Trojaner-Board - SDRA65.exe Befall

Hallo Franz,

hier die Logfiles

Zitat:

Malwarebytes' Anti-Malware 1.44
Datenbank Version: 3805
Windows 5.1.2600 Service Pack 3
Internet Explorer 8.0.6001.18702

28.02.2010 12:59:10
mbam-log-2010-02-28 (12-59-10).txt

Scan-Methode: Vollständiger Scan (C:\|)
Durchsuchte Objekte: 179320
Laufzeit: 1 hour(s), 54 minute(s), 38 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 1
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\cbssreg (Trojan.Agent) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)

Zitat:

10:25:52:818 2380 TDSS rootkit removing tool 2.2.2 Jan 13 2010 08:42:25
10:25:52:818 2380 ================================================================================
10:25:52:818 2380 SystemInfo:

10:25:52:818 2380 OS Version: 5.1.2600 ServicePack: 3.0
10:25:52:818 2380 Product type: Workstation
10:25:52:818 2380 ComputerName: CH
10:25:52:818 2380 UserName: C
10:25:52:818 2380 Windows directory: C:\WINDOWS
10:25:52:818 2380 Processor architecture: Intel x86
10:25:52:818 2380 Number of processors: 2
10:25:52:818 2380 Page size: 0x1000
10:25:52:818 2380 Boot type: Normal boot
10:25:52:818 2380 ================================================================================
10:25:52:818 2380 UnloadDriverW: NtUnloadDriver error 2
10:25:52:818 2380 ForceUnloadDriverW: UnloadDriverW(klmd21) error 2
10:25:52:818 2380 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
10:25:52:818 2380 UtilityInit: KLMD drop and load success
10:25:52:818 2380 KLMD_OpenDevice: Trying to open KLMD Device(KLMD201000)
10:25:52:818 2380 UtilityInit: KLMD open success
10:25:52:818 2380 UtilityInit: Initialize success
10:25:52:818 2380
10:25:52:834 2380 Scanning Services ...
10:25:52:834 2380 CreateRegParser: Registry parser init started
10:25:52:834 2380 DisableWow64Redirection: GetProcAddress(Wow64DisableWow64FsRedirection) error 127
10:25:52:834 2380 CreateRegParser: DisableWow64Redirection error
10:25:52:834 2380 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\system
10:25:52:834 2380 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\system) returned status C0000043
10:25:52:834 2380 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
10:25:52:834 2380 wfopen_ex: Trying to KLMD file open
10:25:52:834 2380 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\system
10:25:52:834 2380 wfopen_ex: File opened ok (Flags 2)
10:25:52:834 2380 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\system) init success: 3848D0
10:25:52:834 2380 wfopen_ex: Trying to open file C:\WINDOWS\system32\config\software
10:25:52:834 2380 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\config\software) returned status C0000043
10:25:52:834 2380 wfopen_ex: MyNtCreateFileW error 32 (C0000043)
10:25:52:834 2380 wfopen_ex: Trying to KLMD file open
10:25:52:834 2380 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\config\software
10:25:52:834 2380 wfopen_ex: File opened ok (Flags 2)
10:25:52:834 2380 CreateRegParser: HIVE_ADAPTER(C:\WINDOWS\system32\config\software) init success: 384978
10:25:52:834 2380 EnableWow64Redirection: GetProcAddress(Wow64RevertWow64FsRedirection) error 127
10:25:52:834 2380 CreateRegParser: EnableWow64Redirection error
10:25:52:834 2380 CreateRegParser: RegParser init completed
10:25:53:099 2380 GetAdvancedServicesInfo: Raw services enum returned 332 services
10:25:53:115 2380 fclose_ex: Trying to close file C:\WINDOWS\system32\config\system
10:25:53:115 2380 fclose_ex: Trying to close file C:\WINDOWS\system32\config\software
10:25:53:115 2380
10:25:53:115 2380 Scanning Kernel memory ...
10:25:53:115 2380 KLMD_GetSystemObjectAddressByNameW: Trying to get system object address by name \Driver\Disk
10:25:53:115 2380 DetectCureTDL3: \Driver\Disk PDRIVER_OBJECT: 89C26A08
10:25:53:115 2380 DetectCureTDL3: KLMD_GetDeviceObjectList returned 4 DevObjects
10:25:53:115 2380
10:25:53:115 2380 DetectCureTDL3: DEVICE_OBJECT: 89BECC68
10:25:53:115 2380 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89BECC68
10:25:53:115 2380 KLMD_ReadMem: Trying to ReadMemory 0x89BECC68[0x38]
10:25:53:115 2380 DetectCureTDL3: DRIVER_OBJECT: 89C26A08
10:25:53:115 2380 KLMD_ReadMem: Trying to ReadMemory 0x89C26A08[0xA8]
10:25:53:115 2380 KLMD_ReadMem: Trying to ReadMemory 0xE14C7620[0x18]
10:25:53:115 2380 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
10:25:53:115 2380 DetectCureTDL3: IrpHandler (0) addr: BA10EBB0
10:25:53:115 2380 DetectCureTDL3: IrpHandler (1) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (2) addr: BA10EBB0
10:25:53:115 2380 DetectCureTDL3: IrpHandler (3) addr: BA108D1F
10:25:53:115 2380 DetectCureTDL3: IrpHandler (4) addr: BA108D1F
10:25:53:115 2380 DetectCureTDL3: IrpHandler (5) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (6) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (7) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (8) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (9) addr: BA1092E2
10:25:53:115 2380 DetectCureTDL3: IrpHandler (10) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (11) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (12) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (13) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (14) addr: BA1093BB
10:25:53:115 2380 DetectCureTDL3: IrpHandler (15) addr: BA10CF28
10:25:53:115 2380 DetectCureTDL3: IrpHandler (16) addr: BA1092E2
10:25:53:115 2380 DetectCureTDL3: IrpHandler (17) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (18) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (19) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (20) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (21) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (22) addr: BA10AC82
10:25:53:115 2380 DetectCureTDL3: IrpHandler (23) addr: BA10F99E
10:25:53:115 2380 DetectCureTDL3: IrpHandler (24) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (25) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (26) addr: 804F4562
10:25:53:115 2380 TDL3_FileDetect: Processing driver: Disk
10:25:53:115 2380 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
10:25:53:115 2380 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
10:25:53:115 2380 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
10:25:53:115 2380
10:25:53:115 2380 DetectCureTDL3: DEVICE_OBJECT: 89BEDC68
10:25:53:115 2380 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89BEDC68
10:25:53:115 2380 KLMD_ReadMem: Trying to ReadMemory 0x89BEDC68[0x38]
10:25:53:115 2380 DetectCureTDL3: DRIVER_OBJECT: 89C26A08
10:25:53:115 2380 KLMD_ReadMem: Trying to ReadMemory 0x89C26A08[0xA8]
10:25:53:115 2380 KLMD_ReadMem: Trying to ReadMemory 0xE14C7620[0x18]
10:25:53:115 2380 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
10:25:53:115 2380 DetectCureTDL3: IrpHandler (0) addr: BA10EBB0
10:25:53:115 2380 DetectCureTDL3: IrpHandler (1) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (2) addr: BA10EBB0
10:25:53:115 2380 DetectCureTDL3: IrpHandler (3) addr: BA108D1F
10:25:53:115 2380 DetectCureTDL3: IrpHandler (4) addr: BA108D1F
10:25:53:115 2380 DetectCureTDL3: IrpHandler (5) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (6) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (7) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (8) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (9) addr: BA1092E2
