4E20-815A-C60BBFB53CB7}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\bin\hammer.bat |
"{2581F77B-0B1F-489A-9539-DF4482C5B5DB}" = protocol=17 | dir=in | app=c:\users\dustin\appdata\local\temp\7zs40c1\hpdiagnosticcoreui.exe |
"{25C424F1-12F0-480F-8B68-3B8B82E391BD}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{26DE1E51-E0A7-4FBA-83B3-81D610173847}" = protocol=17 | dir=in | app=e:\programme\star wars-the old republic\launcher.exe |
"{27C41E66-9FFA-4A8E-B151-4E9AE2428BC7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{27D6CC5D-E025-4DA8-990E-F2CBA858DD17}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\hl2.exe |
"{28884D56-77A6-4ACC-B7D1-D0E9C75703AE}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{29C10C7B-FD2B-46DF-BBAE-FDBE1F53C2C8}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{2B6B7147-8E00-4714-BCD4-05352F53D608}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\america's army 3\binaries\aa3loader.exe |
"{2BEEC5EB-80CF-460F-9A7E-7E20BA8ED18D}" = protocol=6 | dir=in | app=e:\programme\ea games\mirror's edge\binaries\mirrorsedge.exe |
"{2EEDF12D-0DFE-4ACD-9861-8734F2FCA8B4}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{2EFA869D-1736-4781-BD73-FA455D0D2FAF}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\max payne 3\max payne 3\maxpayne3.exe |
"{315E103C-EF0F-4654-A3C5-C895E198B609}" = protocol=6 | dir=out | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{319677A9-936A-4E30-A2F5-036225A28708}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{31B9642F-F201-4970-8C97-AF1D1D1B724E}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\the cursed crusade\tcc.exe |
"{31DA5EDB-F056-47E9-8CA5-CCF97ECF18A5}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{33DC74F6-B452-4FD8-8D84-8F9B92EFE206}" = protocol=17 | dir=in | app=e:\programme\star wars-the old republic\swtor\retailclient\swtor.exe |
"{34126137-BFCF-4DA3-A88C-30DAD3A10F79}" = protocol=17 | dir=in | app=c:\users\dustin\appdata\local\temp\7zs4079\hpdiagnosticcoreui.exe |
"{359686D7-B2E3-45E6-BAD6-1C68E65DFD3F}" = protocol=17 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{35C70C61-D93B-46FA-8A59-7917B422CD39}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe |
"{35CBBD49-553F-4AE1-8EED-A5D5C2D46B79}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\launcheflc.exe |
"{39103E4A-174F-44F4-9DF3-C03B596D88CB}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers64.exe |
"{3A46068C-E0F4-460D-B8A1-B14AE735DDEF}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3B23A263-6BE3-49F0-AB6D-D4730A362532}" = dir=in | app=c:\program files\hp\hp officejet 4620 series\bin\devicesetup.exe |
"{3B4EE278-11CA-407C-88CC-93C679966B1E}" = protocol=6 | dir=in | app=e:\programme\star wars-the old republic\swtor\retailclient\swtor.exe |
"{3BD11F1C-2757-4F30-AF64-B6A59AC27965}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe |
"{3ED0BB57-8063-4EDF-8E39-06CFB32AA3B4}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\hl2.exe |
"{3EF05E01-D0D7-4C25-A9CF-48082043DCB3}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{3F986A03-0874-42C5-BE20-6592A677EF62}" = protocol=6 | dir=in | app=c:\programdata\esafe\egdpsvc.exe |
"{42919FB4-48D1-4F26-9376-9FAA259EEF2D}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{43317C45-64B1-4315-BA61-086A9F3499FE}" = protocol=17 | dir=in | app=e:\programme\star wars-the old republic\launcher.exe |
"{47C5ACEE-B611-47BF-9922-C21009D930ED}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\hitman absolution\hma.exe |
"{488F6608-454A-4C18-B780-4E9F4DC5D258}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\tacticalintervention\bin\tacint.exe |
"{48A39AB2-4ABA-47E1-8940-8EC2828A8700}" = protocol=17 | dir=in | app=%programfiles(x86)%\windows media player\wmplayer.exe |
"{49AA5806-1E32-4536-94C3-A7851FAB0800}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{49B063F8-4094-4C42-A6D3-B707ABC1AB7B}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\warframe\tools\launcher.exe |
"{4D41090A-CB2A-4B26-A7E7-B78DA6AE33EA}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\l.a.noire\lanlauncher.exe |
"{4F1F588F-FB71-4C46-8EC2-0361E1FD8565}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\need for speed hot pursuit\nfs11.exe |
"{5133F8C0-1E86-46E4-AD1F-88AF24714416}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{53608132-593A-4F07-AA54-9038AB863F2F}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\hitman absolution\hma.exe |
"{55D3A0CB-CDEE-40F6-9C9F-7661DBF65F81}" = dir=in | app=c:\program files (x86)\advanced driver updater\adu.exe |
"{568AD45D-7FD9-4880-984D-564DF80B8599}" = protocol=6 | dir=in | app=e:\programme\star wars-the old republic\launcher.exe |
"{57E20A5D-B2D1-48ED-8428-05F781A2F363}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\bin\hammer.bat |
"{59296FA3-6EBB-4A16-A319-A8683F949102}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{5A12CE3D-8A05-48D1-A0E9-6C5B900A62C6}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |
"{5C98B9BF-E570-4519-A538-1C31450A7C85}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\call of duty modern warfare 2\iw4sp.exe |
"{5DAAAF4E-5F31-4AB4-A67F-6FE1D90A3092}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{5DF6F9A2-4B85-427C-892C-03B700824C34}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{5E1A34D9-63BC-48A4-A8D1-18B721DA57A4}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 |
"{60057F10-5852-4D24-B59B-817198253ACE}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\payday 2 demo\payday2_win32_release.exe |
"{607A25C0-9A4B-4B06-AB2E-D043BD30296F}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\america's army\aapg\binaries\aalauncher32.exe |
"{65D62691-BDBA-4618-89FC-63844A822292}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe |
"{65E29EB4-1701-423A-BFDC-62D8FE0C3554}" = protocol=17 | dir=in | app=e:\programme\star wars-the old republic\swtor\retailclient\swtor.exe |
"{65E52D53-D30C-4BEA-BA4B-85FFB52E0111}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\arma 2 operation arrowhead\arma2oa.exe |
"{6881FB22-3B53-4D6E-B268-5D12D8758980}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{68AFB381-57DF-459D-A6B7-5647895202D6}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\warframe\tools\launcher.exe |
"{69E9261F-EE4F-4B26-A46B-9676701A8149}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\need for speed hot pursuit\support\ea help\electronic_arts_technical_support.htm |
"{6A978D0C-FB53-4A46-AAB2-B37B2F2B4EEE}" = protocol=6 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
"{6B24724E-5EC7-4FCC-9DB0-4611DB94FF96}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\need for speed hot pursuit\support\ea help\electronic_arts_technical_support.htm |
"{6BB20DA4-11B4-4C47-ABB0-38D8989D88A6}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{6EB8954C-B93B-4FAB-B0A0-3C14898B2DFB}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\arma 2 operation arrowhead\expansion\beta\arma2oa.exe |
"{729EAF32-4F8D-4B0C-8632-CC2BA293DB4D}" = protocol=17 | dir=in | app=e:\programme\stream\steam.exe |
"{736986FD-2BDC-425A-BC6F-881D3A232758}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{73B66CFE-8BE7-4468-B0BD-BF2855736C3F}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{7407B273-301A-40C9-932F-3E43A1066992}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\the stanley parable\stanley.exe |
"{794B4AA7-1020-4D06-827E-CB41AB2AF3A4}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 |
"{7AEFDAC0-43E2-47D1-8793-F77ACBE2B2AA}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\need for speed hot pursuit\nfs11.exe |
"{7C7B8176-C6AC-4E94-A994-A5D93635B727}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 |
"{7C90A35A-2C81-4733-89BE-63B291BE569A}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe |
"{7E86F94C-90CF-4068-B467-689124D53E0D}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\america's army 3\binaries\aa3loader.exe |
"{8159378D-90F5-4C5D-A74E-6A0B2CE22F8B}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\bin\hammer.bat |
"{82B2F407-5468-4165-A73A-10C26E9DCCB6}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{84C33E20-9C6A-4D97-9AAC-65393E1CFFB6}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers64.exe |
"{871A3407-14B3-4306-AD89-EC7C9A0AB4FC}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\hitman sniper challenge\hmsc.exe |
"{88DB1E27-16CA-42FC-A655-BCCDD8CE7EC9}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{8B52CA51-7426-4F39-98E2-56F136928F92}" = protocol=17 | dir=in | app=e:\programme\ventrilo\ventrilo.exe |
"{8D3E3CC8-0878-4DF2-BE5A-7FAB5B1F294B}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe |
"{8E08208E-4A88-4145-9E5A-6123E8C49920}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{8E09D6CB-887C-4BD4-99E8-AFB1133F0F94}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\the cursed crusade\tcc.exe |
"{8E204EE6-E092-4AE3-8C2B-922A7718A9A8}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{8F87FD9B-012A-4112-A52E-A474EF9BC122}" = protocol=6 | dir=in | app=c:\users\dustin\appdata\roaming\dropbox\bin\dropbox.exe |
"{936EEA0E-61C1-41E8-AD72-0BAD82362A66}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\grand theft auto iv\gtaiv\launchgtaiv.exe |
"{946D0C11-DAAE-4E5C-8D20-5E3EE9C6DBFA}" = protocol=17 | dir=in | app=c:\windows\system32\dmwu.exe |
"{95E35404-54E9-43A0-917B-BE5845A079C6}" = protocol=6 | dir=in | app=e:\programme\stream\steamapps\common\batman arkham asylum\batman_revoker.exe |
"{979C3199-7A58-4CA0-88B8-2484286E6F78}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\tacticalintervention\bin\tacint.exe |
"{97F4BEAF-BA4B-4E8C-BEB0-64ECB8AD7F80}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{9805970C-9015-40B4-8C34-BA8396FBD487}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{98C5C82D-FEA8-4E04-A6DA-7375B725E792}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{98E78946-E083-4D3C-A48B-EDF57E1F7970}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |
"{991E166D-AAD1-4DAC-9BF9-E52D1C948075}" = protocol=17 | dir=in | app=d:\alicecd.exe |
"{9AAF59DB-2013-4D3E-A002-4D657296FF3D}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{9BACFB7E-8448-4A2E-A1BB-19D2518E0EE2}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\men of war assault squad\mow_assault_squad.exe |
"{9BD0425B-13F7-4DD6-92F9-B993008ED9C5}" = protocol=6 | dir=in | app=d:\alicecd.exe |
"{9DC281E2-534C-4346-AC9F-F1EBAC94CB35}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\hl2.exe |
"{9F57EC40-43C6-4118-8863-D368466F4FB7}" = protocol=6 | dir=in | app=c:\users\dustin\appdata\local\temp\7zs40c1\hpdiagnosticcoreui.exe |
"{A0E8D2BC-63F8-4C29-A204-B1F9D751C0D2}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\payday 2 demo\payday2_win32_release.exe |
"{A1A4EDD3-447C-4D0B-961D-A364D2DFB0DB}" = protocol=6 | dir=in | app=e:\programme\star wars-the old republic\swtor\retailclient\swtor.exe |
"{A1E2E7C9-2A4A-47A6-84E0-7872024B2A18}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{A5D6307D-25D5-4393-8678-C29EAA4B5C7E}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe |
"{A6EEDF2D-3C79-4E23-801B-9C14DC1E9D17}" = protocol=17 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
"{A76885B9-89E5-45ED-B106-9231E5C3EC0B}" = dir=in | app=c:\program files (x86)\common files\apple\apple application support\webkit2webprocess.exe |
"{A85C1A91-125E-4269-B57E-7766CC209F83}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\bin\hammer.bat |
"{A971F834-8359-4F3F-A794-6F5D943E648D}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\hl2.exe |
"{AA22B140-17B4-4AFD-B83B-D5685537A291}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{AB82EFBE-C2D1-4735-B2F8-2306EB29B9D7}" = dir=in | app=c:\program files\hp\hp officejet 4620 series\bin\faxapplications.exe |

