teil2: ..........................

**************************************************************************

catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, http://www.gmer.net
Rootkit scan 2009-09-02 23:10
Windows 5.1.2600 Service Pack 2 NTFS

Scanne versteckte Prozesse...

Scanne versteckte Autostarteinträge...

Scanne versteckte Dateien...

Scan erfolgreich abgeschlossen
versteckte Dateien: 0

**************************************************************************

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\GarenaPEngine]
"ImagePath"="\??\c:\dokume~1\***\LOKALE~1\Temp\KXD143.tmp"

[HKEY_LOCAL_MACHINE\System\ControlSet001\Services\vdrv9000]
"ImagePath"="system32\DRIVERS\vdrv9000.sys"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------

[HKEY_USERS\S-1-5-21-484763869-1177238915-839522115-1004\Software\Microsoft\SystemCertificates\AddressBook*]
@Allowed: (Read) (RestrictedCode)
@Allowed: (Read) (RestrictedCode)

[HKEY_USERS\S-1-5-21-484763869-1177238915-839522115-1004\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
"??"=hex:37,6e,bc,6e,0f,89,38,54,03,3c,ee,0f,46,4b,d9,ae,84,ea,5e,ea,e0,3c,1a,
f6,d8,f3,e6,8a,41,0a,41,c4,55,80,d4,ef,94,d5,27,87,39,03,e3,6e,3b,77,31,c1,\
"??"=hex:35,fc,c6,3d,c9,02,ad,db,37,1f,61,de,0f,33,8f,50

[HKEY_USERS\S-1-5-21-484763869-1177238915-839522115-1004\Software\SecuROM\License information*]
"datasecu"=hex:66,a1,8b,17,3d,d3,96,9b,6a,5f,82,3a,d4,94,dd,e6,fa,c4,75,d3,03,
16,f1,55,c3,01,75,08,49,29,6c,2e,98,77,0e,f3,8e,91,ff,5d,97,be,03,41,6a,dd,\
"rkeysecu"=hex:0a,73,de,58,a9,ac,33,9c,57,72,a8,24,49,3c,ad,32

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\Installer\UserData\LocalSystem\Components\Ø•€|ÿÿÿÿ•€|ù•6~*]
"70403E1900063D11C8EF10054038389C"="C?\\WINDOWS\\system32\\FM20ENU.DLL"

[HKEY_LOCAL_MACHINE\software\Microsoft\Windows\CurrentVersion\System*]
"OODEFRAG08.00.00.01WORKSTATION"="DC4FD6863692956633E0551CDE8C289B0DA35E38C56B775CCDAF6E31980FB050758DB48912030460D2B62ABF89C4E00FFB99ECAA5D16F9DC1A39 F3E8A2DB22BD88540FDFAC1772A3402437C8E0DF4411921F2F52D8FE7740395E73C9DB0B0EDB2F7CFA5F9F9D8EC3609848F05A95C7E4245FC8692F694B9B8920852FD807D12F747F2624B9 CC5CD80D2BBEB22404B0537526EDEB06FA20885D28D5B6DE201F45D9FED10EFD3B317E921210CF1B2D9C2AC1E66C9C3C3E7726FCBE23C1E4897D2AD03ED1BE226738D332AC45CBD474FA3A 37381FFEE0A1A615A2D4BFF71B59C4F043A60D1E9030FEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74C8EDD5E5BE2 F6E667A9C6AECB7A5D14075D575E7D6A3B9808C038D530D6EB3452F955537E6711AC7F030C5AF7675652D7210FA8BEFA8DF064A18794371EB5B041E6A96F3417BD762803E75A5F3747A5A8 A23BF634ECEC3566C377E28A1FAD94E9BD3305AE6250608919BE2891F76564543A2969FD1E58F41BDAD77263AF8B8EFECB2D873517054D13173C66CF0BB1B0946115EC7425302F2622169B 56B9301BA834D25DB212DFD897248E27FC64EE6183DEBEE3942A97178AAAA12E973CBE6BF4E868623648A550CEB868F3200CA381A255E8A100EA7716B3D6EF6B02C824E2D7B4B1637240E1 B455238148E71F9BCED636DB70FAB77B456E5FF88A13058A9AA73378A53F94623BA8849213224CE43D6847628B6F781375EBCF3AB3EB2D64DF9D560BDF95F538CDADD2DB39C4D8D3708225 CD26682374A941083385D38D663159E13BBC96A6B98A2AD99E93E49D00C5B7BC6FE49748961A68BAEA92B3090AC55C6EDDDA827E03C14B33236DBF06C24BF9D021DE5307B4B13EF066E09A 950C830DE9CDCC42E86F799ED4B207B513BBC1247A3E231393D011050735E9B83FED093614E69BE0E4A36C99039C13CAD7CF21EF23253373BA2E8AE02A679BE422F3A506028CBF8C068386 1256B33B257DA3148088B901365654265DE090599971A85E8F9B232B17723BE9C3BD4E9B1340A479D8BE64F840DA111E65824AF773F359EBC820153E79E5386BCEFA46C202700162E12C11 F599CA72644B393141B503953A8B9D50D14EB0AB16B5A37BB58872AA16E60CAF4AEFC04E1BC585E574C40E34EA977AC5AF53350E26E021D06DDBBDDA1019EB31BA9469BB19EB3C0D42AC95 CC508DEE6A18EB6A168E9AB22C535ADF0C7C0DAF90FE7B0797EB3D84CE5199313D7575883A3D1F5DC4731368774A82F77CC0BA8EC745BDED825199D9D83CDD8AA615382730C5182BDB2EDC A8A324783BAFF0FE12D52F98875F3D478B5A8F6FE06E21A5FED04D250861CC71AD21AA04716E59991941D06DD1D5D7EF3E894F6806BD3DEF1A9FE239BB9E912984E6"
"OODEFRAG10.00.00.01WORKSTATION"="6250DC14F3AFEF9203E9839E70D966F248D5C3B107106C905F3B989CB8ACE8523F37A475305676D8420B399DCBEC888215CFA4506E0EE605F2C6 52BEA4ACF592B0323B41992D4D8E193F29925E9BA0581C7EC1A278E9FA1FC9F36D704AC944C59C2C81FAC80799619AEA47C07C81F8B33D5FC5CCD7A8B64EB0F7E855DB9147315F346B670C 1DD603CF959C2E3220B157CD92EDB7F43200886A2C55D53DF7C898C77D7D12E28750AA336B43273D5B3C8C16DD8A0E6C568C452D8FDB2186D2E5C4985DD5490548AA93383CEE39107C5F1D D4AA02C10CC4E88223C23428845CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CFEBC9E127BECC74CA6A0AC4980AC7933A2D97226D2 13B555A6171C11EC38DE3DA9C6AECB7A5D14078F2900C725E2089B3ED1A5302106C5B5A3818A82C681C2436BE21D77B804BB45EAEF07000AB9F5735F3C1CC89AB425127368AE5CCDD41853 188CAACA8348C8C8ACC80060EF1A27E87752E2F637D0439DEFA352CCE09CBD69D4AB7BEB169511981417E1ABB20BA1868AA7DC36A76225EA801863A4298254400C16AB282ED6F338B5C414 46455AA2B7EE55DFA233B684EEE130C55ADFF5B27881A5CB6D1BBB8110743AF3382C96974FD278B57FB3DF4C05A659CF8BD529E0154ABBDFD1423604EC0E6AD22E8115A503B3319CB19633 9D6C31044CF46C119C7DCFB7DE8B9AFE727E11C674FAF16D246AE52347C2DF48CD453CA77BF99D68587C5183B67831117DD9DEC69412BE7C9D0512F8DBE1A4FDE39853BC0EA1732FB742DE 87C59626AA86F6AEE75D0D3CE15232B2DE72608FF41DCE57412E968CA316615F32600BAECF25328CA8F128558137B999041BB4DE91EAB77EB6F3A79C5081538C774F1D9146A14C568CE545 86037043E71FD677E3FCF0054F237049EAFBB970F24D4DB8AC9A7D6ABE1BC2E761D45CDC97E61C678725074D288FA51052B535F9F5AF0CEDED1B6A134CE106B90A2409F77399556641BBB9 8AB98A8AB7C3D09C934A9A2E705BDBCCB3D96DA0083C68BB699BF6DE7AA034CB9B87258BA0C0E2CE437A14CC180DB2C19D175476C2C2D6E9EA03C30C4DC7492F426CF4064B61455CF5E31F F2E0AF3C9783062C6200006C401AF1C923AC6DF68E2693944DE0D0968A79B8C9A0EB03574E7FFD11AF7769E91DF785D3DD8B5A7F4550FD9FA9A94E39D4837DA04B7B5A269F8CA8A3A00707 D3166AAA3469FD6F6763AF01B9D497AC5366A90E36D9771F11F40C8607E92E78F0F03A28BD69BF1CF7AD1745877DBA544EA1661622A76DCDC16BC068623414EC4DA91594CAF2AC683D9D3D C633C84CBFD99B9B987F070B76A8575576E19C002ABBF08DDA378FC86E895F3BD6EACB26FDE69F8B6A6BB9A63D793ED42AB4B45F0ACDA8173BE3BE385BF252109BDE"
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------

