TR/Trash.Gen angeblich entfernt, logs so in Ordnung?

flamer · 10.05.2010, 18:13

Hi,
da ich hier auf Malwarebytes gestoßen bin, habe ich mir das auf diesen PC runtergeladen und benutzt. Sofort wurden 4 Trojaner gefunden, welche ich entfernte.
Ohne etwas gemacht zu haben meldete sich später der Antivir Guard. Bei einem Scan wurde folgender Trojaner gefunden: TR/Trash.Gen .
(Datei: 'C:\System Volume Information\_restore{EF710D4B-86A7-4635-8138-E81D2FBEE8C6}\RP323\A0032282.dll'
contained a virus or unwanted program 'TR/Trash )
Diesen ließ ich in die Quarantäne verschieben und löschte ihn.
Wenig später meldete sich Avira wieder und ich fand den gleichen Virus mit dem gleichen Pfad.
Weil system-restore-Datein zu den Wiederherstellungsdateien gehören, habe ich dann Systemwiederherstellung deaktiviert und damit alle Wiederherstelungspunkte gelöscht.
Dann ließ ich nochmal scannen und fand keinen Virus mehr.

(Ich benutze WIndows XP - 32 Bit e: Die chin. Zeichen kommen irgendwie davon,d ass ich Umlaute schreibe. Ich habe die chinesische SChreibsoftware von Microsoft auf dem PC installiert und kann seitdem keine Umlaute mehr schreiben.

)

Hier der Avira Report mit dem Fund: (Den Log von Malwarebytes und den 4 Trojanern habe ich leider gelöscht -.-")

Zitat:

Avira AntiVir Personal
Report file date: Sonntag, 9. Mai 2010 21:00

Scanning for 2081209 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Normally booted
Username : SYSTEM
Computer name : ZHANG

Version information:
BUILD.DAT : 10.0.0.567 32097 Bytes 2010-4-19 15:07:00
AVSCAN.EXE : 10.0.3.0 433832 Bytes 2010-4-27 19:56:23
AVSCAN.DLL : 10.0.3.0 46440 Bytes 2010-4-27 19:56:22
LUKE.DLL : 10.0.2.3 104296 Bytes 2010-3-7 17:33:04
LUKERES.DLL : 10.0.0.1 12648 Bytes 2010-2-10 22:40:49
VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009-11-6 06:35:52
VBASE001.VDF : 7.10.1.0 1372672 Bytes 2009-11-19 13:54:32
VBASE002.VDF : 7.10.3.1 3143680 Bytes 2010-1-20 13:09:10
VBASE003.VDF : 7.10.3.75 996864 Bytes 2010-1-26 12:23:30
VBASE004.VDF : 7.10.4.203 1579008 Bytes 2010-3-5 11:19:23
VBASE005.VDF : 7.10.6.82 2494464 Bytes 2010-4-15 18:13:55
VBASE006.VDF : 7.10.6.83 2048 Bytes 2010-4-15 18:13:56
VBASE007.VDF : 7.10.6.84 2048 Bytes 2010-4-15 18:13:56
VBASE008.VDF : 7.10.6.85 2048 Bytes 2010-4-15 18:13:56
VBASE009.VDF : 7.10.6.86 2048 Bytes 2010-4-15 18:13:56
VBASE010.VDF : 7.10.6.87 2048 Bytes 2010-4-15 18:13:56
VBASE011.VDF : 7.10.6.88 2048 Bytes 2010-4-15 18:13:56
VBASE012.VDF : 7.10.6.89 2048 Bytes 2010-4-15 18:13:56
VBASE013.VDF : 7.10.6.90 2048 Bytes 2010-4-15 18:13:56
VBASE014.VDF : 7.10.6.123 126464 Bytes 2010-4-19 19:56:22
VBASE015.VDF : 7.10.6.152 123392 Bytes 2010-4-21 19:56:22
VBASE016.VDF : 7.10.6.178 122880 Bytes 2010-4-22 19:56:22
VBASE017.VDF : 7.10.6.206 120320 Bytes 2010-4-26 19:56:22
VBASE018.VDF : 7.10.6.232 99328 Bytes 2010-4-28 16:27:51
VBASE019.VDF : 7.10.7.2 155648 Bytes 2010-4-30 16:27:54
VBASE020.VDF : 7.10.7.26 119808 Bytes 2010-5-4 16:27:55
VBASE021.VDF : 7.10.7.51 118272 Bytes 2010-5-6 16:27:57
VBASE022.VDF : 7.10.7.52 2048 Bytes 2010-5-6 16:27:57
VBASE023.VDF : 7.10.7.53 2048 Bytes 2010-5-6 16:27:57
VBASE024.VDF : 7.10.7.54 2048 Bytes 2010-5-6 16:27:57
VBASE025.VDF : 7.10.7.55 2048 Bytes 2010-5-6 16:27:58
VBASE026.VDF : 7.10.7.56 2048 Bytes 2010-5-6 16:27:58
VBASE027.VDF : 7.10.7.57 2048 Bytes 2010-5-6 16:27:58
VBASE028.VDF : 7.10.7.58 2048 Bytes 2010-5-6 16:27:58
VBASE029.VDF : 7.10.7.59 2048 Bytes 2010-5-6 16:27:58
VBASE030.VDF : 7.10.7.60 2048 Bytes 2010-5-6 16:27:58
VBASE031.VDF : 7.10.7.66 70656 Bytes 2010-5-7 16:27:59
Engineversion : 8.2.1.236
AEVDF.DLL : 8.1.2.0 106868 Bytes 2010-4-27 19:56:22
AESCRIPT.DLL : 8.1.3.28 1298810 Bytes 2010-5-7 16:28:28
AESCN.DLL : 8.1.5.0 127347 Bytes 2010-2-27 17:47:34
AESBX.DLL : 8.1.3.1 254324 Bytes 2010-4-27 19:56:22
AERDL.DLL : 8.1.4.6 541043 Bytes 2010-4-18 18:14:21
AEPACK.DLL : 8.2.1.1 426358 Bytes 2010-3-25 15:35:12
AEOFFICE.DLL : 8.1.0.41 201083 Bytes 2010-3-18 20:11:57
AEHEUR.DLL : 8.1.1.27 2670967 Bytes 2010-5-7 16:28:15
AEHELP.DLL : 8.1.11.3 242039 Bytes 2010-4-3 09:55:24
AEGEN.DLL : 8.1.3.7 373106 Bytes 2010-4-18 18:14:05
AEEMU.DLL : 8.1.2.0 393588 Bytes 2010-4-27 19:56:22
AECORE.DLL : 8.1.15.1 192886 Bytes 2010-5-7 16:28:01
AEBB.DLL : 8.1.1.0 53618 Bytes 2010-4-27 19:56:22
AVWINLL.DLL : 10.0.0.0 19304 Bytes 2010-1-14 11:03:38
AVPREF.DLL : 10.0.0.0 44904 Bytes 2010-1-14 11:03:35
AVREP.DLL : 10.0.0.8 62209 Bytes 2010-2-18 15:47:40
AVREG.DLL : 10.0.3.0 53096 Bytes 2010-4-27 19:56:23
AVSCPLR.DLL : 10.0.3.0 83816 Bytes 2010-4-27 19:56:23
AVARKT.DLL : 10.0.0.14 227176 Bytes 2010-4-27 19:56:22
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 2010-1-26 08:53:30
SQLITE3.DLL : 3.6.19.0 355688 Bytes 2010-1-28 11:57:58
AVSMTP.DLL : 10.0.0.17 63848 Bytes 2010-3-16 14:38:56
NETNT.DLL : 10.0.0.0 11624 Bytes 2010-2-19 13:41:00
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 2010-1-28 12:10:20
RCTEXT.DLL : 10.0.53.0 97128 Bytes 2010-4-27 19:56:22

