Trojaner-Board - TR/Dropper.Gen und Security.Hijack

Ich hoffe, ich hab das richtige Unterforum erwischt.
Seit gestern macht sich bei mir ein Trojaner mit der bezeichnung TR/Dropper.Gen bei mir in kurzen Abständen bemerkbar, immer wieder springt Antivir an, und meldet mir den Fehler. (dabei kommen immer zwei Warnfenster hoch...)
Ich habe nun nach Anweisung der Anleitung überall gesucht, aber nichts gefunden, was mir weiterhielfe, und leider nichts gefunden, aus dem ich schlau werde. :(
Darum hab ich nun die entsprechenden Logs erstellt, verbunden mit einer Bitte um Hilfe.

Malwarebytes' - Log

Code:

Malwarebytes' Anti-Malware 1.42

Datenbank Version: 3350

Windows 6.0.6002 Service Pack 2

Internet Explorer 8.0.6001.18865
 

13.12.2009 00:46:54

mbam-log-2009-12-13 (00-46-54).txt
 

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|F:\|G:\|H:\|I:\|Z:\|)

Durchsuchte Objekte: 442742

Laufzeit: 4 hour(s), 22 minute(s), 46 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 5

Infizierte Registrierungswerte: 0

Infizierte Dateiobjekte der Registrierung: 0

Infizierte Verzeichnisse: 0

Infizierte Dateien: 0
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\chrome.exe 
 

(Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\safari.exe 
 

(Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\navigator.exe 
 

(Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\opera.exe 
 

(Security.Hijack) -> Quarantined and deleted successfully.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Image File Execution Options\Userinit.exe 
 

(Security.Hijack) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung:

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

(Keine bösartigen Objekte gefunden)

log.txt

Code:

Logfile of random's system information tool 1.06 (written by random/random)

Run by *** at 2009-12-13 00:51:20

Microsoft® Windows Vista™ Ultimate  Service Pack 2

System drive C: has 3 GB (1%) free of 226 GB

Total RAM: 3581 MB (52% free)
 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 00:51:31, on 13.12.2009

Platform: Windows Vista SP2 (WinNT 6.00.1906)

MSIE: Internet Explorer v8.00 (8.00.6001.18865)

Boot mode: Normal
 

Running processes:

C:\Windows\system32\taskeng.exe

C:\Windows\system32\Dwm.exe

C:\Windows\Explorer.EXE

C:\Program Files\Windows Defender\MSASCui.exe

C:\Program Files\DellTPad\Apoint.exe

C:\Windows\OEM02Mon.exe

C:\Program Files\Java\jre6\bin\jusched.exe

C:\Windows\System32\rundll32.exe

C:\Windows\System32\rundll32.exe

C:\Program Files\Avira\AntiVir Desktop\avgnt.exe

C:\Program Files\Dell Support Center\bin\sprtcmd.exe

C:\Program Files\DellTPad\ApMsgFwd.exe

C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe

C:\Program Files\iTunes\iTunesHelper.exe

C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe

C:\Program Files\DAEMON Tools Lite\daemon.exe

C:\Program Files\DellTPad\HidFind.exe

C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe

C:\Program Files\Windows Media Player\wmpnscfg.exe

C:\Games\Steam\Steam.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Program Files\DellTPad\Apntex.exe

C:\Program Files\Dell\QuickSet\quickset.exe

C:\Program Files\OpenOffice.org 3\program\soffice.exe

C:\Program Files\OpenOffice.org 3\program\soffice.bin

C:\Program Files\Common Files\Ahead\Lib\NMIndexStoreSvr.exe

C:\Program Files\WIDCOMM\Bluetooth Software\BtStackServer.exe

C:\Program Files\Java\jre6\bin\jucheck.exe

C:\PROGRAM FILES\Mozilla Firefox\firefox.exe

C:\Windows\system32\NOTEPAD.EXE

C:\Windows\system32\SearchFilterHost.exe

C:\Users\***\Downloads\RSIT.exe

C:\Program Files\trend micro\***.exe
 

R1 - HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://w*w.daemon-search.com/startpage

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = h**p://go.microsoft.com/fwlink/?LinkId=69157

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = h**p://go.microsoft.com/fwlink/?LinkId=54896

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = h**p://go.microsoft.com/fwlink/?LinkId=54896

R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = h**p://go.microsoft.com/fwlink/?LinkId=69157

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,SearchAssistant = 

R0 - HKLM\Software\Microsoft\Internet Explorer\Search,CustomizeSearch = 

R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyServer = http=192.168.97.1:3128;https=192.168.97.1:3128;socks=192.168.97.1:1080

R0 - HKCU\Software\Microsoft\Internet Explorer\Toolbar,LinksFolderName = 

O1 - Hosts: ::1 localhost

O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll

O2 - BHO: Groove GFS Browser Helper - {72853161-30C5-4D22-B7F9-0BBC1D38A37E} - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll

O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll

O4 - HKLM\..\Run: [Windows Defender] %ProgramFiles%\Windows Defender\MSASCui.exe -hide

O4 - HKLM\..\Run: [Apoint] C:\Program Files\DellTPad\Apoint.exe

O4 - HKLM\..\Run: [OEM02Mon.exe] C:\Windows\OEM02Mon.exe

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Program Files\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [dscactivate] "C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe"

O4 - HKLM\..\Run: [NvSvc] RUNDLL32.EXE C:\Windows\system32\nvsvc.dll,nvsvcStart

O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup

O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\Windows\system32\NvMcTray.dll,NvTaskbarInit

O4 - HKLM\..\Run: [NVHotkey] rundll32.exe C:\Windows\system32\nvHotkey.dll,Start

O4 - HKLM\..\Run: [avgnt] "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min

O4 - HKLM\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter

O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe"

O4 - HKLM\..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe

O4 - HKLM\..\Run: [GrooveMonitor] "C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe"

O4 - HKLM\..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime

O4 - HKLM\..\Run: [iTunesHelper] "C:\Program Files\iTunes\iTunesHelper.exe"

O4 - HKLM\..\Run: [SigmatelSysTrayApp] %ProgramFiles%\SigmaTel\C-Major Audio\WDM\sttray.exe

O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent

O4 - HKCU\..\Run: [DellSupportCenter] "C:\Program Files\Dell Support Center\bin\sprtcmd.exe" /P DellSupportCenter

O4 - HKCU\..\Run: [Skype] "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized

O4 - HKCU\..\Run: [DAEMON Tools Lite] "C:\Program Files\DAEMON Tools Lite\daemon.exe" -autorun

O4 - HKCU\..\Run: [BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe"

O4 - HKCU\..\Run: [WMPNSCFG] C:\Program Files\Windows Media Player\WMPNSCFG.exe

O4 - HKCU\..\Run: [Steam] "C:\Games\Steam\Steam.exe" -silent

O4 - HKUS\S-1-5-19\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-19\..\Run: [WindowsWelcomeCenter] rundll32.exe oobefldr.dll,ShowWelcomeCenter (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [Sidebar] %ProgramFiles%\Windows Sidebar\Sidebar.exe /detectMem (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [cbssreg] C:\Windows\TEMP\fisr.tmp\svchost.exe (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [cbssreg] C:\Windows\TEMP\fisr.tmp\svchost.exe (User 'Default user')

O4 - Startup: OpenOffice.org 3.0.lnk = C:\Program Files\OpenOffice.org 3\program\quickstart.exe

O4 - Global Startup: BTTray.lnk = ?

O4 - Global Startup: QuickSet.lnk = C:\Program Files\Dell\QuickSet\quickset.exe

O8 - Extra context menu item: Add to Google Photos Screensa&ver - res://C:\Windows\system32\GPhotos.scr/200

O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: E&xport to Microsoft Excel - res://C:\PROGRA~1\MICROS~3\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: Send to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra 'Tools' menuitem: S&end to OneNote - {2670000A-7350-4f3c-8081-5663EE0C6C49} - C:\PROGRA~1\MICROS~3\Office12\ONBttnIE.dll

O9 - Extra button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~3\Office12\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe

O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Program Files\ICQ6.5\ICQ.exe

O13 - Gopher Prefix: 

O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - h**p://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab

O18 - Protocol: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll

O23 - Service: Andrea ST Filters Service (AESTFilters) - Andrea Electronics Corporation - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\aestsrv.exe

O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\sched.exe

O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Program Files\Avira\AntiVir Desktop\avguard.exe

O23 - Service: Apple Mobile Device - Apple Inc. - C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe

O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Program Files\Bonjour\mDNSResponder.exe

O23 - Service: Intel(R) PROSet/Wireless Event Log (EvtEng) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\EvtEng.exe

O23 - Service: FLEXnet Licensing Service - Macrovision Europe Ltd. - C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

O23 - Service: Google Update Service (gupdate1c9d86bb6a4e550) (gupdate1c9d86bb6a4e550) - Google Inc. - C:\Program Files\Google\Update\GoogleUpdate.exe

O23 - Service: Google Updater Service (gusvc) - Google - C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe

O23 - Service: iPod-Dienst (iPod Service) - Apple Inc. - C:\Program Files\iPod\bin\iPodService.exe

O23 - Service: NBService - Nero AG - C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe

O23 - Service: NMIndexingService - Nero AG - C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe

O23 - Service: NVIDIA Display Driver Service (nvsvc) - NVIDIA Corporation - C:\Windows\system32\nvvsvc.exe

O23 - Service: PnkBstrA - Unknown owner - C:\Windows\system32\PnkBstrA.exe

O23 - Service: Intel(R) PROSet/Wireless Registry Service (RegSrvc) - Intel Corporation - C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe

O23 - Service: SupportSoft Sprocket Service (dellsupportcenter) (sprtsvc_dellsupportcenter) - SupportSoft, Inc. - C:\Program Files\Dell Support Center\bin\sprtsvc.exe

O23 - Service: SigmaTel Audio Service (STacSV) - IDT, Inc. - C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\STacSV.exe

O23 - Service: Steam Client Service - Valve Corporation - C:\Program Files\Common Files\Steam\SteamService.exe
 

--

End of file - 10210 bytes
 

======Scheduled tasks folder======
 

C:\Windows\tasks\GoogleUpdateTaskMachineCore.job

C:\Windows\tasks\GoogleUpdateTaskMachineUA.job

C:\Windows\tasks\User_Feed_Synchronization-{8949E6C9-EBB5-45C7-AA04-A6CB8ABD91B0}.job
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

Adobe PDF Link Helper - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{72853161-30C5-4D22-B7F9-0BBC1D38A37E}]

Groove GFS Browser Helper - C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java(tm) Plug-In 2 SSV Helper - C:\Program Files\Java\jre6\bin\jp2ssv.dll [2009-09-23 41760]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Program Files\DAEMON Tools Toolbar\DTToolbar.dll [2008-12-10 929224]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"Windows Defender"=C:\Program Files\Windows Defender\MSASCui.exe [2008-01-21 1008184]

"Apoint"=C:\Program Files\DellTPad\Apoint.exe [2007-10-25 167936]

"OEM02Mon.exe"=C:\Windows\OEM02Mon.exe [2007-05-10 36864]

"SunJavaUpdateSched"=C:\Program Files\Java\jre6\bin\jusched.exe [2009-09-23 149280]

"dscactivate"=C:\Program Files\Dell Support Center\gs_agent\custom\dsca.exe [2008-03-11 16384]

"NvSvc"=C:\Windows\system32\nvsvc.dll [2007-09-13 86016]

"NvCplDaemon"=C:\Windows\system32\NvCpl.dll [2007-09-13 8497696]

"NvMediaCenter"=C:\Windows\system32\NvMcTray.dll [2007-09-13 81920]

"NVHotkey"=C:\Windows\system32\nvHotkey.dll [2007-09-13 81920]

"avgnt"=C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

"DellSupportCenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe [2009-05-21 206064]

"Adobe Reader Speed Launcher"=C:\Program Files\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

"NeroFilterCheck"=C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe [2007-03-01 153136]

"GrooveMonitor"=C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [2008-10-25 31072]

"QuickTime Task"=C:\Program Files\QuickTime\QTTask.exe [2009-09-05 417792]

"iTunesHelper"=C:\Program Files\iTunes\iTunesHelper.exe [2009-10-28 141600]

"SigmatelSysTrayApp"=C:\Program Files\SigmaTel\C-Major Audio\WDM\sttray.exe [2008-02-15 405504]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]

"Malwarebytes' Anti-Malware"=C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe [2009-12-03 429392]
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"DellSupportCenter"=C:\Program Files\Dell Support Center\bin\sprtcmd.exe [2009-05-21 206064]

"Skype"=C:\Program Files\Skype\Phone\Skype.exe [2009-03-27 24103720]

"DAEMON Tools Lite"=C:\Program Files\DAEMON Tools Lite\daemon.exe [2008-12-29 687560]

"BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Program Files\Common Files\Ahead\Lib\NMBgMonitor.exe [2007-06-27 152872]

"WMPNSCFG"=C:\Program Files\Windows Media Player\WMPNSCFG.exe [2008-01-21 202240]

"Steam"=C:\Games\Steam\Steam.exe [2009-11-28 1217808]
 

C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup

BTTray.lnk - C:\Program Files\WIDCOMM\Bluetooth Software\BTTray.exe

QuickSet.lnk - C:\Program Files\Dell\QuickSet\quickset.exe
 

C:\Users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup

OpenOffice.org 3.0.lnk - C:\Program Files\OpenOffice.org 3\program\quickstart.exe
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\ShellExecuteHooks]

"{B5A7F190-DDA6-4420-B3BA-52453494E6CD}"=C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-12 2217848]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfPf]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfRd]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfSvc]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\WudfUsbccidDriver]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"EnableLUA"=0

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1

"EnableUIADesktopToggle"=0
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"BindDirectlyToPropertySetStorage"=
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{20107d86-81e3-11de-a5e1-001d09594796}]

shell\AutoRun\command - I:\InstallTomTomHOME.exe
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{84ec6633-bf9e-11de-8f51-001fe2d9a6a1}]

shell\AutoRun\command - J:\LaunchU3.exe -a
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{990fbe5b-ad72-11de-adad-001fe2d9a6a1}]

shell\AutoRun\command - I:\installer.exe

shell\verb\command - I:\installer.exe
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{cbd8d193-76ba-11de-a085-001fe2d9a6a1}]

shell\AutoRun\command - K:\LaunchU3.exe -a
 
 

======File associations======
 

.js - edit - C:\Windows\System32\Notepad.exe %1

.js - open - C:\Windows\System32\WScript.exe "%1" %*
 

======List of files/folders created in the last 1 months======
 

2009-12-13 00:51:21 ----D---- C:\Program Files\trend micro

2009-12-13 00:51:20 ----D---- C:\rsit

2009-12-12 20:21:25 ----D---- C:\Users\***\AppData\Roaming\Malwarebytes

2009-12-12 20:21:16 ----D---- C:\ProgramData\Malwarebytes

2009-12-12 20:21:16 ----D---- C:\Program Files\Malwarebytes' Anti-Malware

2009-12-12 20:08:50 ----D---- C:\Program Files\CCleaner

2009-12-12 03:03:14 ----A---- C:\Windows\system32\nshhttp.dll

2009-12-12 03:03:13 ----A---- C:\Windows\system32\httpapi.dll

2009-12-11 13:07:58 ----SHD---- C:\found.003

2009-12-10 03:28:17 ----A---- C:\Windows\system32\winhttp.dll

2009-12-10 03:28:15 ----A---- C:\Windows\system32\mshtml.dll

2009-12-10 03:28:14 ----A---- C:\Windows\system32\ieframe.dll

2009-12-10 03:28:11 ----A---- C:\Windows\system32\wininet.dll

2009-12-10 03:28:11 ----A---- C:\Windows\system32\urlmon.dll

2009-12-10 03:28:11 ----A---- C:\Windows\system32\occache.dll

2009-12-10 03:28:11 ----A---- C:\Windows\system32\msfeeds.dll

2009-12-10 03:28:11 ----A---- C:\Windows\system32\ieui.dll

2009-12-10 03:28:11 ----A---- C:\Windows\system32\iertutil.dll

2009-12-10 03:28:11 ----A---- C:\Windows\system32\iedkcs32.dll

2009-12-10 03:28:10 ----A---- C:\Windows\system32\msfeedssync.exe

2009-12-10 03:28:10 ----A---- C:\Windows\system32\msfeedsbs.dll

2009-12-10 03:28:10 ----A---- C:\Windows\system32\jsproxy.dll

2009-12-10 03:28:10 ----A---- C:\Windows\system32\ieUnatt.exe

2009-12-10 03:28:10 ----A---- C:\Windows\system32\iesysprep.dll

2009-12-10 03:28:10 ----A---- C:\Windows\system32\iesetup.dll

2009-12-10 03:28:10 ----A---- C:\Windows\system32\iernonce.dll

2009-12-10 03:28:10 ----A---- C:\Windows\system32\iepeers.dll

2009-12-10 03:28:10 ----A---- C:\Windows\system32\ie4uinit.exe

2009-12-10 03:27:52 ----A---- C:\Windows\system32\rastls.dll

2009-11-29 16:29:50 ----A---- C:\Windows\jestertb.dll

2009-11-27 22:30:53 ----D---- C:\Program Files\Common Files\Steam

2009-11-26 03:02:27 ----A---- C:\Windows\system32\tzres.dll

2009-11-25 10:37:11 ----A---- C:\Windows\system32\msxml6.dll

2009-11-25 10:37:10 ----A---- C:\Windows\system32\msxml3.dll

2009-11-25 07:06:36 ----A---- C:\Windows\system32\XAudio2_5.dll

2009-11-25 07:06:36 ----A---- C:\Windows\system32\xactengine3_5.dll

2009-11-25 07:06:36 ----A---- C:\Windows\system32\d3dx11_42.dll

2009-11-25 07:06:36 ----A---- C:\Windows\system32\d3dx10_42.dll

2009-11-25 07:06:36 ----A---- C:\Windows\system32\d3dcsx_42.dll

2009-11-25 07:06:36 ----A---- C:\Windows\system32\D3DCompiler_42.dll

2009-11-25 07:06:35 ----A---- C:\Windows\system32\D3DX9_42.dll

2009-11-25 07:06:34 ----A---- C:\Windows\system32\XAPOFX1_3.dll

2009-11-25 07:06:32 ----A---- C:\Windows\system32\XAudio2_3.dll

2009-11-25 07:06:32 ----A---- C:\Windows\system32\XAPOFX1_2.dll

2009-11-25 07:06:32 ----A---- C:\Windows\system32\xactengine3_3.dll

2009-11-25 07:06:31 ----A---- C:\Windows\system32\XAudio2_2.dll

2009-11-25 07:06:31 ----A---- C:\Windows\system32\XAPOFX1_1.dll

2009-11-25 07:06:31 ----A---- C:\Windows\system32\X3DAudio1_5.dll

2009-11-25 07:06:30 ----A---- C:\Windows\system32\xactengine3_2.dll

2009-11-21 03:21:42 ----D---- C:\Program Files\Windows Portable Devices

2009-11-21 03:04:37 ----A---- C:\Windows\system32\UIAnimation.dll

2009-11-21 03:04:36 ----A---- C:\Windows\system32\UIRibbonRes.dll

2009-11-21 03:04:36 ----A---- C:\Windows\system32\UIRibbon.dll

2009-11-21 03:03:59 ----A---- C:\Windows\system32\WMPhoto.dll

2009-11-21 03:03:58 ----A---- C:\Windows\system32\cdd.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\XpsRasterService.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\XpsGdiConverter.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\WindowsCodecsExt.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\WindowsCodecs.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\printfilterpipelinesvc.exe

