Hallo zusammen,

ich habe mir gestern die Demo von Avatar runter geladen und wollte sie heute installieren. Während der Installation kam jedoch folgende Virusmeldung
"Beim Öffnen der Datei C:\Users\AppData\LocalTemp\IXP000.TMP\VCREDI~3.EXE wurde der Virus Win32Trojan-gen (Engine B) entdeckt."
Ich habe dann versucht die Datei zu bereinigen und jetzt steht im Protokoll meines GData Antivirus 2010 dass der Zugriff verweigert wurde. Per Hand finde ich die Datei auch nicht mehr.

Ich bin mir jedoch trotzdem nicht sicher, in wieweit mein System jetzt wieder sauber ist oder noch infiziert.

Anbei mein Malwarebytes Scan Berichte:

"Malwarebytes' Anti-Malware 1.41
Datenbank Version: 3195
Windows 6.0.6002 Service Pack 2

19.11.2009 15:52:20
mbam-log-2009-11-19 (15-52-20).txt

Scan-Methode: Vollständiger Scan (C:\|L:\|)
Durchsuchte Objekte: 362522
Laufzeit: 1 hour(s), 31 minute(s), 41 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\NoActiveDesktopChanges (Hijack.DisplayProperties) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)"

Die Berichte von RSIT sind leider zu groß, deshalb muss ich sie zerstückelt rein stellen... sorry dafür

Logfile of random's system information tool 1.06 (written by random/random)
Run by Martin at 2009-11-19 15:59:46
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 136 GB (26%) free of 514 GB
Total RAM: 8190 MB (77% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:59:57, on 19.11.2009
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18828)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe
C:\Program Files (x86)\G DATA\AntiVirus\AVKTray\AVKTray.exe
C:\Program Files (x86)\Adobe\Reader 9.0\Reader\reader_sl.exe
C:\Program Files (x86)\Mozilla Firefox\firefox.exe
C:\Users\Martin\Desktop\Anti-Virus Programme\RSIT.exe
C:\Program Files (x86)\HijackThis\Martin.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: SnagIt Toolbar Loader - {00C6482D-C502-44C8-8409-FCE54AD9C208} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll
O2 - BHO: G Data WebFilter Class - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\AntiVirus\Webfilter\AVKWebIE.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Skype add-on (mastermind) - {22BF413B-C6D2-4d91-82A9-A0F997BA588C} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O3 - Toolbar: G Data WebFilter - {0124123D-61B4-456f-AF86-78C53A0790C5} - C:\Program Files (x86)\G DATA\AntiVirus\Webfilter\AVKWebIE.dll
O3 - Toolbar: Snagit - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll
O4 - HKLM\..\Run: [G DATA AntiVirus Trayapplication] C:\Program Files (x86)\G DATA\AntiVirus\AVKTray\AVKTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\Run: [ Malwarebytes Anti-Malware (reboot)] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe" /runcleanupscript
O4 - HKCU\..\Run: [Sidebar] C:\Program Files\Windows Sidebar\sidebar.exe /autoRun
O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe" -autorun
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~2\MICROS~1\Office12\EXCEL.EXE/3000
O9 - Extra button: Skype - {77BF5300-1474-4EC7-9980-D32B190E9B07} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll
O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~2\MICROS~1\Office12\REFIEBAR.DLL
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files (x86)\ICQ6.5\ICQ.exe
O13 - Gopher Prefix:
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - h**p://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - h**p://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe LM Service - Adobe Systems - C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: ASP.NET-Zustandsdienst (aspnet_state) - Unknown owner - C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe (file missing)
O23 - Service: G Data AntiVirus Proxy (AVKProxy) - G Data Software AG - C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe
O23 - Service: G Data Scheduler (AVKService) - G Data Software AG - C:\Program Files (x86)\G DATA\AntiVirus\AVK\AVKService.exe
O23 - Service: G Data Dateisystem Wächter (AVKWCtl) - G Data Software AG - C:\Program Files (x86)\G DATA\AntiVirus\AVK\AVKWCtlX64.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: G Data Scanner (GDScan) - G Data Software AG - C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files (x86)\Common Files\Steam\SteamService.exe
O23 - Service: @%SystemRoot%\System32\TuneUpDefragService.exe,-1 (TuneUp.Defrag) - Unknown owner - C:\Windows\System32\TuneUpDefragService.exe (file missing)
O23 - Service: @%SystemRoot%\System32\TUProgSt.exe,-1 (TuneUp.ProgramStatisticsSvc) - Unknown owner - C:\Windows\System32\TUProgSt.exe (file missing)
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8284 bytes

======Scheduled tasks folder======

C:\Windows\tasks\1-Klick-Wartung.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{00C6482D-C502-44C8-8409-FCE54AD9C208}]
SnagIt Toolbar Loader - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitBHO.dll [2009-04-28 68936]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{0124123D-61B4-456f-AF86-78C53A0790C5}]
G Data WebFilter - C:\Program Files (x86)\G DATA\AntiVirus\Webfilter\AVKWebIE.dll [2009-09-18 594504]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{22BF413B-C6D2-4d91-82A9-A0F997BA588C}]
Skype add-on (mastermind) - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\SkypeIEPlugin.dll [2009-03-27 1088296]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{0124123D-61B4-456f-AF86-78C53A0790C5} - G Data WebFilter - C:\Program Files (x86)\G DATA\AntiVirus\Webfilter\AVKWebIE.dll [2009-09-18 594504]
{8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - Snagit - C:\Program Files (x86)\TechSmith\Snagit 9\SnagitIEAddin.dll [2009-04-28 211272]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"G DATA AntiVirus Trayapplication"=C:\Program Files (x86)\G DATA\AntiVirus\AVKTray\AVKTray.exe [2009-09-18 924232]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288]
" Malwarebytes Anti-Malware (reboot)"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbam.exe [2009-09-10 1312080]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"=C:\Program Files\Windows Sidebar\sidebar.exe [2009-04-11 1555968]
"DAEMON Tools Lite"=C:\Program Files (x86)\DAEMON Tools Lite\daemon.exe [2008-07-24 490952]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"ForceActiveDesktopOn"=
"BindDirectlyToPropertySetStorage"=
"NoActiveDesktopChanges"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2ee4c15a-b013-11dd-82be-806e6f6e6963}]
shell\AutoRun\command - D:\setup.exe /autorun

