Virus im system32 Ordner -.-

Hi,
in quarantäne schieben ist immer das beste.
wenn du vista hast, füre alle tools mit rechtsklick und als administrator ausfüren aus...
2. hjt laden, instalieren scan and safe logfile klicken und posten.

http://virus-protect.org/hijackthis.html
3. malwareBytes laden,instalieren, updaten, scannen, funde löschen und log posten.

http://virus-protect.org/artikel/tools/malwarebytes.html
4.
RSIT laden, ausfüren, logs posten. eines ist minimiert in der taskleiste:
http://virus-protect.org/artikel/tools/random.html

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 15:51:21, on 10.04.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\DisplayLink Core Software\DisplayLinkService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\DisplayLink Core Software\DisplayLinkManager.exe
C:\Programme\DisplayLink Core Software\DisplayLinkUI.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Razer\Copperhead\razerhid.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE
C:\Programme\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Razer\Copperhead\razertra.exe
C:\Programme\Razer\Copperhead\razerofa.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
D:\Programme\Ventrilo\Ventrilo.exe
C:\Programme\Internet Explorer\iexplore.exe
C:\Programme\Internet Explorer\iexplore.exe
D:\Programme\Trend Micro\HijackThis\HijackThis.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Copperhead] C:\Programme\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S46.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.08\is\PhysX_9.09.0203_SystemSoftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: DisplayLink Service (DisplayLinkService) - DisplayLink Corp. - C:\Programme\DisplayLink Core Software\DisplayLinkService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5570 bytes
 

Malwarebytes' Anti-Malware 1.36
Datenbank Version: 1962
Windows 5.1.2600 Service Pack 3

10.04.2009 16:16:22
mbam-log-2009-04-10 (16-16-22).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|)
Durchsuchte Objekte: 115300
Laufzeit: 21 minute(s), 51 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 0

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
(Keine bösartigen Objekte gefunden)
 

OK, nun noch RSIT

Logfile of random's system information tool 1.06 (written by random/random)
Run by Razer SLOne at 2009-04-10 16:17:44
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 11 GB (54%) free of 20 GB
Total RAM: 2047 MB (73% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 16:17:47, on 10.04.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16791)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\DisplayLink Core Software\DisplayLinkService.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\DisplayLink Core Software\DisplayLinkManager.exe
C:\Programme\DisplayLink Core Software\DisplayLinkUI.exe
C:\WINDOWS\SOUNDMAN.EXE
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\Programme\Razer\Copperhead\razerhid.exe
C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE
C:\Programme\Java\jre6\bin\jusched.exe
C:\WINDOWS\system32\RUNDLL32.EXE
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\Razer\Copperhead\razertra.exe
C:\Programme\Razer\Copperhead\razerofa.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\WINDOWS\System32\svchost.exe
D:\Programme\Ventrilo\Ventrilo.exe
C:\Programme\Internet Explorer\iexplore.exe
D:\Programme\Trend Micro\HijackThis\HijackThis.exe
D:\Programme\Malwarebytes' Anti-Malware\mbam.exe
C:\Dokumente und Einstellungen\Razer SLOne\Lokale Einstellungen\Temporary Internet Files\Content.IE5\4N7C0DD8\RSIT[1].exe
D:\Programme\Trend Micro\HijackThis\Razer SLOne.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.google.de/
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [SoundMan] SOUNDMAN.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [Copperhead] C:\Programme\Razer\Copperhead\razerhid.exe
O4 - HKLM\..\Run: [EPSON Stylus DX6000 Series] C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE /FU "C:\WINDOWS\TEMP\E_S46.tmp" /EF "HKLM"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [Adobe Reader Speed Launcher] "C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe"
O4 - HKLM\..\RunOnce: [Malwarebytes' Anti-Malware] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe /install /silent
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\RunOnce: [WiseStubReboot] MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I "C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI" TRANSFORMS="C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST" WISE_SETUP_EXE_PATH="c:\nvidia\winxp\182.08\is\PhysX_9.09.0203_SystemSoftware.exe"
O4 - HKUS\S-1-5-19\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'LOKALER DIENST')
O4 - HKUS\S-1-5-20\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'NETZWERKDIENST')
O4 - HKUS\S-1-5-18\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'SYSTEM')
O4 - HKUS\.DEFAULT\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\CTFMON.EXE (User 'Default user')
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {1E54D648-B804-468d-BC78-4AFFED8E262E} (System Requirements Lab) - http://www.nvidia.com/content/DriverDownload/srl/3.0.0.0/srl_bin/sysreqlab3.cab
O16 - DPF: {67DABFBF-D0AB-41FA-9C46-CC0F21721616} (DivXBrowserPlugin Object) - http://download.divx.com/player/DivXBrowserPlugin.cab
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} (Shockwave Flash Object) - https://download.macromedia.com/pub/shockwave/cabs/flash/swflash.cab
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: DisplayLink Service (DisplayLinkService) - DisplayLink Corp. - C:\Programme\DisplayLink Core Software\DisplayLinkService.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe

--
End of file - 5872 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-04-08 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-04-08 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2009-03-27 13684736]
"nwiz"=nwiz.exe /install []
"SoundMan"=C:\WINDOWS\SOUNDMAN.EXE [2004-07-27 68096]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"Copperhead"=C:\Programme\Razer\Copperhead\razerhid.exe [2005-11-25 155648]
"EPSON Stylus DX6000 Series"=C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\E_FATIBIE.EXE [2006-02-13 131072]
"SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2009-04-08 148888]
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2009-03-27 86016]
"Adobe Reader Speed Launcher"=C:\Programme\Adobe\Reader 9.0\Reader\Reader_sl.exe [2009-02-27 35696]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"Malwarebytes' Anti-Malware"=D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe [2009-04-06 401040]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"WiseStubReboot"=MSIEXEC /quiet SKIP_PPU_DRIVER_INSTALL=1 /I C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MSI TRANSFORMS=C:\Programme\Gemeinsame Dateien\Wise Installation Wizard\WISDD1865F0AD7340FBB23E1822E02396FF_9_09_0203.MST WISE_SETUP_EXE_PATH=c:\nvidia\winxp\182.08\is\PhysX_9.09.0203_SystemSoftware.exe []

