50€-Virus-Was kann ich tun?

Trivandrum · 08.03.2012, 09:57

Hallo,

wie schon so viele, hat auch mein Laptop diesen Virus:

Nachdem ich den Laptop hochfahre, kommt folgende Meldung:

Durch das Besuchen von Seiten mit infizierten und pornographischen Inhalten ist das Computersystem an eine kritische Grenze angekommen, nach der das System zusammenbrechen und die ganzen Dateien verloren gehen können. Um das System wiederherstellen zu können müssen Sie ein zusätzliches Sicherheitsupdate herunterladen.

Dieses Update ist ein kostenpflichtiges Upgrade für besonders infizierte Windowssysteme. Es beschützt das System vollständig von Virus und Schadprogrammen, stabilisiert Ihr Computersystem und verhindert den Datenverlust.

Ich habe Windows Vista.
Mein PC verfügt über 2 Benutzerdesktops. Über den einen, den ich sonst nie benutze, kann ich mich anmelden und alles ist normal bei dem anderen Benutzer kommt oben stehende Meldung.

Ich habe auch ein Amazon-Konto und habe Angst, dass es missbraucht wird.

Könnt ihr mir helfen?

Vielen Dank

Folgende Ergebnisse hat der Scann mit oldtimer gebracht:

OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 08.03.2012 10:35:18 - Run 2
OTL by OldTimer - Version 3.2.36.1     Folder = C:\Users\janka\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 73,97% Memory free
3,98 Gb Paging File | 3,65 Gb Available in Paging File | 91,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 33,99 Gb Free Space | 45,61% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 11,16 Gb Free Space | 16,48% Space Free | Partition Type: NTFS
 
Computer Name: JANKA-PC | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\janka\Downloads\OTL.exe (OldTimer Tools)
PRC - C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - \\?\C:\Windows\System32\wbem\WMIADAP.EXE ()
 
 
========== Modules (No Company Name) ==========
 
MOD - C:\Program Files\Mozilla Firefox\mozjs.dll ()
 
 
========== Win32 Services (SafeList) ==========
 
SRV - (CLTNetCnService) --  File not found
SRV - (Application Updater) -- C:\Program Files\Application Updater\ApplicationUpdater.exe (Spigot, Inc.)
SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira GmbH)
SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira GmbH)
SRV - (vpnagent) -- C:\Program Files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe (Cisco Systems, Inc.)
SRV - (WinDefend) -- C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SRV - (ASLDRService) -- C:\Program Files\ATK Hotkey\ASLDRSrv.exe ()
SRV - (spmgr) -- C:\Program Files\ASUS\NB Probe\SPM\spmgr.exe ()
SRV - (StkSSrv) -- C:\Windows\System32\StkCSrv.exe (Syntek America Inc.)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (ZTEusbser6k) --  File not found
DRV - (ZTEusbnmea) --  File not found
DRV - (ZTEusbmdm6k) --  File not found
DRV - (NwlnkFwd) --  File not found
DRV - (NwlnkFlt) --  File not found
DRV - (massfilter) --  File not found
DRV - (ipswuio) --  File not found
DRV - (IpInIp) --  File not found
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (vpnva) -- C:\Windows\System32\drivers\vpnva.sys (Cisco Systems, Inc.)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (avgio) -- C:\Program Files\Avira\AntiVir Desktop\avgio.sys (Avira GmbH)
DRV - (EC168BDA) -- C:\Windows\System32\drivers\EC168BDA.sys (e3C, Inc.)
DRV - (StkCMini) -- C:\Windows\System32\drivers\StkCMini.sys (Syntek)
DRV - (WCPU) -- C:\Program Files\P4G\WCPU.sys (Windows (R) Codename Longhorn DDK provider)
DRV - (ghaio) -- C:\Program Files\ASUS\NB Probe\SPM\ghaio.sys ()
DRV - (MTsensor) -- C:\Windows\System32\drivers\ATKACPI.sys (ATK0100)
DRV - (Atc002) -- C:\Windows\System32\drivers\L260x86.sys (Attansic Corporation)
DRV - (SSPORT) -- C:\Windows\System32\drivers\SSPORT.SYS (Samsung Electronics)
DRV - (DgiVecp) -- C:\Windows\System32\drivers\DGIVECP.SYS (Samsung Electronics Co., Ltd.)
DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation)
DRV - (R300) -- C:\Windows\System32\drivers\atikmdag.sys (ATI Technologies Inc.)
DRV - (RTL8169) -- C:\Windows\System32\drivers\Rtlh86.sys (Realtek Corporation)
DRV - (NETw3v32) Intel(R) -- C:\Windows\System32\drivers\NETw3v32.sys (Intel® Corporation)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (smserial) -- C:\Windows\System32\drivers\smserial.sys (Motorola Inc.)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.asus.com
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
IE - HKLM\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - SOFTWARE\Classes\CLSID\{c9508125-4747-4733-b048-e4b82dc9716d}\InprocServer32 File not found
IE - HKLM\..\SearchScopes,DefaultScope = {afdbddaa-5d3f-42ee-b79c-185a7020515b}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT2102572
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1
IE - HKCU\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\5.0\pdfforgeToolbarIE.dll (Spigot, Inc.)
IE - HKCU\..\URLSearchHook: {c9508125-4747-4733-b048-e4b82dc9716d} - SOFTWARE\Classes\CLSID\{c9508125-4747-4733-b048-e4b82dc9716d}\InprocServer32 File not found
IE - HKCU\..\SearchScopes,DefaultScope = {2F277093-48A9-4429-AEEC-AAA3F458DEDA}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
IE - HKCU\..\SearchScopes\{2F277093-48A9-4429-AEEC-AAA3F458DEDA}: "URL" = hxxp://de.search.yahoo.com/search?fr=chr-greentree_ie&ei=utf-8&ilc=12&type=827316&p={searchTerms}
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Yahoo"
FF - prefs.js..browser.search.param.yahoo-fr: "chr-greentree_ff&type=827316&ilc=12"
FF - prefs.js..browser.search.selectedEngine: "Yahoo"
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
FF - prefs.js..keyword.URL: "hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=827316&ilc=12&p="
FF - prefs.js..network.proxy.type: 0
 
