| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: 'TR/Crypt.XPACK.Gen' in '\Command & Conquer 3 Kane's Wrath\RetailExe\1.0\cnc3ep1.dat'Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
| |
13.12.2009, 23:59
| #1 |
 |  'TR/Crypt.XPACK.Gen' in '\Command & Conquer 3 Kane's Wrath\RetailExe\1.0\cnc3ep1.dat' hallo! ich hab ein kleines problem mit einem trojaner. mein antivir hat vor kurzem gemeldet: In der Datei 'E:\Command & Conquer 3 Kane's Wrath\RetailExe\1.0\cnc3ep1.dat' wurde ein Virus oder unerwünschtes Programm 'TR/Crypt.XPACK.Gen' [trojan] gefunden. ich hab c&c3 vor 2 oder 3 wochen auf ner lan party von nem kumpel gezogen. damals hat antivir noch nicht gemeckert. ich hab gelesen, dass der trojaner schon mehrere jahre alt ist, deswegen find ich das irgendwie ein bisschen komisch. bei meinem kumpel, der auch auf der lan war, ist es genauso. könnte das ein fehlalarm sein? oder hab ich ein problem? CCleaner hab ich mehrere male durchlaufen lassen. auch Malwarebytes' Anti-Malware und RSIT hab ich gemäß der anleitung angewendet. hier die ergebnisse: Anti-Malware-log: Code:
ATTFilter Malwarebytes' Anti-Malware 1.42
Datenbank Version: 3355
Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180
13.12.2009 23:22:26
mbam-log-2009-12-13 (23-22-21).txt
Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|)
Durchsuchte Objekte: 253900
Laufzeit: 46 minute(s), 48 second(s)
Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 3
Infizierte Verzeichnisse: 0
Infizierte Dateien: 3
Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)
Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)
Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)
Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> No action taken.
Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)
Infizierte Dateien:
C:\Programme\cryptload\ocr\netload.in\asmCaptcha\test.exe (Malware.Packer) -> No action taken.
C:\Programme\cryptload\ocr\rapidshare.com\asmCaptcha\test.exe (Malware.Packer) -> No action taken.
C:\Programme\Everest Poker\var\Everest Casino.exe (Rogue.AdorableCasino) -> No action taken.
RSIT log.txt: Code:
ATTFilter Logfile of random's system information tool 1.06 (written by random/random) Run by Administrator at 2009-12-13 23:24:36 Microsoft Windows XP Professional Service Pack 2 System drive C: has 79 GB (40%) free of 200 GB Total RAM: 3326 MB (77% free) Logfile of Trend Micro HijackThis v2.0.2 Scan saved at 23:24:42, on 13.12.2009 Platform: Windows XP SP2 (WinNT 5.01.2600) MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180) Boot mode: Normal Running processes: C:\WINDOWS\System32\smss.exe C:\WINDOWS\system32\winlogon.exe C:\WINDOWS\system32\services.exe C:\WINDOWS\system32\lsass.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\svchost.exe C:\WINDOWS\System32\svchost.exe C:\WINDOWS\system32\Ati2evxx.exe C:\WINDOWS\system32\spoolsv.exe C:\Programme\Avira\AntiVir Desktop\sched.exe C:\Programme\Avira\AntiVir Desktop\avguard.exe C:\WINDOWS\Explorer.EXE C:\Programme\Avira\AntiVir Desktop\avgnt.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.exe C:\Programme\OCZ Technology\Mouse\Amoumain.exe C:\WINDOWS\RTHDCPL.EXE C:\Programme\Java\jre6\bin\jusched.exe C:\Programme\RocketDock\RocketDock.exe C:\WINDOWS\system32\ctfmon.exe C:\Programme\ICQ6.5\ICQ.exe C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe C:\Programme\ac'tivAid\AutoHotkey\AutoHotkey.exe C:\Programme\ac'tivAid\AutoHotkey\AutoHotkey.exe C:\Programme\LogMeIn Hamachi\hamachi-2.exe C:\Programme\Java\jre6\bin\jqs.exe C:\Programme\WoW Server\mangos\data\mysql\bin\mysqld.exe C:\Programme\NetLimiter 2 Pro\nlsvc.exe C:\WINDOWS\system32\PnkBstrA.exe C:\Programme\SmartSVN 6\bin\statuscached.exe C:\Programme\Tunngle\TnglCtrl.exe C:\WINDOWS\system32\wbem\wmiapsrv.exe C:\Dokumente und Einstellungen\Administrator\Desktop\RSIT.exe C:\Programme\trend micro\Administrator.exe R1 - HKCU\Software\Microsoft\Internet Connection Wizard,ShellNext = h**p://www.everestpoker.com/de/DYN/play/_/index/play-texas-holdem-poker O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll O4 - HKLM\..\Run: [StartCCC] "C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" MSRun O4 - HKLM\..\Run: [NeroFilterCheck] C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min O4 - HKLM\..\Run: [WheelMouse] C:\Programme\OCZ Technology\Mouse\Amoumain.exe O4 - HKLM\..\Run: [KernelFaultCheck] %systemroot%\system32\dumprep 0 -k O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe" O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent O4 - HKCU\..