Hallo,

Ich habe heute nach einem Virenscannerupdate (antivir) seit längerer Zeit mal wieder mein System komplett scannen lassen, der letzte Scan davor ist ca. 2 Monate her. Dabei wurde der in der Überschrift genannte Trojaner gefunden.
Dieser befand sich in der Datei
c:\users\public\documents\Blizzard Entertainment\World of Warcraft\WoW-3.0.8.9464-to-3.0.8.9506-deDE-patch.exe.part

Wer selbst WoW spielt weiss vielleicht dass der WoW-Launcher die Patchdateien, die er automatisch runterlädt, oder Teile davon, da Blizzard gerne die Exe in mehrere kleinere Happen teilt, in diesem Ordner unterbringt.

Die obige Datei ist eigentlich so ein Teil eines Patches, den ich im Mai 2009 heruntergeladen und installiert habe, seitdem wurde die Datei nicht mehr (wissentlich) gestartet oder benutzt. Die Quelle ist folglich der offizielle Update-Server von Blizzard.

Es kommt mir nun ein wenig merkwürdig vor, dass sich ausgerechnet in einer so uralten (Rechner damals frisch aufgesetzt) Datei, die eigentlich auch nur für den Fall dass ich WoW mal neu installieren muss da rumliegt plötzlich ein Trojaner befinden soll, der sich da vor 2 Monaten beim letzten umfassenden Systemscan noch nicht befand.

Der PC zeigt ansonsten keine Auffälligkeiten, keine Abstürze, keine Slowdowns, keine Werbepopups, nichts.

Ich habe die Datei vorsichtshalber mal in Quarantäne verschoben, ein abermaliger Suchlauf brachte dann keine Funde mehr. Malwarebytes Anti-Malwares findet ebenso nichts.

Meine Frage nun:
Fällt jemandem an Hand der RSIT/HijackThis-Logs irgendetwas beunruhigendes auf?
Und wie kann ich mich versichern, ob es sich da wirklich um Fehlalarm handelt?

Hier noch die HijackThis/RSIT-Logs:

Run by moritz at 2010-04-16 21:46:03
Microsoft® Windows Vista™ Home Premium Service Pack 2
System drive C: has 27 GB (26%) free of 104 GB
Total RAM: 6141 MB (67% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 21:46:05, on 16.04.2010
Platform: Windows Vista SP2 (WinNT 6.00.1906)
MSIE: Internet Explorer v8.00 (8.00.6001.18904)
Boot mode: Normal