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\Programme\Ventrilo\Ventrilo.exe"="D:\Programme\Ventrilo\Ventrilo.exe:*:Enabled:Ventrilo.exe"
"D:\Programme\Curse\CurseClient.exe"="D:\Programme\Curse\CurseClient.exe:*:Enabled:Curse Client"
"D:\Programme\World of Warcraft\BackgroundDownloader.exe"="D:\Programme\World of Warcraft\BackgroundDownloader.exe:*:Enabled:Blizzard Downloader"
"D:\Programme\mIRC\mirc.exe"="D:\Programme\mIRC\mirc.exe:*:Enabled:mIRC"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2009-04-10 16:17:44 ----D---- C:\rsit
2009-04-10 15:53:44 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\Malwarebytes
2009-04-10 15:53:38 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-04-08 15:03:30 ----D---- C:\Programme\Adobe
2009-04-08 15:03:22 ----SHD---- C:\Config.Msi
2009-04-08 13:31:54 ----A---- C:\WINDOWS\system32\deploytk.dll
2009-04-07 15:21:51 ----D---- C:\WINDOWS\system32\AGEIA
2009-04-07 15:21:51 ----D---- C:\Programme\AGEIA Technologies
2009-03-31 10:32:19 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Adobe
2009-03-31 10:32:13 ----D---- C:\Programme\Gemeinsame Dateien\Adobe
2009-03-31 01:27:39 ----D---- C:\Programme\Gemeinsame Dateien\DivX Shared
2009-03-30 15:00:15 ----D---- C:\WINDOWS\Sun
2009-03-30 00:42:53 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\OpenOffice.org
2009-03-30 00:41:53 ----D---- C:\Programme\JRE
2009-03-30 00:41:51 ----D---- C:\Programme\OpenOffice.org 3
2009-03-30 00:41:45 ----A---- C:\WINDOWS\system32\javaws.exe
2009-03-30 00:41:45 ----A---- C:\WINDOWS\system32\javaw.exe
2009-03-30 00:41:45 ----A---- C:\WINDOWS\system32\java.exe
2009-03-30 00:41:31 ----D---- C:\Programme\Java
2009-03-30 00:41:30 ----D---- C:\Programme\Gemeinsame Dateien\Java
2009-03-30 00:41:25 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\Sun
2009-03-30 00:30:58 ----A---- C:\WINDOWS\system32\escwiad.dll
2009-03-30 00:30:13 ----D---- C:\Programme\EPSON
2009-03-30 00:30:09 ----A---- C:\WINDOWS\system32\E_DCINST.DLL
2009-03-30 00:30:07 ----A---- C:\WINDOWS\system32\E_FLBBIE.DLL
2009-03-30 00:30:07 ----A---- C:\WINDOWS\system32\E_FD4BBIE.DLL
2009-03-30 00:29:00 ----A---- C:\WINDOWS\epsswt_log.txt
2009-03-26 15:37:12 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\mIRC
2009-03-26 01:29:40 ----D---- C:\Programme\Gemeinsame Dateien\Blizzard Entertainment
2009-03-24 14:56:10 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\Bioshock
2009-03-24 14:55:09 ----RHD---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\SecuROM
2009-03-24 14:54:17 ----A---- C:\WINDOWS\system32\xactengine2_8.dll
2009-03-24 14:54:17 ----A---- C:\WINDOWS\system32\x3daudio1_2.dll
2009-03-24 14:54:17 ----A---- C:\WINDOWS\system32\d3dx9_34.dll
2009-03-24 14:54:17 ----A---- C:\WINDOWS\system32\d3dx10_34.dll
2009-03-24 14:54:17 ----A---- C:\WINDOWS\system32\D3DCompiler_34.dll
2009-03-24 14:54:16 ----A---- C:\WINDOWS\system32\xinput1_3.dll
2009-03-24 14:54:16 ----A---- C:\WINDOWS\system32\xactengine2_7.dll
2009-03-24 14:54:15 ----A---- C:\WINDOWS\system32\d3dx10_33.dll
2009-03-24 14:54:15 ----A---- C:\WINDOWS\system32\D3DCompiler_33.dll
2009-03-24 14:54:13 ----A---- C:\WINDOWS\system32\xactengine2_6.dll
2009-03-24 14:54:13 ----A---- C:\WINDOWS\system32\xactengine2_5.dll
2009-03-24 14:54:13 ----A---- C:\WINDOWS\system32\d3dx9_33.dll
2009-03-24 14:54:13 ----A---- C:\WINDOWS\system32\d3dx9_32.dll
2009-03-24 14:54:12 ----A---- C:\WINDOWS\system32\xinput1_2.dll
2009-03-24 14:54:12 ----A---- C:\WINDOWS\system32\xinput1_1.dll
2009-03-24 14:54:12 ----A---- C:\WINDOWS\system32\xactengine2_4.dll
2009-03-24 14:54:12 ----A---- C:\WINDOWS\system32\xactengine2_3.dll
2009-03-24 14:54:12 ----A---- C:\WINDOWS\system32\xactengine2_2.dll
2009-03-24 14:54:12 ----A---- C:\WINDOWS\system32\x3daudio1_1.dll
2009-03-24 14:54:12 ----A---- C:\WINDOWS\system32\d3dx9_31.dll
2009-03-24 14:54:11 ----A---- C:\WINDOWS\system32\xactengine2_1.dll
2009-03-24 14:54:07 ----A---- C:\WINDOWS\system32\xactengine2_0.dll
2009-03-24 14:54:07 ----A---- C:\WINDOWS\system32\x3daudio1_0.dll
2009-03-24 14:54:07 ----A---- C:\WINDOWS\system32\d3dx9_30.dll
2009-03-24 14:54:07 ----A---- C:\WINDOWS\system32\d3dx9_29.dll
2009-03-24 14:54:06 ----A---- C:\WINDOWS\system32\xinput9_1_0.dll
2009-03-24 14:54:06 ----A---- C:\WINDOWS\system32\d3dx9_28.dll
2009-03-24 14:54:06 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2009-03-24 14:54:06 ----A---- C:\WINDOWS\system32\d3dx9_26.dll
2009-03-24 14:54:05 ----A---- C:\WINDOWS\system32\d3dx9_25.dll
2009-03-24 14:54:04 ----A---- C:\WINDOWS\system32\d3dx9_24.dll
2009-03-24 14:53:12 ----A---- C:\WINDOWS\system32\CmdLineExt.dll
2009-03-22 16:30:29 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\teamspeak2
2009-03-22 02:14:58 ----HDC---- C:\WINDOWS\$NtUninstallKB959772_WM11$
2009-03-22 02:14:47 ----HDC---- C:\WINDOWS\$NtUninstallKB961118$
2009-03-22 02:14:44 ----HDC---- C:\WINDOWS\$NtUninstallKB954154_WM11$
2009-03-22 02:14:42 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-03-22 02:14:32 ----HDC---- C:\WINDOWS\$NtUninstallKB936782_WMP11$
2009-03-22 02:14:23 ----HDC---- C:\WINDOWS\$NtUninstallKB939683$
2009-03-22 02:14:09 ----HDC---- C:\WINDOWS\$NtUninstallKB941569$
2009-03-22 02:05:05 ----N---- C:\WINDOWS\system32\spmsg2.dll
2009-03-22 02:05:04 ----HDC---- C:\WINDOWS\$NtUninstallXPSEPSCLP$
2009-03-22 02:02:11 ----D---- C:\WINDOWS\system32\XPSViewer
2009-03-22 02:02:08 ----D---- C:\Programme\MSBuild
2009-03-22 02:02:07 ----D---- C:\WINDOWS\system32\en-US
2009-03-22 02:02:04 ----D---- C:\Programme\Reference Assemblies
2009-03-22 02:01:51 ----N---- C:\WINDOWS\system32\xpssvcs.dll
2009-03-22 02:01:51 ----N---- C:\WINDOWS\system32\xpsshhdr.dll
2009-03-22 02:01:51 ----N---- C:\WINDOWS\system32\prntvpt.dll
2009-03-22 02:01:30 ----RSD---- C:\WINDOWS\assembly
2009-03-22 02:01:13 ----D---- C:\WINDOWS\Microsoft.NET
2009-03-22 02:00:10 ----HDC---- C:\WINDOWS\$NtUninstallKB952069_WM9$
2009-03-22 02:00:07 ----HDC---- C:\WINDOWS\$NtUninstallKB954459$
2009-03-22 02:00:03 ----HDC---- C:\WINDOWS\$NtUninstallKB951978$
2009-03-22 01:59:35 ----D---- C:\WINDOWS\ie7updates
2009-03-22 01:59:23 ----D---- C:\WINDOWS\WBEM
2009-03-22 01:59:11 ----HDC---- C:\WINDOWS\ie7
2009-03-22 01:59:05 ----HDC---- C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$
2009-03-22 01:58:54 ----HDC---- C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$
2009-03-22 01:57:35 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\WinRAR
2009-03-22 01:56:47 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-03-22 01:56:45 ----HDC---- C:\WINDOWS\$NtUninstallMSCompPackV1$