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Users\janka\Downloads\DivX\DivX Web Player\npdivx32.dll File not found
FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Users\janka\Downloads\DivX\DivX Player\npDivxPlayerPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@google.com/npPicasa3,version=3.0.0: C:\Program Files\Google\Picasa3\npPicasa3.dll (Google, Inc.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10111.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeLive,version=1.3: C:\Program Files\Microsoft\Office Live\npOLW.dll (Microsoft Corp.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012.03.05 14:25:42 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 10.0.2\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.03.05 14:26:13 | 000,000,000 | ---D | M] (No name found) -- C:\Users\janka\AppData\Roaming\mozilla\Extensions
[2012.03.05 14:25:42 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012.02.16 15:55:53 | 000,134,104 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2012.02.16 12:02:53 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012.02.16 11:48:01 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012.02.16 12:02:53 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012.02.16 12:02:53 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012.02.16 12:02:53 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012.02.16 12:02:53 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2006.09.18 22:41:30 | 000,000,761 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1       localhost
O1 - Hosts: ::1             localhost
O2 - BHO: (Skype add-on for Internet Explorer) - {AE805869-2E5C-4ED4-8F7B-F1F7851A4497} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O2 - BHO: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\5.0\pdfforgeToolbarIE.dll (Spigot, Inc.)
O2 - BHO: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O3 - HKLM\..\Toolbar: (pdfforge Toolbar) - {B922D405-6D13-4A2B-AE89-08A030DA4402} - C:\Program Files\pdfforge Toolbar\IE\5.0\pdfforgeToolbarIE.dll (Spigot, Inc.)
O3 - HKLM\..\Toolbar: (PHPNukeDE Toolbar) - {c9508125-4747-4733-b048-e4b82dc9716d} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O3 - HKCU\..\Toolbar\WebBrowser: (PHPNukeDE Toolbar) - {C9508125-4747-4733-B048-E4B82DC9716D} - C:\Program Files\PHPNukeDE\tbPHPN.dll File not found
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ASUS Camera ScreenSaver] C:\Windows\ASScrProlog.exe ()
O4 - HKLM..\Run: [ASUS Screen Saver Protector] C:\Windows\ASScrPro.exe ()
O4 - HKLM..\Run: [ASUSTPE] C:\Windows\System32\ASUSTPE.exe (ASUS)
O4 - HKLM..\Run: [ATKMEDIA] C:\Program Files\ASUS\ATK Media\DMEDIA.EXE (ASUSTeK Computer INC.)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKLM..\Run: [NeroFilterCheck] C:\Program Files\Common Files\Ahead\Lib\NeroCheck.exe (Nero AG)
O4 - HKLM..\Run: [PowerForPhone] C:\Program Files\PowerForPhone\PowerForPhone.exe ()
O4 - HKLM..\Run: [QuickTime Task] "C:\Program Files\QuickTime\QTTask.exe" -atboottime File not found
O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor)
O4 - HKLM..\Run: [Samsung PanelMgr] C:\Windows\Samsung\PanelMgr\SSMMgr.exe ()
O4 - HKLM..\Run: [SearchSettings] C:\Program Files\Common Files\Spigot\Search Settings\SearchSettings.exe (Spigot, Inc.)
O4 - HKLM..\Run: [SMSERIAL] C:\Program Files\Motorola\SMSERIAL\sm56hlpr.exe (Motorola Inc.)
O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation)
O4 - HKLM..\Run: [Zshutdown] c:\Preload\patch\sysprep.cmd File not found
O4 - HKCU..\Run: [{0E330D6F-EC24-11DD-9B90-806E6F6E6963}] C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe ()
O4 - HKCU..\Run: [DetectTray] C:\Program Files\Genius\TVGo DVB-T02PRO\DetectTray.exe ()
O4 - Startup: C:\Users\janka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\StarOffice 8.lnk = C:\Program Files\Sun\StarOffice 8\program\quickstart.exe ()
O8 - Extra context menu item: Add to Google Photos Screensa&ver - C:\Windows\System32\GPhotos.scr (Google Inc.)
O8 - Extra context menu item: Nach Microsoft &Excel exportieren - res://C:\PROGRA~1\MICROS~2\Office10\EXCEL.EXE/3000 File not found
O9 - Extra Button: Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O9 - Extra 'Tools' menuitem : Skype add-on for Internet Explorer - {898EA8C8-E7FF-479B-8935-AEC46303B9E5} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O12 - Plugin for: .spop - C:\Program Files\Internet Explorer\Plugins\NPDocBox.dll (Intertrust Technologies, Inc.)
O13 - gopher Prefix: missing
O15 - HKCU\..Trusted Domains: fritz.box ([]* in Lokales Intranet)
O15 - HKCU\..Trusted Ranges: Range1 ([*] in Lokales Intranet)
O16 - DPF: {28B66320-9687-4B13-8757-36F901887AB5} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/canvasx.cab (CanvasX Class)
O16 - DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab (JordanUploader Class)
O16 - DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} https://vpn-server.rrzn.uni-hannover.de/CACHE/stc/1/binaries/vpnweb.cab (Cisco AnyConnect VPN Client Web Control)
O16 - DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} https://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab (CeWe Color AG & Co. OHG Control)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-0016-0000-0007-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_07-windows-i586.cab (Java Plug-in 1.6.0_07)
O16 - DPF: {CAFEEFAC-0016-0000-0027-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_27-windows-i586.cab (Java Plug-in 1.6.0_27)
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O16 - DPF: {E2883E8F-472F-4FB0-9522-AC9BF37916A7} hxxp://platformdl.adobe.com/NOS/getPlusPlus/1.6/gp.cab (Reg Error: Key error.)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.220.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{E723881F-6E37-4CC1-AB45-21C6A8C62A46}: DhcpNameServer = 192.168.178.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{EF84D312-EE25-4CBC-B693-0D1E89F07D92}: DhcpNameServer = 192.168.220.1
O18 - Protocol\Handler\mso-offdap {3D9F03FA-7A94-11D3-BE81-0050048385D1} - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL (Microsoft Corporation)
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18 - Protocol\Handler\skype-ie-addon-data {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O24 - Desktop WallPaper: C:\Users\janka\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O24 - Desktop BackupWallPaper: C:\Users\janka\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{3bb5b4ee-f83f-11dd-b359-001d60cd4205}\Shell - "" = AutoRun
O33 - MountPoints2\{3bb5b4ee-f83f-11dd-b359-001d60cd4205}\Shell\AutoRun\command - "" = H:\LaunchU3.exe -a
O33 - MountPoints2\{43559195-9978-11de-ace3-001d60cd4205}\Shell - "" = AutoRun
O33 - MountPoints2\{43559195-9978-11de-ace3-001d60cd4205}\Shell\AutoRun\command - "" = G:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk /p \??\F:)
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.03.05 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Roaming\Mozilla
[2012.03.05 14:25:51 | 000,000,000 | ---D | C] -- C:\Users\janka\AppData\Local\Mozilla
[2012.03.05 14:25:41 | 000,000,000 | ---D | C] -- C:\Program Files\Mozilla Firefox
[2012.03.05 14:24:36 | 015,634,456 | ---- | C] (Mozilla) -- C:\Users\janka\Firefox_Setup_10.0.2.exe
[2012.03.03 18:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\Spigot
[2012.03.03 18:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\pdfforge Toolbar
[2012.03.03 18:51:23 | 000,000,000 | ---D | C] -- C:\Program Files\Application Updater
[2012.03.03 18:51:13 | 000,000,000 | -HSD | C] -- C:\Config.Msi
 
========== Files - Modified Within 30 Days ==========
 
[2012.03.08 10:38:05 | 000,632,594 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2012.03.08 10:38:05 | 000,599,528 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2012.03.08 10:38:05 | 000,128,212 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2012.03.08 10:38:05 | 000,105,404 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2012.03.08 10:30:34 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.03.08 10:29:07 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat
[2012.03.08 10:26:42 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
[2012.03.08 10:26:42 | 000,003,168 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
[2012.03.08 08:59:52 | 000,045,056 | ---- | M] () -- C:\Windows\System32\acovcnt.exe
[2012.03.07 17:08:58 | 188,381,636 | ---- | M] () -- C:\Windows\MEMORY.DMP
[2012.03.05 14:25:43 | 000,000,853 | ---- | M] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2012.03.05 14:25:05 | 015,634,456 | ---- | M] (Mozilla) -- C:\Users\janka\Firefox_Setup_10.0.2.exe
[2012.02.23 09:18:36 | 000,237,072 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\MpSigStub.exe
 
========== Files Created - No Company Name ==========
 
[2012.03.05 14:25:43 | 000,000,865 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mozilla Firefox.lnk
[2012.03.05 14:25:43 | 000,000,853 | ---- | C] () -- C:\Users\Public\Desktop\Mozilla Firefox.lnk
[2011.02.24 17:13:53 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll
[2010.11.29 18:06:39 | 000,001,024 | ---- | C] () -- C:\Windows\System32\grcauth2.dll
[2010.11.29 18:06:39 | 000,001,024 | ---- | C] () -- C:\Windows\System32\grcauth1.dll
[2010.11.29 18:06:39 | 000,000,100 | ---- | C] () -- C:\Windows\System32\prsgrc.dll
[2010.11.29 17:58:13 | 000,001,025 | ---- | C] () -- C:\Windows\System32\sysprs7.dll
[2010.11.29 17:58:13 | 000,000,205 | ---- | C] () -- C:\Windows\System32\lsprst7.dll
[2010.10.13 17:50:29 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2010.10.07 13:33:35 | 000,000,049 | ---- | C] () -- C:\Windows\NeroDigital.ini
[2010.05.02 20:17:31 | 000,000,018 | ---- | C] () -- C:\Windows\ssetup.ini
 
========== LOP Check ==========
 
[2009.02.19 20:03:02 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Canon
[2010.02.07 10:44:38 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\elsterformular
[2010.11.25 22:19:51 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\FreeAudioPack
[2009.02.19 19:51:58 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\InterTrust
[2009.01.28 21:15:26 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Miranda
[2010.11.22 14:29:25 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\Scientific Software
[2012.03.07 20:14:30 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\StarOffice8
[2011.02.24 16:53:17 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\UDC Profiles
[2011.02.24 17:07:32 | 000,000,000 | ---D | M] -- C:\Users\janka\AppData\Roaming\WordToPDF
[2012.03.08 10:29:07 | 000,032,630 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

und

OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 08.03.2012 10:35:18 - Run 2
OTL by OldTimer - Version 3.2.36.1     Folder = C:\Users\janka\Downloads
Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6001.18000)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
1,87 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 73,97% Memory free
3,98 Gb Paging File | 3,65 Gb Available in Paging File | 91,75% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 74,52 Gb Total Space | 33,99 Gb Free Space | 45,61% Space Free | Partition Type: NTFS
Drive D: | 67,69 Gb Total Space | 11,16 Gb Free Space | 16,48% Space Free | Partition Type: NTFS
 
Computer Name: JANKA-PC | User Name: *** | Logged in as Administrator.
Boot Mode: SafeMode with Networking | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
 