- - - - - - - > 'winlogon.exe'(1504)
e:\programme\SUPERAntiSpyware\SASWINLO.dll

- - - - - - - > 'explorer.exe'(484)
c:\windows\system32\WPDShServiceObj.dll
c:\windows\system32\PortableDeviceTypes.dll
c:\windows\system32\PortableDeviceApi.dll
c:\windows\system32\browselc.dll
c:\progra~1\JAMSOF~1\TREESI~1\FSizeCol.dll
c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.dll
c:\programme\Gemeinsame Dateien\Adobe\Acrobat\ActiveX\PDFShell.DEU
e:\programme\Illustrate\dBpowerAMP\dBShell.dll
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\brss01a.exe
c:\windows\system32\nvsvc32.exe
e:\programme\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
c:\windows\system32\wscntfy.exe
c:\windows\system32\rundll32.exe
c:\progra~1\MICROS~3\rapimgr.exe
c:\programme\Razer\Lycosa\razertra.exe
c:\programme\Windows Live\Contacts\wlcomm.exe
c:\programme\Razer\Diamondback 3G\razertra.exe
e:\programme\Virtual CD v9\System\vc9tray.exe
c:\programme\Razer\Diamondback 3G\razerofa.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2009-09-02 23:16 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2009-09-02 21:16

Vor Suchlauf: 3'224'694'784 Bytes frei
Nach Suchlauf: 3'267'637'248 Bytes frei

WindowsXP-KB310994-SP2-Home-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Home Edition" /fastdetect /nodebug /NoExecute=OptIn /usepmtimer

319 --- E O F --- 2009-08-02 01:46

Ziemlich rot und ziemlich übel.

Datei agp440.sys empfangen 2009.09.02 21:36:00 (UTC)
Status:    Beendet 
Ergebnis: 23/41 (56.1%) 
 Filter 
Drucken der Ergebnisse  Antivirus	Version	letzte aktualisierung	Ergebnis
a-squared	4.5.0.24	2009.09.02	Virus.Win32.Cutwail!IK
AhnLab-V3	5.0.0.2	2009.09.02	-
AntiVir	7.9.1.7	2009.09.02	SPR/Tool.Cutwail.L.11
Antiy-AVL	2.0.3.7	2009.09.02	-
Authentium	5.1.2.4	2009.09.02	W32/Cutwail.B
Avast	4.8.1335.0	2009.09.02	Win32:Cutwail
AVG	8.5.0.409	2009.09.02	Generic14.ADYJ
BitDefender	7.2	2009.09.02	Rootkit.Kobcka.Patched.Gen
CAT-QuickHeal	10.00	2009.09.02	-
ClamAV	0.94.1	2009.09.02	-
Comodo	2178	2009.09.02	-
DrWeb	5.0.0.12182	2009.09.02	-
eSafe	7.0.17.0	2009.09.02	-
eTrust-Vet	31.6.6717	2009.09.02	Win32/Cutwail.ATB
F-Prot	4.5.1.85	2009.09.01	-
F-Secure	8.0.14470.0	2009.09.02	-
Fortinet	3.120.0.0	2009.09.02	PossibleThreat
GData	19	2009.09.02	Rootkit.Kobcka.Patched.Gen
Ikarus	T3.1.1.68.0	2009.09.02	Virus.Win32.Cutwail
Jiangmin	11.0.800	2009.09.02	-
K7AntiVirus	7.10.834	2009.09.02	Trojan.Win32.Malware.1
Kaspersky	7.0.0.125	2009.09.02	-
McAfee	5728	2009.09.02	Cutwail.gen.e
McAfee+Artemis	5728	2009.09.02	Cutwail.gen.e
McAfee-GW-Edition	6.8.5	2009.09.02	Riskware.Tool.Cutwail.L.11
Microsoft	1.5005	2009.09.02	Virus:Win32/Cutwail.G
NOD32	4390	2009.09.02	Win32/Wigon.LZ
Norman		2009.09.02	W32/Rootkit.ATJD
nProtect	2009.1.8.0	2009.09.02	Trojan/W32.Agent.94016
Panda	10.0.2.2	2009.09.02	Trj/CI.A
PCTools	4.4.2.0	2009.09.02	-
Prevx	3.0	2009.09.02	Medium Risk Malware
Rising	21.45.14.00	2009.09.01	-
Sophos	4.45.0	2009.09.02	Mal/Generic-A
Sunbelt	3.2.1858.2	2009.09.02	-
Symantec	1.4.4.12	2009.09.02	-
TheHacker	6.3.4.3.395	2009.09.02	-
TrendMicro	8.950.0.1094	2009.09.02	-
VBA32	3.12.10.10	2009.09.01	-
ViRobot	2009.9.2.1914	2009.09.02	Win32.Mntfs.A
VirusBuster	4.6.5.0	2009.09.02	Win32.Protector.CV
weitere Informationen
File size: 94016 bytes
MD5...: b061a6e3ba06e8057fb5a6eeeaec9285
SHA1..: f2f0ae8bace5d17e2ed4c585c93253d4a41891b5
SHA256: 0dea6c3a4499e934f5f4e4f4ef0b6b178223d3dc350f662cccf88253c03d5186
ssdeep: 1536:eM/YdwcVIzmTLlY6AbALiNBryARGOB/BycYDx:elTISTLlh6tjB/RYDx
PEiD..: -
PEInfo: PE Structure information

( base data )
entrypointaddress.: 0xed1
timedatestamp.....: 0x4a94914d (Wed Aug 26 01:35:09 2009)
machinetype.......: 0x14c (I386)

( 3 sections )
name viradd virsiz rawdsiz ntrpy md5
.text 0x220 0xd4f 0xd60 5.99 7e9151baddc33093f935e692db7fe3c4
.data 0xf80 0x19 0x20 2.17 09023b0586a11b5dd790a88206791533
.reloc 0xfa0 0x15fa0 0x15fa0 6.04 73e9b081965cdff0f15f1f27e6c507de
         

1.) Deinstalliere:

• Apple Software Update
• Ask Toolbar
• AVG Anti-Spyware 7.5
• HijackThis 1.99.1
• InCD
• J2SE Runtime Environment 5.0 Update 1
• J2SE Runtime Environment 5.0 Update 11
• J2SE Runtime Environment 5.0 Update 6
• Java(TM) 6 Update 11
• Java(TM) 6 Update 2
• Java(TM) 6 Update 3
• Java(TM) 6 Update 5
• Java(TM) 6 Update 7
• Java(TM) SE Runtime Environment 6 Update 1
• Skype™ 3.6
• Spybot - Search & Destroy
• TuneUp Utilities 2009
• VideoLAN VLC media player 0.8.5
• Windows Internet Explorer 7
• Windows Media Player 10 Hotfix

Kontrolliere deine Softwareliste und deinstalliere alles, das du nicht mehr brauchst oder spielst.