Running processes:
C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
C:\Program Files (x86)\Razer\Naga\NagaTray.exe
C:\Program Files (x86)\ROCCAT\Kone Mouse\osd.exe
D:\RSIT.exe
D:\moritz.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://g.uk.msn.com/USCON/8
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://go.microsoft.com/fwlink/?LinkId=69157
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant =
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch =
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Window Title = Internet Explorer bereitgestellt von Dell
R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName =
O1 - Hosts: ::1 localhost
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: (no name) - {5C255C8A-E604-49b4-9D64-90988571CECB} - (no file)
O2 - BHO: Search Helper - {6EBF7485-159F-4bff-A14F-B9E3AAC4465B} - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
O2 - BHO: Windows Live Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll
O2 - BHO: Windows Live Toolbar Helper - {E15A8DC0-8516-42A1-81EA-DC94EC1ACF10} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O3 - Toolbar: &Windows Live Toolbar - {21FA44EF-376D-4D53-9B0F-8A89D3229068} - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll
O4 - HKLM\..\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe"
O4 - HKLM\..\Run: [Kone] "C:\Program Files (x86)\ROCCAT\Kone Mouse\KoneHID.EXE"
O4 - HKLM\..\Run: [Razer Naga Driver] C:\Program Files (x86)\Razer\Naga\NagaTray.exe
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] "C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" /install /silent
O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra button: In Blog veröffentlichen - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra 'Tools' menuitem: In Windows Live Writer in Blog veröffentliche&n - {219C3416-8CB2-491a-A3C7-D9FCDDC9D600} - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
O9 - Extra button: Senden an Bluetooth - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O9 - Extra 'Tools' menuitem: Senden an &Bluetooth-Gerät... - {CCA281CA-C863-46ef-9331-5C8D4460577F} - c:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
O13 - Gopher Prefix:
O17 - HKLM\System\CCS\Services\Tcpip\..\{1A73C3FA-4A44-4CED-B0BC-E9355D4CAE0F}: NameServer = 193.254.160.1 193.254.160.130
O17 - HKLM\System\CS1\Services\Tcpip\..\{1A73C3FA-4A44-4CED-B0BC-E9355D4CAE0F}: NameServer = 193.254.160.1 193.254.160.130
O17 - HKLM\System\CS2\Services\Tcpip\..\{1A73C3FA-4A44-4CED-B0BC-E9355D4CAE0F}: NameServer = 193.254.160.1 193.254.160.130
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
O23 - Service: Andrea ST Filters Service (AESTFilters) - Unknown owner - C:\Windows\system32\AESTSr64.exe (file missing)
O23 - Service: @%SystemRoot%\system32\Alg.exe,-112 (ALG) - Unknown owner - C:\Windows\System32\alg.exe (file missing)
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Dragon Age: Origins - Inhaltsupdater (DAUpdaterSvc) - BioWare - H:\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
O23 - Service: @dfsrres.dll,-101 (DFSR) - Unknown owner - C:\Windows\system32\DFSR.exe (file missing)
O23 - Service: Dock Login Service (DockLoginService) - Stardock Corporation - C:\Program Files\Dell\DellDock\DockLogin.exe
O23 - Service: @keyiso.dll,-100 (KeyIso) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @comres.dll,-2797 (MSDTC) - Unknown owner - C:\Windows\System32\msdtc.exe (file missing)
O23 - Service: @%SystemRoot%\System32\netlogon.dll,-102 (Netlogon) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: Dell Internal Network Card Power Management (nicconfigsvc) - Dell Inc. - C:\Program Files\Dell\QuickSet\NicConfigSvc.exe
O23 - Service: NVIDIA Display Driver Service (nvsvc) - Unknown owner - C:\Windows\system32\nvvsvc.exe (file missing)
O23 - Service: @%systemroot%\system32\psbase.dll,-300 (ProtectedStorage) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%systemroot%\system32\Locator.exe,-2 (RpcLocator) - Unknown owner - C:\Windows\system32\locator.exe (file missing)
O23 - Service: @%SystemRoot%\system32\samsrv.dll,-1 (SamSs) - Unknown owner - C:\Windows\system32\lsass.exe (file missing)
O23 - Service: @%SystemRoot%\system32\SLsvc.exe,-101 (slsvc) - Unknown owner - C:\Windows\system32\SLsvc.exe (file missing)
O23 - Service: @%SystemRoot%\system32\snmptrap.exe,-3 (SNMPTRAP) - Unknown owner - C:\Windows\System32\snmptrap.exe (file missing)
O23 - Service: @%systemroot%\system32\spoolsv.exe,-1 (Spooler) - Unknown owner - C:\Windows\System32\spoolsv.exe (file missing)
O23 - Service: SigmaTel Audio Service (STacSV) - Unknown owner - C:\Windows\system32\STacSV64.exe (file missing)
O23 - Service: stllssvr - MicroVision Development, Inc. - C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
O23 - Service: @%SystemRoot%\system32\ui0detect.exe,-101 (UI0Detect) - Unknown owner - C:\Windows\system32\UI0Detect.exe (file missing)
O23 - Service: @%SystemRoot%\system32\vds.exe,-100 (vds) - Unknown owner - C:\Windows\System32\vds.exe (file missing)
O23 - Service: @%systemroot%\system32\vssvc.exe,-102 (VSS) - Unknown owner - C:\Windows\system32\vssvc.exe (file missing)
O23 - Service: @%Systemroot%\system32\wbem\wmiapsrv.exe,-110 (wmiApSrv) - Unknown owner - C:\Windows\system32\wbem\WmiApSrv.exe (file missing)
O23 - Service: @%ProgramFiles%\Windows Media Player\wmpnetwk.exe,-101 (WMPNetworkSvc) - Unknown owner - C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe (file missing)