\Run: [RocketDock] "C:\Programme\RocketDock\RocketDock.exe" O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6.5\ICQ.exe" silent O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST') O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST') O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM') O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user') O4 - Startup: ac'tivAid.lnk = C:\Programme\ac'tivAid\Portable_ac'tivAid.exe O4 - Startup: test.lnk = C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\test.ahk O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000 O9 - Extra button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra 'Tools' menuitem: An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~2\Office12\ONBttnIE.dll O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe O17 - HKLM\System\CCS\Services\Tcpip\..\{08458C7E-249A-4B1E-BA92-1B395E031032}: NameServer = 192.168.2.1 O17 - HKLM\System\CS1\Services\Tcpip\..\{08458C7E-249A-4B1E-BA92-1B395E031032}: NameServer = 192.168.2.1 O17 - HKLM\System\CS2\Services\Tcpip\..\{08458C7E-249A-4B1E-BA92-1B395E031032}: NameServer = 192.168.2.1 O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\PROGRA~1\MICROS~2\Office12\GR99D3~1.DLL O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe O23 - Service: ATI Smart - Unknown owner - C:\WINDOWS\system32\ati2sgag.exe O23 - Service: LogMeIn Hamachi 2.0 Tunneling Engine (Hamachi2Svc) - LogMeIn Inc. - C:\Programme\LogMeIn Hamachi\hamachi-2.exe O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe O23 - Service: MySQL - Unknown owner - C:\Programme\WoW.exe (file missing) O23 - Service: NetLimiter (nlsvc) - Locktime Software - C:\Programme\NetLimiter 2 Pro\nlsvc.exe O23 - Service: NMIndexingService - Nero AG - C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe O23 - Service: SmartSVN Status Cache (statuscached) - Unknown owner - C:\Programme\SmartSVN 6\bin\statuscached.exe O23 - Service: TunngleService - Tunngle.net GmbH - C:\Programme\Tunngle\TnglCtrl.exe -- End of file - 6634 bytes ======Registry dump====== [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}] Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}] Groove GFS Browser Helper - C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}] Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-10-11 41760] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}] JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-10-11 73728] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run] "StartCCC"=C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2009-07-02 98304] "NeroFilterCheck"=C:\Programme\Gemeinsame Dateien\Nero\Lib\NeroCheck.exe [2007-03-01 153136] "avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153] "WheelMouse"=C:\Programme\OCZ Technology\Mouse\Amoumain.exe [2006-12-28 196608] "KernelFaultCheck"=C:\WINDOWS\system32\dumprep 0 -k [] "RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2009-01-13 18084864] "Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344] "Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696] "Adobe ARM"=C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2009-09-04 935288] "SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2009-10-11 149280] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce] "Malwarebytes' Anti-Malware"=C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-12-03 429392] [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run] "RocketDock"=C:\Programme\RocketDock\RocketDock.exe [2007-09-02 495616] "ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2004-11-11 15360] "ICQ"=C:\Programme\ICQ6.5\ICQ.exe [2009-03-01 172792] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher] C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] C:\Programme\Gemeinsame Dateien\Nero\Lib\NMBgMonitor.exe [2007-09-20 202024] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\GrooveMonitor] C:\Programme\Microsoft Office\Office12\GrooveMonitor.exe [2006-10-27 31016] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Sony Ericsson PC Suite] C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2006-11-24 487424] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WinampAgent] C:\Programme\Winamp\winampa.exe [2008-09-12 36352] [HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^Administrator^Startmenü^Programme^Autostart^Terminplaner.lnk] C:\Programme\pics\Terminplaner\Terminplaner.exe -V:D [] C:\Dokumente und Einstellungen\Administrator\Startmenü\Programme\Autostart ac'tivAid.lnk - C:\Programme\ac'tivAid\Portable_ac'tivAid.exe test.lnk - C:\Dokumente und Einstellungen\Administrator\Eigene Dateien\test.ahk [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent] C:\WINDOWS\system32\Ati2evxx.dll [2009-07-02 155648] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad] WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks] "{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\PROGRA~1\MICROS~2\Office12\GRA8E1~1.DLL [2006-10-27 2210608] [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Hamachi2Svc] [HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System] "dontdisplaylastusername"=0 "legalnoticecaption"= "legalnoticetext"= "shutdownwithoutlogon"=1 "undockwithoutlogon"=1 [HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer] "NoDriveTypeAutoRun"=145 [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" "C:\Programme\ICQ6\ICQ.exe"="C:\Programme\ICQ6\ICQ.exe:*:Enabled:ICQ6" "C:\Programme\Valve\Steam\SteamApps\celoz\counter-strike source\hl2.exe"="C:\Programme\Valve\Steam\SteamApps\celoz\counter-strike source\hl2.exe:*:Enabled:hl2" "C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe"="C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32" "C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe"="C:\Programme\Electronic Arts\Crytek\Crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32" "C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA" "C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB" "C:\Programme\EA GAMES\Battlefield 1942\BF1942.exe"="C:\Programme\EA GAMES\Battlefield 1942\BF1942.exe:*:Enabled:BF1942" "C:\Programme\EA GAMES\Battlefield 2\BF2.exe"="C:\Programme\EA GAMES\Battlefield 2\BF2.exe:*:Enabled:Battlefield 2" "C:\Programme\Ubisoft\Far Cry 2\bin\FarCry2.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FarCry2.exe:*:Enabled:Far Cry 2" "C:\Programme\Ubisoft\Far Cry 2\bin\FC2Launcher.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FC2Launcher.exe:*:Enabled:Far Cry 2 Updater" "C:\Programme\Ubisoft\Far Cry 2\bin\FC2Editor.exe"="C:\Programme\Ubisoft\Far Cry 2\bin\FC2Editor.exe:*:Enabled:Editor" "C:\Programme\CrossLoop\CrossLoopConnect.exe"="C:\Programme\CrossLoop\CrossLoopConnect.exe:*:Enabled:CrossLoop - Simple Secure Screen Sharing" "C:\Programme\Java\jre6\bin\javaw.exe"="C:\Programme\Java\jre6\bin\javaw.exe:*:Disabled:Java(TM) Platform SE binary" "C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE"="C:\Programme\Microsoft Office\Office12\OUTLOOK.EXE:*:Enabled:Microsoft Office Outlook" "C:\Programme\Microsoft Office\Office12\GROOVE.EXE"="C:\Programme\Microsoft Office\Office12\GROOVE.EXE:*:Enabled:Microsoft Office Groove" "C:\Programme\Microsoft Office\Office12\ONENOTE.EXE"="C:\Programme\Microsoft Office\Office12\ONENOTE.EXE:*:Enabled:Microsoft Office OneNote" "C:\Programme\THQ\Company of Heroes\RelicCOH.exe"="C:\Programme\THQ\Company of Heroes\RelicCOH.exe:*:Disabled:RelicCOH" "C:\Programme\Flagship Studios\Hellgate London\Launcher.exe"="C:\Programme\Flagship Studios\Hellgate London\Launcher.exe:*:Enabled:Hellgate: London" "C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox" "C:\Programme\Java\jre6\bin\java.exe"="C:\Programme\Java\jre6\bin\java.exe:*:Enabled:Java(TM) Platform SE binary" "C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6" "C:\Programme\Valve\Steam\Steam.exe"="C:\Programme\Valve\Steam\Steam.exe:*:Enabled:Steam" "C:\Dokumente und Einstellungen\Administrator\Desktop\proggz\Skype\Phone\Skype.exe"="C:\Dokumente und Einstellungen\Administrator\Desktop\proggz\Skype\Phone\Skype.exe:*:Enabled:Skype" "C:\Programme\uTorrent\uTorrent.exe"="C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent" "C:\Programme\Codemasters\DiRT\DiRT.exe"="C:\Programme\Codemasters\DiRT\DiRT.exe:*:Disabled:DiRT Executable" "G:\DesktopUnterwegs\MirandaPortable\App\miranda\miranda32.exe"="G:\DesktopUnterwegs\MirandaPortable\App\miranda\miranda32.exe:*:Enabled:Miranda IM" "C:\Programme\WoW Server\mangos\starter.exe"="C:\Programme\WoW Server\mangos\starter.exe:*:Enabled:Server Tool" "C:\Programme\WoW Server\mangos\mangosd.exe"="C:\Programme\WoW Server\mangos\mangosd.exe:*:Enabled:mangosd" "C:\Programme\WoW Server\mangos\realmd.exe"="C:\Programme\WoW Server\mangos\realmd.exe:*:Enabled:realmd" "C:\Programme\Warcraft III\Frozen Throne.exe"="C:\Programme\Warcraft III\Frozen Throne.exe:*:Enabled:Warcraft III - The Frozen Throne" "C:\Programme\Codemasters\FUEL\FUEL.exe"="C:\Programme\Codemasters\FUEL\FUEL.exe:*:Enabled:FUEL" "Z:\bin\Demigod.exe"="Z:\bin\Demigod.exe:*:Enabled:Demigod Application" "C:\Programme\Ubisoft\Techland\Call of Juarez - Bound in Blood\CoJBiBGame_x86.exe"="C:\Programme\Ubisoft\Techland\Call of Juarez - Bound in Blood\CoJBiBGame_x86.exe:*:Enabled:Call of Juarez - Bound in Blood" "C:\Programme\TmNationsForever\TmForever.exe"="C:\Programme\TmNationsForever\TmForever.exe:*:Enabled:TmForever" "C:\Programme\Tunngle\TnglCtrl.exe"="C:\Programme\Tunngle\TnglCtrl.exe:*:Enabled:Tunngle Service" "C:\Programme\Tunngle\Tunngle.exe"="C:\Programme\Tunngle\Tunngle.exe:*:Enabled:Tunngle Client" "C:\Programme\Valve\Steam\SteamApps\common\left 4 dead\left4dead.exe"="C:\Programme\Valve\Steam\SteamApps\common\left 4 dead\left4dead.exe:*:Enabled:Left 4 Dead" "C:\Dokumente und Einstellungen\Administrator\Desktop\BTrix100\blocktrix.exe"="C:\Dokumente und Einstellungen\Administrator\Desktop\BTrix100\blocktrix.exe:*:Enabled:blocktrix" "E:\Command & Conquer 3 Kane's Wrath\RetailExe\1.0\cnc3ep1.dat"="E:\Command & Conquer 3 Kane's Wrath\RetailExe\1.0\cnc3ep1.dat:*:Enabled:Command & Conquer(tm) 3: Kane's Wrath" "C:\Programme\eclipse\eclipse.exe"="C:\Programme\eclipse\eclipse.exe:*:Enabled:eclipse" "C:\Programme\Valve\Steam\SteamApps\common\torchlight\Torchlight.exe"="C:\Programme\Valve\Steam\SteamApps\common\torchlight\Torchlight.exe:*:Enabled:Torchlight" "C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype " [HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list] "%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019" ======List of files/folders created in the last 1 months====== 2009-12-13 23:24:37 ----D---- C:\Programme\trend micro 2009-12-13 23:24:36 ----D---- C:\rsit 2009-12-13 22:32:27 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Malwarebytes 2009-12-13 22:32:22 ----D---- C:\Programme\Malwarebytes' Anti-Malware 2009-12-13 22:32:22 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes 2009-12-13 22:17:03 ----D---- C:\Programme\CCleaner 2009-12-11 02:01:02 ----D---- C:\Temp 2009-12-07 00:53:07 ----D---- C:\Programme\OpenOfficePortable 2009-11-28 10:28:57 ----D---- C:\workspace 2009-11-25 13:17:46 ----D---- C:\Programme\eclipse 2009-11-17 02:03:27 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\runic games 2009-11-17 02:03:18 ----A---- C:\WINDOWS\system32\XAudio2_4.dll 2009-11-17 02:03:18 ----A---- C:\WINDOWS\system32\XAPOFX1_3.dll 2009-11-17 02:03:18 ----A---- C:\WINDOWS\system32\D3DX9_41.dll 2009-11-17 02:03:18 ----A---- C:\WINDOWS\system32\d3dx10_41.dll 2009-11-17 02:03:18 ----A---- C:\WINDOWS\system32\D3DCompiler_41.dll 2009-11-17 02:03:17 ----A---- C:\WINDOWS\system32\xactengine3_4.dll 2009-11-17 02:03:17 ----A---- C:\WINDOWS\system32\X3DAudio1_6.dll 2009-11-14 18:09:51 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Command & Conquer 3 Kane's Wrath ======List of files/folders modified in the last 1 months====== 2009-12-13 23:24:37 ----RD---- C:\Programme 2009-12-13 23:23:41 ----D---- C:\WINDOWS\Prefetch 2009-12-13 22:32:24 ----D---- C:\WINDOWS\system32\drivers 2009-12-13 22:29:16 ----D---- C:\Programme\Mozilla Firefox 2009-12-13 22:24:55 ----D---- C:\WINDOWS\Minidump 2009-12-13 22:24:55 ----D---- C:\WINDOWS\Debug 2009-12-13 22:24:55 ----D---- C:\WINDOWS 2009-12-13 22:24:54 ----D---- C:\WINDOWS\Temp 2009-12-13 20:55:35 ----D---- C:\Programme\Mozilla Thunderbird 2009-12-13 20:43:41 ----D---- C:\WINDOWS\system32\CatRoot2 2009-12-13 20:42:57 ----D---- C:\Programme\ac'tivAid 2009-12-11 18:08:59 ----N---- C:\WINDOWS\SchedLgU.Txt 2009-12-11 01:46:22 ----D---- C:\public.rw 2009-12-11 00:33:13 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\vlc 2009-12-09 20:43:31 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\dvdcss 2009-11-30 21:15:07 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Tunngle 2009-11-30 21:15:07 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Tunngle 2009-11-30 21:15:01 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Skype 2009-11-29 11:58:45 ----D---- C:\Programme\Gemeinsame Dateien\Adobe 2009-11-29 11:58:45 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Adobe 2009-11-25 14:16:17 ----D---- C:\Dokumente und Einstellungen\Administrator\Anwendungsdaten\Subversion 2009-11-24 00:24:04 ----SHD---- C:\WINDOWS\Installer 2009-11-24 00:24:01 ----D---- C:\WINDOWS\system32 2009-11-24 00:24:00 ----D---- C:\Programme\Java 2009-11-24 00:23:55 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI 2009-11-22 07:24:07 ----D---- C:\WINDOWS\system32\Restore 2009-11-17 02:03:24 ----D---- C:\WINDOWS\WinSxS 2009-11-17 02:03:20 ----D---- C:\WINDOWS\system32\DirectX 2009-11-17 02:03:18 ----HD---- C:\WINDOWS\inf 2009-11-17 02:03:02 ----RSD---- C:\WINDOWS\assembly 2009-11-16 21:44:50 ----D---- C:\WINDOWS\system32\config 2009-11-15 00:37:23 ----A---- C:\WINDOWS\system32\PnkBstrB.exe 2009-11-15 00:27:41 ----D---- C:\Programme\Warcraft III ======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R1 AmdK8;AMD-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-06-18 43520] R1 Amfilter;OCZ Technology Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\Amfilter.sys [2006-12-28 8704] R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys [] R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-04-29 96104] R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2008-07-21 24392] R1 nltdi;nltdi; \??\C:\WINDOWS\system32\drivers\nltdi.sys [] R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-06-10 28520] R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-07 56816] R3 Amusbprt;OCZ Technology HID-compliant Mouse Driver; C:\WINDOWS\system32\DRIVERS\Amusbprt.sys [2006-12-28 13824] R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2008-08-21 99648] R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2009-07-02 4125696] R3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-09-23 26176] R3 HDAudBus;Microsoft UAA Bus Driver for High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2005-01-07 138752] R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-11-11 9600] R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2009-01-20 5027840] R3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtKHDMI.sys [2008-12-25 3721664] R3 RTL8023xp;Realtek 10/100/1000 PCI NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtnicxp.sys [2006-12-14 85120] R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-11-11 26624] R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-11-11 57600] R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2004-11-11 17024] S3 agrpqe4g;agrpqe4g; C:\WINDOWS\system32\drivers\agrpqe4g.sys [] S3 ALSysIO;ALSysIO; \??