2.) Lösche den Ordner

c:\rsit

3.) Poste neue RSIT-Logs. (nur die info.txt)

4.) Erstelle ein Filelisting.

• Lade die Datei listing1.bat auf deinen Desktop
• Doppelklicke auf listing1.bat
• Am Ende befindet sich eine Datei listing.txt auf dem Desktop. Die bei einem Filehoster (z.B. Datei Upload, Bilder hochladen, Datei Hosting auf Materialordner.de) hochladen und hier den Link posten.

5.) Panda Active Scan

Folgende Seite führt dich durch die Installation: PandaActiveScan2.0 Installation

Drücke auf Jetzt Scannen!

Eine Registrierung ist nicht erforderlich!

Nachdem der Scan abgeschlossen ist drücke auf das Text-Icon Export und speichere das log auf dem Desktop.
Öffne die Datei ActiveScan.txt die sich nun auf deinem Desktop befindet und poste uns den Inhalt.

ciao, andreas

Edit: Deinstalliere auch noch:

• PrevxCSI
• SuperAntiSpyware

RSIT teil1 : ......

info.txt logfile of random's system information tool 1.06 2009-09-03 00:53:18

======Uninstall list======

!xSpeed-->E:\!xSpeed\uninstal.exe
-->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
-->E:\Programme\DivX\ConverterUninstall.exe /CONVERTER
-->MsiExec.exe /I{8A42F680-2DD6-11D4-9A8C-0040F6982C20}
-->MsiExec.exe /I{A2529672-574A-4A99-86A5-C1770A0E31FE}
-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
µTorrent-->"D:\Bittorrent\uninstall.exe"
7-Zip 3.13-->rundll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\7-zip.inf,SevenZip.Uninstall
ACDSee 5.0 PowerPack Trial-->MsiExec.exe /I{E48A3003-0DB6-41A8-AEA7-B95989B5D505}
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Adobe Flash Player 9 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\FlashUtil9c.exe -uninstallUnlock
Adobe Reader 9.1.3 - Deutsch-->MsiExec.exe /I{AC76BA86-7AD7-1031-7B44-A91000000001}
Adobe Shockwave Player-->C:\WINDOWS\system32\Macromed\SHOCKW~1\UNWISE.EXE C:\WINDOWS\system32\Macromed\SHOCKW~1\Install.log
Adobe® Photoshop® Album Starter Edition 3.0-->MsiExec.exe /I{4BDFD2CE-6329-42E4-9801-9B3D1F10D79B}
Age of Empires III - The WarChiefs-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{1C08A24C-B168-407E-A826-68FAF5F20710}
Age of Empires III-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\11\INTEL3~1\IDriver.exe /M{7B9CC60A-9B81-46A3-A953-76B6BF9EEC97}
Apple Mobile Device Support-->MsiExec.exe /I{A43B2A2F-1DB5-47F9-A608-F11A4835D7CB}
Astraware Sudoku for Pocket PC-->C:\Programme\Astraware\Astraware Sudoku for Pocket PC\uninst.exe
Athlon 64 Processor Driver-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\01\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{C151CE54-E7EA-4804-854B-F515368B0798}\setup.exe" -l0x7
Audacity 1.2.6-->"E:\Programme\Audacity\unins000.exe"
Ballance-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{42E0783D-3BA4-454B-B58A-BF26E49EB7DE}\setup.exe"
Bowling Master-->C:\Programme\Microsoft ActiveSync\Bowling Master\Uninstall.exe Bowling Master
Brother MFL-Pro Suite-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{BB9AC6BF-71B6-42A4-9689-C17D9F44E79A}\Setup.exe" -l0x7 Brunin03.dllBrunin03.dll
Call of Duty - United Offensive-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{A662E280-64A8-4CF5-8407-13D0808602B3}
Call of Duty-->E:\PROGRA~1\CALLOF~1\Uninstall\Unwise.exe /u E:\PROGRA~1\CALLOF~1\Uninstall\Install.log
Camtasia Studio 3-->E:\Programme\TechSmith\Camtasia Studio 3\CSuninst.EXE
Catch the Sperm II-->E:\Programme\CatchTheSperm2\Uninstall.exe "E:\Programme\CatchTheSperm2\install.log"
Catch the Sperm Unlimited-->"E:\Programme\CatchTheSpermUnlimited\Uninstall.exe" "E:\Programme\CatchTheSpermUnlimited\install.log"
CCleaner (remove only)-->"E:\Programme\CCleaner\uninst.exe"
Choice Guard-->MsiExec.exe /I{8FFC5648-FAF8-43A3-BC8F-42BA1E275C4E}
ClickBall Freeware Edition-->C:\Programme\Microsoft ActiveSync\ClickBall Freeware Edition\Uninstall.exe ClickBall Freeware Edition
COD2 Demo-->C:\Programme\Microsoft ActiveSync\COD2 Demo\Uninstall.exe COD2 Demo
Compatibility Pack for the 2007 Office system-->MsiExec.exe /X{90120000-0020-0407-0000-0000000FF1CE}
Condition Zero Deleted Scenes-->"E:\Programme\Steam\steam.exe" steam://uninstall/100
Condition Zero-->"E:\Programme\Steam\steam.exe" steam://uninstall/80
Counter-Strike: Source-->"E:\Programme\Steam\steam.exe" steam://uninstall/240
Counter-Strike-->"E:\Programme\Steam\steam.exe" steam://uninstall/10
Crazy Machines - Neue Herausforderungen-->MsiExec.exe /X{294EF51E-1453-4F42-8792-77DBFB47D0EC}
Crazy Machines - Neues aus dem Labor-->MsiExec.exe /X{BFF2D920-80F2-46E9-8246-79A20BB9D8B2}
Crazy Machines-->MsiExec.exe /X{8E6A3B40-DCE3-47D9-835B-FE1AD9C083D0}
DATA BECKER Handy Pack 6.0-->C:\WINDOWS\IsUn0407.exe -fe:\programme\HandyPack6.0\Uninst.isu
dBpowerAMP Monkeys Audio Codec-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Monkeys Audio Codec.dat
dBpowerAMP Music Converter-->"C:\WINDOWS\system32\SpoonUninstall.exe" <uninstall>C:\WINDOWS\system32\SpoonUninstall-dBpowerAMP Music Converter.dat
Dev-C++ 5 beta 9 release (4.9.9.2)-->"E:\Dev-Cpp\uninstall.exe"
DivX Codec-->E:\Programme\DivX\DivXCodecUninstall.exe /CODEC
DivX Content Uploader-->E:\Programme\DivX\DivXContentUploaderUninstall.exe /CUPLOADER
DivX Converter-->E:\Programme\DivX\ConverterUninstall.exe /CONVERTER
DivX Player-->E:\Programme\DivX\DivXPlayerUninstall.exe /PLAYER
DivX Web Player-->C:\Programme\DivX\DivXWebPlayerUninstall.exe /PLUGIN
Doom 3-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{584267B8-0BB0-4D18-9FFA-726576619E9A} /l1033 /x
DotAzilla-->E:\Programme\DotAzilla\Uninstall.exe
Dual-Core Optimizer-->MsiExec.exe /X{9FD6F1A8-5550-46AF-8509-271DF0E768B5}
EA SPORTS online 2008-->E:\Programme\EA SPORTS\EA SPORTS online\EASOUNInstaller.exe
eMule Shell Extension-->MsiExec.exe /I{F32652D2-7A93-4769-B88F-504DA9AE50C5}
eMule-->"D:\eMule\Uninstall.exe"
EO Video 1.36-->C:\WINDOWS\iun6002.exe "E:\Programme\EO Video\irunin.ini"
