Schau dir das VT-Ergebnis an:

Datei ESQULcrlbgpsvaxtvndqqnxxoquvgvupx empfangen 2009.07.15 23:03:05 (UTC)
Status:    Beendet 
Ergebnis: 3/41 (7.32%) 
 Filter 
Drucken der Ergebnisse  Antivirus	Version	letzte aktualisierung	Ergebnis
a-squared	4.5.0.24	2009.07.15	-
AhnLab-V3	5.0.0.2	2009.07.15	-
AntiVir	7.9.0.215	2009.07.15	-
Antiy-AVL	2.0.3.7	2009.07.15	-
Authentium	5.1.2.4	2009.07.16	-
Avast	4.8.1335.0	2009.07.15	-
AVG	8.5.0.387	2009.07.15	-
BitDefender	7.2	2009.07.16	-
CAT-QuickHeal	10.00	2009.07.15	-
ClamAV	0.94.1	2009.07.15	-
Comodo	1663	2009.07.16	-
DrWeb	5.0.0.12182	2009.07.15	-
eSafe	7.0.17.0	2009.07.15	-
eTrust-Vet	31.6.6617	2009.07.15	-
F-Prot	4.4.4.56	2009.07.16	-
F-Secure	8.0.14470.0	2009.07.15	-
Fortinet	3.120.0.0	2009.07.15	-
GData	19	2009.07.15	-
Ikarus	T3.1.1.64.0	2009.07.15	-
Jiangmin	11.0.706	2009.07.15	-
K7AntiVirus	7.10.793	2009.07.15	-
Kaspersky	7.0.0.125	2009.07.16	-
McAfee	5677	2009.07.15	-
McAfee+Artemis	5677	2009.07.15	-
McAfee-GW-Edition	6.8.5	2009.07.15	-
Microsoft	1.4803	2009.07.16	VirTool:Win32/Obfuscator.ER
NOD32	4247	2009.07.15	-
Norman	6.01.09	2009.07.15	-
nProtect	2009.1.8.0	2009.07.15	-
Panda	10.0.0.14	2009.07.15	-
PCTools	4.4.2.0	2009.07.15	-
Prevx	3.0	2009.07.16	High Risk Cloaked Malware
Rising	21.38.24.00	2009.07.15	-
Sophos	4.43.0	2009.07.15	-
Sunbelt	3.2.1858.2	2009.07.15	-
Symantec	1.4.4.12	2009.07.16	Suspicious.Vundo.2
TheHacker	6.3.4.3.368	2009.07.15	-
TrendMicro	8.950.0.1094	2009.07.15	-
VBA32	3.12.10.8	2009.07.15	-
ViRobot	2009.7.15.1837	2009.07.15	-
VirusBuster	4.6.5.0	2009.07.15	-
weitere Informationen
File size: 23552 bytes
MD5...: db4997444d76434e325050c090b2efd0
SHA1..: 18bbb4ce71310704533018075cc0c96423717878
SHA256: 51bdd7a2cc1ba343884e4bc6b6c8015719c162d72f405e65a95b3748b00b0d9c
ssdeep: 384:U8Y+Y+GmLiTwYRd5miLiIMhv2zP7n6OTu8JuGrj1:U8wmLiTwYr5m7IMhuz5
Tuur
PEiD..: -
TrID..: File type identification
Win32 Executable Generic (38.4%)
Win32 Dynamic Link Library (generic) (34.2%)
Clipper DOS Executable (9.1%)
Generic Win/DOS Executable (9.0%)
DOS Executable Generic (9.0%)
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x1ba0
timedatestamp.....: 0x4588ab51 (Wed Dec 20 03:17:37 2006)
machinetype.......: 0x14c (I386)

( 6 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x1000 0x246c 0x2000 5.67 ef3748688ff1ad621c4440174d387826
.data 0x4000 0x1863 0x800 2.53 a700095863e2c6898515aa6560eca25c
.rdata 0x6000 0x383c 0x1400 5.42 8855869c1ce8c2329da8cab68783b134
.edata 0xa000 0x28ad 0xc00 3.05 bb966077cbc634aa3da2a3bd54723d6e
.rsrc 0xd000 0x862 0x800 0.00 c99a74c555371a433d121f551d6c6398
.reloc 0xe000 0x82f 0x800 3.95 07f5f5e06c84805c990e53240827ad5f

( 6 imports ) 
> KERNEL32.DLL: VirtualFree, GetCurrentProcess, GetModuleHandleW, VirtualAlloc, ExitProcess, GlobalAlloc, FindFirstFileA, GetFileType, ResumeThread, GetProcessHeap
> msvcrt.dll: __p__fmode, realloc, __p__commode, __set_app_type
> GDI32.DLL: AngleArc, GdiGetDC, GetCurrentObject, ExcludeClipRect
> OLE32.DLL: CoGetInterfaceAndReleaseStream, OleLoadFromStream
> ADVAPI32.DLL: QueryServiceStatus, OpenSCManagerW, RegFlushKey, EqualSid, GetUserNameA, OpenServiceW, RegCreateKeyW, StartServiceCtrlDispatcherA
> version.dll: VerQueryValueA, GetFileVersionInfoW, GetFileVersionInfoSizeA, GetFileVersionInfoA

( 2 exports ) 
DzrcJqTHbbgrgf, ZriWYSvxIgg
PDFiD.: -
RDS...: NSRL Reference Data Set
-
Prevx info: <a href='http://info.prevx.com/aboutprogramtext.asp?PX5=12A3CABE0000AA245C6F00259D6ABA00ABB30703' target='_blank'>http://info.prevx.com/aboutprogramtext.asp?PX5=12A3CABE0000AA245C6F00259D6ABA00ABB30703</a>
         

Noch Fragen?

1.) Deinstalliere SuperAntiSpyware

2.) Panda Active Scan

Folgende Seite führt dich durch die Installation: PandaActiveScan2.0 Installation

Drücke auf Jetzt Scannen!

Eine Registrierung ist nicht erforderlich!

Nachdem der Scan abgeschlossen ist drücke auf das Text-Icon Export und speichere das log auf dem Desktop.
Öffne die Datei ActiveScan.txt die sich nun auf deinem Desktop befindet und poste uns den Inhalt.

3.) Überprüfe den Rechner mit PrevXCSI. Poste ein Screenshot falls etwas gefunden werden sollte.

ciao, andreas

7% ?
Wo fang ich mir nur immer so Dinger ein (vor zwei Wochen H1N1... jetzt sowas... ich fang so langsam schon an zu glauben, dass ich meinen PC angesteckt hab... )

Da ich morgen (an einem Samstag...) aber zeitig raus muss, werd ich mich nun schlafen legen, das Scan-Ergebnis liefer ich morgen früh nach, falls ich aus irgendeinem Grund Schlafstörungen habe, eventuell schon früher...

ciao, andreas

Panda:

;***********************************************************************************************************************************************************************************
ANALYSIS: 2009-07-18 12:33:33
PROTECTIONS: 1
MALWARE: 13
SUSPECTS: 0
;***********************************************************************************************************************************************************************************
PROTECTIONS
Description                                  Version                       Active    Updated
;===================================================================================================================================================================================
AntiVir Desktop                              9.0.1.30                      No        Yes
;===================================================================================================================================================================================
MALWARE
Id        Description                        Type                Active    Severity  Disinfectable  Disinfected Location
;===================================================================================================================================================================================
00041402  Exploit/MS04-022.gen               HackTools           No        0         Yes            No           C:\WINDOWS\Installer\29566.msp[unk_0007]
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\Dokumente und Einstellungen\kwam\Cookies\kwam@doubleclick[1].txt
00139061  Cookie/Doubleclick                 TrackingCookie      No        0         Yes            No           C:\WINDOWS\system32\config\systemprofile\Cookies\system@doubleclick[1].txt
00145393  Cookie/Tradedoubler                TrackingCookie      No        0         Yes            No           C:\Dokumente und Einstellungen\kwam\Cookies\kwam@tradedoubler[1].txt
00149116  Cookie/Ccbill                      TrackingCookie      No        0         Yes            No           C:\Dokumente und Einstellungen\kwam\Cookies\kwam@ccbill[1].txt
00168056  Cookie/YieldManager                TrackingCookie      No        0         Yes            No           C:\WINDOWS\system32\config\systemprofile\Cookies\system@ad.yieldmanager[2].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\WINDOWS\system32\config\systemprofile\Cookies\system@adtech[1].txt
00168109  Cookie/Adtech                      TrackingCookie      No        0         Yes            No           C:\Dokumente und Einstellungen\kwam\Cookies\kwam@adtech[1].txt
00262020  Cookie/Atwola                      TrackingCookie      No        0         Yes            No           C:\Dokumente und Einstellungen\kwam\Cookies\kwam@atwola[1].txt
00590315  Rootkit/Agent.LNB                  HackTools           No        0         Yes            No           C:\System Volume Information\_restore{B7ABC265-EE74-42B4-8042-29A10BC5CEA1}\RP274\A0089106.sys
01675833  Trj/SMSlock.C                      Virus/Trojan        No        0         No             No           C:\Dokumente und Einstellungen\kwam\Desktop\Qoobox.rar[Qoobox\Quarantine\C\cleanup.exe.vir]
03074964  Trj/CI.A                           Virus/Trojan        No        0         No             No           C:\Dokumente und Einstellungen\kwam\Desktop\Qoobox.rar[Qoobox\Quarantine\C\WINDOWS\system32\ESQULjwoaypplxqliosrhdgapirxxdnowqyin.dll.vir]
03432103  Bck/Ciadoor.FQ                     Virus/Trojan        No        1         Yes            No           C:\Dokumente und Einstellungen\kwam\Desktop\dud\ICQ Status Checker.exe
03738701  Generic Malware                    Virus/Trojan        No        0         Yes            No           C:\Programme\QIP\uninstall.exe
03912402  Bck/Ciadoor.FQ                     Virus/Trojan        No        1         Yes            No           C:\Dokumente und Einstellungen\kwam\Desktop\dud\ICQ Ignore Checker.exe
;===================================================================================================================================================================================
SUSPECTS
Sent      Location                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                              `
;===================================================================================================================================================================================
;===================================================================================================================================================================================
VULNERABILITIES
Id        Severity   Description                                                                                                                                                                                                                                                                                                                                                                                                                                                                                                `
;===================================================================================================================================================================================
;===================================================================================================================================================================================
         