2009-03-22 01:56:36 ----D---- C:\Programme\Windows Media Connect 2
2009-03-22 01:56:28 ----HDC---- C:\WINDOWS\$NtUninstallwmp11$
2009-03-22 01:55:59 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-03-22 01:55:43 ----D---- C:\WINDOWS\system32\LogFiles
2009-03-22 01:55:41 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-03-21 16:33:33 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\Ventrilo
2009-03-21 16:33:18 ----A---- C:\WINDOWS\{789289CA-F73A-4A16-A331-54D498CE069F}_WiseFW.ini
2009-03-21 16:30:00 ----D---- C:\Programme\Razer
2009-03-21 16:29:45 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\InstallShield
2009-03-21 16:28:15 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\Adobe
2009-03-21 15:29:16 ----HDC---- C:\WINDOWS\$NtUninstallKB951376-v2$
2009-03-21 15:29:03 ----HDC---- C:\WINDOWS\$NtUninstallKB952954$
2009-03-21 15:28:52 ----HDC---- C:\WINDOWS\$NtUninstallKB946648$
2009-03-21 15:28:41 ----HDC---- C:\WINDOWS\$NtUninstallKB956803$
2009-03-21 15:28:29 ----HDC---- C:\WINDOWS\$NtUninstallKB955839$
2009-03-21 15:27:54 ----HDC---- C:\WINDOWS\$NtUninstallKB958215$
2009-03-21 15:27:33 ----HDC---- C:\WINDOWS\$NtUninstallKB950974$
2009-03-21 15:27:18 ----HDC---- C:\WINDOWS\$NtUninstallKB951698$
2009-03-21 15:23:35 ----A---- C:\WINDOWS\system32\MRT.exe
2009-03-21 15:23:14 ----HDC---- C:\WINDOWS\$NtUninstallKB960225$
2009-03-21 15:22:35 ----HDC---- C:\WINDOWS\$NtUninstallKB956841$
2009-03-21 15:22:05 ----HDC---- C:\WINDOWS\$NtUninstallKB960714$
2009-03-21 15:22:03 ----HDC---- C:\WINDOWS\$NtUninstallKB938464-v2$
2009-03-21 15:22:01 ----HDC---- C:\WINDOWS\$NtUninstallKB950762$
2009-03-21 15:21:58 ----HDC---- C:\WINDOWS\$NtUninstallKB957097$
2009-03-21 15:21:55 ----HDC---- C:\WINDOWS\$NtUninstallKB960715$
2009-03-21 15:21:53 ----HDC---- C:\WINDOWS\$NtUninstallKB958687$
2009-03-21 15:21:50 ----HDC---- C:\WINDOWS\$NtUninstallKB952287$
2009-03-21 15:21:46 ----HDC---- C:\WINDOWS\$NtUninstallKB967715$
2009-03-21 15:21:43 ----HDC---- C:\WINDOWS\$NtUninstallKB950760$
2009-03-21 15:21:40 ----HDC---- C:\WINDOWS\$NtUninstallKB951066$
2009-03-21 15:21:37 ----HDC---- C:\WINDOWS\$NtUninstallKB958690$
2009-03-21 15:21:34 ----HDC---- C:\WINDOWS\$NtUninstallKB951748$
2009-03-21 15:21:31 ----HDC---- C:\WINDOWS\$NtUninstallKB954600$
2009-03-21 15:21:28 ----HDC---- C:\WINDOWS\$NtUninstallKB958644$
2009-03-21 15:21:25 ----HDC---- C:\WINDOWS\$NtUninstallKB955069$
2009-03-21 15:21:20 ----HDC---- C:\WINDOWS\$NtUninstallKB956802$
2009-03-21 15:18:56 ----D---- C:\Programme\Avira
2009-03-21 15:18:56 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2009-03-21 15:13:26 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\nView_Profiles
2009-03-21 15:12:58 ----D---- C:\WINDOWS\Prefetch
2009-03-21 15:09:59 ----D---- C:\WINDOWS\system32\de-de
2009-03-21 15:09:59 ----D---- C:\WINDOWS\system32\de
2009-03-21 15:09:59 ----D---- C:\WINDOWS\system32\bits
2009-03-21 15:09:59 ----D---- C:\WINDOWS\l2schemas
2009-03-21 15:09:18 ----D---- C:\WINDOWS\ServicePackFiles
2009-03-21 15:08:36 ----D---- C:\WINDOWS\network diagnostic
2009-03-21 15:07:47 ----HDC---- C:\WINDOWS\$NtServicePackUninstall$
2009-03-21 15:07:46 ----D---- C:\WINDOWS\EHome
2009-03-21 15:01:45 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Windows Genuine Advantage
2009-03-21 15:01:40 ----D---- C:\WINDOWS\system32\PreInstall
2009-03-21 15:01:39 ----A---- C:\WINDOWS\system32\spupdsvc.exe
2009-03-21 15:01:38 ----HDC---- C:\WINDOWS\$NtUninstallKB898461$
2009-03-21 15:01:38 ----HD---- C:\WINDOWS\$hf_mig$
2009-03-21 15:00:10 ----SHD---- C:\RECYCLER
2009-03-21 14:59:39 ----D---- C:\Programme\Samsung UbiSync Monitor
2009-03-21 14:59:34 ----D---- C:\Programme\DisplayLink Core Software
2009-03-21 14:59:15 ----RA---- C:\WINDOWS\system32\DisplayLinkUsbCo2.dll
2009-03-21 14:54:42 ----A---- C:\WINDOWS\system32\dev32.exe
2009-03-21 14:53:57 ----N---- C:\WINDOWS\system32\ChCfg.exe
2009-03-21 14:53:57 ----N---- C:\WINDOWS\alcupd.exe
2009-03-21 14:53:57 ----N---- C:\WINDOWS\alcrmv.exe
2009-03-21 14:53:57 ----A---- C:\WINDOWS\system32\RTLCPL.EXE
2009-03-21 14:53:57 ----A---- C:\WINDOWS\system32\RTLCPAPI.dll
2009-03-21 14:53:57 ----A---- C:\WINDOWS\system32\Audio3D.dll
2009-03-21 14:53:57 ----A---- C:\WINDOWS\system32\a3d.dll
2009-03-21 14:53:57 ----A---- C:\WINDOWS\SOUNDMAN.EXE
2009-03-21 14:50:57 ----D---- C:\Programme\DIFX
2009-03-21 14:50:55 ----DC---- C:\WINDOWS\system32\DRVSTORE
2009-03-21 14:40:04 ----D---- C:\Programme\Gemeinsame Dateien\Wise Installation Wizard
2009-03-21 14:39:40 ----HDC---- C:\WINDOWS\$MSI31Uninstall_KB893803v2$
2009-03-21 14:39:13 ----D---- C:\WINDOWS\nview
2009-03-21 14:39:13 ----A---- C:\WINDOWS\system32\nvudisp.exe
2009-03-21 14:39:01 ----A---- C:\WINDOWS\system32\NVUNINST.EXE
2009-03-21 14:38:51 ----D---- C:\NVIDIA
2009-03-21 14:33:43 ----D---- C:\Programme\SystemRequirementsLab
2009-03-21 14:33:15 ----A---- C:\WINDOWS\system32\wpa.bak
2009-03-21 14:29:31 ----D---- C:\WINDOWS\system32\SoftwareDistribution
2009-03-21 14:29:12 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\Macromedia
2009-03-21 14:26:39 ----N---- C:\WINDOWS\system32\UnLAN.exe
2009-03-21 14:26:39 ----N---- C:\WINDOWS\system32\rmlan.exe
2009-03-21 14:23:55 ----D---- C:\WINDOWS\system32\ReinstallBackups
2009-03-21 14:23:54 ----N---- C:\WINDOWS\system32\unagp.exe
2009-03-21 14:23:54 ----N---- C:\WINDOWS\system32\rmagp.exe
2009-03-21 14:23:54 ----HD---- C:\Programme\InstallShield Installation Information
2009-03-21 14:23:41 ----D---- C:\Programme\Gemeinsame Dateien\InstallShield
2009-03-21 14:16:12 ----A---- C:\WINDOWS\Ascd_tmp.ini
2009-03-21 04:33:16 ----D---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\Identities
2009-03-21 04:33:15 ----HD---- C:\Programme\Uninstall Information
2009-03-21 04:33:02 ----ASH---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\desktop.ini
2009-03-21 04:33:01 ----SD---- C:\Dokumente und Einstellungen\Razer SLOne\Anwendungsdaten\Microsoft
2009-03-21 04:31:32 ----D---- C:\WINDOWS\SoftwareDistribution
2009-03-21 04:31:30 ----SD---- C:\WINDOWS\system32\Microsoft
2009-03-21 04:31:30 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-03-20 19:02:25 ----SHD---- C:\System Volume Information
2009-03-20 19:02:12 ----RSH---- C:\boot.ini
2009-03-20 18:55:48 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-03-20 18:55:48 ----RSD---- C:\WINDOWS\Fonts
2009-03-20 18:55:48 ----RD---- C:\WINDOWS\Web
2009-03-20 18:55:48 ----HD---- C:\WINDOWS\inf