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 0
"UacDisableNotify" = 0
"InternetSettingsDisableNotify" = 0
"AutoUpdateDisableNotify" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]
"DisableMonitoring" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1331460E-B590-4AFB-8603-73FE6D222879}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{2EC5F36A-0D12-4DDE-B804-EB6A53C5A708}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{3259E05C-38C1-4087-A7B3-6766781E5D16}" = lport=138 | protocol=17 | dir=in | app=system | 
"{33CFD4D0-0DB2-4F95-A514-94E4BE68C109}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{35F1B5CE-ACF8-401E-BBC9-3A722E77D980}" = rport=445 | protocol=6 | dir=out | app=system | 
"{3B500FAA-74C6-4FF3-88D3-143B2CDAB40D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | 
"{3B665BE4-6869-4D89-AE92-94163397BFCD}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{4CF29A67-8032-4409-9897-C85640FE8811}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{525E39D6-CB13-43EB-8489-FAE0EFEE9A71}" = lport=137 | protocol=17 | dir=in | app=system | 
"{53A89469-2A6C-4D4A-99AB-AFAA84F479C4}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{54679428-10C0-4EC8-AED2-6768E60CE652}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{59C4ADAC-156A-4299-ADD9-8DA74FEABD10}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{6546DC7F-F3DC-4C77-8750-4C45EB86CB50}" = rport=10243 | protocol=6 | dir=out | app=system | 
"{73FC3AC9-403D-480B-85CA-ED73BDCF41A3}" = rport=138 | protocol=17 | dir=out | app=system | 
"{8026C332-3A9B-4E68-B971-5BCC3FBB3977}" = lport=445 | protocol=6 | dir=in | app=system | 
"{83BFA2E7-FA2A-47B7-A8E8-3D5ED5DE6DD9}" = lport=139 | protocol=6 | dir=in | app=system | 
"{8DECB48A-29C3-4172-97B6-D212510825F8}" = rport=139 | protocol=6 | dir=out | app=system | 
"{90052951-F440-4EBB-91E1-E73C826F8156}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{92E7EE81-4D78-4FD8-9B30-FE812D1E332B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{9BDC01F3-521D-4F76-A68B-36F0C5975B63}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{A0DC2738-F1AD-45B1-9B81-95C4D1AA0933}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{B80EE33D-5478-4B79-87F3-44C8FD5F27A2}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{D2C5D045-4764-42C5-9198-A229DDCE2F7C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | 
"{DD566E88-255C-4D32-87ED-9FA01C69ED02}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{F2A2F446-7FF9-4E1F-B4CD-EFE8036C1074}" = rport=137 | protocol=17 | dir=out | app=system | 
"{F4FCD3B3-4949-4709-9632-6F99F977DB30}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{FCFD4861-3929-407A-AF2C-342FBB91E70D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{073A3800-60AA-4E07-9911-F9BB8D13F5BD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | 
"{13BB991E-E367-4D8F-9521-F94B757C3146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{2F2E5710-5833-4FF0-B3A1-016DFB989F9B}" = dir=in | app=c:\program files\skype\phone\skype.exe | 
"{2FF348E0-717F-4397-9E24-386367E0A35F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{31FF50AA-75C9-4DE2-8E8B-3EBA22F6A1D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{3ED10B2F-4308-4A6C-95F9-50B28DF6253C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{46B08AA2-C2E6-4829-AB67-85A408C294D7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{667A8EB1-CFEC-4CBB-B2E5-A060937324EC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{82E346F1-4485-4287-B0B7-5F7EE8B6C88E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | 
"{8AE05991-DF8D-4A22-B6D3-D373F0BCE783}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | 
"{9C0E07CC-FD24-48AC-9B92-F9EDE7310A8E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B5258A3D-0B61-47AA-B059-C38B0AF46E75}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{BE004F72-4D96-44D8-8773-2ADB8684CF41}" = protocol=6 | dir=out | app=system | 
"{C1E05AFA-2A3C-4870-BF4C-ADD24751812D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | 
"{C23E2D7A-D908-45D5-9103-D601F99F38F5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{C5770090-7E31-4D66-AD1F-FEBBC6A77F7C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D748D32E-0F4C-4929-92EB-99951C944B2C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{E87605A2-D99A-45ED-92FB-F2A0F02A6B69}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"TCP Query User{5B8025EF-2449-41FE-9E20-C6FBE5D1F4E2}C:\program files\spssinc\statistics17\statistics.exe" = protocol=6 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe | 
"TCP Query User{A4B37A3F-F184-4CB5-BA10-1C34FB7A14AD}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"TCP Query User{B26D7D9B-06E4-4F10-B488-AC5AD4F07025}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | 
"TCP Query User{D563AA5A-97C3-4255-B7ED-60953FE7E9F1}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | 
"UDP Query User{1450BF88-C364-4BDE-88DB-AC8A0985DFF2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | 
"UDP Query User{815D5560-F290-4358-BBAA-7179FD96B4DC}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | 
"UDP Query User{C5A14ABF-0648-4169-A4BC-C4E0D8478934}C:\program files\spssinc\statistics17\statistics.exe" = protocol=17 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe | 
"UDP Query User{F91FB6DD-B1B6-4732-A0FC-D7F3B82A4774}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148
"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media
"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter
"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate
"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F698102-5739-441E-96F0-74F4EA540F06}" = Attansic Giga Ethernet Utility
"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime
"{232FDC0C-12DE-41F2-9701-27EFCA18BEF9}" = MediaJoin
"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27
"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7
"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker
"{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}" = SPSS Statistics 17.0
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4BC1CB2B-FDCE-4DB4-A557-BA8127569B0D}" = StarOffice 8
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57B15AD4-8C9D-4164-82BB-E33D8644E757}" = ASUS InstantFun
"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3
"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2
"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F77DB04-A969-40a4-89EF-06CE06D56524}" = pdfforge Toolbar v5.0
"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent
"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme
"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system
"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme
"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage
"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch
"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder
"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter
"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch
"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B360A8E5-C171-4AAE-9777-65B3CDB0072C}" = CanoScan LiDE20,30 Manual
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{BC61F51E-8AF7-46B9-AF20-B33B5EE81031}" = Nero 7 Essentials
"{BF8780F3-CB8E-4AB0-9AA4-52E1BD574226}" = ATLAS.ti 6.2 Demo
"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology
"{C1D14C0D-FDAA-4DF2-8441-A902805CCE8C}" = ArcSoft PhotoBase 3
"{C2075010-F77F-44CD-8EAF-DEBCD14A46CD}" = TVGo DVB-T02PRO
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{CE86A0E7-818D-43EC-A181-59BA9BD3EF2E}" = LightScribe  1.8.13.1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{DB891739-2EB3-45A8-9CBD-941C255CECD4}" = ASUS Touch Pad Extra
"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader
"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash
"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update
"{E6BF9670-C9E9-461A-9B14-B5ADAC3176CF}" = Cisco AnyConnect VPN Client
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = PowerForPhone
"Adobe Acrobat 5.0" = Adobe Acrobat 5.0
"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX
"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver
"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus
"AVMFBox" = AVM FRITZ!Box Dokumentation
"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss
"Canon CanoScan Toolbox 4.0" = Canon CanoScan Toolbox 4.0
"CCleaner" = CCleaner (remove only)
"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters
"ElsterFormular 11.1.0 11.1.0.***unknown variable buildnummer***" = ElsterFormular 11.1.0
"f4" = f4 3.1.0
"GOM Player" = GOM Player
"LucasArts' Curse of Monkey Island" = LucasArts' Curse of Monkey Island
"MediaJoin" = MediaJoin
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Miranda IM" = Miranda IM 0.7.10
"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)
"PHPNukeDE Toolbar" = PHPNukeDE Toolbar
"Picasa 3" = Picasa 3
"Samsung ML-2010 Series" = Samsung ML-2010 Series
"SMSERIAL" = Motorola SM56 Speakerphone Modem
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"Universal Document Converter_is1" = Universal Document Converter (Demo)
"USB2.0 1.3M WebCam" = USB2.0 1.3M WebCam
"WordToPDF_is1" = WordToPDF 2.4
 
========== Last 10 Event Log Errors ==========
 
[ Application Events ]
Error - 19.03.2011 16:14:18 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 1064  Anfangszeit: 01cbe670a90e356c  Zeitpunkt
 der Beendigung: 31
 
Error - 19.03.2011 17:16:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 13d4  Anfangszeit: 01cbe67a9b328781  Zeitpunkt
 der Beendigung: 0
 
Error - 22.03.2011 12:02:51 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: bb0  Anfangszeit: 01cbe8a808dcae6d  Zeitpunkt
 der Beendigung: 172
 
Error - 22.03.2011 12:06:01 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit 
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet 
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: dc4  Anfangszeit: 01cbe8aad6369487  Zeitpunkt der
 Beendigung: 47
 