EVEREST Home Edition v2.20-->"E:\Lavalys\EVEREST Home Edition\unins000.exe"
Exact Audio Copy 0.95b4-->E:\Programme\Exact Audio Copy\uninst.exe
Far Cry-->C:\PROGRA~1\GEMEIN~1\INSTAL~1\Driver\9\INTEL3~1\IDriver.exe /M{D6DBDC2A-E72C-4284-B6AD-6B3B61B4DABC}
FEAR-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{2B653229-9854-4989-B780-D978F5F13EAB}\setup.exe" -l0x7 /zU -removeonly
FIFA 09-->MsiExec.exe /X{2315B23D-3E21-4920-837D-AE6460934ECB}
FlashFXP v3-->E:\Programme\FlashFXP\unins000.exe
foobar2000 v0.9-->"E:\Programme\foobar2000\uninstall.exe"
Fraps (remove only)-->"E:\Fraps\uninstall.exe"
Free FLV Converter V 6.4.1-->"E:\Programme\Free FLV Converter\unins000.exe"
Free YouTube to Mp3 Converter version 3.1-->"E:\Programme\DVDVideoSoft\Free YouTube to Mp3 Converter\unins000.exe"
Futuremark SystemInfo-->"C:\Programme\InstallShield Installation Information\{BEE64C14-BEF1-4610-8A68-A16EAA47B882}\setup.exe" -runfromtemp -l0x0009 -removeonly
Gamers.IRC 5.21-->E:\Programme\Gamers.IRC\uninstall.exe
Garena-->C:\Programme\InstallShield Installation Information\{89C89156-A70F-4C6D-9CAE-2EA71F1396FE}\setup.exe -runfromtemp -l0x0009 -removeonly
Google Video Player-->"E:\Programme\Google\Google Video Player\Uninstall.exe"
Guitar Hero III-->MsiExec.exe /I{0CE1A6C0-F3F7-49E6-8F9D-2431F9827441}
Hamsterball Gold 3.10-->"E:\Programme\Raptisoft\Hamsterball3.1\unins000.exe"
Hex Workshop v6-->MsiExec.exe /X{48FE73F3-4C3A-4871-BCD0-A7726A08BD64}
HighMAT-Erweiterung für den Microsoft Windows XP-Assistenten zum Schreiben von CDs-->MsiExec.exe /X{FCE65C4E-B0E8-4FBD-AD16-EDCBE6CD591F}
Hotfix for Windows Media Format 11 SDK (KB929399)-->"C:\WINDOWS\$NtUninstallKB929399$\spuninst\spuninst.exe"
Hotfix for Windows Media Format SDK (KB902344)-->"C:\WINDOWS\$NtUninstallKB902344$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB909394)-->"C:\WINDOWS\$NtUninstallKB909394$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB915865)-->"C:\WINDOWS\$NtUninstallKB915865$\spuninst\spuninst.exe"
Hotfix for Windows XP (KB926239)-->"C:\WINDOWS\$NtUninstallKB926239$\spuninst\spuninst.exe"
Hotfix für Windows Media Player 11 (KB939683)-->"C:\WINDOWS\$NtUninstallKB939683$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB896256)-->"C:\WINDOWS\$NtUninstallKB896256$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB914440)-->"C:\WINDOWS\$NtUninstallKB914440$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB924441)-->"C:\WINDOWS\$NtUninstallKB924441$\spuninst\spuninst.exe"
Hotfix für Windows XP (KB952287)-->"C:\WINDOWS\$NtUninstallKB952287$\spuninst\spuninst.exe"
HT Ultra Long DVD-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{A63A48BD-914D-43DE-A976-CD3022C49C9B}\Setup.exe" -l0x9
ICQ6.5-->"C:\Programme\InstallShield Installation Information\{60DE4033-9503-48D1-A483-7846BD217CA9}\setup.exe" -runfromtemp -l0x0009 -removeonly
iPod for Windows 2005-03-23-->C:\Programme\Gemeinsame Dateien\InstallShield\Driver\8\Intel 32\IDriver.exe /M{44A537A5-859C-43A6-8285-C0668142A090} /l1031
IrfanView (remove only)-->C:\Programme\IrfanView\iv_uninstall.exe
iTunes-->MsiExec.exe /I{9357AE3A-B2ED-4138-BB9B-0564352C3F0A}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Kaspersky Internet Security 2009-->MsiExec.exe /I{8CB14A64-CEF4-4C8F-B1C8-1C3B8752CB55}
Logitech Audio Echo Cancellation Component-->MsiExec.exe /X{BEF726DD-4037-4214-8C6A-E625C02D2870}
Logitech Gaming Software-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\10\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{5C1DA723-24FC-48AD-93BA-925695C3EF26}\setup.exe" -l0x7 -removeonly
Logitech iTouch Software-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{036AA4D4-6D32-11D4-9875-00105ACE7734}\Setup.exe" -l0x7 UNINSTALL
Logitech QuickCam-->MsiExec.exe /X{7D2370AC-D8E6-4996-986A-19824F8A167C}
Logitech Video Enumerator-->MsiExec.exe /X{EA516024-D84D-41F1-814F-83175A6188F2}
Logitech® Camera-Treiber-->"C:\Programme\Gemeinsame Dateien\LogiShrd\QCDRV\BIN\SETUP.EXE" UNINSTALL REMOVEPROMPT
Magic ISO Maker v5.4 (build 0251)-->E:\PROGRA~1\MagicISO\UNWISE.EXE E:\PROGRA~1\MagicISO\INSTALL.LOG
Magic ISO Maker v5.5 (build 0276)-->E:\PROGRA~1\MagicISO\UNWISE.EXE E:\PROGRA~1\MagicISO\INSTALL.LOG
Malwarebytes' Anti-Malware-->"E:\Programme\Malwarebytes' Anti-Malware\unins000.exe"
MetFileRegenerator v3.014.2-->"E:\Programme\MetFileRegenerator\uninstall.exe"
Microsoft .NET Framework 1.1 German Language Pack-->MsiExec.exe /X{E78BFA60-5393-4C38-82AB-E8019E464EB4}
Microsoft .NET Framework 1.1 Hotfix (KB928366)-->"C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\hotfix.exe" "C:\WINDOWS\Microsoft.NET\Framework\v1.1.4322\Updates\M928366\M928366Uninstall.msp"
Microsoft .NET Framework 1.1-->msiexec.exe /X {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 1.1-->MsiExec.exe /X{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}
Microsoft .NET Framework 2.0 Service Pack 1-->MsiExec.exe /I{B508B3F1-A24A-32C0-B310-85786919EF28}
Microsoft ActiveSync-->MsiExec.exe /I{99052DB7-9592-4522-A558-5417BBAD48EE}
Microsoft Compression Client Pack 1.0 for Windows XP-->"C:\WINDOWS\$NtUninstallMSCompPackV1$\spuninst\spuninst.exe"
Microsoft Games for Windows - LIVE Redistributable-->MsiExec.exe /X{929CE49F-1CA7-4CF3-A9A1-6D757443C63F}
Microsoft Internationalized Domain Names Mitigation APIs-->"C:\WINDOWS\$NtServicePackUninstallIDNMitigationAPIs$\spuninst\spuninst.exe"
Microsoft National Language Support Downlevel APIs-->"C:\WINDOWS\$NtServicePackUninstallNLSDownlevelMapping$\spuninst\spuninst.exe"
Microsoft Office Professional Edition 2003-->MsiExec.exe /I{91E30407-6000-11D3-8CFE-0150048383C9}
Microsoft SQL Server Desktop Engine (SONY_MEDIAMGR)-->MsiExec.exe /X{E09B48B5-E141-427A-AB0C-D3605127224A}
Microsoft User-Mode Driver Framework Feature Pack 1.0-->"C:\WINDOWS\$NtUninstallWudf01000$\spuninst\spuninst.exe"
