|
Log-Analyse und Auswertung: roter Bildschirm "Aus Sicherheitsgründen wurde ihr Windowssystem blockiert"Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
09.08.2011, 10:41 | #1 |
| roter Bildschirm "Aus Sicherheitsgründen wurde ihr Windowssystem blockiert" Nach einigen Minuten Laufzeit erscheint ein roter Bildschirm "Aus Sicherheitsgründen wurde ihr Windowssystem blockiert". Unten auf der Seite ist ein Button "Bezahlen und herunterladen", den ich natürlich nicht betätige. Nur noch Ausschalten ist möglich. OTLPE (von CD) lieferte OTL.txt: (Direktes OTL.txt und Extras.txt im Anhang) OTL logfile created on: 8/9/2011 12:00:10 PM - Run OTLPE by OldTimer - Version 3.1.48.0 Folder = X:\Programs\OTLPE 64bit-Windows Vista (TM) Home Premium Service Pack 2 (Version = 6.0.6002) - Type = System Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.00 Gb Total Physical Memory | 3.00 Gb Available Physical Memory | 90.00% Memory free 3.00 Gb Paging File | 3.00 Gb Available in Paging File | 98.00% Paging File free Paging file location(s): C:\pagefile.sys 0 0 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 488.28 Gb Total Space | 371.57 Gb Free Space | 76.10% Space Free | Partition Type: NTFS Drive D: | 310.50 Gb Total Space | 225.57 Gb Free Space | 72.65% Space Free | Partition Type: NTFS Drive E: | 97.14 Gb Total Space | 0.40 Gb Free Space | 0.42% Space Free | Partition Type: NTFS Drive F: | 687.37 Gb Total Space | 114.25 Gb Free Space | 16.62% Space Free | Partition Type: NTFS Drive G: | 687.37 Gb Total Space | 466.22 Gb Free Space | 67.83% Space Free | Partition Type: NTFS Drive H: | 310.50 Gb Total Space | 154.14 Gb Free Space | 49.64% Space Free | Partition Type: NTFS Drive I: | 310.50 Gb Total Space | 53.50 Gb Free Space | 17.23% Space Free | Partition Type: NTFS Drive J: | 14.65 Gb Total Space | 1.20 Gb Free Space | 8.18% Space Free | Partition Type: NTFS Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS Computer Name: REATOGO | User Name: SYSTEM Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days Using ControlSet: ControlSet001 ========== Win32 Services (SafeList) ========== SRV:64bit: - [2009/02/18 18:39:26 | 000,160,784 | ---- | M] (Logitech, Inc.) [On_Demand] -- C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV:64bit: - [2008/01/20 22:47:32 | 000,383,544 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend) SRV - [2011/07/20 14:48:31 | 000,269,480 | ---- | M] (Avira GmbH) [Auto] -- D:\tools\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011/05/21 00:01:00 | 002,214,504 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService) SRV - [2011/05/01 12:11:58 | 000,136,360 | ---- | M] (Avira GmbH) [Auto] -- D:\tools\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2010/10/16 06:46:40 | 000,369,256 | ---- | M] (NVIDIA Corporation) [Auto] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service) SRV - [2010/03/18 07:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32) SRV - [2009/05/21 15:21:18 | 000,248,832 | ---- | M] (Hewlett-Packard Co.) [On_Demand] -- D:\treiber\hp_officejet\Digital Imaging\bin\hpqcxs08.dll -- (hpqcxs08) SRV - [2009/05/06 13:53:50 | 001,220,608 | ---- | M] (MAGIX AG) [Auto] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\FABS.exe -- (Fabs) SRV - [2009/03/30 00:42:14 | 000,066,368 | ---- | M] (Microsoft