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{2fc6043d-faa9-11dd-a56e-00508dbcfe80}]
shell\AutoRun\command - C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe SPEEDYGONZALES.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{9ae6c1b9-6c68-11de-9119-00508dbcfe80}]
shell\AutoRun\command - F:\Menu.exe


======File associations======

.js - edit - C:\Windows\SysWOW64\Notepad.exe %1
.js - open - C:\Windows\SysWOW64\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2009-11-19 15:59:46 ----D---- C:\rsit
2009-11-19 14:18:47 ----D---- C:\Users\Martin\AppData\Roaming\Malwarebytes
2009-11-19 14:18:37 ----D---- C:\ProgramData\Malwarebytes
2009-11-19 14:18:36 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2009-11-19 14:10:58 ----D---- C:\Program Files (x86)\CCleaner
2009-11-19 14:02:35 ----D---- C:\Program Files (x86)\HijackThis
2009-11-11 10:15:46 ----A---- C:\Windows\system32\WSDApi.dll
2009-11-10 23:50:20 ----D---- C:\ProgramData\KONAMI
2009-11-09 16:32:07 ----A---- C:\Windows\system32\javaws.exe
2009-11-09 16:32:07 ----A---- C:\Windows\system32\javaw.exe
2009-11-09 16:32:07 ----A---- C:\Windows\system32\java.exe
2009-11-06 21:42:00 ----D---- C:\Program Files (x86)\ProtectDisc Driver Installer
2009-11-03 11:30:44 ----A---- C:\Windows\system32\mshtml.dll
2009-11-02 17:12:03 ----A---- C:\Windows\system32\d3dx10_41.dll
2009-11-02 17:12:03 ----A---- C:\Windows\system32\D3DCompiler_41.dll
2009-11-02 17:12:00 ----A---- C:\Windows\system32\D3DX9_41.dll
2009-11-02 17:11:56 ----A---- C:\Windows\system32\XAudio2_4.dll
2009-11-02 17:11:56 ----A---- C:\Windows\system32\XAPOFX1_3.dll
2009-11-02 17:11:54 ----A---- C:\Windows\system32\xactengine3_4.dll
2009-11-02 17:11:52 ----A---- C:\Windows\system32\X3DAudio1_6.dll
2009-11-02 17:11:48 ----A---- C:\Windows\system32\d3dx10_40.dll
2009-11-02 17:11:48 ----A---- C:\Windows\system32\D3DCompiler_40.dll
2009-11-02 17:11:44 ----A---- C:\Windows\system32\D3DX9_40.dll
2009-10-29 10:41:11 ----D---- C:\Program Files (x86)\Windows Portable Devices
2009-10-29 10:39:16 ----A---- C:\Windows\system32\WMPhoto.dll
2009-10-29 10:39:15 ----A---- C:\Windows\system32\XpsRasterService.dll
2009-10-29 10:39:15 ----A---- C:\Windows\system32\XpsGdiConverter.dll
2009-10-29 10:39:15 ----A---- C:\Windows\system32\WindowsCodecsExt.dll
2009-10-29 10:39:15 ----A---- C:\Windows\system32\WindowsCodecs.dll
2009-10-29 10:39:15 ----A---- C:\Windows\system32\dxdiagn.dll
2009-10-29 10:39:15 ----A---- C:\Windows\system32\d3d10warp.dll
2009-10-29 10:39:15 ----A---- C:\Windows\system32\d2d1.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\xpsservices.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\XpsPrint.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\OpcServices.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\dxgi.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\dxdiag.exe
2009-10-29 10:39:14 ----A---- C:\Windows\system32\DWrite.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\d3d11.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\d3d10level9.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\d3d10core.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\d3d10_1core.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\d3d10_1.dll
2009-10-29 10:39:14 ----A---- C:\Windows\system32\d3d10.dll
2009-10-29 10:38:51 ----A---- C:\Windows\system32\WPDShextAutoplay.exe
2009-10-29 10:38:47 ----A---- C:\Windows\system32\wpdshext.dll
2009-10-29 10:38:46 ----A---- C:\Windows\system32\WPDSp.dll
2009-10-29 10:38:46 ----A---- C:\Windows\system32\WPDShServiceObj.dll
2009-10-29 10:38:46 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll
2009-10-29 10:38:46 ----A---- C:\Windows\system32\PortableDeviceTypes.dll
2009-10-29 10:38:46 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll
2009-10-29 10:38:46 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll
2009-10-29 10:38:46 ----A---- C:\Windows\system32\PortableDeviceApi.dll
2009-10-29 10:37:57 ----A---- C:\Windows\system32\oleaccrc.dll
2009-10-29 10:37:56 ----A---- C:\Windows\system32\UIAutomationCore.dll
2009-10-29 10:37:56 ----A---- C:\Windows\system32\oleacc.dll
2009-10-29 10:37:30 ----A---- C:\Windows\system32\UIRibbonRes.dll
2009-10-29 10:37:30 ----A---- C:\Windows\system32\UIRibbon.dll
2009-10-29 10:37:30 ----A---- C:\Windows\system32\UIAnimation.dll
2009-10-29 10:36:45 ----A---- C:\Windows\system32\wmp.dll
2009-10-29 10:36:44 ----A---- C:\Windows\system32\unregmp2.exe
2009-10-29 10:36:43 ----A---- C:\Windows\system32\wmploc.DLL

