Trojaner-Board - DR/Autoit.TC.9 in C:\windows\csrcs.exe

Hallo.

Habe aus unschönem Anlass den Weg zu euch gefunden.

Am Montag habe ich eine Nachricht von meinem Antiviren-Programm bekommen, dass ich einen Virus namens DR/Autoit.TC.9 auf meinem Rechner habe bekommen. Danach habe ich im Internet versucht mehr darüber rauszubekommen. Das einzige was ich herausbekommen habe ist, dass er sich auf USB-Sticks installiert und von dort beim Anschluß immer wieder auch auf Rechnern installiert. Auf dem USB-Stick befindet sich die Datei kufvwr.exe und es installiert sich die Datei C://Windows/system32/csrcs.exe
Ich habe mir dann CCleaner, MalewareBytes’ Anti-Malware und RSIT heruntergeladen. Antimalreware hat auch einiges gefunden und angeblich auch gelöscht. Ich habe meinen USB-Stick den ich benutze auch komplett formatiert.
Heute habe ich dann erneut gesehen, dass sich die Dateien wieder auf meinem Rechner und USB-Stick befinden.

Hier sind die Logs zu den Programmen:

Malwarebytes' Anti-Malware:

Code:

Malwarebytes' Anti-Malware 1.43

Datenbank Version: 3490

Windows 5.1.2600 Service Pack 3

Internet Explorer 6.0.2900.5512
 

08.01.2010 12:26:17

mbam-log-2010-01-08 (12-26-17).txt
 

Scan-Methode: Vollständiger Scan (C:\|D:\|F:\|)

Durchsuchte Objekte: 282562

Laufzeit: 1 hour(s), 48 minute(s), 41 second(s)
 

Infizierte Speicherprozesse: 0

Infizierte Speichermodule: 0

Infizierte Registrierungsschlüssel: 1

Infizierte Registrierungswerte: 1

Infizierte Dateiobjekte der Registrierung: 1

Infizierte Verzeichnisse: 0

Infizierte Dateien: 1
 

Infizierte Speicherprozesse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule:

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\DRM\amty (Worm.Autorun) -> Quarantined and deleted successfully.
 

Infizierte Registrierungswerte:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\Explorer\Run\csrcs (Trojan.Agent) -> Quarantined and deleted successfully.
 

Infizierte Dateiobjekte der Registrierung:

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Shell (Hijack.Shell) -> Bad: (Explorer.exe csrcs.exe) Good: (Explorer.exe) -> Quarantined and deleted successfully.
 

Infizierte Verzeichnisse:

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien:

C:\WINDOWS\system32\csrcs.exe (Trojan.Agent) -> Quarantined and deleted successfully.

und HijackThis:

Code:

Logfile of random's system information tool 1.06 (written by random/random)

Run by User at 2010-01-08 12:54:27

Microsoft Windows XP Professional Service Pack 3

System drive C: has 92 GB (79%) free of 117 GB

Total RAM: 766 MB (45% free)
 

Logfile of Trend Micro HijackThis v2.0.2

Scan saved at 12:54:29, on 08.01.2010

Platform: Windows XP SP3 (WinNT 5.01.2600)

MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)

Boot mode: Normal
 

Running processes:

C:\WINDOWS\System32\smss.exe

C:\WINDOWS\system32\winlogon.exe

C:\WINDOWS\system32\services.exe

C:\WINDOWS\system32\lsass.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\svchost.exe

C:\WINDOWS\System32\svchost.exe

C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

C:\WINDOWS\system32\Ati2evxx.exe

C:\WINDOWS\system32\spoolsv.exe

C:\Programme\Java\jre6\bin\jqs.exe

C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE

C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe

C:\Programme\samsung\Samsung Network Manager\SNMWLANService.exe

C:\WINDOWS\Explorer.EXE

C:\Programme\Sophos\AutoUpdate\ALsvc.exe

C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe

C:\Programme\Java\jre6\bin\jusched.exe

C:\WINDOWS\AGRSMMSG.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\MOM.EXE

C:\Programme\Synaptics\SynTP\SynTPEnh.exe

C:\Programme\CyberLink\PowerDVD\PDVDServ.exe

C:\Programme\Samsung\AVStation Premium 3.75\AVSAgent.exe

C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe

C:\Programme\Samsung\Easy Display Manager\dmhkcore.exe

C:\Programme\SAMSUNG\MagicKBD\MagicKBD.exe

C:\Programme\SAMSUNG\MagicKBD\PerformanceManager.exe

C:\WINDOWS\RTHDCPL.EXE

C:\Programme\Samsung\Samsung EDS\EDSAgent.exe

C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe

C:\WINDOWS\system32\wbem\wmiapsrv.exe

C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe

C:\WINDOWS\system32\ctfmon.exe

C:\Programme\Rainlendar2\Rainlendar2.exe

C:\Programme\Sophos\AutoUpdate\ALMon.exe

C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe

C:\Programme\ATI Technologies\ATI.ACE\Core-Static\ccc.exe

C:\Programme\Samsung\Samsung Update Plus\SLUTrayNotifier.exe

C:\Dokumente und Einstellungen\User\Desktop\RSIT.exe

C:\Programme\trend micro\User.exe
 

R3 - URLSearchHook: Softonic Deutsch Toolbar - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof1.dll

O2 - BHO: Adobe PDF Reader Link Helper - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll

O2 - BHO: Sophos Web Content Scanner - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll

O2 - BHO: Asz.Citavi.IEPicker.IEPickerButton - {609D670F-B735-4da7-AC6D-F3BD358E325E} - C:\WINDOWS\system32\mscoree.dll

O2 - BHO: Softonic Deutsch Toolbar - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof1.dll

O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll

O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll

O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll

O3 - Toolbar: SciFinder Scholar Bar - {4e16a8fb-0521-46d1-aa2c-d0fc7abf6af9} - mscoree.dll (file missing)

O3 - Toolbar: Softonic Deutsch Toolbar - {8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - C:\Programme\Softonic_Deutsch\tbSof1.dll

O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"

O4 - HKLM\..\Run: [StartCCC] C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe

O4 - HKLM\..\Run: [AGRSMMSG] AGRSMMSG.exe

O4 - HKLM\..\Run: [SynTPEnh] C:\Programme\Synaptics\SynTP\SynTPEnh.exe

O4 - HKLM\..\Run: [RemoteControl] C:\Programme\CyberLink\PowerDVD\PDVDServ.exe

O4 - HKLM\..\Run: [DMHotKey] C:\Programme\Samsung\Easy Display Manager\DMLoader.exe

O4 - HKLM\..\Run: [AVStation Premium 3.75 DriveMapper] C:\Programme\Samsung\AVStation Premium 3.75\DriveMapper.exe

O4 - HKLM\..\Run: [AVStation Premium 3.75] "C:\Programme\Samsung\AVStation Premium 3.75\AVSAgent.exe" /start

O4 - HKLM\..\Run: [BatteryManager] C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe

O4 - HKLM\..\Run: [MagicKeyboard] C:\Programme\SAMSUNG\MagicKBD\PreMKBD.exe

O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE

O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE

O4 - HKLM\..\Run: [EDS] C:\Programme\Samsung\Samsung EDS\EDSAgent.exe

O4 - HKLM\..\Run: [Acrobat Assistant 7.0] "C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe"

O4 - HKLM\..\Run: [Samsung PanelMgr] C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe /autorun

O4 - HKLM\..\RunServices: [csrcs] C:\WINDOWS\system32\csrcs.exe

O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe

O4 - HKCU\..\Run: [Rainlendar2] C:\Programme\Rainlendar2\Rainlendar2.exe

O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')

O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')

O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')

O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')

O4 - Global Startup: AutoUpdate Monitor.lnk = C:\Programme\Sophos\AutoUpdate\ALMon.exe

O4 - Global Startup: BTTray.lnk = ?