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053-->MsiExec.exe /X{770657D0-A123-3C07-8E44-1C83EC895118}
Microsoft Visual C++ 2005 Redistributable-->MsiExec.exe /X{7299052b-02a4-4627-81f2-1818da5d550d}
Microsoft Windows-Journal-Viewer-->MsiExec.exe /X{43DCF766-6838-4F9A-8C91-D92DA586DFA8}
MITs Wizard 3.0 for Device-->MsiExec.exe /X{0143CF89-5CF2-4F2D-80D5-BFAE64E1BA00}
Moorhuhn 3-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{A6473724-A851-11D5-986D-00500443CF9F}\Setup.exe"
Moorhuhn Soccer-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\09\00\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{59DC43FF-8F26-40B2-A566-C69C9457BF7D}\setup.exe" -l0x7
Moorhuhn Wanted XXL-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{A116D023-A3BC-4C70-A8B8-9FE77850F0D9}\Setup.exe" -l0x7 DUIM
Moorhuhn Winter-Edition-->C:\WINDOWS\IsUn0407.exe -f"E:\Programme\phenomedia\Moorhuhn Winter-Edition\Uninst.isu"
Moorhuhn X - XXL-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{D0D3C193-7052-4DE4-8BF4-3954D2021FF2}\Setup.exe" -l0x7
Moorhuhn-->C:\WINDOWS\IsUn0407.exe -fE:\Programme\Phenomedia\Moorhuhn1\Uninst.isu
Mozilla Firefox (3.5.2)-->C:\Programme\Mozilla Firefox\uninstall\helper.exe
Mozilla Thunderbird (2.0.0.23)-->E:\Programme\Mozilla Thunderbird\uninstall\helper.exe
MP3 Folders-->MsiExec.exe /I{5CE09320-7745-11D8-B964-00B0D02C43C4}
MPEG-VCR-->E:\PROGRA~1\MPEGED~1\UNWISE.EXE E:\PROGRA~1\MPEGED~1\INSTALL.LOG
MSVCRT-->MsiExec.exe /I{22B775E7-6C42-4FC5-8E10-9A5E3257BD94}
MSXML 4.0 SP2 (KB927978)-->MsiExec.exe /I{37477865-A3F1-4772-AD43-AAFC6BCFF99F}
MSXML 4.0 SP2 (KB936181)-->MsiExec.exe /I{C04E32E0-0416-434D-AFB9-6969D703A9EF}
MSXML 4.0 SP2 (KB954430)-->MsiExec.exe /I{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}
MSXML 4.0 SP2 Parser and SDK-->MsiExec.exe /I{716E0306-8318-4364-8B8F-0CC4E9376BAC}
Multimedia Launcher-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{1FBF6C24-C1FD-4101-A42B-0C564F9E8E79}\setup.exe" -uninstall
MVision-->MsiExec.exe /I{35725FBC-A136-4A46-9F29-091759D9BB93}
Need for Speed™ Most Wanted-->E:\Programme\EA GAMES\Need for Speed Most Wanted\EAUninstall.exe
Nero OEM-->C:\Programme\Ahead\nero\uninstall\UNNERO.exe /UNINSTALL
NHL06-->E:\Programme\EA SPORTS\NHL06\EAUninstall.exe
NVIDIA Drivers-->C:\WINDOWS\system32\nvuninst.exe UninstallGUI
O&O Defrag Professional Edition-->MsiExec.exe /I{53480330-E1D1-41CA-B8F8-7F78644F7F50}
OmniGSoft Snow Rally Canada 1.1 for Pocket PC-->C:\Programme\Microsoft ActiveSync\OmniGSoft Snow Rally Canada 1.1 for Pocket PC\Uninstall.exe OmniGSoft Snow Rally Canada 1.1 for Pocket PC
PaperPort-->MsiExec.exe /I{A17EABB6-D0C6-44E5-820C-72DC7F495064}
PokerStars.net-->E:\Programme\PokerStars.NET\Uninstall.EXE /u:"PokerStars.net"
PowerDVD-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{6811CAA0-BF12-11D4-9EA1-0050BAE317E1}\Setup.exe" -uninstall
Prevx 3.0-->"C:\Programme\Prevx\prevx.exe" /prop UNINSTALL=Y
Project64 1.6-->MsiExec.exe /X{9559F7CA-5E34-4237-A2D9-D856464AD727}
PunkBuster Services-->C:\WINDOWS\system32\pbsvc.exe -u
Python 2.1 combined Win32 extensions-->E:\Python21\UNWISE~1.EXE E:\Python21\w32inst.log
Python 2.1-->E:\Python21\\Python21\UNWISE.EXE E:\Python21\\Python21\INSTALL.LOG
Python 2.6-->MsiExec.exe /I{110EB5C4-E995-4CFB-AB80-A5F315BEA9E8}
QIP Uninstall-->E:\Programme\QIP\UnQip.exe
QuickTime-->MsiExec.exe /I{95A890AA-B3B1-44B6-9C18-A8F7AB3EE7FC}
Razer Diamondback 3G-->C:\Programme\InstallShield Installation Information\{7E659C5C-4DF1-499B-B802-77BAE9ABE4D4}\Setup.exe -runfromtemp -l0x0009 -removeonly
Razer Lycosa-->C:\Programme\InstallShield Installation Information\{E0FA1DC5-FEBF-4E7B-8FA3-DB94233E952D}\Setup.exe -runfromtemp -l0x0007 -removeonly
RealPlayer-->C:\Programme\Gemeinsame Dateien\Real\Update_OB\r1puninst.exe RealNetworks|RealPlayer|6.0
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\11\50\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" -l0x7 -removeonly
Retriever 1.1.4.0-->"E:\Programme\Retriever\unins000.exe"
Rhapsody Player Engine-->MsiExec.exe /I{22DE1881-9D24-4981-B5CC-EC7E9F2F4D52}
Riva FLV Player-->"E:\Programme\Riva FLV Player\unins000.exe"
RivaTuner v2.0 RC 16-->"E:\Programme\RivaTuner v2.0 RC 16\uninstall.exe"
RM Converter 3-->E:\Programme\RM Converter 3\Uninstall.exe
Scramby 1.5.0.6-->"E:\Programme\Scramby\unins000.exe"
Security Task Manager 1.6f-->E:\Programme\Security Task Manager\Uninstal.exe "C:\Dokumente und Einstellungen\All Users\Startmenü\Programme\Security Task Manager"
Security Update for CAPICOM (KB931906)-->MsiExec.exe /I{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Security Update for CAPICOM (KB931906)-->MsiExec.exe /X{0EFDF2F9-836D-4EB7-A32D-038BD3F1FB2A}
Segoe UI-->MsiExec.exe /I{A1F66FC9-11EE-4F2F-98C9-16F8D1E69FB7}
ShortKeys Lite-->E:\SHORTK~1\UNWISE.EXE E:\SHORTK~1\INSTALL.LOG
Sicherheitsupdate für Windows Media Encoder (KB954156)-->"C:\WINDOWS\$NtUninstallKB954156_WM9L$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB911564)-->"C:\WINDOWS\$NtUninstallKB911564$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player (KB952069)-->"C:\WINDOWS\$NtUninstallKB952069_WM9$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 10 (KB911565)-->"C:\WINDOWS\$NtUninstallKB911565$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 10 (KB917734)-->"C:\WINDOWS\$NtUninstallKB917734_WMP10$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 10 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP10$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB936782)-->"C:\WINDOWS\$NtUninstallKB936782_WMP11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 11 (KB954154)-->"C:\WINDOWS\$NtUninstallKB954154_WM11$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows Media Player 6.4 (KB925398)-->"C:\WINDOWS\$NtUninstallKB925398_WMP64$\spuninst\spuninst.exe"
Sicherheitsupdate für Windows XP (KB890046)-->"C:\WINDOWS\$NtUninstallKB890046$\spuninst\spuninst.exe"