Configuration settings for the scan:
Jobname.............................: avguard_async_scan
Configuration file..................: C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira\AntiVir Desktop\TEMP\AVGUARD_4c24f432\guard_slideup.avp
Logging.............................: low
Primary action......................: repair
Secondary action....................: quarantine
Scan master boot sector.............: on
Scan boot sector....................: off
Process scan........................: on
Scan registry.......................: off
Search for rootkits.................: on
Integrity checking of system files..: off
Optimised scan......................: on
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: high
Deviating risk categories...........: +PCK,+PFS,

Start of the scan: Sonntag, 9. Mai 2010 21:00

Starting search for hidden objects.

The scan of running processes will be started
Scan process 'rsmsink.exe' - '1' Module(s) have been scanned
Scan process 'avscan.exe' - '1' Module(s) have been scanned
Scan process 'avcenter.exe' - '1' Module(s) have been scanned
Scan process 'msdtc.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'dllhost.exe' - '1' Module(s) have been scanned
Scan process 'vssvc.exe' - '1' Module(s) have been scanned
Scan process 'wuauclt.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'alg.exe' - '1' Module(s) have been scanned
Scan process 'wmiprvse.exe' - '1' Module(s) have been scanned
Scan process 'unsecapp.exe' - '1' Module(s) have been scanned
Scan process 'GoogleToolbarNotifier.exe' - '1' Module(s) have been scanned
Scan process 'ctfmon.exe' - '1' Module(s) have been scanned
Scan process 'AdobeARM.exe' - '1' Module(s) have been scanned
Scan process 'avgnt.exe' - '1' Module(s) have been scanned
Scan process 'igfxsrvc.exe' - '1' Module(s) have been scanned
Scan process 'MGSysCtrl.exe' - '1' Module(s) have been scanned
Scan process 'PDVDServ.exe' - '1' Module(s) have been scanned
Scan process 'SynTPEnh.exe' - '1' Module(s) have been scanned
Scan process 'RTHDCPL.EXE' - '1' Module(s) have been scanned
Scan process 'igfxpers.exe' - '1' Module(s) have been scanned
Scan process 'hkcmd.exe' - '1' Module(s) have been scanned
Scan process 'avshadow.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'RichVideo.exe' - '1' Module(s) have been scanned
Scan process 'Explorer.EXE' - '1' Module(s) have been scanned
Scan process 'PSIService.exe' - '1' Module(s) have been scanned
Scan process 'GoogleCrashHandler.exe' - '1' Module(s) have been scanned
Scan process 'MSIService.exe' - '1' Module(s) have been scanned
Scan process 'avguard.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'sched.exe' - '1' Module(s) have been scanned
Scan process 'spoolsv.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'svchost.exe' - '1' Module(s) have been scanned
Scan process 'lsass.exe' - '1' Module(s) have been scanned
Scan process 'services.exe' - '1' Module(s) have been scanned
Scan process 'winlogon.exe' - '1' Module(s) have been scanned
Scan process 'csrss.exe' - '1' Module(s) have been scanned
Scan process 'smss.exe' - '1' Module(s) have been scanned

Starting the file scan:

Begin scan in 'C:\System Volume Information\_restore{EF710D4B-86A7-4635-8138-E81D2FBEE8C6}\RP323\A0032283.dll'
C:\System Volume Information\_restore{EF710D4B-86A7-4635-8138-E81D2FBEE8C6}\RP323\A0032283.dll
[DETECTION] Is the TR/Trash.Gen Trojan
[NOTE] The file was moved to the quarantine directory under the name '4eaba255.qua'.

End of the scan: Sonntag, 9. Mai 2010 21:01
Used time: 01:50 Minute(s)

The scan has been done completely.

0 Scanned directories
45 Files were scanned
1 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
1 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
44 Files not concerned
0 Archives were scanned
0 Warnings
1 Notes
47001 Objects were scanned with rootkit scan
0 Hidden objects were found

The scan results will be transferred to the Guard.

Hier jetzt der letzte Avira Scan ohne Fund:

Zitat:

Avira AntiVir Personal
Report file date: Sonntag, 9. Mai 2010 21:08

Scanning for 2081209 virus strains and unwanted programs.

The program is running as an unrestricted full version.
Online services are available:

Licensee : Avira AntiVir Personal - FREE Antivirus
Serial number : 0000149996-ADJIE-0000001
Platform : Windows XP
Windows version : (Service Pack 3) [5.1.2600]
Boot mode : Safe mode
Username : Administrator
Computer name : ZHANG

