win32.tdss.rtk

Atoll · 26.04.2010, 13:32

Hallo hallo,

Spybot findet immerwieder den Trojaner win32.tdss.rtk. Zudem gab's ein paar Probleme mit Mozilla, der hängenbleibt und ich dann meinen Rechner nicht mehr runterfahren konnte. Affengriff (str+alt+entf) ging ebenfalls nicht. Da dies erst seitdem ich win32.tdss.rtk entdeckt habe auftritt, schreib ich's mal dazu.

Hier sind die Logs:

Malwarebytes' Anti-Malware 1.45
wxxw.malwarebytes.org

Datenbank Version: 4036

Windows 5.1.2600 Service Pack 2
Internet Explorer 6.0.2900.2180

26.04.2010 14:05:56
mbam-log-2010-04-26 (14-05-56).txt

Art des Suchlaufs: Quick-Scan
Durchsuchte Objekte: 103965
Laufzeit: 2 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 1
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 5
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
C:\WINDOWS\system\svchost.exe (Backdoor.Bot) -> Unloaded process successfully.

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Backdoor.Bot) -> Data: c:\windows\system\svchost.exe -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\AntiVirusDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\FirewallDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\UpdatesDisableNotify (Disabled.SecurityCenter) -> Bad: (1) Good: (0) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.Userinit) -> Bad: (userinit.exe,C:\WINDOWS\system\svchost.exe) Good: (Userinit.exe) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
C:\WINDOWS\system\svchost.exe (Backdoor.Bot) -> Quarantined and deleted successfully.

_______________________________________________________________

Logfile of random's system information tool 1.06 (written by random/random)
Run by Fernando Poo at 2010-04-26 14:16:05
Microsoft Windows XP Professional Service Pack 2
System drive C: has 23 GB (18%) free of 128 GB
Total RAM: 2815 MB (82% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 14:16:11, on 26.04.2010
Platform: Windows XP SP2 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP2 (6.00.2900.2180)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\WTouch\WTouchService.exe
C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
C:\Programme\Gemeinsame Dateien\Native Instruments\Hardware\NIHardwareService.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesApp32.exe
C:\Programme\WTouch\WTouchUser.exe
C:\Programme\SyncroSoft\Pos\H2O\cledx.exe
C:\Programme\DivX\DivX Update\DivXUpdate.exe
C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\Dropbox\bin\Dropbox.exe
C:\Programme\Googlemail Notifier\gnotify.exe
C:\WINDOWS\system32\WTablet\Pen_TabletUser.exe
C:\WINDOWS\system32\Pen_Tablet.exe
C:\WINDOWS\System32\svchost.exe
C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe
C:\Dokumente und Einstellungen\Fernando Poo\Desktop\RSIT.exe
C:\Programme\trend micro\Fernando Poo.exe

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Bar = about.blank
R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = about.blank
R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = about.blank
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O4 - HKLM\..\Run: [H2O] C:\Programme\SyncroSoft\Pos\H2O\cledx.exe
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [DivXUpdate] "C:\Programme\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
O4 - Startup: Dropbox.lnk = C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\Dropbox\bin\Dropbox.exe
O4 - Startup: gnotify.lnk = C:\Programme\Googlemail Notifier\gnotify.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe (file missing)
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: Lavasoft Ad-Aware Service - Lavasoft - C:\Programme\Lavasoft\Ad-Aware\AAWService.exe
O23 - Service: M-Audio Series II MIDI Installer (MA_CMIDI_InstallerService) - Unknown owner - C:\Programme\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe
O23 - Service: NIHardwareService - Native Instruments GmbH - C:\Programme\Gemeinsame Dateien\Native Instruments\Hardware\NIHardwareService.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: TabletServicePen - Wacom Technology, Corp. - C:\WINDOWS\system32\Pen_Tablet.exe
O23 - Service: TuneUp Drive Defrag-Dienst (TuneUp.Defrag) - TuneUp Software - C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe
O23 - Service: TuneUp Utilities Service (TuneUp.UtilitiesSvc) - TuneUp Software - C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe
O23 - Service: WTouch Service (WTouchService) - Wacom Technology, Corp. - C:\Programme\WTouch\WTouchService.exe

--
End of file - 4031 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Ad-Aware Update (Daily 1).job
C:\WINDOWS\tasks\Ad-Aware Update (Daily 2).job
C:\WINDOWS\tasks\Ad-Aware Update (Daily 3).job
C:\WINDOWS\tasks\Ad-Aware Update (Daily 4).job
C:\WINDOWS\tasks\Ad-Aware Update (Weekly).job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"H2O"=C:\Programme\SyncroSoft\Pos\H2O\cledx.exe [2005-10-23 385024]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-08-17 13877248]
"nwiz"=nwiz.exe /install []
"DivXUpdate"=C:\Programme\DivX\DivX Update\DivXUpdate.exe [2010-04-13 1135912]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ad-Watch]
C:\Programme\Lavasoft\Ad-Aware\AAWTray.exe [2010-01-27 788880]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Reader Speed Launcher]
C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-10-03 35696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\AdobeCS4ServiceManager]
C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Ask and Record FLV Service]
C:\Programme\Replay Media Catcher\FLVSrvc.exe [2009-09-22 156672]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cmaudio]
RunDll32 cmicnfg.cpl,CMICtrlWnd []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools-1033]
C:\Programme\D-Tools\daemon.exe [2004-08-22 81920]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Dit]
C:\WINDOWS\Dit.exe [2004-07-20 90112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\IMJPMIG8.1]
C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2004-08-04 208952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\M-Audio Taskbar Icon]
C:\WINDOWS\System32\M-AudioTaskBarIcon.exe [2007-01-25 154112]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvCplDaemon]
C:\WINDOWS\system32\NvCpl.dll [2009-08-17 13877248]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\NvMediaCenter]
C:\WINDOWS\system32\NvMcTray.dll [2009-08-17 86016]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\nwiz]
C:\Programme\NVIDIA Corporation\nView\nwiz.exe [2009-08-12 1657376]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002A]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PHIME2002ASync]
C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2004-08-04 455168]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\QuickTime Task]
C:\Programme\QuickTime\QTTask.exe [2009-01-05 413696]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Programme\Skype\Phone\Skype.exe [2009-10-09 25623336]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Verknüpfung mit der High Definition Audio-Eigenschaftenseite]
C:\WINDOWS\system32\HDAudPropShortcut.exe [2004-03-17 61952]

