Dropper.Gen/Kido/Trojan.gen

Hallo,
die im Threadtitel genannten Übeltäter wurden auf meinen System (in einem rar-Archiv) sowie auf meinem Usb-Stick von Avira gefunden.
Die Meldungen/Logs dazu finde ich nicht mehr, da ich inzwischen den neuen Release von Avira installiert habe.

Quelle war immer der Stick (war im laptop von meinem Dozenten^^).

Die eine Geschichte war als Recycler/"kryptische Zeichenfolge" getarnt, obwohl ich mir versteckte Dateien/Systemdateien usw. anzeigen lasse, unsichtbar in dem Archiv.

Der Kido, der sich erst Tage später bemerkbar machte, hat den USB-Stick irgendwie umgebaut: Das Symbol hat im Arbeitsplatz hatte sich auf das eines Ordners geändert. Ausserdem war er wohl im Autostart des Sticks.


Habe eine vollständige Systemprüfung mit Avira gemacht - die üblichen Warnungen, aber keine Funde.

Ich arbeite mit Win-XP SP3 und eingeschränken Rechten. Die Scans habe ich aber auf dem "Administrator-Account" gemacht. Ich hoffe das ist so richtig.

E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\ hat in dem Log recht viele Einträge, wie kommt das zustande? (ist das Programm, aus dem Archiv, das mit dem Bösewicht behaftet war)


Ja, nun bitte ich Euch um Eure Hilfe. Ist irgendwas verdächtig? Was kann ich noch machen?

Grüße,

Manuel



Logs:

Malwarebytes' Anti-Malware 1.39
Datenbank Version: 2447
Windows 5.1.2600 Service Pack 3

17.07.2009 11:10:46
mbam-log-2009-07-17 (11-10-46).txt

Scan-Methode: Vollständiger Scan (C:\|D:\|E:\|F:\|H:\|I:\|J:\|K:\|L:\|M:\|)
Durchsuchte Objekte: 421903
Laufzeit: 1 hour(s), 23 minute(s), 42 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 0
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 0
Infizierte Verzeichnisse: 0
Infizierte Dateien: 1

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse:
(Keine bösartigen Objekte gefunden)

Infizierte Dateien:
e:\frei\Default.SFX (Spyware.Banker) -> Quarantined and deleted successfully.




Logfile of random's system information tool 1.06 (written by random/random)
Run by ... at 2009-07-17 11:48:09
Microsoft Windows XP Professional Service Pack 3
System drive C: has 4 GB (17%) free of 25 GB
Total RAM: 3582 MB (88% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 11:48:10, on 17.07.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v7.00 (7.00.6000.16850)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\Explorer.EXE
C:\WINDOWS\system32\RUNDLL32.EXE
H:\...\VMware\VMware Player\hqtray.exe
C:\Programme\Java\jre6\bin\jusched.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
F:\Programme\...\cvpnd.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\WINDOWS\system32\PnkBstrA.exe
C:\WINDOWS\system32\vmnat.exe
C:\WINDOWS\system32\vmnetdhcp.exe
H:\VM_WP2\VMware\VMware Player\vmware-authd.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Dokumente und Einstellungen\...\Desktop\RSIT.exe
C:\Programme\trend micro\suboptimal.exe