Version information:
BUILD.DAT : 10.0.0.567 32097 Bytes 2010-4-19 15:07:00
AVSCAN.EXE : 10.0.3.0 433832 Bytes 2010-4-27 19:56:23
AVSCAN.DLL : 10.0.3.0 46440 Bytes 2010-4-27 19:56:22
LUKE.DLL : 10.0.2.3 104296 Bytes 2010-3-7 17:33:04
LUKERES.DLL : 10.0.0.1 12648 Bytes 2010-2-10 22:40:49
VBASE000.VDF : 7.10.0.0 19875328 Bytes 2009-11-6 06:35:52
VBASE001.VDF : 7.10.1.0 1372672 Bytes 2009-11-19 13:54:32
VBASE002.VDF : 7.10.3.1 3143680 Bytes 2010-1-20 13:09:10
VBASE003.VDF : 7.10.3.75 996864 Bytes 2010-1-26 12:23:30
VBASE004.VDF : 7.10.4.203 1579008 Bytes 2010-3-5 11:19:23
VBASE005.VDF : 7.10.6.82 2494464 Bytes 2010-4-15 18:13:55
VBASE006.VDF : 7.10.6.83 2048 Bytes 2010-4-15 18:13:56
VBASE007.VDF : 7.10.6.84 2048 Bytes 2010-4-15 18:13:56
VBASE008.VDF : 7.10.6.85 2048 Bytes 2010-4-15 18:13:56
VBASE009.VDF : 7.10.6.86 2048 Bytes 2010-4-15 18:13:56
VBASE010.VDF : 7.10.6.87 2048 Bytes 2010-4-15 18:13:56
VBASE011.VDF : 7.10.6.88 2048 Bytes 2010-4-15 18:13:56
VBASE012.VDF : 7.10.6.89 2048 Bytes 2010-4-15 18:13:56
VBASE013.VDF : 7.10.6.90 2048 Bytes 2010-4-15 18:13:56
VBASE014.VDF : 7.10.6.123 126464 Bytes 2010-4-19 19:56:22
VBASE015.VDF : 7.10.6.152 123392 Bytes 2010-4-21 19:56:22
VBASE016.VDF : 7.10.6.178 122880 Bytes 2010-4-22 19:56:22
VBASE017.VDF : 7.10.6.206 120320 Bytes 2010-4-26 19:56:22
VBASE018.VDF : 7.10.6.232 99328 Bytes 2010-4-28 16:27:51
VBASE019.VDF : 7.10.7.2 155648 Bytes 2010-4-30 16:27:54
VBASE020.VDF : 7.10.7.26 119808 Bytes 2010-5-4 16:27:55
VBASE021.VDF : 7.10.7.51 118272 Bytes 2010-5-6 16:27:57
VBASE022.VDF : 7.10.7.52 2048 Bytes 2010-5-6 16:27:57
VBASE023.VDF : 7.10.7.53 2048 Bytes 2010-5-6 16:27:57
VBASE024.VDF : 7.10.7.54 2048 Bytes 2010-5-6 16:27:57
VBASE025.VDF : 7.10.7.55 2048 Bytes 2010-5-6 16:27:58
VBASE026.VDF : 7.10.7.56 2048 Bytes 2010-5-6 16:27:58
VBASE027.VDF : 7.10.7.57 2048 Bytes 2010-5-6 16:27:58
VBASE028.VDF : 7.10.7.58 2048 Bytes 2010-5-6 16:27:58
VBASE029.VDF : 7.10.7.59 2048 Bytes 2010-5-6 16:27:58
VBASE030.VDF : 7.10.7.60 2048 Bytes 2010-5-6 16:27:58
VBASE031.VDF : 7.10.7.66 70656 Bytes 2010-5-7 16:27:59
Engineversion : 8.2.1.236
AEVDF.DLL : 8.1.2.0 106868 Bytes 2010-4-27 19:56:22
AESCRIPT.DLL : 8.1.3.28 1298810 Bytes 2010-5-7 16:28:28
AESCN.DLL : 8.1.5.0 127347 Bytes 2010-2-27 17:47:34
AESBX.DLL : 8.1.3.1 254324 Bytes 2010-4-27 19:56:22
AERDL.DLL : 8.1.4.6 541043 Bytes 2010-4-18 18:14:21
AEPACK.DLL : 8.2.1.1 426358 Bytes 2010-3-25 15:35:12
AEOFFICE.DLL : 8.1.0.41 201083 Bytes 2010-3-18 20:11:57
AEHEUR.DLL : 8.1.1.27 2670967 Bytes 2010-5-7 16:28:15
AEHELP.DLL : 8.1.11.3 242039 Bytes 2010-4-3 09:55:24
AEGEN.DLL : 8.1.3.7 373106 Bytes 2010-4-18 18:14:05
AEEMU.DLL : 8.1.2.0 393588 Bytes 2010-4-27 19:56:22
AECORE.DLL : 8.1.15.1 192886 Bytes 2010-5-7 16:28:01
AEBB.DLL : 8.1.1.0 53618 Bytes 2010-4-27 19:56:22
AVWINLL.DLL : 10.0.0.0 19304 Bytes 2010-1-14 11:03:38
AVPREF.DLL : 10.0.0.0 44904 Bytes 2010-1-14 11:03:35
AVREP.DLL : 10.0.0.8 62209 Bytes 2010-2-18 15:47:40
AVREG.DLL : 10.0.3.0 53096 Bytes 2010-4-27 19:56:23
AVSCPLR.DLL : 10.0.3.0 83816 Bytes 2010-4-27 19:56:23
AVARKT.DLL : 10.0.0.14 227176 Bytes 2010-4-27 19:56:22
AVEVTLOG.DLL : 10.0.0.8 203112 Bytes 2010-1-26 08:53:30
SQLITE3.DLL : 3.6.19.0 355688 Bytes 2010-1-28 11:57:58
AVSMTP.DLL : 10.0.0.17 63848 Bytes 2010-3-16 14:38:56
NETNT.DLL : 10.0.0.0 11624 Bytes 2010-2-19 13:41:00
RCIMAGE.DLL : 10.0.0.26 2550120 Bytes 2010-1-28 12:10:20
RCTEXT.DLL : 10.0.53.0 97128 Bytes 2010-4-27 19:56:22

Configuration settings for the scan:
Jobname.............................: Complete system scan
Configuration file..................: C:\Programme\Avira\AntiVir Desktop\sysscan.avp
Logging.............................: low
Primary action......................: interactive
Secondary action....................: ignore
Scan master boot sector.............: on
Scan boot sector....................: on
Boot sectors........................: C:, D:,
Process scan........................: on
Extended process scan...............: on
Scan registry.......................: on
Search for rootkits.................: on
Integrity checking of system files..: off
Optimised scan......................: on
Scan all files......................: All files
Scan archives.......................: on
Recursion depth.....................: 20
Smart extensions....................: on
Macro heuristic.....................: on
File heuristic......................: medium
Deviating risk categories...........: +PCK,+PFS,

Start of the scan: Sonntag, 9. Mai 2010 21:08

Starting search for hidden objects.
The driver could not be initialized.

The scan of running processes will be started
Scan process 'avscan.exe' - '61' Module(s) have been scanned
Scan process 'Explorer.EXE' - '69' Module(s) have been scanned
Scan process 'svchost.exe' - '70' Module(s) have been scanned
Scan process 'svchost.exe' - '40' Module(s) have been scanned
Scan process 'svchost.exe' - '35' Module(s) have been scanned
Scan process 'lsass.exe' - '51' Module(s) have been scanned
Scan process 'services.exe' - '29' Module(s) have been scanned
Scan process 'winlogon.exe' - '60' Module(s) have been scanned
Scan process 'csrss.exe' - '14' Module(s) have been scanned
Scan process 'smss.exe' - '2' Module(s) have been scanned

Starting master boot sector scan:
Master boot sector HD0
[INFO] No virus was found!