2009-11-21 03:03:56 ----A---- C:\Windows\system32\printfilterpipelineprxy.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\PhotoMetadataHandler.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\dxdiagn.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\dxdiag.exe

2009-11-21 03:03:56 ----A---- C:\Windows\system32\d3d10warp.dll

2009-11-21 03:03:56 ----A---- C:\Windows\system32\d2d1.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\xpsservices.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\XpsPrint.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\OpcServices.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\FntCache.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\dxgi.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\DWrite.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\d3d11.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\d3d10level9.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\d3d10core.dll

2009-11-21 03:03:55 ----A---- C:\Windows\system32\d3d10_1core.dll

2009-11-21 03:03:54 ----A---- C:\Windows\system32\d3d10_1.dll

2009-11-21 03:03:54 ----A---- C:\Windows\system32\d3d10.dll

2009-11-21 03:03:12 ----A---- C:\Windows\system32\WPDShextAutoplay.exe

2009-11-21 03:03:12 ----A---- C:\Windows\system32\wpdbusenum.dll

2009-11-21 03:03:12 ----A---- C:\Windows\system32\BthMtpContextHandler.dll

2009-11-21 03:03:09 ----A---- C:\Windows\system32\PortableDeviceConnectApi.dll

2009-11-21 03:03:08 ----A---- C:\Windows\system32\WpdConns.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\WPDSp.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\WPDShServiceObj.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\wpdshext.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\WpdMtpUS.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\WpdMtp.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\wpd_ci.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\PortableDeviceWMDRM.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\PortableDeviceTypes.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\PortableDeviceClassExtension.dll

2009-11-21 03:03:07 ----A---- C:\Windows\system32\PortableDeviceApi.dll

2009-11-21 03:01:48 ----A---- C:\Windows\system32\UIAutomationCore.dll

2009-11-21 03:01:48 ----A---- C:\Windows\system32\oleaccrc.dll

2009-11-21 03:01:48 ----A---- C:\Windows\system32\oleacc.dll

2009-11-20 17:51:33 ----D---- C:\Program Files\SecureW2

2009-11-20 16:42:20 ----D---- C:\Windows\system32\eu-ES

2009-11-20 16:42:20 ----D---- C:\Windows\system32\ca-ES

2009-11-20 16:42:19 ----D---- C:\Windows\system32\vi-VN

2009-11-20 16:25:33 ----D---- C:\Windows\system32\EventProviders

2009-11-16 11:51:12 ----D---- C:\Users\***\AppData\Roaming\FileZilla

2009-11-16 11:50:21 ----D---- C:\Program Files\FileZilla FTP Client

2009-11-15 23:14:02 ----D---- C:\Program Files\Multiple Image Resizer .NET

2009-11-15 23:13:39 ----HDC---- C:\ProgramData\{9CCF7773-8BDD-441A-9B92-593772C4EFDC}