2009-03-20 18:55:48 ----D---- C:\WINDOWS\WinSxS
2009-03-20 18:55:48 ----D---- C:\WINDOWS\twain_32
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Temp
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\wins
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\wbem
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\usmt
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\spool
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\ShellExt
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\Setup
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\ras
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\oobe
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\npp
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\mui
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\inetsrv
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\IME
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\icsxml
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\ias
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\export
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\drivers
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\dhcp
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\config
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\3com_dmi
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\3076
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\2052
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\1054
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\1042
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\1041
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\1037
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\1033
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\1031
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\1028
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32\1025
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system32
2009-03-20 18:55:48 ----D---- C:\WINDOWS\system
2009-03-20 18:55:48 ----D---- C:\WINDOWS\security
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Resources
2009-03-20 18:55:48 ----D---- C:\WINDOWS\repair
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Provisioning
2009-03-20 18:55:48 ----D---- C:\WINDOWS\PeerNet
2009-03-20 18:55:48 ----D---- C:\WINDOWS\pchealth
2009-03-20 18:55:48 ----D---- C:\WINDOWS\mui
2009-03-20 18:55:48 ----D---- C:\WINDOWS\msapps
2009-03-20 18:55:48 ----D---- C:\WINDOWS\msagent
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Media
2009-03-20 18:55:48 ----D---- C:\WINDOWS\java
2009-03-20 18:55:48 ----D---- C:\WINDOWS\ime
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Help
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Driver Cache
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Debug
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Cursors
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Connection Wizard
2009-03-20 18:55:48 ----D---- C:\WINDOWS\Config
2009-03-20 18:55:48 ----D---- C:\WINDOWS\AppPatch
2009-03-20 18:55:48 ----D---- C:\WINDOWS\addins
2009-03-20 18:55:48 ----D---- C:\WINDOWS
2009-03-20 18:20:57 ----D---- C:\WINDOWS\system32\xircom
2009-03-20 18:20:57 ----D---- C:\Programme\xerox
2009-03-20 18:20:57 ----D---- C:\Programme\microsoft frontpage
2009-03-20 18:20:45 ----A---- C:\WINDOWS\control.ini
2009-03-20 18:20:45 ----A---- C:\AUTOEXEC.BAT
2009-03-20 18:20:32 ----A---- C:\WINDOWS\OEWABLog.txt
2009-03-20 18:20:29 ----A---- C:\WINDOWS\system32\mapi32.dll
2009-03-20 18:19:56 ----SD---- C:\WINDOWS\Downloaded Program Files
2009-03-20 18:19:56 ----RD---- C:\WINDOWS\Offline Web Pages
2009-03-20 18:19:56 ----RAH---- C:\WINDOWS\system32\logonui.exe.manifest
2009-03-20 18:19:51 ----RAH---- C:\WINDOWS\system32\cdplayer.exe.manifest
2009-03-20 18:19:48 ----HD---- C:\Programme\WindowsUpdate
2009-03-20 18:19:45 ----D---- C:\Programme\Online-Dienste
2009-03-20 18:19:31 ----D---- C:\WINDOWS\system32\DirectX
2009-03-20 18:19:10 ----A---- C:\WINDOWS\system32\atrace.dll
2009-03-20 18:19:06 ----A---- C:\WINDOWS\system32\desktop.ini
2009-03-20 18:19:06 ----A---- C:\WINDOWS\desktop.ini
2009-03-20 18:19:00 ----A---- C:\WINDOWS\system32\nmevtmsg.dll
2009-03-20 18:18:58 ----D---- C:\Programme\Gemeinsame Dateien\Dienste
2009-03-20 18:18:58 ----A---- C:\WINDOWS\system32\acctres.dll
2009-03-20 18:18:55 ----SD---- C:\WINDOWS\Tasks
2009-03-20 18:18:55 ----A---- C:\WINDOWS\system32\icfgnt5.dll
2009-03-20 18:18:54 ----D---- C:\Programme\Gemeinsame Dateien\MSSoap
2009-03-20 18:18:49 ----D---- C:\WINDOWS\srchasst
2009-03-20 18:18:48 ----D---- C:\WINDOWS\system32\Macromed
2009-03-20 18:18:45 ----A---- C:\WINDOWS\system32\wuweb.dll
2009-03-20 18:18:45 ----A---- C:\WINDOWS\system32\wucltui.dll
2009-03-20 18:18:44 ----A---- C:\WINDOWS\system32\wups.dll
2009-03-20 18:18:44 ----A---- C:\WINDOWS\system32\wuauserv.dll
2009-03-20 18:18:44 ----A---- C:\WINDOWS\system32\wuaueng1.dll
2009-03-20 18:18:44 ----A---- C:\WINDOWS\system32\wuaueng.dll
2009-03-20 18:18:44 ----A---- C:\WINDOWS\system32\wuauclt1.exe
2009-03-20 18:18:44 ----A---- C:\WINDOWS\system32\wuauclt.exe
2009-03-20 18:18:44 ----A---- C:\WINDOWS\system32\wuapi.dll
2009-03-20 18:18:43 ----A---- C:\WINDOWS\system32\qmgrprxy.dll
2009-03-20 18:18:43 ----A---- C:\WINDOWS\system32\qmgr.dll
2009-03-20 18:18:43 ----A---- C:\WINDOWS\system32\bitsprx3.dll
2009-03-20 18:18:43 ----A---- C:\WINDOWS\system32\bitsprx2.dll
2009-03-20 18:18:38 ----D---- C:\Programme\Movie Maker
2009-03-20 18:18:34 ----A---- C:\WINDOWS\system32\safrslv.dll
2009-03-20 18:18:34 ----A---- C:\WINDOWS\system32\safrdm.dll
2009-03-20 18:18:34 ----A---- C:\WINDOWS\system32\safrcdlg.dll
2009-03-20 18:18:34 ----A---- C:\WINDOWS\system32\racpldlg.dll
2009-03-20 18:18:30 ----A---- C:\WINDOWS\system32\fltmc.exe
2009-03-20 18:18:30 ----A---- C:\WINDOWS\system32\fltlib.dll
2009-03-20 18:18:29 ----D---- C:\WINDOWS\system32\Restore
2009-03-20 18:18:29 ----A---- C:\WINDOWS\system32\srsvc.dll