Start scanning boot sectors:
Boot sector 'C:\'
[INFO] No virus was found!
Boot sector 'D:\'
[INFO] No virus was found!

Starting to scan executable files (registry).
The registry was scanned ( '406' files ).

Starting the file scan:

Begin scan in 'C:\' <BOOT>
Begin scan in 'D:\' <RECOVER>

End of the scan: Sonntag, 9. Mai 2010 22:27
Used time: 1:18:32 Hour(s)

The scan has been done completely.

5470 Scanned directories
298027 Files were scanned
0 Viruses and/or unwanted programs were found
0 Files were classified as suspicious
0 files were deleted
0 Viruses and unwanted programs were repaired
0 Files were moved to quarantine
0 Files were renamed
0 Files cannot be scanned
298027 Files not concerned
7574 Archives were scanned
0 Warnings
0 Notes

Malwarebytes Scan ohne Befund:

Zitat:

Malwarebytes' Anti-Malware 1.46
Malwarebytes

Database version: 4086

Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

10.05.2010 17:58:57
mbam-log-2010-05-10 (17-58-57).txt

Scan type: Quick scan
Objects scanned: 122491
Time elapsed: 8 minute(s), 45 second(s)

Memory Processes Infected: 0
Memory Modules Infected: 0
Registry Keys Infected: 0
Registry Values Infected: 0
Registry Data Items Infected: 0
Folders Infected: 0
Files Infected: 0

Memory Processes Infected:
(No malicious items detected)

Memory Modules Infected:
(No malicious items detected)

Registry Keys Infected:
(No malicious items detected)

Registry Values Infected:
(No malicious items detected)

Registry Data Items Infected:
(No malicious items detected)

Folders Infected:
(No malicious items detected)

Files Infected:
(No malicious items detected)

RSIT-logs:
info.txt

Zitat:

info.txt logfile of random's system information tool 1.06 2010-05-10 18:38:13

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.3.1 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A93000000001}
Adobe Shockwave Player 11-->C:\WINDOWS\system32\adobe\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Adobe\SHOCKW~1\Install.log
ALDI Foto Manager Free Sued-->C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Manager_Free\instslct.exe /p
ALDI Online Druck Service (Sued)-->C:\PROGRA~1\ALDION~1\ALDI_ODS\UNWISE.EXE C:\PROGRA~1\ALDION~1\ALDI_ODS\INSTALL.LOG
Aldi Süd Fotoservice-->"C:\Programme\Aldi Sued Fotoservice\unins000.exe"
ALDI Sued Foto Service-->C:\Programme\ALDI Sued Foto Service\ALDI_Foto_Service\instslct.exe /p
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
Azurewave Wireless LAN-->C:\Programme\InstallShield Installation Information\{F3D92514-CD5D-4E96-BE88-8258EB9BF85A}\setup.exe -runfromtemp -l0x0009 -removeonly
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
CyberLink YouCam-->"C:\Programme\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\Setup.exe" /z-uninstall
CyberLink YouCam-->"C:\Programme\InstallShield Installation Information\{01FB4998-33C4-4431-85ED-079E3EEFE75D}\Setup.exe" /z-uninstall
Firebird SQL Server - MAGIX Edition-->C:\Programme\ALDI Sued Foto Service\Common\Database\instslct.exe /p
Google Chrome-->"C:\Programme\Google\Chrome\Application\4.1.249.1064\Installer\setup.exe" --uninstall --system-level
Google Desktop-->C:\Programme\Google\Google Desktop Search\GoogleDesktopSetup.exe -uninstall
Google Toolbar for Internet Explorer-->"C:\Programme\Google\Google Toolbar\Component\GoogleToolbarManager_E85CDE7661A53A6A.exe" /uninstall
Google Toolbar for Internet Explorer-->MsiExec.exe /I{18455581-E099-4BA8-BC6B-F34B2F06600C}
Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}
Google Updater-->"C:\Programme\Google\Google Updater\GoogleUpdater.exe" -uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix für Windows Internet Explorer 7 (KB947864)-->"C:\WINDOWS\ie7updates\KB947864-IE7\spuninst\spuninst.exe"
Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix f黵 Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix f黵 Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Hotfix f黵 Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
Hotfix f黵 Windows XP (KB979306)-->"C:\WINDOWS\$NtUninstallKB979306$\spuninst\spuninst.exe"
Intel(R) Graphics Media Accelerator Driver-->C:\WINDOWS\system32\igxpun.exe -uninstall
Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}
LetsTrade Komponenten-->C:\WINDOWS\fpuninst.exe -uninstall:"C:\Programme\Letstrade\uninst\uninst.ini"
Letstrade-->MsiExec.exe /X{E0091C29-DEE8-4B24-BF65-8C35B5940D77}
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
MEDION Fotos auf CD Sued-->C:\Programme\ALDI Sued Foto Service\Medion_Fotos_auf_CD_6\instslct.exe /p
Microsoft .NET Framework 2.0 Language Pack - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - DEU\install.exe
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Silverlight-->MsiExec.exe /I{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148-->MsiExec.exe /X{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}
Mozilla Firefox (3.6.3)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
Norton Security Scan-->C:\Programme\Norton Security Scan\Norton Security Scan\Engine\2.7.0.52\InstWrap.exe
PowerDVD-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
REALTEK GbE & FE Ethernet PCI-E NIC Driver-->C:\Programme\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\setup.exe -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\Setup.exe" -l0x7 -removeonly
Sicherheitsupdate für Windows Internet Explorer 7 (KB950759)-->"C:\WINDOWS\ie7updates\KB950759-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB953838)-->"C:\WINDOWS\ie7updates\KB953838-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Sicherheitsupdate für Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 7 (KB976325)-->"C:\WINDOWS\ie7updates\KB976325-IE7\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 8 (KB976325)-->"C:\WINDOWS\ie8updates\KB976325-IE8\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 8 (KB978207)-->"C:\WINDOWS\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Internet Explorer 8 (KB981332)-->"C:\WINDOWS\ie8updates\KB981332-IE8\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB961371-v2)-->"C:\WINDOWS\$NtUninstallKB961371-v2$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB975561)-->"C:\WINDOWS\$NtUninstallKB975561$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB977165-v2)-->"C:\WINDOWS\$NtUninstallKB977165-v2$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB977816)-->"C:\WINDOWS\$NtUninstallKB977816$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB978338)-->"C:\WINDOWS\$NtUninstallKB978338$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB978601)-->"C:\WINDOWS\$NtUninstallKB978601$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB979309)-->"C:\WINDOWS\$NtUninstallKB979309$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB979683)-->"C:\WINDOWS\$NtUninstallKB979683$\spuninst\spuninst.exe"
Sicherheitsupdate f黵 Windows XP (KB980232)-->"C:\WINDOWS\$NtUninstallKB980232$\spuninst\spuninst.exe"
Skype web features-->MsiExec.exe /I{541DEAC0-5F3D-45E6-B7CB-94ECF3B96748}
Skype? 4.1-->MsiExec.exe /X{D103C4BA-F905-437A-8049-DB24763BBE36}
Spyware Doctor 7.0-->C:\Programme\Spyware Doctor\unins000.exe /LOG
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Synaptics Pointing Device Driver-->rundll32.exe "C:\Programme\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall
System Control Manager-->C:\Programme\InstallShield Installation Information\{ED9C5D25-55DF-48D8-9328-2AC0D75DE5D8}\setup.exe -runfromtemp -l0x0009 -removeonly
Ulead PhotoImpact 12-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{11AFE21E-B193-430D-B57A-DFF7815BB962}\setup.exe" -l0x7
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update für Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update für Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update für Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update für Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update f黵 Windows Internet Explorer 8 (KB975364)-->"C:\WINDOWS\ie8updates\KB975364-IE8\spuninst\spuninst.exe"
Update f黵 Windows Internet Explorer 8 (KB976662)-->"C:\WINDOWS\ie8updates\KB976662-IE8\spuninst\spuninst.exe"
Update f黵 Windows Internet Explorer 8 (KB980182)-->"C:\WINDOWS\ie8updates\KB980182-IE8\spuninst\spuninst.exe"
Update f黵 Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Update f黵 Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update f黵 Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update f黵 Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Update f黵 Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Update f黵 Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Update f黵 Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
USB 2.0 Card Reader-->C:\Programme\InstallShield Installation Information\{D10CB652-9332-4242-B7A9-2D61570144F7}\setup.exe -runfromtemp -l0x0009 -removeonly
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Live Messenger-->MsiExec.exe /I{279DB581-239C-4E13-97F8-0F48E40BE75C}
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows-Sicherungsprogramm-->MsiExec.exe /I{76EFFC7C-17A6-479D-9E47-8E658C1695AE}
WISO Mein Geld 2008 Professional-->MsiExec.exe /I{D8D22773-14BF-4178-A683-3DBA515C2A26}
WordPerfect Office X3-->"C:\Programme\WordPerfect Office X3\CabsDE\MSILauncher.exe" "{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}"
WordPerfect Office X3-->MsiExec.exe /I{54DB13F1-0CE0-4BAB-BD5F-7DE150C043C8}
迅雷看看播放器-->C:\Programme\Thunder Network\Xmp\Uninstall.exe