2009-11-14 04:34:37 ----D---- C:\Users\***\AppData\Roaming\VOWSoft

2009-11-14 04:34:33 ----D---- C:\Program Files\PicaLoader
 

======List of files/folders modified in the last 1 months======
 

2009-12-13 00:51:31 ----D---- C:\Windows\Prefetch

2009-12-13 00:51:25 ----D---- C:\Windows\Temp

2009-12-13 00:51:21 ----RD---- C:\Program Files

2009-12-13 00:17:12 ----D---- C:\Program Files\Trillian

2009-12-13 00:17:01 ----D---- C:\Users\***\AppData\Roaming\Skype

2009-12-12 22:47:36 ----A---- C:\Windows\NeroDigital.ini

2009-12-12 20:21:18 ----D---- C:\Windows\system32\drivers

2009-12-12 20:21:16 ----HD---- C:\ProgramData

2009-12-12 20:19:14 ----D---- C:\Program Files\Mozilla Firefox

2009-12-12 20:12:51 ----D---- C:\Windows\Minidump

2009-12-12 20:12:51 ----D---- C:\Windows\Debug

2009-12-12 20:12:51 ----D---- C:\Windows

2009-12-12 18:10:50 ----D---- C:\Windows\System32

2009-12-12 18:10:50 ----D---- C:\Windows\inf

2009-12-12 18:10:50 ----A---- C:\Windows\system32\PerfStringBackup.INI

2009-12-12 13:57:52 ----D---- C:\Windows\rescache

2009-12-12 09:19:41 ----D---- C:\Windows\winsxs

2009-12-12 07:24:57 ----D---- C:\Windows\system32\catroot

2009-12-12 07:22:16 ----D---- C:\Windows\system32\migration

2009-12-12 07:22:15 ----D---- C:\Windows\system32\en-US

2009-12-12 07:22:15 ----D---- C:\Windows\system32\de-DE

2009-12-12 07:22:15 ----D---- C:\Program Files\Internet Explorer

2009-12-12 07:22:14 ----D---- C:\Program Files\Windows Mail

2009-12-12 03:05:31 ----SHD---- C:\Windows\Installer

2009-12-12 03:05:23 ----D---- C:\ProgramData\Microsoft Help

2009-12-12 03:03:41 ----D---- C:\Windows\system32\catroot2

2009-12-12 03:03:06 ----RSD---- C:\Windows\assembly

2009-12-08 06:44:00 ----D---- C:\Users\***\AppData\Roaming\Azureus

2009-12-06 22:05:20 ----RD---- C:\Torrent

2009-12-05 04:15:13 ----D---- C:\Windows\system32\spool

2009-12-05 04:12:40 ----D---- C:\Program Files\Vuze

2009-12-01 21:06:19 ----A---- C:\Windows\system32\mrt.exe

2009-11-29 03:17:39 ----SHD---- C:\System Volume Information

2009-11-27 22:30:53 ----D---- C:\Program Files\Common Files

2009-11-27 22:30:49 ----D---- C:\Games

2009-11-27 12:55:21 ----D---- C:\Program Files\Google

2009-11-22 01:37:48 ----A---- C:\Windows\ACTIVEJP.INI

2009-11-21 16:27:04 ----D---- C:\Windows\system32\Tasks

2009-11-21 06:48:02 ----D---- C:\Windows\Microsoft.NET

2009-11-21 03:21:41 ----D---- C:\Windows\system32\wbem

2009-11-21 03:21:39 ----D---- C:\Windows\system32\zh-TW

2009-11-21 03:21:39 ----D---- C:\Windows\system32\zh-HK

2009-11-21 03:21:39 ----D---- C:\Windows\system32\zh-CN

2009-11-21 03:21:39 ----D---- C:\Windows\system32\uk-UA

2009-11-21 03:21:39 ----D---- C:\Windows\system32\tr-TR

2009-11-21 03:21:39 ----D---- C:\Windows\system32\th-TH

2009-11-21 03:21:39 ----D---- C:\Windows\system32\sv-SE

2009-11-21 03:21:39 ----D---- C:\Windows\system32\sr-Latn-CS

2009-11-21 03:21:39 ----D---- C:\Windows\system32\sl-SI

2009-11-21 03:21:39 ----D---- C:\Windows\system32\sk-SK

2009-11-21 03:21:39 ----D---- C:\Windows\system32\ru-RU

2009-11-21 03:21:39 ----D---- C:\Windows\system32\ro-RO

2009-11-21 03:21:39 ----D---- C:\Windows\system32\pt-PT

2009-11-21 03:21:39 ----D---- C:\Windows\system32\pt-BR

2009-11-21 03:21:39 ----D---- C:\Windows\system32\pl-PL

2009-11-21 03:21:39 ----D---- C:\Windows\system32\nl-NL

2009-11-21 03:21:39 ----D---- C:\Windows\system32\nb-NO

2009-11-21 03:21:39 ----D---- C:\Windows\system32\lv-LV

2009-11-21 03:21:39 ----D---- C:\Windows\system32\lt-LT

2009-11-21 03:21:39 ----D---- C:\Windows\system32\ko-KR

2009-11-21 03:21:39 ----D---- C:\Windows\system32\ja-JP

2009-11-21 03:21:39 ----D---- C:\Windows\system32\it-IT

2009-11-21 03:21:39 ----D---- C:\Windows\system32\hu-HU

2009-11-21 03:21:39 ----D---- C:\Windows\system32\hr-HR

2009-11-21 03:21:39 ----D---- C:\Windows\system32\he-IL

2009-11-21 03:21:39 ----D---- C:\Windows\system32\fr-FR

2009-11-21 03:21:39 ----D---- C:\Windows\system32\fi-FI

2009-11-21 03:21:39 ----D---- C:\Windows\system32\et-EE

2009-11-21 03:21:39 ----D---- C:\Windows\system32\es-ES

2009-11-21 03:21:39 ----D---- C:\Windows\system32\el-GR

2009-11-21 03:21:39 ----D---- C:\Windows\system32\da-DK

2009-11-21 03:21:39 ----D---- C:\Windows\system32\cs-CZ

2009-11-21 03:21:39 ----D---- C:\Windows\system32\bg-BG

2009-11-21 03:21:39 ----D---- C:\Windows\system32\ar-SA

2009-11-20 16:51:01 ----SHD---- C:\Boot

2009-11-20 16:43:40 ----D---- C:\Program Files\Windows Calendar

2009-11-20 16:43:40 ----D---- C:\Program Files\Movie Maker

2009-11-20 16:43:37 ----D---- C:\Program Files\Windows Sidebar

2009-11-20 16:43:37 ----D---- C:\Program Files\Windows Media Player

2009-11-20 16:43:37 ----D---- C:\Program Files\Windows Journal

2009-11-20 16:43:37 ----D---- C:\Program Files\Windows Collaboration

2009-11-20 16:43:35 ----D---- C:\Program Files\Windows Photo Gallery

2009-11-20 16:43:35 ----D---- C:\Program Files\Common Files\System

2009-11-20 16:43:29 ----D---- C:\Windows\servicing

2009-11-20 16:43:29 ----D---- C:\Windows\ehome

2009-11-20 16:43:29 ----D---- C:\Program Files\Windows Defender

2009-11-20 16:43:16 ----D---- C:\Windows\IME

2009-11-20 16:43:15 ----D---- C:\Windows\system32\XPSViewer

2009-11-20 16:43:15 ----D---- C:\Windows\PolicyDefinitions

2009-11-20 16:43:09 ----D---- C:\Windows\system32\oobe

2009-11-20 16:43:06 ----D---- C:\Windows\system32\SLUI

2009-11-20 16:43:06 ----D---- C:\Windows\system32\setup

2009-11-20 16:43:06 ----D---- C:\Windows\system32\manifeststore

2009-11-20 16:43:06 ----D---- C:\Windows\system32\en

2009-11-20 16:43:06 ----D---- C:\Windows\system32\AdvancedInstallers

2009-11-20 16:43:01 ----D---- C:\Windows\system32\migwiz

2009-11-20 16:42:28 ----RSD---- C:\Windows\Fonts

2009-11-20 16:42:28 ----D---- C:\Windows\AppPatch

2009-11-20 16:42:19 ----D---- C:\Windows\system32\Boot
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R1 avgio;avgio; \??\C:\Program Files\Avira\AntiVir Desktop\avgio.sys [2009-02-13 11608]

R1 avipbb;avipbb; C:\Windows\system32\DRIVERS\avipbb.sys [2009-04-28 96104]

R1 CSC;Offline Files Driver; C:\Windows\system32\drivers\csc.sys [2009-04-11 351744]

R1 ssmdrv;ssmdrv; C:\Windows\system32\DRIVERS\ssmdrv.sys [2009-06-11 28520]

R2 avgntflt;avgntflt; C:\Windows\system32\DRIVERS\avgntflt.sys [2009-12-07 56816]

R2 rismxdp;Ricoh xD-Picture Card Driver; C:\Windows\system32\DRIVERS\rixdptsk.sys [2006-11-14 37376]

R3 ApfiltrService;Alps Touch Pad Filter Driver for Windows 2000/XP/Vista; C:\Windows\system32\DRIVERS\Apfiltr.sys [2007-12-26 164400]

R3 BthEnum;Bluetooth-Auflistungsdienst; C:\Windows\system32\DRIVERS\BthEnum.sys [2009-04-11 22528]

R3 BthPan;Bluetooth-Gerät (PAN); C:\Windows\system32\DRIVERS\bthpan.sys [2008-01-21 92160]

R3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\Windows\System32\Drivers\BTHUSB.sys [2009-04-11 29696]

R3 btwaudio;Bluetooth-Audiogerät; C:\Windows\system32\drivers\btwaudio.sys [2006-11-06 78128]

R3 btwavdt;Bluetooth AVDT; C:\Windows\system32\drivers\btwavdt.sys [2006-11-06 80176]

R3 btwrchid;btwrchid; C:\Windows\system32\DRIVERS\btwrchid.sys [2006-11-06 16560]

R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\Windows\system32\DRIVERS\CmBatt.sys [2008-01-21 14208]

R3 GEARAspiWDM;GEAR ASPI Filter Driver; C:\Windows\system32\DRIVERS\GEARAspiWDM.sys [2009-05-18 26600]

R3 NETw4v32;Intel(R) Wireless WiFi Link Adaptertreiber für Windows Vista 32 Bit; C:\Windows\system32\DRIVERS\NETw4v32.sys [2007-08-08 2226688]

R3 nvlddmkm;nvlddmkm; C:\Windows\system32\DRIVERS\nvlddmkm.sys [2007-09-13 7620704]

R3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\Windows\system32\DRIVERS\rfcomm.sys [2009-04-11 148992]

R3 rimmptsk;rimmptsk; C:\Windows\system32\DRIVERS\rimmptsk.sys [2005-11-16 28928]

R3 rimsptsk;rimsptsk; C:\Windows\system32\DRIVERS\rimsptsk.sys [2005-12-22 51840]

R3 sdbus;sdbus; C:\Windows\system32\DRIVERS\sdbus.sys [2009-04-11 89088]

R3 STHDA;SigmaTel High Definition Audio CODEC; C:\Windows\system32\drivers\stwrt.sys [2008-02-15 330752]

R3 WmiAcpi;Microsoft Windows Management Interface for ACPI; C:\Windows\system32\DRIVERS\wmiacpi.sys [2008-01-21 11264]

R3 yukonwlh;NDIS6.0 Miniport Driver for Marvell Yukon Ethernet Controller; C:\Windows\system32\DRIVERS\yk60x86.sys [2007-09-17 278528]

S3 aro8hdqa;aro8hdqa; C:\Windows\system32\drivers\aro8hdqa.sys []

S3 BTHPORT;Bluetooth-Porttreiber; C:\Windows\System32\Drivers\BTHport.sys [2009-04-11 507904]

S3 CVirtA;Cisco Systems VPN Adapter; C:\Windows\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]

S3 DFUBTUSB;WIDCOMM USB Bluetooth Driver in DFU State; C:\Windows\System32\Drivers\frmupgr.sys []

S3 drmkaud;Microsoft Kernel-DRM-Audioentschlüsselung; C:\Windows\system32\drivers\drmkaud.sys [2008-01-21 5632]

S3 HdAudAddService;Microsoft 1.1 UAA-Funktionstreiber für High Definition Audio-Dienst; C:\Windows\system32\drivers\HdAudio.sys [2006-11-02 235520]

S3 MSKSSRV;Microsoft Streaming Service Proxy; C:\Windows\system32\drivers\MSKSSRV.sys [2008-01-21 8192]

S3 MSPCLOCK;Microsoft Proxy für Streaming Clock; C:\Windows\system32\drivers\MSPCLOCK.sys [2008-01-21 5888]

S3 MSPQM;Microsoft Proxy für Streaming Quality Manager; C:\Windows\system32\drivers\MSPQM.sys [2008-01-21 5504]

S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\Windows\system32\drivers\MSTEE.sys [2008-01-21 6016]

S3 OEM02Dev;Creative Camera OEM002 Driver; C:\Windows\system32\DRIVERS\OEM02Dev.sys [2007-10-11 235648]

S3 OEM02Vfx;Creative Camera OEM002 Video VFX Driver; C:\Windows\system32\DRIVERS\OEM02Vfx.sys [2007-03-05 7424]

S3 USBAAPL;Apple Mobile USB Driver; C:\Windows\System32\Drivers\usbaapl.sys [2009-08-28 40448]

S3 usbvideo;USB-Videogerät (WDM); C:\Windows\System32\Drivers\usbvideo.sys [2008-01-21 134016]

S3 WpdUsb;WpdUsb; C:\Windows\system32\DRIVERS\wpdusb.sys [2009-10-01 40448]

S3 WUDFRd;WUDFRd; C:\Windows\system32\DRIVERS\WUDFRd.sys [2008-01-21 83328]

S4 DNE;Deterministic Network Enhancer Miniport; C:\Windows\system32\DRIVERS\dne2000.sys [2008-03-29 125328]

S4 ErrDev;Microsoft Hardware Error Device Driver; C:\Windows\system32\drivers\errdev.sys [2008-01-21 6656]