======List of files/folders modified in the last 1 months======

2009-11-19 15:59:50 ----D---- C:\Windows\Temp
2009-11-19 15:56:30 ----D---- C:\Windows
2009-11-19 15:49:37 ----D---- C:\Users\Martin\AppData\Roaming\Skype
2009-11-19 14:18:38 ----D---- C:\Windows\system32\drivers
2009-11-19 14:18:37 ----D---- C:\ProgramData
2009-11-19 14:18:36 ----D---- C:\Program Files (x86)
2009-11-19 14:18:21 ----D---- C:\Windows\Prefetch
2009-11-19 14:13:17 ----D---- C:\Windows\Debug
2009-11-19 13:15:46 ----RSD---- C:\Windows\assembly
2009-11-19 13:14:52 ----SHD---- C:\System Volume Information
2009-11-19 13:12:16 ----HD---- C:\Program Files (x86)\InstallShield Installation Information
2009-11-19 12:22:34 ----D---- C:\Users\Martin\AppData\Roaming\skypePM
2009-11-19 08:46:44 ----D---- C:\Windows\System32
2009-11-19 08:46:44 ----D---- C:\Windows\inf
2009-11-12 21:26:25 ----D---- C:\Users\Martin\AppData\Roaming\dvdcss
2009-11-11 14:30:06 ----SHD---- C:\Windows\Installer
2009-11-11 10:35:44 ----D---- C:\Windows\winsxs
2009-11-11 10:18:42 ----D---- C:\Windows\SysWOW64
2009-11-11 10:16:15 ----D---- C:\Program Files (x86)\Windows Mail
2009-11-10 00:53:08 ----D---- C:\Program Files (x86)\Mozilla Firefox
2009-11-09 16:28:03 ----D---- C:\Program Files (x86)\Java
2009-11-03 22:06:20 ----D---- C:\Program Files (x86)\Common Files
2009-10-29 11:03:15 ----D---- C:\Windows\rescache
2009-10-29 10:41:11 ----RD---- C:\Program Files
2009-10-29 10:41:11 ----D---- C:\Windows\system32\wbem
2009-10-29 10:41:11 ----D---- C:\Windows\system32\de-DE
2009-10-29 10:41:11 ----D---- C:\Program Files (x86)\Windows Media Player
2009-10-29 10:41:09 ----D---- C:\Windows\system32\zh-TW
2009-10-29 10:41:09 ----D---- C:\Windows\system32\zh-HK
2009-10-29 10:41:09 ----D---- C:\Windows\system32\zh-CN
2009-10-29 10:41:09 ----D---- C:\Windows\system32\uk-UA
2009-10-29 10:41:09 ----D---- C:\Windows\system32\tr-TR
2009-10-29 10:41:09 ----D---- C:\Windows\system32\th-TH
2009-10-29 10:41:09 ----D---- C:\Windows\system32\sv-SE
2009-10-29 10:41:09 ----D---- C:\Windows\system32\sr-Latn-CS
2009-10-29 10:41:09 ----D---- C:\Windows\system32\sl-SI
2009-10-29 10:41:09 ----D---- C:\Windows\system32\sk-SK
2009-10-29 10:41:09 ----D---- C:\Windows\system32\ru-RU
2009-10-29 10:41:09 ----D---- C:\Windows\system32\ro-RO
2009-10-29 10:41:09 ----D---- C:\Windows\system32\pt-PT
2009-10-29 10:41:09 ----D---- C:\Windows\system32\pt-BR
2009-10-29 10:41:09 ----D---- C:\Windows\system32\pl-PL
2009-10-29 10:41:09 ----D---- C:\Windows\system32\nl-NL
2009-10-29 10:41:09 ----D---- C:\Windows\system32\nb-NO
2009-10-29 10:41:09 ----D---- C:\Windows\system32\lv-LV
2009-10-29 10:41:09 ----D---- C:\Windows\system32\lt-LT
2009-10-29 10:41:09 ----D---- C:\Windows\system32\ko-KR
2009-10-29 10:41:09 ----D---- C:\Windows\system32\ja-JP
2009-10-29 10:41:09 ----D---- C:\Windows\system32\it-IT
2009-10-29 10:41:09 ----D---- C:\Windows\system32\hu-HU
2009-10-29 10:41:09 ----D---- C:\Windows\system32\hr-HR
2009-10-29 10:41:09 ----D---- C:\Windows\system32\he-IL
2009-10-29 10:41:09 ----D---- C:\Windows\system32\fr-FR
2009-10-29 10:41:09 ----D---- C:\Windows\system32\fi-FI
2009-10-29 10:41:09 ----D---- C:\Windows\system32\et-EE
2009-10-29 10:41:09 ----D---- C:\Windows\system32\es-ES
2009-10-29 10:41:09 ----D---- C:\Windows\system32\en-US
2009-10-29 10:41:09 ----D---- C:\Windows\system32\el-GR
2009-10-29 10:41:09 ----D---- C:\Windows\system32\da-DK
2009-10-29 10:41:09 ----D---- C:\Windows\system32\cs-CZ
2009-10-29 10:41:09 ----D---- C:\Windows\system32\bg-BG
2009-10-29 10:41:09 ----D---- C:\Windows\system32\ar-SA
2009-10-29 10:37:26 ----D---- C:\Program Files (x86)\Internet Explorer
2009-10-28 10:06:33 ----D---- C:\Windows\SoftwareDistribution