O8 - Extra context menu item: &Citavi Picker... - file://C:\Programme\Internet Explorer\PLUGINS\Citavi Picker\ShowContextMenu.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECaptureSelLinks.html

O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppendSelLinks.html

O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: In vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\OFFICE11\EXCEL.EXE/3000

O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~2\Office12\EXCEL.EXE/3000

O8 - Extra context menu item: Senden an &Bluetooth-Gerät... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm

O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIECapture.html

O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - res://C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll/AcroIEAppend.html

O9 - Extra button: Citavi Picker - {619D670F-B735-4da7-AC6D-F3BD358E325E} - C:\WINDOWS\system32\mscoree.dll

O9 - Extra button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - C:\PROGRA~1\MICROS~2\OFFICE11\REFIEBAR.DLL

O9 - Extra button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra 'Tools' menuitem: @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm

O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe

O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe

O10 - Unknown file in Winsock LSP: c:\windows\system32\nwprovau.dll

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: Domain = biochem.nat.tu-bs.de

O17 - HKLM\Software\..\Telephony: DomainName = biochem.nat.tu-bs.de

O17 - HKLM\System\CCS\Services\Tcpip\..\{08CE06F7-F807-4FA1-895F-449E750420AE}: NameServer = 134.169.9.151,134.169.9.152

O17 - HKLM\System\CS1\Services\Tcpip\Parameters: Domain = biochem.nat.tu-bs.de

O17 - HKLM\System\CS1\Services\Tcpip\..\{08CE06F7-F807-4FA1-895F-449E750420AE}: NameServer = 134.169.9.151,134.169.9.152

O17 - HKLM\System\CS2\Services\Tcpip\Parameters: Domain = biochem.nat.tu-bs.de

O17 - HKLM\System\CS2\Services\Tcpip\..\{08CE06F7-F807-4FA1-895F-449E750420AE}: NameServer = 134.169.9.151,134.169.9.152

O18 - Protocol: ncbi8 - {2B576DD3-0B3E-4718-BCBF-B15E4FB8009D} - C:\Programme\Informax\Vector NTI Suite 9\Ncbi.dll

O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL

O20 - AppInit_DLLs: C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL

O23 - Service: Ati HotKey Poller - ATI Technologies Inc. - C:\WINDOWS\system32\Ati2evxx.exe

O23 - Service: Bluetooth Service (btwdins) - Broadcom Corporation. - C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe

O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe

O23 - Service: LightScribeService Direct Disc Labeling Service (LightScribeService) - Hewlett-Packard Company - C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe

O23 - Service: Samsung Update Plus - Unknown owner - C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe

O23 - Service: Sophos Anti-Virus Statusreporter (SAVAdminService) - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe

O23 - Service: Sophos Anti-Virus (SAVService) - Sophos Plc - C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe

O23 - Service: SNM WLAN Service - Unknown owner - C:\Programme\samsung\Samsung Network Manager\SNMWLANService.exe

O23 - Service: Sophos AutoUpdate Service - Sophos Plc - C:\Programme\Sophos\AutoUpdate\ALsvc.exe
 

--

End of file - 10304 bytes
 

======Scheduled tasks folder======
 

C:\WINDOWS\tasks\Dienstags um 4 Uhr.job

C:\WINDOWS\tasks\WGASetup.job
 

======Registry dump======
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{06849E9F-C8D7-4D59-B87D-784B7D6BE0B3}]

Adobe PDF Reader Link Helper - C:\Programme\Adobe\Acrobat 7.0\ActiveX\AcroIEHelper.dll [2006-12-18 59032]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{39EA7695-B3F2-4C44-A4BC-297ADA8FD235}]

Sophos Web Content Scanner - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll [2010-01-04 240680]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{609D670F-B735-4da7-AC6D-F3BD358E325E}]

Asz.Citavi.IEPicker.IEPickerButton - C:\WINDOWS\system32\mscoree.dll [2008-07-25 282112]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{8dbb6d8e-e4a6-4e3b-9753-af78b226441c}]

Softonic Deutsch Toolbar - C:\Programme\Softonic_Deutsch\tbSof1.dll [2009-04-30 1883672]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]

Adobe PDF Conversion Toolbar Helper - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]

Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2010-01-07 41760]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]

JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2010-01-07 73728]
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]

{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programme\Adobe\Acrobat 7.0\Acrobat\AcroIEFavClient.dll [2006-12-18 231160]

{4e16a8fb-0521-46d1-aa2c-d0fc7abf6af9} - SciFinder Scholar Bar - C:\WINDOWS\system32\mscoree.dll [2008-07-25 282112]

{8dbb6d8e-e4a6-4e3b-9753-af78b226441c} - Softonic Deutsch Toolbar - C:\Programme\Softonic_Deutsch\tbSof1.dll [2009-04-30 1883672]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]

"SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2010-01-07 149280]

"StartCCC"=C:\Programme\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [2006-11-10 90112]

"AGRSMMSG"=C:\WINDOWS\AGRSMMSG.exe [2006-08-31 89542]

"SynTPEnh"=C:\Programme\Synaptics\SynTP\SynTPEnh.exe [2005-12-07 761947]

"RemoteControl"=C:\Programme\CyberLink\PowerDVD\PDVDServ.exe [2006-08-16 45056]

"DMHotKey"=C:\Programme\Samsung\Easy Display Manager\DMLoader.exe [2006-12-27 466944]

"AVStation Premium 3.75 DriveMapper"=C:\Programme\Samsung\AVStation Premium 3.75\DriveMapper.exe [2007-02-08 36864]

"AVStation Premium 3.75"=C:\Programme\Samsung\AVStation Premium 3.75\AVSAgent.exe [2007-07-18 163840]

"BatteryManager"=C:\Programme\Samsung\Samsung Battery Manager\BatteryManager.exe [2007-09-03 2764800]

"MagicKeyboard"=C:\Programme\SAMSUNG\MagicKBD\PreMKBD.exe [2006-05-14 151552]

"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2007-07-05 16380416]

"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]

""= []

"EDS"=C:\Programme\Samsung\Samsung EDS\EDSAgent.exe [2007-01-11 634880]

"Acrobat Assistant 7.0"=C:\Programme\Adobe\Acrobat 7.0\Distillr\Acrotray.exe [2008-04-23 483328]

"Samsung PanelMgr"=C:\WINDOWS\Samsung\PanelMgr\SSMMgr.exe [2008-08-18 536576]
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]

"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

"Rainlendar2"=C:\Programme\Rainlendar2\Rainlendar2.exe [2009-02-21 4333568]
 

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart

AutoUpdate Monitor.lnk - C:\Programme\Sophos\AutoUpdate\ALMon.exe

BTTray.lnk - C:\Programme\WIDCOMM\Bluetooth Software\BTTray.exe
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]

"AppInit_DLLS"="C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL"
 

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Notify\AtiExtEvent]

C:\WINDOWS\system32\Ati2evxx.dll [2007-08-27 118784]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\SAVService]
 

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\SAVService]
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]

"dontdisplaylastusername"=0

"legalnoticecaption"=

"legalnoticetext"=

"shutdownwithoutlogon"=1

"undockwithoutlogon"=1
 

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"NoDriveTypeAutoRun"=145
 

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]

"HonorAutoRunSetting"=
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Programme\Internet Explorer\IEXPLORE.EXE"="C:\Programme\Internet Explorer\IEXPLORE.EXE:*:Enabled:Internet Explorer"

"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"

"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

"C:\Programme\Miranda IM\miranda32.exe"="C:\Programme\Miranda IM\miranda32.exe:*:Enabled:Miranda IM"

"C:\Programme\Messenger\msmsgs.exe"="C:\Programme\Messenger\msmsgs.exe:*:Enabled:Windows Messenger"

"C:\Programme\SmartFTP Client\SmartFTP.exe"="C:\Programme\SmartFTP Client\SmartFTP.exe:*:Enabled:SmartFTP Client 3.0"