R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R0 - HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = http://go.microsoft.com/fwlink/?LinkId=69157
O2 - BHO: FDMIECookiesBHO Class - {CC59E0F9-7E43-44FA-9FAA-8377850BF205} - E:\Programme\Free Download Manager\iefdm2.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O4 - HKLM\..\Run: [JMB36X IDE Setup] C:\WINDOWS\RaidTool\xInsIDE.exe
O4 - HKLM\..\Run: [36X Raid Configurer] C:\WINDOWS\system32\xRaidSetup.exe boot
O4 - HKLM\..\Run: [GEST] m’|ü
O4 - HKLM\..\Run: [Alcmtr] ALCMTR.EXE
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [nwiz] nwiz.exe /install
O4 - HKLM\..\Run: [NvMediaCenter] RUNDLL32.EXE C:\WINDOWS\system32\NvMcTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [VMware hqtray] "H:\VM_WP2\VMware\VMware Player\hqtray.exe"
O4 - HKLM\..\Run: [SunJavaUpdateSched] "C:\Programme\Java\jre6\bin\jusched.exe"
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKLM\..\Run: [MSConfig] C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe /auto
O4 - HKCU\..\Run: [ctfmon.exe] C:\WINDOWS\system32\ctfmon.exe
O4 - Global Startup: Microsoft Office.lnk = C:\Programme\Microsoft Office\Office10\OSA.EXE
O8 - Extra context menu item: Alles mit FDM herunterladen - file://E:\Programme\Free Download Manager\dlall.htm
O8 - Extra context menu item: Auswahl mit FDM herunterladen - file://E:\Programme\Free Download Manager\dlselected.htm
O8 - Extra context menu item: Datei mit FDM herunterladen - file://E:\Programme\Free Download Manager\dllink.htm
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000
O8 - Extra context menu item: Videos mit FDM herunterladen - file://E:\Programme\Free Download Manager\dlfvideo.htm
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O10 - Unknown file in Winsock LSP: h:\vm_wp2\vmware\vmware player\vsocklib.dll
O10 - Unknown file in Winsock LSP: h:\vm_wp2\vmware\vmware player\vsocklib.dll
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} (WUWebControl Class) - http://www.update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1231070275234
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Cisco Systems, Inc. VPN Service (CVPND) - Cisco Systems, Inc. - F:\Programme\...\cvpnd.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: Pml Driver - HP - C:\WINDOWS\system32\HPHipm09.exe
O23 - Service: PnkBstrA - Unknown owner - C:\WINDOWS\system32\PnkBstrA.exe
O23 - Service: VMware Agent Service (ufad-ws60) - VMware, Inc. - H:\VM_WP2\VMware\VMware Player\vmware-ufad.exe
O23 - Service: VMware Authorization Service (VMAuthdService) - VMware, Inc. - H:\...\VMware\VMware Player\vmware-authd.exe
O23 - Service: VMware DHCP Service (VMnetDHCP) - VMware, Inc. - C:\WINDOWS\system32\vmnetdhcp.exe
O23 - Service: VMware NAT Service - VMware, Inc. - C:\WINDOWS\system32\vmnat.exe

--
End of file - 5498 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CC59E0F9-7E43-44FA-9FAA-8377850BF205}]
FDMIECookiesBHO Class - E:\Programme\Free Download Manager\iefdm2.dll [2008-06-18 94208]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"JMB36X IDE Setup"=C:\WINDOWS\RaidTool\xInsIDE.exe [2007-03-20 36864]
"36X Raid Configurer"=C:\WINDOWS\system32\xRaidSetup.exe [2007-08-29 1966080]
"GEST"=m’|ü []
"Alcmtr"=C:\WINDOWS\ALCMTR.EXE [2005-05-03 69632]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2007-12-05 8523776]
"nwiz"=nwiz.exe /install []
"NvMediaCenter"=C:\WINDOWS\system32\NvMcTray.dll [2007-12-05 81920]
"VMware hqtray"=H:\VM_WP2\VMware\VMware Player\hqtray.exe [2008-09-19 64048]
"SunJavaUpdateSched"=C:\Programme\Java\jre6\bin\jusched.exe [2009-03-09 148888]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]
"MSConfig"=C:\WINDOWS\PCHealth\HelpCtr\Binaries\MSConfig.exe [2008-04-14 172544]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"ctfmon.exe"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
C:\WINDOWS\system32\spool\drivers\w32x86\3\hpztsb04.exe [2003-01-30 196608]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPHmon03]
C:\WINDOWS\system32\hphmon03.exe [2003-01-30 311296]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PC Suite Tray]
E:\Programme\Handy\NokiaSuite\Nokia PC Suite 7\PCSuite.exe [2008-12-03 1205760]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\RTHDCPL]
C:\WINDOWS\RTHDCPL.EXE [2007-09-19 16844800]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^VPN Client.lnk]
C:\WINDOWS\Installer\{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}\Icon3E5562ED7.ico [2009-06-03 6144]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\services]
"ServiceLayer"=3

C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Autostart
Microsoft Office.lnk - C:\Programme\Microsoft Office\Office10\OSA.EXE

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\network\Wdf01000.sys]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=145