10:25:53:115 2380 DetectCureTDL3: IrpHandler (10) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (11) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (12) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (13) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (14) addr: BA1093BB
10:25:53:115 2380 DetectCureTDL3: IrpHandler (15) addr: BA10CF28
10:25:53:115 2380 DetectCureTDL3: IrpHandler (16) addr: BA1092E2
10:25:53:115 2380 DetectCureTDL3: IrpHandler (17) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (18) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (19) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (20) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (21) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (22) addr: BA10AC82
10:25:53:115 2380 DetectCureTDL3: IrpHandler (23) addr: BA10F99E
10:25:53:115 2380 DetectCureTDL3: IrpHandler (24) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (25) addr: 804F4562
10:25:53:115 2380 DetectCureTDL3: IrpHandler (26) addr: 804F4562
10:25:53:115 2380 TDL3_FileDetect: Processing driver: Disk
10:25:53:115 2380 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
10:25:53:115 2380 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
10:25:53:115 2380 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
10:25:53:115 2380
10:25:53:115 2380 DetectCureTDL3: DEVICE_OBJECT: 89BEEC68
10:25:53:115 2380 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89BEEC68
10:25:53:131 2380 KLMD_ReadMem: Trying to ReadMemory 0x89BEEC68[0x38]
10:25:53:131 2380 DetectCureTDL3: DRIVER_OBJECT: 89C26A08
10:25:53:131 2380 KLMD_ReadMem: Trying to ReadMemory 0x89C26A08[0xA8]
10:25:53:131 2380 KLMD_ReadMem: Trying to ReadMemory 0xE14C7620[0x18]
10:25:53:131 2380 DetectCureTDL3: DRIVER_OBJECT name: \Driver\Disk, Driver Name: Disk
10:25:53:131 2380 DetectCureTDL3: IrpHandler (0) addr: BA10EBB0
10:25:53:131 2380 DetectCureTDL3: IrpHandler (1) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (2) addr: BA10EBB0
10:25:53:131 2380 DetectCureTDL3: IrpHandler (3) addr: BA108D1F
10:25:53:131 2380 DetectCureTDL3: IrpHandler (4) addr: BA108D1F
10:25:53:131 2380 DetectCureTDL3: IrpHandler (5) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (6) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (7) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (8) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (9) addr: BA1092E2
10:25:53:131 2380 DetectCureTDL3: IrpHandler (10) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (11) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (12) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (13) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (14) addr: BA1093BB
10:25:53:131 2380 DetectCureTDL3: IrpHandler (15) addr: BA10CF28
10:25:53:131 2380 DetectCureTDL3: IrpHandler (16) addr: BA1092E2
10:25:53:131 2380 DetectCureTDL3: IrpHandler (17) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (18) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (19) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (20) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (21) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (22) addr: BA10AC82
10:25:53:131 2380 DetectCureTDL3: IrpHandler (23) addr: BA10F99E
10:25:53:131 2380 DetectCureTDL3: IrpHandler (24) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (25) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (26) addr: 804F4562
10:25:53:131 2380 TDL3_FileDetect: Processing driver: Disk
10:25:53:131 2380 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\disk.sys
10:25:53:131 2380 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\disk.sys
10:25:53:131 2380 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\disk.sys - Verdict: Clean
10:25:53:131 2380
10:25:53:131 2380 DetectCureTDL3: DEVICE_OBJECT: 89C38AB8
10:25:53:131 2380 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89C38AB8
10:25:53:131 2380 DetectCureTDL3: DEVICE_OBJECT: 89BF5F18
10:25:53:131 2380 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89BF5F18
10:25:53:131 2380 DetectCureTDL3: DEVICE_OBJECT: 89C29D98
10:25:53:131 2380 KLMD_GetLowerDeviceObject: Trying to get lower device object for 89C29D98
10:25:53:131 2380 KLMD_ReadMem: Trying to ReadMemory 0x89C29D98[0x38]
10:25:53:131 2380 DetectCureTDL3: DRIVER_OBJECT: 89C3FAC0
10:25:53:131 2380 KLMD_ReadMem: Trying to ReadMemory 0x89C3FAC0[0xA8]
10:25:53:131 2380 KLMD_ReadMem: Trying to ReadMemory 0xE14BEA60[0x1A]
10:25:53:131 2380 DetectCureTDL3: DRIVER_OBJECT name: \Driver\atapi, Driver Name: atapi
10:25:53:131 2380 DetectCureTDL3: IrpHandler (0) addr: B9F146F2
10:25:53:131 2380 DetectCureTDL3: IrpHandler (1) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (2) addr: B9F146F2
10:25:53:131 2380 DetectCureTDL3: IrpHandler (3) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (4) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (5) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (6) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (7) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (8) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (9) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (10) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (11) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (12) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (13) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (14) addr: B9F14712
10:25:53:131 2380 DetectCureTDL3: IrpHandler (15) addr: B9F10852
10:25:53:131 2380 DetectCureTDL3: IrpHandler (16) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (17) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (18) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (19) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (20) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (21) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (22) addr: B9F1473C
10:25:53:131 2380 DetectCureTDL3: IrpHandler (23) addr: B9F1B336
10:25:53:131 2380 DetectCureTDL3: IrpHandler (24) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (25) addr: 804F4562
10:25:53:131 2380 DetectCureTDL3: IrpHandler (26) addr: 804F4562
10:25:53:131 2380 KLMD_ReadMem: Trying to ReadMemory 0xB9F11864[0x400]
10:25:53:131 2380 TDL3_StartIoHookDetect: CheckParameters: 0, 00000000, 0
10:25:53:131 2380 TDL3_FileDetect: Processing driver: atapi
10:25:53:131 2380 TDL3_FileDetect: Processing driver file: C:\WINDOWS\system32\DRIVERS\atapi.sys
10:25:53:131 2380 KLMD_CreateFileW: Trying to open file C:\WINDOWS\system32\DRIVERS\atapi.sys
10:25:53:131 2380 TDL3_FileDetect: C:\WINDOWS\system32\DRIVERS\atapi.sys - Verdict: Clean
10:25:53:131 2380
10:25:53:131 2380 Completed
10:25:53:131 2380
10:25:53:131 2380 Results:
10:25:53:131 2380 Memory objects infected / cured / cured on reboot: 0 / 0 / 0
10:25:53:131 2380 Registry objects infected / cured / cured on reboot: 0 / 0 / 0
10:25:53:131 2380 File objects infected / cured / cured on reboot: 0 / 0 / 0
10:25:53:131 2380
10:25:53:131 2380 MyNtCreateFileW: NtCreateFile(\??\C:\WINDOWS\system32\drivers\klmd.sys) returned status 00000000
10:25:53:131 2380 UtilityDeinit: KLMD(ARK) unloaded successfully