--
End of file - 8330 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2010-04-04 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{5C255C8A-E604-49b4-9D64-90988571CECB}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{6EBF7485-159F-4bff-A14F-B9E3AAC4465B}]
Search Helper - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll [2009-05-19 137600]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{9030D464-4C02-4ABF-8ECC-5164760863C6}]
Windows Live Anmelde-Hilfsprogramm - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-02-17 408440]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll [2010-03-09 41760]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E15A8DC0-8516-42A1-81EA-DC94EC1ACF10}]
Windows Live Toolbar Helper - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [2008-12-08 1067352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{21FA44EF-376D-4D53-9B0F-8A89D3229068} - &Windows Live Toolbar - C:\Program Files (x86)\Windows Live\Toolbar\wltcore.dll [2008-12-08 1067352]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"avgnt"=C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"SunJavaUpdateSched"=C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-02-18 248040]
"Kone"=C:\Program Files (x86)\ROCCAT\Kone Mouse\KoneHID.EXE [2008-10-06 151552]
"Razer Naga Driver"=C:\Program Files (x86)\Razer\Naga\NagaTray.exe [2010-01-02 1631616]
"Adobe Reader Speed Launcher"=C:\Program Files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe [2010-04-04 36272]
"Adobe ARM"=C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe [2010-03-29 437584]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1
"EnableUIADesktopToggle"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoActiveDesktop"=
"ForceActiveDesktopOn"=
"BindDirectlyToPropertySetStorage"=
"NoActiveDesktopChanges"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44073b7b-48ad-11de-be26-00219bf92a17}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{44073b9f-48ad-11de-be26-00219bf92a17}]
shell\AutoRun\command - F:\AutoRun.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{616a9206-4943-11de-9bc7-806e6f6e6963}]
shell\AutoRun\command - F:\AutoRun.exe


======File associations======

.js - edit - C:\Windows\SysWOW64\Notepad.exe %1
.js - open - C:\Windows\SysWOW64\WScript.exe "%1" %*

======List of files/folders created in the last 1 months======

2010-04-16 21:39:53 ----D---- C:\rsit
2010-04-16 08:19:22 ----SHD---- C:\Config.Msi
2010-04-15 08:40:17 ----A---- C:\Windows\system32\vbscript.dll
2010-04-14 14:48:30 ----A---- C:\Windows\system32\cabview.dll
2010-04-14 14:48:29 ----A---- C:\Windows\system32\wintrust.dll
2010-04-14 02:27:56 ----D---- C:\Users\moritz\AppData\Roaming\WinRAR
2010-04-11 15:10:59 ----D---- C:\Program Files (x86)\NVIDIA Corporation
2010-04-11 15:08:15 ----A---- C:\Windows\system32\OpenCL.dll
2010-04-11 15:08:15 ----A---- C:\Windows\system32\nvwgf2um.dll
2010-04-11 15:08:12 ----A---- C:\Windows\system32\nvoglv32.dll
2010-04-11 15:08:10 ----A---- C:\Windows\system32\nvd3dum.dll
2010-04-11 15:08:10 ----A---- C:\Windows\system32\nvcuvid.dll
2010-04-11 15:08:08 ----A---- C:\Windows\system32\nvcuvenc.dll
2010-04-11 15:08:08 ----A---- C:\Windows\system32\nvcuda.dll
2010-04-11 15:08:08 ----A---- C:\Windows\system32\nvcompiler.dll
2010-04-11 15:08:05 ----A---- C:\Windows\system32\nvapi.dll
2010-04-07 23:35:16 ----A---- C:\Windows\IsUninst.exe
2010-03-31 08:33:44 ----A---- C:\Windows\system32\mshtml.dll
2010-03-31 08:33:40 ----A---- C:\Windows\system32\iertutil.dll
2010-03-31 08:33:40 ----A---- C:\Windows\system32\ieframe.dll
2010-03-31 08:33:39 ----A---- C:\Windows\system32\wininet.dll
2010-03-31 08:33:39 ----A---- C:\Windows\system32\urlmon.dll
2010-03-31 08:33:39 ----A---- C:\Windows\system32\occache.dll
2010-03-31 08:33:39 ----A---- C:\Windows\system32\mstime.dll
2010-03-31 08:33:39 ----A---- C:\Windows\system32\msfeeds.dll
2010-03-31 08:33:39 ----A---- C:\Windows\system32\iedkcs32.dll
2010-03-31 08:33:38 ----A---- C:\Windows\system32\msfeedssync.exe
2010-03-31 08:33:38 ----A---- C:\Windows\system32\msfeedsbs.dll
2010-03-31 08:33:38 ----A---- C:\Windows\system32\jsproxy.dll
2010-03-31 08:33:38 ----A---- C:\Windows\system32\ieUnatt.exe
2010-03-31 08:33:38 ----A---- C:\Windows\system32\ieui.dll
2010-03-31 08:33:38 ----A---- C:\Windows\system32\iesysprep.dll
2010-03-31 08:33:38 ----A---- C:\Windows\system32\iesetup.dll
2010-03-31 08:33:38 ----A---- C:\Windows\system32\iernonce.dll
2010-03-31 08:33:38 ----A---- C:\Windows\system32\iepeers.dll
2010-03-31 08:33:38 ----A---- C:\Windows\system32\ie4uinit.exe
2010-03-30 18:39:32 ----D---- C:\ProgramData\Sun
2010-03-30 18:39:31 ----D---- C:\Program Files (x86)\Common Files\Java
2010-03-30 18:39:22 ----A---- C:\Windows\system32\javaws.exe
2010-03-30 18:39:22 ----A---- C:\Windows\system32\javaw.exe
2010-03-30 18:39:22 ----A---- C:\Windows\system32\java.exe
2010-03-21 15:06:23 ----D---- C:\Users\moritz\AppData\Roaming\Skype
2010-03-21 15:06:17 ----D---- C:\Program Files (x86)\Common Files\Skype
2010-03-21 15:06:16 ----RD---- C:\Program Files (x86)\Skype