======Security center information======

AV: Spyware Doctor with AntiVirus (disabled)
AV: AntiVir Desktop

======System event log======

Computer Name: ZHANG
Event Code: 1001
Message: Diesem Computer konnte keine Netzwerkadresse durch den DHCP-Server für die
Netzwerkkarte mit der Netzwerkadresse 0015AF9F4E80 zugeteilt werden. Der folgende Fehler
ist aufgetreten:
Der Vorgang wurde durch den Benutzer abgebrochen.
.
Es wird weiterhin im Hintergrund versucht, eine Adresse vom
Netzwerkadressserver (DHCP) zugeteilt zu bekommen.

Record Number: 6860
Source Name: Dhcp
Time Written: 20100313150716.000000+060
Event Type: error
User:

Computer Name: ZHANG
Event Code: 1003
Message: Der Computer konnte die Netzwerkadresse, die durch den DHCP-Server für die
Netzwerkkarte mit der Netzwerkadresse 0015AF9F4E80 zugeteilt wurde, nicht erneuern. Der
folgende Fehler ist aufgetreten:
Der Vorgang wurde durch den Benutzer abgebrochen.
.
Es wird weiterhin im Hintergrund versucht, eine Adresse vom
Netzwerkadressserver (DHCP) zu erhalten.

Record Number: 6859
Source Name: Dhcp
Time Written: 20100313150715.000000+060
Event Type: warning
User:

Computer Name: ZHANG
Event Code: 10010
Message: Der Server "{781B925F-0BF8-4C7B-A2A8-A8B11B488A07}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Record Number: 6824
Source Name: DCOM
Time Written: 20100312173727.000000+060
Event Type: error
User: ZHANG\Kevin Zhang

Computer Name: ZHANG
Event Code: 4226
Message: TCP/IP hat das Sicherheitslimit erreicht, das für die Anzahl gleichzeitiger TCP-Verbindungsversuche festgelegt wurde.

Record Number: 6823
Source Name: Tcpip
Time Written: 20100312153918.000000+060
Event Type: warning
User:

Computer Name: ZHANG
Event Code: 10010
Message: Der Server "{781B925F-0BF8-4C7B-A2A8-A8B11B488A07}" konnte innerhalb des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.

Record Number: 6821
Source Name: DCOM
Time Written: 20100312151841.000000+060
Event Type: error
User: ZHANG\Kevin Zhang

=====Application event log=====

Computer Name: ZHANG
Event Code: 32026
Message: Fehler beim Initialisieren der zugewiesenen Faxger?te (virtuell oder TAPI) durch den Faxdienst.
Es k?nnen keine Faxe gesendet werden, bis ein Faxger?t installiert ist.

Record Number: 141
Source Name: Microsoft Fax
Time Written: 20080830124105.000000+120
Event Type: warning
User:

Computer Name: ZHANG
Event Code: 32068
Message: Die ausgehende Verteilerregel ist nicht gültig, weil kein gültiges Ger?t gefunden werden kann. Ausgehende Faxe, die diese Regel verwenden, werden nicht weitergeleitet. Stellen Sie sicher, dass das angezielte Ger?t bzw. die angezielten Ger?te angeschlossen, korrekt installiert und angeschaltet sind. Stellen Sie au?erdem sicher, dass die Gruppe korrekt konfiguriert ist, falls die Weiterleitung an eine Gruppe von Ger?ten erfolgen soll.
Landes-/Regionskennzahl: "*"
Ortskennzahl: "*"

Record Number: 138
Source Name: Microsoft Fax
Time Written: 20080818062716.000000+120
Event Type: warning
User:

Computer Name: ZHANG
Event Code: 32026
Message: Fehler beim Initialisieren der zugewiesenen Faxger?te (virtuell oder TAPI) durch den Faxdienst.
Es k?nnen keine Faxe gesendet werden, bis ein Faxger?t installiert ist.