Zitat:

Logfile of random's system information tool 1.06 (written by random/random)
Run by C at 2010-02-28 13:00:55
Microsoft Windows XP Professional Service Pack 3
System drive C: has 955 MB (5%) free of 20 GB
Total RAM: 1790 MB (69% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 13:00:57, on 28.02.2010
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v8.00 (8.00.6001.18702)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\Ati2evxx.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\WINDOWS\system32\rundll32.exe
D:\Programme\pdf24\PDFBackend.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
D:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Bonjour\mDNSResponder.exe
C:\Programme\Java\jre6\bin\jqs.exe
d:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe
C:\Programme\Java\jre6\bin\jucheck.exe
D:\Programme\Mozilla Firefox\firefox.exe
D:\Eigene dateien\downloads\RSIT.exe
C:\Programme\Trend Micro\HijackThis\C.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = Google
R1 - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings,ProxyOverride = *.local
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - (no file)
O2 - BHO: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O2 - BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [BluetoothAuthenticationAgent] rundll32.exe bthprops.cpl,,BluetoothAuthenticationAgent
O4 - HKLM\..\Run: [PDFPrint] "d:\Programme\pdf24\PDFBackend.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [QuickTime Task] "D:\Programme\QuickTime\qttask.exe" -atboottime
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [NBKeyScan] "C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe"
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "d:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [SpybotSD TeaTimer] C:\Programme\Spybot - Search & Destroy\TeaTimer.exe
O4 - HKCU\..\Run: [IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}] "C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe" ASO-616B5711-6DAE-4795-A05F-39A1E5104020
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O4 - Global Startup: Microsoft Office.lnk = D:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: add to &BOM - C:\\PROGRA~1\\BIET-O~1\\\\AddToBOM.hta
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://D:\PROGRA~1\MICROS~1\Office10\EXCEL.EXE/3000
O9 - Extra button: (no name) - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra 'Tools' menuitem: Spybot - Search && Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - C:\Programme\Spybot - Search & Destroy\SDHelper.dll
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {CF40ACC5-E1BB-4AFF-AC72-04C2F616BCA7} (get_atlcom Class) - http://wwwimages.adobe.com/www.adobe...bat/nos/gp.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Gemeinsame Dateien\Skype\Skype4COM.dll
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe
O23 - Service: Autodesk Licensing Service - Autodesk - C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe
O23 - Service: Bonjour-Dienst (Bonjour Service) - Apple Inc. - C:\Programme\Bonjour\mDNSResponder.exe
O23 - Service: getPlus(R) Helper - NOS Microsystems Ltd. - C:\Programme\NOS\bin\getPlus_HelperSvc.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: Sony Ericsson OMSI download service (OMSI download service) - Unknown owner - d:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe

--
End of file - 5609 bytes

======Scheduled tasks folder======

C:\WINDOWS\tasks\OGALogon.job
C:\WINDOWS\tasks\WGASetup.job

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{53707962-6F74-2D53-2644-206D7942484F}]
Spybot-S&D IE Protection - C:\Programme\Spybot - Search & Destroy\SDHelper.dll [2009-01-26 1879896]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}]
Java(tm) Plug-In SSV Helper - C:\Programme\Java\jre6\bin\ssv.dll [2008-11-11 320920]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2008-11-11 34816]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2008-11-11 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2008-06-12 34672]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2008-09-30 16864768]
"BluetoothAuthenticationAgent"=bthprops.cpl,,BluetoothAuthenticationAgent []
"PDFPrint"=d:\Programme\pdf24\PDFBackend.exe [2008-01-31 134144]
"SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2008-11-11 136600]
"QuickTime Task"=D:\Programme\QuickTime\qttask.exe [2009-01-05 413696]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"NBKeyScan"=C:\Programme\Nero\Nero8\Nero BackItUp\NBKeyScan.exe []
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2008-06-19 57344]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"Sony Ericsson PC Suite"=d:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2009-09-24 434176]
"SpybotSD TeaTimer"=C:\Programme\Spybot - Search & Destroy\TeaTimer.exe [2009-01-26 2144088]
"IndxStoreSvr_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}"=C:\Programme\Gemeinsame Dateien\Nero\Lib\NMIndexStoreSvr.exe ASO-616B5711-6DAE-4795-A05F-39A1E5104020 []
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Microsoft Office.lnk - D:\Programme\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]
C:\WINDOWS\system32\Ati2evxx.dll [2008-03-19 126976]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\WgaLogon]
C:\WINDOWS\system32\WgaLogon.dll [2008-09-05 267304]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\{1a3e09be-1e45-494b-9174-d7385b45bbf5}]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

======File associations======

.scr - open - C:\WINDOWS\system32\notepad.exe "%1"
.scr - install -
.scr - config -

======List of files/folders created in the last 1 months======

2010-02-28 10:25:52 ----A---- C:\TDSSKiller.2.2.2_28.02.2010_10.25.52_log.txt
2010-02-28 10:25:19 ----A---- C:\TDSSKiller.2.2.2_28.02.2010_10.25.19_log.txt
2010-02-28 10:25:11 ----A---- C:\TDSSKiller.2.2.2_28.02.2010_10.25.11_log.txt
2010-02-24 23:30:49 ----A---- C:\WINDOWS\imsins.BAK
2010-02-24 23:30:46 ----HDC---- C:\WINDOWS\$NtUninstallKB979306$
2010-02-21 19:37:09 ----SHD---- C:\RECYCLER
2010-02-21 00:17:31 ----D---- C:\Avenger
2010-02-21 00:17:31 ----A---- C:\avenger.txt
2010-02-19 18:24:14 ----A---- C:\ComboFix.txt
2010-02-19 18:21:29 ----D---- C:\cofi.exe
2010-02-19 18:03:30 ----A---- C:\Boot.bak
2010-02-19 18:03:27 ----RASHD---- C:\cmdcons
2010-02-19 18:02:05 ----A---- C:\WINDOWS\zip.exe
2010-02-19 18:02:05 ----A---- C:\WINDOWS\SWXCACLS.exe
2010-02-19 18:02:05 ----A---- C:\WINDOWS\SWSC.exe
2010-02-19 18:02:05 ----A---- C:\WINDOWS\SWREG.exe
2010-02-19 18:02:05 ----A---- C:\WINDOWS\sed.exe
2010-02-19 18:02:05 ----A---- C:\WINDOWS\PEV.exe
2010-02-19 18:02:05 ----A---- C:\WINDOWS\NIRCMD.exe
2010-02-19 18:02:05 ----A---- C:\WINDOWS\MBR.exe
2010-02-19 18:02:05 ----A---- C:\WINDOWS\grep.exe
2010-02-19 18:01:50 ----D---- C:\WINDOWS\ERDNT
2010-02-19 18:01:48 ----D---- C:\CoFi
2010-02-19 18:01:11 ----D---- C:\Qoobox
2010-02-16 20:04:00 ----D---- C:\rsit
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\zh-TW
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\zh-HK
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\tr-TR
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\sv-SE
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\pt-BR
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\nl-NL
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\nb-NO
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\ko-KR
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\it-IT
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\he-IL
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\fr-FR
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\fi-FI
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\es-ES
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\el-GR
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\da-DK
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\ar-SA
2010-02-16 16:14:43 ----D---- C:\Programme\CCleaner
2010-02-16 10:19:24 ----D---- C:\Dokumente und Einstellungen\C\Anwendungsdaten\Malwarebytes
2010-02-16 10:19:18 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2010-02-16 10:19:18 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2010-02-16 09:55:21 ----D---- C:\Programme\ClearProg
2010-02-16 01:14:59 ----D---- C:\WINDOWS\ie8updates
2010-02-14 22:42:22 ----D---- C:\WINDOWS\WBEM
2010-02-14 22:41:24 ----HDC---- C:\WINDOWS\ie8
2010-02-14 21:10:17 ----D---- C:\Programme\Spybot - Search & Destroy
2010-02-14 21:10:17 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Spybot - Search & Destroy
2010-02-14 21:05:06 ----D---- C:\Programme\Trend Micro
2010-02-14 20:48:20 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SecTaskMan
2010-02-14 20:48:17 ----D---- C:\Programme\Security Task Manager
2010-02-14 20:38:28 ----D---- C:\Dokumente und Einstellungen\C\Anwendungsdaten\QuickScan
2010-02-14 20:21:27 ----SHD---- C:\WINDOWS\CSC
2010-02-10 23:03:08 ----HDC---- C:\WINDOWS\$NtUninstallKB978262$
2010-02-10 23:03:04 ----HDC---- C:\WINDOWS\$NtUninstallKB971468$
2010-02-10 23:02:00 ----HDC---- C:\WINDOWS\$NtUninstallKB978037$
2010-02-10 23:01:57 ----HDC---- C:\WINDOWS\$NtUninstallKB975713$
2010-02-10 23:01:53 ----HDC---- C:\WINDOWS\$NtUninstallKB978251$
2010-02-10 23:01:48 ----HDC---- C:\WINDOWS\$NtUninstallKB975560$
2010-02-10 23:01:20 ----HDC---- C:\WINDOWS\$NtUninstallKB977914$
2010-02-10 23:01:15 ----HDC---- C:\WINDOWS\$NtUninstallKB978706$
2010-02-10 23:01:02 ----HDC---- C:\WINDOWS\$NtUninstallKB977165$
2010-02-09 12:42:27 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\TVU Networks
2010-02-09 12:42:20 ----D---- C:\Programme\TVUPlayer