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 gdwfpcd;G DATA WFP CD; C:\Windows\system32\DRIVERS\gdwfpcd64.sys []
R1 GRD;G Data Rootkit Detector Driver; \??\C:\Windows\system32\drivers\GRD.sys []
R2 acedrv11;acedrv11; \??\C:\Windows\system32\drivers\acedrv11.sys []
R2 atksgt;atksgt; C:\Windows\system32\DRIVERS\atksgt.sys []
R2 lirsgt;lirsgt; C:\Windows\system32\DRIVERS\lirsgt.sys []
R3 GDMnIcpt;GDMnIcpt; \??\C:\Windows\system32\drivers\MiniIcpt.sys []
R3 HookCentre;HookCentre; \??\C:\Windows\system32\drivers\HookCentre.sys []
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\Windows\system32\drivers\RTKVHD64.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 lvpepf64;Volume Adapter; C:\Windows\system32\DRIVERS\lv302a64.sys []
R3 LVUSBS64;Logitech USB Monitor Filter; C:\Windows\system32\drivers\LVUSBS64.sys []
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys []
R3 PID_PEPI;Logitech QuickCam IM(PID_PEPI); C:\Windows\system32\DRIVERS\LV302V64.SYS []
R3 usbaudio;USB-Audiotreiber (WDM); C:\Windows\system32\drivers\usbaudio.sys []
R3 yukonx64;NDIS6.0 Miniporttreiber für Marvell Yukon-Ethernet-Controller; C:\Windows\system32\DRIVERS\yk60x64.sys []
S3 axhfo135;axhfo135; C:\Windows\system32\drivers\axhfo135.sys []
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys []
S3 GearAspiWDM;GEARAspiWDM; C:\Windows\System32\drivers\GEARAspiWDM.sys []
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys []
S3 netr7364;Linksys Compact Wireless-G USB Adapter Driver for Vista; C:\Windows\system32\DRIVERS\WUSB54GCx64.sys []
S3 RTL8187B;NETGEAR WG111v3 54Mbps Wireless USB 2.0 Adapter Vista Driver; C:\Windows\system32\DRIVERS\wg111v3.sys []
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys []
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []
S4 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\drivers\wmiacpi.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AVKProxy;G Data AntiVirus Proxy; C:\Program Files (x86)\Common Files\G DATA\AVKProxy\AVKProxy.exe [2009-10-23 1126472]
R2 AVKService;G Data Scheduler; C:\Program Files (x86)\G DATA\AntiVirus\AVK\AVKService.exe [2009-08-08 397896]
R2 AVKWCtl;G Data Dateisystem Wächter; C:\Program Files (x86)\G DATA\AntiVirus\AVK\AVKWCtlX64.exe [2009-10-21 1720656]
R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Program Files (x86)\Common Files\LightScribe\LSSrvc.exe [2006-10-19 61440]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 TuneUp.ProgramStatisticsSvc;@%SystemRoot%\System32\TUProgSt.exe,-1; C:\Windows\System32\TUProgSt.exe []
R2 UxTuneUp;@%SystemRoot%\System32\uxtuneup.dll,-4096; C:\Windows\System32\svchost.exe [2008-01-21 21504]
R3 GDScan;G Data Scanner; C:\Program Files (x86)\Common Files\G DATA\GDScan\GDScan.exe [2009-07-27 300616]
S3 Adobe LM Service;Adobe LM Service; C:\Program Files (x86)\Common Files\Adobe Systems Shared\Service\Adobelmsvc.exe [2009-07-10 72704]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\Windows\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe []
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-03-30 89920]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]
S3 ose;Office Source Engine; C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-21 19968]
S3 SQLWriter;SQL Server VSS Writer; c:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe [2006-04-14 153376]
S3 Steam Client Service;Steam Client Service; C:\Program Files (x86)\Common Files\Steam\SteamService.exe [2009-10-01 316664]
S3 TuneUp.Defrag;@%SystemRoot%\System32\TuneUpDefragService.exe,-1; C:\Windows\System32\TuneUpDefragService.exe []
S4 NMIndexingService;NMIndexingService; C:\Program Files (x86)\Common Files\Ahead\Lib\NMIndexingService.exe []