PrevXCSI ging ja schnell. Hat auf jeden Fall nichts entdeckt.

1.) Lösche Qoobox.rar von deinem Desktop, die Dateien wurden schon an die AVP-Hersteller verschickt.

2.) Folgende Dateien würde ich dir auch dringend zum Löschen empfehlen:

C:\Dokumente und Einstellungen\kwam\Desktop\dud\ICQ Status Checker.exe
C:\Dokumente und Einstellungen\kwam\Desktop\dud\ICQ Ignore Checker.exe

3.) Die Datei

C:\Programme\QIP\uninstall.exe

bitte bei www.virustotal.com überprüfen lassen und hier den kompletten Bericht posten. Benutze bitte [ code]Bericht[ /code]-Befehle, dann ist die Darstellung besser. Alternativ kannst du in der Symbolleiste dass 4. Symbol von rechts => # benutzen.

4.) Deaktiviere die Systemwiederherstellung, im Verlauf der Infektion wurden auch Malwaredateien in Wiederherstellungspunkten mitgesichert - die sind alle nun unbrauchbar, da ein Zurücksetzen des System durch einen Wiederherstellungspunkt das System wahrscheinlich wieder infizieren würde.
Nach Neustart kann sie wieder aktiviert werden.

ciao, andreas

Die Dateiüberprüfung läuft nun bereits über 3h. Kann das sein, oder lief da irgendetwas schief?

Kann das sein, oder lief da irgendetwas schief?

Ganz sicher, klicke auf aktualisieren. Sollte das nicht helfen und die Datei kleiner als 3MB sein, kannst du sie auch bei uns uploaden => http://www.trojaner-board.de/54791-a...ner-board.html

ciao, andreas

Ok, F5 hat geholfen

Antivirus 	Version 	letzte aktualisierung 	Ergebnis
a-squared 	4.5.0.24 	2009.07.18 	-
AhnLab-V3 	5.0.0.2 	2009.07.18 	-
AntiVir 	7.9.0.220 	2009.07.17 	-
Antiy-AVL 	2.0.3.7 	2009.07.17 	-
Authentium 	5.1.2.4 	2009.07.18 	-
Avast 	4.8.1335.0 	2009.07.17 	-
AVG 	8.5.0.387 	2009.07.18 	-
BitDefender 	7.2 	2009.07.18 	-
CAT-QuickHeal 	10.00 	2009.07.17 	-
ClamAV 	0.94.1 	2009.07.18 	-
Comodo 	1690 	2009.07.18 	-
DrWeb 	5.0.0.12182 	2009.07.18 	-
eSafe 	7.0.17.0 	2009.07.16 	Suspicious File
eTrust-Vet 	31.6.6623 	2009.07.18 	-
F-Prot 	4.4.4.56 	2009.07.17 	-
F-Secure 	8.0.14470.0 	2009.07.17 	-
Fortinet 	3.120.0.0 	2009.07.18 	-
GData 	19 	2009.07.18 	-
Ikarus 	T3.1.1.64.0 	2009.07.18 	-
Jiangmin 	11.0.800 	2009.07.18 	-
K7AntiVirus 	7.10.794 	2009.07.16 	Trojan.Win32.Malware.1
Kaspersky 	7.0.0.125 	2009.07.18 	-
McAfee 	5679 	2009.07.17 	-
McAfee+Artemis 	5679 	2009.07.17 	-
McAfee-GW-Edition 	6.8.5 	2009.07.18 	-
Microsoft 	1.4803 	2009.07.18 	-
NOD32 	4256 	2009.07.18 	-
Norman 	6.01.09 	2009.07.17 	-
nProtect 	2009.1.8.0 	2009.07.18 	-
Panda 	10.0.0.14 	2009.07.17 	Generic Malware
PCTools 	4.4.2.0 	2009.07.17 	-
Prevx 	3.0 	2009.07.18 	High Risk Worm
Rising 	21.38.52.00 	2009.07.18 	-
Sophos 	4.43.0 	2009.07.18 	-
Sunbelt 	3.2.1858.2 	2009.07.18 	-
Symantec 	1.4.4.12 	2009.07.18 	-
TheHacker 	6.3.4.3.370 	2009.07.17 	-
TrendMicro 	8.950.0.1094 	2009.07.17 	PAK_Generic.001
VBA32 	3.12.10.8 	2009.07.17 	-
ViRobot 	2009.7.17.1841 	2009.07.17 	-
VirusBuster 	4.6.5.0 	2009.07.16 	-
weitere Informationen
File size: 10752 bytes
MD5   : 25116b532484c18ec775bc26914da309
SHA1  : 34313cc8e85585206167a14ccb5868060a569806
SHA256: b88e752f1647e7e10cd72ff49212a701f5b2b5445f93d46f0dd375bcd67c074b
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0x9C90
timedatestamp.....: 0x43F654A2 (Fri Feb 17 23:56:34 2006)
machinetype.......: 0x14C (Intel I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
UPX0 0x1000 0x7000 0x0 0.00 d41d8cd98f00b204e9800998ecf8427e
UPX1 0x8000 0x2000 0x1E00 7.83 fc4ef447659b59cf04c5f06c45607d5f
.rsrc 0xA000 0x1000 0x800 3.36 c160677f97d54879bdc87533f8c2c760

( 7 imports )

> advapi32.dll: RegCloseKey
> kernel32.dll: LoadLibraryA, GetProcAddress, ExitProcess
> msvcp60.dll: __1_Winit@std@@QAE@XZ
> msvcrt.dll: exit
> ole32.dll: CoInitialize
> shell32.dll: SHGetMalloc
> user32.dll: GetFocus

( 0 exports )
TrID  : File type identification
39.5% (.EXE) UPX compressed Win32 Executable (30569/9/7)
34.3% (.EXE) Win32 EXE Yoda's Crypter (26569/9/4)
11.0% (.EXE) Win32 Executable Generic (8527/13/3)
9.8% (.DLL) Win32 Dynamic Link Library (generic) (7583/30/2)
2.5% (.EXE) Generic Win/DOS Executable (2002/3)
ssdeep: 192:agMMw34x7j4Dsw7zPTeCB04u9N2cQZMa+3EGrfaTsPI32hZP7C9WU5y:D/rdjsw9McQmpUGrjQGHP7Doy
Prevx Info: http://info.prevx.com/aboutprogramtext.asp?PX5=14183E20004B4AA72A13005869B4930050768941
PEiD  : UPX 2.90 [LZMA] -> Markus Oberhumer, Laszlo Molnar & John Reiser
packers (Kaspersky): UPX
packers (F-Prot): UPX
CWSandbox: http://research.sunbelt-software.com/partnerresource/MD5.aspx?md5=25116b532484c18ec775bc26914da309
RDS   : NSRL Reference Data Set
         

Diesen S-Shot wollte ich eigentlich noch annhängen. Warum er nun nicht angezeigt wird, weiß ich nicht.