2009-03-20 18:18:29 ----A---- C:\WINDOWS\system32\srrstr.dll
2009-03-20 18:18:29 ----A---- C:\WINDOWS\system32\srclient.dll
2009-03-20 18:18:29 ----A---- C:\WINDOWS\system32\ils.dll
2009-03-20 18:18:28 ----A---- C:\WINDOWS\system32\nmmkcert.dll
2009-03-20 18:18:28 ----A---- C:\WINDOWS\system32\msconf.dll
2009-03-20 18:18:28 ----A---- C:\WINDOWS\system32\mnmsrvc.exe
2009-03-20 18:18:28 ----A---- C:\WINDOWS\system32\mnmdd.dll
2009-03-20 18:18:28 ----A---- C:\WINDOWS\system32\isrdbg32.dll
2009-03-20 18:18:25 ----D---- C:\Programme\NetMeeting
2009-03-20 18:18:25 ----A---- C:\WINDOWS\system32\msoert2.dll
2009-03-20 18:18:25 ----A---- C:\WINDOWS\system32\msoeacct.dll
2009-03-20 18:18:24 ----A---- C:\WINDOWS\system32\inetres.dll
2009-03-20 18:18:23 ----A---- C:\WINDOWS\system32\inetcomm.dll
2009-03-20 18:18:20 ----D---- C:\Programme\Outlook Express
2009-03-20 18:18:20 ----A---- C:\WINDOWS\system32\schedsvc.dll
2009-03-20 18:18:20 ----A---- C:\WINDOWS\system32\mstinit.exe
2009-03-20 18:18:20 ----A---- C:\WINDOWS\system32\mstask.dll
2009-03-20 18:18:20 ----A---- C:\WINDOWS\system32\icwphbk.dll
2009-03-20 18:18:20 ----A---- C:\WINDOWS\system32\icwdial.dll
2009-03-20 18:18:19 ----A---- C:\WINDOWS\system32\isign32.dll
2009-03-20 18:18:19 ----A---- C:\WINDOWS\system32\inetcfg.dll
2009-03-20 18:18:13 ----D---- C:\Programme\Gemeinsame Dateien\System
2009-03-20 18:18:12 ----D---- C:\Programme\Internet Explorer
2009-03-20 18:18:03 ----D---- C:\Programme\ComPlus Applications
2009-03-20 18:18:01 ----A---- C:\WINDOWS\vbaddin.ini
2009-03-20 18:18:01 ----A---- C:\WINDOWS\vb.ini
2009-03-20 18:17:58 ----D---- C:\WINDOWS\Registration
2009-03-20 18:17:37 ----D---- C:\Programme\Windows Media Player
2009-03-20 18:17:37 ----D---- C:\Programme\Online Services
2009-03-20 18:17:33 ----D---- C:\Programme\Messenger
2009-03-20 18:17:28 ----D---- C:\Programme\MSN Gaming Zone
2009-03-20 18:17:28 ----A---- C:\WINDOWS\system32\write.exe
2009-03-20 18:17:20 ----A---- C:\WINDOWS\system32\sndvol32.exe
2009-03-20 18:17:20 ----A---- C:\WINDOWS\system32\hticons.dll
2009-03-20 18:17:20 ----A---- C:\WINDOWS\system32\avwav.dll
2009-03-20 18:17:20 ----A---- C:\WINDOWS\system32\avtapi.dll
2009-03-20 18:17:20 ----A---- C:\WINDOWS\system32\avmeter.dll
2009-03-20 18:17:19 ----A---- C:\WINDOWS\system32\winchat.exe
2009-03-20 18:17:12 ----A---- C:\WINDOWS\system32\getuname.dll
2009-03-20 18:17:11 ----A---- C:\WINDOWS\system32\winmine.exe
2009-03-20 18:17:11 ----A---- C:\WINDOWS\system32\sol.exe
2009-03-20 18:17:11 ----A---- C:\WINDOWS\system32\charmap.exe
2009-03-20 18:17:11 ----A---- C:\WINDOWS\system32\calc.exe
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\usrlogon.cmd
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\tsshutdn.exe
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\tslabels.ini
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\tskill.exe
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\tsdiscon.exe
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\tscon.exe
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\shadow.exe
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\reset.exe
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\mshearts.exe
2009-03-20 18:17:10 ----A---- C:\WINDOWS\system32\freecell.exe
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\rwinsta.exe
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\regini.exe
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\rdpcfgex.dll
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\qwinsta.exe
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\qappsrv.exe
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\msg.exe
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\msdtcprf.ini
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\logoff.exe
2009-03-20 18:17:09 ----A---- C:\WINDOWS\system32\cdmodem.dll
2009-03-20 18:17:08 ----A---- C:\WINDOWS\system32\mtxlegih.dll
2009-03-20 18:17:08 ----A---- C:\WINDOWS\system32\mtxex.dll
2009-03-20 18:17:08 ----A---- C:\WINDOWS\system32\mtxdm.dll
2009-03-20 18:17:08 ----A---- C:\WINDOWS\system32\dcomcnfg.exe
2009-03-20 18:17:08 ----A---- C:\WINDOWS\system32\comrepl.dll
2009-03-20 18:17:08 ----A---- C:\WINDOWS\system32\comaddin.dll
2009-03-20 18:17:07 ----A---- C:\WINDOWS\system32\stclient.dll
2009-03-20 18:17:07 ----A---- C:\WINDOWS\system32\comsnap.dll
2009-03-20 18:17:03 ----A---- C:\WINDOWS\system32\wmimgmt.msc
2009-03-20 18:16:51 ----D---- C:\Programme\MSN
2009-03-20 18:16:51 ----A---- C:\WINDOWS\system32\accwiz.exe
2009-03-20 18:16:50 ----A---- C:\WINDOWS\system32\sndrec32.exe
2009-03-20 18:16:50 ----A---- C:\WINDOWS\system32\mplay32.exe
2009-03-20 18:16:50 ----A---- C:\WINDOWS\system32\hypertrm.dll
2009-03-20 18:16:49 ----D---- C:\Programme\Windows NT
2009-03-20 18:16:49 ----A---- C:\WINDOWS\system32\spider.exe
2009-03-20 18:16:49 ----A---- C:\WINDOWS\system32\mspaint.exe
2009-03-20 18:16:49 ----A---- C:\WINDOWS\system32\clipbrd.exe
2009-03-20 18:16:48 ----A---- C:\WINDOWS\system32\tscfgwmi.dll
2009-03-20 18:16:48 ----A---- C:\WINDOWS\system32\mstscax.dll
2009-03-20 18:16:48 ----A---- C:\WINDOWS\system32\mstsc.exe
2009-03-20 18:16:47 ----A---- C:\WINDOWS\system32\tscupgrd.exe
2009-03-20 18:16:47 ----A---- C:\WINDOWS\system32\termsrv.dll
2009-03-20 18:16:47 ----A---- C:\WINDOWS\system32\sessmgr.exe
2009-03-20 18:16:47 ----A---- C:\WINDOWS\system32\remotepg.dll
2009-03-20 18:16:47 ----A---- C:\WINDOWS\system32\rdshost.exe
2009-03-20 18:16:47 ----A---- C:\WINDOWS\system32\rdsaddin.exe
2009-03-20 18:16:47 ----A---- C:\WINDOWS\system32\rdchost.dll
2009-03-20 18:16:46 ----D---- C:\WINDOWS\system32\MsDtc
2009-03-20 18:16:46 ----A---- C:\WINDOWS\system32\rdpwsx.dll
2009-03-20 18:16:46 ----A---- C:\WINDOWS\system32\rdpsnd.dll
2009-03-20 18:16:46 ----A---- C:\WINDOWS\system32\rdpclip.exe