"C:\Programme\Mozilla Firefox\firefox.exe"="C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox"

"C:\Programme\Informax\Vector NTI Suite 9\Vector NTI 9.exe"="C:\Programme\Informax\Vector NTI Suite 9\Vector NTI 9.exe:*:Enabled:Vector NTI 9.0.0"

"C:\Programme\CambridgeSoft\ChemOffice2008\ChemDraw\ChemDraw.exe"="C:\Programme\CambridgeSoft\ChemOffice2008\ChemDraw\ChemDraw.exe:*:Disabled:BioDraw Ultra 11.0.1"

"C:\Programme\CambridgeSoft\ChemOffice\ChemDraw\ChemDraw.exe"="C:\Programme\CambridgeSoft\ChemOffice\ChemDraw\ChemDraw.exe:*:Enabled:ChemBioDraw Ultra 11.0.1"

"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
 

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]

"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"

"C:\Programme\Windows Live\Messenger\msnmsgr.exe"="C:\Programme\Windows Live\Messenger\msnmsgr.exe:*:Enabled:Windows Live Messenger"

"C:\Programme\Windows Live\Messenger\livecall.exe"="C:\Programme\Windows Live\Messenger\livecall.exe:*:Enabled:Windows Live Messenger (Phone)"

"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\F]

shell\AutoRun\command - F:\LaunchU3.exe -a
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{666464ec-8d58-11de-8440-00137760193a}]

shell\AutoRun\command - WDSetup.exe
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{d55684b6-c98c-11dc-ad9d-00137760193a}]

shell\AutoRun\command - F:\LaunchU3.exe -a
 

[HKEY_CURRENT_USER\software\microsoft\windows\currentversion\explorer\mountpoints2\{f6f46dbd-5669-11de-840a-00137760193a}]

shell\AutoRun\command - F:\LaunchU3.exe -a
 
 