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=
"HonorAutoRunSetting"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"E:\games\Warcraft III\Warcraft III.exe"="E:\games\Warcraft III\Warcraft III.exe:*isabled:Warcraft III"
"F:\Programme\SAP\SAPgui\saplogon.exe"="F:\Programme\SAP\SAPgui\saplogon.exe:*:Enabled:SAP Logon for Windows"
"H:\VM_WP2\VMware\VMware Player\vmware-authd.exe"="H:\VM_WP2\VMware\VMware Player\vmware-authd.exe:*:Enabled:VMware Authd"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"D:\games\crysis\Bin32\Crysis.exe"="D:\games\crysis\Bin32\Crysis.exe:*:Enabled:Crysis_32"
"D:\games\crysis\Bin32\CrysisDedicatedServer.exe"="D:\games\crysis\Bin32\CrysisDedicatedServer.exe:*:Enabled:CrysisDedicatedServer_32"
"C:\WINDOWS\system32\PnkBstrA.exe"="C:\WINDOWS\system32\PnkBstrA.exe:*:Enabled:PnkBstrA"
"C:\WINDOWS\system32\PnkBstrB.exe"="C:\WINDOWS\system32\PnkBstrB.exe:*:Enabled:PnkBstrB"
"C:\Programme\VideoLAN\VLC\vlc.exe"="C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player"
"E:\Programme\Free Download Manager\fdm.exe"="E:\Programme\Free Download Manager\fdm.exe:*isabled:Free Download Manager"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\JavaClient\jre\bin\java.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\JavaClient\jre\bin\java .exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jre\bin\java.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jre\bin\ja va.exe:*:Enabled:Java(TM) 2 Platform Standard Edition binary"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\JavaClient\BPA Symbol Editor.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\JavaClient\BPA Symbol Editor.exe:*:Enabled:ARIS"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\JavaClient\BPAAdm.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\JavaClient\BPAAdm.exe:*:Enabl ed:ARIS SiteAdmin Tool"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jsl\simusrv.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jsl\simusrv .exe:*:Enabled:simusrv"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\olite\msql.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\olite\msql.e xe:*:Enabled:MSQL Utility (EXE)"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\appletviewer.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jd k\bin\appletviewer.exe:*:Enabled:appletviewer"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\extcheck.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bi n\extcheck.exe:*:Enabled:extcheck"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\HtmlConverter.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\j dk\bin\HtmlConverter.exe:*:Enabled:HtmlConverter"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\idlj.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\id lj.exe:*:Enabled:idlj"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\jar.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\jar .exe:*:Enabled:jar"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\jarsigner.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\b in\jarsigner.exe:*:Enabled:jarsigner"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\java.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\ja va.exe:*:Enabled:java"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\javac.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\j avac.exe:*:Enabled:javac"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\javadoc.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin \javadoc.exe:*:Enabled:javadoc"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\javah.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\j avah.exe:*:Enabled:javah"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\javap.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\j avap.exe:*:Enabled:javap"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\javaw.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\j avaw.exe:*:Enabled:javaw"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\jdb.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\jdb .exe:*:Enabled:jdb"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\keytool.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin \keytool.exe:*:Enabled:keytool"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\kinit.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\k init.exe:*:Enabled:kinit"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\klist.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\k list.exe:*:Enabled:klist"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\ktab.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\kt ab.exe:*:Enabled:ktab"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\native2ascii.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jd k\bin\native2ascii.exe:*:Enabled:native2ascii"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\orbd.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\or bd.exe:*:Enabledrbd"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\packager.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bi n\packager.exe:*:Enabledackager"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\policytool.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\ bin\policytool.exe:*:Enabledolicytool"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\rmic.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\rm ic.exe:*:Enabled:rmic"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\rmid.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\rm id.exe:*:Enabled:rmid"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\rmiregistry.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk \bin\rmiregistry.exe:*:Enabled:rmiregistry"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\serialver.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\b in\serialver.exe:*:Enabled:serialver"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\servertool.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\ bin\servertool.exe:*:Enabled:servertool"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\bin\tnameserv.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\b in\tnameserv.exe:*:Enabled:tnameserv"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\java.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jr e\bin\java.exe:*:Enabled:java"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\javaw.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\j re\bin\javaw.exe:*:Enabled:javaw"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\jpicpl32.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jd k\jre\bin\jpicpl32.exe:*:Enabled:jpicpl32"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\jucheck.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk \jre\bin\jucheck.exe:*:Enabled:UpdateChecker Module"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\jusched.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk \jre\bin\jusched.exe:*:Enabled:jusched"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\keytool.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk \jre\bin\keytool.exe:*:Enabled:keytool"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\kinit.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\j re\bin\kinit.exe:*:Enabled:kinit"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\klist.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\j re\bin\klist.exe:*:Enabled:klist"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\ktab.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jr e\bin\ktab.exe:*:Enabled:ktab"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\orbd.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jr e\bin\orbd.exe:*:Enabledrbd"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\policytool.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\ jdk\jre\bin\policytool.exe:*:Enabledolicytool"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\rmid.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jr e\bin\rmid.exe:*:Enabled:rmid"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\rmiregistry.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer \jdk\jre\bin\rmiregistry.exe:*:Enabled:rmiregistry"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\servertool.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\ jdk\jre\bin\servertool.exe:*:Enabled:servertool"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\bin\tnameserv.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\j dk\jre\bin\tnameserv.exe:*:Enabled:tnameserv"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\jdk\jre\javaws\javaws.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\LocalServer\j dk\jre\javaws\javaws.exe:*:Enabled:javaws"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\orabprserverw.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\orabprserverw.exe:*:Enabledrabp rserverw"
"E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\JavaClient\Oracle Business Process Architect.exe"="E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\JavaClient\Oracle Business Process Architect.exe:*:Enabled:ARIS"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======List of files/folders created in the last 1 months======