======List of files/folders modified in the last 1 months======

2010-02-28 10:28:04 ----D---- C:\WINDOWS\Prefetch
2010-02-28 10:25:53 ----D---- C:\WINDOWS\system32\drivers
2010-02-28 10:02:08 ----D---- C:\Dokumente und Einstellungen\C\Anwendungsdaten\Skype
2010-02-28 09:49:59 ----D---- C:\WINDOWS\Temp
2010-02-28 09:49:02 ----D---- C:\Dokumente und Einstellungen\C\Anwendungsdaten\skypePM
2010-02-28 09:49:00 ----D---- C:\Dokumente und Einstellungen\C\Anwendungsdaten\BOM
2010-02-28 08:58:08 ----D---- C:\WINDOWS\system32
2010-02-28 08:58:08 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2010-02-28 08:54:14 ----D---- C:\WINDOWS\system32\CatRoot2
2010-02-28 00:45:42 ----A---- C:\WINDOWS\SchedLgU.Txt
2010-02-25 09:13:03 ----AD---- C:\WINDOWS
2010-02-24 23:31:10 ----HD---- C:\WINDOWS\inf
2010-02-24 23:31:09 ----RSHDC---- C:\WINDOWS\system32\dllcache
2010-02-24 23:30:54 ----HD---- C:\WINDOWS\$hf_mig$
2010-02-21 00:17:31 ----RD---- C:\Programme
2010-02-20 16:58:49 ----D---- C:\Dokumente und Einstellungen\C\Anwendungsdaten\vlc
2010-02-19 18:23:35 ----A---- C:\WINDOWS\system.ini
2010-02-19 18:22:52 ----D---- C:\WINDOWS\AppPatch
2010-02-19 18:22:49 ----D---- C:\Programme\Gemeinsame Dateien
2010-02-19 18:05:24 ----D---- C:\WINDOWS\system32\config
2010-02-19 18:03:30 ----RASH---- C:\boot.ini
2010-02-17 20:18:52 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2010-02-16 19:05:56 ----SHD---- C:\WINDOWS\Installer
2010-02-16 19:05:55 ----SD---- C:\WINDOWS\Tasks
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\en-us
2010-02-16 19:05:55 ----D---- C:\WINDOWS\system32\de-de
2010-02-16 18:01:30 ----SD---- C:\WINDOWS\Downloaded Program Files
2010-02-16 17:41:58 ----D---- C:\Dokumente und Einstellungen\C\Anwendungsdaten\dvdcss
2010-02-16 16:15:59 ----D---- C:\WINDOWS\Debug
2010-02-16 10:03:29 ----D---- C:\Programme\Bonjour
2010-02-16 01:15:13 ----D---- C:\Programme\Internet Explorer
2010-02-15 14:56:51 ----D---- C:\Dokumente und Einstellungen
2010-02-14 22:50:01 ----D---- C:\WINDOWS\Help
2010-02-14 22:42:17 ----D---- C:\WINDOWS\Media
2010-02-14 21:36:38 ----D---- C:\Programme\Biet-O-Matic
2010-02-14 20:29:01 ----D---- C:\WINDOWS\system32\wbem
2010-02-14 20:27:30 ----D---- C:\WINDOWS\Registration
2010-02-09 12:44:26 ----A---- C:\WINDOWS\NeroDigital.ini
2010-02-01 19:26:20 ----A---- C:\WINDOWS\system32\MRT.exe