S4 MegaSR;MegaSR; C:\Windows\system32\drivers\megasr.sys [2008-01-21 386616]
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 AESTFilters;Andrea ST Filters Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\aestsrv.exe [2007-09-20 73728]

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Program Files\Avira\AntiVir Desktop\sched.exe [2009-06-11 108289]

R2 AntiVirService;Avira AntiVir Guard; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [2009-08-05 185089]

R2 Apple Mobile Device;Apple Mobile Device; C:\Program Files\Common Files\Apple\Mobile Device Support\bin\AppleMobileDeviceService.exe [2009-05-29 144712]

R2 Bonjour Service;Bonjour-Dienst; C:\Program Files\Bonjour\mDNSResponder.exe [2008-12-12 238888]

R2 BthServ;@%SystemRoot%\System32\bthserv.dll,-101; C:\Windows\system32\svchost.exe [2008-01-21 21504]

R2 CscService;@%systemroot%\system32\cscsvc.dll,-200; C:\Windows\System32\svchost.exe [2008-01-21 21504]

R2 EvtEng;Intel(R) PROSet/Wireless Event Log; C:\Program Files\Intel\Wireless\Bin\EvtEng.exe [2007-07-25 647168]

R2 nvsvc;NVIDIA Display Driver Service; C:\Windows\system32\nvvsvc.exe [2008-09-03 196608]

R2 PnkBstrA;PnkBstrA; C:\Windows\system32\PnkBstrA.exe [2009-10-26 75064]

R2 RegSrvc;Intel(R) PROSet/Wireless Registry Service; C:\Program Files\Intel\Wireless\Bin\RegSrvc.exe [2007-07-25 327680]

R2 sprtsvc_dellsupportcenter;SupportSoft Sprocket Service (dellsupportcenter); C:\Program Files\Dell Support Center\bin\sprtsvc.exe [2008-08-13 201968]

R2 STacSV;SigmaTel Audio Service; C:\Windows\System32\DriverStore\FileRepository\stwrt.inf_c09c50a2\STacSV.exe [2008-02-15 102400]

R3 iPod Service;iPod-Dienst; C:\Program Files\iPod\bin\iPodService.exe [2009-10-28 545568]

R3 NMIndexingService;NMIndexingService; C:\Program Files\Common Files\Ahead\Lib\NMIndexingService.exe [2007-06-27 279848]

S2 gupdate1c9d86bb6a4e550;Google Update Service (gupdate1c9d86bb6a4e550); C:\Program Files\Google\Update\GoogleUpdate.exe [2009-05-19 133104]

S3 AppMgmt;@appmgmts.dll,-3250; C:\Windows\system32\svchost.exe [2008-01-21 21504]

S3 Fax;@%systemroot%\system32\fxsresm.dll,-118; C:\Windows\system32\fxssvc.exe [2008-01-21 523776]

S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-06-02 654848]

S3 FontCache;@%systemroot%\system32\FntCache.dll,-100; C:\Windows\system32\svchost.exe [2008-01-21 21504]

S3 gusvc;Google Updater Service; C:\Program Files\Google\Common\Google Updater\GoogleUpdaterService.exe [2008-11-20 136120]

S3 Microsoft Office Groove Audit Service;Microsoft Office Groove Audit Service; C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe [2008-10-25 65888]

S3 NBService;NBService; C:\Program Files\Nero\Nero 7\Nero BackItUp\NBService.exe [2007-06-29 800040]

S3 odserv;Microsoft Office Diagnostics Service; C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE [2008-11-04 441712]

S3 ose;Office Source Engine; C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S3 Steam Client Service;Steam Client Service; C:\Program Files\Common Files\Steam\SteamService.exe [2009-07-16 316664]

S3 UmRdpService;@%SystemRoot%\system32\umrdp.dll,-1000; C:\Windows\System32\svchost.exe [2008-01-21 21504]

S3 wbengine;@%systemroot%\system32\wbengine.exe,-104; C:\Windows\system32\wbengine.exe [2009-04-11 918528]
 

-----------------EOF-----------------

info.txt

Code:

info.txt logfile of random's system information tool 1.06 2009-12-13 00:51:33
 

======Uninstall list======
 

-->C:\Program Files\Nero\Nero 7\\nero\uninstall\UNNERO.exe /UNINSTALL

-->C:\Windows\UNNeroBackItUp.exe /UNINSTALL

-->C:\Windows\UNNeroMediaHome.exe /UNINSTALL

-->C:\Windows\UNNeroShowTime.exe /UNINSTALL

-->C:\Windows\UNNeroVision.exe /UNINSTALL

-->C:\Windows\UNRecode.exe /UNINSTALL

Adobe Anchor Service CS3-->MsiExec.exe /I{90176341-0A8B-4CCC-A78D-F862228A6B95}

Adobe Asset Services CS3-->MsiExec.exe /I{6FF5DD7A-FE28-4439-B8CF-1E9AF4EA0A61}

Adobe Bridge CS3-->MsiExec.exe /I{9C9824D9-9000-4373-A6A5-D0E5D4831394}

Adobe Bridge Start Meeting-->MsiExec.exe /I{08B32819-6EEF-4057-AEDA-5AB681A36A23}

Adobe Camera Raw 4.0-->MsiExec.exe /I{B3BF6689-A81D-40D8-9A86-4AC4ACD9FC1C}

Adobe CMaps-->MsiExec.exe /I{A2B242BD-FF8D-4840-9DAA-9170EABEC59C}

Adobe Color - Photoshop Specific-->MsiExec.exe /I{A2D81E70-2A98-4A08-A628-94388B063C5E}

Adobe Color Common Settings-->MsiExec.exe /I{DADD7B8A-BCB0-44F5-967A-ECB6B4F2ECD9}

Adobe Color EU Extra Settings-->MsiExec.exe /I{51846830-E7B2-4218-8968-B77F0FF475B8}

Adobe Color JA Extra Settings-->MsiExec.exe /I{DD7DB3C5-6FA3-4FA3-8A71-C2F2940EB029}

Adobe Color NA Recommended Settings-->MsiExec.exe /I{95655ED4-7CA5-46DF-907F-7144877A32E5}

Adobe Default Language CS3-->MsiExec.exe /I{B9B35331-B7E4-4E5C-BF4C-7BC87856124D}

Adobe Device Central CS3-->MsiExec.exe /I{8D2BA474-F406-4710-9AE4-D4F22D21F0DD}

Adobe ExtendScript Toolkit 2-->MsiExec.exe /I{C2D69781-F392-4118-A5A7-C7E9C38DBFC2}

Adobe Flash Player 10 ActiveX-->C:\Windows\system32\Macromed\Flash\uninstall_activeX.exe

Adobe Flash Player 10 Plugin-->C:\Windows\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Fonts All-->MsiExec.exe /I{6ABE0BEE-D572-4FE8-B434-9E72A289431B}

Adobe Help Viewer CS3-->MsiExec.exe /I{04AF207D-9A77-465A-8B76-991F6AB66245}

Adobe Illustrator CS3-->C:\Program Files\Common Files\Adobe\Installers\a04a925a57548091300ada368235fc6\Setup.exe

Adobe Illustrator CS3-->MsiExec.exe /I{F08E8D2E-F132-4742-9C87-D5FF223A016A}

Adobe Linguistics CS3-->MsiExec.exe /I{54793AA1-5001-42F4-ABB6-C364617C6078}

Adobe PDF Library Files-->MsiExec.exe /I{D2559B88-CC9D-4B48-81BB-F492BAA9C48C}

Adobe Photoshop CS3-->C:\Program Files\Common Files\Adobe\Installers\2ac78060bc5856b0c1cf873bb919b58\Setup.exe

Adobe Photoshop CS3-->MsiExec.exe /I{0046FA01-C5B9-4985-BACB-398DC480FC05}

Adobe Photoshop Lightroom 2-->MsiExec.exe /I{531BC138-F1F7-496B-879C-F039ECEF438D}

Adobe Reader 9.1 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A91000000001}

Adobe Setup-->MsiExec.exe /I{4F3E17F8-F1C8-4A4B-9EB8-1EE2D190CDA9}

Adobe Setup-->MsiExec.exe /I{D1BB4446-AE9C-4256-9A7F-4D46604D2462}

Adobe Stock Photos CS3-->MsiExec.exe /I{29E5EA97-5F74-4A57-B8B2-D4F169117183}

Adobe Type Support-->MsiExec.exe /I{8E6808E2-613D-4FCD-81A2-6C8FA8E03312}

Adobe Update Manager CS3-->MsiExec.exe /I{E69AE897-9E0B-485C-8552-7841F48D42D8}

Adobe Version Cue CS3 Client-->MsiExec.exe /I{D0DFF92A-492E-4C40-B862-A74A173C25C5}

Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{184CE391-7E0E-4C63-9935-D7A10EDFD3C6}

Adobe XMP Panels CS3-->MsiExec.exe /I{802771A9-A856-4A41-ACF7-1450E523C923}

Aliens versus Predator 2: Primal Hunt-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{103B6835-DCA0-413F-A99E-ECAD6622726E}\Setup.exe" -l0x9 

Aliens vs. Predator 2-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{3EF79591-BF16-4CF8-8FF0-D8AD968228B1}\Setup.exe" 