2009-07-17 11:44:27 ----D---- C:\Programme\trend micro
2009-07-17 11:44:26 ----D---- C:\rsit
2009-07-17 09:14:58 ----D---- C:\Dokumente und Einstellungen\...\Anwendungsdaten\Malwarebytes
2009-07-17 09:14:53 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-07-16 00:09:19 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-07-16 00:09:15 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-16 00:08:09 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-07-15 09:56:49 ----D---- C:\Programme\Avira
2009-07-15 09:56:49 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2009-06-27 18:49:23 ----A---- C:\WINDOWS\polite.ini

======List of files/folders modified in the last 1 months======

2009-07-17 11:44:35 ----D---- C:\WINDOWS\Prefetch
2009-07-17 11:44:27 ----RD---- C:\Programme
2009-07-17 11:43:20 ----D---- C:\Programme\Mozilla Firefox
2009-07-17 11:17:02 ----D---- C:\WINDOWS\Temp
2009-07-17 11:17:02 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-17 11:16:55 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\VMware
2009-07-17 11:16:45 ----SH---- C:\boot.ini
2009-07-17 11:16:45 ----A---- C:\WINDOWS\win.ini
2009-07-17 11:16:45 ----A---- C:\WINDOWS\system.ini
2009-07-17 11:16:03 ----D---- C:\WINDOWS\system32\drivers
2009-07-17 11:16:03 ----D---- C:\WINDOWS
2009-07-17 11:15:22 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-17 11:15:06 ----D---- C:\Dokumente und Einstellungen\...\Anwendungsdaten\Free Download Manager
2009-07-17 08:47:19 ----D---- C:\WINDOWS\pss
2009-07-16 00:09:20 ----HD---- C:\WINDOWS\inf
2009-07-16 00:09:20 ----D---- C:\WINDOWS\system32
2009-07-16 00:09:18 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-16 00:09:17 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-16 00:09:17 ----A---- C:\WINDOWS\imsins.BAK
2009-07-15 09:55:23 ----SHD---- C:\WINDOWS\Installer
2009-07-15 09:55:22 ----D---- C:\WINDOWS\WinSxS
2009-07-07 17:10:56 ----A---- C:\WINDOWS\system32\MRT.exe
2009-06-27 18:48:42 ----HD---- C:\Programme\InstallShield Installation Information
2009-06-27 14:07:56 ----SHD---- C:\Boot