C:\Dokumente und Einstellungen\Fernando Poo\Startmenü\Programme\Autostart
Dropbox.lnk - C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\Dropbox\bin\Dropbox.exe
gnotify.lnk - C:\Programme\Googlemail Notifier\gnotify.exe

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Lavasoft Ad-Aware Service]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145
"NoSMHelp"=01000000
"NoLogoff"=0
"NoActiveDesktop"=01000000
"NoSMMyDocs"=01000000
"StartMenuLogOff"=1

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"C:\Programme\uTorrent\uTorrent.exe"="C:\Programme\uTorrent\uTorrent.exe:*:Enabled:µTorrent"
"C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Programme\Skype\Plugin Manager\skypePM.exe"="C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{674c33ca-a2d9-11de-8ac2-000c76710209}]
shell\AutoRun\command - C:\WINDOWS\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL wscript.exe FRECHBUBU.vbs

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{8715acb0-7792-11de-8a87-000c76710209}]
shell\AutoRun\command - N:\MI.exe

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d4ffac94-0860-11df-8b79-000c76710209}]
shell\AutoRun\command - ·Ë
shell\explore\command - K:\RECYCLER\INFO.exe
shell\open\command - K:\RECYCLER\INFO.exe

======List of files/folders created in the last 1 months======

2010-04-26 14:16:06 ----D---- C:\Programme\trend micro
2010-04-26 14:16:05 ----D---- C:\rsit
2010-04-26 13:58:10 ----D---- C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\Malwarebytes
2010-04-26 13:58:02 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-04-26 13:58:02 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-04-26 13:51:29 ----D---- C:\Programme\CCleaner
2010-04-24 22:01:50 ----A---- C:\WINDOWS\system32\TURegOpt.exe
2010-04-24 22:01:49 ----A---- C:\WINDOWS\system32\uxtuneup.dll
2010-04-24 22:01:33 ----D---- C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\TuneUp Software
2010-04-24 22:01:19 ----D---- C:\Programme\TuneUp Utilities 2010
2010-04-24 22:00:39 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TuneUp Software
2010-04-24 22:00:32 ----SHD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D3742F82-1C1A-4DCC-ABBD-0E7C3C0185CC}
2010-04-22 04:26:21 ----D---- C:\Programme\Wbcm and Screen Recorder
2010-04-22 03:59:44 ----D---- C:\Programme\Zeallsoft
2010-04-21 21:31:50 ----D---- C:\videooutput
2010-04-21 21:31:47 ----D---- C:\Programme\FLV to AVI MPEG WMV Converter
2010-04-21 21:31:47 ----A---- C:\WINDOWS\system32\xvidvfw.dll
2010-04-21 21:31:47 ----A---- C:\WINDOWS\system32\xvidcore.dll
2010-04-21 21:31:47 ----A---- C:\WINDOWS\system32\NCMedia2.dll
2010-04-21 21:27:43 ----D---- C:\Programme\Webcam Simulator
2010-04-21 21:27:43 ----D---- C:\Programme\Gemeinsame Dateien\wcs
2010-04-18 01:22:04 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX

======List of files/folders modified in the last 1 months======

2010-04-26 14:16:06 ----D---- C:\Programme
2010-04-26 14:13:51 ----D---- C:\WINDOWS\Prefetch
2010-04-26 14:09:41 ----SD---- C:\WINDOWS\Tasks
2010-04-26 14:09:07 ----D---- C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\Dropbox
2010-04-26 14:08:59 ----D---- C:\WINDOWS\Temp
2010-04-26 14:08:58 ----D---- C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\WTablet
2010-04-26 14:08:52 ----D---- C:\WINDOWS
2010-04-26 14:07:37 ----D---- C:\WINDOWS\system32\drivers
2010-04-26 14:07:37 ----D---- C:\WINDOWS\pchealth
2010-04-26 14:06:45 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-04-26 14:05:56 ----D---- C:\WINDOWS\system
2010-04-26 13:54:22 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-04-26 13:54:00 ----D---- C:\WINDOWS\Minidump
2010-04-26 13:54:00 ----D---- C:\WINDOWS\Debug
2010-04-26 02:56:59 ----D---- C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\uTorrent
2010-04-26 02:21:58 ----D---- C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\vlc
2010-04-24 22:11:57 ----D---- C:\WINDOWS\AppPatch
2010-04-24 22:01:53 ----SHD---- C:\WINDOWS\Installer
2010-04-24 22:01:51 ----D---- C:\WINDOWS\system32\config
2010-04-24 22:01:50 ----D---- C:\WINDOWS\system32
2010-04-23 18:34:55 ----D---- C:\WINDOWS\system32\CatRoot2
2010-04-22 04:57:16 ----D---- C:\Programme\Replay Media Catcher
2010-04-22 04:51:16 ----A---- C:\WINDOWS\system32\rmc_rtspdl.dll
2010-04-22 04:51:16 ----A---- C:\WINDOWS\system32\rmc_fixasf.exe
2010-04-21 21:27:43 ----D---- C:\Programme\Gemeinsame Dateien
2010-04-21 15:26:58 ----D---- C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\Skype
2010-04-21 15:23:36 ----D---- C:\Dokumente und Einstellungen\Fernando Poo\Anwendungsdaten\skypePM
2010-04-18 02:21:12 ----D---- C:\Programme\DivX
2010-04-18 02:20:37 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared
2010-04-16 15:11:28 ----D---- C:\Programme\Mozilla Firefox
2010-03-28 15:11:04 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2004-08-04 40192]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2004-08-04 14848]
R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2004-08-04 60800]
R3 CLEDX;Team H2O CLEDX service; C:\WINDOWS\system32\DRIVERS\cledx.sys [2005-05-09 33792]
R3 cmudax;C-Media High Definition Audio Interface; C:\WINDOWS\system32\drivers\cmudax.sys [2005-05-12 1287296]
R3 DELTA;Service for Delta Driver (WDM); C:\WINDOWS\system32\DRIVERS\delta.sys [2007-01-25 302336]
R3 FETND5BV;VIA Rhine-Family Fast Ethernet Adapter Driver Service; C:\WINDOWS\system32\DRIVERS\fetnd5bv.sys [2006-10-27 43008]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2004-04-26 135168]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2004-08-04 9600]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2004-08-04 61824]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-08-17 7729568]
R3 TuneUpUtilitiesDrv;TuneUpUtilitiesDrv; \??\C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesDriver32.sys []
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2004-08-04 31616]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2004-08-03 26624]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2004-08-03 57600]
R3 usbstor;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2004-08-04 26496]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2004-08-03 20480]
R3 wacommousefilter;Wacom Mouse Filter Driver; C:\WINDOWS\system32\DRIVERS\wacommousefilter.sys [2007-02-16 11312]
R3 wacomvhid;Wacom Virtual Hid Driver; C:\WINDOWS\system32\DRIVERS\wacomvhid.sys [2009-05-20 13736]
R3 WacomVKHid;Virtual Keyboard Driver; C:\WINDOWS\system32\DRIVERS\WacomVKHid.sys [2007-02-15 11440]
S2 Nsynas32;Nsynas32; C:\WINDOWS\system32\drivers\Nsynas32.sys []
S3 CardReaderFilter;Card Reader Filter; \??\C:\WINDOWS\system32\Drivers\USBCRFT.SYS []
S3 HdAudAddService;Microsoft UAA-Funktionstreiber für den High Definition Audio-Dienst; C:\WINDOWS\system32\drivers\HdAudio.sys [2004-03-17 113664]
S3 MA_CMIDI;M-Audio USB Driver; C:\WINDOWS\system32\drivers\ma_cmidi.sys [2006-08-16 21888]
S3 usbaudio;USB-Audiotreiber (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2004-08-03 59264]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2004-08-03 25856]
S3 wacmoumonitor;Wacom Mode Helper; C:\WINDOWS\system32\DRIVERS\wacmoumonitor.sys [2009-01-30 15656]

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 Lavasoft Ad-Aware Service;Lavasoft Ad-Aware Service; C:\Programme\Lavasoft\Ad-Aware\AAWService.exe [2010-02-05 1181328]
R2 MA_CMIDI_InstallerService;M-Audio Series II MIDI Installer; C:\Programme\M-Audio\M-Audio Series II MIDI\MA_CMIDI_Inst.exe [2007-01-08 94208]
R2 NIHardwareService;NIHardwareService; C:\Programme\Gemeinsame Dateien\Native Instruments\Hardware\NIHardwareService.exe [2009-07-17 3576320]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-08-17 168004]
R2 TabletServicePen;TabletServicePen; C:\WINDOWS\system32\Pen_Tablet.exe [2009-09-08 4410152]
R2 TuneUp.UtilitiesSvc;TuneUp Utilities Service; C:\Programme\TuneUp Utilities 2010\TuneUpUtilitiesService32.exe [2010-04-01 1050440]
R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2005-01-28 38912]
R2 UxTuneUp;TuneUp Designerweiterung; C:\WINDOWS\System32\svchost.exe [2004-08-04 14336]
R2 WTouchService;WTouch Service; C:\Programme\WTouch\WTouchService.exe [2009-09-08 112936]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2007-10-24 33800]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-11-25 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S3 TuneUp.Defrag;TuneUp Drive Defrag-Dienst; C:\Programme\TuneUp Utilities 2010\TuneUpDefragService.exe [2010-04-24 435016]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------