AllToAVI v4 r5394-->C:\Program Files\AllToAVI\uninst.exe

Apple Application Support-->MsiExec.exe /I{B607C354-CD79-4D22-86D1-92DC94153F42}

Apple Mobile Device Support-->MsiExec.exe /I{AADEA55D-C834-4BCB-98A3-4B8D1C18F4EE}

Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}

Audiosurf-->"C:\Games\Steam\steam.exe" steam://uninstall/12900

Avira AntiVir Personal - Free Antivirus-->C:\Program Files\Avira\AntiVir Desktop\setup.exe /REMOVE

AviSynth 2.5-->"C:\Program Files\AviSynth 2.5\Uninstall.exe"

Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}

Call of Duty Modern Warfare 2-->"C:\Games\Modern Warfare 2\unins000.exe"

CANON iMAGE GATEWAY Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\CRWUnInstall.ini"

Canon Internet Library for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\CIGUnInstall.ini"

Canon RAW Image Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\RAW Image Task\Uninst.ini"

Canon Utilities CameraWindow DC_DV 6 for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowDVC6\Uninst.ini"

Canon Utilities CameraWindow-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\CameraWindowLauncher\Uninst.ini"

Canon Utilities Digital Photo Professional 3.4-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\Digital Photo Professional\Uninst.ini"

Canon Utilities EOS Utility-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\EOS Utility\Uninst.ini"

Canon Utilities MyCamera-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\MyCamera\Uninst.ini"

Canon Utilities Original Data Security Tools-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\Original Data Security Tools\Uninst.ini"

Canon Utilities PhotoStitch-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\PhotoStitch\Uninst.ini"

Canon Utilities Picture Style Editor-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\Picture Style Editor\Uninst.ini"

Canon Utilities RemoteCapture Task for ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\CameraWindow\RemoteCaptureTask DC\Uninst.ini"

Canon Utilities WFT-E1/E2/E3 Utility-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\WFT Utility\Uninst.ini"

Canon Utilities ZoomBrowser EX-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX\Program\Uninst.ini"

Canon ZoomBrowser EX Memory Card Utility-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\ZoomBrowser EX MCU\Uninst.ini"

CCleaner-->"C:\Program Files\CCleaner\uninst.exe"

Combined Community Codec Pack 2008-09-21 16:18-->"C:\Program Files\Combined Community Codec Pack\unins000.exe"

Counter-Strike: Source-->"C:\Games\Steam\steam.exe" steam://uninstall/240

DAEMON Tools Toolbar-->C:\Program Files\DAEMON Tools Toolbar\uninst.exe

Dell Resource CD-->MsiExec.exe /X{42929F0F-CE14-47AF-9FC7-FF297A603021}

Dell Support Center (Support Software)-->MsiExec.exe /X{E3BFEE55-39E2-4BE0-B966-89FE583822C1}

Dell Touchpad-->C:\Program Files\DellTPad\Uninstap.exe ADDREMOVE

Diablo II-->C:\Windows\DIIUnin.exe C:\Windows\DIIUnin.dat

EOS USB WIA Driver-->"C:\Program Files\Common Files\Canon\UIW\1.4.0.0\Uninst.exe" "C:\Program Files\Canon\EOS USB WIA Driver\Uninst.ini"

FileZilla Client 3.3.0.1-->C:\Program Files\FileZilla FTP Client\uninstall.exe

Google Earth-->MsiExec.exe /X{9074AFC0-CFDA-11DE-B484-005056806466}

Google Update Helper-->MsiExec.exe /I{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}

Grand Theft Auto San Andreas-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{086BADF8-9B1F-4E89-B207-2EDA520972D6}\setup.exe" -l0x9  -removeonly

GTA San Andreas 2.0 Uncutpatch-->C:\Games\Rockstar Games\Grand Theft Auto San Andreas\Uninstal.exe

HijackThis 2.0.2-->"C:\Program Files\trend micro\HijackThis.exe" /uninstall

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""

Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""

ICQ6.5-->"C:\Program Files\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly

Idiot Proof Video Converter 1.00-->C:\Program Files\Idiot Proof Video Converter\uninst.exe

Insurgency-->"C:\Games\Steam\steam.exe" steam://uninstall/17700

Intel(R) PROSet/Wireless Software-->C:\Windows\Installer\iProInst.exe

iPhone Tunnel Suite v 2.0-->"C:\Program Files\iPhone Tunnel Suite\unins000.exe"

iPhoneModem-->MsiExec.exe /I{05580173-6EF3-419A-84BE-C4D12EA6661A}

iTunes-->MsiExec.exe /I{D1A74FBB-CA8D-4CCA-9B89-BAAA436DB178}

Java(TM) 6 Update 15-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216015FF}

Java(TM) 6 Update 5-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160050}

JDownloader-->C:\Program Files\JDownloader\uninstall.exe

Katawa Shoujo Act 1-->"C:\Program Files\Katawa Shoujo Act 1\Uninstall Katawa Shoujo Act 1.exe"

Laptop Integrated Webcam Driver (1.04.01.1011)  -->C:\Windows\CtDrvIns.exe -uninstall -script OEM002.uns -plugin OEM02Pin.dll -pluginres OEM02Pin.crl -nodisconprompt -langid 0x0407

Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"

Marvell Miniport Driver-->MsiExec.exe /X{C950420B-4182-49EA-850A-A6A2ABF06C6B}

mCore-->MsiExec.exe /I{F5D7FAB5-A1FD-4DD3-983E-4155B09D7102}

mDriver-->MsiExec.exe /I{A0F925BF-5C55-44C2-A4E7-5A4C59791C29}

mHelp-->MsiExec.exe /I{8C6BB412-D3A8-4AAE-A01B-35B681789D68}

Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->c:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe

Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}

Microsoft .NET Framework 3.5 SP1-->C:\Windows\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe

Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}

Microsoft AppLocale-->MsiExec.exe /I{394BE3D9-7F57-4638-A8D1-1D88671913B7}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0B36C6D6-F5D8-4EAF-BF94-4376A230AD5B}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-00BA-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0114-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0115-0409-0000-0000000FF1CE} /uninstall {DE5A002D-8122-4278-A7EE-3121E7EA254E}

Microsoft Office 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-0117-0409-0000-0000000FF1CE} /uninstall {2FC4457D-409E-466F-861F-FB0CB796B53E}

Microsoft Office Access MUI (English) 2007-->MsiExec.exe /X{90120000-0015-0409-0000-0000000FF1CE}

Microsoft Office Access Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0117-0409-0000-0000000FF1CE}

Microsoft Office Enterprise 2007-->"C:\Program Files\Common Files\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall ENTERPRISE /dll OSETUP.DLL

Microsoft Office Enterprise 2007-->MsiExec.exe /X{90120000-0030-0000-0000-0000000FF1CE}

Microsoft Office Excel MUI (English) 2007-->MsiExec.exe /X{90120000-0016-0409-0000-0000000FF1CE}

Microsoft Office Groove MUI (English) 2007-->MsiExec.exe /X{90120000-00BA-0409-0000-0000000FF1CE}

Microsoft Office Groove Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0114-0409-0000-0000000FF1CE}

Microsoft Office InfoPath MUI (English) 2007-->MsiExec.exe /X{90120000-0044-0409-0000-0000000FF1CE}

Microsoft Office OneNote MUI (English) 2007-->MsiExec.exe /X{90120000-00A1-0409-0000-0000000FF1CE}

Microsoft Office Outlook MUI (English) 2007-->MsiExec.exe /X{90120000-001A-0409-0000-0000000FF1CE}

Microsoft Office PowerPoint MUI (English) 2007-->MsiExec.exe /X{90120000-0018-0409-0000-0000000FF1CE}

Microsoft Office Proof (English) 2007-->MsiExec.exe /X{90120000-001F-0409-0000-0000000FF1CE}

Microsoft Office Proof (French) 2007-->MsiExec.exe /X{90120000-001F-040C-0000-0000000FF1CE}

Microsoft Office Proof (Spanish) 2007-->MsiExec.exe /X{90120000-001F-0C0A-0000-0000000FF1CE}

Microsoft Office Proofing (English) 2007-->MsiExec.exe /X{90120000-002C-0409-0000-0000000FF1CE}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0409-0000-0000000FF1CE} /uninstall {ABDDE972-355B-4AF1-89A8-DA50B7B5C045}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-040C-0000-0000000FF1CE} /uninstall {F580DDD5-8D37-4998-968E-EBB76BB86787}

Microsoft Office Proofing Tools 2007 Service Pack 2 (SP2)-->msiexec /package {90120000-001F-0C0A-0000-0000000FF1CE} /uninstall {187308AB-5FA7-4F14-9AB9-D290383A10D9}

Microsoft Office Publisher MUI (English) 2007-->MsiExec.exe /X{90120000-0019-0409-0000-0000000FF1CE}

Microsoft Office Shared MUI (English) 2007-->MsiExec.exe /X{90120000-006E-0409-0000-0000000FF1CE}

Microsoft Office Shared Setup Metadata MUI (English) 2007-->MsiExec.exe /X{90120000-0115-0409-0000-0000000FF1CE}

Microsoft Office Word MUI (English) 2007-->MsiExec.exe /X{90120000-001B-0409-0000-0000000FF1CE}

Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}

Microsoft SQL Server Compact 3.5 SP1 English-->MsiExec.exe /I{E59113EB-0285-4BFD-A37A-B79EAC6B8F4B}

Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}

Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

Microsoft Windows Application Compatibility Database-->C:\Windows\system32\sdbinst.exe -u "C:\Windows\AppPatch\Custom\{deb7008b-681e-4a4a-8aae-cc833e8216ce}.sdb"

mMHouse-->MsiExec.exe /I{F0BFC7EF-9CF8-44EE-91B0-158884CD87C5}

MozBackup 1.4.9-->C:\Program Files\MozBackup\Uninstall.exe

Mozilla Firefox (3.0.15)-->C:\PROGRAM FILES\Mozilla Firefox\uninstall\helper.exe

mPfMgr-->MsiExec.exe /I{8B928BA1-EDEC-4227-A2DA-DD83026C36F5}

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}

Multiple Image Resizer .NET-->"C:\ProgramData\{9CCF7773-8BDD-441A-9B92-593772C4EFDC}\MirInstaller.exe" REMOVE=TRUE MODIFY=FALSE

Multiple Image Resizer .NET-->C:\ProgramData\{9CCF7773-8BDD-441A-9B92-593772C4EFDC}\MirInstaller.exe

mWMI-->MsiExec.exe /I{63DB9CCD-2B56-4217-9A3D-507AC78320CA}

Nero 7 Ultra Edition-->MsiExec.exe /X{CF097717-F174-4144-954A-FBC4BF301031}

neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}

NVIDIA Drivers-->C:\Windows\system32\NVUNINST.EXE UninstallGUI

Ogg Codecs 0.81.15562-->C:\Program Files\Xiph.Org\Ogg Codecs\uninst.exe

OpenOffice.org 3.0-->MsiExec.exe /I{04B45310-A5FE-4425-BFCA-1A6D8920DE74}

PDF Settings-->MsiExec.exe /I{AC5B0C19-D851-42F4-BDA0-410ECF7F70A5}

PicaLoader 1.7.1-->C:\Program Files\PicaLoader\uninst.exe

Picasa 3-->"C:\Program Files\Google\Picasa3\Uninstall.exe"

Postal Fudge Pack-->C:\Windows\unvise32.exe C:\Games\Postal2STP\uninstal.log

PS3 Video 9 5.03-->C:\Program Files\Red Kawa\Video Converter App\uninstaller.exe

PunkBuster Services-->C:\Windows\system32\pbsvc.exe -u

Qtpfsgui 1.9.3-->"C:\Program Files\Qtpfsgui\unins000.exe"

QuickSet-->MsiExec.exe /I{4B6AD248-D3BF-426A-8D64-847288154F13}

QuickTime-->MsiExec.exe /I{A429C2AE-EBF1-4F81-A221-1C115CAADDAD}

Safari-->MsiExec.exe /I{E56D39F8-2A9F-44B4-B068-A72E45A073E6}

SecureW2 EAP Suite 1.1.3 for Windows-->C:\Program Files\SecureW2\Uninstall.exe

Security Update for 2007 Microsoft Office System (KB969559)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {69F52148-9BF6-4CDC-BF76-103DEAF3DD08}

Security Update for 2007 Microsoft Office System (KB973704)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {E626DC89-A787-4553-9BB3-DC2EC7E1593F}

Security Update for Microsoft Office Excel 2007 (KB973593)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7D6255E3-3423-4D8B-A328-F6F8D28DD5FE}

Security Update for Microsoft Office Outlook 2007 (KB972363)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {120BE9A0-9B09-4855-9E0C-7DEE45CB03C0}

Security Update for Microsoft Office PowerPoint 2007 (KB957789)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7559E742-FF9F-4FAE-B279-008ED296CB4D}

Security Update for Microsoft Office Publisher 2007 (KB969693)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {7BE67088-1EB3-4569-8E75-DDAFBF61BC4E}

Security Update for Microsoft Office system 2007 (972581)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {3D019598-7B59-447A-80AE-815B703B84FF}

Security Update for Microsoft Office system 2007 (KB969613)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {5ECEB317-CBE9-4E08-AB10-756CB6F0FB6C}

Security Update for Microsoft Office system 2007 (KB974234)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FCD742B9-7A55-44BC-A776-F795F21FEDDC}

Security Update for Microsoft Office Visio Viewer 2007 (KB973709)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {71127777-8B2C-4F97-AF7A-6CF8CAC8224D}

SigmaTel Audio-->RunDll32 C:\PROGRA~1\COMMON~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{A462213D-EED4-42C2-9A60-7BDD4D4B0B17}\setup.exe" -l0x7 -remove -removeonly

Skype™ 4.0-->MsiExec.exe /X{24D753CA-6AE9-4E30-8F5F-EFC93E08BF3D}

Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}

TeamSpeak 2 RC2-->"C:\Program Files\Teamspeak2_RC2\unins000.exe"

Trillian-->C:\Program Files\Trillian\trillian.exe /uninstall

Update for 2007 Microsoft Office System (KB967642)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {C444285D-5E4F-48A4-91DD-47AAAA68E92D}

Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\Windows\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""

Update for Microsoft Office 2007 Help for Common Features (KB963673)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {AB365889-0395-4FAD-B702-CA5985D53D42}

Update for Microsoft Office Access 2007 Help (KB963663)-->msiexec /package {90120000-0015-0409-0000-0000000FF1CE} /uninstall {6B76A18A-AA1E-42AB-A7AD-6C84BBB43987}

Update for Microsoft Office Excel 2007 Help (KB963678)-->msiexec /package {90120000-0016-0409-0000-0000000FF1CE} /uninstall {199DF7B6-169C-448C-B511-1054101BE9C9}

Update for Microsoft Office InfoPath 2007 (KB976416)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {432C5EE4-8096-4FF1-95E1-65219365DFF7}

Update for Microsoft Office Infopath 2007 Help (KB963662)-->msiexec /package {90120000-0044-0409-0000-0000000FF1CE} /uninstall {716B81B8-B13C-41DF-8EAC-7A2F656CAB63}

Update for Microsoft Office OneNote 2007 Help (KB963670)-->msiexec /package {90120000-00A1-0409-0000-0000000FF1CE} /uninstall {2744EF05-38E1-4D5D-B333-E021EDAEA245}

Update for Microsoft Office Outlook 2007 Help (KB963677)-->msiexec /package {90120000-001A-0409-0000-0000000FF1CE} /uninstall {0451F231-E3E3-4943-AB9F-58EB96171784}

Update for Microsoft Office Powerpoint 2007 Help (KB963669)-->msiexec /package {90120000-0018-0409-0000-0000000FF1CE} /uninstall {397B1D4F-ED7B-4ACA-A637-43B670843876}

Update for Microsoft Office Publisher 2007 Help (KB963667)-->msiexec /package {90120000-0019-0409-0000-0000000FF1CE} /uninstall {2E40DE55-B289-4C8B-8901-5D369B16814F}

Update for Microsoft Office Script Editor Help (KB963671)-->msiexec /package {90120000-006E-0409-0000-0000000FF1CE} /uninstall {CD11C6A2-FFC6-4271-8EAB-79C3582F505C}

Update for Microsoft Office Word 2007 (KB974561)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {0CDDBAA2-2111-4A0E-A1B0-76C40C635331}

Update for Microsoft Office Word 2007 Help (KB963665)-->msiexec /package {90120000-001B-0409-0000-0000000FF1CE} /uninstall {80E762AA-C921-4839-9D7D-DB62A72C0726}

Update for Outlook 2007 Junk Email Filter (kb976884)-->msiexec /package {90120000-0030-0000-0000-0000000FF1CE} /uninstall {FB60F280-C70F-4174-BADB-471412AA42F0}

Videora iPhone 3G Converter 4.07-->C:\Program Files\Red Kawa\Video Converter App\uninstaller.exe

Vuze-->C:\Program Files\Vuze\uninstall.exe

WavePad Sound Editor-->C:\Program Files\NCH Swift Sound\WavePad\uninst.exe

WIDCOMM Bluetooth Software 6.0.1.3100-->MsiExec.exe /X{A13E07E1-A423-44FB-9DEE-B24C75C1BAF2}

winpwn-2.5 2.5.0.2-->C:\Program Files\winpwn-2.5\uninstall winpwn-2.5.exe

WinRAR-->C:\Program Files\WinRAR\uninstall.exe

Wolfenstein-->C:\Program Files\InstallShield Installation Information\{F9B37992-968C-4264-8449-489032FC28DE}\setup.exe -runfromtemp -l0x0409

YouTube Downloader App 1.02-->C:\Program Files\Regensoft\Downloader App\uninstaller.exe
 

======Security center information======
 

AS: Windows Defender
 

======System event log======
 

Computer Name: Jedi

Event Code: 4201

Message: Netzwerkadapter "LAN-Verbindung" wurde mit dem Netzwerk verbunden, und das System im normalen Zustand gestartet.