2009-03-20 18:16:46 ----A---- C:\WINDOWS\system32\qprocess.exe
2009-03-20 18:16:46 ----A---- C:\WINDOWS\system32\mtxoci.dll
2009-03-20 18:16:46 ----A---- C:\WINDOWS\system32\msdtcuiu.dll
2009-03-20 18:16:46 ----A---- C:\WINDOWS\system32\icaapi.dll
2009-03-20 18:16:46 ----A---- C:\WINDOWS\system32\cfgbkend.dll
2009-03-20 18:16:45 ----A---- C:\WINDOWS\system32\xolehlp.dll
2009-03-20 18:16:45 ----A---- C:\WINDOWS\system32\msdtctm.dll
2009-03-20 18:16:45 ----A---- C:\WINDOWS\system32\msdtcprx.dll
2009-03-20 18:16:45 ----A---- C:\WINDOWS\system32\msdtclog.dll
2009-03-20 18:16:45 ----A---- C:\WINDOWS\system32\msdtc.exe
2009-03-20 18:16:44 ----D---- C:\WINDOWS\system32\Com
2009-03-20 18:16:44 ----A---- C:\WINDOWS\system32\colbact.dll
2009-03-20 18:16:43 ----A---- C:\WINDOWS\system32\clbcatex.dll
2009-03-20 18:16:43 ----A---- C:\WINDOWS\system32\catsrvut.dll
2009-03-20 18:16:43 ----A---- C:\WINDOWS\system32\catsrvps.dll
2009-03-20 18:16:43 ----A---- C:\WINDOWS\system32\catsrv.dll
2009-03-20 18:16:42 ----A---- C:\WINDOWS\system32\comuid.dll
2009-03-20 18:16:42 ----A---- C:\WINDOWS\system32\comsvcs.dll
2009-03-20 18:16:42 ----A---- C:\WINDOWS\system32\clbcatq.dll
2009-03-20 18:16:37 ----A---- C:\WINDOWS\system32\servdeps.dll
2009-03-20 18:16:36 ----A---- C:\WINDOWS\system32\mmfutil.dll
2009-03-20 18:16:36 ----A---- C:\WINDOWS\system32\licwmi.dll
2009-03-20 18:16:36 ----A---- C:\WINDOWS\system32\cmprops.dll
2009-03-20 18:15:37 ----A---- C:\WINDOWS\system32\h323log.txt
2009-03-20 18:08:12 ----A---- C:\WINDOWS\system32\vfwwdm32.dll
2009-03-20 18:08:08 ----A---- C:\WINDOWS\system32\hidserv.dll
2009-03-20 18:08:05 ----A---- C:\WINDOWS\system32\ksuser.dll
2009-03-20 18:06:58 ----A---- C:\WINDOWS\system32\usbui.dll
2009-03-20 18:06:07 ----A---- C:\WINDOWS\imsins.BAK
2009-03-20 18:06:05 ----SHD---- C:\WINDOWS\Installer
2009-03-20 18:06:05 ----A---- C:\WINDOWS\system32\PerfStringBackup.INI
2009-03-20 18:06:04 ----D---- C:\Programme\Gemeinsame Dateien\ODBC
2009-03-20 18:06:04 ----A---- C:\WINDOWS\ODBCINST.INI
2009-03-20 18:06:01 ----D---- C:\Programme\Gemeinsame Dateien\SpeechEngines
2009-03-20 18:06:00 ----RD---- C:\Programme
2009-03-20 18:06:00 ----D---- C:\Programme\Gemeinsame Dateien\Microsoft Shared
2009-03-20 18:06:00 ----D---- C:\Programme\Gemeinsame Dateien
2009-03-20 18:05:56 ----RA---- C:\WINDOWS\system32\kbdtuq.dll
2009-03-20 18:05:56 ----RA---- C:\WINDOWS\system32\kbdtuf.dll
2009-03-20 18:05:56 ----RA---- C:\WINDOWS\system32\kbdazel.dll
2009-03-20 18:05:55 ----RA---- C:\WINDOWS\system32\kbdkyr.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdycc.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbduzb.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdur.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdtat.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdru1.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdru.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdmon.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdkaz.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdbu.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdblr.dll
2009-03-20 18:05:54 ----RA---- C:\WINDOWS\system32\kbdaze.dll
2009-03-20 18:05:52 ----RA---- C:\WINDOWS\system32\kbdhept.dll
2009-03-20 18:05:52 ----RA---- C:\WINDOWS\system32\kbdhela3.dll
2009-03-20 18:05:52 ----RA---- C:\WINDOWS\system32\kbdhela2.dll
2009-03-20 18:05:52 ----RA---- C:\WINDOWS\system32\kbdhe319.dll
2009-03-20 18:05:52 ----RA---- C:\WINDOWS\system32\kbdhe220.dll
2009-03-20 18:05:52 ----RA---- C:\WINDOWS\system32\kbdhe.dll
2009-03-20 18:05:52 ----RA---- C:\WINDOWS\system32\kbdgkl.dll
2009-03-20 18:05:51 ----RA---- C:\WINDOWS\system32\kbdlt1.dll
2009-03-20 18:05:50 ----RA---- C:\WINDOWS\system32\kbdlv1.dll
2009-03-20 18:05:50 ----RA---- C:\WINDOWS\system32\kbdlv.dll
2009-03-20 18:05:50 ----RA---- C:\WINDOWS\system32\kbdlt.dll
2009-03-20 18:05:50 ----RA---- C:\WINDOWS\system32\kbdest.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdycl.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdsl1.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdsl.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdro.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdpl1.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdpl.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdhu1.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdhu.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdcz2.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdcz1.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdcz.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\kbdcr.dll
2009-03-20 18:05:48 ----RA---- C:\WINDOWS\system32\KBDAL.DLL
2009-03-20 18:05:46 ----A---- C:\WINDOWS\system32\irclass.dll
2009-03-20 18:05:46 ----A---- C:\WINDOWS\system32\dgsetup.dll
2009-03-20 18:05:46 ----A---- C:\WINDOWS\system32\dgrpsetu.dll
2009-03-20 18:05:45 ----A---- C:\WINDOWS\system32\spxcoins.dll
2009-03-20 18:05:45 ----A---- C:\WINDOWS\system32\EqnClass.Dll
2009-03-20 18:05:43 ----N---- C:\WINDOWS\system32\CONFIG.TMP
2009-03-20 18:05:43 ----A---- C:\WINDOWS\TASKMAN.EXE
2009-03-20 18:05:43 ----A---- C:\WINDOWS\system32\batt.dll
2009-03-20 18:05:42 ----A---- C:\WINDOWS\notepad.exe
2009-03-20 18:05:41 ----A---- C:\WINDOWS\system32\storprop.dll
2009-03-20 18:05:35 ----ASH---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\desktop.ini
2009-03-20 18:03:54 ----RA---- C:\WINDOWS\SET8.tmp
2009-03-20 18:03:51 ----RA---- C:\WINDOWS\SET4.tmp
2009-03-20 18:03:50 ----RA---- C:\WINDOWS\SET3.tmp
2009-03-20 18:03:45 ----D---- C:\WINDOWS\system32\CatRoot2
2009-03-20 18:03:45 ----D---- C:\WINDOWS\system32\CatRoot
2009-03-20 18:03:39 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
2009-03-20 18:03:16 ----A---- C:\WINDOWS\setuplog.txt
2009-03-20 18:03:14 ----D---- C:\Dokumente und Einstellungen