Record Number: 137
Source Name: Microsoft Fax
Time Written: 20080818062716.000000+120
Event Type: warning
User:

Computer Name: ZHANG
Event Code: 32068
Message: Die ausgehende Verteilerregel ist nicht gültig, weil kein gültiges Ger?t gefunden werden kann. Ausgehende Faxe, die diese Regel verwenden, werden nicht weitergeleitet. Stellen Sie sicher, dass das angezielte Ger?t bzw. die angezielten Ger?te angeschlossen, korrekt installiert und angeschaltet sind. Stellen Sie au?erdem sicher, dass die Gruppe korrekt konfiguriert ist, falls die Weiterleitung an eine Gruppe von Ger?ten erfolgen soll.
Landes-/Regionskennzahl: "*"
Ortskennzahl: "*"

Record Number: 123
Source Name: Microsoft Fax
Time Written: 20080810012802.000000+120
Event Type: warning
User:

Computer Name: ZHANG
Event Code: 32026
Message: Fehler beim Initialisieren der zugewiesenen Faxger?te (virtuell oder TAPI) durch den Faxdienst.
Es k?nnen keine Faxe gesendet werden, bis ein Faxger?t installiert ist.

Record Number: 122
Source Name: Microsoft Fax
Time Written: 20080810012802.000000+120
Event Type: warning
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\Gemeinsame Dateien\Thunder Network\KanKan\Codecs
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 28 Stepping 2, GenuineIntel
"PROCESSOR_REVISION"=1c02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------

log.txt

Zitat:

Logfile of random's system information tool 1.07 (written by random/random)
Run by Kevin Zhang at 2010-05-10 18:37:52
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 46 GB (67%) free of 68 GB
Total RAM: 1013 MB (55% free)

Logfile of Trend Micro HijackThis v2.0.4
Scan saved at 18:38:08, on 10.05.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Google\Update\1.2.183.23\GoogleCrashHandler.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\System Control Manager\MSIService.exe
C:\WINDOWS\system32\PSIService.exe
C:\Programme\Avira\AntiVir Desktop\avshadow.exe
C:\Programme\Cyberlink\Shared files\RichVideo.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\hkcmd.exe
C:\WINDOWS\system32\igfxpers.exe
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Synaptics\SynTP\SynTPEnh.exe
C:\Programme\HomeCinema\PowerDVD\PDVDServ.exe
C:\Programme\System Control Manager\MGSysCtrl.exe
C:\WINDOWS\system32\igfxsrvc.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe
C:\WINDOWS\system32\wbem\unsecapp.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Dokumente und Einstellungen\Kevin Zhang\Eigene Dateien\Downloads\RSIT.exe
C:\Programme\trend micro\Kevin Zhang.exe

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: SSVHelper Class - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O2 - BHO: (no name) - {7E853D72-626A-48EC-A868-BA8D5E23E045} - (no file)
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll
O3 - Toolbar: Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll
O4 - HKLM\..\Run: [IgfxTray] C:\WINDOWS\system32\igfxtray.exe
O4 - HKLM\..\Run: [HotKeysCmds] C:\WINDOWS\system32\hkcmd.exe
O4 - HKLM\..\Run: [Persistence] C:\WINDOWS\system32\igfxpers.exe
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe
O4 - HKLM\..\Run: [QuickFinder Scheduler] "C:\Programme\WordPerfect Office X3\Programs\QFSCHD130.EXE"
O4 - HKLM\..\Run: [UCam_Menu] "C:\Programme\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe" "C:\Programme\HomeCinema\YouCam" update "Software\CyberLink\YouCam\1.0"
O4 - HKLM\..\Run: [RemoteControl] C:\Programme\HomeCinema\PowerDVD\PDVDServ.exe
O4 - HKLM\..\Run: [LanguageShortcut] C:\Programme\HomeCinema\PowerDVD\Language\Language.exe
O4 - HKLM\..\Run: [MGSysCtrl] C:\Programme\System Control Manager\MGSysCtrl.exe
O4 - HKLM\..\Run: [Google Desktop Search] "C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe" /startup
O4 - HKLM\..\Run: [toolbar_eula_launcher] C:\Program Files\GoogleEULA\EULALauncher.exe
O4 - HKLM\..\Run: [IMJPMIG8.1] "C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE" /Spoil /RemAdvDef /Migration32
O4 - HKLM\..\Run: [MSPY2002] C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe /SYNC
O4 - HKLM\..\Run: [PHIME2002ASync] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /SYNC
O4 - HKLM\..\Run: [PHIME2002A] C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE /IMEName
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [Adobe ARM] "C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [swg] "C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe"
O4 - HKCU\..\Run: [Steam] "c:\programme\steam\steam.exe" -silent
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O8 - Extra context menu item: Google Sidewiki... - res://C:\Programme\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
O9 - Extra button: (no name) - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra 'Tools' menuitem: Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O15 - ESC Trusted Zone: hxxp://*.update.microsoft.com
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - hxxp://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1211625236765
O16 - DPF: {644E432F-49D3-41A1-8DD5-E099162EEEC5} (Symantec RuFSI Utility Class) - hxxp://security.symantec.com/sscv6/SharedContent/common/bin/cabsa.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O20 - AppInit_DLLs: C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL
O22 - SharedTaskScheduler: Browseui preloader - {438755C2-A8BA-11D1-B96B-00A0C90312E1} - C:\WINDOWS\system32\browseui.dll
O22 - SharedTaskScheduler: Component Categories cache daemon - {8C7461EF-2B13-11d2-BE35-3078302C2030} - C:\WINDOWS\system32\browseui.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: BGRaSvc - Unknown owner - C:\Programme\BullGuard Software\BullGuard\support\bgrasvc.exe (file missing)
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - MAGIX? - C:\Programme\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe
O23 - Service: Google Desktop Manager 5.9.911.3589 (GoogleDesktopManager-110309-193829) - Google - C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe
O23 - Service: Google Update Service (gupdate) (gupdate) - Google Inc. - C:\Programme\Google\Update\GoogleUpdate.exe
O23 - Service: Google Software Updater (gusvc) - Google - C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe
O23 - Service: Micro Star SCM - Unknown owner - C:\Programme\System Control Manager\MSIService.exe
O23 - Service: ProtexisLicensing - Unknown owner - C:\WINDOWS\system32\PSIService.exe
O23 - Service: Cyberlink RichVideo Service(CRVS) (RichVideo) - Unknown owner - C:\Programme\Cyberlink\Shared files\RichVideo.exe
O23 - Service: PC Tools Auxiliary Service (sdAuxService) - PC Tools - C:\Programme\Spyware Doctor\pctsAuxs.exe
O23 - Service: PC Tools Security Service (sdCoreService) - PC Tools - C:\Programme\Spyware Doctor\pctsSvc.exe