-Z3RO- · Jan 8, 2014

Extras.txt (Part 2)
-----------------------

"{AFCDCC61-F601-4424-806C-14AF4EF446D3}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{B00191E9-F5F3-4051-A68A-DF354B2E679A}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\grand theft auto iv episodes from liberty city\eflc\launcheflc.exe |
"{B02A9E62-2206-460A-A3EE-541EE14DB914}" = dir=in | app=c:\program files\hp\hp officejet 4620 series\bin\sendafax.exe |
"{B38180BB-76B1-4348-BDE6-7C0D676C33A8}" = protocol=6 | dir=in | app=e:\programme\star wars-the old republic\launcher.exe |
"{B388CF73-9293-41A0-ACC8-7508696529B0}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{B47D3257-7C3F-4010-B1B5-80A60ED29CF2}" = protocol=17 | dir=in | app=e:\programme\stream\steamapps\common\batman arkham asylum\batman_revoker.exe |
"{B5F83974-C8AB-41D1-9828-D1915B10A079}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\war thunder\launcher.exe |
"{B96B13A1-F96F-4537-B32C-E35B0157ADDB}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{BD44B4DF-CBE3-47CD-9562-A34FCBAE787A}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe |
"{BF9529A7-7BD6-4374-84C6-6DF14999152C}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"{C0706B03-466B-48EA-BAB0-1D730B1D41F8}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 |
"{C9167C2D-292A-4FAD-98B7-1CB13EB061DB}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe |
"{CDE96D51-98C0-44AE-81D8-3285A4848822}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\the stanley parable\stanley.exe |
"{CEF0CE79-7FE9-4EC8-810C-88593EC6CFF0}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\the stanley parable\stanley.exe |
"{CFE8EDCA-AAA7-45B1-9CE7-E7E649DC077D}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\call of duty modern warfare 2\iw4mp.exe |
"{D0603AD6-36CC-4AB5-8902-27D3A3984D51}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\bin\hammer.bat |
"{D0A2DC58-A519-42A5-9285-802E7BD696F1}" = protocol=17 | dir=in | app=c:\windows\system32\arfc\wrtc.exe |
"{D2322278-6CDC-4DD0-BE6E-FAFAFE7F58E4}" = protocol=6 | dir=in | app=c:\program files (x86)\skype\plugin manager\skypepm.exe |
"{D40B1D4E-A1FF-4B8D-8D53-78181CA93735}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{D5CC2416-E17C-47CD-B031-9ECBD3C6B931}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\l.a.noire\lanlauncher.exe |
"{D7583CBD-DABB-4A98-93C2-7036C0175219}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\hitman sniper challenge\hmsc.exe |
"{DA32BFC3-5CB4-409D-BA34-678FCD7B0BBF}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\nmrih\sdk\bin\hammer.bat |
"{DB8D73A3-34F6-4710-BF10-72BA780D92E8}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\war thunder\launcher.exe |
"{DB9F742C-6478-4BE2-8016-F2CD74CE0EC0}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{DD108680-4503-46C7-A6D3-B396C3BF8EF4}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\grand theft auto iv\gtaiv\launchgtaiv.exe |
"{DE3BFDDE-FAD5-460B-B9FB-4C2EE5C32564}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{DF94A3B8-6212-477C-BA07-07E050993D45}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\borderlands 2\binaries\win32\launcher.exe |
"{E0B1CF01-0395-41A3-AD55-9031BD604744}" = protocol=6 | dir=in | app=e:\programme\ventrilo\ventrilo.exe |
"{E21CC7DD-336F-426C-BF2E-AF449517CCEB}" = protocol=17 | dir=in | app=e:\programme\ea games\mirror's edge\binaries\mirrorsedge.exe |
"{E2C6ED98-EF2C-4EDB-926E-C1AD4E552C33}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{E35ED2E5-B54B-4083-860F-4C6B8C0EB9C8}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\max payne 3\max payne 3\maxpayne3.exe |
"{E7A6BD86-FD00-4BCE-B6F9-2F3A1FF466ED}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{E9A15907-5FFB-4491-B9A5-E681DA0D9231}" = dir=in | app=c:\program files\hp\hp officejet 4620 series\bin\digitalwizards.exe |
"{EA5F760A-4DEB-4BCB-A458-81F2BE0CC3EE}" = protocol=6 | dir=in | app=c:\windows\system32\arfc\wrtc.exe |
"{EC40D704-DFF8-461A-A7EE-7C9259310887}" = protocol=17 | dir=in | app=c:\users\dustin\appdata\roaming\dropbox\bin\dropbox.exe |
"{ECFD0B9E-3DA3-4ABF-BCFA-6E034132D668}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe |
"{F04C5702-35E0-45B4-A5B2-33E471817E1E}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{F1CC9E77-5F25-4C9D-BEBB-04E7D2B1969A}" = dir=in | app=c:\program files\hp\hp officejet 4620 series\bin\hpnetworkcommunicator.exe |
"{F1D93C5D-5317-4224-A3C7-539AD73A9E67}" = protocol=6 | dir=in | app=e:\programme\stream\steam.exe |
"{F2A683B7-9FA0-4401-8870-9FD8ED39EBC4}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\bin64\spaceengineers.exe |
"{F441C18D-1797-4539-9C81-7CC704F7F099}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\prison architect\prison architect.exe |
"{F4B48359-D19D-4FF9-92A1-52121C3492B5}" = protocol=6 | dir=in | app=c:\windows\syswow64\arfc\wrtc.exe |
"{F5885EC9-3197-4EB6-9E49-310AF5B78127}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"{F665CA46-2ADE-4EBA-B900-7FF8CA25B7CB}" = protocol=17 | dir=in | app=e:\programme\steam\steam.exe |
"{F9A6095F-F85F-4C41-ADD5-5B80F25F6480}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe |
"{FBB24A26-70B9-4A2F-9081-4A363C7A90D6}" = protocol=6 | dir=in | app=c:\windows\system32\dmwu.exe |
"{FBC8E401-CCCA-4EA2-BFEB-88FFE8654D94}" = protocol=17 | dir=in | app=e:\programme\steam\steamapps\common\borderlands 2\binaries\win32\borderlands2.exe |
"{FFC4862A-336C-45F3-A39B-6B2956E2F7B8}" = protocol=6 | dir=in | app=e:\programme\steam\steamapps\common\spaceengineers\spaceengineers.exe |
"TCP Query User{07A95D9C-8393-48AE-BDAD-7B59BD4EE5BA}E:\downloads\vstparamtool.exe" = protocol=6 | dir=in | app=e:\downloads\vstparamtool.exe |
"TCP Query User{4413C40F-8682-4C4B-B710-95B9DC898E72}E:\programme\meerkat\slvoice.exe" = protocol=6 | dir=in | app=e:\programme\meerkat\slvoice.exe |
"TCP Query User{5E68A94D-3E10-4218-A2B4-0B726F618D93}E:\programme\winamp\winamp.exe" = protocol=6 | dir=in | app=e:\programme\winamp\winamp.exe |
"TCP Query User{5F71EF29-EF8A-4834-8B95-5B751CB940E1}E:\programme\free download manager\fdmwi.exe" = protocol=6 | dir=in | app=e:\programme\free download manager\fdmwi.exe |