\C:\DOKUME~1\ADMINI~1\LOKALE~1\Temp\ALSysIO.sys [] S3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-11-11 60800] S3 AtiHdmiService;ATI Function Driver for HDMI Service; C:\WINDOWS\system32\drivers\AtiHdmi.sys [2008-05-21 93696] S3 EagleNT;EagleNT; \??\C:\WINDOWS\system32\drivers\EagleNT.sys [] S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys [] S3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-11-11 12288] S3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-11-11 61824] S3 se46bus;Sony Ericsson Device 070 driver (WDM); C:\WINDOWS\system32\DRIVERS\se46bus.sys [2006-11-30 61536] S3 se46mdfl;Sony Ericsson Device 070 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\se46mdfl.sys [2006-11-30 9360] S3 se46mdm;Sony Ericsson Device 070 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\se46mdm.sys [2006-11-30 97088] S3 se46mgmt;Sony Ericsson Device 070 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\se46mgmt.sys [2006-11-30 88624] S3 se46nd5;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (NDIS); C:\WINDOWS\system32\DRIVERS\se46nd5.sys [2006-11-30 18704] S3 se46obex;Sony Ericsson Device 070 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\se46obex.sys [2006-11-30 86432] S3 se46unic;Sony Ericsson Device 070 USB Ethernet Emulation SEMC46 (WDM); C:\WINDOWS\system32\DRIVERS\se46unic.sys [2006-11-30 90800] S3 tap0901;TAP-Win32 Adapter V9; C:\WINDOWS\system32\DRIVERS\tap0901.sys [2009-10-18 25984] S3 tap0901t;TAP-Win32 Adapter V9 (Tunngle); C:\WINDOWS\system32\DRIVERS\tap0901t.sys [2009-09-16 27136] S3 usbaudio;USB-Audiotreiber (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264] S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-03 31616] S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-03 26496] S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568] S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944] S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys [] ======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)====== R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-06-10 108289] R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-08-30 185089] R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2009-07-02 602112] R2 Hamachi2Svc;LogMeIn Hamachi 2.0 Tunneling Engine; C:\Programme\LogMeIn Hamachi\hamachi-2.exe [2009-10-29 1074568] R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-10-11 153376] R2 MySQL;MySQL; C:\Programme\WoW Server\mangos\data\mysql\bin\mysqld MySQL [] R2 nlsvc;NetLimiter; C:\Programme\NetLimiter 2 Pro\nlsvc.exe [2007-03-21 516096] R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-04-21 75064] R2 statuscached;SmartSVN Status Cache; C:\Programme\SmartSVN 6\bin\statuscached.exe [2009-10-27 215040] R2 TunngleService;TunngleService; C:\Programme\Tunngle\TnglCtrl.exe [2009-09-16 666360] S2 ATI Smart;ATI Smart; C:\WINDOWS\system32\ati2sgag.exe [2009-07-02 593920] S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2005-09-23 29896] S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2005-09-23 66240] S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2006-10-20 36864] S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\1150\Intel 32\IDriverT.exe [2005-11-14 69632] S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2006-10-30 741376] S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Programme\Microsoft Office\Office12\GrooveAuditService.exe [2006-10-27 65824] S3 NMIndexingService;NMIndexingService; C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexingService.exe [2007-09-20 382248] S3 odserv;Microsoft Office Diagnostics Service; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136] S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184] S3 usprserv;User Privilege Service; C:\WINDOWS\System32\svchost.exe [2004-11-11 14336] S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2004-11-11 14336] S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2006-10-30 122880] -----------------EOF----------------- RSIT info.txt: Code:
ATTFilter info.txt logfile of random's system information tool 1.06 2009-12-13 23:24:43
======Uninstall list======
-->C:\Programme\Nero\Nero8\\nero\uninstall\UNNERO.exe /UNINSTALL
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
AC3Filter 1.62b-->"C:\Programme\AC3Filter\unins000.exe"
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\UninstFl.exe -q
Adobe Reader 9.2 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A92000000001}
Amazon MP3-Downloader 1.0.5-->C:\Programme\Amazon\MP3 Downloader\Uninstall.exe
AMD Processor Driver-->C:\Programme\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe -runfromtemp -l0x0007 -removeonly