________________________________________________________________

info.txt logfile of random's system information tool 1.06 2010-04-26 14:16:13

======Uninstall list======

-->C:\WINDOWS\IsUninst.exe -f\"C:\Programme\Final Fantasy VII\Uninst.isu"
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
7-Zip 4.65-->"C:\Programme\7-Zip\Uninstall.exe"
ACDSee Photo Manager 2009-->MsiExec.exe /I{300578F9-9EFF-4B93-9AB1-C0E5707EF463}
Ad-Aware-->"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe" REMOVE=TRUE MODIFY=FALSE
Ad-Aware-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{CFBD8779-FAAB-4357-84F2-1EC8619FADA6}\Ad-AwareInstallation.exe
Adobe AIR-->c:\Programme\Gemeinsame Dateien\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
Adobe Bridge CS4-->MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0}
Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
Adobe Color - Photoshop Specific CS4-->MsiExec.exe /I{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
Adobe Color EU Extra Settings CS4-->MsiExec.exe /I{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}
Adobe Color JA Extra Settings CS4-->MsiExec.exe /I{0D6013AB-A0C7-41DC-973C-E93129C9A29F}
Adobe Color NA Recommended Settings CS4-->MsiExec.exe /I{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}
Adobe Color Video Profiles CS CS4-->MsiExec.exe /I{63C24A08-70F3-4C8E-B9FB-9F21A903801D}
Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}
Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}
Adobe Device Central CS4-->MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A}
Adobe Drive CS4-->MsiExec.exe /I{16E16F01-2E2D-4248-A42F-76261C147B6C}
Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Fonts All-->MsiExec.exe /I{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}
Adobe Linguistics CS4-->MsiExec.exe /I{931AB7EA-3656-4BB7-864D-022B09E3DD67}
Adobe Media Player-->msiexec /qb /x {39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Media Player-->MsiExec.exe /I{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}
Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}
Adobe Photoshop CS4 Support-->MsiExec.exe /I{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}
Adobe Photoshop CS4-->C:\Programme\Gemeinsame Dateien\Adobe\Installers\faf656ef605427ee2f42989c3ad31b8\Setup.exe --uninstall=1
Adobe Photoshop CS4-->MsiExec.exe /I{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}
Adobe Photoshop CS4-->MsiExec.exe /I{E4848436-0345-47E2-B648-8B522FCDA623}
Adobe Reader 9.2 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A92000000001}
Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
Adobe Setup-->MsiExec.exe /I{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}
Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}
Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
AdobeColorCommonSetCMYK-->MsiExec.exe /I{68243FF8-83CA-466B-B2B8-9F99DA5479C4}
AdobeColorCommonSetRGB-->MsiExec.exe /I{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}
Amazing Slow Downer (remove only)-->"C:\Programme\Amazing Slow Downer\uninstall.exe"
AmpegSVX-->C:\Programme\InstallShield Installation Information\{CF1D7323-8A0A-49C7-83B0-088DB90721E2}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
AmpliTube Jimi Hendrix-->C:\Programme\InstallShield Installation Information\{66BA35B0-1911-47EF-B170-1DCFFDA362F1}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
AmpliTube2-->C:\Programme\InstallShield Installation Information\{C95AACD4-9507-4F5C-9D53-22B1ACCFECD1}\setup.exe -runfromtemp -l0x0009 uninstall -removeonly
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Applian Director-->"C:\WINDOWS\Applian Director\uninstall.exe" "/U:C:\Programme\Applian Director\Uninstall\uninstall_director.xml"
Arturia Modular System v1.0-->C:\PROGRA~1\Arturia\MODULA~1\UNWISE.EXE C:\PROGRA~1\Arturia\MODULA~1\INSTALL.LOG
Atmosphere-->C:\Programme\Spectrasonics\Atmosphere\unins000.exe
Audio Damage DubStation VST v1.0.2.0-->C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\AUDIOD~1\DUBUNI~1\UNWISE.EXE C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\AUDIOD~1\DUBUNI~1\INSTALL.LOG
Bass Audio Decoder (remove only)-->"C:\Programme\Bass Audio Decoder\uninstall.exe"
BigTick Rhino v1.01-->C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\Rhino\UNWISE.EXE C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\Rhino\INSTALL.LOG
CamStudio-->C:\Programme\CamStudio\uninstall.exe
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
CD Audio Reader Filter (remove only)-->"C:\Programme\CD Audio Reader Filter\uninstall.exe"