Die gleichen Dateien, die Panda auch angenörgelt hat, lösche beide, dann ist Ruhe.

1.) Wie geht es dem Rechner? Noch irgendwelche Auffälligkeiten?

2.) Poste neue RSIT-Logs => http://www.trojaner-board.de/74910-a...tion-tool.html

3.) Kaspersky - Onlinescanner

Dieser Scanner entfernt die Funde nicht, gibt aber einen guten Überblick über die vorhandene Malware.

---> hier herunterladen => Kaspersky Online Scanner
=> Hinweise zu älteren Versionen beachten!
=> Voraussetzung: Internet Explorer 6.0 oder höher
=> die nötigen ActiveX-Steuerelemente installieren => Update der Signaturen => Weiter
=> Scan-Einstellungen => Standard wählen => OK => Link "Arbeitsplatz" anklicken
=> Scan beginnt automatisch => Untersuchung wurde abgeschlossen => Protokoll speichern als
=> Dateityp auf .txt umstellen => auf dem Desktop als Kaspersky.txt speichern => Log hier posten
=> Deinstallation => Systemsteuerung => Software => Kaspersky Online Scanner entfernen

ciao, andreas

Nein, ich merke nichts mehr, allerdings ist das schon seit dem Avengerdurchlauf so der Fall.

Log, Teil I:

Logfile of random's system information tool 1.06 (written by random/random)
Run by kwam at 2009-07-18 18:03:55
Microsoft Windows XP Home Edition Service Pack 3
System drive C: has 132 GB (55%) free of 238 GB
Total RAM: 2046 MB (47% free)

Logfile of Trend Micro HijackThis v2.0.2
Scan saved at 18:03:56, on 18.07.2009
Platform: Windows XP SP3 (WinNT 5.01.2600)
MSIE: Internet Explorer v6.00 SP3 (6.00.2900.5512)
Boot mode: Normal

Running processes:
C:\WINDOWS\System32\smss.exe
C:\WINDOWS\system32\winlogon.exe
C:\WINDOWS\system32\services.exe
C:\WINDOWS\system32\lsass.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\svchost.exe
C:\WINDOWS\system32\spoolsv.exe
C:\Programme\Avira\AntiVir Desktop\sched.exe
C:\WINDOWS\Explorer.EXE
C:\Programme\Avira\AntiVir Desktop\avguard.exe
C:\WINDOWS\system32\CTsvcCDA.EXE
C:\Programme\ICQ6Toolbar\ICQ Service.exe
C:\Programme\Java\jre6\bin\jqs.exe
C:\Programme\CDBurnerXP\NMSAccessU.exe
C:\WINDOWS\system32\nvsvc32.exe
C:\Programme\CardReader2.0\OTiReader.exe
C:\WINDOWS\system32\RunDLL32.exe
C:\WINDOWS\CTHELPER.EXE
C:\WINDOWS\system32\CTXFIHLP.EXE
C:\WINDOWS\RTHDCPL.EXE
C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe
C:\WINDOWS\SYSTEM32\CTXFISPI.EXE
C:\Programme\Winamp\winampa.exe
C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe
C:\Programme\Avira\AntiVir Desktop\avgnt.exe
C:\WINDOWS\system32\ctfmon.exe
C:\Programme\Creative\MediaSource\Detector\CTDetect.exe
C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe
C:\Programme\Gemeinsame Dateien\Teleca Shared\Generic.exe
C:\WINDOWS\system32\wbem\wmiapsrv.exe
C:\Programme\Sony Ericsson\Mobile2\Mobile Phone Monitor\epmworker.exe
C:\WINDOWS\system32\wscntfy.exe
C:\Programme\Mozilla Firefox\firefox.exe
C:\WINDOWS\System32\svchost.exe
C:\WINDOWS\system32\wuauclt.exe
C:\Programme\Prevx\prevx.exe
C:\Programme\Prevx\prevx.exe
C:\WINDOWS\system32\svchost.exe
C:\Programme\ICQ6.5\ICQ.exe
C:\Programme\Winamp\winamp.exe
C:\Dokumente und Einstellungen\kwam\Desktop\RSIT(2).exe
C:\Programme\trend micro\kwam.exe

R0 - HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?o=101677&l=dis
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = http://go.microsoft.com/fwlink/?LinkId=69157
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Default_Search_URL = http://go.microsoft.com/fwlink/?LinkId=54896
R1 - HKLM\Software\Microsoft\Internet Explorer\Main,Search Page = http://go.microsoft.com/fwlink/?LinkId=54896
R3 - URLSearchHook: (no name) -  - (no file)
R3 - URLSearchHook: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O2 - BHO: ContributeBHO Class - {074C1DC5-9320-4A9A-947D-C042949C6216} - C:\Programme\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O2 - BHO: AcroIEHelperStub - {18DF081C-E8AD-4283-A596-FA578C2EBDC3} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
O2 - BHO: Google Toolbar Helper - {AA58ED58-01DD-4d91-8333-CF10577473F7} - c:\programme\google\googletoolbar1.dll
O2 - BHO: Adobe PDF Conversion Toolbar Helper - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O2 - BHO: Google Toolbar Notifier BHO - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Programme\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll
O2 - BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre6\bin\jp2ssv.dll
O2 - BHO: JQSIEStartDetectorImpl - {E7E6F031-17CE-4C07-BC86-EABFE594F69C} - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll
O2 - BHO: EpsonToolBandKicker Class - {E99421FB-68DD-40F0-B4AC-B7027CAE2F1A} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O2 - BHO: SmartSelect - {F4971EE7-DAA0-4053-9964-665D8EE6A077} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: &Google - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - c:\programme\google\googletoolbar1.dll
O3 - Toolbar: EPSON Web-To-Page - {EE5D279F-081B-4404-994D-C6B60AAEBA6D} - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll
O3 - Toolbar: DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll
O3 - Toolbar: ICQToolBar - {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll
O3 - Toolbar: Adobe PDF - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll
O3 - Toolbar: Contribute Toolbar - {517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - C:\Programme\Adobe\/Adobe Contribute CS4/contributeieplugin.dll
O4 - HKLM\..\Run: [NvCplDaemon] RUNDLL32.EXE C:\WINDOWS\system32\NvCpl.dll,NvStartup
O4 - HKLM\..\Run: [NvMediaCenter] RunDLL32.exe NvMCTray.dll,NvTaskbarInit
O4 - HKLM\..\Run: [CTHelper] CTHELPER.EXE
O4 - HKLM\..\Run: [CTxfiHlp] CTXFIHLP.EXE
O4 - HKLM\..\Run: [D-Link AirPlus G] C:\Programme\D-Link\AirPlus G\AirGCFG.exe
O4 - HKLM\..\Run: [ANIWZCS2Service] C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe
O4 - HKLM\..\Run: [JMB36X Configure] C:\WINDOWS\system32\JMRaidTool.exe boot
O4 - HKLM\..\Run: [RTHDCPL] RTHDCPL.EXE
O4 - HKLM\..\Run: [SkyTel] SkyTel.EXE
O4 - HKLM\..\Run: [Sony Ericsson PC Suite] "C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe" /startoptions
O4 - HKLM\..\Run: [WinampAgent] C:\Programme\Winamp\winampa.exe
O4 - HKLM\..\Run: [AdobeCS4ServiceManager] "C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe" -launchedbylogin
O4 - HKLM\..\Run: [Acrobat Assistant 8.0] "C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe"
O4 - HKLM\..\Run: [Adobe_ID0ENQBO] C:\PROGRA~1\GEMEIN~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE
O4 - HKLM\..\Run: [avgnt] "C:\Programme\Avira\AntiVir Desktop\avgnt.exe" /min
O4 - HKCU\..\Run: [CTFMON.EXE] C:\WINDOWS\system32\ctfmon.exe
O4 - HKCU\..\Run: [Creative Detector] C:\Programme\Creative\MediaSource\Detector\CTDetect.exe /R
O4 - HKCU\..\Run: [Sony Ericsson PC Suite] "C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe" /systray /nologon
O4 - HKCU\..\Run: [ICQ] "C:\Programme\ICQ6.5\ICQ.exe" silent
O8 - Extra context menu item: An vorhandene PDF-Datei anfügen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppend.html
O8 - Extra context menu item: In Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECapture.html
O8 - Extra context menu item: Linkziel an vorhandene PDF-Datei anhängen - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIEAppendSelLinks.html
O8 - Extra context menu item: Linkziel in Adobe PDF konvertieren - res://C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll/AcroIECaptureSelLinks.html
O9 - Extra button: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra 'Tools' menuitem: PartyPoker.com - {B7FE5D70-9AA2-40F1-9C6B-12A255F085E1} - C:\Programme\PartyGaming\PartyPoker\RunApp.exe (file missing)
O9 - Extra button: (no name) - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra 'Tools' menuitem: @xpsp3res.dll,-20001 - {e2e2dd38-d088-4134-82b7-f2ba38496583} - C:\WINDOWS\Network Diagnostic\xpnetdiag.exe
O9 - Extra button: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra 'Tools' menuitem: ICQ6 - {E59EB121-F339-4851-A3BA-FE49C35617C2} - C:\Programme\ICQ6.5\ICQ.exe
O9 - Extra button: Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O9 - Extra 'Tools' menuitem: Windows Messenger - {FB5F1910-F110-11d2-BB9E-00C04F795683} - C:\Programme\Messenger\msmsgs.exe
O16 - DPF: {D0C0F75C-683A-4390-A791-1ACFD5599AB8} (Oberon Flash Game Host) - http://icq.oberon-media.com/Gameshell/GameHost/1.0/OberonGameHost.cab
O18 - Protocol: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\GEMEIN~1\Skype\SKYPE4~1.DLL
O23 - Service: Adobe Version Cue CS4 - Adobe Systems Incorporated - C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe
O23 - Service: ANIWZCSd Service (ANIWZCSdService) - Alpha Networks Inc. - C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe
O23 - Service: Avira AntiVir Planer (AntiVirSchedulerService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\sched.exe
O23 - Service: Avira AntiVir Guard (AntiVirService) - Avira GmbH - C:\Programme\Avira\AntiVir Desktop\avguard.exe
O23 - Service: Creative Service for CDROM Access - Creative Technology Ltd - C:\WINDOWS\system32\CTsvcCDA.EXE
O23 - Service: CSIScanner - Prevx - C:\Programme\Prevx\prevx.exe
O23 - Service: Firebird Server - MAGIX Instance (FirebirdServerMAGIXInstance) - Unknown owner - C:\Programme\MAGIX\Common\Database\bin\fbserver.exe (file missing)
O23 - Service: FLEXnet Licensing Service - Acresso Software Inc. - C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
O23 - Service: ICQ Service - Unknown owner - C:\Programme\ICQ6Toolbar\ICQ Service.exe
O23 - Service: InstallDriver Table Manager (IDriverT) - Macrovision Corporation - C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe
O23 - Service: Java Quick Starter (JavaQuickStarterService) - Sun Microsystems, Inc. - C:\Programme\Java\jre6\bin\jqs.exe
O23 - Service: NMSAccessU - Unknown owner - C:\Programme\CDBurnerXP\NMSAccessU.exe
O23 - Service: NVIDIA Display Driver Service (NVSvc) - NVIDIA Corporation - C:\WINDOWS\system32\nvsvc32.exe
O23 - Service: OTi Card Reader Service - Unknown owner - C:\Programme\CardReader2.0\OTiReader.exe