Error - 22.03.2011 12:15:39 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit 
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet 
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: d4  Anfangszeit: 01cbe8ab10e44570  Zeitpunkt der 
Beendigung: 16
 
Error - 22.03.2011 12:18:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr 
mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 7b4  Anfangszeit: 01cbe8aa9b8b8dc4  Zeitpunkt
 der Beendigung: 94
 
Error - 03.04.2011 11:47:29 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 12d4  Anfangszeit: 01cbf2160a75b91f  Zeitpunkt
 der Beendigung: 31
 
Error - 03.04.2011 11:48:17 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit
 Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet
 "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen 
über das Problem zu suchen.  Prozess-ID: 17ac  Anfangszeit: 01cbf21676aa0a7d  Zeitpunkt
 der Beendigung: 125
 
Error - 03.04.2011 11:53:09 | Computer Name = janka-PC | Source = Application Hang | ID = 1002
Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit 
Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet 
"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über
 das Problem zu suchen.  Prozess-ID: 1244  Anfangszeit: 01cbf216944ba00f  Zeitpunkt der
 Beendigung: 47
 
Error - 04.04.2011 13:21:03 | Computer Name = janka-PC | Source = Application Error | ID = 1000
Description = Fehlerhafte Anwendung iexplore.exe, Version 7.0.6001.18565, Zeitstempel
 0x4d0f5fa9, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,
 Ausnahmecode 0xc0000005, Fehleroffset 0x8e8a770b,  Prozess-ID 0xc10, Anwendungsstartzeit
 01cbf2e87d4acd67.
 
[ Cisco AnyConnect VPN Client Events ]
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line: 
2188 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::applyHostConfigForNoVpn File: .\MainThread.cpp
Line:
 7578 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CMainThread::OnTimerExpired File: .\MainThread.cpp Line: 4128
Invoked
 Function: CMainThread::applyHostConfigForNoVpn Return Code: -33095647 (0xFE070021)
Description:
 ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp
Line:
 2484 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647 
(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866
Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line: 
2188 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647
 (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED 
 
Error - 06.03.2012 12:52:02 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 06.03.2012 13:04:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 07.03.2012 15:15:54 | Computer Name = JANKA-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 08.03.2012 05:24:59 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
Error - 08.03.2012 05:29:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873
Description = Termination reason code 9: Client PC is shutting down.
 
 
========== Last 10 Event Log Errors ==========
 
Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!
 
< End of report >

--- --- ---

Trivandrum · 08.03.2012, 11:32

Ich habe versucht, die Punkte der Checkliste auszuführen, allerdings konnte ich dieses dds nicht machen.
Wenn ich auf ausführen geklickt habe, dann kam kurz ein schwarzes Feld mit weißer Schrift, das war dann allerdings gleich wieder weg.
Jetzt weiß ich nicht, ob ich mit den nächsten Schritten weitermachen soll.

markusg · 08.03.2012, 11:54

hi

dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.

• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.

Code:

ATTFilter

:OTL
O4 - HKCU..\Run: [{0E330D6F-EC24-11DD-9B90-806E6F6E6963}] C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe ()
 :Files
C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe
:Commands
[purity]
[EMPTYFLASH] 
[emptytemp]
[Reboot]

• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die

+ E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

Trivandrum · 08.03.2012, 13:34

Hallo,
vielen Dank schonmal für die Hilfe.
OTL hat Folgendes ausgespuckt:
[spoiler]Error: Unable to interpret <OTL EXTRAS Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 08.03.2012 10:35:18 - Run 2> in the current context!
Error: Unable to interpret <OTL by OldTimer - Version 3.2.36.1     Folder = C:\Users\janka\Downloads> in the current context!
Error: Unable to interpret <Windows Vista Home Premium Edition Service Pack 1 (Version = 6.0.6001) - Type = NTWorkstation> in the current context!
Error: Unable to interpret <Internet Explorer (Version = 7.0.6001.18000)> in the current context!
Error: Unable to interpret <Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <1,87 Gb Total Physical Memory | 1,39 Gb Available Physical Memory | 73,97% Memory free> in the current context!
Error: Unable to interpret <3,98 Gb Paging File | 3,65 Gb Available in Paging File | 91,75% Paging File free> in the current context!
Error: Unable to interpret <Paging file location(s): ?:\pagefile.sys [binary data]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files> in the current context!
Error: Unable to interpret <Drive C: | 74,52 Gb Total Space | 33,99 Gb Free Space | 45,61% Space Free | Partition Type: NTFS> in the current context!
Error: Unable to interpret <Drive D: | 67,69 Gb Total Space | 11,16 Gb Free Space | 16,48% Space Free | Partition Type: NTFS> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Computer Name: JANKA-PC | User Name: janka | Logged in as Administrator.> in the current context!
Error: Unable to interpret <Boot Mode: SafeMode with Networking | Scan Mode: Current user> in the current context!
Error: Unable to interpret <Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Extra Registry (SafeList) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== File Associations ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]> in the current context!
Error: Unable to interpret <.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]> in the current context!
Error: Unable to interpret <.html [@ = FirefoxHTML] -- C:\Program Files\Mozilla Firefox\firefox.exe (Mozilla Corporation)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Shell Spawning ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]> in the current context!
Error: Unable to interpret <batfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <cmdfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <comfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)> in the current context!
Error: Unable to interpret <exefile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <helpfile [open] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)> in the current context!
Error: Unable to interpret <inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)> in the current context!
Error: Unable to interpret <InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l> in the current context!
Error: Unable to interpret <piffile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <regfile [merge] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <scrfile [config] -- "%1"> in the current context!
Error: Unable to interpret <scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l> in the current context!
Error: Unable to interpret <scrfile [open] -- "%1" /S> in the current context!
Error: Unable to interpret <txtfile [edit] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1> in the current context!
Error: Unable to interpret <Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Security Center Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]> in the current context!
Error: Unable to interpret <"cval" = 0> in the current context!
Error: Unable to interpret <"UacDisableNotify" = 0> in the current context!
Error: Unable to interpret <"InternetSettingsDisableNotify" = 0> in the current context!
Error: Unable to interpret <"AutoUpdateDisableNotify" = 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]> in the current context!
Error: Unable to interpret <"DisableMonitoring" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]> in the current context!
Error: Unable to interpret <"DisableMonitoring" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]> in the current context!
Error: Unable to interpret <"DisableMonitoring" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]> in the current context!
Error: Unable to interpret <"AntiVirusOverride" = 0> in the current context!
Error: Unable to interpret <"AntiSpywareOverride" = 0> in the current context!
Error: Unable to interpret <"FirewallOverride" = 0> in the current context!
Error: Unable to interpret <"VistaSp1" = Reg Error: Unknown registry data type -- File not found> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Firewall Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]> in the current context!
Error: Unable to interpret <"DisableNotifications" = 0> in the current context!
Error: Unable to interpret <"EnableFirewall" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]> in the current context!
Error: Unable to interpret <"DisableNotifications" = 0> in the current context!
Error: Unable to interpret <"EnableFirewall" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]> in the current context!
Error: Unable to interpret <"DisableNotifications" = 0> in the current context!
Error: Unable to interpret <"EnableFirewall" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Authorized Applications List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Vista Active Open Ports Exception List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]> in the current context!
Error: Unable to interpret <"{1331460E-B590-4AFB-8603-73FE6D222879}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{2EC5F36A-0D12-4DDE-B804-EB6A53C5A708}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{3259E05C-38C1-4087-A7B3-6766781E5D16}" = lport=138 | protocol=17 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{33CFD4D0-0DB2-4F95-A514-94E4BE68C109}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{35F1B5CE-ACF8-401E-BBC9-3A722E77D980}" = rport=445 | protocol=6 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{3B500FAA-74C6-4FF3-88D3-143B2CDAB40D}" = lport=rpc | protocol=6 | dir=in | svc=spooler | app=%systemroot%\system32\spoolsv.exe | > in the current context!
Error: Unable to interpret <"{3B665BE4-6869-4D89-AE92-94163397BFCD}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{4CF29A67-8032-4409-9897-C85640FE8811}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{525E39D6-CB13-43EB-8489-FAE0EFEE9A71}" = lport=137 | protocol=17 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{53A89469-2A6C-4D4A-99AB-AFAA84F479C4}" = lport=10243 | protocol=6 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{54679428-10C0-4EC8-AED2-6768E60CE652}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{59C4ADAC-156A-4299-ADD9-8DA74FEABD10}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{6546DC7F-F3DC-4C77-8750-4C45EB86CB50}" = rport=10243 | protocol=6 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{73FC3AC9-403D-480B-85CA-ED73BDCF41A3}" = rport=138 | protocol=17 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{8026C332-3A9B-4E68-B971-5BCC3FBB3977}" = lport=445 | protocol=6 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{83BFA2E7-FA2A-47B7-A8E8-3D5ED5DE6DD9}" = lport=139 | protocol=6 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{8DECB48A-29C3-4172-97B6-D212510825F8}" = rport=139 | protocol=6 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{90052951-F440-4EBB-91E1-E73C826F8156}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{92E7EE81-4D78-4FD8-9B30-FE812D1E332B}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{9BDC01F3-521D-4F76-A68B-36F0C5975B63}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{A0DC2738-F1AD-45B1-9B81-95C4D1AA0933}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{B80EE33D-5478-4B79-87F3-44C8FD5F27A2}" = lport=2869 | protocol=6 | dir=in | app=system | > in the current context!
Error: Unable to interpret <"{D2C5D045-4764-42C5-9198-A229DDCE2F7C}" = lport=rpc-epmap | protocol=6 | dir=in | svc=rpcss | name=@firewallapi.dll,-28539 | > in the current context!
Error: Unable to interpret <"{DD566E88-255C-4D32-87ED-9FA01C69ED02}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{F2A2F446-7FF9-4E1F-B4CD-EFE8036C1074}" = rport=137 | protocol=17 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{F4FCD3B3-4949-4709-9632-6F99F977DB30}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{FCFD4861-3929-407A-AF2C-342FBB91E70D}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Vista Active Application Exception List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]> in the current context!
Error: Unable to interpret <"{073A3800-60AA-4E07-9911-F9BB8D13F5BD}" = protocol=1 | dir=in | name=@firewallapi.dll,-28543 | > in the current context!
Error: Unable to interpret <"{13BB991E-E367-4D8F-9521-F94B757C3146}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{2F2E5710-5833-4FF0-B3A1-016DFB989F9B}" = dir=in | app=c:\program files\skype\phone\skype.exe | > in the current context!
Error: Unable to interpret <"{2FF348E0-717F-4397-9E24-386367E0A35F}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{31FF50AA-75C9-4DE2-8E8B-3EBA22F6A1D8}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{3ED10B2F-4308-4A6C-95F9-50B28DF6253C}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | > in the current context!
Error: Unable to interpret <"{46B08AA2-C2E6-4829-AB67-85A408C294D7}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{667A8EB1-CFEC-4CBB-B2E5-A060937324EC}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | > in the current context!
Error: Unable to interpret <"{82E346F1-4485-4287-B0B7-5F7EE8B6C88E}" = protocol=58 | dir=out | name=@firewallapi.dll,-28546 | > in the current context!
Error: Unable to interpret <"{8AE05991-DF8D-4A22-B6D3-D373F0BCE783}" = protocol=1 | dir=out | name=@firewallapi.dll,-28544 | > in the current context!
Error: Unable to interpret <"{9C0E07CC-FD24-48AC-9B92-F9EDE7310A8E}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{B5258A3D-0B61-47AA-B059-C38B0AF46E75}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{BE004F72-4D96-44D8-8773-2ADB8684CF41}" = protocol=6 | dir=out | app=system | > in the current context!
Error: Unable to interpret <"{C1E05AFA-2A3C-4870-BF4C-ADD24751812D}" = protocol=58 | dir=in | name=@firewallapi.dll,-28545 | > in the current context!
Error: Unable to interpret <"{C23E2D7A-D908-45D5-9103-D601F99F38F5}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | > in the current context!
Error: Unable to interpret <"{C5770090-7E31-4D66-AD1F-FEBBC6A77F7C}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | > in the current context!
Error: Unable to interpret <"{D748D32E-0F4C-4929-92EB-99951C944B2C}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | > in the current context!
Error: Unable to interpret <"{E87605A2-D99A-45ED-92FB-F2A0F02A6B69}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | > in the current context!
Error: Unable to interpret <"TCP Query User{5B8025EF-2449-41FE-9E20-C6FBE5D1F4E2}C:\program files\spssinc\statistics17\statistics.exe" = protocol=6 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe | > in the current context!
Error: Unable to interpret <"TCP Query User{A4B37A3F-F184-4CB5-BA10-1C34FB7A14AD}C:\program files\internet explorer\iexplore.exe" = protocol=6 | dir=in | app=c:\program files\internet explorer\iexplore.exe | > in the current context!
Error: Unable to interpret <"TCP Query User{B26D7D9B-06E4-4F10-B488-AC5AD4F07025}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | > in the current context!
Error: Unable to interpret <"TCP Query User{D563AA5A-97C3-4255-B7ED-60953FE7E9F1}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=6 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | > in the current context!
Error: Unable to interpret <"UDP Query User{1450BF88-C364-4BDE-88DB-AC8A0985DFF2}C:\program files\internet explorer\iexplore.exe" = protocol=17 | dir=in | app=c:\program files\internet explorer\iexplore.exe | > in the current context!
Error: Unable to interpret <"UDP Query User{815D5560-F290-4358-BBAA-7179FD96B4DC}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | > in the current context!
Error: Unable to interpret <"UDP Query User{C5A14ABF-0648-4169-A4BC-C4E0D8478934}C:\program files\spssinc\statistics17\statistics.exe" = protocol=17 | dir=in | app=c:\program files\spssinc\statistics17\statistics.exe | > in the current context!
Error: Unable to interpret <"UDP Query User{F91FB6DD-B1B6-4732-A0FC-D7F3B82A4774}C:\program files\java\jre1.6.0_07\bin\javaw.exe" = protocol=17 | dir=in | app=c:\program files\java\jre1.6.0_07\bin\javaw.exe | > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== HKEY_LOCAL_MACHINE Uninstall List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]> in the current context!
Error: Unable to interpret <"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator> in the current context!
Error: Unable to interpret <"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148> in the current context!
Error: Unable to interpret <"{03F1CC67-5BD8-4C36-8394-76311B2AE69A}" = ArcSoft PhotoStudio 5> in the current context!
Error: Unable to interpret <"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu> in the current context!
Error: Unable to interpret <"{139B0FFA-187E-4BA1-BCA6-6B56B2B6AB8C}" = ATK Media> in the current context!
Error: Unable to interpret <"{13F3917B56CD4C25848BDC69916971BB}" = DivX Converter> in the current context!
Error: Unable to interpret <"{18D10072035C4515918F7E37EAFAACFC}" = AutoUpdate> in the current context!
Error: Unable to interpret <"{1DBD1F12-ED93-49C0-A7CC-56CBDE488158}" = LifeFrame2> in the current context!
Error: Unable to interpret <"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148> in the current context!
Error: Unable to interpret <"{1F698102-5739-441E-96F0-74F4EA540F06}" = Attansic Giga Ethernet Utility> in the current context!
Error: Unable to interpret <"{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}" = QuickTime> in the current context!
Error: Unable to interpret <"{232FDC0C-12DE-41F2-9701-27EFCA18BEF9}" = MediaJoin> in the current context!
Error: Unable to interpret <"{26A24AE4-039D-4CA4-87B4-2F83216027FF}" = Java(TM) 6 Update 27> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7> in the current context!
Error: Unable to interpret <"{3912D529-02BC-4CA8-B5ED-0D0C20EB6003}" = ATK Hotkey> in the current context!
Error: Unable to interpret <"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile> in the current context!
Error: Unable to interpret <"{3FC7CBBC4C1E11DCA1A752EA55D89593}" = DivX Version Checker> in the current context!
Error: Unable to interpret <"{46B65150-F8AA-42F2-94FB-2729A8AE5F7E}" = SPSS Statistics 17.0> in the current context!
Error: Unable to interpret <"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater> in the current context!
Error: Unable to interpret <"{4BC1CB2B-FDCE-4DB4-A557-BA8127569B0D}" = StarOffice 8> in the current context!
Error: Unable to interpret <"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml> in the current context!
Error: Unable to interpret <"{57B15AD4-8C9D-4164-82BB-E33D8644E757}" = ASUS InstantFun> in the current context!