AnyDVD-->"C:\Programme\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="C:\Programme\SlySoft\AnyDVD"
ATI - Dienstprogramm zur Deinstallation der Software-->C:\Programme\ATI Technologies\UninstallAll\AtiCimUn.exe
ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
Battlefield 1942-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{698D7E61-E4BF-4CA6-8A09-CF6BDBFDEF65}\setup.exe" -l0x7
Battlefield 2(TM)-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{04858915-9F49-4B2A-AED4-DC49A7DE6A7B}\setup.exe" -l0x7 -removeonly
Battlefield Heroes-->"C:\Programme\EA Games\Battlefield Heroes\uninstaller.exe" "C:\Programme\EA Games\Battlefield Heroes\Uninstall.xml"
BioShock-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{E280923D-C5D9-4728-8C79-AC9A0DC75875}\Setup.exe" -l0x7 -removeonly
Call of Juarez - Bound in Blood-->C:\Programme\InstallShield Installation Information\{FEFAF112-4DA8-479C-89E2-7DE25091711A}\Setup.exe -runfromtemp -l0x0407
Catalyst Control Center - Branding-->MsiExec.exe /I{D3B1C799-CB73-42DE-BA0F-2344793A095C}
CBL Daten-Shredder-->MsiExec.exe /I{560E96B3-356D-4572-9FE3-B44F9AB92622}
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
Company of Heroes - FAKEMSI-->MsiExec.exe /I{14574B7F-75D1-4718-B7F2-EBF6E2862A35}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{199E6632-EB28-4F73-AECB-3E192EB92D18}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{25724802-CC14-4B90-9F3B-3D6955EE27B1}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{32C4A4EB-C97D-414E-99C5-38F8DFD31D5D}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{50193078-F553-4EBA-AA77-64C9FAA12F98}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{51D718D1-DA81-4FAD-919F-5C1CE3C33379}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{66F78C51-D108-4F0C-A93C-1CBE74CE338F}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{7F4B1592-222F-4E5F-A100-E5AFD61A0BB3}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{80D03817-7943-4839-8E96-B9F924C5E67D}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{97E5205F-EA4F-438F-B211-F1846419F1C1}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{99A7722D-9ACB-43F3-A222-ABC7133F159E}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{BA801B94-C28D-46EE-B806-E1E021A3D519}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{D4D244D1-05E0-4D24-86A2-B2433C435671}
Company of Heroes - FAKEMSI-->MsiExec.exe /I{EAF636A9-F664-4703-A659-85A894DA264F}
Company of Heroes-->"C:\Programme\THQ\Company of Heroes\Uninstall_German.exe"
CrossLoop 2.44-->"C:\Programme\CrossLoop\unins000.exe"
Crysis(R)-->MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4}
DesertCombat 0.7-->C:\WINDOWS\iun6002.exe "C:\Programme\EA GAMES\Battlefield 1942\DesertCombat.ini"
DH Driver Cleaner Professional Edition-->C:\Programme\Driver Cleaner Pro\Uninstall.exe
DiRT-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{57B89E30-0BBA-4F20-9F2C-8E8CDE1CEDB6}\setup.exe" -l0x7 -removeonly
DivX Web Player-->C:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Everest Casino (Remove Only)-->C:\Programme\Everest Casino\cstart.exe /uninstall
Everest Poker (Remove Only)-->C:\Programme\Everest Poker\cstart.exe /uninstall
Fallout 3-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{974C4B12-4D02-4879-85E0-61C95CC63E9E}\setup.exe" -l0x7 -removeonly
Far Cry 2-->"C:\Programme\InstallShield Installation Information\{F2835483-37F2-4123-B4FE-0E77D58447F2}\setup.exe" -runfromtemp -l0x0007 -removeonly
FUEL-->C:\Programme\InstallShield Installation Information\{F51FF206-2273-4B3E-A90A-4752AE288C12}\setup.exe -runfromtemp -l0x0007 -removeonly
Half-Life 2: Episode One-->"C:\Programme\Valve\Steam\steam.exe" steam://uninstall/380
Half-Life(R) 2-->MsiExec.exe /I{D45EC259-4A19-4656-B588-C2C360DD18EA}
Hellgate: London-->MsiExec.exe /X{A2B4455D-1046-4732-BFBC-0821BEFC07BC}
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Programme\trend micro\HijackThis.exe" /uninstall
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
ICQ6.5-->"C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
Java DB 10.3.1.4-->MsiExec.exe /X{CD49361E-3FE6-457E-90A1-9C59E29B5D02}
Java(TM) 6 Update 17-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Development Kit 6 Update 7-->MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160070}
JUDE Community 5.5.2-->C:\Programme\JUDE-Community\unins000.exe
Left 4 Dead-->"C:\Programme\Valve\Steam\steam.exe" steam://uninstall/500
LogMeIn Hamachi-->C:\WINDOWS\system32\\msiexec.exe /i {067EC517-9731-43FD-B4D5-296EE0027BBB} REMOVE=ALL
LogMeIn Hamachi-->MsiExec.exe /I{067EC517-9731-43FD-B4D5-296EE0027BBB}
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Mangos 2.4.1 Server v3.0-->C:\Programme\WoW Server\uninstall.exe
Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme-->MsiExec.exe /X{90120000-00B2-0407-0000-0000000FF1CE}
Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe
Microsoft .NET Framework 3.0-->c:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0\setup.exe