======List of files/folders modified in the last 1 months======

2010-04-16 21:46:02 ----D---- C:\Windows\Temp
2010-04-16 21:45:34 ----D---- C:\Windows\Prefetch
2010-04-16 21:03:03 ----D---- C:\Program Files (x86)\Malwarebytes' Anti-Malware
2010-04-16 21:03:00 ----D---- C:\Windows\system32\drivers
2010-04-16 20:54:48 ----D---- C:\Windows\Minidump
2010-04-16 20:54:48 ----D---- C:\Windows\Debug
2010-04-16 20:54:48 ----D---- C:\Windows
2010-04-16 20:53:22 ----D---- C:\Program Files (x86)\CCleaner
2010-04-16 19:52:42 ----D---- C:\Windows\System32
2010-04-16 19:52:42 ----D---- C:\Windows\inf
2010-04-16 19:28:00 ----SHD---- C:\System Volume Information
2010-04-16 08:19:46 ----SHD---- C:\Windows\Installer
2010-04-16 08:19:16 ----D---- C:\Windows\SysWOW64
2010-04-15 19:12:10 ----D---- C:\Windows\winsxs
2010-04-15 09:08:57 ----D---- C:\Program Files (x86)\Windows Mail
2010-04-15 03:15:18 ----D---- C:\Users\moritz\AppData\Roaming\uTorrent
2010-04-14 02:27:33 ----RD---- C:\Program Files
2010-04-14 02:27:25 ----D---- C:\Installationsdateien
2010-04-11 15:12:21 ----D---- C:\NVIDIA
2010-04-11 15:12:11 ----D---- C:\ProgramData\NVIDIA
2010-04-11 15:10:59 ----D---- C:\Program Files (x86)
2010-04-11 15:10:58 ----D---- C:\Program Files (x86)\Common Files\Wise Installation Wizard
2010-04-11 15:10:58 ----D---- C:\Program Files (x86)\AGEIA Technologies
2010-04-08 00:05:28 ----D---- C:\Windows\Help
2010-04-04 13:34:27 ----D---- C:\Program Files (x86)\Mozilla Thunderbird
2010-04-03 11:43:15 ----D---- C:\Program Files (x86)\Mozilla Firefox
2010-03-31 18:43:22 ----D---- C:\Windows\system32\migration
2010-03-31 18:43:22 ----D---- C:\Program Files (x86)\Internet Explorer
2010-03-30 18:39:32 ----HD---- C:\ProgramData
2010-03-30 18:39:31 ----D---- C:\Program Files (x86)\Common Files
2010-03-30 18:39:20 ----D---- C:\Program Files (x86)\Java
2010-03-21 17:01:36 ----D---- C:\Users\moritz\AppData\Roaming\skypePM
2010-03-21 15:06:16 ----D---- C:\ProgramData\Skype