======List of files/folders created in the last 1 months======
 

2010-01-08 12:34:51 ----D---- C:\WINDOWS\SQLTools9_KB970892_ENU

2010-01-08 12:32:59 ----D---- C:\WINDOWS\SQL9_KB970892_ENU

2010-01-08 09:46:10 ----D---- C:\WINDOWS\pss

2010-01-07 17:40:21 ----HDC---- C:\WINDOWS\$NtUninstallKB970430$

2010-01-07 17:40:11 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$

2010-01-07 17:39:21 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$

2010-01-07 17:39:04 ----HDC---- C:\WINDOWS\$NtUninstallKB956744$

2010-01-07 11:14:02 ----D---- C:\WINDOWS\Prefetch

2010-01-07 09:49:05 ----HDC---- C:\WINDOWS\$NtUninstallKB976325$

2010-01-07 09:48:58 ----HDC---- C:\WINDOWS\$NtUninstallKB975467$

2010-01-07 09:48:52 ----HDC---- C:\WINDOWS\$NtUninstallKB975025$

2010-01-07 09:48:46 ----HDC---- C:\WINDOWS\$NtUninstallKB974571$

2010-01-07 09:48:37 ----HDC---- C:\WINDOWS\$NtUninstallKB974392$

2010-01-07 09:48:31 ----HDC---- C:\WINDOWS\$NtUninstallKB974318$

2010-01-07 09:48:26 ----HDC---- C:\WINDOWS\$NtUninstallKB974112$

2010-01-07 09:48:18 ----HDC---- C:\WINDOWS\$NtUninstallKB973869$

2010-01-07 09:48:12 ----HDC---- C:\WINDOWS\$NtUninstallKB973815$

2010-01-07 09:48:04 ----HDC---- C:\WINDOWS\$NtUninstallKB973687$

2010-01-07 09:47:56 ----HDC---- C:\WINDOWS\$NtUninstallKB973507$

2010-01-07 09:47:49 ----HDC---- C:\WINDOWS\$NtUninstallKB973354$

2010-01-07 09:47:43 ----HDC---- C:\WINDOWS\$NtUninstallKB971737$

2010-01-07 09:47:37 ----HDC---- C:\WINDOWS\$NtUninstallKB971657$

2010-01-07 09:47:30 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$

2010-01-07 09:47:25 ----HDC---- C:\WINDOWS\$NtUninstallKB971557$

2010-01-07 09:47:13 ----HDC---- C:\WINDOWS\$NtUninstallKB971486$

2010-01-07 09:47:02 ----HDC---- C:\WINDOWS\$NtUninstallKB970238$

2010-01-07 09:46:56 ----HDC---- C:\WINDOWS\$NtUninstallKB969947$

2010-01-07 09:46:49 ----HDC---- C:\WINDOWS\$NtUninstallKB969059$

2010-01-07 09:46:39 ----HDC---- C:\WINDOWS\$NtUninstallKB968389$

2010-01-07 09:46:28 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$

2010-01-07 09:46:17 ----HDC---- C:\WINDOWS\$NtUninstallKB976325_1$

2010-01-07 09:46:08 ----HDC---- C:\WINDOWS\$NtUninstallKB963027$

2010-01-07 09:46:01 ----HDC---- C:\WINDOWS\$NtUninstallKB961501$

2010-01-07 09:45:53 ----HDC---- C:\WINDOWS\$NtUninstallKB961373$

2010-01-07 09:45:47 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2$

2010-01-07 09:45:40 ----HDC---- C:\WINDOWS\$NtUninstallKB960859$

2010-01-07 09:45:34 ----HDC---- C:\WINDOWS\$NtUninstallKB960803$

2010-01-07 09:45:25 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$

2010-01-07 09:45:19 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$

2010-01-07 09:45:12 ----HDC---- C:\WINDOWS\$NtUninstallKB959426$

2010-01-07 09:45:06 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$

2010-01-07 09:45:00 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$

2010-01-07 09:44:52 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$

2010-01-07 09:44:44 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$

2010-01-07 09:44:37 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$

2010-01-07 09:44:31 ----HDC---- C:\WINDOWS\$NtUninstallKB956844$

2010-01-07 09:44:25 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$

2010-01-07 09:44:16 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$

2010-01-07 09:44:10 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$

2010-01-07 09:43:54 ----HDC---- C:\WINDOWS\$NtUninstallKB956572$

2010-01-07 09:43:41 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_1$

2010-01-07 09:43:36 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$

2010-01-07 09:43:29 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_1$

2010-01-07 09:43:24 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$

2010-01-07 09:43:19 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$

2010-01-07 09:43:11 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$

2010-01-07 09:43:02 ----HDC---- C:\WINDOWS\$NtUninstallKB952004$

2010-01-07 09:42:53 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$

2010-01-07 09:42:46 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$

2010-01-07 09:42:39 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$

2010-01-07 09:42:33 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$

2010-01-07 09:42:27 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$

2010-01-07 09:42:22 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$

2010-01-07 09:42:15 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$

2010-01-07 09:42:07 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$

2010-01-07 09:42:00 ----HDC---- C:\WINDOWS\$NtUninstallKB923561$

2010-01-07 09:37:55 ----D---- C:\WINDOWS\system32\de-de

2010-01-07 09:37:53 ----D---- C:\WINDOWS\l2schemas

2010-01-07 09:37:52 ----D---- C:\WINDOWS\system32\de

2010-01-07 09:37:52 ----D---- C:\WINDOWS\system32\bits

2010-01-07 09:31:20 ----D---- C:\WINDOWS\network diagnostic

2010-01-07 09:23:10 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$

2010-01-07 09:16:41 ----HD---- C:\WINDOWS\PIF

2010-01-07 09:15:12 ----A---- C:\WINDOWS\system32\javaws.exe

2010-01-07 09:15:12 ----A---- C:\WINDOWS\system32\javaw.exe

2010-01-07 09:15:12 ----A---- C:\WINDOWS\system32\java.exe

2010-01-07 09:15:12 ----A---- C:\WINDOWS\system32\deploytk.dll

2010-01-06 16:20:37 ----A---- C:\WINDOWS\system32\MRT.exe

2010-01-06 16:16:29 ----HDC---- C:\WINDOWS\$NtUninstallKB971737_0$

2010-01-06 11:09:15 ----HDC---- C:\WINDOWS\$NtUninstallKB960859_0$

2010-01-06 11:08:32 ----HDC---- C:\WINDOWS\$NtUninstallKB958869$

2010-01-06 11:08:27 ----HDC---- C:\WINDOWS\$NtUninstallKB954155_WM9$

2010-01-06 11:07:59 ----HDC---- C:\WINDOWS\$NtUninstallKB976098-v2$

2010-01-06 11:07:53 ----HDC---- C:\WINDOWS\$NtUninstallKB974318_0$

2010-01-06 11:07:41 ----HDC---- C:\WINDOWS\$NtUninstallKB969059_0$

2010-01-06 11:04:59 ----HDC---- C:\WINDOWS\$NtUninstallKB961371-v2_0$

2010-01-06 11:04:52 ----HDC---- C:\WINDOWS\$NtUninstallKB971657_0$

2010-01-06 11:04:45 ----HDC---- C:\WINDOWS\$NtUninstallKB971557_0$

2010-01-06 11:04:38 ----HDC---- C:\WINDOWS\$NtUninstallKB974112_0$

2010-01-06 11:04:33 ----D---- C:\Programme\Microsoft CAPICOM 2.1.0.2

2010-01-06 11:04:27 ----HDC---- C:\WINDOWS\$NtUninstallKB956844_0$

2010-01-06 11:03:43 ----HDC---- C:\WINDOWS\$NtUninstallKB961501_0$

2010-01-06 11:03:37 ----HDC---- C:\WINDOWS\$NtUninstallKB968816_WM9$

2010-01-06 11:03:30 ----HDC---- C:\WINDOWS\$NtUninstallKB971633_0$

2010-01-06 11:03:24 ----HDC---- C:\WINDOWS\$NtUninstallKB973869_0$

2010-01-06 11:03:17 ----HDC---- C:\WINDOWS\$NtUninstallKB975025_0$

2010-01-06 11:03:04 ----HDC---- C:\WINDOWS\$NtUninstallKB973540_WM9L$

2010-01-06 11:02:55 ----HDC---- C:\WINDOWS\$NtUninstallKB974571_0$

2010-01-06 11:02:28 ----HDC---- C:\WINDOWS\$NtUninstallKB976325_0$

2010-01-06 11:02:13 ----HDC---- C:\WINDOWS\$NtUninstallKB973507_0$

2010-01-06 11:02:01 ----HDC---- C:\WINDOWS\$NtUninstallKB973687_0$

2010-01-06 09:37:54 ----D---- C:\WINDOWS\system32\XPSViewer

2010-01-06 09:37:46 ----D---- C:\Programme\MSBuild

2010-01-06 09:37:43 ----D---- C:\WINDOWS\system32\en-US

2010-01-06 09:37:31 ----D---- C:\Programme\Reference Assemblies

2010-01-06 09:36:26 ----N---- C:\WINDOWS\system32\prntvpt.dll

2010-01-06 09:36:25 ----N---- C:\WINDOWS\system32\xpssvcs.dll

2010-01-06 09:36:25 ----N---- C:\WINDOWS\system32\xpsshhdr.dll

2010-01-06 09:28:57 ----HDC---- C:\WINDOWS\$NtUninstallWIC$

2010-01-05 17:00:20 ----D---- C:\WINDOWS\Minidump

2010-01-05 16:58:49 ----HDC---- C:\WINDOWS\$NtUninstallKB973354_0$

2010-01-05 16:58:40 ----HDC---- C:\WINDOWS\$NtUninstallKB973904$

2010-01-05 16:58:32 ----HDC---- C:\WINDOWS\$NtUninstallKB974392_0$

2010-01-05 16:58:03 ----HDC---- C:\WINDOWS\$NtUninstallKB971961$

2010-01-05 16:57:53 ----HDC---- C:\WINDOWS\$NtUninstallKB970238_0$

2010-01-05 16:57:38 ----HDC---- C:\WINDOWS\$NtUninstallKB971486_0$

2010-01-05 16:57:22 ----D---- C:\WINDOWS\ServicePackFiles

2010-01-05 16:57:20 ----HDC---- C:\WINDOWS\$NtUninstallKB958470$

2010-01-05 16:57:07 ----HDC---- C:\WINDOWS\$NtUninstallKB973815_0$

2010-01-05 16:57:00 ----HDC---- C:\WINDOWS\$NtUninstallKB973525$

2010-01-05 16:56:43 ----HDC---- C:\WINDOWS\$NtUninstallKB971032$

2010-01-05 16:55:26 ----HDC---- C:\WINDOWS\$NtUninstallKB975467_0$

2010-01-05 16:55:13 ----HDC---- C:\WINDOWS\$NtUninstallKB968389_0$

2010-01-05 16:54:59 ----HDC---- C:\WINDOWS\$NtUninstallKB969947_0$

2010-01-04 13:57:36 ----A---- C:\WINDOWS\system32\sdccoinstaller.dll

2010-01-04 13:57:16 ----D---- C:\Programme\Gemeinsame Dateien\Cisco Systems

2010-01-04 13:57:10 ----A---- C:\WINDOWS\system32\sophosboottasks.exe

2010-01-04 13:56:59 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos

2010-01-04 13:55:50 ----D---- C:\Programme\Sophos

2010-01-04 12:38:06 ----D---- C:\Programme\trend micro

2010-01-04 12:38:05 ----D---- C:\rsit

2010-01-04 09:41:43 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Malwarebytes