-----------------EOF-----------------



info.txt logfile of random's system information tool 1.06 2009-11-19 15:59:59

======Uninstall list======

-->MsiExec /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe
Adobe Premiere Pro 2.0-->msiexec /I {FA17A726-B229-4116-B793-A2AB1A4EAE2E}
Adobe Reader 9.2 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A92000000001}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Batman: Arkham Asylum-->"C:\Program Files (x86)\InstallShield Installation Information\{4E79A60F-15D2-4BEC-91AD-E41EC42E61B0}\setup.exe" -runfromtemp -l0x0007 -removeonly
Brothers In Arms EiB-->L:\spiele\BrothersInArmsEiB\System\Setup.exe uninstall "BrothersInArmsEiB"
Brothers in Arms: Hell's Highway-->L:\spiele\Brothers in Arms - Hell's Highway\Binaries\uninst.exe
Brothers In Arms-->L:\spiele\BrothersInArms\System\Setup.exe uninstall "BrothersInArms"
Burnout(TM) Paradise The Ultimate Box-->MsiExec.exe /X{9A996B6A-846E-4A89-B9C4-17546B7BE49F}
Call of Duty(R) - World at War(TM) 1.2 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{2BF0AE92-C3BC-4112-9066-1546342B1FAE}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) - World at War(TM) 1.4 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{9F01A67B-7D67-482F-9D4F-D5980A440FD4}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) - World at War(TM)-->C:\Program Files (x86)\InstallShield Installation Information\{D80A6A73-E58A-4673-AFF5-F12D7110661F}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.1 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{5D7767FA-7FE8-4627-9F09-AEF7A25F1E07}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.2 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{E5141379-B2D9-4BBC-BB2A-5805541571DD}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.3 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{050C1C8E-4A4D-4C2F-B9AE-67E60EE91B7F}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.4 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{3BD633E0-4BF8-4499-9149-88F0767D449C}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.5 Multiplayer Patch-->C:\Program Files (x86)\InstallShield Installation Information\{8503C901-85D7-4262-88D2-8D8B2A7B08B8}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.6 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{8A15B7D9-908A-4EF9-BA84-5AEDE61743EE}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM) 1.7 Patch-->C:\Program Files (x86)\InstallShield Installation Information\{931C37FC-594D-43A9-B10F-A2F2B1F03498}\setup.exe -runfromtemp -l0x0409
Call of Duty(R) 4 - Modern Warfare(TM)-->C:\Program Files (x86)\InstallShield Installation Information\{E48469CC-635E-4FD5-A122-1497C286D217}\setup.exe -runfromtemp -l0x0407
CCleaner-->"C:\Program Files (x86)\CCleaner\uninst.exe"
Cobra 11 - Highway Nights Demo (remove only)-->"L:\spiele\Cobra 11 - Highway Nights Demo\Uninstall.exe"
Dawn of War - Dark Crusade-->C:\Program Files (x86)\InstallShield Installation Information\{FF39FC01-819B-42E4-AE49-1968AF12DDD4}\setup.exe -runfromtemp -l0x0007 -removeonly
Dawn of War - Soulstorm-->"C:\Program Files (x86)\InstallShield Installation Information\{20533183-D42D-4261-A125-956736FBEA8C}\setup.exe" -runfromtemp -l0x0007 -removeonly
Dawn Of War - Winter Assault-->MsiExec.exe /X{DD8408E9-9421-484F-979D-DB6361E3E828}
Dawn Of War-->MsiExec.exe /X{83F12F73-D52E-40C0-93B1-463C311C4E17}
Dead Space™-->MsiExec.exe /X{4D87DC92-C328-46EC-A7B4-9C88129DC696}
Empire: Total War Demo-->"L:\spiele\Steam\steam.exe" steam://uninstall/10620
f4 3.0.3-->C:\Program Files (x86)\f4\uninstall.exe
Fallout 3-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{974C4B12-4D02-4879-85E0-61C95CC63E9E}\setup.exe" -l0x7 -removeonly
Far Cry 2-->"C:\Program Files (x86)\InstallShield Installation Information\{F2835483-37F2-4123-B4FE-0E77D58447F2}\setup.exe" -runfromtemp -l0x0007 -removeonly
FMOD Designer-->"C:\Program Files (x86)\FMOD SoundSystem\FMOD Designer\uninstall.exe"
Fraps-->"C:\Program Files (x86)\fraps\uninstall.exe"
Free YouTube to Mp3 Converter version 3.1-->"C:\Program Files (x86)\DVDVideoSoft\Free YouTube to Mp3 Converter\unins000.exe"
FUSSBALL MANAGER 10 DEMO-->L:\spiele\FUSSBALL MANAGER 10 DEMO\eauninstall.exe
G Data AntiVirus-->MsiExec.exe /I{0FDB2D25-D880-4E10-868F-8C64EFE155F1}
GRID-->"C:\Program Files (x86)\InstallShield Installation Information\{5A0B7BA5-4682-4273-81C2-69B17E649103}\setup.exe" -runfromtemp -l0x0007 -removeonly
Half-Life 2-->"L:\spiele\Steam\steam.exe" steam://uninstall/220
Half-Life: Source-->"L:\spiele\Steam\steam.exe" steam://uninstall/280
HijackThis 2.0.2-->"C:\Program Files (x86)\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {08155812-0202-4D5F-A7FF-12A2782DC548} /qb+ REBOOTPROMPT=""
ICQ6.5-->"C:\Program Files (x86)\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
James Cameron's AVATAR(tm): DAS SPIEL (Demo)-->"C:\Program Files (x86)\InstallShield Installation Information\{1DC4E424-5D92-4C92-B1E1-4BE4318E7136}\setup.exe" -runfromtemp -l0x0007 -removeonly
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Linksys Compact Wireless-G USB Adapter Driver - WUSB54GC-->C:\Program Files (x86)\InstallShield Installation Information\{F855C3AE-992D-4B84-A09D-07103CDCDAC2}\setup.exe -runfromtemp -l0x0007 -removeonly
Malwarebytes' Anti-Malware-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"
Medieval II Total War : Kingdoms : Americas-->C:\Program Files (x86)\InstallShield Installation Information\{75983B66-804C-40D1-BA13-64DAF652A6F1}\setup.exe -runfromtemp -l0x0007 -removeonly
Medieval II Total War : Kingdoms : Britannia-->C:\Program Files (x86)\InstallShield Installation Information\{CEDDEE73-3D36-41C2-AA40-29355D9FBD63}\setup.exe -runfromtemp -l0x0007 -removeonly