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-03-30 96104]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-05-11 28520]
R1 truecrypt;truecrypt; C:\WINDOWS\System32\drivers\truecrypt.sys [2009-04-10 215872]
R1 WS2IFSL;Windows Socket 2.0 Non-IFS-Dienstanbieter-Unterstützungsumgebung; C:\WINDOWS\System32\drivers\ws2ifsl.sys [2006-02-28 12032]
R2 atksgt;atksgt; C:\WINDOWS\system32\DRIVERS\atksgt.sys [2008-05-23 271360]
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-03-24 55640]
R2 CVPNDRVA;Cisco Systems Inc. IPSec Driver; \??\C:\WINDOWS\system32\Drivers\CVPNDRVA.sys []
R2 hcmon;VMware hcmon; \??\C:\WINDOWS\system32\drivers\hcmon.sys []
R2 lirsgt;lirsgt; C:\WINDOWS\system32\DRIVERS\lirsgt.sys [2008-05-23 18048]
R2 vmci;VMware vmci; \??\C:\WINDOWS\system32\Drivers\vmci.sys []
R2 VMnetBridge;VMware Bridge Protocol; C:\WINDOWS\system32\DRIVERS\vmnetbridge.sys [2008-09-18 31280]
R2 VMnetuserif;VMware Network Application Interface; \??\C:\WINDOWS\system32\drivers\vmnetuserif.sys []
R2 VMparport;VMware VMparport; \??\C:\WINDOWS\system32\Drivers\VMparport.sys []
R2 vmx86;VMware vmx86; \??\C:\WINDOWS\system32\Drivers\vmx86.sys []
R2 vstor2-ws60;Vstor2 WS60 Virtual Storage Driver; \??\H:\VM_WP2\VMware\VMware Player\vstor2-ws60.sys []
R3 DNE;Deterministic Network Enhancer Miniport; C:\WINDOWS\system32\DRIVERS\dne2000.sys [2008-03-29 125328]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2007-09-19 4617728]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-02-28 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2007-12-05 7435392]
R3 RTLE8023xp;Realtek 10/100/1000 PCI-E NIC Family NDIS XP Driver; C:\WINDOWS\system32\DRIVERS\Rtenicxp.sys [2007-09-19 101504]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;USB2-aktivierter Hub; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
R3 vmkbd;VMware kbd; \??\C:\WINDOWS\system32\drivers\VMkbd.sys []
R3 VMnetAdapter;VMware Virtual Ethernet Adapter Driver; C:\WINDOWS\system32\DRIVERS\vmnetadapter.sys [2008-09-18 16560]
S3 CVirtA;Cisco Systems VPN Adapter; C:\WINDOWS\system32\DRIVERS\CVirtA.sys [2007-01-18 5275]
S3 Dot4 HPH09;Dot4 HPH09; C:\WINDOWS\system32\DRIVERS\hphid409.sys [2003-01-30 50800]
S3 dot4;MS IEEE-1284.4-Treiber; C:\WINDOWS\system32\DRIVERS\Dot4.sys [2008-04-13 206976]
S3 Dot4Print HPH09;Print Class Driver for IEEE-1284.4 HPH09; C:\WINDOWS\system32\DRIVERS\hphipr09.sys [2003-01-30 16112]
S3 Dot4Print;Druckerklassentreiber für IEEE-1284.4; C:\WINDOWS\system32\DRIVERS\Dot4Prt.sys [2001-08-17 12928]
S3 Dot4Storage HPH09;Storage Class Driver for IEEE-1284.4 (HPH09); C:\WINDOWS\System32\Drivers\hphs2k09.sys [2003-01-30 50211]
S3 Dot4Usb HPH09;Dot4Usb HPH09; C:\WINDOWS\System32\drivers\hphius09.sys [2003-01-30 18864]
S3 dot4usb;Dot4USB-Filter Dot4USB Filter; C:\WINDOWS\system32\DRIVERS\dot4usb.sys [2001-08-18 23936]
S3 ENTECH;ENTECH; \??\C:\WINDOWS\system32\DRIVERS\ENTECH.sys []
S3 gdrv;gdrv; \??\C:\WINDOWS\gdrv.sys []
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-04-09 25280]
S3 nmwcd;Nokia USB Phone Parent; C:\WINDOWS\system32\drivers\ccdcmb.sys [2008-09-15 17664]
S3 nmwcdc;Nokia USB Generic; C:\WINDOWS\system32\drivers\ccdcmbo.sys [2008-09-15 22016]
S3 pccsmcfd;PCCS Mode Change Filter Driver; C:\WINDOWS\system32\DRIVERS\pccsmcfd.sys [2008-08-26 18816]
S3 upperdev;upperdev; C:\WINDOWS\system32\DRIVERS\usbser_lowerflt.sys [2008-09-15 8064]
S3 usbser;USB Modem Driver; C:\WINDOWS\system32\drivers\usbser.sys [2008-04-13 26112]
S3 UsbserFilt;UsbserFilt; C:\WINDOWS\system32\DRIVERS\usbser_lowerfltj.sys [2008-09-15 8064]
S3 usbstor;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
S3 vmusb;VMware USB Client Driver; C:\WINDOWS\System32\Drivers\vmusb.sys [2008-09-18 31280]
S3 Wdf01000;Kernel Mode Driver Frameworks service; C:\WINDOWS\System32\Drivers\wdf01000.sys [2008-03-27 503008]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []

======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-05-13 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-05-11 185089]
R2 CVPND;Cisco Systems, Inc. VPN Service; F:\Programme\...\cvpnd.exe [2008-08-29 1528608]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2007-12-05 155716]
R2 PnkBstrA;PnkBstrA; C:\WINDOWS\system32\PnkBstrA.exe [2009-03-06 66872]
R2 VMAuthdService;VMware Authorization Service; H:\...\VMware\VMware Player\vmware-authd.exe [2008-09-19 113200]
R2 VMnetDHCP;VMware DHCP Service; C:\WINDOWS\system32\vmnetdhcp.exe [2008-09-19 326192]
R2 VMware NAT Service;VMware NAT Service; C:\WINDOWS\system32\vmnat.exe [2008-09-19 399920]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\aspnet_state.exe [2004-07-15 32768]
S3 Pml Driver;Pml Driver; C:\WINDOWS\system32\HPHipm09.exe [2003-01-30 77824]
S3 ufad-ws60;VMware Agent Service; H:\...\VMware\VMware Player\vmware-ufad.exe [2008-08-25 191024]
S4 ServiceLayer;ServiceLayer; C:\Programme\PC Connectivity Solution\ServiceLayer.exe [2008-11-11 620544]