teil2: ...............

Soldat 1.4.2-->"E:\Soldat\unins000.exe"
Sommerspiele Deinstallieren-->E:\Programme\Sommerspiele\uninstall.exe
Sony Media Manager 2.2-->MsiExec.exe /X{71A41426-C7A4-4DCF-A9ED-C5B4B105ED1D}
Sony Vegas 7.0-->MsiExec.exe /X{251C3815-7A55-4607-A82D-C3B98F0FBAB8}
SpeedFan (remove only)-->"E:\Programme\SpeedFan\uninstall.exe"
Spelling Dictionaries Support For Adobe Reader 9-->MsiExec.exe /I{AC76BA86-7AD7-5464-3428-900000000004}
Steam-->MsiExec.exe /X{048298C9-A4D3-490B-9FF9-AB023A9238F3}
Sudoku-->"C:\Programme\Gemeinsame Dateien\MimarSinan\Installation Information\{FB5055E4-9BE1-425F-B40A-33E43E9460DA}\{C8A522A9-9CBA-4AD3-80E9-EE3DD9BCA3A2}\SudokuSetup.exe" REMOVE=TRUE MODIFY=FALSE
SUPERAntiSpyware Free Edition-->MsiExec.exe /X{CDDCBBF1-2703-46BC-938B-BCC81A1EEAAA}
TeamSpeak 2 RC2-->E:\Programme\Teamspeak2_RC2\unins000.exe
Text-To-Speech-Runtime-->MsiExec.exe /X{7B3F0113-E63C-4D6D-AF19-111A3165CCA2}
TI Connect 1.6-->MsiExec.exe /I{A8B94669-8654-4126-BD28-D0D2412CDED6}
TI NoteFolio Creator-->MsiExec.exe /I{F07AE5AB-516C-4CEB-A0AA-AD083B9182C6}
TiEmu 2.08-->"E:\Programme\TiEmu\unins000.exe"
TommyK-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{2CC9A4AB-9E07-460F-B643-8F810859BCCD}\Setup.exe" -l0x9
Top Spin 2-->MsiExec.exe /I{4D5B5CDD-77BD-48FB-8E2C-42A41ADC7CEC}
TrackMania Original 1.5.0-->"E:\TrackMania\unins000.exe"
TrackMania United DVD Patch 2006-12-15-->"E:\Programme\TrackMania United\unins000.exe"
TreeSize Professional 3.3-->"C:\Programme\JAM Software\TreeSize Professional\unins000.exe"
Ulead COOL 360 1.0-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{3CEA4CA8-CDD4-451C-B673-E8F17BE01B15}\Setup.exe" -l0x7 -uninst
Ulead Photo Explorer 8.6-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{025C3792-E9C6-432A-92C1-661F99D021CA}\setup.exe" -l0x7
Ulead PhotoImpact 11-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{C8550C86-A712-4219-AD4C-038C9FD1D149}\setup.exe" -l0x7
UltraStar Deluxe-->N:\UltraStar Deluxe\Uninstall.exe
Uninstall 1.0.0.1-->"C:\Programme\Gemeinsame Dateien\DVDVideoSoft\unins000.exe"
Update für Windows XP (KB894391)-->"C:\WINDOWS\$NtUninstallKB894391$\spuninst\spuninst.exe"
Update für Windows XP (KB896727)-->"C:\WINDOWS\$NtUninstallKB896727$\spuninst\spuninst.exe"
Update für Windows XP (KB898461)-->"C:\WINDOWS\$NtUninstallKB898461$\spuninst\spuninst.exe"
Update für Windows XP (KB900485)-->"C:\WINDOWS\$NtUninstallKB900485$\spuninst\spuninst.exe"
Update für Windows XP (KB900930)-->"C:\WINDOWS\$NtUninstallKB900930$\spuninst\spuninst.exe"
Update für Windows XP (KB904942)-->"C:\WINDOWS\$NtUninstallKB904942$\spuninst\spuninst.exe"
Update für Windows XP (KB910437)-->"C:\WINDOWS\$NtUninstallKB910437$\spuninst\spuninst.exe"
Update für Windows XP (KB916595)-->"C:\WINDOWS\$NtUninstallKB916595$\spuninst\spuninst.exe"
Update für Windows XP (KB920872)-->"C:\WINDOWS\$NtUninstallKB920872$\spuninst\spuninst.exe"
Update für Windows XP (KB922582)-->"C:\WINDOWS\$NtUninstallKB922582$\spuninst\spuninst.exe"
Update für Windows XP (KB927891)-->"C:\WINDOWS\$NtUninstallKB927891$\spuninst\spuninst.exe"
Update für Windows XP (KB929338)-->"C:\WINDOWS\$NtUninstallKB929338$\spuninst\spuninst.exe"
Update für Windows XP (KB930916)-->"C:\WINDOWS\$NtUninstallKB930916$\spuninst\spuninst.exe"
Update für Windows XP (KB931836)-->"C:\WINDOWS\$NtUninstallKB931836$\spuninst\spuninst.exe"
Update für Windows XP (KB932823-v3)-->"C:\WINDOWS\$NtUninstallKB932823-v3$\spuninst\spuninst.exe"
Update für Windows XP (KB933360)-->"C:\WINDOWS\$NtUninstallKB933360$\spuninst\spuninst.exe"
Update für Windows XP (KB938828)-->"C:\WINDOWS\$NtUninstallKB938828$\spuninst\spuninst.exe"
Update für Windows XP (KB942763)-->"C:\WINDOWS\$NtUninstallKB942763$\spuninst\spuninst.exe"
Update für Windows XP (KB942840)-->"C:\WINDOWS\$NtUninstallKB942840$\spuninst\spuninst.exe"
Update für Windows XP (KB951072-v2)-->"C:\WINDOWS\$NtUninstallKB951072-v2$\spuninst\spuninst.exe"
Update für Windows XP (KB955839)-->"C:\WINDOWS\$NtUninstallKB955839$\spuninst\spuninst.exe"
Update für Windows XP (KB961503)-->"C:\WINDOWS\$NtUninstallKB961503$\spuninst\spuninst.exe"
Update für Windows XP (KB967715)-->"C:\WINDOWS\$NtUninstallKB967715$\spuninst\spuninst.exe"
VC80CRTRedist - 8.0.50727.762-->MsiExec.exe /I{767CC44C-9BBC-438D-BAD3-FD4595DD148B}