2010-01-04 09:41:33 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes

2010-01-04 09:41:32 ----D---- C:\Programme\Malwarebytes' Anti-Malware

2010-01-04 09:26:23 ----D---- C:\Programme\CCleaner
 

======List of files/folders modified in the last 1 months======
 

2010-01-08 12:46:33 ----D---- C:\Programme\Mozilla Thunderbird

2010-01-08 12:46:25 ----D---- C:\Programme\Mozilla Firefox

2010-01-08 12:40:50 ----D---- C:\WINDOWS\Temp

2010-01-08 12:40:19 ----SH---- C:\cj.ini

2010-01-08 12:38:45 ----A---- C:\WINDOWS\SchedLgU.Txt

2010-01-08 12:38:25 ----RASH---- C:\boot.ini

2010-01-08 12:38:24 ----A---- C:\WINDOWS\win.ini

2010-01-08 12:38:24 ----A---- C:\WINDOWS\system.ini

2010-01-08 12:35:24 ----SHD---- C:\WINDOWS\Installer

2010-01-08 12:35:03 ----D---- C:\Programme\Microsoft SQL Server

2010-01-08 12:34:58 ----D---- C:\WINDOWS\Registration

2010-01-08 12:34:51 ----D---- C:\WINDOWS

2010-01-08 12:34:04 ----D---- C:\WINDOWS\system32

2010-01-08 12:34:04 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI

2010-01-08 12:27:47 ----D---- C:\WINDOWS\system32\drivers

2010-01-08 10:35:49 ----RSD---- C:\WINDOWS\assembly

2010-01-08 10:32:45 ----D---- C:\WINDOWS\Microsoft.NET

2010-01-08 10:25:21 ----RD---- C:\Programme

2010-01-08 10:19:46 ----D---- C:\WINDOWS\Debug

2010-01-08 09:51:53 ----HD---- C:\WINDOWS\inf

2010-01-08 09:22:43 ----D---- C:\WINDOWS\system32\CatRoot2

2010-01-07 17:42:27 ----D---- C:\WINDOWS\WinSxS

2010-01-07 17:40:25 ----RSHDC---- C:\WINDOWS\system32\dllcache

2010-01-07 17:40:03 ----D---- C:\WINDOWS\system32\CatRoot

2010-01-07 17:39:00 ----HD---- C:\WINDOWS\$hf_mig$

2010-01-07 11:13:13 ----D---- C:\WINDOWS\system32\wbem

2010-01-07 11:13:13 ----D---- C:\WINDOWS\system32\Setup

2010-01-07 11:13:13 ----D---- C:\WINDOWS\AppPatch

2010-01-07 11:13:12 ----RSD---- C:\WINDOWS\Fonts

2010-01-07 09:47:51 ----D---- C:\Programme\Outlook Express

2010-01-07 09:47:43 ----D---- C:\WINDOWS\security

2010-01-07 09:42:17 ----D---- C:\Programme\Messenger

2010-01-07 09:38:16 ----D---- C:\WINDOWS\ehome

2010-01-07 09:38:15 ----D---- C:\WINDOWS\system32\inetsrv

2010-01-07 09:38:14 ----D---- C:\WINDOWS\ime

2010-01-07 09:38:14 ----D---- C:\WINDOWS\Help

2010-01-07 09:37:55 ----D---- C:\WINDOWS\system32\usmt

2010-01-07 09:37:53 ----D---- C:\Programme\Internet Explorer

2010-01-07 09:37:52 ----D---- C:\WINDOWS\PeerNet

2010-01-07 09:37:52 ----D---- C:\Programme\Movie Maker

2010-01-07 09:33:56 ----D---- C:\WINDOWS\system32\Restore

2010-01-07 09:33:55 ----D---- C:\WINDOWS\system32\npp

2010-01-07 09:33:54 ----D---- C:\WINDOWS\msagent

2010-01-07 09:33:52 ----D---- C:\WINDOWS\srchasst

2010-01-07 09:33:51 ----D---- C:\Programme\NetMeeting

2010-01-07 09:33:49 ----D---- C:\WINDOWS\system32\Com

2010-01-07 09:33:47 ----D---- C:\Programme\Windows Media Player

2010-01-07 09:33:46 ----D---- C:\Programme\Windows NT

2010-01-07 09:33:43 ----D---- C:\Programme\Gemeinsame Dateien\System

2010-01-07 09:33:20 ----D---- C:\WINDOWS\system32\oobe

2010-01-07 09:33:17 ----D---- C:\WINDOWS\system

2010-01-07 09:14:46 ----D---- C:\Programme\Java

2010-01-06 16:17:40 ----SHD---- C:\WINDOWS\CSC

2010-01-06 09:37:00 ----D---- C:\WINDOWS\system32\spool

2010-01-06 09:32:02 ----D---- C:\WINDOWS\system32\mui

2010-01-06 05:16:43 ----A---- C:\WINDOWS\DUMP43a0.tmp

2010-01-05 15:00:23 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\vlc

2010-01-04 13:57:50 ----SD---- C:\WINDOWS\Tasks

2010-01-04 13:57:16 ----D---- C:\Programme\Gemeinsame Dateien

2010-01-04 13:55:28 ----D---- C:\Programme\MSECACHE

2010-01-04 11:42:48 ----D---- C:\SFSCHLR

2010-01-04 11:34:28 ----D---- C:\WINDOWS\msapps

2009-12-18 12:59:50 ----D---- C:\wingpc_7#1

2009-12-18 10:49:12 ----D---- C:\Programme\PSS WinGPC Unity

2009-12-17 13:52:30 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\gtk-2.0

2009-12-14 10:04:18 ----D---- C:\Programme\Gemeinsame Dateien\Real

2009-12-14 10:04:17 ----D---- C:\Program Files

2009-12-14 10:04:02 ----D---- C:\Dokumente und Einstellungen\User\Anwendungsdaten\Real

2009-12-14 10:03:35 ----D---- C:\Programme\Mozilla Sunbird
 

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]

R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]

R1 SAVOnAccessControl;SAVOnAccessControl; C:\WINDOWS\system32\DRIVERS\savonaccesscontrol.sys [2010-01-04 110848]

R1 SAVOnAccessFilter;SAVOnAccessFilter; C:\WINDOWS\system32\DRIVERS\savonaccessfilter.sys [2010-01-04 38528]

R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-06-10 28520]

R2 DOSMEMIO;MEMIO; \??\C:\WINDOWS\system32\MEMIO.SYS []

R2 NwlnkIpx;NWLink IPX/SPX/NetBIOS-kompatibles Transportprotokoll; C:\WINDOWS\system32\DRIVERS\nwlnkipx.sys [2008-04-13 88320]

R2 NwlnkNb;NWLink-NetBIOS; C:\WINDOWS\system32\DRIVERS\nwlnknb.sys [2004-08-04 63232]

R2 NwlnkSpx;NWLink SPX/SPXII-Protokoll; C:\WINDOWS\system32\DRIVERS\nwlnkspx.sys [2004-08-04 55936]

R3 AgereSoftModem;Agere Systems Soft Modem; C:\WINDOWS\system32\DRIVERS\AGRSM.sys [2006-08-30 1161152]

R3 AR5211;Atheros Wireless Network Adapter Service; C:\WINDOWS\system32\DRIVERS\ar5211.sys [2007-05-03 546976]

R3 ati2mtag;ati2mtag; C:\WINDOWS\system32\DRIVERS\ati2mtag.sys [2007-08-27 2372096]

R3 btaudio;Bluetooth-Audiogerät; C:\WINDOWS\system32\drivers\btaudio.sys [2007-03-23 539072]

R3 BTDriver;Virtueller Bluetooth-Kommunikationstreiber; C:\WINDOWS\system32\DRIVERS\btport.sys [2007-03-23 37424]

R3 BTKRNL;Bluetooth-Bus-Enumerator; C:\WINDOWS\system32\DRIVERS\btkrnl.sys [2007-03-31 876384]

R3 BTWUSB;WIDCOMM USB Bluetooth Driver; C:\WINDOWS\System32\Drivers\btwusb.sys [2007-03-23 67960]

R3 CmBatt;Treiber für Microsoft-ACPI-Kontrollmethodenkompatible Batterie; C:\WINDOWS\system32\DRIVERS\CmBatt.sys [2008-04-13 13952]

R3 DNSeFilter;DNSeFilter; C:\WINDOWS\system32\drivers\SamsungEDS.sys [2006-10-12 28160]

R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]

R3 HidUsb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]

R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-07-10 4449280]

R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2001-08-18 12288]

R3 ROCKEYNT;Feitian ROCKEY4 Device Service; C:\WINDOWS\system32\DRIVERS\Rockey4.sys [2008-07-15 22016]

R3 SynTP;Synaptics TouchPad Driver; C:\WINDOWS\system32\DRIVERS\SynTP.sys [2005-12-07 191936]

R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]

R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]

R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]

R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]

R3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]

R3 yukonwxp;NDIS5.1 Miniport Driver for Marvell Yukon Ethernet Controller; C:\WINDOWS\system32\DRIVERS\yk51x86.sys [2006-08-25 249856]

S2 DgiVecp;DgiVecp; \??\C:\WINDOWS\system32\Drivers\DgiVecp.sys []

S2 Sentinel;Sentinel; C:\WINDOWS\System32\Drivers\SENTINEL.SYS [1999-01-15 73216]

S2 Sntnlusb;Sntnlusb; C:\WINDOWS\System32\Drivers\SNTNLUSB.SYS [1999-01-15 8128]

S2 SSPORT;SSPORT; \??\C:\WINDOWS\system32\Drivers\SSPORT.sys []

S3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]

S3 BTWDNDIS;Bluetooth-LAN-Zugangsserver; C:\WINDOWS\system32\DRIVERS\btwdndis.sys [2007-03-23 149123]

S3 CSWInt7;CSWInt7; C:\WINDOWS\System32\Drivers\CSWInt7.sys [2005-03-08 22016]

S3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]

S3 Rockey_USB;Feitian ROCKEY4 USB Service; C:\WINDOWS\system32\DRIVERS\Rockey4USB.sys [2008-07-15 12928]