-----------------EOF-----------------

info.txt logfile of random's system information tool 1.06 2009-07-17 12:13:48

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
3DMark06-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{7F3AD00A-1819-4B15-BB7D-08B3586336D7}\setup.exe" -l0x9 -removeonly
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Ashampoo Burning Studio 6 FREE-->"C:\Programme\Ashampoo\Ashampoo Burning Studio 6\unins000.exe"
Avira AntiVir Personal - Free Antivirus-->C:\Programme\Avira\AntiVir Desktop\setup.exe /REMOVE
CIB pdf Plug-in 1.3.25-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{62A5F5BC-CDAC-4F44-A2A9-C30A1BCBCA6B}\setup.exe" -l0x7 -uninst
Cisco Systems VPN Client 5.0.04.0300-->MsiExec.exe /X{51FB15F4-AD27-43BC-AD4B-DD0354FB6BBD}
Crysis(R)-->MsiExec.exe /I{000E79B7-E725-4F01-870A-C12942B7F8E4}
ffdshow [rev 2094] [2008-08-30]-->"C:\Programme\ffdshow\unins000.exe"
Free Download Manager 2.5-->"E:\Programme\Free Download Manager\unins000.exe"
Gigabyte Raid Configurer-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{3A1B5D40-41E9-43FA-8C7B-A8667F5586EF}\SETUP.EXE" -l0x7 -removeonly
Gothic III-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{02B244A2-7F6A-42E8-A36F-8C385D7A1625}\setup.exe" -l0x7 -removeonly
High Definition Audio Driver Package - KB888111-->"C:\WINDOWS\$NtUninstallKB888111WXPSP2$\spuninst\spuninst.exe"
HijackThis 2.0.2-->"C:\Programme\trend micro\HijackThis.exe" /uninstall
Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
HP PhotoSmart printer Serie (nur entfernen)-->C:\Programme\hp photosmart\printer\hphuni03.exe
IBM Installation Manager-->MsiExec.exe /X{DBD90D51-BD46-41AF-A1F5-B74CEA24365B}
IBM Software Development Platform-->F:\Programme\RSA\IBM\SDP70\uninstall\uninstall.exe
Java DB 10.3.1.4-->MsiExec.exe /X{CD49361E-3FE6-457E-90A1-9C59E29B5D02}
Java(TM) 6 Update 13-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 6-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160060}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
Java(TM) SE Development Kit 6 Update 6-->MsiExec.exe /I{32A3A4F4-B792-11D6-A78A-00B0D0160060}
Malwarebytes' Anti-Malware-->"E:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft Kernel-Mode Driver Framework Feature Pack 1.7-->"C:\WINDOWS\$NtUninstallWdf01007$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office XP Professional mit FrontPage-->MsiExec.exe /I{90280407-6000-11D3-8CFE-0050048383C9}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{A49F249F-0C91-497F-86DF-B2585E8E76B7}
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17-->MsiExec.exe /X{9A25302D-30C0-39D9-BD6F-21E6EC160475}
Mozilla Firefox (3.0.10)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
MSVC80_x86-->MsiExec.exe /I{212748BB-0DA5-46DE-82A1-403736DC9F27}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
NetSpeedMonitor 2.4.2.0 x86-->MsiExec.exe /I{DFD7F080-D4BB-4A72-8B19-8FD0CE34F780}
Nokia Connectivity Cable Driver-->MsiExec.exe /X{15AC0C5D-A6FB-4CE2-8CD0-28179EEB5625}
Nokia PC Suite-->C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Installations\{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}\Nokia_PC_Suite_7_1_18_0_ger_web.exe
Nokia PC Suite-->MsiExec.exe /I{58FB2F9A-5F2D-40E8-82DF-4987E60AD8BD}
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
OpenOffice.org 3.0-->MsiExec.exe /I{04B45310-A5FE-4425-BFCA-1A6D8920DE74}
Oracle Business Process Analysis Suite 10.1.3.4-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{7C8522E1-1CB9-40AC-A886-CF3BB00A1A53}\setup.exe" -l0x7 uninstall
PC Connectivity Solution-->MsiExec.exe /I{D848D140-41C3-4A53-86D8-E866A100B4CD}
PDFCreator-->F:\Programme\PDFCreator\unins000.exe
PunkBuster Services-->C:\WINDOWS\system32\pbsvc.exe -u
QIP Infium 2.0.9020 RC3-->"E:\Programme\QIPInfium9020\unins000.exe"
REALTEK GbE & FE Ethernet PCI-E NIC Driver-->C:\Programme\InstallShield Installation Information\{C9BED750-1211-4480-B1A5-718A3BE15525}\SETUP.EXE -runfromtemp -l0x0007 -removeonly
Realtek High Definition Audio Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}\SETUP.EXE" -l0x7 -removeonly
SAMSUNG HDD Serial Number Tracking for Germany Buyer-->MsiExec.exe /I{E7336944-A48C-42EE-B6FC-12C443482EA9}
SAP Front End-->"C:\WINDOWS\SAPwksta\setup\sapsetup.exe" /uninstall