Error: Unable to interpret <"{57F0ED40-8F11-41AA-B926-4A66D0D1A9CC}" = Microsoft Office Live Add-in 1.3> in the current context!
Error: Unable to interpret <"{5C1DB4ED-E9B4-402D-BB14-D75D97D6C1A6}" = ATKOSD2> in the current context!
Error: Unable to interpret <"{6324A1EF-CEF4-43E3-8BCD-9EF3F67317FD}" = NB Probe> in the current context!
Error: Unable to interpret <"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update> in the current context!
Error: Unable to interpret <"{6AFCA4E1-9B78-3640-8F72-A7BF33448200}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729> in the current context!
Error: Unable to interpret <"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable> in the current context!
Error: Unable to interpret <"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762> in the current context!
Error: Unable to interpret <"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053> in the current context!
Error: Unable to interpret <"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec> in the current context!
Error: Unable to interpret <"{7F77DB04-A969-40a4-89EF-06CE06D56524}" = pdfforge Toolbar v5.0> in the current context!
Error: Unable to interpret <"{83E2CFA9-E0EB-4E08-9F85-43E577FF3D60}" = Windows Live Anmelde-Assistent> in the current context!
Error: Unable to interpret <"{83F73CB1-7705-49D1-9852-84D839CA2A45}" = Wireless Console 2> in the current context!
Error: Unable to interpret <"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570> in the current context!
Error: Unable to interpret <"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight> in the current context!
Error: Unable to interpret <"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player> in the current context!
Error: Unable to interpret <"{8CFEBE9C-F29F-4C49-80E0-7106970F8734}" = Power4Gear eXtreme> in the current context!
Error: Unable to interpret <"{90120000-0020-0409-0000-0000000FF1CE}" = Compatibility Pack for the 2007 Office system> in the current context!
Error: Unable to interpret <"{90120000-00B2-0407-0000-0000000FF1CE}" = Microsoft – Speichern als PDF oder XPS – Add-In für 2007 Microsoft Office-Programme> in the current context!
Error: Unable to interpret <"{90280407-6000-11D3-8CFE-0050048383C9}" = Microsoft Office XP Professional mit FrontPage> in the current context!
Error: Unable to interpret <"{981029E0-7FC9-4CF3-AB39-6F133621921A}" = Skype Toolbars> in the current context!
Error: Unable to interpret <"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17> in the current context!
Error: Unable to interpret <"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161> in the current context!
Error: Unable to interpret <"{9D6D7811-43B3-463C-BC79-5D1755269989}" = Net4Switch> in the current context!
Error: Unable to interpret <"{A96E97134CA649888820BCDE5E300BBD}" = H.264 Decoder> in the current context!
Error: Unable to interpret <"{AAC389499AEF40428987B3D30CFC76C9}" = MKV Splitter> in the current context!
Error: Unable to interpret <"{AC76BA86-7AD7-1031-7B44-A93000000001}" = Adobe Reader 9.3.2 - Deutsch> in the current context!
Error: Unable to interpret <"{AEF9DC35ADDF4825B049ACBFD1C6EB37}" = AAC Decoder> in the current context!
Error: Unable to interpret <"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter> in the current context!
Error: Unable to interpret <"{B360A8E5-C171-4AAE-9777-65B3CDB0072C}" = CanoScan LiDE20,30 Manual> in the current context!
Error: Unable to interpret <"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player> in the current context!
Error: Unable to interpret <"{BC61F51E-8AF7-46B9-AF20-B33B5EE81031}" = Nero 7 Essentials> in the current context!
Error: Unable to interpret <"{BF8780F3-CB8E-4AB0-9AA4-52E1BD574226}" = ATLAS.ti 6.2 Demo> in the current context!
Error: Unable to interpret <"{C0FC1C14-4824-4A73-87A6-9E888C9C3102}" = ASUS Splendid Video Enhancement Technology> in the current context!
Error: Unable to interpret <"{C1D14C0D-FDAA-4DF2-8441-A902805CCE8C}" = ArcSoft PhotoBase 3> in the current context!
Error: Unable to interpret <"{C2075010-F77F-44CD-8EAF-DEBCD14A46CD}" = TVGo DVB-T02PRO> in the current context!
Error: Unable to interpret <"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1> in the current context!
Error: Unable to interpret <"{CE86A0E7-818D-43EC-A181-59BA9BD3EF2E}" = LightScribe  1.8.13.1> in the current context!
Error: Unable to interpret <"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2> in the current context!
Error: Unable to interpret <"{DB891739-2EB3-45A8-9CBD-941C255CECD4}" = ASUS Touch Pad Extra> in the current context!
Error: Unable to interpret <"{DC24971E-1946-445D-8A82-CE685433FA7D}" = Realtek USB 2.0 Card Reader> in the current context!
Error: Unable to interpret <"{DE10AB76-4756-4913-BE25-55D1C1051F9A}" = WinFlash> in the current context!
Error: Unable to interpret <"{E657B243-9AD4-4ECC-BE81-4CCF8D667FD0}" = ASUS Live Update> in the current context!
Error: Unable to interpret <"{E6BF9670-C9E9-461A-9B14-B5ADAC3176CF}" = Cisco AnyConnect VPN Client> in the current context!
Error: Unable to interpret <"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver> in the current context!
Error: Unable to interpret <"{FC3D290D-79BE-44B7-ABF9-FDD110925930}" = PowerForPhone> in the current context!
Error: Unable to interpret <"Adobe Acrobat 5.0" = Adobe Acrobat 5.0> in the current context!
Error: Unable to interpret <"Adobe Flash Player ActiveX" = Adobe Flash Player 10 ActiveX> in the current context!
Error: Unable to interpret <"Asus_Camera_ScreenSaver" = Asus_Camera_ScreenSaver> in the current context!
Error: Unable to interpret <"Avira AntiVir Desktop" = Avira AntiVir Personal - Free Antivirus> in the current context!
Error: Unable to interpret <"AVMFBox" = AVM FRITZ!Box Dokumentation> in the current context!
Error: Unable to interpret <"AVMFBoxPrinter" = AVM FRITZ!Box Druckeranschluss> in the current context!
Error: Unable to interpret <"Canon CanoScan Toolbox 4.0" = Canon CanoScan Toolbox 4.0> in the current context!
Error: Unable to interpret <"CCleaner" = CCleaner (remove only)> in the current context!
Error: Unable to interpret <"DivX Plus DirectShow Filters" = DivX Plus DirectShow Filters> in the current context!
Error: Unable to interpret <"ElsterFormular 11.1.0 11.1.0.***unknown variable buildnummer***" = ElsterFormular 11.1.0> in the current context!
Error: Unable to interpret <"f4" = f4 3.1.0> in the current context!
Error: Unable to interpret <"GOM Player" = GOM Player> in the current context!
Error: Unable to interpret <"LucasArts' Curse of Monkey Island" = LucasArts' Curse of Monkey Island> in the current context!
Error: Unable to interpret <"MediaJoin" = MediaJoin> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile> in the current context!
Error: Unable to interpret <"Miranda IM" = Miranda IM 0.7.10> in the current context!
Error: Unable to interpret <"Mozilla Firefox 10.0.2 (x86 de)" = Mozilla Firefox 10.0.2 (x86 de)> in the current context!
Error: Unable to interpret <"PHPNukeDE Toolbar" = PHPNukeDE Toolbar> in the current context!
Error: Unable to interpret <"Picasa 3" = Picasa 3> in the current context!
Error: Unable to interpret <"Samsung ML-2010 Series" = Samsung ML-2010 Series> in the current context!
Error: Unable to interpret <"SMSERIAL" = Motorola SM56 Speakerphone Modem> in the current context!
Error: Unable to interpret <"SynTPDeinstKey" = Synaptics Pointing Device Driver> in the current context!
Error: Unable to interpret <"Universal Document Converter_is1" = Universal Document Converter (Demo)> in the current context!
Error: Unable to interpret <"USB2.0 1.3M WebCam" = USB2.0 1.3M WebCam> in the current context!
Error: Unable to interpret <"WordToPDF_is1" = WordToPDF 2.4> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Last 10 Event Log Errors ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ Application Events ]> in the current context!
Error: Unable to interpret <Error - 19.03.2011 16:14:18 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr > in the current context!
Error: Unable to interpret <mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 1064  Anfangszeit: 01cbe670a90e356c  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 31> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 19.03.2011 17:16:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr > in the current context!
Error: Unable to interpret <mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 13d4  Anfangszeit: 01cbe67a9b328781  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 22.03.2011 12:02:51 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr > in the current context!
Error: Unable to interpret <mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: bb0  Anfangszeit: 01cbe8a808dcae6d  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 172> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 22.03.2011 12:06:01 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit > in the current context!
Error: Unable to interpret <Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet > in the current context!
Error: Unable to interpret <"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über> in the current context!
Error: Unable to interpret < das Problem zu suchen.  Prozess-ID: dc4  Anfangszeit: 01cbe8aad6369487  Zeitpunkt der> in the current context!
Error: Unable to interpret < Beendigung: 47> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 22.03.2011 12:15:39 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit > in the current context!
Error: Unable to interpret <Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet > in the current context!
Error: Unable to interpret <"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über> in the current context!
Error: Unable to interpret < das Problem zu suchen.  Prozess-ID: d4  Anfangszeit: 01cbe8ab10e44570  Zeitpunkt der > in the current context!
Error: Unable to interpret <Beendigung: 16> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 22.03.2011 12:18:00 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm iexplore.exe, Version 7.0.6001.18565 arbeitet nicht mehr > in the current context!
Error: Unable to interpret <mit Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 7b4  Anfangszeit: 01cbe8aa9b8b8dc4  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 94> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.04.2011 11:47:29 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit> in the current context!
Error: Unable to interpret < Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 12d4  Anfangszeit: 01cbf2160a75b91f  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 31> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.04.2011 11:48:17 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm POWERPNT.EXE, Version 10.0.6858.0 arbeitet nicht mehr mit> in the current context!
Error: Unable to interpret < Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet> in the current context!
Error: Unable to interpret < "Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen > in the current context!
Error: Unable to interpret <über das Problem zu suchen.  Prozess-ID: 17ac  Anfangszeit: 01cbf21676aa0a7d  Zeitpunkt> in the current context!
Error: Unable to interpret < der Beendigung: 125> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.04.2011 11:53:09 | Computer Name = janka-PC | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Programm WINWORD.EXE, Version 10.0.6866.0 arbeitet nicht mehr mit > in the current context!
Error: Unable to interpret <Windows zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet > in the current context!
Error: Unable to interpret <"Lösungen für Probleme" in der Systemsteuerung, um nach weiteren Informationen über> in the current context!
Error: Unable to interpret < das Problem zu suchen.  Prozess-ID: 1244  Anfangszeit: 01cbf216944ba00f  Zeitpunkt der> in the current context!
Error: Unable to interpret < Beendigung: 47> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 04.04.2011 13:21:03 | Computer Name = janka-PC | Source = Application Error | ID = 1000> in the current context!
Error: Unable to interpret <Description = Fehlerhafte Anwendung iexplore.exe, Version 7.0.6001.18565, Zeitstempel> in the current context!
Error: Unable to interpret < 0x4d0f5fa9, fehlerhaftes Modul unknown, Version 0.0.0.0, Zeitstempel 0x00000000,> in the current context!
Error: Unable to interpret < Ausnahmecode 0xc0000005, Fehleroffset 0x8e8a770b,  Prozess-ID 0xc10, Anwendungsstartzeit> in the current context!
Error: Unable to interpret < 01cbf2e87d4acd67.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ Cisco AnyConnect VPN Client Events ]> in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line: > in the current context!
Error: Unable to interpret <2188 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647> in the current context!
Error: Unable to interpret < (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CMainThread::applyHostConfigForNoVpn File: .\MainThread.cpp> in the current context!
Error: Unable to interpret <Line:> in the current context!
Error: Unable to interpret < 7578 Invoked Function: CHostConfigMgr::DeterminePublicInterface Return Code: -33095647> in the current context!
Error: Unable to interpret < (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CMainThread::OnTimerExpired File: .\MainThread.cpp Line: 4128> in the current context!
Error: Unable to interpret <Invoked> in the current context!
Error: Unable to interpret < Function: CMainThread::applyHostConfigForNoVpn Return Code: -33095647 (0xFE070021)> in the current context!
Error: Unable to interpret <Description:> in the current context!
Error: Unable to interpret < ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CIPv4ChangeRouteHelper::FindBestRoute File: .\IPv4ChangeRouteHelper.cpp> in the current context!
Error: Unable to interpret <Line:> in the current context!
Error: Unable to interpret < 2484 Invoked Function: CIPv4RouteTable::FindMatchingRoute Return Code: -33095647 > in the current context!
Error: Unable to interpret <(0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 10:43:37 | Computer Name = janka-PC | Source = vpnagent | ID = 67108866> in the current context!
Error: Unable to interpret <Description = Function: CRouteMgr::UpdatePublicAddress File: .\RouteMgr.cpp Line: > in the current context!
Error: Unable to interpret <2188 Invoked Function: CChangeRouteTable::FindBestRouteInterface Return Code: -33095647> in the current context!
Error: Unable to interpret < (0xFE070021) Description: ROUTETABLE_ERROR_GETBESTROUTE_FAILED > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 12:52:02 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 06.03.2012 13:04:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 07.03.2012 15:15:54 | Computer Name = JANKA-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 08.03.2012 05:24:59 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 08.03.2012 05:29:07 | Computer Name = janka-PC | Source = vpnagent | ID = 67110873> in the current context!
Error: Unable to interpret <Description = Termination reason code 9: Client PC is shutting down.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Last 10 Event Log Errors ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error reading Event Logs: The Event Service is not operating properly or the Event Logs are corrupt!> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret << End of report >