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 {2E444BE9-B8EC-4CE6-8C2B-6536FB7F4FB7};{2E444BE9-B8EC-4CE6-8C2B-6536FB7F4FB7}; \??\C:\Program Files (x86)\Dell\MediaDirect\000.fcl [2007-09-07 32240]
R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys []
R2 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmpx64.sys []
R2 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimspx64.sys []
R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdpx64.sys []
R3 b57nd60a;Broadcom NetXtreme-Gigabit-Ethernet - NDIS 6.0; C:\Windows\system32\DRIVERS\b57nd60a.sys []
R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys []
R3 ksthunk;Kernel Streaming Thunks; C:\Windows\system32\drivers\ksthunk.sys []
R3 NETw4v64;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 64 Bit; C:\Windows\system32\DRIVERS\NETw4v64.sys []
R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys []
R3 OEM02Dev;Creative Camera OEM002 Driver; C:\Windows\system32\DRIVERS\OEM02Dev.sys []
R3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver; C:\Windows\system32\DRIVERS\OEM02Vfx.sys []
R3 RzSynapse;Razer Naga Driver; C:\Windows\system32\DRIVERS\RzSynapse.sys []
R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys []
R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt64.sys []
R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys []
S3 BthEnum;Bluetooth-Auflistungsdienst; C:\Windows\system32\DRIVERS\BthEnum.sys []
S3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys []
S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys []
S3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\Windows\System32\Drivers\BTHUSB.sys []
S3 btwaudio;Bluetooth-Audiogerät; C:\Windows\system32\drivers\btwaudio.sys []
S3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys []
S3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys []
S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys []
S3 e1express;Intel(R) PRO/1000 PCI Express-Netzwerkverbindungstreiber; C:\Windows\system32\DRIVERS\e1e6032e.sys []
S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys []
S3 hwdatacard;Huawei DataCard USB Modem and USB Serial; C:\Windows\system32\DRIVERS\ewusbmdm.sys []
S3 KoneFltr;ROCCAT Kone; C:\Windows\system32\drivers\Kone.sys []
S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys []
S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys []
S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys []
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys []
S3 R300;R300; C:\Windows\system32\DRIVERS\atikmdag.sys []
S3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys []
S3 WinUSB;WinUSB FSL; C:\Windows\system32\DRIVERS\WinUSB.sys []
S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys []
S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys []
S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys []
S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\system32\AESTSr64.exe []
R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [2009-06-15 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [2009-08-05 185089]
R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]
R2 DockLoginService;Dock Login Service; C:\Program Files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
R2 nicconfigsvc;Dell Internal Network Card Power Management; C:\Program Files\Dell\QuickSet\NicConfigSvc.exe [2008-02-22 592464]
R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe []
R2 SeaPort;SeaPort; C:\Program Files (x86)\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe [2009-05-19 240512]
R2 STacSV;SigmaTel Audio Service; C:\Windows\system32\STacSV64.exe []
S3 clr_optimization_v2.0.50727_64;Microsoft .NET Framework NGEN v2.0.50727_X64; C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe [2009-03-30 89920]
S3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater; H:\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]
S3 PerfHost;@%systemroot%\sysWow64\perfhost.exe,-2; C:\Windows\SysWow64\perfhost.exe [2008-01-21 19968]
S3 stllssvr;stllssvr; C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe [2008-03-24 74384]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.06 2010-04-16 21:40:01