Medieval II Total War : Kingdoms : Crusades-->C:\Program Files (x86)\InstallShield Installation Information\{02A10468-2F1C-447C-AD8E-4DEDDEA25AE2}\setup.exe -runfromtemp -l0x0007 -removeonly
Medieval II Total War : Kingdoms : Teutonic-->C:\Program Files (x86)\InstallShield Installation Information\{7AEE1963-7001-4C37-BC20-2FAEB74AA41C}\setup.exe -runfromtemp -l0x0007 -removeonly
Medieval II Total War-->C:\Program Files (x86)\InstallShield Installation Information\{C0698BDA-0D29-40EE-8570-A31106DF9AB1}\setup.exe -runfromtemp -l0x0007 -removeonly
Microsoft .NET Framework 1.1 Security Update (KB953297)-->"C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\Windows\Microsoft.NET\Framework\v1.1.4322\Updates\M953297\M953297Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{B578C85A-A84C-4230-A177-C5B2AF565B8C}
Microsoft Games for Windows - LIVE-->MsiExec.exe /X{B45FABE7-D101-4D99-A671-E16DA40AF7F0}
Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A40407-6000-11D3-8CFE-0150048383C9}
Microsoft Office 2007 Primary Interop Assemblies-->MsiExec.exe /X{50120000-1105-0000-0000-0000000FF1CE}
Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}
Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE}
Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}
Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}
Microsoft Office Project MUI (German) 2007-->MsiExec.exe /X{90120000-00B4-0407-0000-0000000FF1CE}
Microsoft Office Project Professional 2007-->"C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PRJPROR /dll OSETUP.DLL
Microsoft Office Project Professional 2007-->MsiExec.exe /X{91120000-003B-0000-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}
Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}
Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}
Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}
Microsoft Office Small Business Connectivity Components-->MsiExec.exe /X{A939D341-5A04-4E0A-BB55-3E65B386432D}
Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mozilla Firefox (3.5.5)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.23)-->C:\Program Files (x86)\Mozilla Thunderbird\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB941833)-->MsiExec.exe /I{C523D256-313D-4866-B36A-F3DE528246EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NVIDIA PhysX-->MsiExec.exe /X{C5C1C0F0-D62F-4DBF-81D4-D7EF397C228B}
Oblivion-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{35CB6715-41F8-4F99-8881-6FC75BF054B0}\setup.exe" -l0x7 -removeonly
OpenAL-->"C:\Program Files (x86)\OpenAL\oalinst.exe" /U
PDFCreator-->C:\Program Files (x86)\PDFCreator\unins000.exe
Plants vs. Zombies-->L:\Spiele\PlantsvsZombies\Plants vs. Zombies\PopUninstall.exe "L:\Spiele\PlantsvsZombies\Plants vs. Zombies\Install.log"
Prince of Persia-->"C:\Program Files (x86)\InstallShield Installation Information\{7C11154F-3539-4CB5-979D-EF7913473E53}\setup.exe" -runfromtemp -l0x0007 -removeonly
Pro Evolution Soccer 2010-->MsiExec.exe /X{283FFB23-8751-4B08-ACB8-5E0F8BCF7727}
ProtectDisc Driver, Version 11-->C:\Program Files (x86)\ProtectDisc Driver Installer\uninstall_v11.exe
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Race On Demo-->"L:\spiele\Race On Demo\Uninstall\unins000.exe"
Realtek High Definition Audio Driver-->C:\Program Files\Realtek\Audio\HDA\RtlUpd64.exe -r -m -nrg2709
RESIDENT EVIL 5-->MsiExec.exe /X{AC08BBA0-96B9-431A-A7D0-D8598E493775}
Risen Demo-->"C:\Program Files (x86)\InstallShield Installation Information\{2A82D40B-899C-4BDB-BAC1-8A0126C3DAA2}\setup.exe" -runfromtemp -l0x0007 -removeonly
S.T.A.L.K.E.R. - Shadow of Chernobyl [v1.0005]-->"L:\spiele\S.T.A.L.K.E.R. - Shadow of Chernobyl\unins000.exe"
Sid Meier's Pirates!-->C:\Program Files (x86)\Common Files\InstallShield\Driver\8\Intel 32\IDriver.exe /M{1632FD86-1BA4-4FC4-8B25-A8C655D63F68} /l1031
Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}
Snagit 9.1.2-->MsiExec.exe /I{B440D659-FECA-4BDD-A12B-5C9F05790FF3}
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Stranglehold-->C:\Program Files (x86)\InstallShield Installation Information\{86EDEF11-EFE4-46CB-8B08-9CBD4A936B1F}\setup.exe -runfromtemp -l0x0007 -removeonly
STREET FIGHTER IV-->MsiExec.exe /X{59ABBDF0-E1E5-48AF-85FB-F523A08C3490}
System Requirements Lab-->C:\Program Files (x86)\SystemRequirementsLab\Uninstall.exe
The Chronicles of Riddick - Assault on Dark Athena-->C:\Program Files (x86)\InstallShield Installation Information\{12C85315-0989-4C28-8956-33458F464DD6}\Setup.exe -runfromtemp -l0x0007 -removeonly
Titan Quest Immortal Throne-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{B5C5C17E-FEF6-4062-8151-A427AE8AF9D7}\setup.exe" -l0x7 -removeonly
Titan Quest-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{412B69AF-C352-4F6F-A318-B92B3CB9ACC6}\setup.exe" -l0x7 -removeonly
Tom Clancy's H.A.W.X-->"C:\Program Files (x86)\InstallShield Installation Information\{6E36A172-06FB-4BC8-B7FC-D30D219E6776}\setup.exe" -runfromtemp -l0x0007 -removeonly
TuneUp Utilities 2009-->MsiExec.exe /I{55A29068-F2CE-456C-9148-C869879E2357}
Uninstall 1.0.0.1-->"C:\Program Files (x86)\Common Files\DVDVideoSoft\unins000.exe"
Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)-->MsiExec.exe /X{07629207-FAA0-4F1A-8092-BF5085BE511F}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Venetica-DEMO-->"L:\spiele\Venetica-DEMO\unins000.exe"
Vista Codec Package-->MsiExec.exe /I{F9FD80CE-0448-4D4F-8BCD-77FC514C3F99}
VLC media player 0.9.2-->C:\Program Files (x86)\VideoLAN\VLC\uninstall.exe
Warhammer 40,000: Dawn of War II-->"L:\spiele\Steam\steam.exe" steam://uninstall/15620
Wolfenstein-->C:\Program Files (x86)\InstallShield Installation Information\{F9B37992-968C-4264-8449-489032FC28DE}\setup.exe -runfromtemp -l0x0409
WORLD IN CONFLICT-->C:\Program Files (x86)\InstallShield Installation Information\{F11ADC64-C89E-47F4-A0B3-3665FF859397}\setup.exe -runfromtemp -l0x0007 -removeonly