======List of files/folders modified in the last 1 months======

2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nwiz.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwssr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwss.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrszht.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrszhc.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrstr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsth.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrssv.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrssl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrssk.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsru.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsptb.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrspt.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrspl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsno.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsnl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsko.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsja.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsit.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrshu.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrshe.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsfr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsfi.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsesm.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrses.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrseng.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsel.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsde.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsda.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrscs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwrsar.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwimg.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwdmcpl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvwddi.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvvitvsr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvvitvs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvsvc32.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvshell.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrszht.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrszhc.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrstr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsth.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrssv.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrssl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrssk.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsru.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsptb.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrspt.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrspl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsno.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsnl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsko.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsja.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsit.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrshu.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrshe.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsfr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsfi.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsesm.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrses.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrseng.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsel.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsde.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsda.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrscs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvrsar.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvoglnt.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmoblsr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmobls.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmctray.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmccssr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmccss.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmccsrs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvmccs.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nview.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvgamesr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvgames.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvdspsch.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvdispsr.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvdisps.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcuvid.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcuda.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcpluir.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcplui.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcpl.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcolor.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcodins.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvcod.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvappbar.exe
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nvapi.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\nv4_disp.dll
2009-03-27 10:03:00 ----A---- C:\WINDOWS\system32\keystone.exe
2009-03-22 01:56:40 ----A---- C:\WINDOWS\win.ini
2009-03-20 18:05:59 ----A---- C:\WINDOWS\system.ini

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 AmdK8;AMD-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\AmdK8.sys [2006-05-10 43520]
R1 ATITool;ATITool Overclocking Utility; C:\WINDOWS\system32\DRIVERS\ATITool.sys [2006-11-10 24064]
R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-02-13 95576]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-02-13 28376]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-02-13 55640]
R3 ALCXSENS;Service for WDM 3D Audio Driver; C:\WINDOWS\system32\drivers\ALCXSENS.SYS [2004-02-24 400384]
R3 ALCXWDM;Service for Realtek AC97 Audio (WDM); C:\WINDOWS\system32\drivers\ALCXWDM.SYS [2004-08-02 635281]
R3 DisplayLinkGA;DisplayLinkGA; C:\WINDOWS\system32\DRIVERS\DisplayLinkGAport.sys [2007-03-09 25704]
R3 DisplayLinkmirror;DisplayLinkmirror; C:\WINDOWS\system32\DRIVERS\DisplayLinkmirrorport.sys [2007-03-09 23400]
R3 DisplayLinkUsbPort;DisplayLink USB Device; C:\WINDOWS\system32\DRIVERS\DisplayLinkUsbPort.sys [2007-11-26 20992]
R3 hidusb;HID Class Driver; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 MBAMSwissArmy;MBAMSwissArmy; \??\C:\WINDOWS\system32\drivers\mbamswissarmy.sys []
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2004-08-04 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2009-03-27 6280416]
R3 ULI5261XP;ULi M526X Ethernet NT Driver; C:\WINDOWS\system32\DRIVERS\ULILAN51.SYS [2005-03-22 28672]
R3 usbaudio;USB-Audiotreiber (WDM); C:\WINDOWS\system32\drivers\usbaudio.sys [2008-04-13 60032]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 UsbFltr;Razer Copperhead Driver; C:\WINDOWS\system32\drivers\copperhd.sys [2005-11-02 11596]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbohci;Miniporttreiber für Microsoft USB Open Host-Controller; C:\WINDOWS\system32\DRIVERS\usbohci.sys [2008-04-13 17152]
R3 usbvideo;USB-Videogerät (WDM); C:\WINDOWS\System32\Drivers\usbvideo.sys [2008-04-13 121984]
S1 kbdqadyt;kbdqadyt; \??\C:\WINDOWS\system32\drivers\kbdqadyt.sys []
S3 CCDECODE;Untertiteldecoder; C:\WINDOWS\system32\DRIVERS\CCDECODE.sys [2008-04-13 17024]
S3 MSTEE;Microsoft Streaming Tee/Sink-to-Sink-Konvertierung; C:\WINDOWS\system32\drivers\MSTEE.sys [2008-04-13 5504]
S3 NABTSFEC;NABTS/FEC VBI-Codec; C:\WINDOWS\system32\DRIVERS\NABTSFEC.sys [2008-04-13 85248]
S3 NdisIP;Microsoft TV-/Videoverbindung; C:\WINDOWS\system32\DRIVERS\NdisIP.sys [2008-04-13 10880]
S3 SLIP;BDA Slip De-Framer; C:\WINDOWS\system32\DRIVERS\SLIP.sys [2008-04-13 11136]
S3 streamip;BDA-IPSink; C:\WINDOWS\system32\DRIVERS\StreamIP.sys [2008-04-13 15232]
S3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
S3 usbscan;USB-Scannertreiber; C:\WINDOWS\system32\DRIVERS\usbscan.sys [2008-04-13 15104]
S3 USBSTOR;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 WSTCODEC;World Standard Teletext-Codec; C:\WINDOWS\system32\DRIVERS\WSTCODEC.SYS [2008-04-13 19200]
S3 WudfPf;Windows Driver Foundation - User-mode Driver Framework Platform Driver; C:\WINDOWS\system32\DRIVERS\WudfPf.sys [2006-09-28 77568]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-03-05 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-03-02 185089]
R2 DisplayLinkService;DisplayLink Service; C:\Programme\DisplayLink Core Software\DisplayLinkService.exe [2008-03-12 439656]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-04-08 152984]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2009-03-27 163908]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\aspnet_state.exe [2008-07-25 34312]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2008-07-25 69632]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.NET\Framework\v3.0\WPF\PresentationFontCache.exe [2008-07-29 46104]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2008-07-29 881664]
S3 WMPNetworkSvc;Windows Media Player-Netzwerkfreigabedienst; C:\Programme\Windows Media Player\WMPNetwk.exe [2006-11-03 920576]
S3 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2008-07-29 132096]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.06 2009-04-10 16:17:48