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-04-27 96104]
R1 ElbyCDIO;ElbyCDIO Driver; C:\WINDOWS\System32\Drivers\ElbyCDIO.sys [2009-01-29 23976]
R1 hwinterface;hwinterface; C:\WINDOWS\System32\Drivers\hwinterface.sys [2010-01-10 2996]
R1 mbmiodrvr;mbmiodrvr; \??\C:\WINDOWS\system32\mbmiodrvr.sys []
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-06-17 28520]
R1 WmiAcpi;Microsoft Windows-Verwaltungsschnittstelle für ACPI; C:\WINDOWS\system32\DRIVERS\wmiacpi.sys [2008-04-13 8832]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-12-08 56816]
R3 AnyDVD;AnyDVD; C:\WINDOWS\System32\Drivers\AnyDVD.sys [2009-01-29 103488]
R3 AR5211;TP-LINK Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2005-12-21 470048]
R3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2008-03-19 2871296]
R3 BthEnum;Bluetooth-Anforderungsblocktreiber; C:\WINDOWS\system32\DRIVERS\BthEnum.sys [2008-04-13 17024]
R3 BTHMODEM;Bluetooth-Modemkommunikationstreiber; C:\WINDOWS\system32\DRIVERS\bthmodem.sys [2008-04-13 37888]
R3 BthPan;Bluetooth-Gerät (PAN); C:\WINDOWS\system32\DRIVERS\bthpan.sys [2008-04-13 101120]
R3 BTHUSB;USB-Treiber für Bluetooth-Funkgerät; C:\WINDOWS\System32\Drivers\BTHUSB.sys [2008-04-13 18944]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2008-10-02 4878336]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]
R3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
R3 RFCOMM;Bluetooth-Gerät (RFCOMM-Protokoll-TDI); C:\WINDOWS\system32\DRIVERS\rfcomm.sys [2008-04-13 59136]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2008-01-04 105856]
R3 seehcri;Sony Ericsson seehcri Device Driver; C:\WINDOWS\system32\DRIVERS\seehcri.sys [2008-01-09 27632]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-14 59520]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
S1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
S3 BTHPORT;Bluetooth-Porttreiber; C:\WINDOWS\System32\Drivers\BTHport.sys [2008-06-14 273024]
S3 catchme;catchme; \??\C:\CoFi\catchme.sys []
S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
S3 HidBth;Microsoft Bluetooth-HID-Miniport; C:\WINDOWS\system32\DRIVERS\hidbth.sys [2008-04-14 25856]
S3 RTHDMIAzAudService;Service for HDMI; C:\WINDOWS\system32\drivers\RtHDMI.sys [2007-05-14 3526464]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-06-17 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-08-12 185089]
R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2008-03-19 536576]
R2 Bonjour Service;Bonjour-Dienst; C:\Programme\Bonjour\mDNSResponder.exe [2008-12-12 238888]
R2 BthServ;Bluetooth Support Service; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2008-11-11 152984]
R2 OMSI download service;Sony Ericsson OMSI download service; d:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SupServ.exe [2009-04-30 90112]
S3 aspnet_state;ASP.NET-Zustandsdienst; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 Autodesk Licensing Service;Autodesk Licensing Service; C:\Programme\Gemeinsame Dateien\Autodesk Shared\Service\AdskScSrv.exe [2008-11-24 85096]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 getPlus(R) Helper;getPlus(R) Helper; C:\Programme\NOS\bin\getPlus_HelperSvc.exe [2008-08-29 33752]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp-Portfreigabedienst; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

Zitat:

info.txt logfile of random's system information tool 1.06 2010-02-16 20:04:04

======Uninstall list======

-->d:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Reader 9 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A90000000001}
Anti-Twin (Installation 17.12.2008)-->d:\Programme\AntiTwin\uninstall.exe /uninst "UninstallKey=Anti-Twin 2008-12-17 19.26.09"
AnyDVD-->"d:\Programme\SlySoft\AnyDVD\AnyDVD-uninst.exe" /D="d:\Programme\SlySoft\AnyDVD"
Apple Application Support-->MsiExec.exe /I{3FA365DF-2D68-45ED-8F83-8C8A33E65143}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean
AutoCAD 2009 - Deutsch-->C:\Programme\AutoCAD 2009\Setup\Setup.exe /P {5783F2D7-7001-0407-0002-0060B0CE6BBA} /M ACAD
Autodesk Design Review 2009-->C:\Programme\Autodesk\Autodesk Design Review\Setup\Setup.exe /P {450063AA-643B-417C-8CF5-405BA3F4EF40} /M ADR
Avanquest update-->"C:\Programme\InstallShield Installation Information\{76E41F43-59D2-4F30-BA42-9A762EE1E8DE}\Setup.exe" -runfromtemp -l0x0007 -removeonly
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
Biet-O-Matic v2.10.1-->C:\PROGRA~1\BIET-O~1\UNWISE.EXE C:\PROGRA~1\BIET-O~1\install.log
Bonjour-->MsiExec.exe /I{07287123-B8AC-41CE-8346-3D777245C35B}
CCleaner-->"C:\Programme\CCleaner\uninst.exe"
ClearProg 1.6.0 Final-->C:\Programme\ClearProg\Uninstall.exe
Compatibility Pack für 2007 Office System-->MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE}
DivX Codec-->d:\Programme\DivX\DivXCodecUninstall.exe /CODEC
DivX Converter-->d:\Programme\DivX\DivXConverterUninstall.exe /CONVERTER
DivX Player-->d:\Programme\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Plus DirectShow Filters-->d:\Programme\DivX\DivXDSFiltersUninstall.exe /DSFILTERS
DivX Plus Web Player-->d:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
ElsterFormular 2008/2009-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{04830D0F-F980-4EC0-89F1-594F2FD2A1B5}\setup.exe" -l0x7 -removeonly
EVEREST Home Edition v2.20-->"d:\Programme\Lavalys\EVEREST Home Edition\unins000.exe"
FileZilla (remove only)-->"d:\Programme\FileZilla\uninstall.exe"
FLV Player-->"C:\WINDOWS\FLV Player\uninstall.exe" "/U:d:\Programme\FLV Player\Uninstall\uninstall.xml"
Free YouTube to Mp3 Converter version 3.1-->"d:\Programme\DVDVideoSoft\Free YouTube to Mp3 Converter\unins000.exe"
GetDataBack Data Recovery-->"C:\Programme\Runtime Software\GetDataBack for FAT and NTFS\Uninstall.exe" "C:\Programme\Runtime Software\GetDataBack for FAT and NTFS\install.log" -u
getPlus(R) for Adobe-->"C:\Programme\NOS\bin\getPlus_HelperSvc.exe" /UninstallGet1
GPL Ghostscript 8.63-->d:\Programme\gs\uninstgs.exe "d:\Programme\gs\gs8.63\uninstal.txt"
GTAIII-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{92B94569-6683-4617-8C54-EB27A1B51B30}\Setup.exe" -l0x7
HD Tune 2.55-->"d:\Programme\HD Tune\unins000.exe"
HijackThis 2.0.2-->"C:\Programme\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB970653-v3)-->"C:\WINDOWS\$NtUninstallKB970653-v3$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB976098-v2)-->"C:\WINDOWS\$NtUninstallKB976098-v2$\spuninst\spuninst.exe"
IrfanView (remove only)-->d:\Programme\IrfanView\iv_uninstall.exe
Java(TM) 6 Update 10-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216010FF}
Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
MDI2PDF 2.5-->"d:\Programme\MDIConvertor\unins000.exe"
Microsoft .NET Framework 2.0 Language Pack - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0 Language Pack - DEU\install.exe
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 German Language Pack-->C:\WINDOWS\Microsoft.NET\Framework\v3.0\Microsoft .NET Framework 3.0 German Language Pack\setup.exe
Microsoft .NET Framework 3.0 German Language Pack-->MsiExec.exe /X{F2A7F421-1679-48D5-B918-96999014ED53}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Office XP Professional mit FrontPage-->MsiExec.exe /I{90280407-6000-11D3-8CFE-0050048383C9}
Microsoft Silverlight-->MsiExec.exe /X{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148-->MsiExec.exe /X{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Motherboard Monitor 5-->"d:\Programme\Motherboard Monitor 5\unins000.exe"
Mozilla Firefox (3.5.7)-->D:\Programme\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.23)-->D:\Programme\Mozilla Thunderbird\uninstall\helper.exe
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 (KB973688)-->MsiExec.exe /I{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}
MSXML 6.0 Parser (KB925673)-->MsiExec.exe /I{FE9126DB-5F84-495A-BB46-3C724F1C2D08}
Nero 8 Lite 8.3.6.0-->"d:\Programme\Nero\unins000.exe"
neroxml-->MsiExec.exe /I{56C049BE-79E9-4502-BEA7-9754A3E60F9B}
OGA Notifier 2.0.0048.0-->MsiExec.exe /I{B2544A03-10D0-4E5E-BA69-0362FFC20D18}
PDF Blender-->d:\Programme\PDF Blender\uninstall.exe
pdf24-->"d:\Programme\pdf24\unins000.exe"
QCad-->C:\WINDOWS\iun3405.exe d:\Programme\QCad
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek High Definition Audio Driver-->RtlUpd.exe -r -m -nrg2709
Safari-->MsiExec.exe /I{D6E4E5D6-7693-4BB4-95BA-21F38FAFEE90}
Security Task Manager 1.7h-->C:\Programme\Security Task Manager\Uninstal.exe "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Security Task Manager"
Sicherheitsupdate für Windows Internet Explorer 8 (KB971961)-->"C:\WINDOWS\ie8updates\KB971961-IE8\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 8 (KB978207)-->"C:\WINDOWS\ie8updates\KB978207-IE8\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB954155)-->"C:\WINDOWS\$NtUninstallKB954155_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB968816)-->"C:\WINDOWS\$NtUninstallKB968816_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB973540)-->"C:\WINDOWS\$NtUninstallKB973540_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB953838)-->"C:\WINDOWS\$NtUninstallKB953838$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB953839)-->"C:\WINDOWS\$NtUninstallKB953839$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956390)-->"C:\WINDOWS\$NtUninstallKB956390$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956744)-->"C:\WINDOWS\$NtUninstallKB956744$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956844)-->"C:\WINDOWS\$NtUninstallKB956844$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958869)-->"C:\WINDOWS\$NtUninstallKB958869$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960859)-->"C:\WINDOWS\$NtUninstallKB960859$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969059)-->"C:\WINDOWS\$NtUninstallKB969059$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969897)-->"C:\WINDOWS\$NtUninstallKB969897$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969947)-->"C:\WINDOWS\$NtUninstallKB969947$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB970430)-->"C:\WINDOWS\$NtUninstallKB970430$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971468)-->"C:\WINDOWS\$NtUninstallKB971468$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971486)-->"C:\WINDOWS\$NtUninstallKB971486$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971557)-->"C:\WINDOWS\$NtUninstallKB971557$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971657)-->"C:\WINDOWS\$NtUninstallKB971657$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971961)-->"C:\WINDOWS\$NtUninstallKB971961$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB972260)-->"C:\WINDOWS\$NtUninstallKB972260$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB972270)-->"C:\WINDOWS\$NtUninstallKB972270$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973354)-->"C:\WINDOWS\$NtUninstallKB973354$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973507)-->"C:\WINDOWS\$NtUninstallKB973507$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973525)-->"C:\WINDOWS\$NtUninstallKB973525$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973869)-->"C:\WINDOWS\$NtUninstallKB973869$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973904)-->"C:\WINDOWS\$NtUninstallKB973904$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974112)-->"C:\WINDOWS\$NtUninstallKB974112$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974318)-->"C:\WINDOWS\$NtUninstallKB974318$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974392)-->"C:\WINDOWS\$NtUninstallKB974392$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974455)-->"C:\WINDOWS\$NtUninstallKB974455$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB974571)-->"C:\WINDOWS\$NtUninstallKB974571$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975025)-->"C:\WINDOWS\$NtUninstallKB975025$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975467)-->"C:\WINDOWS\$NtUninstallKB975467$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975560)-->"C:\WINDOWS\$NtUninstallKB975560$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB975713)-->"C:\WINDOWS\$NtUninstallKB975713$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB976325)-->"C:\WINDOWS\$NtUninstallKB976325$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB977165)-->"C:\WINDOWS\$NtUninstallKB977165$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB977914)-->"C:\WINDOWS\$NtUninstallKB977914$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978037)-->"C:\WINDOWS\$NtUninstallKB978037$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978251)-->"C:\WINDOWS\$NtUninstallKB978251$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978262)-->"C:\WINDOWS\$NtUninstallKB978262$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB978706)-->"C:\WINDOWS\$NtUninstallKB978706$\spuninst\spuninst.exe"
Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}
Sony Ericsson PC Suite 6.009.00-->"C:\Programme\InstallShield Installation Information\{2FFE93F0-BB72-4E52-8761-354D1AAA9387}\ISAdmin.exe" -runfromtemp -l0x0007 -removeonly
Spybot - Search & Destroy-->"C:\Programme\Spybot - Search & Destroy\unins000.exe"
Sweet Home 3D version 2.0-->"d:\Programme\Sweet Home 3D\unins000.exe"
The Panorama Factory V5 m32 Edition-->MsiExec.exe /I{4C2FDB46-6A32-479D-9374-6CA797ED3FD3}
Turbo Lister 2-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{69640730-B830-4C24-BB5C-222DA1260548}
TVUPlayer 2.5.0.1-->C:\Programme\TVUPlayer\uninst.exe
Uninstall 1.0.0.1-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe"
Update for Microsoft .NET Framework 3.5 SP1 (KB963707)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {B2AE9C82-DC7B-3641-BFC8-87275C4F3607} /qb+ REBOOTPROMPT=""
Update für Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update für Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update für Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update für Windows XP (KB955759)-->"C:\WINDOWS\$NtUninstallKB955759$\spuninst\spuninst.exe"
Update für Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update für Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Update für Windows XP (KB968389)-->"C:\WINDOWS\$NtUninstallKB968389$\spuninst\spuninst.exe"
Update für Windows XP (KB971737)-->"C:\WINDOWS\$NtUninstallKB971737$\spuninst\spuninst.exe"
Update für Windows XP (KB973687)-->"C:\WINDOWS\$NtUninstallKB973687$\spuninst\spuninst.exe"
Update für Windows XP (KB973815)-->"C:\WINDOWS\$NtUninstallKB973815$\spuninst\spuninst.exe"
Update für Windows XP (KB976749)-->"C:\WINDOWS\$NtUninstallKB976749$\spuninst\spuninst.exe"
Update für Windows XP (KB978207)-->"C:\WINDOWS\$NtUninstallKB978207$\spuninst\spuninst.exe"
VC80CRTRedist - 8.0.50727.4053-->MsiExec.exe /I{5EE7D259-D137-4438-9A5F-42F432EC0421}
VLC media player 1.0.0-->d:\Programme\VideoLAN\VLC\uninstall.exe
Windows Internet Explorer 8-->"C:\WINDOWS\ie8\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Presentation Foundation Language Pack (DEU)-->MsiExec.exe /X{92DF2F1B-F63C-4D9A-B3E1-B2D11AE29790}
Windows Presentation Foundation-->MsiExec.exe /X{BAF78226-3200-4DB4-BE33-4D922A799840}
Windows Workflow Foundation DE Language Pack-->MsiExec.exe /I{7228FD8C-3B9E-4204-AE36-8A466107685B}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
WinRAR-->d:\Programme\WinRAR\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
Zattoo 3.3.4 Beta-->C:\Programme\Zattoo\uninst.exe