--
End of file - 9681 bytes

======Registry dump======

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{074C1DC5-9320-4A9A-947D-C042949C6216}]
ContributeBHO Class - C:\Programme\Adobe\/Adobe Contribute CS4/contributeieplugin.dll [2008-09-10 136560]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{18DF081C-E8AD-4283-A596-FA578C2EBDC3}]
Adobe PDF Link Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2009-02-27 75128]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AA58ED58-01DD-4d91-8333-CF10577473F7}]
Google Toolbar Helper - c:\programme\google\googletoolbar1.dll [2008-10-24 2427968]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AE7CD045-E861-484f-8273-0445EE161910}]
Adobe PDF Conversion Toolbar Helper - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{AF69DE43-7D58-4638-B6FA-CE66B5AD205D}]
Google Toolbar Notifier BHO - C:\Programme\Google\GoogleToolbarNotifier\3.1.807.1746\swg.dll [2008-12-24 737776]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{DBC80044-A445-435b-BC74-9C25C1C588A9}]
Java(tm) Plug-In 2 SSV Helper - C:\Programme\Java\jre6\bin\jp2ssv.dll [2009-03-09 35840]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E7E6F031-17CE-4C07-BC86-EABFE594F69C}]
JQSIEStartDetectorImpl Class - C:\Programme\Java\jre6\lib\deploy\jqs\ie\jqs_plugin.dll [2009-03-09 73728]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{E99421FB-68DD-40F0-B4AC-B7027CAE2F1A}]
EpsonToolBandKicker Class - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{F4971EE7-DAA0-4053-9964-665D8EE6A077}]
SmartSelect Class - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\Toolbar]
{2318C2B1-4965-11d4-9B18-009027A5CD4F} - &Google - c:\programme\google\googletoolbar1.dll [2008-10-24 2427968]
{EE5D279F-081B-4404-994D-C6B60AAEBA6D} - EPSON Web-To-Page - C:\Programme\EPSON\EPSON Web-To-Page\EPSON Web-To-Page.dll [2005-02-21 368640]
{32099AAC-C132-4136-9E9A-4E364A424E17} - DAEMON Tools Toolbar - C:\Programme\DAEMON Tools Toolbar\DTToolbar.dll [2008-10-14 863688]
{855F3B16-6D32-4fe6-8A56-BBB695989046} - ICQToolBar - C:\Programme\ICQ6Toolbar\ICQToolBar.dll [2008-06-12 958712]
{47833539-D0C5-4125-9FA8-0819E2EAAC93} - Adobe PDF - C:\Programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\AcroIEFavClient.dll [2008-06-11 345480]
{517BDDE4-E3A7-4570-B21E-2B52B6139FC7} - Contribute Toolbar - C:\Programme\Adobe\/Adobe Contribute CS4/contributeieplugin.dll [2008-09-10 136560]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run]
"NvCplDaemon"=C:\WINDOWS\system32\NvCpl.dll [2006-05-13 7606272]
"NvMediaCenter"=NvMCTray.dll,NvTaskbarInit []
"CTHelper"=C:\WINDOWS\CTHELPER.EXE [2005-08-08 16384]
"CTxfiHlp"=C:\WINDOWS\system32\CTXFIHLP.EXE [2005-08-08 18944]
"D-Link AirPlus G"=C:\Programme\D-Link\AirPlus G\AirGCFG.exe [2005-07-22 1519616]
"ANIWZCS2Service"=C:\Programme\ANI\ANIWZCS2 Service\WZCSLDR2.exe [2004-12-16 49152]
"JMB36X Configure"=C:\WINDOWS\system32\JMRaidTool.exe [2006-04-20 385024]
"RTHDCPL"=C:\WINDOWS\RTHDCPL.EXE [2006-05-04 16206848]
"SkyTel"=C:\WINDOWS\SkyTel.EXE [2006-04-24 1448960]
"Sony Ericsson PC Suite"=C:\Programme\Sony Ericsson\Mobile2\Application Launcher\Application Launcher.exe [2007-03-28 593920]
"WinampAgent"=C:\Programme\Winamp\winampa.exe [2009-02-25 37888]
"AdobeCS4ServiceManager"=C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe [2008-08-14 611712]
"Acrobat Assistant 8.0"=C:\Programme\Adobe\Acrobat 9.0\Acrobat\Acrotray.exe [2008-06-11 640376]
"Adobe_ID0ENQBO"=C:\PROGRA~1\GEMEIN~1\Adobe\ADOBEV~1\Server\bin\VERSIO~2.EXE [2008-08-15 378224]
"avgnt"=C:\Programme\Avira\AntiVir Desktop\avgnt.exe [2009-03-02 209153]

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"=C:\WINDOWS\system32\ctfmon.exe [2008-04-14 15360]
"Creative Detector"=C:\Programme\Creative\MediaSource\Detector\CTDetect.exe [2004-12-02 102400]
"Sony Ericsson PC Suite"=C:\Programme\Sony Ericsson\Sony Ericsson PC Suite\SEPCSuite.exe [2009-02-16 405504]
"ICQ"=C:\Programme\ICQ6.5\ICQ.exe [2009-03-01 172792]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe Photo Downloader]
C:\Programme\Adobe\Photoshop Album Starter Edition\3.0\Apps\apdproxy.exe [2005-06-23 57344]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Cognac]
C:\DOKUME~1\kwam\LOKALE~1\Temp\b.exe []

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\CRBroadCasting]
C:\Programme\CardReader2.0\CRBroadCasting.exe [2004-07-27 24576]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\DAEMON Tools Lite]
C:\Programme\DAEMON Tools Lite\daemon.exe [2008-08-08 490952]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Skype]
C:\Programme\Skype\Phone\Skype.exe [2008-11-07 21633320]