S3 se58bus;Sony Ericsson Device 088 driver (WDM); C:\WINDOWS\system32\DRIVERS\se58bus.sys [2006-09-05 61536]

S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]

S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

S4 SophosBootDriver;SophosBootDriver; C:\WINDOWS\system32\DRIVERS\SophosBootDriver.sys [2010-01-04 14976]
 

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======
 

R2 Ati HotKey Poller;Ati HotKey Poller; C:\WINDOWS\system32\Ati2evxx.exe [2007-08-27 483328]

R2 btwdins;Bluetooth Service; C:\Programme\WIDCOMM\Bluetooth Software\bin\btwdins.exe [2007-04-01 273256]

R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2010-01-07 153376]

R2 LightScribeService;LightScribeService Direct Disc Labeling Service; C:\Programme\Gemeinsame Dateien\LightScribe\LSSrvc.exe [2006-06-20 49152]

R2 MDM;Machine Debug Manager; C:\Programme\Gemeinsame Dateien\Microsoft Shared\VS7DEBUG\MDM.EXE [2003-06-19 322120]

R2 MSSQL$CSSQL05;SQL Server (CSSQL05); C:\Programme\Microsoft SQL Server\MSSQL.1\MSSQL\Binn\sqlservr.exe [2009-05-27 29262680]

R2 NwSapAgent;SAP-Agent; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]

R2 SAVAdminService;Sophos Anti-Virus Statusreporter; C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe [2010-01-04 80936]

R2 SAVService;Sophos Anti-Virus; C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe [2010-01-04 98304]

R2 SNM WLAN Service;SNM WLAN Service; C:\Programme\samsung\Samsung Network Manager\SNMWLANService.exe [2005-05-28 36864]

R2 Sophos AutoUpdate Service;Sophos AutoUpdate Service; C:\Programme\Sophos\AutoUpdate\ALsvc.exe [2010-01-04 172032]

R2 SQLBrowser;SQL Server Browser; C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe [2008-11-24 239968]

R2 SQLWriter;SQL Server VSS Writer; C:\Programme\Microsoft SQL Server\90\Shared\sqlwriter.exe [2008-11-24 87904]

R2 UMWdf;Windows User Mode Driver Framework; C:\WINDOWS\system32\wdfmgr.exe [2004-08-10 38912]

S2 Samsung Update Plus;Samsung Update Plus; C:\Programme\Samsung\Samsung Update Plus\SLUBackgroundService.exe [2006-11-13 73728]

S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]

S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]

S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]

S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]

S3 odserv;Microsoft Office Diagnostics Service; C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\ODSERV.EXE [2006-10-26 441136]

S3 ose;Office Source Engine; C:\Programme\Gemeinsame Dateien\Microsoft Shared\Source Engine\OSE.EXE [2006-10-26 145184]

S4 MSSQLServerADHelper;SQL Server Active Directory Helper; C:\Programme\Microsoft SQL Server\90\Shared\sqladhlp90.exe [2008-11-24 45408]

S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]
 

-----------------EOF-----------------

Code:

info.txt logfile of random's system information tool 1.06 2010-01-04 12:38:19
 

======Uninstall list======
 

-->MsiExec.exe /I{022984AE-FF6F-46C4-AA47-5DB3A9C195A9}

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf

2007 Microsoft Office system-->"C:\Programme\Gemeinsame Dateien\Microsoft Shared\OFFICE12\Office Setup Controller\setup.exe" /uninstall PROHYBRIDR /dll OSETUP.DLL

Activation Assistant for the 2007 Microsoft Office suites-->"C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\{623D32E9-0C62-4453-AD44-98B31F52A5E1}\Microsoft Office Activation Assistant.exe" REMOVE=TRUE MODIFY=FALSE

Adobe Acrobat 7.1.0 Professional - English, Français, Deutsch-->msiexec /I {AC76BA86-1033-F400-7760-100000000002}

Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe

Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9b.exe -uninstallDelete

Adobe Reader 7.0.8 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A70800000002}

Agere Systems HDA Modem-->agrsmdel

Aspell German Dictionary-0.50-2-->C:\Programme\Aspell\unins001.exe

Atheros WLAN Client-->C:\Programme\InstallShield Installation Information\{F4F41D14-E0DD-4FB4-AA09-A14225C769BD}\setup.exe -runfromtemp -l0x0007 -removeonly

ATI - Dienstprogramm zur Deinstallation der Software-->C:\Programme\ATI Technologies\UninstallAll\AtiCimUn.exe

ATI Catalyst Control Center-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{055EE59D-217B-43A7-ABFF-507B966405D8}\setup.exe" -l0x0 

ATI Display Driver-->rundll32 C:\WINDOWS\system32\atiiiexx.dll,_InfEngUnInstallINFFile_RunDLL@16 -force_restart -flags:0x2010001 -inf_class:DISPLAY -clean

Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE

AVStation Premium 3.75-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{BA7AF70A-F81B-40EF-9268-741A7DE3D608} /l1031 

CambridgeSoft Activation Client-->MsiExec.exe /I{863F58EF-467F-4BCC-A40B-D2304630DEA1}

CambridgeSoft BioDraw Ultra 11.0-->C:\Programme\InstallShield Installation Information\{E4CCF22F-A681-44D6-B414-3DCFD03BC3C0}\setup.exe -runfromtemp -l0x0409

CambridgeSoft ChemBioDraw Ultra 11.0-->C:\Programme\InstallShield Installation Information\{798B2322-89EB-4ADC-A6B2-21EAC108E252}\setup.exe -runfromtemp -l0x0409

CambridgeSoft ENotebook 11.0-->C:\Programme\InstallShield Installation Information\{09AE4FE6-9610-449C-A5DE-C78FCFEB8A41}\setup.exe -runfromtemp -l0x0409

CCleaner-->"C:\Programme\CCleaner\uninst.exe"

Citavi 2.5.1.0-->C:\Programme\Citavi\Deinstallieren.exe

Clarity-->C:\WINDOWS\unvise32.exe c:\programme\clarity\uninstal.log

Easy Display Manager-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{17283B95-21A8-4996-97DA-547A48DB266F}\setup.exe" -l0x9  -removeonly

FinchTV-->MsiExec.exe /I{4D5C1F43-2D45-42C1-B4BF-F74BFA28E7FF}

GIMP 2.4.7-->"C:\Programme\GIMP-2.0\setup\unins000.exe"

GNU Aspell 0.50-3-->C:\Programme\Aspell\unins000.exe

GPL Ghostscript 8.64-->C:\Programme\gs\uninstgs.exe "C:\Programme\gs\gs8.64\uninstal.txt"

High Definition Audio - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"

HijackThis 2.0.2-->"C:\Programme\trend micro\HijackThis.exe" /uninstall

Hotfix für Microsoft .NET Framework 2.0 (KB922981)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {A1D5A6B2-B620-41F9-B435-10A4FF3C18A2} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}

Hotfix für Microsoft .NET Framework 2.0 (KB923319)-->C:\WINDOWS\system32\msiexec.exe /promptrestart /uninstall {3C87D1CF-1592-4BFA-9B3E-380580EFAF51} /package {7131646D-CD3C-40F4-97B9-CD9E4E6262EF}

Hotfix für Windows XP (KB899271)-->"C:\WINDOWS\$NtUninstallKB899271$\spuninst\spuninst.exe"

Hotfix für Windows XP (KB917332)-->"C:\WINDOWS\$NtUninstallKB917332$\spuninst\spuninst.exe"

Hotfix für Windows XP (KB924867)-->"C:\WINDOWS\$NtUninstallKB924867$\spuninst\spuninst.exe"

Hotfix für Windows XP (KB928388)-->"C:\WINDOWS\$NtUninstallKB928388$\spuninst\spuninst.exe"

Hotfix für Windows XP (KB935192)-->"C:\WINDOWS\$NtUninstallKB935192$\spuninst\spuninst.exe"