C-Media High Definition Audio Driver-->C:\WINDOWS\system32\cmirmdrv.exe
Color Efex Pro 3.0 Complete-->C:\Programme\Adobe\Adobe Photoshop CS4\Plug-ins\Nik Software\Color Efex Pro 3.0 Complete\uninstall.exe
Connect-->MsiExec.exe /I{B29AD377-CC12-490A-A480-1452337C618D}
DAEMON Tools-->MsiExec.exe /I{3DED3A72-61A8-4B87-98A5-EF0BC8038AA0}
Daphne 1.46-->C:\Programme\Daphne\uninst.exe
DCoder Image Source (remove only)-->"C:\Programme\DCoder Image Source\uninstall.exe"
DeepBurner v1.9.0.228-->"C:\Programme\DeepBurner\Uninstall.exe" "C:\Programme\DeepBurner\install.log" -u
Delta-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{A4810699-E859-43A6-8F40-1743873E72AB}\setup.exe" -l0x9 -removeonly
Deus Ex-->C:\Programme\DeusEx\System\Setup.exe uninstall "Deus Ex"
Dfine 2.0-->C:\Programme\Adobe\Adobe Photoshop CS4\Plug-ins\Nik Software\Dfine 2.0\uninstall.exe
DirectVobSub (remove only)-->"C:\Programme\DirectVobSub\uninstall.exe"
Discord 2 VST plug-in-->C:\WINDOWS\Discord 2 VST plug-in Uninstaller.exe
DivX Codec-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX\DivX7\DivX Codec\DivXCodecUninstall.exe /CODEC
DivX Player-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX\DivX7\DivX Player\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX\DivX7\DivX Plus DirectShow Filters\DivXDSFiltersUninstall.exe /DSFILTERS
DivX-Setup-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\DivX\Setup\DivXSetup.exe /uninstall /bundleGroupId divx.com
DScaler 5 Mpeg Decoders-->"C:\Programme\DScaler5\unins000.exe"
DVD Shrink 3.2 deutsch (DeCSS-frei)-->"C:\Programme\DVD Shrink\unins000.exe"
East West Stormdrum Kompakt-->C:\PROGRA~1\STORMD~1\UNWISE.EXE C:\PROGRA~1\STORMD~1\INSTALL.LOG
Edirol SuperQuartet v1.5-->C:\PROGRA~1\Edirol\SUPERQ~1\UNWISE.EXE C:\PROGRA~1\Edirol\SUPERQ~1\INSTALL.LOG
Exact Audio Copy 0.99pb5-->C:\Programme\Exact Audio Copy\uninst.exe
FabFilter One 3.05-->C:\Programme\FabFilter\One\Uninst.exe
FabFilter Pro-C VST RTAS v1.10-->"C:\Programme\FabFilter\unins000.exe"
FabFilter Simplon VST RTAS v1.01-->"C:\Programme\Steinberg\Cubase SX 3\Vstplugins\FabFilter\Simplon\Uninstall\unins000.exe"
FabFilter Timeless v1.00 VST-->C:\PROGRA~1\FABFIL~1\Timeless\UNWISE.EXE C:\PROGRA~1\FABFIL~1\Timeless\INSTALL.LOG
FabFilter Volcano 2.00-->C:\Programme\FabFilter\Volcano 2\Uninst.exe
Fallout-->C:\WINDOWS\ipuninst.exe -fC:\Program Files\Fallout\uninst.log
FileZilla Client 3.2.4.1-->C:\Programme\FileZilla FTP Client\uninstall.exe
Final Fantasy VII - Ultima Edition-->"C:\Programme\Final Fantasy VII\unins000.exe"
Focusrite Saffire Bundle VST v2.0-->C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\SAFFIR~1.0\UNINST~1\UNWISE.EXE C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\SAFFIR~1.0\UNINST~1\INSTALL.LOG
Free YouTube to Mp3 Converter version 3.1-->"C:\Programme\YouTube to Mp3\unins000.exe"
Freez FLV to AVI/MPEG/WMV Converter-->"C:\Programme\FLV to AVI MPEG WMV Converter\unins000.exe"
Futuremark SystemInfo-->"C:\Programme\InstallShield Installation Information\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}\setup.exe" -runfromtemp -l0x0009 -removeonly
Gabest MPEG Splitter (remove only)-->"C:\Programme\Gabest MPEG Splitter\uninstall.exe"
Garritan Jazz Big Band-->C:\PROGRA~1\GARRIT~1\UNWISE.EXE C:\PROGRA~1\GARRIT~1\INSTALL.LOG
Generic USB CardReader 2.0-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{EA1CB7AC-E221-4822-A789-0ADB051DC498}\Setup.exe" -l0x9 -wUninst
Guitar Pro 5.2-->"C:\Programme\Guitar Pro 5\unins000.exe"
High Definition Audio Driver Package - KB835221-->C:\WINDOWS\$NtUninstallKB835221WXP$\spuninst\spuninst.exe
HijackThis 2.0.2-->"C:\Programme\trend micro\HijackThis.exe" /uninstall
ILLUSION Sexy???3~????????DISC~-->MsiExec.exe /X{F5DCB11C-8F09-4C71-B952-B96DBB4E6584}
ILLUSION Sexy???3-->MsiExec.exe /X{6E7F60B4-F1E9-473F-A6BA-1C1C73A63592}
iZotope Alloy-->"C:\Programme\iZotope\Alloy\unins000.exe"
iZotope Ozone 4-->"C:\Programme\iZotope\Ozone 4\unins000.exe"
JPGVideo 1.05.0.0-->C:\Programme\JPGVideo\unins000.exe
kuler-->MsiExec.exe /I{098727E1-775A-4450-B573-3F441F1CA243}
Lexicon PSP42 1.4-->C:\PROGRA~1\PSP\LEXICO~1\UNWISE.EXE C:\PROGRA~1\PSP\LEXICO~1\INSTALL.LOG
LightZone 3.8-->C:\Programme\LightZone 3\uninstall.exe
Lounge Lizard EP-2 v2.0-->C:\PROGRA~1\LOUNGE~1\UNINST~1\UNWISE.EXE C:\PROGRA~1\LOUNGE~1\UNINST~1\INSTALL.LOG
LucasArts' Grim Fandango-->C:\WINDOWS\uninst.exe -f"C:\Program Files\LucasArts\Grim\DeIsL1.isu"
Magic ISO Maker v5.5 (build 0276)-->C:\PROGRA~1\MagicISO\UNWISE.EXE C:\PROGRA~1\MagicISO\INSTALL.LOG
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