[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\swg]
C:\Programme\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [2008-12-24 68856]

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad]
WPDShServiceObj - {AAA288BA-9A4C-45B0-95D7-94D524869DB5} - C:\WINDOWS\system32\WPDShServiceObj.dll [2006-10-18 133632]

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\System]
"dontdisplaylastusername"=0
"legalnoticecaption"=
"legalnoticetext"=
"shutdownwithoutlogon"=1
"undockwithoutlogon"=1

[HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"NoDriveTypeAutoRun"=323
"NoDriveAutoRun"=67108863
"NoDrives"=0

[HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Policies\explorer]
"HonorAutoRunSetting"=
"NoDriveAutoRun"=
"NoDriveTypeAutoRun"=
"NoDrives"=

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\standardprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"
"C:\Programme\ICQ6.5\ICQ.exe"="C:\Programme\ICQ6.5\ICQ.exe:*:Enabled:ICQ6"
"C:\WINDOWS\system32\dplaysvr.exe"="C:\WINDOWS\system32\dplaysvr.exe:*:Enabled:Microsoft DirectPlay Helper"
"C:\Dokumente und Einstellungen\kwam\Desktop\dud\Age Of Empires 2 & The Conquerors Expansion -\age2_x1.exe"="C:\Dokumente und Einstellungen\kwam\Desktop\dud\Age Of Empires 2 & The Conquerors Expansion -\age2_x1.exe:*:Enabled:Age of Empires II Expansion"
"C:\WINDOWS\system32\dpvsetup.exe"="C:\WINDOWS\system32\dpvsetup.exe:*:Enabled:Microsoft DirectPlay Voice Test"
"C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe"="C:\Programme\Gemeinsame Dateien\Adobe\CS4ServiceManager\CS4ServiceManager.exe:*:Enabled:Adobe CSI CS4"
"C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe"="C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe:*:Enabled:Adobe Version Cue CS4 Server"
"C:\Programme\Skype\Phone\Skype.exe"="C:\Programme\Skype\Phone\Skype.exe:*:Enabled:Skype"

[HKEY_LOCAL_MACHINE\system\currentcontrolset\services\sharedaccess\parameters\firewallpolicy\domainprofile\authorizedapplications\list]
"%windir%\system32\sessmgr.exe"="%windir%\system32\sessmgr.exe:*:enabled:@xpsp2res.dll,-22019"
"%windir%\Network Diagnostic\xpnetdiag.exe"="%windir%\Network Diagnostic\xpnetdiag.exe:*:Enabled:@xpsp3res.dll,-20000"

======File associations======

.js - open - "C:\Programme\Adobe\Adobe Dreamweaver CS4\Dreamweaver.exe","%1"

======List of files/folders created in the last 1 months======

2009-07-18 18:01:25 ----D---- C:\rsit
2009-07-18 12:36:18 ----D---- C:\Programme\Prevx
2009-07-18 12:36:14 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\PrevxCSI
2009-07-18 12:36:14 ----A---- C:\WINDOWS\wininit.ini
2009-07-17 22:37:32 ----D---- C:\Programme\Panda Security
2009-07-17 22:35:59 ----SHD---- C:\Config.Msi
2009-07-17 20:08:39 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\SUPERAntiSpyware.com
2009-07-17 20:08:22 ----D---- C:\Programme\SUPERAntiSpyware
2009-07-17 20:08:22 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\SUPERAntiSpyware.com
2009-07-17 18:10:00 ----SD---- C:\combo-fix
2009-07-17 10:11:31 ----A---- C:\ComboFix.txt
2009-07-17 09:56:36 ----D---- C:\WINDOWS\temp
2009-07-16 01:34:42 ----HDC---- C:\WINDOWS\$NtUninstallKB973346$
2009-07-16 01:34:38 ----HDC---- C:\WINDOWS\$NtUninstallKB971633$
2009-07-16 01:33:18 ----A---- C:\WINDOWS\imsins.BAK
2009-07-16 01:33:14 ----HDC---- C:\WINDOWS\$NtUninstallKB961371$
2009-07-16 01:03:54 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\Malwarebytes
2009-07-16 00:51:18 ----A---- C:\Boot.bak
2009-07-16 00:51:10 ----D---- C:\cmdcons
2009-07-16 00:47:56 ----D---- C:\WINDOWS\ERDNT
2009-07-16 00:26:58 ----A---- C:\RootRepeal report 07-16-09 (00-26-58).txt
2009-07-15 23:23:19 ----A---- C:\RootRepeal report 07-15-09 (23-23-19).txt
2009-07-15 22:13:21 ----D---- C:\Programme\CCleaner
2009-07-15 15:15:13 ----D---- C:\Programme\Malwarebytes' Anti-Malware
2009-07-15 15:15:13 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Malwarebytes
2009-07-14 22:35:27 ----D---- C:\Programme\Trend Micro
2009-07-14 20:46:52 ----D---- C:\WINDOWS\Minidump
2009-07-14 20:38:41 ----A---- C:\WINDOWS\Robota.INI
2009-07-14 20:38:36 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\MAGIX
2009-07-14 20:23:09 ----A---- C:\WINDOWS\system32\mpg4c32.dll
2009-07-14 20:23:07 ----A---- C:\WINDOWS\system32\wmv8dmod.dll
2009-07-14 20:22:19 ----A---- C:\WINDOWS\system32\msxml4a.dll
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\TTIC32.dll
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\TTI32.dll
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\STRING32.dll
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\MXRestore.exe
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\mgxcdr.txt
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\mgxasio2.dll
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\DLLTPO32.dll
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\DLLRES32.dll
2009-07-14 20:22:17 ----A---- C:\WINDOWS\system32\DLLRD32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLPTL32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLPRJ32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLPRF32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLPNT32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLMSC32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLIX.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLISO32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLIO32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLIMG32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLDRV32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLDIR32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLDEV32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLCPY32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLCDF32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLCDA32.dll
2009-07-14 20:22:16 ----A---- C:\WINDOWS\system32\DLLAV32.dll
2009-07-14 20:21:38 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\MAGIX
2009-07-14 20:21:23 ----A---- C:\WINDOWS\system32\DLLDEV32i.dll
2009-07-14 20:21:10 ----D---- C:\WINDOWS\system32\MAGIX
2009-07-14 20:21:10 ----A---- C:\WINDOWS\system32\mgxoschk.dll
2009-07-14 20:21:10 ----A---- C:\WINDOWS\mgxoschk.ini
2009-07-14 19:27:31 ----D---- C:\Programme\Audacity
2009-07-10 20:47:49 ----A---- C:\WINDOWS\system32\d3dx9_27.dll
2009-07-10 20:47:08 ----A---- C:\WINDOWS\system32\psisdecd.dll
2009-07-10 20:47:02 ----A---- C:\WINDOWS\system32\dxdllreg.exe
2009-07-07 18:30:23 ----D---- C:\Programme\Avira
2009-07-07 18:30:23 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Avira
2009-07-06 22:52:05 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\com.adobe.ExMan
2009-07-02 21:11:46 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\Apple Computer
2009-06-24 00:06:08 ----HDC---- C:\WINDOWS\$NtUninstallKB929399$
2009-06-24 00:05:48 ----N---- C:\WINDOWS\system32\spmsg.dll
2009-06-22 15:26:19 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\BVRP Software
2009-06-22 15:22:16 ----A---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\hpe146.dll
2009-06-22 15:12:11 ----D---- C:\Programme\Gemeinsame Dateien\Sony Shared
2009-06-22 15:11:58 ----D---- C:\Programme\Sony
2009-06-22 15:09:10 ----D---- C:\Programme\Gemeinsame Dateien\Apple
2009-06-22 15:09:08 ----D---- C:\Programme\QuickTime
2009-06-22 15:09:07 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple Computer
2009-06-22 15:08:57 ----D---- C:\Programme\Apple Software Update
2009-06-22 15:08:57 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Apple
2009-06-22 15:08:22 ----HDC---- C:\WINDOWS\$NtUninstallWMFDist11$
2009-06-22 15:08:00 ----HDC---- C:\WINDOWS\$NtUninstallWudf01000$
2009-06-22 15:06:51 ----HDC---- C:\WINDOWS\$NtUninstallKB942288-v3$
2009-06-22 15:05:58 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\Sony
         

Log, Teil II:

======List of files/folders modified in the last 1 months======

2009-07-18 18:03:37 ----RD---- C:\Programme
2009-07-18 18:03:27 ----D---- C:\WINDOWS\Prefetch
2009-07-18 18:03:27 ----D---- C:\Programme\Vuze
2009-07-18 17:52:18 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\Winamp
2009-07-18 12:36:18 ----D---- C:\WINDOWS\system32\drivers
2009-07-18 12:36:14 ----D---- C:\WINDOWS
2009-07-18 07:54:32 ----D---- C:\Programme\Mozilla Firefox
2009-07-18 07:53:33 ----D---- C:\WINDOWS\system32\CatRoot2
2009-07-18 01:09:08 ----A---- C:\WINDOWS\SchedLgU.Txt
2009-07-17 22:43:40 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\temp
2009-07-17 22:42:18 ----D---- C:\WINDOWS\system32
2009-07-17 22:39:47 ----HD---- C:\WINDOWS\inf
2009-07-17 22:36:09 ----SHD---- C:\WINDOWS\Installer
2009-07-17 22:36:02 ----D---- C:\Programme\Gemeinsame Dateien
2009-07-17 22:29:12 ----D---- C:\Programme\PartyGaming
2009-07-17 18:10:30 ----SHD---- C:\System Volume Information
2009-07-17 18:10:30 ----D---- C:\WINDOWS\system32\Restore
2009-07-17 09:58:51 ----A---- C:\WINDOWS\system.ini
2009-07-17 09:50:44 ----D---- C:\WINDOWS\AppPatch
2009-07-16 19:38:29 ----D---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Lavasoft
2009-07-16 15:52:56 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\FrostWire
2009-07-16 01:34:42 ----HD---- C:\WINDOWS\$hf_mig$
2009-07-16 01:34:40 ----RSHDC---- C:\WINDOWS\system32\dllcache
2009-07-16 01:33:24 ----D---- C:\WINDOWS\Debug
2009-07-16 00:51:18 ----RASH---- C:\boot.ini
2009-07-15 23:59:29 ----SD---- C:\WINDOWS\Tasks
2009-07-14 23:01:21 ----A---- C:\WINDOWS\win.ini
2009-07-14 22:06:57 ----D---- C:\Programme\Warcraft III
2009-07-14 20:23:18 ----D---- C:\WINDOWS\Help
2009-07-14 20:22:39 ----RSD---- C:\WINDOWS\Fonts
2009-07-14 20:21:11 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\Azureus
2009-07-10 22:57:54 ----SD---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\Microsoft
2009-07-10 20:46:55 ----D---- C:\WINDOWS\system32\DirectX
2009-07-10 20:10:54 ----D---- C:\Programme\Microsoft Games
2009-07-10 16:06:56 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\Skype
2009-07-10 16:01:01 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\skypePM
2009-07-07 19:11:49 ----D---- C:\WINDOWS\WinSxS
2009-07-07 17:10:56 ----A---- C:\WINDOWS\system32\MRT.exe
2009-07-06 22:54:36 ----D---- C:\Dokumente und Einstellungen\kwam\Anwendungsdaten\Adobe
2009-07-02 21:16:14 ----D---- C:\Programme\Gemeinsame Dateien\DVDVideoSoft
2009-07-02 21:16:10 ----D---- C:\Programme\DVDVideoSoft
2009-06-24 00:06:25 ----D---- C:\WINDOWS\system32\CatRoot
2009-06-22 15:28:08 ----SD---- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Microsoft
2009-06-22 15:22:02 ----HD---- C:\Programme\InstallShield Installation Information
2009-06-22 15:22:02 ----D---- C:\Programme\Sony Ericsson
2009-06-22 15:09:29 ----D---- C:\Programme\Internet Explorer
2009-06-22 15:08:28 ----D---- C:\Programme\Windows Media Player
2009-06-22 15:08:08 ----D---- C:\WINDOWS\system32\LogFiles

======List of drivers (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R1 avgio;avgio; \??\C:\Programme\Avira\AntiVir Desktop\avgio.sys []
R1 avipbb;avipbb; C:\WINDOWS\system32\DRIVERS\avipbb.sys [2009-07-08 96104]
R1 intelppm;Intel-Prozessortreiber; C:\WINDOWS\system32\DRIVERS\intelppm.sys [2008-04-14 40448]
R1 kbdhid;Tastatur-HID-Treiber; C:\WINDOWS\system32\DRIVERS\kbdhid.sys [2008-04-14 14720]
R1 ssmdrv;ssmdrv; C:\WINDOWS\system32\DRIVERS\ssmdrv.sys [2009-07-08 28520]
R2 adfs;adfs; C:\WINDOWS\system32\drivers\adfs.sys [2008-08-14 74720]
R2 ANIO;ANIO Service; \??\C:\WINDOWS\system32\ANIO.SYS []
R2 avgntflt;avgntflt; C:\WINDOWS\system32\DRIVERS\avgntflt.sys [2009-07-08 55640]
R3 ctac32k;Creative AC3 Software Decoder; C:\WINDOWS\system32\drivers\ctac32k.sys [2005-08-07 501760]
R3 ctaud2k;Creative Audio Driver (WDM); C:\WINDOWS\system32\drivers\ctaud2k.sys [2005-08-07 439424]
R3 ctprxy2k;Creative Proxy Driver; C:\WINDOWS\system32\drivers\ctprxy2k.sys [2005-08-07 7168]
R3 ctsfm2k;Creative SoundFont Management Device Driver; C:\WINDOWS\system32\drivers\ctsfm2k.sys [2005-08-07 142848]
R3 e1express;Intel(R) PRO/1000 PCI Express Network Connection Driver; C:\WINDOWS\system32\DRIVERS\e1e5132.sys [2006-04-03 199168]
R3 emupia;E-mu Plug-in Architecture Driver; C:\WINDOWS\system32\drivers\emupia2k.sys [2005-08-07 77824]
R3 ha20x2k;Creative 20X HAL Driver; C:\WINDOWS\system32\drivers\ha20x2k.sys [2005-08-07 1093632]
R3 HDAudBus;Microsoft UAA-Bustreiber für High Definition Audio; C:\WINDOWS\system32\DRIVERS\HDAudBus.sys [2008-04-13 144384]
R3 hidusb;Microsoft HID Class-Treiber; C:\WINDOWS\system32\DRIVERS\hidusb.sys [2008-04-13 10368]
R3 mouhid;Maus-HID-Treiber; C:\WINDOWS\system32\DRIVERS\mouhid.sys [2006-02-28 12288]
R3 nv;nv; C:\WINDOWS\system32\DRIVERS\nv4_mini.sys [2006-05-13 3918176]
R3 ossrv;Creative OS Services Driver; C:\WINDOWS\system32\drivers\ctoss2k.sys [2005-08-07 114688]
R3 RT61;D-Link Wireless Driver; C:\WINDOWS\system32\DRIVERS\RT61.sys [2005-06-04 319104]
R3 usbccgp;Microsoft Standard-USB-Haupttreiber; C:\WINDOWS\system32\DRIVERS\usbccgp.sys [2008-04-13 32128]
R3 usbehci;Miniporttreiber für erweiterten Microsoft USB 2.0-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbehci.sys [2008-04-13 30208]
R3 usbhub;Microsoft USB-Standardhubtreiber; C:\WINDOWS\system32\DRIVERS\usbhub.sys [2008-04-13 59520]
R3 usbprint;Microsoft USB-Druckerklasse; C:\WINDOWS\system32\DRIVERS\usbprint.sys [2008-04-13 25856]
R3 usbstor;USB-Massenspeichertreiber; C:\WINDOWS\system32\DRIVERS\USBSTOR.SYS [2008-04-13 26368]
R3 usbuhci;Miniporttreiber für universellen Microsoft USB-Hostcontroller; C:\WINDOWS\system32\DRIVERS\usbuhci.sys [2008-04-13 20608]
S3 ab7p2ig4;ab7p2ig4; C:\WINDOWS\system32\drivers\ab7p2ig4.sys []
S3 Arp1394;1394-ARP-Clientprotokoll; C:\WINDOWS\system32\DRIVERS\arp1394.sys [2008-04-13 60800]
S3 catchme;catchme; \??\C:\DOKUME~1\kwam\LOKALE~1\Temp\catchme.sys []
S3 ctdvda2k;Creative DVD-Audio Device Driver; C:\WINDOWS\system32\drivers\ctdvda2k.sys [2005-07-13 340704]
S3 hamachi;Hamachi Network Interface; C:\WINDOWS\system32\DRIVERS\hamachi.sys [2009-01-29 25280]
S3 IntcAzAudAddService;Service for Realtek HD Audio (WDM); C:\WINDOWS\system32\drivers\RtkHDAud.sys [2006-05-04 4271616]
S3 NIC1394;1394-Netzwerktreiber; C:\WINDOWS\system32\DRIVERS\nic1394.sys [2008-04-13 61824]
S3 s1018bus;Sony Ericsson Device 1018 driver (WDM); C:\WINDOWS\system32\DRIVERS\s1018bus.sys [2008-11-04 86696]
S3 s1018mdfl;Sony Ericsson Device 1018 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\s1018mdfl.sys [2008-11-04 15016]
S3 s1018mdm;Sony Ericsson Device 1018 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\s1018mdm.sys [2008-11-04 114472]
S3 s1018mgmt;Sony Ericsson Device 1018 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\s1018mgmt.sys [2008-11-04 108328]
S3 s1018nd5;Sony Ericsson Device 1018 USB Ethernet Emulation (NDIS); C:\WINDOWS\system32\DRIVERS\s1018nd5.sys [2008-11-04 26024]
S3 s1018obex;Sony Ericsson Device 1018 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\s1018obex.sys [2008-11-04 104616]
S3 s1018unic;Sony Ericsson Device 1018 USB Ethernet Emulation (WDM); C:\WINDOWS\system32\DRIVERS\s1018unic.sys [2008-11-04 109736]
S3 se59bus;Sony Ericsson Device 089 driver (WDM); C:\WINDOWS\system32\DRIVERS\se59bus.sys [2006-09-05 61536]
S3 se59mdfl;Sony Ericsson Device 089 USB WMC Modem Filter; C:\WINDOWS\system32\DRIVERS\se59mdfl.sys [2006-09-05 9360]
S3 se59mdm;Sony Ericsson Device 089 USB WMC Modem Driver; C:\WINDOWS\system32\DRIVERS\se59mdm.sys [2006-09-05 97088]
S3 se59mgmt;Sony Ericsson Device 089 USB WMC Device Management Drivers (WDM); C:\WINDOWS\system32\DRIVERS\se59mgmt.sys [2006-09-05 88624]
S3 se59nd5;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (NDIS); C:\WINDOWS\system32\DRIVERS\se59nd5.sys [2006-09-05 18704]
S3 se59obex;Sony Ericsson Device 089 USB WMC OBEX Interface; C:\WINDOWS\system32\DRIVERS\se59obex.sys [2006-09-05 86432]
S3 se59unic;Sony Ericsson Device 089 USB Ethernet Emulation SEMC59 (WDM); C:\WINDOWS\system32\DRIVERS\se59unic.sys [2006-09-05 90800]
S3 WpdUsb;WpdUsb; C:\WINDOWS\system32\DRIVERS\wpdusb.sys [2006-10-18 38528]
S3 WudfRd;Windows Driver Foundation - User-mode Driver Framework Reflector; C:\WINDOWS\system32\DRIVERS\wudfrd.sys [2006-09-28 82944]
S4 IntelIde;IntelIde; C:\WINDOWS\system32\drivers\IntelIde.sys []
======List of services (R=Running, S=Stopped, 0=Boot, 1=System, 2=Auto, 3=Demand, 4=Disabled)======