"TCP Query User{6060B3C9-2BB9-44FF-B10A-2309F085F3F8}E:\programme\sl-inertia\inertia.exe" = protocol=6 | dir=in | app=e:\programme\sl-inertia\inertia.exe |
"TCP Query User{70154D6E-B0DB-4C71-85B1-8B3A427F7CAA}E:\programme\sl-inertia\inertia.exe" = protocol=6 | dir=in | app=e:\programme\sl-inertia\inertia.exe |
"TCP Query User{71931EF7-E018-467A-87F0-58F22CFF716F}E:\programme\emerald viewer\slvoice.exe" = protocol=6 | dir=in | app=e:\programme\emerald viewer\slvoice.exe |
"TCP Query User{89304DF1-5B7C-45A7-ABA5-DBA0C657D034}E:\programme\secondlife\slvoice.exe" = protocol=6 | dir=in | app=e:\programme\secondlife\slvoice.exe |
"TCP Query User{8A6133E8-5726-496A-B943-F4AE4B6715FA}E:\programme\phoenix viewer\phoenixviewer.exe" = protocol=6 | dir=in | app=e:\programme\phoenix viewer\phoenixviewer.exe |
"TCP Query User{91BB68AC-2759-45CC-82E9-9E3CC76C4606}E:\programme\stream\steamapps\common\america's army 3 dedicated server\binaries\aa3game.exe" = protocol=6 | dir=in | app=e:\programme\stream\steamapps\common\america's army 3 dedicated server\binaries\aa3game.exe |
"TCP Query User{A8D23312-67CE-4EE0-B4A4-09CE2F2F98A9}E:\programme\fl studio\fl.exe" = protocol=6 | dir=in | app=e:\programme\fl studio\fl.exe |
"TCP Query User{C0E882B7-26B2-428D-B437-15E6C5DE82EA}E:\programme\empire earth\empire earth.exe" = protocol=6 | dir=in | app=e:\programme\empire earth\empire earth.exe |
"TCP Query User{C175087A-BCD8-4BA3-9B82-7BA49621009C}E:\programme\emerald viewer\emerald viewer\slvoice.exe" = protocol=6 | dir=in | app=e:\programme\emerald viewer\emerald viewer\slvoice.exe |
"TCP Query User{DFDD0D5A-5952-4A3A-8998-BBD1733E9950}E:\programme\phoenix viewer\phoenix.exe" = protocol=6 | dir=in | app=e:\programme\phoenix viewer\phoenix.exe |
"TCP Query User{E73B81D6-FC4B-4FDF-BD33-28E961184F3F}E:\programme\soldat\soldat.exe" = protocol=6 | dir=in | app=e:\programme\soldat\soldat.exe |
"TCP Query User{EB2E8D1C-04CB-4B57-AF37-8AB9AE630883}E:\programme\phoenix viewer\phoenix.exe" = protocol=6 | dir=in | app=e:\programme\phoenix viewer\phoenix.exe |
"TCP Query User{EDB2949D-59B3-4E4A-A315-F9C05A45F805}E:\programme\stream\steamapps\common\batman arkham asylum\binaries\shippingpc-bmgame.exe" = protocol=6 | dir=in | app=e:\programme\stream\steamapps\common\batman arkham asylum\binaries\shippingpc-bmgame.exe |
"TCP Query User{F8296D75-9AA2-4B19-B28F-8A78284C33B5}E:\programme\phoenix viewer\slvoice.exe" = protocol=6 | dir=in | app=e:\programme\phoenix viewer\slvoice.exe |
"TCP Query User{FCDAA60B-84B1-4E04-BB98-46A7A4636A6E}E:\programme\phoenix viewer\phoenixviewer.exe" = protocol=6 | dir=in | app=e:\programme\phoenix viewer\phoenixviewer.exe |
"UDP Query User{039E3FF0-7D8B-4266-8B09-1DA81B0D20E7}E:\programme\stream\steamapps\common\america's army 3 dedicated server\binaries\aa3game.exe" = protocol=17 | dir=in | app=e:\programme\stream\steamapps\common\america's army 3 dedicated server\binaries\aa3game.exe |
"UDP Query User{13DFA712-6338-4FCF-AAA0-6EA0CF4FF108}E:\programme\phoenix viewer\phoenixviewer.exe" = protocol=17 | dir=in | app=e:\programme\phoenix viewer\phoenixviewer.exe |
"UDP Query User{3295C1C2-1259-45F4-8DB8-9DC77349F24E}E:\programme\sl-inertia\inertia.exe" = protocol=17 | dir=in | app=e:\programme\sl-inertia\inertia.exe |
"UDP Query User{331C03E9-D54A-41F3-ADA7-FB6EA6839D7A}E:\programme\phoenix viewer\slvoice.exe" = protocol=17 | dir=in | app=e:\programme\phoenix viewer\slvoice.exe |
"UDP Query User{33DC5F15-55A9-4DFB-8DCC-8FE240E9313A}E:\programme\fl studio\fl.exe" = protocol=17 | dir=in | app=e:\programme\fl studio\fl.exe |
"UDP Query User{4B074068-20C6-4336-BC45-1BC3847B4489}E:\downloads\vstparamtool.exe" = protocol=17 | dir=in | app=e:\downloads\vstparamtool.exe |
"UDP Query User{4BD6FF27-F867-41DF-9842-DD7E331A69F9}E:\programme\soldat\soldat.exe" = protocol=17 | dir=in | app=e:\programme\soldat\soldat.exe |
"UDP Query User{5E66B755-3F2D-4774-B75D-70ACE0C05B92}E:\programme\stream\steamapps\common\batman arkham asylum\binaries\shippingpc-bmgame.exe" = protocol=17 | dir=in | app=e:\programme\stream\steamapps\common\batman arkham asylum\binaries\shippingpc-bmgame.exe |
"UDP Query User{6A9B3CDE-4447-49CD-B697-8CDCD06FFA70}E:\programme\secondlife\slvoice.exe" = protocol=17 | dir=in | app=e:\programme\secondlife\slvoice.exe |
"UDP Query User{75FBE86A-D857-4DA4-BC72-3FFF7241CC3F}E:\programme\meerkat\slvoice.exe" = protocol=17 | dir=in | app=e:\programme\meerkat\slvoice.exe |
"UDP Query User{76BBF6AF-BB88-4038-B45F-B9CD0FC475AD}E:\programme\free download manager\fdmwi.exe" = protocol=17 | dir=in | app=e:\programme\free download manager\fdmwi.exe |
"UDP Query User{77AB97D9-65F7-4DB2-BF20-95EB4B0EC355}E:\programme\emerald viewer\emerald viewer\slvoice.exe" = protocol=17 | dir=in | app=e:\programme\emerald viewer\emerald viewer\slvoice.exe |
"UDP Query User{8FA05C44-E8C9-4EF9-9D0B-20A11914CC42}E:\programme\phoenix viewer\phoenixviewer.exe" = protocol=17 | dir=in | app=e:\programme\phoenix viewer\phoenixviewer.exe |
"UDP Query User{B06EA9B0-21A1-4F55-8C7C-9F85A79C969F}E:\programme\phoenix viewer\phoenix.exe" = protocol=17 | dir=in | app=e:\programme\phoenix viewer\phoenix.exe |
"UDP Query User{B2B1C7DE-7B01-4A2F-B8D8-98D2A187792D}E:\programme\winamp\winamp.exe" = protocol=17 | dir=in | app=e:\programme\winamp\winamp.exe |
"UDP Query User{C780E6E9-BDEC-485D-844A-3E6492972832}E:\programme\empire earth\empire earth.exe" = protocol=17 | dir=in | app=e:\programme\empire earth\empire earth.exe |
"UDP Query User{CF5D8498-1EE1-41B8-A99F-98F80FA641F3}E:\programme\emerald viewer\slvoice.exe" = protocol=17 | dir=in | app=e:\programme\emerald viewer\slvoice.exe |
"UDP Query User{D4158B7D-2333-43DE-A1A4-220810C61608}E:\programme\phoenix viewer\phoenix.exe" = protocol=17 | dir=in | app=e:\programme\phoenix viewer\phoenix.exe |
"UDP Query User{ECEE8A82-E72B-4195-8C21-AA6E3CC21EB9}E:\programme\sl-inertia\inertia.exe" = protocol=17 | dir=in | app=e:\programme\sl-inertia\inertia.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{11953C65-BB4E-4CA4-B0F0-2600A4B20040}" = Picture Control Utility x64