======Uninstall list======

-->MsiExec /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Reader 9.1 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A91000000001}
ANNO 1503-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{EBBB1DEF-8878-4CB8-BC0D-1196B30E7527}\Setup.exe" -l0x7
ATITool Overclocking Utility-->"D:\Programme\ATITool\Uninstall.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
BioShock-->C:\Programme\InstallShield Installation Information\{E280923D-C5D9-4728-8C79-AC9A0DC75875}\Setup.exe -runfromtemp -l0x0007 -removeonly
Curse Client-->D:\Programme\Curse\uninstall.exe
Die Siedler II - Die nächste Generation-->"D:\Programme\Die Siedler II - Die nächste Generation\uninstall.exe"
DisplayLink Core Software-->MsiExec.exe /X{3DCDBE35-7C05-4E50-8F57-6C9DF692AF94}
DivX Web Player-->D:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
EPSON Scan-->C:\Programme\epson\escndv\setup\setup.exe /r
EPSON-Drucker-Software-->C:\WINDOWS\System32\spool\DRIVERS\W32X86\3\EPUPDATE.EXE /R
HijackThis 2.0.2-->"D:\Programme\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix für Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB961118)-->"C:\WINDOWS\$NtUninstallKB961118$\spuninst\spuninst.exe"
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216013FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Malwarebytes' Anti-Malware-->"D:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - DEU-->MsiExec.exe /I{C314CE45-3392-3B73-B4E1-139CD41CA933}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - DEU-->MsiExec.exe /I{C2C284D2-6BD7-3B34-B0C5-B2CAED168DF7}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - deu\setup.exe
Microsoft .NET Framework 3.5 Language Pack SP1 - deu-->MsiExec.exe /I{052FDD78-A6EA-3187-8386-C82F4CA3A929}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
mIRC-->D:\Programme\mIRC\uninstall.exe _?=D:\Programme\mIRC
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
NVIDIA PhysX-->MsiExec.exe /X{DD1865F0-AD73-40FB-B23E-1822E02396FF}
OpenOffice.org 3.0-->MsiExec.exe /I{7EC19307-7C22-47A8-922B-3FA965291260}
Razer Copperhead-->C:\Programme\InstallShield Installation Information\{28A946E1-E83B-4662-BC7C-23451851489E}\setup.exe -runfromtemp -l0x0009 -removeonly
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Samsung UbiSync Monitor-->MsiExec.exe /X{ECAD7145-5281-485A-A4BD-38900CE08D66}
Sicherheitsupdate für Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB956390)-->"C:\WINDOWS\ie7updates\KB956390-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Sicherheitsupdate für Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB941569)-->"C:\WINDOWS\$NtUninstallKB941569$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950760)-->"C:\WINDOWS\$NtUninstallKB950760$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
System Requirements Lab-->C:\Programme\SystemRequirementsLab\Uninstall.exe
TeamSpeak 2 RC2-->D:\Programme\Teamspeak2\unins000.exe
ULi AGP Driver -->C:\WINDOWS\system32\UnAGP.EXE RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0DD0650C-5113-4FEE-BDDA-AC0B76FD0BD1}\Setup.exe"  -uninst
ULi LAN Driver-->C:\WINDOWS\system32\UnLAN.EXE RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{143BE018-D8F8-4014-8CB6-AF63F5799D21}\Setup.exe"  -uninst
ULi SATA Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FDC53DC6-137A-4541-BFA2-A9BAE4A7FE99}\Setup.exe" -l0x9  -removeonly
Update für Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update für Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update für Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Wichtiges Update für Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Windows Internet Explorer 7-->"C:\WINDOWS\ie7\spuninst\spuninst.exe"
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
Windows-Treiberpaket - Advanced Micro Devices (AmdK8) Processor  (04/28/2006 1.3.1.0)-->C:\PROGRA~1\DIFX\7B44739871F4D539FA473F57A832EA4B6A59EF06\DPInst.exe /d /u C:\WINDOWS\system32\DRVSTORE\amdk8_46A23DA005A38EDACA9A5DA30EC2FEBF00D83D18\amdk8.inf
WinRAR-->D:\Programme\WinRAR\uninstall.exe
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: SVEN
Event Code: 15007
Message: Die von URL-Präfix "http://*:2869/" identifizierte Namespacereservierung wurde erfolgreich hinzugefügt.

Record Number: 5
Source Name: HTTP
Time Written: 20090320171947.000000+060
Event Type: Informationen
User:

Computer Name: SVEN
Event Code: 6011
Message: Der NetBIOS-Name und DNS-Hostname dieses Computers wurden von MACHINENAME in SVEN geändert.

Record Number: 4
Source Name: EventLog
Time Written: 20090320171558.000000+060
Event Type: Informationen
User:

Computer Name: MACHINENAME
Event Code: 2
Message: Bei der Überprüfung, ob \Device\Serial0 ein serieller Anschluss ist, wurde ein FIFO-Baustein entdeckt. Es wird der FIFO-Baustein verwendet.

Record Number: 3
Source Name: Serial
Time Written: 20090320170337.000000+060
Event Type: Informationen
User:

Computer Name: MACHINENAME
Event Code: 6005
Message: Der Ereignisprotokolldienst wurde gestartet.

Record Number: 2
Source Name: EventLog
Time Written: 20090320170318.000000+060
Event Type: Informationen
User:

Computer Name: MACHINENAME
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 2 Uniprocessor Free.

Record Number: 1
Source Name: EventLog
Time Written: 20090320170318.000000+060
Event Type: Informationen
User:

=====Application event log=====

Computer Name: SVEN
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst ContentIndex (ContentIndex) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 5
Source Name: LoadPerf
Time Written: 20090320171738.000000+060
Event Type: Informationen
User:

Computer Name: SVEN
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst TermService (Terminaldienste) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 4
Source Name: LoadPerf
Time Written: 20090320171737.000000+060
Event Type: Informationen
User:

Computer Name: SVEN
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst RemoteAccess (Routing und RAS) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 3
Source Name: LoadPerf
Time Written: 20090320171628.000000+060
Event Type: Informationen
User:

Computer Name: SVEN
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst PSched (PSched) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 2
Source Name: LoadPerf
Time Written: 20090320171607.000000+060
Event Type: Informationen
User:

Computer Name: SVEN
Event Code: 1000
Message: Die Leistungsindikatoren für den Dienst RSVP (QoS-RSVP) wurden geladen.
Die Daten enthalten die dem Dienst zugeordneten neuen Indexwerte.

Record Number: 1
Source Name: LoadPerf
Time Written: 20090320171606.000000+060
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 55 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=3702
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP

-----------------EOF-----------------
 

Während des Scans vom malware hat der noch 2 zusätzliche Trojaner gefunden, die allerdings der Antivir in die Quarantäne geschoben hat.
Kam mir nur sehr komisch vor da der malware nix gefunden hatte...

Ansonsten ist alles gepostet mit mühe und not^^

Gruß

welche trojaner wurden wo gefunden? ich sehe mir jetzt die logs an mom bitte.

Insgesamt 3 Trojaner der Kategorie
TR/PSW.Agent.mrh
laut Antivir

Quelle
C:/WINDOWS/system32/d3dspa.dll
C:/System Volume Information/_restore{8E914CAA-D8BE-48C7-B3D7-D86EE18DF2E4}/RP32/A0004946.dll
C:/WINDOWS/system32/drivers/kbdqadyt.sys