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: CH
Event Code: 7036
Message: Dienst "SSDP-Suchdienst" befindet sich jetzt im Status "Ausgeführt".

Record Number: 13740
Source Name: Service Control Manager
Time Written: 20091227084248.000000+000
Event Type: Informationen
User:

Computer Name: CH
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "SSDP-Suchdienst" gesendet.

Record Number: 13739
Source Name: Service Control Manager
Time Written: 20091227084248.000000+000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: CH
Event Code: 7036
Message: Dienst "Kompatibilität für schnelle Benutzerumschaltung" befindet sich jetzt im Status "Ausgeführt".

Record Number: 13738
Source Name: Service Control Manager
Time Written: 20091227084245.000000+000
Event Type: Informationen
User:

Computer Name: CH
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "Kompatibilität für schnelle Benutzerumschaltung" gesendet.

Record Number: 13737
Source Name: Service Control Manager
Time Written: 20091227084245.000000+000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: CH
Event Code: 7036
Message: Dienst "Terminaldienste" befindet sich jetzt im Status "Ausgeführt".

Record Number: 13736
Source Name: Service Control Manager
Time Written: 20091227084240.000000+000
Event Type: Informationen
User:

=====Application event log=====

Computer Name: CH
Event Code: 1002
Message: Starting interactive setup.

Record Number: 3846
Source Name: WgaSetup
Time Written: 20091010063817.000000+000
Event Type: Informationen
User:

Computer Name: CH
Event Code: 1006
Message: Der Endbenutzer-Lizenzvertrag wurde zuvor akzeptiert.

Record Number: 3845
Source Name: WgaSetup
Time Written: 20091010063817.000000+000
Event Type: Informationen
User:

Computer Name: CH
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!

Record Number: 3844
Source Name: Avira AntiVir
Time Written: 20091009205558.000000+000
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: CH
Event Code: 1800
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 3843
Source Name: SecurityCenter
Time Written: 20091009205557.000000+000
Event Type: Informationen
User:

Computer Name: CH
Event Code: 1007
Message: Der Endbenutzer-Lizenzvertrag wurde zuvor abgelehnt.

Record Number: 3842
Source Name: WgaSetup
Time Written: 20091009205542.000000+000
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;D:\Programme\QuickTime\QTSystem\;C:\Programme\Gemeinsame Dateien\DivX Shared\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 107 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=6b02
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Programme\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------

Danke

Christian