Microsoft .NET Framework 3.0-->MsiExec.exe /X{15095BF3-A3D7-4DDF-B193-3A496881E003}
Microsoft Games for Windows - LIVE -->MsiExec.exe /X{4D243BA7-9AC4-46D1-90E5-EEB88974F501}
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{05B49229-22A2-4F88-842A-BBC2EBE1CCF6}
Microsoft Office Access MUI (German) 2007-->MsiExec.exe /X{90120000-0015-0407-0000-0000000FF1CE}
Microsoft Office Enterprise 2007-->"C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL
Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}
Microsoft Office Excel MUI (German) 2007-->MsiExec.exe /X{90120000-0016-0407-0000-0000000FF1CE}
Microsoft Office Groove MUI (German) 2007-->MsiExec.exe /X{90120000-00BA-0407-0000-0000000FF1CE}
Microsoft Office InfoPath MUI (German) 2007-->MsiExec.exe /X{90120000-0044-0407-0000-0000000FF1CE}
Microsoft Office OneNote MUI (German) 2007-->MsiExec.exe /X{90120000-00A1-0407-0000-0000000FF1CE}
Microsoft Office Outlook MUI (German) 2007-->MsiExec.exe /X{90120000-001A-0407-0000-0000000FF1CE}
Microsoft Office PowerPoint MUI (German) 2007-->MsiExec.exe /X{90120000-0018-0407-0000-0000000FF1CE}
Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}
Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}
Microsoft Office Proof (German) 2007-->MsiExec.exe /X{90120000-001F-0407-0000-0000000FF1CE}
Microsoft Office Proof (Italian) 2007-->MsiExec.exe /X{90120000-001F-0410-0000-0000000FF1CE}
Microsoft Office Proofing (German) 2007-->MsiExec.exe /X{90120000-002C-0407-0000-0000000FF1CE}
Microsoft Office Publisher MUI (German) 2007-->MsiExec.exe /X{90120000-0019-0407-0000-0000000FF1CE}
Microsoft Office Shared MUI (German) 2007-->MsiExec.exe /X{90120000-006E-0407-0000-0000000FF1CE}
Microsoft Office Word MUI (German) 2007-->MsiExec.exe /X{90120000-001B-0407-0000-0000000FF1CE}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30411-->MsiExec.exe /X{5DA8F6CD-C70E-39D8-8430-3D9808D6BD17}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.5.5)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.23)-->C:\Programme\Mozilla Thunderbird\uninstall\helper.exe
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
Mumble and Murmur-->C:\Programme\Mumble\Uninstall.exe
Nero 8-->MsiExec.exe /X{5E6EC4DD-7B1F-4E10-82B9-EA1B90791031}
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
NetLimiter 2 Pro (remove only)-->"C:\Programme\NetLimiter 2 Pro\nl2uninst.exe"
OCZ Technology Laser Gaming Mouse-->C:\Programme\OCZ Technology\Mouse\Uninst32.exe
Portal: The First Slice-->"C:\Programme\Valve\Steam\steam.exe" steam://uninstall/410
PunkBuster Services-->C:\WINDOWS\system32\pbsvc.exe -u
QT Lite 2.8.0-->"C:\Programme\QT Lite\unins000.exe"
Quake Live Mozilla Plugin-->MsiExec.exe /I{6F3F58D0-6CE9-4B76-B3C2-9E5BD6323992}
Rappelz-->"C:\Program Files\gPotato.eu\Rappelz\unins000.exe"
REALTEK GbE & FE Ethernet PCI NIC Driver-->C:\Programme\InstallShield Installation Information\{ACCA20B0-C4D1-4BF5-BF21-0A0EB5EF9730}\SETUP.EXE -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x7 -removeonly
Requiem-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F9831B39-277F-4F53-BFB0-12DC90C4CB40}\setup.exe" -l0x9 -removeonly
RocketDock 1.3.5-->"C:\Programme\RocketDock\unins000.exe"
Runes of Magic-->"C:\Programme\Runes of Magic\unins000.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
SmartSVN 6-->MsiExec.exe /I{94441B9A-EC26-47D8-946D-610542AA4463}
Sony Ericsson PC Suite-->MsiExec.exe /I{FC906D5C-91F9-4DA4-A765-6DCBB669F317}
Steam(TM)-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Tinc 1.0.10-->"C:\Programme\tinc\Uninstall.exe"
TmNationsForever-->"C:\Programme\TmNationsForever\unins000.exe"
Torchlight - Demo-->"C:\Programme\Valve\Steam\steam.exe" steam://uninstall/41510
Tunngle beta-->"C:\Programme\Tunngle\unins000.exe"
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VCRedistSetup-->MsiExec.exe /I{3921A67A-5AB1-4E48-9444-C71814CF3027}
VLC media player 1.0.1-->C:\Programme\VideoLAN\VLC\uninstall.exe
Warhammer Online - Age of Reckoning-->"C:\Programme\Warhammer Online - Age of Reckoning\unins000.exe"
Winamp-->"C:\Programme\Winamp\UninstWA.exe"
Windows Communication Foundation-->MsiExec.exe /X{491DD792-AD81-429C-9EB4-86DD3D22E333}
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation-->MsiExec.exe /I{7D1B85BD-AA07-48B8-808D-67A4067FC6BD}
Windows-Treiberpaket - Advanced Micro Devices (AmdK8) Processor (05/27/2006 1.3.2.0)-->C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_87B606860B720724BEB5DCEB69E8628A61DE0A7E\amdk8.inf
WinRAR-->C:\Programme\WinRAR\uninstall.exe
World of Warcraft-->C:\Programme\Gemeinsame Dateien\Blizzard Entertainment\WORLD OF WARCRAFT\Uninstall.exe
XviD MPEG-4 Video Codec-->C:\Programme\XviD\unins000.exe
======Security center information======
AV: AntiVir Desktop (disabled) (outdated)
======System event log======
Computer Name: DOM
Event Code: 7036
Message: Dienst "WMI-Leistungsadapter" befindet sich jetzt im Status "Ausgeführt".