Hotfix für Windows XP (KB935448)-->"C:\WINDOWS\$NtUninstallKB935448$\spuninst\spuninst.exe"

Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"

imagine digital freedom - Samsung-->MsiExec.exe /X{00AF10C1-44BD-4862-9D7F-24E6BA3E87FD}

Inkscape 0.46-->C:\Programme\Inkscape\Uninstall.exe

Install McAfee-->MsiExec.exe /I{6B32EF07-8A23-4824-91BD-B0F24E50E974}

ISIS Draw 2.3 Standalone-->C:\WINDOWS\IsUninst.exe -f"C:\Programme\ISIS Draw 2.3\uninst.isu"

J2SE Runtime Environment 5.0-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0150000}

Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}

LEd Beta 0.52-->"C:\Programme\LEd\unins000.exe"

Magic Keyboard-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{BD723E53-A42C-4702-AA04-1D74A0311590}\Setup.exe" -l0x9 Remove

Malwarebytes' Anti-Malware-->"C:\Programme\Malwarebytes' Anti-Malware\unins000.exe"

Microsoft .NET Framework 2.0-->C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\Microsoft .NET Framework 2.0\install.exe

Microsoft Office 2003 Web Components-->MsiExec.exe /I{90A40407-6000-11D3-8CFE-0150048383C9}

Microsoft Office PowerPoint 2003 Template Pack 1-->MsiExec.exe /I{90AB0407-6000-11D3-8CFE-0150048383C9}

Microsoft Office PowerPoint 2003 Template Pack 2-->MsiExec.exe /I{90AC0407-6000-11D3-8CFE-0150048383C9}

Microsoft Office PowerPoint 2003 Template Pack 3-->MsiExec.exe /I{90AD0407-6000-11D3-8CFE-0150048383C9}

Microsoft Office Professional Edition 2003-->MsiExec.exe /I{90110407-6000-11D3-8CFE-0150048383C9}

Microsoft SQL Server 2005 Express Edition (CSSQL05)-->MsiExec.exe /I{2AFFFDD7-ED85-4A90-8C52-5DA9EBDC9B8F}

Microsoft SQL Server 2005 Tools Express Edition-->MsiExec.exe /I{2750B389-A2D2-4953-99CA-27C1F2A8E6FD}

Microsoft SQL Server 2005-->"C:\Programme\Microsoft SQL Server\90\Setup Bootstrap\ARPWrapper.exe" /Remove

Microsoft SQL Server Native Client-->MsiExec.exe /I{F9B3DD02-B0B3-42E9-8650-030DFF0D133D}

Microsoft SQL Server Setup Support Files (English)-->MsiExec.exe /X{53F5C3EE-05ED-4830-994B-50B2F0D50FCE}

Microsoft SQL Server VSS Writer-->MsiExec.exe /I{E9F44C98-B8B6-480F-AF7B-E42A0A46F4E3}

Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022-->MsiExec.exe /X{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}

Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}

MiKTeX 2.7-->C:\texmf\miktex\bin\copystart_admin.exe C:\texmf\miktex\config\uninstall.dat

Miranda IM 0.8.9-->C:\Programme\Miranda IM\Uninstall.exe

Mozilla Firefox (3.5.6)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe

Mozilla Thunderbird (2.0.0.23)-->C:\Programme\Mozilla Thunderbird\uninstall\helper.exe

MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}

MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}

MSXML 6 Service Pack 2 (KB954459)-->MsiExec.exe /I{B5E8B139-9A06-4D97-BA4E-1256F8D6968D}

OpenOffice.org 3.0-->MsiExec.exe /I{7EC19307-7C22-47A8-922B-3FA965291260}

PowerDVD-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\setup.exe"  -uninstall

PowerStarter-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe"  -uninstall

PSS WinGPC Unity-->C:\Programme\PSS WinGPC Unity\uninstall.exe

Rainlendar2 (remove only)-->"C:\Programme\Rainlendar2\uninst.exe"

Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\setup.exe" -l0x7  -removeonly

Samsung Battery Manager-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6F730513-8688-4C3C-90A3-6B9792CE2EF3}\Setup.exe" -l0x9 Remove

Samsung EDS-->MsiExec.exe /X{ABB14904-A11B-4F42-996C-80FD608A0F17}

Samsung Magic Doctor-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{32D6A58F-9659-446C-BBFC-E6F2B41F24DC}\Setup.exe" -l0x7 Remove

Samsung ML-2850 Series-->C:\Programme\Samsung\Samsung ML-2850 Series\Install\Setup.exe /R

Samsung Network Manager 2.0-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{DEA48EFD-22C1-4CD6-B887-EB2E6B2E4735} /l1031 

Samsung Recovery Solution II-->C:\Programme\InstallShield Installation Information\{145DE957-0679-4A2A-BB5C-1D3E9808FAB2}\setup.exe -runfromtemp -l0x0007 -removeonly

Samsung Update Plus-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\10\INTEL3~1\IDriver.exe /M{685707A4-911C-468D-BFC4-64A50E5E3A0C} /l1031 

SciFinder Scholar 2007-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\SFSCHLR\Uninstall\SETUP.EXE" -l0x9 

SciFinder Scholar Toolbar-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\SFScholarToolbar\Uninstall\Setup.exe" -l0x9 

Scribus 1.3.3.13-->C:\Programme\Scribus 1.3.3.13\uninst.exe

Sentinel System Driver-->C:\WINDOWS\SYSTEM32\RNBOSENT\SETUPX86.EXE /U /q

Shared Add-in Support Update for Microsoft .NET Framework 2.0 (KB908002)-->MsiExec.exe /X{64F3B15C-24C7-4B2B-9B72-65CCBBD7F06B}

Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB896423)-->"C:\WINDOWS\$NtUninstallKB896423$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB896424)-->"C:\WINDOWS\$NtUninstallKB896424$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB901214)-->"C:\WINDOWS\$NtUninstallKB901214$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB902400)-->"C:\WINDOWS\$NtUninstallKB902400$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB904706)-->"C:\WINDOWS\$NtUninstallKB904706$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB905749)-->"C:\WINDOWS\$NtUninstallKB905749$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB908519)-->"C:\WINDOWS\$NtUninstallKB908519$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB911562)-->"C:\WINDOWS\$NtUninstallKB911562$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB912919)-->"C:\WINDOWS\$NtUninstallKB912919$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB914388)-->"C:\WINDOWS\$NtUninstallKB914388$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB914389)-->"C:\WINDOWS\$NtUninstallKB914389$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB917422)-->"C:\WINDOWS\$NtUninstallKB917422$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB920213)-->"C:\WINDOWS\$NtUninstallKB920213$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB920670)-->"C:\WINDOWS\$NtUninstallKB920670$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB920683)-->"C:\WINDOWS\$NtUninstallKB920683$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB922616)-->"C:\WINDOWS\$NtUninstallKB922616$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB923191)-->"C:\WINDOWS\$NtUninstallKB923191$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB923414)-->"C:\WINDOWS\$NtUninstallKB923414$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB923689)-->"C:\WINDOWS\$NtUninstallKB923689$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB924270)-->"C:\WINDOWS\$NtUninstallKB924270$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB925454)-->"C:\WINDOWS\$NtUninstallKB925454$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB929969)-->"C:\WINDOWS\$NtUninstallKB929969$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB944338-v2)-->"C:\WINDOWS\$NtUninstallKB944338-v2$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"

Sicherheitsupdate für Windows XP (KB963027)-->"C:\WINDOWS\$NtUninstallKB963027$\spuninst\spuninst.exe"

SigmaPlot 10.0-->MsiExec.exe /I{43224D30-5941-47A4-9AD7-9250EE794396}

Skype™ 3.8-->MsiExec.exe /X{5C82DAE5-6EB0-4374-9254-BE3319BA4E82}

SmartFTP Client 3.0 Setup Files (remove only)-->C:\Programme\SmartFTP Client 3.0 Setup Files\uninst-sftp.exe