VDMSound 2.0.4-->MsiExec.exe /I{8ECBE643-8230-11D5-9D6B-00A024112F81}
Ventrilo Client-->MsiExec.exe /I{789289CA-F73A-4A16-A331-54D498CE069F}
Vodei Multimedia Processor 2.00-->E:\Programme\Vodei\uninst.exe
WC3Banlist-->"E:\Programme\WC3Banlist\unins000.exe"
Wichtiges Update für Windows Media Player 11 (KB959772)-->"C:\WINDOWS\$NtUninstallKB959772_WM11$\spuninst\spuninst.exe"
Windows Driver Package - Razer (Razerlow) HIDClass (03/07/2007 1.0.0.2)-->C:\PROGRA~1\DIFX\D6ACC4BE676423A2B130B78A4B627FC457D98997\DPInst.exe /u C:\WINDOWS\system32\DRVSTORE\db3g_17CEA01FB508D63DE2A978D03A05C3D4BC0BA4B7\db3g.inf
Windows Genuine Advantage v1.3.0254.0-->MsiExec.exe /I{63569CE9-FA00-469C-AF5C-E5D4D93ACF91}
Windows Installer 3.1 (KB893803)-->"C:\WINDOWS\$MSI31Uninstall_KB893803v2$\spuninst\spuninst.exe"
Windows Installer Clean Up-->MsiExec.exe /X{121634B0-2F4B-11D3-ADA3-00C04F52DD52}
Windows Live Anmelde-Assistent-->MsiExec.exe /I{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}
Windows Live Call-->MsiExec.exe /I{5FC68772-6D56-41C6-9DF1-24E868198AE6}
Windows Live Communications Platform-->MsiExec.exe /I{3B4E636E-9D65-4D67-BA61-189800823F52}
Windows Live Essentials-->C:\Programme\Windows Live\Installer\wlarp.exe
Windows Live Essentials-->MsiExec.exe /I{91E04CA7-0B13-4F8C-AA4D-2A573AC96D19}
Windows Live Messenger-->MsiExec.exe /X{837B6259-6FF5-4E66-87C1-A5A15ED36FF4}
Windows Live-Uploadtool-->MsiExec.exe /I{205C6BDD-7B73-42DE-8505-9A093F35A238}
Windows Media Encoder 9-Reihe-->msiexec.exe /I {E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Encoder 9-Reihe-->MsiExec.exe /I{E38C00D0-A68B-4318-A8A6-F7D4B5B1DF0E}
Windows Media Format 11 runtime-->"C:\Programme\Windows Media Player\wmsetsdk.exe" /UninstallAll
Windows Media Format 11 runtime-->"C:\WINDOWS\$NtUninstallWMFDist11$\spuninst\spuninst.exe"
Windows Media Format SDK Hotfix - KB891122-->"C:\WINDOWS\$NtUninstallKB891122$\spuninst\spuninst.exe"
Windows Media Player 11-->"C:\Programme\Windows Media Player\Setup_wm.exe" /Uninstall
Windows Media Player 11-->"C:\WINDOWS\$NtUninstallwmp11$\spuninst\spuninst.exe"
Windows Mobile®-Gerätehandbuch-->C:\Programme\Windows Mobile Device Handbook\Windows Mobile Device Handbook\Bin\DHUninstall.exe
Windows XP-Hotfix - KB873339-->C:\WINDOWS\$NtUninstallKB873339$\spuninst\spuninst.exe
Windows XP-Hotfix - KB885250-->C:\WINDOWS\$NtUninstallKB885250$\spuninst\spuninst.exe
Windows XP-Hotfix - KB885835-->C:\WINDOWS\$NtUninstallKB885835$\spuninst\spuninst.exe
Windows XP-Hotfix - KB885836-->C:\WINDOWS\$NtUninstallKB885836$\spuninst\spuninst.exe
Windows XP-Hotfix - KB886185-->C:\WINDOWS\$NtUninstallKB886185$\spuninst\spuninst.exe
Windows XP-Hotfix - KB887472-->C:\WINDOWS\$NtUninstallKB887472$\spuninst\spuninst.exe
Windows XP-Hotfix - KB887742-->C:\WINDOWS\$NtUninstallKB887742$\spuninst\spuninst.exe
Windows XP-Hotfix - KB887797-->C:\WINDOWS\$NtUninstallKB887797$\spuninst\spuninst.exe
Windows XP-Hotfix - KB888113-->C:\WINDOWS\$NtUninstallKB888113$\spuninst\spuninst.exe
Windows XP-Hotfix - KB888302-->C:\WINDOWS\$NtUninstallKB888302$\spuninst\spuninst.exe
Windows XP-Hotfix - KB890859-->"C:\WINDOWS\$NtUninstallKB890859$\spuninst\spuninst.exe"
Windows XP-Hotfix - KB891781-->C:\WINDOWS\$NtUninstallKB891781$\spuninst\spuninst.exe
WinPcap 4.0-->C:\Programme\WinPcap\uninstall.exe
WinRAR archiver-->E:\Programme\WinRar\uninstall.exe
Worms Armageddon-->C:\WINDOWS\IsUn0407.exe -fe:\WormsArmageddon\Uninst.isu
Worms World Party-->RunDll32 C:\PROGRA~1\GEMEIN~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Programme\InstallShield Installation Information\{9A200E68-D5F4-4E70-910F-2871753A0E2B}\setup.exe"
Worms.IP.Override 2.0-->"E:\Programme\Worms.IP.Override\unins000.exe"
Worms.IP.Override-->MsiExec.exe /X{3E517D96-F713-4563-AB57-E8FA6EE1C7DD}
Xbox 360 Controller for Windows-->"C:\WINDOWS\$NtUninstall_Xbox_360_CC_Driver$\spuninst\spuninst.exe"
Xfire (remove only)-->"E:\Programme\Xfire\uninst.exe"
XP Codec Pack-->C:\Programme\XP Codec Pack\Uninstall.exe
xp-AntiSpy 3.96-2-->E:\Programme\xp-AntiSpy\Uninstall.exe
YAWLE 0.5b-->C:\WINDOWS\iun6002.exe "E:\Programme\Warcraft III\YAWLE\irunin.ini"
YETISPORTS Pingu Throw D.C.-->"C:\Programme\Yetisports\Uninstall.exe" "C:\Programme\Yetisports\install.log"
Zattoo 3.3.4 Beta-->E:\Programme\Zattoo\uninst.exe