Corporation) [Disabled] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32) SRV - [2008/10/24 10:35:44 | 000,128,296 | ---- | M] () [Auto] -- D:\Programme\Steuerprogramm\2010\AAVUpdateManager\aavus.exe -- (AAV UpdateService) SRV - [2008/09/04 21:33:24 | 002,848,000 | ---- | M] () [Auto] -- D:\util\DiskImage\oodiag.exe -- (O&O DiskImage) SRV - [2008/08/07 06:10:02 | 003,276,800 | ---- | M] (MAGIX®) [On_Demand] -- C:\Program Files (x86)\Common Files\MAGIX Services\Database\bin\fbserver.exe -- (FirebirdServerMAGIXInstance) SRV - [2007/11/28 05:27:24 | 000,800,040 | ---- | M] (Nero AG) [On_Demand] -- D:\tools\Nero 7\Nero BackItUp\NBService.exe -- (NBService) SRV - [2007/11/06 16:16:54 | 000,139,264 | ---- | M] (Hewlett-Packard Co.) [Auto] -- D:\treiber\hp_officejet\Digital Imaging\bin\hpqddsvc.dll -- (hpqddsvc) SRV - [2007/07/24 05:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto] -- C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) SRV - [2006/12/27 19:00:00 | 000,356,352 | R--- | M] (AVM Berlin) [Auto] -- C:\Program Files (x86)\avmwlanstick\WLanNetService.exe -- (AVM WLAN Connection Service) ========== Driver Services (SafeList) ========== DRV:64bit: - [2011/07/20 14:48:31 | 000,123,784 | ---- | M] (Avira GmbH) [Kernel | System] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV:64bit: - [2011/07/20 14:48:31 | 000,088,288 | ---- | M] (Avira GmbH) [File_System | Auto] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV:64bit: - [2010/11/21 04:45:36 | 000,063,696 | ---- | M] () [Kernel | On_Demand] -- C:\Windows\System32\drivers\RAMDiskVE.sys -- (RAMDiskVE) DRV:64bit: - [2010/08/24 14:26:08 | 000,025,688 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- C:\Windows\System32\drivers\johci.sys -- (johci) DRV:64bit: - [2010/06/23 03:21:34 | 000,318,568 | ---- | M] (Realtek ) [Kernel | On_Demand] -- C:\Windows\System32\drivers\Rtlh64.sys -- (RTL8169) DRV:64bit: - [2010/03/12 12:21:52 | 000,097,280 | ---- | M] (Prolific Technology Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\ser2pl64.sys -- (Ser2pl) DRV:64bit: - [2010/02/03 09:56:56 | 000,033,856 | -H-- | M] (LogMeIn, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\hamachi.sys -- (hamachi) DRV:64bit: - [2009/04/11 01:42:21 | 000,140,288 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- C:\Windows\System32\drivers\rmcast.sys -- (RMCAST) RMCAST (Pgm) DRV:64bit: - [2009/01/28 16:49:12 | 000,376,400 | ---- | M] (Protect Software GmbH) [Kernel | Auto] -- C:\Windows\System32\drivers\acedrv11.sys -- (acedrv11) DRV:64bit: - [2008/12/18 17:47:30 | 000,041,488 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt) DRV:64bit: - [2008/12/18 17:47:18 | 000,057,872 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt) DRV:64bit: - [2008/12/18 17:47:10 | 000,055,312 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt) DRV:64bit: - [2008/12/18 15:30:58 | 000,098,656 | ---- | M] (JMicron Technology Corp.) [Kernel | Boot] -- C:\Windows\System32\drivers\jraid.sys -- (JRAID) DRV:64bit: - [2008/09/04 21:36:48 | 000,042,504 | ---- | M] (O&O Software GmbH) [File_System | Boot] -- C:\Windows\System32\drivers\oodivdh.sys -- (oodivdh) DRV:64bit: - [2008/09/04 21:36:38 | 000,171,016 | ---- | M] (O&O Software GmbH) [Kernel | Boot] -- C:\Windows\System32\drivers\oodivd.sys -- (oodivd) DRV:64bit: - [2008/09/04 21:36:28 | 000,039,944 | ---- | M] (O&O Software GmbH) [File_System | Boot] -- C:\Windows\System32\drivers\oodisrh.sys -- (oodisrh) DRV:64bit: - [2008/09/04 21:36:16 | 000,116,232 | ---- | M] (O&O Software GmbH) [Kernel | Boot] -- C:\Windows\System32\drivers\oodisr.sys -- (oodisr) DRV:64bit: - [2008/01/20 22:47:28 | 000,048,768 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avc.sys -- (Avc) DRV:64bit: - [2008/01/20 22:46:57 | 000,058,496 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\61883.sys -- (61883) DRV:64bit: - [2008/01/20 22:46:53 | 000,061,568 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- C:\Windows\System32\drivers\msdv.sys -- (MSDV) DRV:64bit: - [2007/07/11 09:57:08 | 000,027,136 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\lgx64diag.sys -- (UsbDiag) DRV:64bit: - [2007/07/11 05:07:36 | 000,029,696 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\lgx64modem.sys -- (USBModem) DRV:64bit: - [2007/07/11 05:04:40 | 000,016,896 | ---- | M] (LG Electronics Inc.) [Kernel | On_Demand] -- C:\Windows\System32\drivers\lgx64bus.sys -- (usbbus) DRV:64bit: - [2007/05/06 21:00:00 | 000,706,048 | ---- | M] (AVM Berlin) [Kernel | On_Demand] -- C:\Windows\System32\drivers\fpcibase.sys -- (FPCIBASE) DRV:64bit: - [2007/05/06 21:00:00 | 000,081,920 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avmcowan.sys -- (AVMCOWAN) DRV:64bit: - [2006/12/27 19:00:00 | 000,460,800 | ---- | M] (AVM GmbH) [Kernel | On_Demand] -- C:\Windows\System32\drivers\fwlanusb.sys -- (FWLANUSB) DRV:64bit: - [2006/12/27 19:00:00 | 000,014,120 | R--- | M] (AVM Berlin) [Kernel | On_Demand] -- C:\Windows\System32\drivers\avmeject.sys -- (avmeject) DRV:64bit: - [2006/12/18 14:06:36 | 000,031,232 | ---- | M] (Homecast) [Kernel | On_Demand] -- C:\Windows\System32\drivers\HcPvra64.sys -- (HcPvrUsb) DRV:64bit: - [2006/09/18 17:36:24 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- C:\Windows\System32\wbem\ntfs.mof -- (Ntfs) DRV - [2010/10/22 05:37:36 | 000,014,136 | ---- | M] (MSI) [Kernel | On_Demand] -- D:\util\MSI\Live Update 5\NTIOLib_X64.sys -- (NTIOLib_1_0_4) DRV - [2010/05/10 05:44:46 | 000,028,984 | ---- | M] (Your Corporation) [Kernel | On_Demand] -- D:\util\MSI\Live Update 5\DVDSYS64_100507.sys -- (MSI_DVD_010507) DRV - [2010/05/10 05:44:40 | 000,033,592 | ---- | M] (Your Corporation) [Kernel | On_Demand] -- D:\util\MSI\Live Update 5\msibios64_100507.sys -- (MSI_MSIBIOS_010507) DRV - [2010/05/10 05:44:18 | 000,014,960 | ---- | M] () [Kernel | On_Demand] -- D:\util\MSI\Live Update 5\VGASYS64_100507.sys -- (MSI_VGASYS_010507) DRV - [2008/04/04 13:34:26 | 000,014,208 | ---- | M] (MAGIX) [Kernel | Boot] -- C:\Windows\SysWow64\drivers\disksec.sys -- (DiskSec) DRV - [2007/05/03 05:19:16 | 000,066,472 | ---- | M] (AVM Berlin) [Kernel | Auto] -- C:\Windows\SysWOW64\drivers\avmport.sys -- (AVMPORT) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Micha_ON_C\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKU\Micha_ON_C\Software\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKU\Micha_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\Micha_ON_C\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = fritz.box FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\Wow6432Node\MozillaPlugins\@bittorrent.com/BitTorrentDNA: C:\Program Files (x86)\DNA\plugins\npbtdna.dll (BitTorrent, Inc.) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.0.60531.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@pack.google.com/Google Updater;version=13: C:\Program Files (x86)\Google\Google Updater\2.4.1536.6592\npCIDetect13.dll (Google) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\Wow6432Node\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.65\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\tools\Adobe\Reader 9.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 5.0.1\extensions\\Components: D:\Programme\Mozilla Firefox\components [2011/07/23 12:39:38 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 5.0.1\extensions\\Plugins: D:\Programme\Mozilla Firefox\plugins [2011/07/23 12:39:37 | 000,000,000 | ---D | M] O1 HOSTS File: ([2006/09/18 17:37:24 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: ::1 localhost O2 - BHO: (Google Toolbar Notifier BHO) - {AF69DE43-7D58-4638-B6FA-CE66B5AD205D} - C:\Program Files (x86)\Google\GoogleToolbarNotifier\5.1.1309.3572\swg.dll (Google Inc.) O4:64bit: - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKLM..\Run: [avgnt] D:\tools\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH) O4 - HKLM..\Run: [AVMWlanClient] C:\Program Files (x86)\avmwlanstick\wlangui.exe (AVM Berlin) O4 - HKLM..\Run: [JMB36X IDE Setup] C:\Windows\RaidTool\xInsIDE.exe () O4 - HKU\LocalService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\LocalService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation) O4 - HKU\Micha_ON_C..\Run: [{D98A835F-E334-11DD-A333-806E6F6E6963}] C:\Users\Micha\AppData\Roaming\Identities\{D98A835F-E334-11DD-A333-806E6F6E6963}\svghost.exe (Avis Punch Chad) O4 - HKU\NetworkService_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\NetworkService_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation) O4 - HKU\UpdatusUser_ON_C..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation) O4 - HKU\UpdatusUser_ON_C..\Run: [WindowsWelcomeCenter] C:\Windows\SysWow64\oobefldr.dll (Microsoft Corporation) O4 - Startup: Error locating startup folders. O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 255 O7 - HKU\Micha_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveAutorun = 0 O7 - HKU\Micha_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 0 O7 - HKU\Micha_ON_C\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoWelcomeScreen = 1 O9:64bit: - Extra Button: PDFill PDF Editor - {ED93D107-B43A-490e-AA5C-C5578BAAF479} - D:\util\PDFill\DownloadPDF.exe (PlotSoft LLC) O9 - Extra Button: HP Intelligente Auswahl - {DDE87865-83C5-48c4-8357-2F5B1AA84522} - D:\treiber\hp_officejet\Digital Imaging\Smart Web Printing\hpswp_BHO.dll (Hewlett-Packard Co.) O9 - Extra Button: PDFill PDF Editor - {FB858B22-55E2-413f-87F5-30ADC5552151} - D:\util\PDFill\DownloadPDF.exe (PlotSoft LLC) O13:64bit: - gopher Prefix: missing O13 - gopher Prefix: missing O15:64bit: - Micha_ON_C\..Trusted Domains: fritz.box ([]* in Lokales Intranet) O15:64bit: - Micha_ON_C\..Trusted Ranges: Range1 ([*] in Lokales Intranet) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_23-windows-i586.cab (Java Plug-in 1.6.0_23) O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O18:64bit: - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\ipp - No CLSID value found