"{1D8E6291-B0D5-35EC-8441-6616F567A0F7}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.40219
"{1E9FC118-651D-4934-97BE-E53CAE5C7D45}" = Microsoft_VC80_MFCLOC_x86_x64
"{26A24AE4-039D-4CA4-87B4-2F86417021FF}" = Java 7 Update 21 (64-bit)
"{2EDC2FA3-1F34-34E5-9085-588C9EFD1CC6}" = Microsoft Visual C++ 2012 x64 Minimum Runtime - 11.0.60610
"{350AA351-21FA-3270-8B7A-835434E766AD}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.21022
"{412FF2A0-2E34-436B-8A0A-9E4EF32E913E}" = Option WWAN Driver 5.0.32.0 Installer
"{439760BC-7737-4386-9B1D-A90A3E8A22EA}" = Apple Mobile Device Support
"{4569AD91-47F4-4D9E-8FC9-717EC32D7AE1}" = Microsoft_VC80_CRT_x86_x64
"{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148
"{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161
"{635BE602-BB9C-4C59-8CC5-93F9366E8A21}" = ViewNX 2
"{6C1A010F-9108-4162-A26F-9FEC4AC0F0F0}" = Adobe Photoshop Lightroom 5 64-bit
"{727E94E5-584F-4463-B4F5-93D3779C610B}_x" = Option WWAN Driver 5.0.32.0 Installer
"{764384C5-BCA9-307C-9AAC-FD443662686A}" = Microsoft Visual C++ 2012 x64 Additional Runtime - 11.0.60610
"{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17
"{8338783A-0968-3B85-AFC7-BAAE0A63DC50}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570
"{8557397C-A42D-486F-97B3-A2CBC2372593}" = Microsoft_VC90_ATL_x86_x64
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8E34682C-8118-31F1-BC4C-98CD9675E1C2}" = Microsoft .NET Framework 4 Extended
"{925D058B-564A-443A-B4B2-7E90C6432E55}" = Microsoft_VC80_ATL_x86_x64
"{92A3CA0D-55CD-4C5D-BA95-5C2600C20F26}" = Microsoft_VC90_CRT_x86_x64
"{95120000-00B9-0409-1000-0000000FF1CE}" = Microsoft Application Error Reporting
"{981D96C5-41F7-43DB-90AA-F781BBD302B9}" = HP Officejet 4620 series - Grundlegende Software für das Gerät
"{9B48B0AC-C813-4174-9042-476A887592C7}" = Windows Live ID Sign-in Assistant
"{A472B9E4-0AFF-4F7B-B25D-F64F8E928AAB}" = Microsoft_VC90_MFC_x86_x64
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 331.65
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 331.65
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 331.65
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 314.22
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.1031
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.15.2
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application
"{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components
"{C8C1BAD5-54E6-4146-AD07-3A8AD36569C3}" = Microsoft_VC80_MFC_x86_x64
"{EE936C7A-EA40-31D5-9B65-8E3E089C3828}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148
"{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile
"Blender" = Blender
"DiskMax" = DiskMax 4.71
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Wacom Tablet Driver" = Wacom Tablett
"Wacom WebTabletPlugin for Internet Explorer and Netscape" = WebTablet FB Plugin 64 bit
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{02698606-3A21-489D-9D2A-75C9E8D3E5BD}" = Adobe Creative Suite 5 Design Premium
"{033E378E-6AD3-4AD5-BDEB-CBD69B31046C}" = Microsoft_VC90_ATL_x86
"{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam
"{08D2E121-7F6A-43EB-97FD-629B44903403}" = Microsoft_VC90_CRT_x86
"{0AEC308E-7EB3-47F7-BB59-F2C9C6166B27}" = OpenOffice 4.0.1
"{0D2DBE8A-43D0-7830-7AE7-CA6C99A832E7}" = Adobe Community Help
"{0F3647F8-E51D-4FCC-8862-9A8D0C5ACF25}" = Microsoft_VC80_ATL_x86
"{14DC0059-00F1-4F62-BD1A-AB23CD51A95E}" = Adobe AIR
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{205C6BDD-7B73-42DE-8505-9A093F35A238}" = Windows Live-Uploadtool
"{20D4A895-748C-4D88-871C-FDB1695B0169}" = Platform
"{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}" = MSVCRT
"{26A24AE4-039D-4CA4-87B4-2F83217045FF}" = Java 7 Update 45
"{3B11D799-48E0-48ED-BFD7-EA655676D8BB}" = Star Wars: The Old Republic
"{3BEF9769-BA52-18F7-1D02-2362F6A27E38}" = Adobe Media Player
"{3D6AD258-61EA-35F5-812C-B7A02152996E}" = Microsoft Visual C++ 2012 x86 Additional Runtime - 11.0.60610
"{434D0820-3AA6-493A-80B9-301000028501}" = DiRT2
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4CB0307C-565E-4441-86BE-0DF2E4FB828C}" = Microsoft Games for Windows Marketplace
"{4E76FF7E-AEBA-4C87-B788-CD47E5425B9D}" = Skype™ 6.11
"{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"{5CAD3393-EEC0-44CE-9F93-BCAA365B77FB}" = Nikon Movie Editor
"{635FED5B-2C6D-49BE-87E6-7A6FCD22BC5A}" = Microsoft_VC90_MFC_x86
"{64E72FB1-2343-4977-B4A8-262CD53D0BD3}" = Corel Paint Shop Pro Photo X2
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{72EDA2AC-2908-4BB3-97E5-4F9DDEBF9731}" = HP Officejet 4620 series Hilfe
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{832D9DE0-8AFC-4689-9819-4DBBDEBD3E4F}" = Microsoft Games for Windows - LIVE Redistributable
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{846B5DED-DC8C-4E1A-B5B4-9F5B39A0CACE}" = HPDiagnosticAlert
"{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}" = HP Update
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{870F1750-BA89-11DA-A94D-0800200C9A66}_is1" = VSO CopyToDVD 4
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{8B922CF8-8A6C-41CE-A858-F1755D7F5D29}" = NVIDIA PhysX
"{91B33C97-0FBA-74AE-E802-D782F5C8AA89}_is1" = Ashampoo Burning Studio 2013 v.11.0.6
"{920DF926-D85A-4ED9-8F4D-7D98F0EAF2C6}" = CEWE FOTOBUCH PRO
"{92D58719-BBC1-4CC3-A08B-56C9E884CC2C}" = Microsoft_VC80_CRT_x86
"{933B4015-4618-4716-A828-5289FC03165F}" = VC80CRTRedist - 8.0.50727.6195
"{95716cce-fc71-413f-8ad5-56c2892d4b3a}" = Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.60610
"{99D5EF59-CF6F-4030-901B-4DDDB7F99403}" = Presto! PageManager 7.23
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{a1909659-0a08-4554-8af1-2175904903a1}" = Microsoft Visual C++ 2012 Redistributable (x64) - 11.0.60610
"{A49F249F-0C91-497F-86DF-B2585E8E76B7}" = Microsoft Visual C++ 2005 Redistributable
"{A78FE97A-C0C8-49CE-89D0-EDD524A17392}" = PDF Settings CS5
"{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-1033-F400-7760-000000000004}_955" = Adobe Acrobat 9.5.5 - CPSID_83708