======Uninstall list======

-->C:\Windows\CtDrvIns.exe -uninstall -script OEM002.uns -unsext NTamd64 -plugin OEM02Pin.dll -pluginres OEM02Pin.crl -nodisconprompt -langid 0x0407
-->MsiExec /X{DEA314C4-0929-4250-BC92-98E4C105F28D}
-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x7
-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{D5BA7C09-E523-478C-9C37-A1D86C76383E}\setup.exe" -l0x7
µTorrent-->"H:\utorrent\uTorrent.exe" /UNINSTALL
Adobe Flash Player 10 ActiveX-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\Windows\SysWOW64\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9.3.2 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A93000000001}
Advanced Audio FX Engine-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{88564CEF-20A5-4EF2-A05F-309F2EBA9B06}\setup.exe" -l0x7 /remove
Advanced Video FX Engine-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{D5BA7C09-E523-478C-9C37-A1D86C76383E}\setup.exe" -l0x7 /remove
Avira AntiVir Personal - Free Antivirus-->C:\Program Files (x86)\Avira\AntiVir Desktop\setup.exe /REMOVE
CCleaner-->"C:\Program Files (x86)\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
Compatibility Pack für 2007 Office System-->MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE}
Dragon Age: Origins-->C:\Program Files (x86)\Common Files\BioWare\Uninstall Dragon Age.exe
Enigma-->"C:\Spiele\Enigma\uninstall.exe"
Filzip 3.06-->"C:\Program Files (x86)\Filzip\unins000.exe"
GOM Player-->"C:\Program Files (x86)\GRETECH\GomPlayer\Uninstall.exe"
Haali Media Splitter-->"C:\Program Files (x86)\Haali\MatroskaSplitter\uninstall.exe"
HijackThis 2.0.2-->"C:\Users\moritz\Downloads\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {08155812-0202-4D5F-A7FF-12A2782DC548} /qb+ REBOOTPROMPT=""
Java(TM) 6 Update 19-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Junk Mail filter update-->MsiExec.exe /I{4AB8B41B-3AF1-46BE-99B0-0ACD3B300C0A}
Malwarebytes' Anti-Malware-->"C:\Program Files (x86)\Malwarebytes' Anti-Malware\unins000.exe"
MediaDirect-->C:\Program Files (x86)\InstallShield Installation Information\{9C6978E8-B6D0-4AB7-A7A0-D81A74FBF745}\setup.exe -runfromtemp -l0x0007 -cluninstall
Microsoft Search Enhancement Pack-->MsiExec.exe /X{4CBA3D4C-8F51-4D60-B27E-F6B641C571E7}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft SQL Server 2005 Compact Edition [ENU]-->MsiExec.exe /I{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}
Microsoft Sync Framework Runtime Native v1.0 (x86)-->MsiExec.exe /I{8A74E887-8F0F-4017-AF53-CBA42211AAA5}
Microsoft Sync Framework Services Native v1.0 (x86)-->MsiExec.exe /I{BD64AF4A-8C80-4152-AD77-FCDDF05208AB}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{837b34e3-7c30-493c-8f6a-2b0f04e2912c}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Microsoft Works-->MsiExec.exe /I{39D0E034-1042-4905-BECB-5502909FCB7C}
Miranda IM 0.8.11-->C:\Program Files (x86)\Miranda IM\Uninstall.exe
Mozilla Firefox (3.6.3)-->C:\Program Files (x86)\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (3.0.4)-->C:\Program Files (x86)\Mozilla Thunderbird\uninstall\helper.exe
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
Naga Firmware Updater 1.07-->MsiExec.exe /I{5A336D74-E680-4986-96F4-E9CEBC784F56}
NVIDIA PhysX-->MsiExec.exe /X{DEA314C4-0929-4250-BC92-98E4C105F28D}
OpenOffice.org 3.1-->MsiExec.exe /I{D765F1CE-5AE5-4C47-B134-AE58AC474740}
OutlookAddinSetup-->MsiExec.exe /I{9BDEF074-020E-458D-ADC5-8FF68E0C9B56}
Razer Naga-->MsiExec.exe /X{F3CC3463-C6C2-4667-BDAC-BC517A11628F}
Real Alternative 2.0.1-->"C:\Program Files (x86)\Real Alternative\unins000.exe"
ROCCAT Kone Mouse Driver-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{9733747E-E53D-4C17-977E-3A872AFB93E1}\Setup.exe"
Roxio Creator Audio-->MsiExec.exe /I{73A4F29F-31AC-4EBD-AA1B-0CC5F18C8F83}
Roxio Creator Copy-->MsiExec.exe /I{B6A26DE5-F2B5-4D58-9570-4FC760E00FCD}
Roxio Creator Data-->MsiExec.exe /I{08E81ABD-79F7-49C2-881F-FD6CB0975693}
Roxio Creator DE-->C:\ProgramData\Uninstall\{09760D42-E223-42AD-8C3E-55B47D0DDAC3}\setup.exe /x {09760D42-E223-42AD-8C3E-55B47D0DDAC3}
Roxio Creator DE-->MsiExec.exe /I{ED439A64-F018-4DD4-8BA5-328D85AB09AB}
Roxio Creator Tools-->MsiExec.exe /I{1F54DAFA-9261-4A62-B59D-6C9F26B48FE4}
Roxio Express Labeler 3-->MsiExec.exe /I{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}
Roxio Update Manager-->MsiExec.exe /I{30465B6C-B53F-49A1-9EBA-A3F187AD502E}
SigmaTel Audio-->RunDll32 C:\PROGRA~2\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files (x86)\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x7 -remove -removeonly
Skype™ 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->c:\Windows\SysWOW64\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Warcraft III-->C:\Windows\War3Unin.exe C:\Windows\War3Unin.dat
Winamp-->"C:\Program Files (x86)\Winamp\UninstWA.exe"
Windows Live Anmelde-Assistent-->MsiExec.exe /I{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}
Windows Live Call-->MsiExec.exe /I{835686C5-8650-49EB-8CA0-4528B4035495}
Windows Live Communications Platform-->MsiExec.exe /I{F69E83CF-B440-43F8-89E6-6EA80712109B}
Windows Live Essentials-->C:\Program Files (x86)\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{DF5F687F-8018-4542-9F98-7084E9022917}
Windows Live Fotogalerie-->MsiExec.exe /X{6B96DADA-1A27-4A04-8CB2-CC45168D05FA}
Windows Live Mail-->MsiExec.exe /I{5A166C0B-9557-4364-A057-F946D674E6AC}
Windows Live Messenger-->MsiExec.exe /X{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}
Windows Live Sync-->MsiExec.exe /X{8C1E2925-14F8-45AA-B999-1E2A74BF5607}
Windows Live Toolbar-->MsiExec.exe /X{566BAEC0-74CB-4ACC-9E18-8779AC974FB0}
Windows Live Writer-->MsiExec.exe /X{81821BF8-DA20-4F8C-AA87-F70A274828D4}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Xvid 1.2.2 final uninstall-->"C:\Program Files (x86)\Xvid\unins000.exe"