--- --- ---
> in the current context!

OTL by OldTimer - Version 3.2.36.1 log created on 03082012_133027
[/spoiler]

Ich werde jetzt die anderen Schritte ausführen.

Trivandrum · 08.03.2012, 13:42

Ich habe gerade versucht, meinen PC im normalen Modus zu starten.
Leider kam nach kurzer Zeit wieder der Virus.
Deswegen weiß ich nicht, was ich tun soll:

Ich könnte wieder in den abgesicherten modus gehen und da die weiteren Schritte ausführen.

Oder ich könnte den PC im normalen Modus starten, allerdings mit einem anderen Benutzer.

Grüße

Trivandrum · 08.03.2012, 15:24

Hallo,

es hat jetzt doch alles geklappt, ich habe OTL als Administrator geöffnetund dann gings.
Folgendes kam dabei raus:

[spoiler]All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{0E330D6F-EC24-11DD-9B90-806E6F6E6963} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0E330D6F-EC24-11DD-9B90-806E6F6E6963}\ not found.
C:\Users\janka\AppData\Roaming\Microsoft\torrent.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: All Users

User: Default

User: Default User

User: janka
->Flash cache emptied: 12688 bytes

User: klaus
->Flash cache emptied: 626 bytes

User: Public

Total Flash Files Cleaned = 0,00 mb

[EMPTYTEMP]

User: All Users

User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: janka
->Temp folder emptied: 7127902 bytes
->Temporary Internet Files folder emptied: 171942174 bytes
->Java cache emptied: 48184 bytes
->FireFox cache emptied: 74380793 bytes
->Flash cache emptied: 0 bytes

User: klaus
->Temp folder emptied: 577126 bytes
->Temporary Internet Files folder emptied: 23336854 bytes
->FireFox cache emptied: 49520684 bytes
->Flash cache emptied: 0 bytes

User: Public

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 4046190 bytes
RecycleBin emptied: 162556 bytes

Total Files Cleaned = 316,00 mb

OTL by OldTimer - Version 3.2.36.1 log created on 03082012_150926

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...
[/spoiler]

Ich habe die Sachen auch im Upload hochgeladen.

Muss ich noch etwas machen oder ist der Virus nun beseitigt?

markusg · 08.03.2012, 15:50

Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.

Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
Tool

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Hinweis:
Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Trivandrum · 08.03.2012, 17:01

FOlgendes kam dabei raus:

Combofix Logfile:

Code:

ATTFilter

ComboFix 12-03-08.02 - janka 08.03.2012  16:30:41.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6001.1.1252.49.1031.18.1919.1151 [GMT 1:00]
ausgeführt von:: c:\users\janka\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {090F9C29-64CE-6C6F-379C-5901B49A85B7}
SP: AntiVir Desktop *Disabled/Updated* {B26E7DCD-42F4-63E1-0D2C-6273CF1DCF0A}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\users\janka\Firefox_Setup_10.0.2.exe
c:\windows\unin0407.exe
c:\windows\WindowsUpdate.log
.
Infizierte Kopie von c:\windows\system32\kernel32.dll wurde gefunden und desinfiziert 
Kopie von - c:\windows\winsxs\x86_microsoft-windows-kernel32_31bf3856ad364e35_6.0.6002.18449_none_9582275d538a1db6\kernel32.dll wurde wiederhergestellt 
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-02-08 bis 2012-03-08  ))))))))))))))))))))))))))))))
.
.
2012-03-08 12:30 . 2012-03-08 14:20	--------	d-----w-	C:\_OTL
2012-03-08 08:04 . 2012-03-08 08:04	--------	d-----w-	c:\users\klaus\AppData\Local\Mozilla
2012-03-07 14:41 . 2012-03-07 14:41	--------	d-----w-	c:\users\klaus\AppData\Roaming\Avira
2012-03-06 07:47 . 2012-02-08 06:03	6552120	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{EE2760AE-BB32-4382-81C3-5CCCAFA10515}\mpengine.dll
2012-03-05 13:25 . 2012-03-05 13:25	--------	d-----w-	c:\users\janka\AppData\Local\Mozilla
2012-03-03 17:51 . 2012-03-03 17:51	--------	d-----w-	c:\program files\Application Updater
2012-03-03 17:51 . 2012-03-03 17:51	--------	d-----w-	c:\program files\pdfforge Toolbar
2012-03-03 17:51 . 2012-03-03 17:51	--------	d-----w-	c:\program files\Common Files\Spigot
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-08 15:40 . 2009-01-26 11:25	45056	----a-w-	c:\windows\system32\acovcnt.exe
2012-02-23 08:18 . 2009-10-03 13:28	237072	------w-	c:\windows\system32\MpSigStub.exe
2011-12-14 07:36 . 2011-12-14 07:36	1207568	----a-w-	c:\programdata\Microsoft\eHome\Packages\MCESpotlight\MCESpotlight\SpotlightResources.dll
2012-02-16 14:55 . 2012-03-05 13:25	134104	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2008-01-19 1233920]
"LightScribe Control Panel"="c:\program files\Common Files\LightScribe\LightScribeControlPanel.exe" [2007-06-20 451872]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-19 125952]
"DetectTray"="c:\program files\Genius\TVGo DVB-T02PRO\DetectTray.exe" [2007-09-21 131072]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2006-12-02 4186112]
"SMSERIAL"="c:\program files\Motorola\SMSERIAL\sm56hlpr.exe" [2006-10-09 729088]
"ATKMEDIA"="c:\program files\ASUS\ATK Media\DMEDIA.EXE" [2006-11-02 61440]
"ASUSTPE"="c:\windows\system32\ASUSTPE.exe" [2006-12-12 106496]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2006-11-23 815104]
"ASUS Camera ScreenSaver"="c:\windows\ASScrProlog.exe" [2009-01-26 37232]
"ASUS Screen Saver Protector"="c:\windows\ASScrPro.exe" [2009-01-26 33136]
"PowerForPhone"="c:\program files\PowerForPhone\PowerForPhone.exe" [2007-01-15 778240]
"NeroFilterCheck"="c:\program files\Common Files\Ahead\Lib\NeroCheck.exe" [2007-03-01 153136]
"Samsung PanelMgr"="c:\windows\Samsung\PanelMgr\SSMMgr.exe" [2007-01-02 520192]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2010-11-08 281768]
"Adobe Reader Speed Launcher"="c:\program files\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2010-04-04 36272]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2010-03-24 952768]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"SearchSettings"="c:\program files\Common Files\Spigot\Search Settings\SearchSettings.exe" [2012-02-06 934240]
.
c:\users\janka\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
StarOffice 8.lnk - c:\program files\Sun\StarOffice 8\program\quickstart.exe [2005-6-21 122880]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Microsoft Office.lnk - c:\program files\Microsoft Office\Office10\OSA.EXE [2001-2-13 83360]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\session manager]
BootExecute	REG_MULTI_SZ   	autocheck autochk /p \??\F:\0autocheck autochk *
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecAntiVirus]
"DisableMonitoring"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{10880D85-AAD9-4558-ABDC-2AB1552D831F}]
2007-06-20 11:47	451872	----a-w-	c:\program files\Common Files\LightScribe\LSRunOnce.exe
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
TCP: DhcpNameServer = 192.168.220.1
DPF: {34DC6011-88B5-4EA9-BA7A-DC7B4F4437FE} - hxxp://www.photodose.de/ips-opdata/operator/69189345/objects/jordan.cab
DPF: {55963676-2F5E-4BAF-AC28-CF26AA587566} - hxxps://vpn-server.rrzn.uni-hannover.de/CACHE/stc/1/binaries/vpnweb.cab
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
FF - ProfilePath - c:\users\janka\AppData\Roaming\Mozilla\Firefox\Profiles\pfml280r.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://search.yahoo.com/search?ei=utf-8&fr=greentree_ff1&type=827316&ilc=12&p=
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{c9508125-4747-4733-b048-e4b82dc9716d} - c:\program files\PHPNukeDE\tbPHPN.dll
BHO-{c9508125-4747-4733-b048-e4b82dc9716d} - c:\program files\PHPNukeDE\tbPHPN.dll
Toolbar-{c9508125-4747-4733-b048-e4b82dc9716d} - c:\program files\PHPNukeDE\tbPHPN.dll
WebBrowser-{C9508125-4747-4733-B048-E4B82DC9716D} - c:\program files\PHPNukeDE\tbPHPN.dll
HKLM-Run-Zshutdown - c:\preload\patch\sysprep.cmd
HKLM-Run-QuickTime Task - c:\program files\QuickTime\QTTask.exe
AddRemove-DivX Plus DirectShow Filters - c:\users\janka\Downloads\DivX\DivXDSFiltersUninstall.exe
AddRemove-LucasArts' Curse of Monkey Island - c:\windows\unin0407.exe
AddRemove-Miranda IM - c:\program files\Miranda IM\Uninstall.exe
AddRemove-PHPNukeDE Toolbar - c:\progra~1\PHPNUK~1\UNWISE.EXE
AddRemove-{7585478E9D9B42108671C12F8714CEFE} - c:\users\janka\Downloads\DivX\DivXConverterUninstall.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\users\janka\Downloads\DivX\DivXCodecUninstall.exe
AddRemove-{8ADFC4160D694100B5B8A22DE9DCABD9} - c:\users\janka\Downloads\DivX\DivXPlayerUninstall.exe
AddRemove-{B13A7C41581B411290FBC0395694E2A9} - c:\users\janka\Downloads\DivX\DivXConverterUninstall.exe
AddRemove-{B7050CBDB2504B34BC2A9CA0A692CC29} - c:\users\janka\Downloads\DivX\DivXWebPlayerUninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, GMER - Rootkit Detector and Remover
Rootkit scan 2012-03-08 16:40
Windows 6.0.6001 Service Pack 1 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files\Cisco\Cisco AnyConnect VPN Client\vpnagent.exe
c:\program files\ATK Hotkey\ASLDRSrv.exe
c:\program files\Avira\AntiVir Desktop\sched.exe
c:\program files\Avira\AntiVir Desktop\avguard.exe
c:\program files\Application Updater\ApplicationUpdater.exe
c:\program files\Common Files\LightScribe\LSSrvc.exe
c:\program files\Avira\AntiVir Desktop\avshadow.exe
c:\program files\ASUS\NB Probe\SPM\spmgr.exe
c:\windows\System32\StkCSrv.exe
c:\windows\system32\WUDFHost.exe
c:\program files\ASUS\Net4Switch\Net4Switch.exe
c:\program files\ATK Hotkey\Hcontrol.exe
c:\program files\ATKOSD2\ATKOSD2.exe
c:\program files\Wireless Console 2\wcourier.exe
c:\program files\P4G\BatteryLife.exe
c:\program files\ASUS\Splendid\ACMON.exe
c:\windows\System32\ACEngSvr.exe
c:\program files\ATK Hotkey\ATKOSD.exe
c:\windows\system32\UI0Detect.exe
c:\windows\system32\conime.exe
c:\windows\RtHDVCpl.exe
c:\windows\ehome\ehmsas.exe
c:\program files\Sun\StarOffice 8\program\soffice.exe
c:\program files\Sun\StarOffice 8\program\soffice.BIN
c:\program files\Windows Media Player\wmpnetwk.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-03-08  16:48:50 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-03-08 15:48
.
Vor Suchlauf: 13 Verzeichnis(se), 34.339.741.696 Bytes frei
Nach Suchlauf: 19 Verzeichnis(se), 34.530.611.200 Bytes frei
.
- - End Of File - - 7CAF0925A653F45CAD175F0240A5CD1B[/spoiler]

--- --- ---

markusg · 08.03.2012, 17:40

malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Trivandrum · 08.03.2012, 21:52

Es wurden keine infizierten Dateien gefunden, deswegen konnte ich auch nichts löschen.
Folgendes Ergebnis:
[spoiler]Malwarebytes Anti-Malware 1.60.1.1000
Malwarebytes : Free anti-malware, anti-virus and spyware removal download

Datenbank Version: v2012.03.08.06

Windows Vista Service Pack 1 x86 NTFS
Internet Explorer 7.0.6001.18000
janka :: JANKA-PC [Administrator]

08.03.2012 20:29:52
mbam-log-2012-03-08 (20-29-52).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 334706
Laufzeit: 1 Stunde(n), 14 Minute(n), 46 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
[/spoiler]

markusg · 09.03.2012, 13:08

Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.

wenn fertig, melden bitte

Trivandrum · 09.03.2012, 15:29

Okay, auch das ist erledigt!

markusg · 09.03.2012, 15:33

rechtsklick auf computer, eigenschaften, guck mal welches servicepack instaliert ist.

Trivandrum · 09.03.2012, 16:18

Es ist servicepack 2 installiert.

markusg · 09.03.2012, 16:22

sehr gut.

lade den CCleaner standard:
CCleaner Download - CCleaner 3.16.1666
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

50€-Virus-Was kann ich tun?

Log-Analyse und Auswertung: 50€-Virus-Was kann ich tun?