"{AC76BA86-1033-F400-7760-000000000004}{AC76BA86-1033-F400-7760-000000000004}" = Adobe Acrobat 9 Pro - English, Français, Deutsch
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.01) - Deutsch
"{AEDBD563-24BB-4EE3-8366-A654DAC2D988}" = Mirror's Edge™
"{B014EE44-9197-4513-9613-71E6EB1B514E}" = Nikon Message Center 2
"{B67BAFBA-4C9F-48FA-9496-933E3B255044}" = QuickTime
"{B6CF2967-C81E-40C0-9815-C05774FEF120}" = Skype Click to Call
"{C4D738F7-996A-4C81-B8FA-C4E26D767E41}" = Windows Live Mail
"{C679F9B9-C65D-4C65-BD6C-BF90B859E281}" = Trust 100K Series Webcam
"{CA3AC3CC-3B2F-45F9-8C68-485269110A8D}" = OpticFilm 8100
"{CA6BCA2F-EDEB-408F-850B-31404BE16A61}" = I.R.I.S. OCR
"{D1A19B02-817E-4296-A45B-07853FD74D57}" = Microsoft_VC80_MFC_x86
"{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1" = Rapture3D 2.3.22 Game
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D92BBB52-82FF-42ED-8A3C-4E062F944AB7}" = Microsoft_VC80_MFCLOC_x86
"{E2DFE069-083E-4631-9B6C-43C48E991DE5}" = Junk Mail filter update
"{e7394a0f-3f80-45b1-87fc-abcd51893246}" = Python 2.6.4
"{E7D4E834-93EB-351F-B8FB-82CDAE623003}" = Microsoft Visual C++ 2012 x86 Minimum Runtime - 11.0.60610
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{ED00D08A-3C5F-488D-93A0-A04F21F23956}" = Windows Live Communications Platform
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E12BBA-AD66-4022-A453-A1C8A0C4D570}" = Microsoft Choice Guard
"{F5266D28-E0B2-4130-BFC5-EE155AD514DC}" = Apple Application Support
"{F8FF18EE-264A-43FD-B2F6-5EAD40798C2F}" = Windows Live Essentials
"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022
"7-Zip" = 7-Zip 9.20
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"ASIO4ALL" = ASIO4ALL
"Bandicam" = Bandicam
"BandiMPEG1" = Bandisoft MPEG-1 Decoder
"BattlEye for OA" = BattlEye for OA Uninstall
"Capture NX 2" = Capture NX 2
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"Codec-V" = Codec-V
"com.adobe.amp.E7BED6E5DDA59983786DD72EBFA46B1598278E07.1" = Adobe Media Player
"DivX Setup" = DivX Setup
"Dropbox Export Plug-in for Adobe Lightroom_is1" = Dropbox Export Plug-in version 1.5.0 for Adobe Lightroom
"EZ-RC" = EZ-RC
"FileZilla Client" = FileZilla Client 3.7.1
"Firestorm-Release" = Firestorm-Release (remove only)
"Free Download Manager_is1" = Free Download Manager 3.9.2
"HP Photo Creations" = HP Photo Creations
"InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}" = VIA Plattform-Geräte-Manager
"InstallWIX_{560985FB-4B76-4121-9189-7A2CDC7886D6}" = Kaspersky Internet Security 2013
"LineIn plugin for WinAMP" = LineIn plugin for WinAMP v1.80 (remove only)
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware version 1.75.0.1300
"Mozilla Firefox 26.0 (x86 de)" = Mozilla Firefox 26.0 (x86 de)
"Mozilla Thunderbird 17.0.5 (x86 de)" = Mozilla Thunderbird 17.0.5 (x86 de)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver
"OpenAL" = OpenAL
"Origin" = Origin
"PunkBusterSvc" = PunkBuster Services
"RaidCall" = RaidCall
"Rockstar Games Social Club" = Rockstar Games Social Club
"Secure Eraser_is1" = Secure Eraser
"SilverFast 8 x64" = SilverFast 8.0.1r5 (64bit)
"SpeedFan" = SpeedFan (remove only)
"Spyder4Elite" = Spyder4Elite
"SpyderPRINT" = SpyderPRINT
"SpyderStudio" = SpyderStudio
"Steam App 10180" = Call of Duty: Modern Warfare 2
"Steam App 10190" = Call of Duty: Modern Warfare 2 - Multiplayer
"Steam App 106000" = The Cursed Crusade
"Steam App 110800" = L.A. Noire
"Steam App 12210" = Grand Theft Auto IV
"Steam App 12220" = Grand Theft Auto: Episodes from Liberty City
"Steam App 13140" = America's Army 3
"Steam App 203140" = Hitman: Absolution
"Steam App 203290" = America's Army: Proving Grounds Beta
"Steam App 204100" = Max Payne 3
"Steam App 205930" = Hitman: Sniper Challenge
"Steam App 219540" = Arma 2: Operation Arrowhead Beta
"Steam App 221910" = The Stanley Parable
"Steam App 224260" = No More Room in Hell
"Steam App 230410" = Warframe
"Steam App 233450" = Prison Architect
"Steam App 236390" = War Thunder
"Steam App 244850" = Space Engineers
"Steam App 251040" = PAYDAY 2 Demo
"Steam App 33930" = Arma 2: Operation Arrowhead
"Steam App 47870" = Need for Speed: Hot Pursuit
"Steam App 49520" = Borderlands 2
"Steam App 64000" = Men of War: Assault Squad
"TeamSpeak 3 Client" = TeamSpeak 3 Client
"VSO DivxToDVD_is1" = DivxToDVD 0.5.2b
"Wacom WebTabletPlugin for IE" = WebTablet IE Plugin
"Wacom WebTabletPlugin for Internet Explorer and Netscape" = WebTablet FB Plugin 32 bit
"Wacom WebTabletPlugin for Netscape" = WebTablet Netscape Plugin
"Winamp" = Winamp
"WinLiveSuite_Wave3" = Windows Live Essentials
"Xvid Video Codec 1.3.2" = Xvid Video Codec
========== HKEY_USERS Uninstall List ==========
[HKEY_USERS\S-1-5-21-3423161360-200612408-4252266538-1000\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Dropbox" = Dropbox
"Google Chrome" = Google Chrome
"Mozilla Thunderbird 24.2.0 (x86 de)" = Mozilla Thunderbird 24.2.0 (x86 de)
"Winamp Detect" = Winamp Detector Plug-in
========== Last 20 Event Log Errors ==========
[ Application Events ]
Error - 08.01.2014 09:50:33 | Computer Name = Dustin-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "E:\Programme\Adobe\Acrobat
9 Pro\Designer 8.2\FormDesigner.exe". Fehler in Manifest- oder Richtliniendatei
"" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt
mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:.
Komponente
1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
Error - 08.01.2014 09:50:33 | Computer Name = Dustin-PC | Source = SideBySide | ID = 16842832
Description = Fehler beim Generieren des Aktivierungskontexts für "E:\Programme\Adobe\Acrobat
9 Pro\Designer 8.2\FormDesigner.exe". Fehler in Manifest- oder Richtliniendatei
"" in Zeile . Eine für die Anwendung erforderliche Komponentenversion steht in Konflikt
mit einer anderen, bereits aktiven Komponentenversion. In Konflikt stehende Komponenten:.
Komponente
1: C:\Windows\WinSxS\manifests\amd64_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_fa396087175ac9ac.manifest.
Komponente
2: C:\Windows\WinSxS\manifests\x86_microsoft.windows.common-controls_6595b64144ccf1df_6.0.7601.17514_none_41e6975e2bd6f2b2.manifest.
< End of report >