M-Audio Series II MIDI-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{379BD39E-F13E-458F-96D8-56BD7F2CC516}\setup.exe" -l0x9 -removeonly
Melodyne 3.1-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{A1F143D1-1F0D-44FB-A44B-71D4367D16DE}\setup.exe" -l0x9 -removeonly
Microsoft .NET Framework 2.0 Service Pack 1 Language Pack - DEU-->MsiExec.exe /I{9309DD7E-EBFE-3C95-8B47-30D3A012F606}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft .NET Framework 3.0 Service Pack 1 Language Pack - DEU-->MsiExec.exe /I{A1071AEB-B0EF-3F5F-BC84-83A270EBE496}
Microsoft .NET Framework 3.0 Service Pack 1-->MsiExec.exe /I{2BA00471-0328-3743-93BD-FA813353A783}
Microsoft .NET Framework 3.5 Language Pack - DEU-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack - deu-->MsiExec.exe /I{1545207E-C6F3-31D7-9918-BDBB65075FBF}
Microsoft .NET Framework 3.5-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5\setup.exe
Microsoft .NET Framework 3.5-->MsiExec.exe /I{2FC099BD-AC9B-33EB-809C-D332E1B27C40}
Microsoft AppLocale-->MsiExec.exe /I{394BE3D9-7F57-4638-A8D1-1D88671913B7}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}
Microsoft Windows Application Compatibility Database-->C:\WINDOWS\system32\sdbinst.exe -u "C:\WINDOWS\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb"
MONOGRAM AMR Splitter/Decoder (remove only)-->"C:\Programme\MONOGRAM AMR SplitterDecoder\uninstall.exe"
Mozilla Firefox (3.6.3)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
MSXML 6.0 Parser (KB933579)-->MsiExec.exe /I{0A869A65-8C94-4F7C-A5C7-972D3C8CED9E}
N.I. Guitar Rig v2.0.2-->C:\Programme\Native Instruments\Guitar Rig 2\uninstall.exe
Native Instruments B4 II-->C:\PROGRA~1\NATIVE~1\B4II~1\UNWISE.EXE C:\PROGRA~1\NATIVE~1\B4II~1\INSTALL.LOG
Native Instruments Controller Editor-->"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{0CC51CB2-911C-40BB-BC1B-BD3CAC590222}\Controller Editor Setup.exe" REMOVE=TRUE MODIFY=FALSE
Native Instruments Controller Editor-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{0CC51CB2-911C-40BB-BC1B-BD3CAC590222}\Controller Editor Setup.exe
Native Instruments Guitar Rig 3-->C:\PROGRA~1\NATIVE~1\GUITAR~2\UNWISE.EXE C:\PROGRA~1\NATIVE~1\GUITAR~2\INSTALL.LOG
Native Instruments Guitar Rig 4-->"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D69A48BF-7653-4AA8-94BC-5847522A4573}\Guitar Rig 4 Setup PC.exe" REMOVE=TRUE MODIFY=FALSE
Native Instruments Guitar Rig 4-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D69A48BF-7653-4AA8-94BC-5847522A4573}\Guitar Rig 4 Setup PC.exe
Native Instruments Massive v1.0.1.008 VSTi DXi RTAS-->C:\PROGRA~1\NATIVE~1\Massive\UNWISE.EXE C:\PROGRA~1\NATIVE~1\Massive\INSTALL.LOG
Native Instruments Service Center-->"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D7CFB71A-972A-44FF-AE44-8780EB53ABB2}\Service Center Setup.exe" REMOVE=TRUE MODIFY=FALSE
Native Instruments Service Center-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{D7CFB71A-972A-44FF-AE44-8780EB53ABB2}\Service Center Setup.exe
Native.Instruments Battery v3.0.1.005 VSTi DXi RTAS-->C:\PROGRA~1\NATIVE~1\BATTER~1\UNWISE.EXE C:\PROGRA~1\NATIVE~1\BATTER~1\INSTALL.LOG
Nomad Factory Blue Tubes Bundle v2.0-->C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\BLUETU~1\NOMADF~1\UNWISE.EXE C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\BLUETU~1\NOMADF~1\INSTALL.LOG
Nomad Factory Rock Amp Legends VST v1.0-->C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\NOMADF~1\UNWISE.EXE C:\PROGRA~1\STEINB~1\CUBASE~1\VSTPLU~1\NOMADF~1\INSTALL.LOG
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA nView Desktop Manager-->C:\Programme\NVIDIA Corporation\nView\nViewSetup.exe -uninstall
OpenAL-->"C:\Programme\OpenAL\OpenALwEAX.exe" /U
OpenOffice.org 3.1-->MsiExec.exe /I{D765F1CE-5AE5-4C47-B134-AE58AC474740}
OpenSource DTS/AC3/DD+ Source Filter (remove only)-->"C:\Programme\OpenSource DTSAC3DD+ Source Filter\uninstall.exe"
OpenSource Flash Video Splitter (remove only)-->"C:\Programme\OpenSource Flash Video Splitter\uninstall.exe"
PDF Settings CS4-->MsiExec.exe /I{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}
Photomatix Pro version 3.2-->"C:\Programme\PhotomatixPro3\unins000.exe"
Photoshop Camera Raw-->MsiExec.exe /I{CC75AB5C-2110-4A7F-AF52-708680D22FE8}
PSP 84 v1.0-->C:\PROGRA~1\PSP\PSP84~1\UNWISE.EXE C:\PROGRA~1\PSP\PSP84~1\INSTALL.LOG
PSP EasyVerb 1.5.4-->"C:\Programme\PSP\PSP EasyVerb\uninstall.exe" "/U:C:\Programme\PSP\PSP EasyVerb\irunin.xml"
PSP MasterQ 1.5.0-->"C:\Programme\PSP\PSP MasterQ 1.5.0\uninstall.exe" "/U:C:\Programme\PSP\PSP MasterQ 1.5.0\irunin.xml"
PSP Nitro 1.1.0-->C:\WINDOWS\iun6002.exe "C:\Programme\PSP\PSP Nitro\irunin.ini"