Sicherheitsupdate für Windows Internet Explorer 7 (KB938127-v2)-->"C:\WINDOWS\ie7updates\KB938127-v2-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB958215)-->"C:\WINDOWS\ie7updates\KB958215-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB960714)-->"C:\WINDOWS\ie7updates\KB960714-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB961260)-->"C:\WINDOWS\ie7updates\KB961260-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB963027)-->"C:\WINDOWS\ie7updates\KB963027-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Internet Explorer 7 (KB969897)-->"C:\WINDOWS\ie7updates\KB969897-IE7\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB923561)-->"C:\WINDOWS\$NtUninstallKB923561$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB938464)-->"C:\WINDOWS\$NtUninstallKB938464$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB938464-v2)-->"C:\WINDOWS\$NtUninstallKB938464-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB946648)-->"C:\WINDOWS\$NtUninstallKB946648$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950762)-->"C:\WINDOWS\$NtUninstallKB950762$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB950974)-->"C:\WINDOWS\$NtUninstallKB950974$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951066)-->"C:\WINDOWS\$NtUninstallKB951066$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951376-v2)-->"C:\WINDOWS\$NtUninstallKB951376-v2$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951698)-->"C:\WINDOWS\$NtUninstallKB951698$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB951748)-->"C:\WINDOWS\$NtUninstallKB951748$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952004)-->"C:\WINDOWS\$NtUninstallKB952004$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB952954)-->"C:\WINDOWS\$NtUninstallKB952954$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954211)-->"C:\WINDOWS\$NtUninstallKB954211$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954459)-->"C:\WINDOWS\$NtUninstallKB954459$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB954600)-->"C:\WINDOWS\$NtUninstallKB954600$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB955069)-->"C:\WINDOWS\$NtUninstallKB955069$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956391)-->"C:\WINDOWS\$NtUninstallKB956391$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956572)-->"C:\WINDOWS\$NtUninstallKB956572$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956802)-->"C:\WINDOWS\$NtUninstallKB956802$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956803)-->"C:\WINDOWS\$NtUninstallKB956803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB956841)-->"C:\WINDOWS\$NtUninstallKB956841$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957095)-->"C:\WINDOWS\$NtUninstallKB957095$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB957097)-->"C:\WINDOWS\$NtUninstallKB957097$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958215)-->"C:\WINDOWS\$NtUninstallKB958215$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958644)-->"C:\WINDOWS\$NtUninstallKB958644$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958687)-->"C:\WINDOWS\$NtUninstallKB958687$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB958690)-->"C:\WINDOWS\$NtUninstallKB958690$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB959426)-->"C:\WINDOWS\$NtUninstallKB959426$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960225)-->"C:\WINDOWS\$NtUninstallKB960225$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960714)-->"C:\WINDOWS\$NtUninstallKB960714$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960715)-->"C:\WINDOWS\$NtUninstallKB960715$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB960803)-->"C:\WINDOWS\$NtUninstallKB960803$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961371)-->"C:\WINDOWS\$NtUninstallKB961371$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961373)-->"C:\WINDOWS\$NtUninstallKB961373$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB961501)-->"C:\WINDOWS\$NtUninstallKB961501$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB968537)-->"C:\WINDOWS\$NtUninstallKB968537$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB969898)-->"C:\WINDOWS\$NtUninstallKB969898$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB970238)-->"C:\WINDOWS\$NtUninstallKB970238$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB971633)-->"C:\WINDOWS\$NtUninstallKB971633$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB973346)-->"C:\WINDOWS\$NtUninstallKB973346$\spuninst\spuninst.exe"
Sun ODF Plugin for Microsoft Office 1.2-->MsiExec.exe /X{5A29E75C-A8DE-49B4-9AF3-2266CE76C428}
TrueCrypt-->"C:\Programme\TrueCrypt Setup.exe" /u
Update für Windows XP (KB951978)-->"C:\WINDOWS\$NtUninstallKB951978$\spuninst\spuninst.exe"
Update für Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update für Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
Vensim PLE-->E:\Programme\Vensim\Vensim\Uninstal.exe Venple.ilg
VideoLAN VLC media player 0.8.6f-->C:\Programme\VideoLAN\VLC\uninstall.exe
VMware Player-->MsiExec.exe /I{A53A11EA-0095-493F-86FA-A15E8A86A405}
Windows XP Service Pack 3-->"C:\WINDOWS\$NtServicePackUninstall$\spuninst\spuninst.exe"
Windows-Treiberpaket - Nokia Modem (10/27/2008 3.9)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokia_blue_79486EC6AA0D1732FB17E5167077C07ECAE1B870\nokia_bluetooth.inf
Windows-Treiberpaket - Nokia Modem (10/27/2008 7.01.0.1)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\nokbtmdm_247189AEBF39EB69A7C75429610DFED2F2EDC1B6\nokbtmdm.inf
Windows-Treiberpaket - Nokia pccsmcfd (08/22/2008 7.0.0.0)-->C:\PROGRA~1\DIFX\270581355A767BF1\dpinst.exe /u C:\WINDOWS\system32\DRVSTORE\pccsmcfd_A3B3916E5D8138F59EE218321B27B044D3B18294\pccsmcfd.inf
XMedia Recode 2.1.1.1-->E:\Programme\XMedia Recode\uninst.exe