Broni · Jan 8, 2014

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following

Code:

:OTL
FF - user.js - File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_9_900_170.dll File not found
FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll File not found
O2:64bit: - BHO: (Webroot Vault) - {c8d5d964-2be8-4c5b-8cf5-6e975aa88504} - C:\ProgramData\WRData\pkg\LPBar64.dll File not found
O4 - HKLM..\Run: [] File not found
O4 - HKU\S-1-5-21-3423161360-200612408-4252266538-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\UpdatusUser.Dustin-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uninstall Webroot RunOnce.lnk = C:\Program Files (x86)\Common Files\wruninstall.exe (Webroot Software, Inc.)
O8:64bit: - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\Office\Office10\EXCEL.EXE/3000 File not found
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://E:\PROGRA~1\Office\Office10\EXCEL.EXE/3000 File not found
O9:64bit: - Extra Button: Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\pkg\LPBar64.dll File not found
O9:64bit: - Extra 'Tools' menuitem : Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - C:\ProgramData\WRData\pkg\LPBar64.dll File not found
O9 - Extra Button: Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - Reg Error: Key error. File not found
O9 - Extra 'Tools' menuitem : Webroot - {43699cd0-e34f-11de-8a39-0800200c9a66} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\0x00000001 - No CLSID value found
O18:64bit: - Protocol\Handler\msdaipp\oledb - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18:64bit: - Protocol\Handler\wlmailhtml - No CLSID value found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O29:64bit: - HKLM SecurityProviders - (msapsspc.dll) - File not found
O29:64bit: - HKLM SecurityProviders - (digest.dll) - File not found
O29:64bit: - HKLM SecurityProviders - (msnsspc.dll) - File not found
O29 - HKLM SecurityProviders - (msapsspc.dll) - File not found
O29 - HKLM SecurityProviders - (digest.dll) - File not found
O29 - HKLM SecurityProviders - (msnsspc.dll) - File not found
@Alternate Data Stream - 58 bytes -> C:\Users\Dustin\Desktop\Info.rtf:com.dropbox.attributes
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:D1B5B4F1

:Services

:Reg

:Files
C:\FRST

:Commands
[purity]
[emptytemp]
[emptyjava]
[emptyflash]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
You will get a log that shows the results of the fix. Please post it.