Record Number: 11867
Source Name: Service Control Manager
Time Written: 20090912034315.000000+120
Event Type: Informationen
User:
Computer Name: DOM
Event Code: 7036
Message: Dienst "IMAPI-CD-Brenn-COM-Dienste" befindet sich jetzt im Status "Ausgeführt".
Record Number: 11866
Source Name: Service Control Manager
Time Written: 20090912034315.000000+120
Event Type: Informationen
User:
Computer Name: DOM
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "IMAPI-CD-Brenn-COM-Dienste" gesendet.
Record Number: 11865
Source Name: Service Control Manager
Time Written: 20090912034315.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: DOM
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "Kompatibilität für schnelle Benutzerumschaltung" gesendet.
Record Number: 11864
Source Name: Service Control Manager
Time Written: 20090912034315.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: DOM
Event Code: 7036
Message: Dienst "Kompatibilität für schnelle Benutzerumschaltung" befindet sich jetzt im Status "Ausgeführt".
Record Number: 11863
Source Name: Service Control Manager
Time Written: 20090912034315.000000+120
Event Type: Informationen
User:
=====Application event log=====
Computer Name: DOM
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!
Record Number: 444
Source Name: Avira AntiVir
Time Written: 20081020171520.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: DOM
Event Code: 105
Message: The service was started.
Record Number: 443
Source Name: ATI Smart
Time Written: 20081020171513.000000+120
Event Type: Informationen
User:
Computer Name: DOM
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!
Record Number: 442
Source Name: Avira AntiVir
Time Written: 20081020101737.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM
Computer Name: DOM
Event Code: 105
Message: The service was started.
Record Number: 441
Source Name: ATI Smart
Time Written: 20081020101730.000000+120
Event Type: Informationen
User:
Computer Name: DOM
Event Code: 1000
Message: Fehlgeschlagene Anwendung vlc.exe, Version 0.8.6.0, fehlgeschlagenes Modul libwxwidgets_plugin.dll, Version 0.0.0.0, Fehleradresse 0x00166d3c.
Record Number: 440
Source Name: Application Error
Time Written: 20081019235115.000000+120
Event Type: Fehler
User:
======Environment variables======
"CLASSPATH"=.;C:\Dokumente und Einstellungen\Administrator\Desktop\fh\programmieren 1
"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"HellgateEnv"=C:\Programme\Flagship Studios\Hellgate London\
"NUMBER_OF_PROCESSORS"=2
"OS"=Windows_NT
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\ATI Technologies\ATI.ACE\Core-Static;C:\Programme\Gemeinsame Dateien\Teleca Shared;C:\Programme\Java\jdk1.6.0_07\bin;C:\instantclient_11_1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 67 Stepping 3, AuthenticAMD
"PROCESSOR_LEVEL"=15
"PROCESSOR_REVISION"=4303
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"TNS_ADMIN"=C:\instantclient_11_1
"windir"=%SystemRoot%
-----------------EOF-----------------
ich hoffe ich hab nichts vergessen. wäre sehr dankbar für hilfe. gruß dominik |
| Themen zu 'TR/Crypt.XPACK.Gen' in '\Command & Conquer 3 Kane's Wrath\RetailExe\1.0\cnc3ep1.dat' |
| antivir, antivir guard, avgntflt.sys, avira, bho, browser, counter-strike source, crysis, desktop, diagnostics, disabled.securitycenter, drvstore, fehlalarm, firefox, firefox.exe, flash player, fontcache, gservice, hijack, hijackthis, hkus\s-1-5-18, kompatibilität, logfile, malware.packer, malwarebytes' anti-malware, msiexec.exe, plug-in, problem, programm, realtek, registrierungsschlüssel, registry, security, senden, server, skype.exe, software, starten, system, tr/crypt.xpack.ge, tr/crypt.xpack.gen, tr/crypt.xpack.gen', tr/crypt.xpack.gen' [trojan], virus, windows xp |
Baum-Darstellung