======Security center information======

AV: AntiVir Desktop

======System event log======

Computer Name: ...
Event Code: 7036
Message: Dienst "ServiceLayer" befindet sich jetzt im Status "Ausgeführt".

Record Number: 13595
Source Name: Service Control Manager
Time Written: 20090516174840.000000+120
Event Type: Informationen
User:

Computer Name: ...
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "SSDP-Suchdienst" gesendet.

Record Number: 13594
Source Name: Service Control Manager
Time Written: 20090516174840.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: ...
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "ServiceLayer" gesendet.

Record Number: 13593
Source Name: Service Control Manager
Time Written: 20090516174840.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: ...
Event Code: 7036
Message: Dienst "RAS-Verbindungsverwaltung" befindet sich jetzt im Status "Ausgeführt".

Record Number: 13592
Source Name: Service Control Manager
Time Written: 20090516174840.000000+120
Event Type: Informationen
User:

Computer Name: ...
Event Code: 7036
Message: Dienst "NLA (Network Location Awareness)" befindet sich jetzt im Status "Ausgeführt".

Record Number: 13591
Source Name: Service Control Manager
Time Written: 20090516174840.000000+120
Event Type: Informationen
User:

=====Application event log=====

Computer Name: ...
Event Code: 11707
Message: Produkt: IBM Installation Manager -- Installationsvorgang erfolgreich abgeschlossen.

Record Number: 651
Source Name: MsiInstaller
Time Written: 20081020214200.000000+120
Event Type: Informationen
User: ...\...

Computer Name: ...
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!

Record Number: 650
Source Name: Avira AntiVir
Time Written: 20081020204116.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: ..
Event Code: 1800
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 649
Source Name: SecurityCenter
Time Written: 20081020204113.000000+120
Event Type: Informationen
User:

Computer Name: ...
Event Code: 4096
Message: Der AntiVir Dienst wurde erfolgreich gestartet!

Record Number: 648
Source Name: Avira AntiVir
Time Written: 20081017081707.000000+120
Event Type: Informationen
User: NT-AUTORITÄT\SYSTEM

Computer Name: ...
Event Code: 1800
Message: Der Windows-Sicherheitscenterdienst wurde gestartet.

Record Number: 647
Source Name: SecurityCenter
Time Written: 20081017081704.000000+120
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=C:\Programme\PC Connectivity Solution\;%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=6
"PROCESSOR_IDENTIFIER"=x86 Family 6 Model 23 Stepping 6, GenuineIntel
"PROCESSOR_REVISION"=1706
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"BPAHOME101"=E:\Programme\Oracle_BPA_Suite_10.1.3.4_download\

-----------------EOF-----------------