NOTE. If for any reason OTL stalls (most likely at "killing processes..." step) run the fix from safe mode.

Last scans...

Download Security Check from here or here and save it to your Desktop.

Double-click SecurityCheck.exe
Follow the onscreen instructions inside of the black box.
A Notepad document should open automatically called checkup.txt; please post the contents of that document.

NOTE 1. If one of your security applications (e.g., third-party firewall) requests permission to allow DIG.EXE access the Internet, allow it to do so.
NOTE 2 SecurityCheck may produce some false warning(s), so leave the results reading to me.

Please download Farbar Service Scanner (FSS) and run it on the computer with the issue.

Make sure the following options are checked:
- Internet Services
- Windows Firewall
- System Restore
- Security Center
- Windows Update
- Windows Defender
- Other Services
Press "Scan".
It will create a log (FSS.txt) in the same directory the tool is run.
Please copy and paste the log to your reply.

Download Temp File Cleaner (TFC)
Alternate download: http://www.itxassociates.com/OT-Tools/TFC.exe

Double click on TFC.exe to run the program.
Click on Start button to begin cleaning process.
TFC will close all running programs, and it may ask you to restart computer.

Please run a free online scan with the ESET Online Scanner

Disable your antivirus program
Click on "Run ESET Online Scanner" button.
Tick the box next to YES, I accept the Terms of Use
Click Start
Accept any security warnings from your browser.
Check Scan archives
Click Start
ESET will then download updates for itself, install itself, and begin scanning your computer. Please be patient as this can take some time.
When the scan completes, click on List of found threats
Click on Export to text file , and save the file to your desktop using a unique name, such as ESETScan. Include the contents of this report in your next reply.
NOTE. If Eset won't find any threats, it won't produce any log.

-Z3RO- · Jan 9, 2014

OTL Log:

01092014_171854.log
-----------------------------

All processes killed
========== OTL ==========
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@adobe.com/FlashPlayer\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{c8d5d964-2be8-4c5b-8cf5-6e975aa88504}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{c8d5d964-2be8-4c5b-8cf5-6e975aa88504}\ deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3423161360-200612408-4252266538-1004\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
C:\Users\UpdatusUser.Dustin-PC\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Uninstall Webroot RunOnce.lnk moved successfully.
C:\Program Files (x86)\Common Files\wruninstall.exe moved successfully.
64bit-Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ deleted successfully.
Registry key HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\MenuExt\Nach Microsoft &Excel exportieren\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{43699cd0-e34f-11de-8a39-0800200c9a66}\ deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43699cd0-e34f-11de-8a39-0800200c9a66}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{43699cd0-e34f-11de-8a39-0800200c9a66}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43699cd0-e34f-11de-8a39-0800200c9a66}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{43699cd0-e34f-11de-8a39-0800200c9a66}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43699cd0-e34f-11de-8a39-0800200c9a66}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Extensions\{43699cd0-e34f-11de-8a39-0800200c9a66}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{43699cd0-e34f-11de-8a39-0800200c9a66}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\ deleted successfully.
File Protocol\Handler\msdaipp - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\0x00000001\ not found.
File Protocol\Handler\msdaipp\0x00000001 - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\msdaipp\oledb\ not found.
File Protocol\Handler\msdaipp\oledb - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\skype4com\ deleted successfully.
File Protocol\Handler\skype4com - No CLSID value found not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\PROTOCOLS\Handler\wlmailhtml\ deleted successfully.
File Protocol\Handler\wlmailhtml - No CLSID value found not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad\\WebCheck deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{E6FB5E20-DE35-11CF-9C87-00AA005127ED}\ not found.
64bit-Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:msapsspc.dll deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:digest.dll deleted successfully.
64bit-Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:msnsspc.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:msapsspc.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:digest.dll deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SecurityProviders\\SecurityProviders:msnsspc.dll deleted successfully.
ADS C:\Users\Dustin\Desktop\Info.rtf:com.dropbox.attributes deleted successfully.
ADS C:\ProgramData\TEMP

1B5B4F1 deleted successfully.
========== SERVICES/DRIVERS ==========
========== REGISTRY ==========
========== FILES ==========
File\Folder C:\FRST not found.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 67 bytes
->Flash cache emptied: 58264 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Dustin
->Temp folder emptied: 5584370 bytes
->Temporary Internet Files folder emptied: 130647 bytes
->Java cache emptied: 144717 bytes
->FireFox cache emptied: 104467745 bytes
->Google Chrome cache emptied: 8416082 bytes
->Apple Safari cache emptied: 17606656 bytes
->Flash cache emptied: 2637 bytes
User: Public
->Temp folder emptied: 0 bytes
User: UpdatusUser
->Temp folder emptied: 0 bytes
User: UpdatusUser.Dustin-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 356352 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 12986 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 20262459 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 150,00 mb
[EMPTYJAVA]
User: All Users
User: Default
User: Default User
User: Dustin
->Java cache emptied: 0 bytes
User: Public
User: UpdatusUser
User: UpdatusUser.Dustin-PC
Total Java Files Cleaned = 0,00 mb
[EMPTYFLASH]
User: All Users
User: Default
->Flash cache emptied: 0 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Dustin
->Flash cache emptied: 0 bytes
User: Public
User: UpdatusUser
User: UpdatusUser.Dustin-PC
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0,00 mb
OTL by OldTimer - Version 3.2.69.0 log created on 01092014_171854

Files\Folders moved on Reboot...
C:\Users\Dustin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Dustin\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