PSP PianoVerb 1.0-->C:\WINDOWS\iun506.exe C:\Programme\PSP\PianoVerb\irunin.ini
PSP VintageWarmer 2.0.0-->"C:\Programme\PSP\PSP VintageWarmer 2.0.0\uninstall.exe" "/U:C:\Programme\PSP\PSP VintageWarmer 2.0.0\irunin.xml"
PTLens-->MsiExec.exe /I{23773C74-EBEE-41FB-86ED-58B599A2B586}
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
RealMedia (remove only)-->"C:\Programme\RealMedia\uninstall.exe"
Replay Converter 3-->"C:\WINDOWS\Replay Converter 3\uninstall.exe" "/U:C:\Programme\Applian Director\Replay Converter\Uninstall\ReplayConverrter3Uninstall.xml"
Replay Media Catcher-->"C:\WINDOWS\Replay Media Catcher\uninstall.exe" "/U:C:\Programme\Replay Media Catcher\Uninstall\uninstall.xml"
Requiem: Avenging Angel(TM)-->C:\WINDOWS\IsUninst.exe -fC:\Programme\3DO\Requiem\Uninst.isu
Royale Remixed Theme-->MsiExec.exe /I{993A94A9-DCE3-4774-B35D-D8C74FC1E0BE}
Samsung_MonSetup-->C:\Programme\InstallShield Installation Information\{8EA79DBF-D637-448A-89D6-410A087A4493}\setup.exe -runfromtemp -l0x0009 -removeonly
Sharpener Pro 3.0-->C:\Programme\Adobe\Adobe Photoshop CS4\Plug-ins\Nik Software\Sharpener Pro 3.0\uninstall.exe
SHOUTcast Source (remove only)-->"C:\Programme\SHOUTcast Source\uninstall.exe"
Silver Efex Pro-->C:\Programme\Adobe\Adobe Photoshop CS4\Plug-ins\Nik Software\Silver Efex Pro\uninstall.exe
Skype web features-->MsiExec.exe /I{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}
Skype·4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
SpeedFan (remove only)-->"C:\Programme\SpeedFan\uninstall.exe"
Spybot - Search & Destroy-->"C:\Programme\Spybot - Search & Destroy\unins000.exe"
Steinberg Cubase SX 3-->"C:\Programme\Steinberg\Cubase SX 3\Uninstall.exe" "C:\Programme\Steinberg\Cubase SX 3\install.log"
Stifttablett-->C:\Programme\Tablet\Pen\Remove.exe /u
Suite Shared Configuration CS4-->MsiExec.exe /I{842B4B72-9E8F-4962-B3C1-1C422A5C4434}
SyncroSoft Emu (Remove only)-->C:\Programme\SyncroSoft\Pos\H2O\Uninst.exe
Syncrosofts Lizenz Kontrolle-->C:\PROGRA~1\SYNCRO~1\UNWISE.EXE C:\PROGRA~1\SYNCRO~1\INSTALL.LOG
Trespasser-->C:\Programme\DreamWorks Interactive\Trespasser\setup95.exe /uninstall
Trilogy-->C:\Programme\Spectrasonics\Trilogy\unins000.exe
TuneUp Utilities-->C:\Programme\TuneUp Utilities 2010\TUInstallHelper.exe --Trigger-Uninstall
Tweak UI-->"C:\WINDOWS\system32\mshta.exe" "res://C:\WINDOWS\system32\TweakUI.exe/uninstall.hta"
Uninstall 1.0.0.1-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe"
Vanguard Demo 1.03-->"C:\Programme\Steinberg\Cubase SX 3\Vstplugins\unins000.exe"
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VIA Rhine-Family Fast Ethernet Adapter-->Rundll32.exe vuins32.dll,vuins32Ex $Rhine $VIA
Visual C++ 2008 x86 Runtime - (v9.0.30729)-->MsiExec.exe /X{F333A33D-125C-32A2-8DCE-5C5D14231E27}
Visual C++ 2008 x86 Runtime - v9.0.30729.01-->C:\WINDOWS\system32\msiexec.exe /x {F333A33D-125C-32A2-8DCE-5C5D14231E27} /qb+ REBOOTPROMPT=""
Viveza-->C:\Programme\Adobe\Adobe Photoshop CS4\Plug-ins\Nik Software\Viveza\uninstall.exe
VLC media player 1.0.5-->C:\Programme\VLC\uninstall.exe
WaveLab 6-->"C:\Programme\Steinberg\WaveLab 6\Uninstall.exe" "C:\Programme\Steinberg\WaveLab 6\install.log"
Waves API Collection-->C:\PROGRA~1\Waves\Logs\WAVESA~1\UNWISE.EXE C:\PROGRA~1\Waves\Logs\WAVESA~1\INSTALL.LOG
Waves GTR 3-->C:\PROGRA~1\Waves\Logs\WAVESG~1\UNWISE.EXE C:\PROGRA~1\Waves\Logs\WAVESG~1\INSTALL.LOG
Waves L3 LL-->C:\PROGRA~1\Waves\Logs\WAVESL~1\UNWISE.EXE C:\PROGRA~1\Waves\Logs\WAVESL~1\INSTALL.LOG
Waves Mercury Bundle-->C:\PROGRA~1\Waves\Logs\WAVESM~1\UNWISE.EXE C:\PROGRA~1\Waves\Logs\WAVESM~1\INSTALL.LOG
Waves SSL Collection v1.2-->C:\PROGRA~1\Waves\AIRLOG~1\WAVESS~1.2\UNWISE.EXE C:\PROGRA~1\Waves\AIRLOG~1\WAVESS~1.2\INSTALL.LOG
Webcam and Screen Recorder 4.5.6-->"C:\Programme\Wbcm and Screen Recorder\unins000.exe"
Webcam Simulator 6.3-->"C:\Programme\Webcam Simulator\unins000.exe"
Winamp-->"C:\Programme\Winamp\UninstWA.exe"
Windows Imaging Component-->"C:\WINDOWS\$NtUninstallWIC$\spuninst\spuninst.exe"
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Media Format Runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Player Firefox Plugin-->MsiExec.exe /I{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}
WinRAR archiver-->C:\Programme\WinRAR\uninstall.exe
Wizoo WizooVerb W2 VST RTAS v1.0-->C:\PROGRA~1\Wizoo\WIZOOV~1\UNINST~1\UNWISE.EXE C:\PROGRA~1\Wizoo\WIZOOV~1\UNINST~1\INSTALL.LOG
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Zeallsoft Super Webcam Recorder 4.0-->"C:\Programme\Zeallsoft\Super Webcam Recorder\unins000.exe"