SmartFTP Client-->MsiExec.exe /I{6F23C1A3-9F62-470C-BD12-B83F04E67865}

Softonic_Deutsch Toolbar-->C:\PROGRA~1\SOFTON~1\UNWISE.EXE C:\PROGRA~1\SOFTON~1\INSTALL.LOG

Synaptics Pointing Device Driver-->rundll32.exe "C:\Programme\Synaptics\SynTP\SynISDLL.dll",standAloneUninstall

TeXnicCenter Version 1.0 Stable RC1-->"C:\Programme\TeXnicCenter\unins000.exe"

Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)-->MsiExec.exe /X{07629207-FAA0-4F1A-8092-BF5085BE511F}

Update for Office 2007 (KB934528)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {2B939677-2FFD-48F6-9075-7BF48CB87C80}

Update for Office System 2007 Setup (KB929722)-->msiexec /package {91120000-0031-0000-0000-0000000FF1CE} /uninstall {D8E9BEBD-655F-467D-8176-CA9959C140A3}

Update für Windows XP (KB896256)-->"C:\WINDOWS\$NtUninstallKB896256$\spuninst\spuninst.exe"

Update für Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"

Update für Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"

Update für Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"

User Guide-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{BAE68339-B0F6-4D33-9554-5A3DB2DFF5DA}\setup.exe" -l0x7 Remove

V9CC-->MsiExec.exe /I{549FDEBE-A2C4-43D1-AA96-70D4ED66F7BA}

V9CNT-->MsiExec.exe /I{4C6761E4-A311-4EC7-B8D5-9F2DB6881C64}

V9COM-->MsiExec.exe /I{849B3D37-2AFA-426C-B917-24599E2A3125}

V9DT-->MsiExec.exe /I{DF4A9575-9E92-42A3-8CA8-CEF88A80E5EE}

V9NQ-->MsiExec.exe /I{B70E0DBE-8CD5-4045-B88C-661E2CEC20E5}

V9PFAM-->MsiExec.exe /I{5BC0231B-05FB-4CFD-A0A0-51332E811A2E}

V9V8V-->MsiExec.exe /I{21A99ABF-E99C-4986-B0AF-89B90745BA2A}

Vector NTI 9-->MsiExec.exe /I{76EADF34-0714-4D22-9366-18DC9722CB90}

VLC media player 1.0.2-->C:\Programme\VideoLAN\VLC\uninstall.exe

WIDCOMM Bluetooth Software-->MsiExec.exe /X{84814E6B-2581-46EC-926A-823BD1C670F6}

Winamp-->"C:\Programme\Winamp\UninstWA.exe"

Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"

Windows Installer Clean Up-->MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52}

Windows Media Format Runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll

Windows Media Player 10-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall

Windows XP-Hotfix - KB830092-->"C:\WINDOWS\$NtUninstallKB830092$\spuninst\spuninst.exe"

Windows XP-Hotfix - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe

Windows-Treiberpaket - DataApex Ltd. (cswcb20) Chromatography 11/07/2000 -->C:\WINDOWS\system32\DRVSTORE\f1490bc41e7d27129cb157cba768cf63b89e7752\DPInst.exe /u Cswcb20_46732e725fcb63c9c2725cb91eb57ebb67bf3fe5

Windows-Treiberpaket - DataApex Ltd. (cswint7) Chromatography 11/07/2000 -->C:\WINDOWS\system32\DRVSTORE\f1490bc41e7d27129cb157cba768cf63b89e7752\DPInst.exe /u CswInt7_1116d271e3432baa1a8f711201a66fc04e09bfd2

Windows-Treiberpaket - DataApex Ltd. (cswupad) Chromatography 01/01/2005 -->C:\WINDOWS\system32\DRVSTORE\f1490bc41e7d27129cb157cba768cf63b89e7752\DPInst.exe /u CswUpad_ac331b5a5c468b341b230b848bd65f862cac9817

WinRAR-->C:\Programme\WinRAR\uninstall.exe
 

======Security center information======
 

AV: AntiVir Desktop
 

======System event log======
 

Computer Name: L***N

Event Code: 7036

Message: Dienst "IMAPI-CD-Brenn-COM-Dienste" befindet sich jetzt im Status "Ausgeführt".
 

Record Number: 10750

Source Name: Service Control Manager

Time Written: 20090828090404.000000+120

Event Type: Informationen

User: 
 

Computer Name: L***N

Event Code: 7035

Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "IMAPI-CD-Brenn-COM-Dienste" gesendet.
 

Record Number: 10749

Source Name: Service Control Manager

Time Written: 20090828090404.000000+120

Event Type: Informationen

User: NT-AUTORITÄT\SYSTEM
 

Computer Name: L***N

Event Code: 7035

Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "RAS-Verbindungsverwaltung" gesendet.
 

Record Number: 10748

Source Name: Service Control Manager

Time Written: 20090828090404.000000+120

Event Type: Informationen

User: LKILIAN\User
 

Computer Name: L***N

Event Code: 7036

Message: Dienst "Telefonie" befindet sich jetzt im Status "Ausgeführt".
 

Record Number: 10747

Source Name: Service Control Manager

Time Written: 20090828090404.000000+120

Event Type: Informationen

User: 
 

Computer Name: L***N

Event Code: 7036

Message: Dienst "SSDP-Suchdienst" befindet sich jetzt im Status "Ausgeführt".
 

Record Number: 10746

Source Name: Service Control Manager

Time Written: 20090828090402.000000+120

Event Type: Informationen

User: 
 

=====Application event log=====
 

Computer Name: L***N

Event Code: 17896

Message: The time stamp counter of CPU on scheduler id 1 is not synchronized with other CPUs.
 

Record Number: 6199

Source Name: MSSQL$CSSQL05

Time Written: 20091012152550.000000+120

Event Type: Informationen

User: 
 

Computer Name: L***N

Event Code: 17896

Message: The time stamp counter of CPU on scheduler id 1 is not synchronized with other CPUs.
 

Record Number: 6198

Source Name: MSSQL$CSSQL05

Time Written: 20091012140150.000000+120

Event Type: Informationen

User: 
 

Computer Name: L***N

Event Code: 17896

Message: The time stamp counter of CPU on scheduler id 1 is not synchronized with other CPUs.
 

Record Number: 6197

Source Name: MSSQL$CSSQL05

Time Written: 20091012125750.000000+120

Event Type: Informationen

User: 
 

Computer Name: L***N

Event Code: 17896

Message: The time stamp counter of CPU on scheduler id 1 is not synchronized with other CPUs.
 

Record Number: 6196

Source Name: MSSQL$CSSQL05

Time Written: 20091012115350.000000+120

Event Type: Informationen

User: 
 

Computer Name: L***N

Event Code: 17896

Message: The time stamp counter of CPU on scheduler id 1 is not synchronized with other CPUs.
 

Record Number: 6195

Source Name: MSSQL$CSSQL05

Time Written: 20091012102950.000000+120

Event Type: Informationen

User: 
 

======Environment variables======
 

"ComSpec"=%SystemRoot%\system32\cmd.exe

"FP_NO_HOST_CHECK"=NO

"NUMBER_OF_PROCESSORS"=2

"OS"=Windows_NT

"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Programme\ATI Technologies\ATI.ACE\Core-Static;C:\Programme\Gemeinsame Dateien\MDL Shared\ISIS;C:\texmf\miktex\bin;C:\Programme\Microsoft SQL Server\90\Tools\binn\

"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH

"PROCESSOR_ARCHITECTURE"=x86

"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 15 Stepping 13, GenuineIntel

"PROCESSOR_LEVEL"=6

"PROCESSOR_REVISION"=0f0d

"TEMP"=%SystemRoot%\TEMP

"TMP"=%SystemRoot%\TEMP

"windir"=%SystemRoot%
 

-----------------EOF-----------------

Ich hoffe es ist auch ausreichend anonymisiert.