======Security center information======

AS: Windows Defender

======System event log======

Computer Name: moritz-PC
Event Code: 7036
Message: Dienst "TCP/IP-NetBIOS-Hilfsdienst" befindet sich jetzt im Status "Ausgeführt".
Record Number: 56926
Source Name: Service Control Manager
Time Written: 20090924162654.000000-000
Event Type: Informationen
User:

Computer Name: moritz-PC
Event Code: 7036
Message: Dienst "Netzwerkspeicher-Schnittstellendienst" befindet sich jetzt im Status "Ausgeführt".
Record Number: 56925
Source Name: Service Control Manager
Time Written: 20090924162654.000000-000
Event Type: Informationen
User:

Computer Name: moritz-PC
Event Code: 7036
Message: Dienst "Windows Driver Foundation - Benutzermodus-Treiberframework" befindet sich jetzt im Status "Ausgeführt".
Record Number: 56924
Source Name: Service Control Manager
Time Written: 20090924162654.000000-000
Event Type: Informationen
User:

Computer Name: moritz-PC
Event Code: 7036
Message: Dienst "Tablet PC-Eingabedienst" befindet sich jetzt im Status "Ausgeführt".
Record Number: 56923
Source Name: Service Control Manager
Time Written: 20090924162654.000000-000
Event Type: Informationen
User:

Computer Name: moritz-PC
Event Code: 7036
Message: Dienst "Sicherheitskonto-Manager" befindet sich jetzt im Status "Ausgeführt".
Record Number: 56922
Source Name: Service Control Manager
Time Written: 20090924162654.000000-000
Event Type: Informationen
User:

=====Application event log=====

Computer Name: moritz-PC
Event Code: 223
Message: WinMail (2964) WindowsMail0: Sicherung von Protokolldateien (Bereich C:\Users\moritz\AppData\Local\Microsoft\Windows Mail\edb00001.log - C:\Users\moritz\AppData\Local\Microsoft\Windows Mail\edb00001.log) wird gestartet.
Record Number: 401
Source Name: ESENT
Time Written: 20090507180154.000000-000
Event Type: Informationen
User:

Computer Name: moritz-PC
Event Code: 221
Message: WinMail (2964) WindowsMail0: Sicherung der Datei C:\Users\moritz\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore wird beendet.
Record Number: 400
Source Name: ESENT
Time Written: 20090507180154.000000-000
Event Type: Informationen
User:

Computer Name: moritz-PC
Event Code: 220
Message: WinMail (2964) WindowsMail0: Sicherung der Datei C:\Users\moritz\AppData\Local\Microsoft\Windows Mail\WindowsMail.MSMessageStore (Größe 2 Mb) beginnt.
Record Number: 399
Source Name: ESENT
Time Written: 20090507180154.000000-000
Event Type: Informationen
User:

Computer Name: moritz-PC
Event Code: 210
Message: WinMail (2964) WindowsMail0: Eine vollständige Sicherung wird gestartet.
Record Number: 398
Source Name: ESENT
Time Written: 20090507180154.000000-000
Event Type: Informationen
User:

Computer Name: moritz-PC
Event Code: 102
Message: WinMail (2964) WindowsMail0: Das Datenbankmodul (6.00.6001.0000) hat eine neue Instanz gestartet (0).
Record Number: 397
Source Name: ESENT
Time Written: 20090507180153.000000-000
Event Type: Informationen
User:

=====Security event log=====

Computer Name: moritz-PC
Event Code: 4634
Message: Ein Konto wurde abgemeldet.

Antragsteller:
Sicherheits-ID: S-1-5-7
Kontoname: ANONYMOUS-ANMELDUNG
Kontodomäne: NT-AUTORITÄT
Anmelde-ID: 0x36410

Anmeldetyp: 3

Dieses Ereignis wird generiert, wenn eine Anmeldesitzung zerstört wird. Es kann anhand des Wertes der Anmelde-ID positiv mit einem Anmeldeereignis korreliert werden. Anmelde-IDs sind nur zwischen Neustarts auf demselben Computer eindeutig.
Record Number: 445
Source Name: Microsoft-Windows-Security-Auditing
Time Written: 20090507193732.828000-000
Event Type: Überwachung erfolgreich
User:

Computer Name: moritz-PC
Event Code: 1108
Message: Der Ereignisprotokollierungsdienst hat einen Fehler beim Verarbeiten eines eingehenden Ereignisses erkannt, das von "Microsoft-Windows-Security-Auditing" veröffentlicht wurde.
Record Number: 444
Source Name: Microsoft-Windows-Eventlog
Time Written: 20090507193732.796800-000
Event Type: Überwachung erfolgreich
User:

Computer Name: moritz-PC
Event Code: 1108
Message: Der Ereignisprotokollierungsdienst hat einen Fehler beim Verarbeiten eines eingehenden Ereignisses erkannt, das von "Microsoft-Windows-Security-Auditing" veröffentlicht wurde.
Record Number: 443
Source Name: Microsoft-Windows-Eventlog
Time Written: 20090507193732.796800-000
Event Type: Überwachung erfolgreich
User:

Computer Name: moritz-PC
Event Code: 1100
Message: Der Ereignisprotokollierungsdienst wurde heruntergefahren.
Record Number: 442
Source Name: Microsoft-Windows-Eventlog
Time Written: 20090507193732.709000-000
Event Type: Überwachung erfolgreich
User:

Computer Name: moritz-PC
Event Code: 1102
Message: Das Überwachungsprotokoll wurde gelöscht.
Subjekt:
Sicherheits- ID: S-1-5-21-2952007077-1049892783-3684959568-1000
Kontoname: moritz
Domänenname: moritz-PC
Logon-ID: 0xbf566
Record Number: 441
Source Name: Microsoft-Windows-Eventlog
Time Written: 20090507180115.869102-000
Event Type: Überwachung erfolgreich
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"Path"=c:\Program Files (x86)\NVIDIA Corporation\PhysX\Common;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files (x86)\Common Files\Roxio Shared\DLLShared\;C:\Program Files (x86)\Common Files\Roxio Shared\10.0\DLLShared\
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC
"PROCESSOR_ARCHITECTURE"=AMD64
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"USERNAME"=SYSTEM
"windir"=%SystemRoot%
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=Intel64 Family 6 Model 23 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=1706
"NUMBER_OF_PROCESSORS"=2
"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\34FB5F65-FFEB-4B61-BF0E-A6A76C450FAA\TraceFormat
"DFSTRACINGON"=FALSE
"RoxioCentral"=C:\Program Files (x86)\Common Files\Roxio Shared\10.0\Roxio Central36\

-----------------EOF-----------------