-Z3RO- · Jan 9, 2014

Security Check

checkup.txt
---------------

Results of screen317's Security Check version 0.99.78
Windows 7 Service Pack 1 x64 (UAC is enabled)
Internet Explorer 10 Out of date!
``````````````Antivirus/Firewall Check:``````````````
Kaspersky Internet Security
Antivirus up to date!
`````````Anti-malware/Other Utilities Check:`````````
Spyder4Elite
SpyderPRINT
SpyderStudio
Malwarebytes Anti-Malware version 1.75.0.1300
Java 7 Update 45
Adobe Flash Player 11.9.900.170
Adobe Reader XI
Mozilla Firefox (26.0)
Mozilla Thunderbird (17.0.5)
Google Chrome 31.0.1650.57
Google Chrome 31.0.1650.63
Google Chrome Plugins...
````````Process Check: objlist.exe by Laurent````````
Malwarebytes Anti-Malware mbamservice.exe
Malwarebytes Anti-Malware mbamgui.exe
Malwarebytes' Anti-Malware mbamscheduler.exe
Kaspersky Lab Kaspersky Internet Security 2013 avp.exe
`````````````````System Health check`````````````````
Total Fragmentation on Drive C:
````````````````````End of Log``````````````````````

Total Fragmentation on Drive C

.... You wouldn't happen to have an effective way to defragment? cuz when I last looked into the C Drives Fragmentation it wasn't that bad according to Windows

-Z3RO- · Jan 9, 2014

FFS.txt
----------

Farbar Service Scanner Version: 08-01-2014
Ran by Dustin (administrator) on 09-01-2014 at 17:53:22
Running from "C:\Users\Dustin\Desktop"
Microsoft Windows 7 Home Premium Service Pack 1 (X64)
Boot Mode: Normal
****************************************************************

Internet Services:
============

Connection Status:
==============
Localhost is accessible.
LAN connected.
Google IP is accessible.
Google.com is accessible.
Yahoo.com is accessible.

Windows Firewall:
=============

Firewall Disabled Policy:
==================
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall"=DWORD:0

System Restore:
============

System Restore Disabled Policy:
========================

Action Center:
============

Windows Update:
============

Windows Autoupdate Disabled Policy:
============================

Windows Defender:
==============

Other Services:
==============

File Check:
========
C:\Windows\System32\nsisvc.dll => MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys => MD5 is legit
C:\Windows\System32\dhcpcore.dll => MD5 is legit
C:\Windows\System32\drivers\afd.sys => MD5 is legit
C:\Windows\System32\drivers\tdx.sys => MD5 is legit
C:\Windows\System32\Drivers\tcpip.sys => MD5 is legit
C:\Windows\System32\dnsrslvr.dll => MD5 is legit
C:\Windows\System32\mpssvc.dll => MD5 is legit
C:\Windows\System32\bfe.dll => MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys => MD5 is legit
C:\Windows\System32\SDRSVC.dll => MD5 is legit
C:\Windows\System32\vssvc.exe => MD5 is legit
C:\Windows\System32\wscsvc.dll => MD5 is legit
C:\Windows\System32\wbem\WMIsvc.dll => MD5 is legit
C:\Windows\System32\wuaueng.dll => MD5 is legit
C:\Windows\System32\qmgr.dll => MD5 is legit
C:\Windows\System32\es.dll => MD5 is legit
C:\Windows\System32\cryptsvc.dll => MD5 is legit
C:\Program Files\Windows Defender\MpSvc.dll => MD5 is legit
C:\Windows\System32\ipnathlp.dll => MD5 is legit
C:\Windows\System32\iphlpsvc.dll => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit

**** End of log ****

-Z3RO- · Jan 9, 2014

Don't know if you need this, just though I would post it in case you do...

TFC
------

Getting user folders.
Stopping running processes.
Emptying Temp folders.
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Dustin
->Temp folder emptied: 2736459 bytes
->Temporary Internet Files folder emptied: 128 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 16534839 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 492 bytes
User: Public
->Temp folder emptied: 0 bytes
User: UpdatusUser
->Temp folder emptied: 0 bytes
User: UpdatusUser.Dustin-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 10472 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 92943 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 753 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
Emptying RecycleBin. Do not interrupt.
RecycleBin emptied: 0 bytes
Process complete!
Total Files Cleaned = 18,00 mb

-Z3RO- · Jan 9, 2014

ESET

No Theats

Broni · Jan 9, 2014

You don't need to defrag right now.
"Total Fragmentation on Drive C:" doesn't list any number which means there is no need to defrag.

===================================

Your computer is clean

1. We need to reset system restore to prevent your computer from being accidentally reinfected by using some old restore point(s). We'll create fresh, clean restore point, using following OTL script:

Run OTL

Under the Custom Scans/Fixes box at the bottom, paste in the following:

Code:

:OTL
:Commands
[purity]
[emptytemp]
[EMPTYFLASH]
[emptyjava]
[CLEARALLRESTOREPOINTS]
[Reboot]

Then click the Run Fix button at the top
Let the program run unhindered, reboot the PC when it is done
Post resulting log.

2. Now, we'll remove all tools, we used during our cleaning process

Clean up with OTL:

Double-click OTL.exe to start the program.
Close all other programs apart from OTL as this step will require a reboot
On the OTL main screen, press the CLEANUP button
Say Yes to the prompt and then allow the program to reboot your computer.

If you still have any tools or logs leftover on your computer you can go ahead and delete those off of your computer now.

3. Make sure Windows Updates are current.

4. If any trojans, rootkits or bootkits were listed among your infection(s), make sure, you change all of your on-line important passwords (bank account(s), secured web sites, etc.) immediately!

5. Check if your browser plugins are up to date.
Firefox - https://www.mozilla.org/en-US/plugincheck/
other browsers: https://browsercheck.qualys.com/ (click on "Launch a quick scan now" link)

6. Download, and install WOT (Web OF Trust): http://www.mywot.com/. It'll warn you (in most cases) about dangerous web sites.

7. Run Malwarebytes "Quick scan" once in a while to assure safety of your computer.

8. Run Temporary File Cleaner (TFC), AdwCleaner and Junkware Removal Tool (JRT) weekly.

9. Download and install Secunia Personal Software Inspector (PSI): https://www.techspot.com/downloads/4898-secunia-personal-software-inspector-psi.html. The Secunia PSI is a FREE security tool designed to detect vulnerable and out-dated programs and plug-ins which expose your PC to attacks. Run it weekly.

10. (optional) If you want to keep all your programs up to date, download and install FileHippo Update Checker.
The Update Checker will scan your computer for installed software, check the versions and then send this information to FileHippo.com to see if there are any newer releases.

11. (Windows XP only) Run defrag at your convenience.

12. When installing\updating ANY program, make sure you always select "Custom " installation, so you can UN-check any possible "drive-by-install" (foistware), like toolbars etc., which may try to install along with the legitimate program. Do NOT click "Next" button without looking at any given page.

13. Read:
How did I get infected?, With steps so it does not happen again!: http://www.bleepingcomputer.com/forums/topic2520.html
Simple and easy ways to keep your computer safe and secure on the Internet: http://www.bleepingcomputer.com/tutorials/keep-your-computer-safe-online/

14. Please, let me know, how your computer is doing.

-Z3RO- · Jan 10, 2014

OTL:

01102014_091926.txt
----------------------------

All processes killed
========== OTL ==========
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Dustin
->Temp folder emptied: 1653916 bytes
->Temporary Internet Files folder emptied: 128 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 47079390 bytes
->Google Chrome cache emptied: 0 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 492 bytes
User: Public
->Temp folder emptied: 0 bytes
User: UpdatusUser
->Temp folder emptied: 0 bytes
User: UpdatusUser.Dustin-PC
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 9632 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 0 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 46,00 mb
[EMPTYFLASH]
User: All Users
User: Default
->Flash cache emptied: 0 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Dustin
->Flash cache emptied: 0 bytes
User: Public
User: UpdatusUser
User: UpdatusUser.Dustin-PC
->Flash cache emptied: 0 bytes
Total Flash Files Cleaned = 0,00 mb
[EMPTYJAVA]
User: All Users
User: Default
User: Default User
User: Dustin
->Java cache emptied: 0 bytes
User: Public
User: UpdatusUser
User: UpdatusUser.Dustin-PC
Total Java Files Cleaned = 0,00 mb
Restore point Set: OTL Restore Point
OTL by OldTimer - Version 3.2.69.0 log created on 01102014_091826

Files\Folders moved on Reboot...
C:\Users\Dustin\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.
C:\Users\Dustin\AppData\Local\Microsoft\Windows\Temporary Internet Files\counters.dat moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...

Solved Freemium Free Paperball - Software Updater

Posts: 20 +0

Attachments

Posts: 56,041 +516

Posts: 20 +0

Posts: 56,041 +516

Posts: 20 +0

Posts: 20 +0

Posts: 20 +0

Posts: 56,041 +516

Posts: 20 +0

Posts: 56,041 +516

Posts: 20 +0

Attachments

Posts: 20 +0

Posts: 20 +0

Posts: 20 +0

Posts: 20 +0

Posts: 20 +0

Posts: 20 +0

Posts: 56,041 +516

Posts: 20 +0

Posts: 20 +0

Posts: 20 +0

Posts: 20 +0

Posts: 20 +0

Posts: 56,041 +516

Posts: 20 +0

Similar threads