Record Number: 63846

Source Name: Tcpip

Time Written: 20090907081043.651762-000

Event Type: Informationen

User: 
 

Computer Name: Jedi

Event Code: 121

Message: Port A is up with 100 Mbps

Record Number: 63845

Source Name: yukonwlh

Time Written: 20090907081043.651762-000

Event Type: Informationen

User: 
 

Computer Name: Jedi

Event Code: 1003

Message: Der Computer konnte die Netzwerkadresse, die durch den DHCP-Server für die Netzwerkkarte mit der Netzwerkadresse 001D09594796 zugeteilt wurde, nicht erneuern. Der folgende Fehler ist aufgetreten: 

Der Vorgang wurde durch den Benutzer abgebrochen.. Es wird weiterhin im Hintergrund versucht, eine Adresse vom Netzwerkadressserver (DHCP) zu erhalten.

Record Number: 63844

Source Name: Microsoft-Windows-Dhcp-Client

Time Written: 20090907081044.000000-000

Event Type: Warnung

User: 
 

Computer Name: Jedi

Event Code: 83

Message: Port A is down 

Record Number: 63843

Source Name: yukonwlh

Time Written: 20090907081042.452762-000

Event Type: Informationen

User: 
 

Computer Name: Jedi

Event Code: 4201

Message: Netzwerkadapter "LAN-Verbindung" wurde mit dem Netzwerk verbunden, und das System im normalen Zustand gestartet.

Record Number: 63842

Source Name: Tcpip

Time Written: 20090907081041.952762-000

Event Type: Informationen

User: 
 

=====Application event log=====
 

Computer Name: 26L2233A3-09

Event Code: 1003

Message: Der Windows-Suchdienst wurde gestartet.
 

Record Number: 5

Source Name: Microsoft-Windows-Search

Time Written: 20090408235933.000000-000

Event Type: Informationen

User: 
 

Computer Name: 26L2233A3-09

Event Code: 5615

Message: Der Windows-Verwaltungsinstrumentationsdienst wurde erfolgreich gestartet.

Record Number: 4

Source Name: Microsoft-Windows-WMI

Time Written: 20090408235933.000000-000

Event Type: Informationen

User: 
 

Computer Name: 26L2233A3-09

Event Code: 4625

Message: Das EventSystem-Subsystem unterdrückt duplizierte Ereignisprotokolleinträge für eine Dauer von 86400 Sekunden. Dieses Zeitlimit kann durch den REG_DWORD-Wert SuppressDuplicateDuration unter folgendem Registrierungsschlüssel gesteuert werden: HKLM\Software\Microsoft\EventSystem\EventLog.

Record Number: 3

Source Name: Microsoft-Windows-EventSystem

Time Written: 20090408235929.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-OQK6C7NWF98

Event Code: 900

Message: Der Softwarelizenzierungsdienst wird gestartet.
 

Record Number: 2

Source Name: Microsoft-Windows-Security-Licensing-SLC

Time Written: 20090408235928.000000-000

Event Type: Informationen

User: 
 

Computer Name: WIN-OQK6C7NWF98

Event Code: 1531

Message: Der Benutzerprofildienst wurde erfolgreich gestartet.  
 
 

Record Number: 1

Source Name: Microsoft-Windows-User Profiles Service

Time Written: 20090408235928.000000-000

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

=====Security event log=====
 

Computer Name: 26L2233A3-09

Event Code: 4624

Message: Ein Konto wurde erfolgreich angemeldet.
 

Antragsteller:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                26L2233A3-09$

        Kontodomäne:                WORKGROUP

        Anmelde-ID:                0x3e7
 

Anmeldetyp:                        5
 

Neue Anmeldung:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                SYSTEM

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x3e7

        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}
 

Prozessinformationen:

        Prozess-ID:                0x248

        Prozessname:                C:\Windows\System32\services.exe
 

Netzwerkinformationen:

        Arbeitsstationsname:        

        Quellnetzwerkadresse:        -

        Quellport:                -
 

Detaillierte Authentifizierungsinformationen:

        Anmeldeprozess:                Advapi  

        Authentifizierungspaket:        Negotiate

        Übertragene Dienste:        -

        Paketname (nur NTLM):        -

        Schlüssellänge:                0
 

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
 

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
 

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
 

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
 

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
 

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.

         - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.

        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.

        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.

        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.

Record Number: 5

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090408235854.001258-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: 26L2233A3-09

Event Code: 4648

Message: Anmeldeversuch mit expliziten Anmeldeinformationen.
 

Antragsteller:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                26L2233A3-09$

        Kontodomäne:                WORKGROUP

        Anmelde-ID:                0x3e7

        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}
 

Konto, dessen Anmeldeinformationen verwendet wurden:

        Kontoname:                SYSTEM

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}
 

Zielserver:

        Zielservername:        localhost

        Weitere Informationen:        localhost
 

Prozessinformationen:

        Prozess-ID:                0x248

        Prozessname:                C:\Windows\System32\services.exe
 

Netzwerkinformationen:

        Netzwerkadresse:        -

        Port:                        -
 

Dieses Ereignis wird bei einem Anmeldeversuch durch einen Prozess generiert, wenn ausdrücklich die Anmeldeinformationen des Kontos angegeben werden.  Dies ist normalerweise der Fall in Batch-Konfigurationen, z. B. bei geplanten Aufgaben oder wenn der Befehl "runas" verwendet wird.

Record Number: 4

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090408235854.001258-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: 26L2233A3-09

Event Code: 4902

Message: Eine Benutzerrichtlinien-Überwachungstabelle wurde erstellt.
 

        Anzahl von Elementen:        0

        Richtlinienkennung:        0x1f836a

Record Number: 3

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090408235848.354022-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: 26L2233A3-09

Event Code: 4624

Message: Ein Konto wurde erfolgreich angemeldet.
 

Antragsteller:

        Sicherheits-ID:                S-1-0-0

        Kontoname:                -

        Kontodomäne:                -

        Anmelde-ID:                0x0
 

Anmeldetyp:                        0
 

Neue Anmeldung:

        Sicherheits-ID:                S-1-5-18

        Kontoname:                SYSTEM

        Kontodomäne:                NT-AUTORITÄT

        Anmelde-ID:                0x3e7

        Anmelde-GUID:                {00000000-0000-0000-0000-000000000000}
 

Prozessinformationen:

        Prozess-ID:                0x4

        Prozessname:                
 

Netzwerkinformationen:

        Arbeitsstationsname:        -

        Quellnetzwerkadresse:        -

        Quellport:                -
 

Detaillierte Authentifizierungsinformationen:

        Anmeldeprozess:                -

        Authentifizierungspaket:        -

        Übertragene Dienste:        -

        Paketname (nur NTLM):        -

        Schlüssellänge:                0
 

Dieses Ereignis wird beim Erstellen einer Anmeldesitzung generiert. Es wird auf dem Computer generiert, auf den zugegriffen wurde.
 

Die Antragstellerfelder geben das Konto auf dem lokalen System an, von dem die Anmeldung angefordert wurde. Dies ist meistens ein Dienst wie der Serverdienst oder ein lokaler Prozess wie "Winlogon.exe" oder "Services.exe".
 

Das Anmeldetypfeld gibt den jeweiligen Anmeldetyp an. Die häufigsten Typen sind 2 (interaktiv) und 3 (Netzwerk).
 

Die Felder für die neue Anmeldung geben das Konto an, für das die Anmeldung erstellt wurde, d. h. das angemeldete Konto.
 

Die Netzwerkfelder geben die Quelle einer Remoteanmeldeanforderung an. der Arbeitsstationsname ist nicht immer verfügbar und kann in manchen Fällen leer bleiben.
 

Die Felder für die Authentifizierungsinformationen enthalten detaillierte Informationen zu dieser speziellen Anmeldeanforderung.

         - Die Anmelde-GUID ist ein eindeutiger Bezeichner, der verwendet werden kann, um dieses Ereignis mit einem KDC-Ereignis zu korrelieren.

        - Die übertragenen Dienste geben an, welche Zwischendienste an der Anmeldeanforderung beteiligt waren.

        - Der Paketname gibt das in den NTLM-Protokollen verwendete Unterprotokoll an.

        - Die Schlüssellänge gibt die Länge des generierten Sitzungsschlüssels an. Wenn kein Sitzungsschlüssel angefordert wurde, ist dieser Wert 0.

Record Number: 2

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090408235846.092007-000

Event Type: Überwachung erfolgreich

User: 
 

Computer Name: 26L2233A3-09

Event Code: 4608

Message: Windows wird gestartet.
 

Dieses Ereignis wird protokolliert, wenn LSASS.EXE gestartet und das Überwachungssubsystem initialisiert wird.

Record Number: 1

Source Name: Microsoft-Windows-Security-Auditing

Time Written: 20090408235846.045207-000

Event Type: Überwachung erfolgreich

User: 
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"OS"=Windows_NT

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\QuickTime\QTSystem\

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH;.MSC

"PROCESSOR_ARCHITECTURE"=x86

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"USERNAME"=SYSTEM

"windir"=%SystemRoot%

"PROCESSOR_LEVEL"=6

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 6, GenuineIntel

"PROCESSOR_REVISION"=1706

"NUMBER_OF_PROCESSORS"=2

"TRACE_FORMAT_SEARCH_PATH"=\\NTREL202.ntdev.corp.microsoft.com\4F18C3A5-CA09-4DBD-B6FC-219FDD4C6BE0\TraceFormat

"DFSTRACINGON"=FALSE

"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip

"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip
 

-----------------EOF-----------------

Ich hoffe, es lässt sich aus diesen Logs etwas schließen.

Gute Nacht allerseits,

Ceras