R2 AntiVirSchedulerService;Avira AntiVir Planer; C:\Programme\Avira\AntiVir Desktop\sched.exe [2009-07-08 108289]
R2 AntiVirService;Avira AntiVir Guard; C:\Programme\Avira\AntiVir Desktop\avguard.exe [2009-07-08 185089]
R2 Creative Service for CDROM Access;Creative Service for CDROM Access; C:\WINDOWS\system32\CTsvcCDA.EXE [1999-12-12 44032]
R2 CSIScanner;CSIScanner; C:\Programme\Prevx\prevx.exe [2009-07-18 4368952]
R2 ICQ Service;ICQ Service; C:\Programme\ICQ6Toolbar\ICQ Service.exe [2008-06-10 222456]
R2 JavaQuickStarterService;Java Quick Starter; C:\Programme\Java\jre6\bin\jqs.exe [2009-03-09 152984]
R2 NMSAccessU;NMSAccessU; C:\Programme\CDBurnerXP\NMSAccessU.exe [2008-10-20 71096]
R2 NVSvc;NVIDIA Display Driver Service; C:\WINDOWS\system32\nvsvc32.exe [2006-05-13 155715]
R2 OTi Card Reader Service;OTi Card Reader Service; C:\Programme\CardReader2.0\OTiReader.exe [2004-07-26 139369]
R2 WudfSvc;Windows Driver Foundation - User-mode Driver Framework; C:\WINDOWS\system32\svchost.exe [2008-04-14 14336]
S2 ANIWZCSdService;ANIWZCSd Service; C:\Programme\ANI\ANIWZCS2 Service\ANIWZCSdS.exe [2004-10-22 49152]
S3 Adobe Version Cue CS4;Adobe Version Cue CS4; C:\Programme\Gemeinsame Dateien\Adobe\Adobe Version Cue CS4\Server\bin\VersionCueCS4.exe [2008-08-15 284016]
S3 aspnet_state;ASP.NET State Service; C:\WINDOWS\Microsoft.NET\Framework\v4.0.20506\aspnet_state.exe [2009-05-06 35160]
S3 clr_optimization_v2.0.50727_32;.NET Runtime Optimization Service v2.0.50727_X86; C:\WINDOWS\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe [2007-10-24 70144]
S3 clr_optimization_v4.0.20506_32;.NET Runtime Optimization Service v4.0.20506_X86; C:\WINDOWS\Microsoft.NET\Framework\v4.0.20506\mscorsvw.exe [2009-05-06 104272]
S3 FirebirdServerMAGIXInstance;Firebird Server - MAGIX Instance; C:\Programme\MAGIX\Common\Database\bin\fbserver.exe []
S3 FLEXnet Licensing Service;FLEXnet Licensing Service; C:\Programme\Gemeinsame Dateien\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe [2009-06-05 655624]
S3 FontCache3.0.0.0;Windows Presentation Foundation Font Cache 3.0.0.0; C:\WINDOWS\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe [2007-10-09 36864]
S3 IDriverT;InstallDriver Table Manager; C:\Programme\Gemeinsame Dateien\InstallShield\Driver\11\Intel 32\IDriverT.exe [2005-04-04 69632]
S3 idsvc;Windows CardSpace; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe [2007-10-11 864256]
S4 NetTcpPortSharing;Net.Tcp Port Sharing Service; C:\WINDOWS\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe [2007-10-11 122880]

-----------------EOF-----------------
         

Info, Teil I.a:

info.txt logfile of random's system information tool 1.06 2009-07-18 18:01:28

======Uninstall list======

-->"C:\Programme\Creative\Sound Blaster X-Fi\Program\SETUP.EXE" /S /U /W /L:GER
-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0B095086-7205-4D48-90DF-DCD16613C6D4}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0B095086-7205-4D48-90DF-DCD16613C6D4}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0E5AA361-4B16-4282-B639-9E5B2B6A2EC8}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{0E5AA361-4B16-4282-B639-9E5B2B6A2EC8}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{103BCDA0-E063-46AC-8028-64E78722ABA7}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{103BCDA0-E063-46AC-8028-64E78722ABA7}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{32903944-19A2-418C-901D-4BBAF4C55ABA}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{32903944-19A2-418C-901D-4BBAF4C55ABA}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{4D8AA0B4-E890-4BF7-A9D1-8E63027E76D3}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{4D8AA0B4-E890-4BF7-A9D1-8E63027E76D3}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{63A317D0-60A6-43FC-848A-9FE4A53B29CE}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6BF90A01-FA3F-42B9-A071-7D744409967E}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6BF90A01-FA3F-42B9-A071-7D744409967E}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{700932B3-A964-4878-82A2-96054622A1F7}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{84F573D3-0F71-4768-978A-D35310E3FBA6}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{8A3F2ADE-DEF2-4A50-866A-6B9357B5590F}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{8A3F2ADE-DEF2-4A50-866A-6B9357B5590F}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{A82F10CB-18B5-4EAC-AEF2-FA49CD565626}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{B8DA9EB2-DBEF-4F0A-B90A-45B77D9E65B2}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{B8DA9EB2-DBEF-4F0A-B90A-45B77D9E65B2}\setup.exe" -l0x7  /remove
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x7 
-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{CB99E420-8071-48F9-9567-4A53BE7569C4}\setup.exe" -l0x7  /remove
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acrobat.com-->msiexec /qb /x {C86E7C99-E4AD-79C7-375B-1AEF9A91EC2B}
Acrobat.com-->MsiExec.exe /I{C86E7C99-E4AD-79C7-375B-1AEF9A91EC2B}
Adobe After Effects CS4 Presets-->MsiExec.exe /I{44E240EC-2224-4078-A88B-2CEE0D3016EF}
Adobe After Effects CS4 Third Party Content-->MsiExec.exe /I{67A9747A-E1F5-4E9A-81CC-12B5D5B81B6E}
Adobe After Effects CS4-->MsiExec.exe /I{45EC816C-0771-4C14-AE6D-72D1B578F4C8}
Adobe AIR-->c:\Programme\Gemeinsame Dateien\Adobe AIR\Versions\1.0\Resources\Adobe AIR Updater.exe -arp:uninstall
Adobe AIR-->MsiExec.exe /I{197A3012-8C85-4FD3-AB66-9EC7E13DB92E}
Adobe Anchor Service CS4-->MsiExec.exe /I{1618734A-3957-4ADD-8199-F973763109A8}
Adobe Asset Services CS4-->MsiExec.exe /I{B9F4561A-924D-4510-A85A-BB0960C338CB}
Adobe Bridge CS4-->MsiExec.exe /I{83877DB1-8B77-45BC-AB43-2BAC22E093E0}
Adobe CMaps CS4-->MsiExec.exe /I{94D398EB-D2FD-4FD1-B8C4-592635E8A191}
Adobe Color - Photoshop Specific CS4-->MsiExec.exe /I{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}
Adobe Color EU Extra Settings CS4-->MsiExec.exe /I{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}
Adobe Color JA Extra Settings CS4-->MsiExec.exe /I{0D6013AB-A0C7-41DC-973C-E93129C9A29F}
Adobe Color NA Recommended Settings CS4-->MsiExec.exe /I{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}
Adobe Color Video Profiles AE CS4-->MsiExec.exe /I{B15381DD-FF97-4FCD-A881-ED4DB0975500}
Adobe Color Video Profiles CS CS4-->MsiExec.exe /I{63C24A08-70F3-4C8E-B9FB-9F21A903801D}
Adobe Contribute CS4-->MsiExec.exe /I{A6EC82A0-1414-475D-8AFD-469089F3080D}
Adobe Creative Suite 4 Master Collection-->C:\Programme\Gemeinsame Dateien\Adobe\Installers\b2d6abde968e6f277ddbfd501383e02\Setup.exe --uninstall=1
Adobe Creative Suite 4 Master Collection-->MsiExec.exe /I{61D6891E-E822-4448-9F9A-0AAAAEB6AF6C}
Adobe CS4 American English Speech Analysis Models-->MsiExec.exe /I{297190A1-4B0D-4CD6-8B9F-3907F15C3FD8}
Adobe CSI CS4-->MsiExec.exe /I{0F723FC1-7606-4867-866C-CE80AD292DAF}
Adobe Default Language CS4-->MsiExec.exe /I{C52E3EC1-048C-45E1-8D53-10B0C6509683}
Adobe Device Central CS4-->MsiExec.exe /I{67F0E67A-8E93-4C2C-B29D-47C48262738A}
Adobe Dreamweaver CS4-->MsiExec.exe /I{30C8AA56-4088-426F-91D1-0EDFD3A25678}
Adobe Drive CS4-->MsiExec.exe /I{16E16F01-2E2D-4248-A42F-76261C147B6C}
Adobe Dynamiclink Support-->MsiExec.exe /I{60DB5894-B5A1-4B62-B0F3-669A22C0EE5D}
Adobe Encore CS4 Codecs-->MsiExec.exe /I{FB2A5FCC-B81B-48C2-A009-7804694D83E9}
Adobe Encore CS4-->MsiExec.exe /I{5EAD5443-7194-46CC-A055-428E6ABB1BAF}
Adobe ExtendScript Toolkit CS4-->MsiExec.exe /I{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}
Adobe Extension Manager CS4-->MsiExec.exe /I{054EFA56-2AC1-48F4-A883-0AB89874B972}
Adobe Fireworks CS4-->MsiExec.exe /I{428FDF9F-E010-4C4C-A8BB-156960AFCA1C}
Adobe Flash CS4 Extension - Flash Lite STI en-->MsiExec.exe /I{793D1D88-6141-43DE-BE58-59BCE31B4090}
Adobe Flash CS4 STI-en-->MsiExec.exe /I{2168245A-B5AD-40D8-A641-48E3E070B5B6}
Adobe Flash CS4-->MsiExec.exe /I{F6E99614-F042-4459-82B7-8B38B2601356}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->MsiExec.exe /X{03DEEAD2-F3B7-45BF-9006-A25D015F00D2}
Adobe Fonts All-->MsiExec.exe /I{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}
Adobe Illustrator CS4-->MsiExec.exe /I{87532CAB-7932-4F84-8937-823337622807}
Adobe InDesign CS4 Application Feature Set Files (Roman)-->MsiExec.exe /I{2BAF2B96-7560-48B4-87D4-10178DDBE217}
Adobe InDesign CS4 Common Base Files-->MsiExec.exe /I{7CC7BDD5-6F10-4724-96A1-EAC7D9F2831C}
Adobe InDesign CS4 Icon Handler-->MsiExec.exe /I{1E04CB54-AF4E-4AC3-B4B7-C0A160BE57F1}
Adobe InDesign CS4-->MsiExec.exe /I{1DCA3EAA-6EB5-4563-A970-EA14D75037BA}
Adobe Linguistics CS4-->MsiExec.exe /I{931AB7EA-3656-4BB7-864D-022B09E3DD67}
Adobe Media Encoder CS4 Additional Exporter-->MsiExec.exe /I{BE9CEAAA-F069-4331-BF2F-8D350F6504F4}
Adobe Media Encoder CS4 Dolby-->MsiExec.exe /I{EE353798-E875-42E0-B58D-7E6696182EA8}
Adobe Media Encoder CS4 Exporter-->MsiExec.exe /I{561968FD-56A1-49FD-9ED0-F55482C7C5BC}
Adobe Media Encoder CS4 Importer-->MsiExec.exe /I{8186FF34-D389-4B7E-9A2F-C197585BCFBD}
Adobe Media Encoder CS4-->MsiExec.exe /I{DEB90B8E-0DCB-48CE-B90E-8842A2BD643E}
Adobe Media Player-->msiexec /qb /x {39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe Media Player-->MsiExec.exe /I{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}
Adobe MotionPicture Color Files CS4-->MsiExec.exe /I{B05DE7B7-0B40-4411-BD4B-222CAE2D8F15}
Adobe OnLocation CS4-->MsiExec.exe /I{7406DF60-016D-476B-A2C7-55D997592047}
Adobe Output Module-->MsiExec.exe /I{BB4E33EC-8181-4685-96F7-8554293DEC6A}
Adobe PDF Library Files CS4-->MsiExec.exe /I{F93C84A6-0DC6-42AF-89FA-776F7C377353}
Adobe Photoshop CS4 Support-->MsiExec.exe /I{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}
Adobe Photoshop CS4-->MsiExec.exe /I{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}
Adobe Premiere Pro CS4 Functional Content-->MsiExec.exe /I{B169BC97-B8AA-4ACA-9CF2-9D0FF5BABDF7}
Adobe Premiere Pro CS4 Third Party Content-->MsiExec.exe /I{C938BE91-3BB5-4B84-9EF6-88F0505D0038}
Adobe Premiere Pro CS4-->MsiExec.exe /I{D499F8DE-3F31-4900-9157-61061613704B}
Adobe Reader 9.1 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A91000000001}
Adobe Search for Help-->MsiExec.exe /I{F0E64E2E-3A60-40D8-A55D-92F6831875DA}
Adobe Service Manager Extension-->MsiExec.exe /I{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}
Adobe Setup-->MsiExec.exe /I{E8EE9410-8AC4-4F43-A626-DDECA75C79F3}
Adobe SGM CS4-->MsiExec.exe /I{15BF7AAF-846C-4A6D-80E1-5D1FC7FB461B}
Adobe SING CS4-->MsiExec.exe /I{4A52555C-032A-4083-BDD9-6A85ABFB39A8}
Adobe Soundbooth CS4 Codecs-->MsiExec.exe /I{52232EF4-CC12-4C21-ABCF-ADB79618302D}
Adobe Soundbooth CS4-->MsiExec.exe /I{14F70205-1940-4000-88C7-BE799A6B2CAD}
Adobe Type Support CS4-->MsiExec.exe /I{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}
Adobe Update Manager CS4-->MsiExec.exe /I{05308C4E-7285-4066-BAE3-6B50DA6ED755}
Adobe Version Cue CS4 Server-->MsiExec.exe /I{1B7C06E1-4888-47A6-992A-0990B9683486}
Adobe WinSoft Linguistics Plugin-->MsiExec.exe /I{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}
Adobe XMP Panels CS4-->MsiExec.exe /I{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}
Adobe® Photoshop® Album Starter Edition 3.0-->MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}