======Hosts File======

127.0.0.1 www.007guard.com
127.0.0.1 007guard.com
127.0.0.1 008i.com
127.0.0.1 www.008k.com
127.0.0.1 008k.com
127.0.0.1 www.00hq.com
127.0.0.1 00hq.com
127.0.0.1 010402.com
127.0.0.1 www.032439.com
127.0.0.1 032439.com

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: Martin-PC
Event Code: 7036
Message: Dienst "Sitzungs-Manager für Desktopfenster-Manager" befindet sich jetzt im Status "Ausgeführt".
Record Number: 63518
Source Name: Service Control Manager
Time Written: 20090427084601.000000-000
Event Type: Informationen
User:

Computer Name: Martin-PC
Event Code: 7036
Message: Dienst "Softwarelizenzierung" befindet sich jetzt im Status "Ausgeführt".
Record Number: 63517
Source Name: Service Control Manager
Time Written: 20090427084601.000000-000
Event Type: Informationen
User:

Computer Name: Martin-PC
Event Code: 7036
Message: Dienst "Benachrichtigungsdienst für Systemereignisse" befindet sich jetzt im Status "Ausgeführt".
Record Number: 63516
Source Name: Service Control Manager
Time Written: 20090427084601.000000-000
Event Type: Informationen
User:

Computer Name: Martin-PC
Event Code: 7036
Message: Dienst "COM+-Ereignissystem" befindet sich jetzt im Status "Ausgeführt".
Record Number: 63515
Source Name: Service Control Manager
Time Written: 20090427084601.000000-000
Event Type: Informationen
User:

Computer Name: Martin-PC
Event Code: 7036
Message: Dienst "TuneUp Designerweiterung" befindet sich jetzt im Status "Ausgeführt".
Record Number: 63514
Source Name: Service Control Manager
Time Written: 20090427084601.000000-000
Event Type: Informationen
User:

=====Application event log=====

Computer Name: WIN-HJV4NJJJSQX
Event Code: 6000
Message: Der Winlogon-Benachrichtigungsabonnent <SessionEnv> war nicht verfügbar, um das Benachrichtigungsereignis zu verarbeiten.
Record Number: 654
Source Name: Microsoft-Windows-Winlogon
Time Written: 20081106110034.000000-000
Event Type: Informationen
User:

Computer Name: WIN-HJV4NJJJSQX
Event Code: 9009
Message: Der Desktopfenster-Manager wurde mit dem Code (0x40010004) abgebrochen.
Record Number: 653
Source Name: Desktop Window Manager
Time Written: 20081106110034.000000-000
Event Type: Informationen
User:

Computer Name: WIN-HJV4NJJJSQX
Event Code: 1003
Message: Softwarelizenzierungsdienst hat die Überprüfung des Lizenzierungsstatus abgeschlossen.
Anwendungs-ID=55c92734-d682-4d71-983e-d6ec3f16059f
Lizenzierungsstatus=
{1,[3a1d44e2-bede-46fb-8a02-0cd485a1db8b, 8, 0xC004F014,0x0]}

{1,[9e042223-03bf-49ae-808f-ff37f128d40d, 0, 0x0,0x0],[0x1,0xC004F034,0x0,0,0,0x0],[0x10,0xC004F030,0x0,0,0,0x0],[0x0,0x0,0x0,0,0,0xA8C0],[30,3,0xA8C0]}

{1,[a3481201-436e-4fc9-88b4-34ccf7f81789, 8, 0xC004F014,0x0]}

{1,[a4eec485-e375-48b4-8f51-80d13a4086b6, 8, 0xC004F014,0x0]}

{1,[b6795467-dc45-4acf-af87-e948ee3f15f4, 8, 0xC004F014,0x0]}

{1,[bffdc375-bbd5-499d-8ef1-4f37b61c895f, 8, 0xC004F014,0x0]}

{1,[c3505bd0-004a-49b9-84db-a1a4869eddf1, 8, 0xC004F014,0x0]}

{1,[c5d8ec70-e2ae-42d8-aaa9-eec3772438ee, 8, 0xC004F014,0x0]}

{1,[f3acdd3c-119a-4932-a3d7-0b6f33a1dca9, 8, 0xC004F014,0x0]}

{1,[afd5f68f-b70f-4000-a21d-28dbc8be8b07, 8, 0xC004F014,0x0]}

Record Number: 652
Source Name: Microsoft-Windows-Security-Licensing-SLC
Time Written: 20081106110031.000000-000
Event Type: Informationen
User:

Computer Name: WIN-HJV4NJJJSQX
Event Code: 1033
Message: Die Richtlinien werden ausgeschlossen, da sie nur mit dem override-only-Attribut definiert wurden.
Richtliniennamen=(IIS-W3SVC-MaxConcurrentRequests) (Telnet-Client-EnableTelnetClient) (Telnet-Client-EnableTelnetClient_w) (Telnet-Server-EnableTelnetServer) (Telnet-Server-EnableTelnetServer_w)
Anwendungs-ID=55c92734-d682-4d71-983e-d6ec3f16059f
SKU-ID=9e042223-03bf-49ae-808f-ff37f128d40d
Record Number: 651
Source Name: Microsoft-Windows-Security-Licensing-SLC
Time Written: 20081106110031.000000-000
Event Type: Informationen
User:

Computer Name: WIN-HJV4NJJJSQX
Event Code: 1013
Message: Der Windows-Suchdienst wurde normal beendet.

Record Number: 650
Source Name: Microsoft-Windows-Search
Time Written: 20081106105937.000000-000
Event Type: Informationen
User:

=====Security event log=====

Computer Name: Martin-PC
Event Code: 1100
Message: Der Ereignisprotokollierungsdienst wurde heruntergefahren.
Record Number: 5370
Source Name: Microsoft-Windows-Eventlog
Time Written: 20081207172150.125875-000
Event Type: Überwachung erfolgreich
User:

Computer Name: Martin-PC
Event Code: 4672
Message: Einer neuen Anmeldung wurden besondere Rechte zugewiesen.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7

Berechtigungen: SeAssignPrimaryTokenPrivilege
SeTcbPrivilege
SeSecurityPrivilege
SeTakeOwnershipPrivilege
SeLoadDriverPrivilege
SeBackupPrivilege
SeRestorePrivilege
SeDebugPrivilege
SeAuditPrivilege
SeSystemEnvironmentPrivilege
SeImpersonatePrivilege
Record Number: 5369
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081207171849.555255-000
Event Type: Überwachung erfolgreich
User:

Computer Name: Martin-PC
Event Code: 4624
Message: Ein Konto wurde erfolgreich angemeldet.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: MARTIN-PC$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7

Anmeldetyp: 5

Neue Anmeldung:
Sicherheits-ID: S-1-5-18
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}

Prozessinformationen:
Prozess-ID: 0x25c
Prozessname: C:\Windows\System32\services.exe

Netzwerkinformationen:
Arbeitsstationsname:
Quellnetzwerkadresse: -
Quellport: -

Detaillierte Authentifizierungsinformationen:
Anmeldeprozess: Advapi
Authentifizierungspaket: Negotiate
Übertragene Dienste: -
Paketname (nur NTLM): -
Schlüssellänge: 0

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.
- Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.
- Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.
- Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.
- Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.
Record Number: 5368
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081207171849.555255-000
Event Type: Überwachung erfolgreich
User:

Computer Name: Martin-PC
Event Code: 4648
Message: Anmeldeversuch mit expliziten Anmeldeinformationen.

Antragsteller:
Sicherheits-ID: S-1-5-18
Kontoname: MARTIN-PC$
Kontodomäne: WORKGROUP
Anmelde-ID: 0x3e7
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}

Konto, dessen Anmeldeinformationen verwendet wurden:
Kontoname: SYSTEM
Kontodomäne: NT-AUTORITÄT
Anmelde-GUID: {00000000-0000-0000-0000-000000000000}

Zielserver:
Zielservername: localhost
Weitere Informationen: localhost

Prozessinformationen:
Prozess-ID: 0x25c
Prozessname: C:\Windows\System32\services.exe

Netzwerkinformationen:
Netzwerkadresse: -
Port: -

Dieses Ereignis wird bei einem Anmeldeversuch durch einen Prozess generiert, wenn ausdrücklich die Anmeldeinformationen des Kontos angegeben werden. Dies ist normalerweise der Fall in Batch-Konfigurationen, z. B. bei geplanten Aufgaben oder wenn der Befehl "runas" verwendet wird.
Record Number: 5367
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081207171849.555255-000
Event Type: Überwachung erfolgreich
User:

Computer Name: Martin-PC
Event Code: 5032
Message: Der Windows-Firewalldienst konnte den Benutzer nicht darüber benachrichtigen, dass eine Anwendung blockiert wurde und keine eingehenden Verbindungen im Netzwerk annehmen kann.

Fehlercode: 2
Record Number: 5366
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20081207171637.287678-000
Event Type: Überwachung gescheitert
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\QuickTime\QTSystem\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 23 Stepping 7, GenuineIntel
"PROCESSOR_REVISION"=1707
"NUMBER_OF_PROCESSORS"=4
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\34FB5F65-FFEB-4B61-BF0E-A6A76C450FAA\TraceFormat
"DFSTRACINGON"=FALSE
"CLASSPATH"=.;C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files (x86)\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

Beim Malwarebytes-Scan wurde auch noch was gefunden, kann mir jemand erklären was das war? Da ja mein Gdata nix dazu gesagt hat.

Danke für eure Hilfe.

Grüße Martin

Da sich bisher keiner gemeldet hat und mein System scheinbar ohne Probleme läuft vermute ich mal, dass alles ok ist...

Grüße