--
End of file - 7866 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\Google Software Updater.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineCore.job
C:\WINDOWS\tasks\GoogleUpdateTaskMachineUA.job
C:\WINDOWS\tasks\Norton Security Scan for Kevin Zhang.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-12-21 75200]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
SSVHelper Class - C:\Programme\Java\jre1.6.0_05\bin\ssv.dll [2008-02-22 509328]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{7E853D72-626A-48EC-A868-BA8D5E23E045}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-26 279664]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programme\Google\GoogleToolbarNotifier\5.5.4723.1820\swg.dll [2010-02-26 812528]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - Google Toolbar - C:\Programme\Google\Google Toolbar\GoogleToolbar_32.dll [2010-02-26 279664]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"IgfxTray"=C:\WINDOWS\system32\igfxtray.exe [2007-12-19 135168]
"HotKeysCmds"=C:\WINDOWS\system32\hkcmd.exe [2007-12-19 159744]
"Persistence"=C:\WINDOWS\system32\igfxpers.exe [2007-12-19 131072]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-05-07 16862208]
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"SynTPEnh"=C:\Programme\Synaptics\SynTP\SynTPEnh.exe [2008-01-11 1028096]
"QuickFinder Scheduler"=C:\Programme\WordPerfect Office X3\Programs\QFSCHD130.EXE [2007-01-02 83568]
"UCam_Menu"=C:\Programme\HomeCinema\YouCam\MUITransfer\MUIStartMenu.exe [2007-09-13 222504]
"RemoteControl"=C:\Programme\HomeCinema\PowerDVD\PDVDServ.exe [2007-01-08 68640]
"LanguageShortcut"=C:\Programme\HomeCinema\PowerDVD\Language\Language.exe [2007-01-08 52256]
"MGSysCtrl"=C:\Programme\System Control Manager\MGSysCtrl.exe [2008-06-10 782336]
"Google Desktop Search"=C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-11 30192]
"toolbar_eula_launcher"=C:\Program Files\GoogleEULA\EULALauncher.exe [2007-02-09 16896]
"IMJPMIG8.1"=C:\WINDOWS\IME\imjp8_1\IMJPMIG.EXE [2008-04-14 208952]
"MSPY2002"=C:\WINDOWS\system32\IME\PINTLGNT\ImScInst.exe [2008-04-14 59392]
"PHIME2002ASync"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-14 455168]
"PHIME2002A"=C:\WINDOWS\system32\IME\TINTLGNT\TINTSETP.EXE [2008-04-14 455168]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2010-03-02 282792]
"Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-12-22 35760]
"Adobe ARM"=C:\Programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe [2010-03-24 952768]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"swg"=C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2009-12-22 39408]
"Steam"=c:\programme\steam\steam.exe [2010-05-07 1238352]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLS"="C:\PROGRA~1\Google\GOOGLE~2\GOEC62~1.DLL"

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\igfxcui]
C:\WINDOWS\system32\igfxdev.dll [2007-12-19 208896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\MSN Messenger\msnmsgr.exe"="C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"
"C:\Dokumente und Einstellungen\Gang Zhang\Lokale Einstellungen\Temporary Internet Files\Content.IE5\FXJY93CR\qqonlineinstall_blessingkb1[1].exe"="C:\Dokumente und Einstellungen\Gang Zhang\Lokale Einstellungen\Temporary Internet Files\Content.IE5\FXJY93CR\qqonlineinstall_blessingkb1[1].exe:*

isabled:QQ在线安装"
"C:\Programme\Tencent\QQ\QQ.exe"="C:\Programme\Tencent\QQ\QQ.exe:*:Enabled:QQ"
"C:\Programme\Tencent\QQ\Qzone\Qzone.exe"="C:\Programme\Tencent\QQ\Qzone\Qzone.exe:*

isabled:QzoneClient1.3 Beta05"
"C:\Programme\Thunder Network\Xmp\kankan\XMPBoot.exe"="C:\Programme\Thunder Network\Xmp\kankan\XMPBoot.exe:*:Enabled:迅雷看看播放器"
"C:\Programme\Thunder Network\Xmp\xmp.exe"="C:\Programme\Thunder Network\Xmp\xmp.exe:*:Enabled:迅雷看看播放器"
"C:\Programme\Thunder Network\Xmp\ThunderLiveUD.exe"="C:\Programme\Thunder Network\Xmp\ThunderLiveUD.exe:*:Enabled:ThunderLiveUD"
"C:\Programme\QIP\qip.exe"="C:\Programme\QIP\qip.exe:*:Enabled:Quiet Internet Pager"
"C:\Programme\Skype\Plugin Manager\skypePM.exe"="C:\Programme\Skype\Plugin Manager\skypePM.exe:*:Enabled:Skype Extras Manager"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.61\ThunderService.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.61\ThunderService.exe:*:Enabled:ThunderService1.0.2.61"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.61\ThunderLiveUD.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.61\ThunderLiveUD.exe:*:Enabled:ThunderLiveUD1.0.2.61"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.61\XLBugReport.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.61\XLBugReport.exe:*:Enabled:XLBugReport1.0.2.61"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.54\ThunderService.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.54\ThunderService.exe:*:Enabled:ThunderService1.0.2.54"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.54\ThunderLiveUD.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.54\ThunderLiveUD.exe:*:Enabled:ThunderLiveUD1.0.2.54"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.54\XLBugReport.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.54\XLBugReport.exe:*:Enabled:XLBugReport1.0.2.54"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.56\ThunderService.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.56\ThunderService.exe:*:Enabled:ThunderService1.0.2.56"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.56\ThunderLiveUD.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.56\ThunderLiveUD.exe:*:Enabled:ThunderLiveUD1.0.2.56"
"C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.56\XLBugReport.exe"="C:\Programme\Gemeinsame Dateien\Thunder Network\DS\Ver1\1.0.2.56\XLBugReport.exe:*:Enabled:XLBugReport1.0.2.56"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\MSN Messenger\msnmsgr.exe"="C:\Programme\MSN Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger 8.1"
"C:\Programme\MSN Messenger\livecall.exe"="C:\Programme\MSN Messenger\livecall.exe:*:Enabled:Windows Live Messenger 8.1 (Phone)"

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{65dbbaf8-2a2a-11dd-86eb-0015afb79a11}]
shell\AutoRun\command - E:\LaunchU3.exe

======File associations======

.ini - open - C:\WINDOWS\System32\NOTEPAD.EXE %1
.txt - open - C:\WINDOWS\notepad.exe %1