O18:64bit: - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msdaipp - No CLSID value found O18:64bit: - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18:64bit: - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - Reg Error: Key error. File not found O18 - Protocol\Handler\http\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\http\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\https\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11D1-9C6B-0000F875AC61} - C:\Program Files (x86)\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ] O34 - HKLM BootExecute: (autocheck autochk *) - File not found 64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found 64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %* O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011/07/14 12:49:34 | 001,210,880 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\kernel32.dll [2011/07/14 12:49:32 | 000,451,072 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\winsrv.dll [2011/07/14 12:49:32 | 000,085,504 | ---- | C] (Microsoft Corporation) -- C:\Windows\System32\csrsrv.dll [2004/11/24 15:25:52 | 000,335,872 | ---- | C] ( ) -- C:\Windows\SysWow64\drvc.dll [2 C:\Users\Micha\AppData\Local\*.tmp files -> C:\Users\Micha\AppData\Local\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011/08/09 04:51:38 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011/08/09 04:51:24 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011/08/09 04:51:24 | 000,003,712 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011/08/09 04:49:39 | 010,337,022 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011/08/09 04:49:39 | 003,617,246 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011/08/09 04:49:39 | 003,258,948 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011/08/09 04:49:39 | 002,963,376 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011/08/09 04:46:35 | 000,001,064 | ---- | M] () -- C:\Windows\tasks\Google Software Updater.job [2011/08/09 04:42:51 | 000,001,106 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2011/08/09 03:52:14 | 000,001,110 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2011/08/05 05:22:55 | 000,000,680 | ---- | M] () -- C:\Users\Micha\AppData\Local\d3d9caps.dat [2011/07/26 10:35:58 | 000,000,133 | ---- | M] () -- C:\Users\Micha\AppData\default.pls [2011/07/23 18:19:56 | 000,000,643 | ---- | M] () -- C:\Users\Micha\Desktop\START.html - Verknüpfung.lnk [2011/07/23 12:39:39 | 000,000,649 | ---- | M] () -- C:\Users\Micha\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\Mozilla Firefox.lnk [2011/07/21 00:52:00 | 000,000,000 | ---D | M] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Steuertipps [2011/07/20 14:48:31 | 000,123,784 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011/07/20 14:48:31 | 000,088,288 | ---- | M] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011/07/18 17:49:36 | 000,000,333 | ---- | M] () -- C:\Users\Micha\Desktop\Motorradmarkt Xt 600.url [2011/07/18 17:44:02 | 000,000,181 | ---- | M] () -- C:\Users\Micha\Desktop\Moko Kleinanzeigen.url [2011/07/18 17:43:19 | 000,000,182 | ---- | M] () -- C:\Users\Micha\Desktop\Kurve Kleinanzeigen.url [2011/07/18 17:30:37 | 000,000,162 | ---- | M] () -- C:\Users\Micha\Desktop\DHD24 XT 600.url [2011/07/18 17:29:19 | 000,000,224 | ---- | M] () -- C:\Users\Micha\Desktop\eBay Xt 600 2NF.url [2011/07/18 17:28:55 | 000,000,266 | ---- | M] () -- C:\Users\Micha\Desktop\eBay Xt 600 2KF.url [2011/07/18 17:14:42 | 000,000,250 | ---- | M] () -- C:\Users\Micha\Desktop\Motoscout24.url [2011/07/18 17:13:25 | 000,000,341 | ---- | M] () -- C:\Users\Micha\Desktop\Mobile.url [2011/07/17 12:59:36 | 558,504,819 | ---- | M] () -- C:\Windows\MEMORY.DMP [2011/07/16 16:49:59 | 000,001,833 | ---- | M] () -- C:\Users\Public\Desktop\Steuer-Spar-Erklärung 2010.lnk [2011/07/15 08:21:32 | 000,306,184 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2 C:\Users\Micha\AppData\Local\*.tmp files -> C:\Users\Micha\AppData\Local\*.tmp -> ] ========== Files Created - No Company Name ========== [2011/07/23 18:19:58 | 000,000,643 | ---- | C] () -- C:\Users\Micha\Desktop\START.html - Verknüpfung.lnk [2011/07/18 17:49:28 | 000,000,333 | ---- | C] () -- C:\Users\Micha\Desktop\Motorradmarkt Xt 600.url [2011/07/18 17:43:55 | 000,000,181 | ---- | C] () -- C:\Users\Micha\Desktop\Moko Kleinanzeigen.url [2011/07/18 17:43:08 | 000,000,182 | ---- | C] () -- C:\Users\Micha\Desktop\Kurve Kleinanzeigen.url [2011/07/18 17:30:28 | 000,000,162 | ---- | C] () -- C:\Users\Micha\Desktop\DHD24 XT 600.url [2011/07/18 17:29:10 | 000,000,224 | ---- | C] () -- C:\Users\Micha\Desktop\eBay Xt 600 2NF.url [2011/07/18 17:28:44 | 000,000,266 | ---- | C] () -- C:\Users\Micha\Desktop\eBay Xt 600 2KF.url [2011/07/18 17:12:30 | 000,000,341 | ---- | C] () -- C:\Users\Micha\Desktop\Mobile.url [2011/07/18 17:12:06 | 000,000,250 | ---- | C] () -- C:\Users\Micha\Desktop\Motoscout24.url [2011/06/06 11:37:39 | 000,010,626 | ---- | C] () -- C:\Windows\scunin.dat [2011/02/11 07:06:15 | 000,083,968 | ---- | C] () -- C:\Windows\UnGins.exe [2011/01/01 11:02:50 | 000,000,680 | ---- | C] () -- C:\Users\Micha\AppData\Local\d3d9caps.dat [2010/08/21 06:00:31 | 000,018,845 | ---- | C] () -- C:\Windows\W2BNEUnin.dat [2010/07/16 16:40:30 | 000,003,140 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys [2010/07/16 16:40:30 | 000,000,088 | RHS- | C] () -- C:\ProgramData\5FC61D408B.sys [2010/05/31 15:50:10 | 000,315,444 | ---- | C] () -- C:\Windows\SysWow64\isdnapi32.dll [2010/05/31 15:50:10 | 000,049,152 | ---- | C] () -- C:\Windows\SysWow64\AuerCapiJNINative.dll [2010/05/31 15:50:10 | 000,032,768 | ---- | C] () -- C:\Windows\SysWow64\AuerUsbJNINative.dll [2010/03/30 03:52:30 | 000,117,248 | ---- | C] () -- C:\Windows\SysWow64\EhStorAuthn.dll [2010/03/30 03:52:16 | 000,107,612 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchema.bin [2010/03/30 03:52:02 | 000,368,640 | ---- | C] () -- C:\Windows\SysWow64\msjetoledb40.dll [2010/03/12 14:04:20 | 000,012,938 | ---- | C] () -- C:\Users\Micha\AppData\Roaming\Kommagetrennte Werte (Windows).CAL [2010/03/05 12:55:16 | 000,000,306 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2010/02/21 14:11:09 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini [2010/01/30 12:22:33 | 000,000,046 | ---- | C] () -- C:\Windows\PCCT.INI [2010/01/30 12:22:27 | 000,146,432 | ---- | C] () -- C:\Windows\SysWow64\APOMngr.DLL [2010/01/30 12:22:27 | 000,072,704 | ---- | C] () -- C:\Windows\SysWow64\CmdRtr.DLL [2010/01/30 11:04:44 | 000,000,093 | ---- | C] () -- C:\Users\Micha\AppData\Local\fusioncache.dat [2010/01/30 10:36:15 | 000,000,111 | ---- | C] () -- C:\Windows\installation.ini [2010/01/30 09:09:03 | 000,006,926 | ---- | C] () -- C:\Windows\SysWow64\PerfStringBackup.INI [2009/12/19 09:43:03 | 000,007,103 | ---- | C] () -- C:\Windows\mgxoschk.ini [2009/12/16 10:19:57 | 000,078,204 | ---- | C] () -- C:\Windows\hpqins05.dat [2009/12/16 09:12:30 | 000,010,567 | R--- | C] () -- C:\Windows\hpwscr19.dat [2009/12/16 09:08:31 | 000,203,134 | ---- | C] () -- C:\Windows\hpwins19.dat [2009/12/15 12:17:01 | 000,120,200 | ---- | C] () -- C:\Windows\SysWow64\DLLDEV32i.dll [2009/07/21 04:00:37 | 000,018,904 | ---- | C] () -- C:\Windows\SysWow64\StructuredQuerySchemaTrivial.bin [2009/05/28 16:35:37 | 000,000,760 | ---- | C] () -- C:\Users\Micha\AppData\Roaming\setup_ldm.iss [2009/04/05 04:44:05 | 000,047,104 | ---- | C] () -- C:\Windows\SysWow64\KMVIDC32.DLL [2009/02/08 10:55:24 | 000,027,648 | ---- | C] () -- C:\Windows\SysWow64\AVSredirect.dll [2009/01/28 15:20:14 | 000,045,056 | ---- | C] () -- C:\Users\Micha\AppData\Roaming\tsdnwin.dll [2009/01/25 15:30:10 | 000,001,327 | ---- | C] () -- C:\Windows\ODBCINST.INI [2009/01/25 15:30:10 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2009/01/25 15:30:10 | 000,000,063 | ---- | C] () -- C:\Windows\mdm.ini [2009/01/23 10:06:07 | 000,000,133 | ---- | C] () -- C:\Users\Micha\AppData\default.pls [2009/01/23 10:05:46 | 000,027,136 | ---- | C] () -- C:\Users\Micha\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2009/01/23 09:09:44 | 000,000,433 | ---- | C] () -- C:\Users\Micha\AppData\Roaming\SamsungLiveUpdateConfig.ini [2009/01/15 14:54:47 | 000,001,460 | ---- | C] () -- C:\Users\Micha\AppData\Local\d3d9caps64.dat [2008/12/19 11:15:58 | 004,338,246 | ---- | C] () -- C:\Windows\SysWow64\libavcodec.dll [2008/12/17 13:41:18 | 000,884,237 | ---- | C] () -- C:\Windows\SysWow64\ff_x264.dll [2008/12/17 13:22:58 | 000,093,184 | ---- | C] () -- C:\Windows\SysWow64\ff_wmv9.dll [2008/12/17 13:22:48 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\ff_vfw.dll [2008/12/17 13:17:34 | 000,239,247 | ---- | C] () -- C:\Windows\SysWow64\ff_theora.dll [2008/12/17 12:59:54 | 000,560,802 | ---- | C] () -- C:\Windows\SysWow64\libmplayer.dll [2008/01/20 22:50:05 | 000,060,124 | ---- | C] () -- C:\Windows\SysWow64\tcpmon.ini [2008/01/06 18:08:10 | 000,000,997 | R--- | C] () -- C:\Windows\hpwmdl19.dat [2006/11/02 12:10:16 | 000,080,912 | ---- | C] () -- C:\Windows\SysWow64\sherlock2.exe [2006/11/02 11:37:05 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006/11/02 11:02:31 | 000,197,632 | ---- | C] () -- C:\Windows\SysWow64\ir32_32.dll [2006/11/02 08:37:14 | 000,215,943 | ---- | C] () -- C:\Windows\SysWow64\dssec.dat [2006/11/02 08:24:17 | 000,000,741 | ---- | C] () -- C:\Windows\SysWow64\NOISE.DAT [2006/11/02 08:18:17 | 000,673,088 | ---- | C] () -- C:\Windows\SysWow64\mlang.dat [2006/11/02 05:47:54 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2004/10/03 13:50:54 | 000,129,024 | ---- | C] () -- C:\Windows\SysWow64\ff_mpeg2enc.dll ========== LOP Check ========== [2011/04/23 17:01:51 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\Amazon [2009/09/28 11:10:30 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\FreeFLVConverter [2009/01/23 09:58:36 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\FRITZ! [2009/03/09 15:50:25 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\Homecast [2009/01/23 10:02:15 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\Leadertech [2009/05/09 14:52:16 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\LG Electronics [2010/01/30 10:37:32 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\MAGIX [2009/01/23 13:58:16 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\MPEG Streamclip [2009/07/30 07:03:59 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\My Games [2009/03/26 04:22:24 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\OpenOffice.org [2011/01/08 12:52:12 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\PopSoft [2010/12/27 05:13:26 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\PreisHai4 [2010/08/10 15:11:54 | 000,000,000 | ---D | M] -- C:\Users\Micha\AppData\Roaming\Rubberduck [2009/07/30 16:11:30 | 000,000,000 | ---D | M] -- C:\ProgramData\AAV [2009/01/15 14:52:57 | 000,000,000 | -HSD | M] -- C:\ProgramData\Anwendungsdaten [2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Application Data [2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Desktop [2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Documents [2009/01/15 14:52:57 | 000,000,000 | -HSD | M] -- C:\ProgramData\Dokumente [2009/12/22 03:16:40 | 000,000,000 | ---D | M] -- C:\ProgramData\eBay [2009/01/15 14:52:57 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favoriten [2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Favorites [2009/01/23 08:51:14 | 000,000,000 | ---D | M] -- C:\ProgramData\ISDNWatch [2009/01/28 15:13:42 | 000,000,000 | ---D | M] -- C:\ProgramData\LightScribe [2010/01/30 10:37:32 | 000,000,000 | ---D | M] -- C:\ProgramData\MAGIX [2009/01/15 15:06:21 | 000,000,000 | ---D | M] -- C:\ProgramData\OO Software [2010/09/09 17:29:19 | 000,000,000 | ---D | M] -- C:\ProgramData\PlotSoft [2011/01/08 12:52:12 | 000,000,000 | ---D | M] -- C:\ProgramData\PopSoft [2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Start Menu [2009/01/15 14:52:57 | 000,000,000 | -HSD | M] -- C:\ProgramData\Startmenü [2006/11/02 11:42:17 | 000,000,000 | -HSD | M] -- C:\ProgramData\Templates [2009/01/15 14:52:57 | 000,000,000 | -HSD | M] -- C:\ProgramData\Vorlagen [2011/08/09 04:51:24 | 000,032,514 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== < End of report > Vielen Dank für Eure Hilfe! |
09.08.2011, 14:38 | #2 |
| roter Bildschirm "Aus Sicherheitsgründen wurde ihr Windowssystem blockiert" Habe einen Scan & Reparatur mit mbam-setup-1.51.1.1800 durchgeführt. Das logfile ist im Anhang.
__________________Nach der Reparatur einen kompletten scan - ok. Ist damit wieder alles ok? Bisher trat der Fehler nicht mehr auf. Danke! |
Themen zu roter Bildschirm "Aus Sicherheitsgründen wurde ihr Windowssystem blockiert" |
0x00000001, antivir, aus sicherheitsgründen, aus sicherheitsgründen wurde ihr windowssystem blockiert, avira, bezahlen und herunterladen, bho, bildschirm, blockiert, defender, desktop, ebay, error, explorer, extras.txt, firefox, format, google earth, home, intranet, laufzeit, launch, logfile, microsoft, nvidia, object, officejet, otl.txt, plug-in, programme, realtek, reatogo, registry, roter bildschirm, scan, sched.exe, sicherheitsgründe, sicherheitsgründen, software, start menu, stick, version=1.0, vista, windowssystem, windowssystem blockiert, wurde ihr |