======Security center information======

AV: Kaspersky Internet Security (outdated)
FW: Kaspersky Internet Security

======System event log======

Computer Name: ***
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "Anwendungsverwaltung" gesendet.

Record Number: 13979
Source Name: Service Control Manager
Time Written: 20090903002005.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 7023
Message: Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
Das angegebene Modul wurde nicht gefunden.


Record Number: 13978
Source Name: Service Control Manager
Time Written: 20090903002005.000000+120
Event Type: Fehler
User:

Computer Name: ***
Event Code: 7036
Message: Dienst "Anwendungsverwaltung" befindet sich jetzt im Status "Beendet".

Record Number: 13977
Source Name: Service Control Manager
Time Written: 20090903002005.000000+120
Event Type: Informationen
User:

Computer Name: ****
Event Code: 7035
Message: Der Steuerbefehl "starten" wurde erfolgreich an den Dienst "Anwendungsverwaltung" gesendet.

Record Number: 13976
Source Name: Service Control Manager
Time Written: 20090903002005.000000+120
Event Type: Informationen
User: ****

Computer Name: ***
Event Code: 7023
Message: Der Dienst "Anwendungsverwaltung" wurde mit folgendem Fehler beendet:
Das angegebene Modul wurde nicht gefunden.


Record Number: 13975
Source Name: Service Control Manager
Time Written: 20090903002005.000000+120
Event Type: Fehler
User:

=====Application event log=====

Computer Name: ***
Event Code: 301
Message: MsnMsgr (1672) \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\***@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\dfsr.db: Das Datenbankmodul gibt die Protokolldatei \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\****@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\fsr019BB.log wieder.

Record Number: 31803
Source Name: ESENT
Time Written: 20090508125552.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 301
Message: MsnMsgr (1672) \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\****@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\dfsr.db: Das Datenbankmodul gibt die Protokolldatei \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\****@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\fsr019BA.log wieder.

Record Number: 31802
Source Name: ESENT
Time Written: 20090508125552.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 301
Message: MsnMsgr (1672) \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\***@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\dfsr.db: Das Datenbankmodul gibt die Protokolldatei \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\***@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\fsr019B9.log wieder.

Record Number: 31801
Source Name: ESENT
Time Written: 20090508125551.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 301
Message: MsnMsgr (1672) \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\***@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\dfsr.db: Das Datenbankmodul gibt die Protokolldatei \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\***@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\fsr019B8.log wieder.

Record Number: 31800
Source Name: ESENT
Time Written: 20090508125551.000000+120
Event Type: Informationen
User:

Computer Name: ***
Event Code: 300
Message: MsnMsgr (1672) \\.\C:\Dokumente und Einstellungen\***\Lokale Einstellungen\Anwendungsdaten\Microsoft\Messenger\***@hotmail.com\SharingMetadata\Working\database_6458_3CB6_583C_88B6\dfsr.db: Das Datenbankmodul initiiert Schritte zur Wiederherstellung.

Record Number: 31799
Source Name: ESENT
Time Written: 20090508125550.000000+120
Event Type: Informationen
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%systemroot%\system32;%systemroot%;%systemroot%\system32\wbem;C:\Programme\Gemeinsame Dateien\Ulead Systems\MPEG;C:\Programme\Gemeinsame Dateien\Ulead Systems\DVD;%VDMSPath%;E:\Programme\Gemeinsame Dateien\GTK\2.0\bin;C:\Programme\QuickTime\QTSystem;C:\Programme\Microsoft SQL Server\80\Tools\Binn
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 35 Stepping 2, AuthenticAMD
"PROCESSOR_REVISION"=2302
"NUMBER_OF_PROCESSORS"=2
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"VDMSPath"=E:\Programme\VDMSound\
"LANG"=de
"CLASSPATH"=.;C:\Programme\Java\jre1.6.0_01\lib\ext\QTJava.zip
"QTJAVA"=C:\Programme\Java\jre1.6.0_01\lib\ext\QTJava.zip

-----------------EOF-----------------

Filelisting: http://www.materialordner.de/qU82sET...oI4Yqdpzu.html

Panda Scan kommt morgen

- Also das mit der XP Pro CD wird schwierig... Ich kenn niemanden der die hat

- nach all den deinstallationen hab ich zwei probleme:
1. Die Schriftart im Browser, Desktop etc. ist plötzlich anders
2. Die Treiber/Software von Tatatur/Maus sind weg


Panda Scan:

;***************************************************************************************************************************************************** ******************************
ANALYSIS: 2009-09-03 13:14:25
PROTECTIONS: 1
MALWARE: 14
SUSPECTS: 6
;***************************************************************************************************************************************************** ******************************
PROTECTIONS
Description Version Active Updated
;===================================================================================================================================================== ==============================
Kaspersky Internet Security 8.0.0.506 Yes No
;===================================================================================================================================================== ==============================
MALWARE
Id Description Type Active Severity Disinfectable Disinfected Location
;===================================================================================================================================================== ==============================
00039729 HackTool/Unsecure.A HackTools No 0 Yes No N:\nicht verwendete Desktopverknüpfungen\Unsecure\Uns12.exe
00039729 HackTool/Unsecure.A HackTools No 0 No No N:\nicht verwendete Desktopverknüpfungen\Unsecure.rar[Unsecurev1.2.zip][Uns12.exe]
00139064 Cookie/Atlas DMT TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\***\Cookies\***@atdmt[2].txt
00262020 Cookie/Atwola TrackingCookie No 0 Yes No C:\Dokumente und Einstellungen\***\Cookies\***@atwola[1].txt
00331070 Application/MotherboardMonitor.A HackTools No 0 Yes No E:\Programme\Gamers.IRC\bin\dll\moo.dll
01895149 Malicious Packer SecRisk No 0 Yes No E:\Programme\No23 Recorder\No23Recorder.exe
02878197 Generic Trojan Virus/Trojan No 0 No No E:\FirefoxDownload\FEAR_102_blutpatch.rar[FEAR_1.02_Blutpatch.exe]
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{C4ACFDC9-8DD2-4710-8846-910C21F55848}\RP22\A0003866.sys
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\WINDOWS\LastGood\system32\drivers\agp440.sys
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\WINDOWS\system32\drivers\OLD1A7.tmp
03074964 Trj/CI.A Virus/Trojan No 0 Yes No C:\System Volume Information\_restore{C4ACFDC9-8DD2-4710-8846-910C21F55848}\RP22\A0003865.sys
03899020 Generic Trojan Virus/Trojan No 0 No No E:\FirefoxDownload\rld-tunt.rar[tmunite.dll]
04414633 Generic Trojan Virus/Trojan No 0 Yes No E:\Programme\Garena\plugins\FixedUpdatePlugin.dll
04414633 Generic Trojan Virus/Trojan No 0 Yes No E:\Programme\Ocean Technology\GG E-Sports Platform\plugins\FixedUpdatePlugin.dll
;===================================================================================================================================================== ==============================
SUSPECTS
Sent Location OV
;===================================================================================================================================================== ==============================
No E:\Programme\Gamers.IRC\mirc.exe OV
No E:\Programme\Gamers.IRC\mirc.exe.BAK OV
No E:\Programme\QIP\qip.exe OV
No E:\System Volume Information\_restore{C4ACFDC9-8DD2-4710-8846-910C21F55848}\RP15\A0002487.exe OV
No N:\nicht verwendete Desktopverknüpfungen\4083_samp_v01b.rar[samp01b-installer.exe] OV
;===================================================================================================================================================== ==============================
VULNERABILITIES
Id Severity Description OV
;===================================================================================================================================================== ==============================
212494 HIGH MS09-042 OV
212493 HIGH MS09-041 OV
212490 HIGH MS09-038 OV
212530 HIGH MS09-034 OV
210618 HIGH MS09-019 OV
208379 HIGH MS09-014 OV
203806 HIGH MS08-078 OV
203508 HIGH MS08-073 OV
201250 HIGH MS08-058 OV
209273 HIGH MS08-045 OV
194861 HIGH MS08-031 OV
191617 HIGH MS08-024 OV
187735 HIGH MS08-010 OV
;===================================================================================================================================================== ==============================