======List of files/folders created in the last 1 months======

2010-05-10 18:37:53 ----D---- C:\Programme\trend micro
2010-05-10 18:37:52 ----D---- C:\rsit
2010-05-10 18:24:21 ----D---- C:\Programme\CCleaner
2010-05-09 20:04:18 ----D---- C:\Dokumente und Einstellungen\Kevin Zhang\Anwendungsdaten\Malwarebytes
2010-05-09 20:04:08 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-05-09 20:04:07 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-04-18 20:17:36 ----HDC---- C:\WINDOWS\$NtUninstallKB979683$
2010-04-18 20:17:22 ----HDC---- C:\WINDOWS\$NtUninstallKB980232$
2010-04-18 20:14:16 ----HDC---- C:\WINDOWS\$NtUninstallKB978338$
2010-04-18 20:14:05 ----HDC---- C:\WINDOWS\$NtUninstallKB977816$
2010-04-18 20:13:53 ----HDC---- C:\WINDOWS\$NtUninstallKB978601$
2010-04-18 20:13:22 ----HDC---- C:\WINDOWS\$NtUninstallKB979309$

======List of files/folders modified in the last 1 months======

2010-05-10 18:37:59 ----D---- C:\WINDOWS\Prefetch
2010-05-10 18:37:53 ----RD---- C:\Programme
2010-05-10 18:32:57 ----D---- C:\WINDOWS\Temp
2010-05-10 18:32:57 ----D---- C:\WINDOWS\Debug
2010-05-10 18:32:57 ----D---- C:\WINDOWS
2010-05-10 18:10:32 ----D---- C:\WINDOWS\system32\CatRoot2
2010-05-10 18:10:16 ----D---- C:\Programme\Steam
2010-05-10 18:10:14 ----SD---- C:\WINDOWS\Tasks
2010-05-10 18:08:57 ----N---- C:\WINDOWS\SchedLgU.Txt
2010-05-10 18:08:56 ----D---- C:\WINDOWS\system32\CatRoot
2010-05-10 18:08:52 ----HD---- C:\WINDOWS\inf
2010-05-10 13:29:29 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Google Updater
2010-05-09 22:35:51 ----SHD---- C:\System Volume Information
2010-05-09 22:31:41 ----D---- C:\WINDOWS\Registration
2010-05-09 22:30:16 ----D---- C:\WINDOWS\system32\Restore
2010-05-09 21:04:51 ----D---- C:\Dokumente und Einstellungen
2010-05-09 20:18:49 ----D---- C:\WINDOWS\system32\drivers
2010-05-09 20:18:49 ----D---- C:\WINDOWS\I386
2010-05-09 20:15:12 ----D---- C:\WINDOWS\system32
2010-05-09 19:55:29 ----AD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TEMP
2010-05-09 19:55:25 ----D---- C:\Programme\Spyware Doctor
2010-05-09 18:00:09 ----D---- C:\Programme\Gemeinsame Dateien\Symantec Shared
2010-05-01 15:11:10 ----D---- C:\Dokumente und Einstellungen\Kevin Zhang\Anwendungsdaten\Skype
2010-05-01 15:09:57 ----D---- C:\Dokumente und Einstellungen\Kevin Zhang\Anwendungsdaten\skypePM
2010-04-18 20:17:41 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-04-18 20:17:29 ----HD---- C:\WINDOWS\$hf_mig$
2010-04-18 20:13:35 ----D---- C:\WINDOWS\ie8updates

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2010-03-01 124784]
R1 FsVga;FsVga; C:\WINDOWS\system32\DRIVERS\fsvga.sys [2008-04-14 12288]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-14 8832]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2010-02-16 60936]
R3 CmBatt;Microsoft-Netzteiltreiber; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-14 13952]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-14 144384]
R3 ialm;ialm; C:\WINDOWS\system32\DRIVERS\igxpmp32.sys [2007-12-19 5854688]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-05-07 4739072]
R3 RSUSBSTOR;RTS5121.Sys Realtek USB Card Reader; C:\WINDOWS\System32\Drivers\RTS5121.sys [2008-06-10 156160]
R3 RT80x86;Ralink 802.11n Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT2860.sys [2007-11-15 572416]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-05-07 106368]
R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2008-01-11 220128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-14 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-14 20608]
S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-14 17024]
S3 dot4;MS IEEE-1284.4-Treiber; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-14 206976]
S3 Dot4Print;Druckerklassentreiber für IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 Dot4Scan;Scannerklassentreiber für IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Scan.sys [2001-08-17 8704]
S3 dot4usb;Dot4USB-Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-18 23936]
S3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-14 10368]
S3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-14 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-14 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-14 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-14 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-14 15232]
S3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-14 32128]
S3 usbstor;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-14 26368]
S3 usbvideo;USB-Videoger?t (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-14 121984]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-14 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 atapi;atapi; C:\WINDOWS\system32\drivers\atapi.sys [2008-04-14 96512]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2010-02-24 135336]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2010-04-27 267432]
R2 Micro Star SCM;Micro Star SCM; C:\Programme\System Control Manager\MSIService.exe [2008-02-21 159744]
R2 ProtexisLicensing;ProtexisLicensing; C:\WINDOWS\system32\PSIService.exe [2006-11-02 174656]
R2 RichVideo;Cyberlink RichVideo Service(CRVS); C:\Programme\Cyberlink\Shared files\RichVideo.exe [2007-01-08 171040]
S2 Fax;Fax; C:\WINDOWS\system32\fxssvc.exe [2008-04-14 268800]
S2 gupdate;Google Update Service (gupdate); C:\Programme\Google\Update\GoogleUpdate.exe [2010-02-03 135664]
S2 gusvc;Google Software Updater; C:\Programme\Google\Common\Google Updater\GoogleUpdaterService.exe [2010-02-03 182768]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 BGRaSvc;BGRaSvc; C:\Programme\BullGuard Software\BullGuard\support\bgrasvc.exe []
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Programme\ALDI Sued Foto Service\Common\Database\bin\fbserver.exe [2005-11-17 1527900]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; c:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 GoogleDesktopManager-110309-193829;Google Desktop Manager 5.9.911.3589; C:\Programme\Google\Google Desktop Search\GoogleDesktop.exe [2009-12-11 30192]
S3 idsvc;Windows CardSpace; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 sdAuxService;PC Tools Auxiliary Service; C:\Programme\Spyware Doctor\pctsAuxs.exe [2009-10-30 359624]
S3 sdCoreService;PC Tools Security Service; C:\Programme\Spyware Doctor\pctsSvc.exe [2009-11-06 1141712]
S3 usnjsvc;Messenger USN Journal Reader-Service für freigegebene Ordner; C:\Programme\MSN Messenger\usnsvc.exe [2007-01-19 97136]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; c:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Ich hoffe, dass ihr mir helfen könnt und bedanke mich schonmal im Voraus für eure Hilfe

MfG,
Flamer

TR/Trash.Gen angeblich entfernt, logs so in Ordnung?

Plagegeister aller Art und deren Bekämpfung: TR/Trash.Gen angeblich entfernt, logs so in Ordnung?

TR/Trash.Gen angeblich entfernt, logs so in Ordnung?

Ähnliche Themen: TR/Trash.Gen angeblich entfernt, logs so in Ordnung?