======Hosts File======

127.0.0.1 activate.adobe.com
127.0.0.1 practivate.adobe.com
127.0.0.1 ereg.adobe.com
127.0.0.1 activate.wip3.adobe.com
127.0.0.1 wip3.adobe.com
127.0.0.1 3dns-3.adobe.com
127.0.0.1 3dns-2.adobe.com
127.0.0.1 adobe-dns.adobe.com
127.0.0.1 adobe-dns-2.adobe.com
127.0.0.1 adobe-dns-3.adobe.com

======System event log======

Computer Name: HAGBARD
Event Code: 7000
Message: Der Dienst "Nsynas32" wurde aufgrund folgenden Fehlers nicht gestartet:
Das System kann die angegebene Datei nicht finden.

Record Number: 21313
Source Name: Service Control Manager
Time Written: 20100419223248.000000+120
Event Type: Fehler
User:

Computer Name: HAGBARD
Event Code: 51
Message: Bei einem Auslagerungsvorgang wurde ein Fehler festgestellt. Betroffen ist Gerät \Device\CdRom2.

Record Number: 21312
Source Name: Cdrom
Time Written: 20100419223234.000000+120
Event Type: Warnung
User:

Computer Name: HAGBARD
Event Code: 4201
Message: Netzwerkadapter "VIA...Fast Ethernet Adapter - Paketplaner-Miniport" wurde mit dem Netzwerk verbunden, und das
System wurde über das Netzwerk im normalen Zustand gestartet.

Record Number: 21311
Source Name: Tcpip
Time Written: 20100419223234.000000+120
Event Type: Informationen
User:

Computer Name: HAGBARD
Event Code: 6005
Message: Der Ereignisprotokolldienst wurde gestartet.

Record Number: 21310
Source Name: EventLog
Time Written: 20100419223221.000000+120
Event Type: Informationen
User:

Computer Name: HAGBARD
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Multiprocessor Free.

Record Number: 21309
Source Name: EventLog
Time Written: 20100419223221.000000+120
Event Type: Informationen
User:

=====Application event log=====

Computer Name: HAGBARD
Event Code: 11707
Message: Product: Microsoft AppLocale -- Installation completed successfully.

Record Number: 2082
Source Name: MsiInstaller
Time Written: 20091118020239.000000+060
Event Type: Informationen
User: HAGBARD\Fernando Poo

Computer Name: HAGBARD
Event Code: 101
Message: wuauclt (3528) Das Datenbankmodul wurde beendet.

Record Number: 2081
Source Name: ESENT
Time Written: 20091117134930.000000+060
Event Type: Informationen
User:

Computer Name: HAGBARD
Event Code: 103
Message: wuaueng.dll (3528) SUS20ClientDataStore: Das Datenbankmodul hat die Instanz (0) beendet.

Record Number: 2080
Source Name: ESENT
Time Written: 20091117134930.000000+060
Event Type: Informationen
User:

Computer Name: HAGBARD
Event Code: 102
Message: wuaueng.dll (3528) SUS20ClientDataStore: Das Datenbankmodul hat eine neue Instanz gestartet (0).

Record Number: 2079
Source Name: ESENT
Time Written: 20091117134429.000000+060
Event Type: Informationen
User:

Computer Name: HAGBARD
Event Code: 100
Message: wuauclt (3528) Das Datenbankmodul 5.01.2600.2180 ist gestartet.

Record Number: 2078
Source Name: ESENT
Time Written: 20091117134429.000000+060
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\QuickTime\QTSystem\;C:\Programme\Gemeinsame Dateien\DivX Shared\;C:\Programme\Gemeinsame Dateien\iZotope\Runtimes
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 3 Stepping 4, GenuineIntel
"PROCESSOR_REVISION"=0304
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Programme\QuickTime\QTSystem\QTJava.zip
"QTJAVA"=C:\Programme\QuickTime\QTSystem\QTJava.zip

-----------------EOF-----------------

Auf jeden Fall tat es schon mal gut CCleaner und die anderen Sachen laufen zu lassen. Ein sauberer Rechner ist schon was feines.

Ich habe davor nur ab und an Spybot und Ad-Aware benutzt. Beide fanden meißt nur ein paar Cookies und so. TuneUp Utilitties habe ich vor ein paar Tagen (aber nach dem ich den Trojaner entdeckt habe) laufen lassen, das hat extrem viele Probleme gefunden und behoben. Der Rechner ist stark fragmentiert, das könnte vielleicht auch ein Grund sein, warum er sich manchmal aufhängt(?).

Also also, was meint ihr Profis zu den Logs? Wie soll ich vorgehen?

Besten Dank! Ihr habt mir schon mal geholfen.

Atoll

win32.tdss.rtk

Plagegeister aller Art und deren Bekämpfung: win32.tdss.rtk

win32.tdss.rtk

Ähnliche Themen: win32.tdss.rtk