Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen (https://www.trojaner-board.de/110571-sicherheitsgruenden-wurde-windowssystem-blockiert-bezahlen-runterlasen.html)

Sportie 28.02.2012 12:33
Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen
 
Hallo zusammen!
Ich bin neu hier in der Community und bin um jede Hilfe sehr dankbar!
Ich hoffe, da mein Problem hier wohl schon bekannt ist, dass ihr mir auch helfen könnt!
Seit einer Woche kommt, immer wenn ich meinen Rechner mit dem Internet verbinde die bekannte Meldung: Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterladen!

Meine "Anti Vir Premimum" Software hat hier wohl versagt und zeigt nach einem vollständigen Systemcheck keine Funde an!

Die geforderten Files zu erstellen war ohne Internetverbindung gar nicht so einfach! Ich hoffe jedoch, ich habe alles hinbekommen!

Ich würde mich über eine Hilfe von euch freuen!

Sportie

markusg 28.02.2012 12:36
hi,
starte mal neu, drücke f8 wähle abgesicherter modus mit netzwerk, melde dich im infiziertem konto an, stelle die internet verbindung her.
Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
  • Schliesse bitte nun alle Programme. (Wichtig)
  • Klicke nun bitte auf den Quick Scan Button.
  • Kopiere
    nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Sportie 28.02.2012 13:28
Bin noch etwas langsam, aber ich hoffe ich habe bisher alles richtig gemacht!?

markusg 28.02.2012 17:44
hi


dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user.
wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts.


• Starte bitte die OTL.exe
• Kopiere nun das Folgende in die Textbox.



Code:
:OTL
O4 - HKCU..\Run: [{FA7C4B0A-4FC4-11DC-8D75-806D6172696F}] C:\Dokumente und Einstellungen\Helmi\Anwendungsdaten\Microsoft\torrent.exe ()

 :Files
C:\Dokumente und Einstellungen\Helmi\Anwendungsdaten\Microsoft\torrent.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]


• Schliesse bitte nun alle Programme.
• Klicke nun bitte auf den Fix Button.
• OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
• Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!



Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + E Taste.
  • Öffne dein Systemlaufwerk ( meistens C: )
  • Suche nun
    folgenden Ordner: _OTL und öffne diesen.
  • Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner

  • Dies wird eine Movedfiles.zip Datei in _OTL erstellen
  • Lade diese bitte in unseren Uploadchannel
    hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )
Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus :)

Sportie 28.02.2012 19:02
All processes killed
Error: Unable to interpret <activexactivex> in the current context!
Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context!
Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context!
Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context!
Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context!
Error: Unable to interpret </md5start> in the current context!
Error: Unable to interpret <userinit.exe> in the current context!
Error: Unable to interpret <eventlog.dll> in the current context!
Error: Unable to interpret <scecli.dll> in the current context!
Error: Unable to interpret <netlogon.dll> in the current context!
Error: Unable to interpret <cngaudit.dll> in the current context!
Error: Unable to interpret <ws2ifsl.sys> in the current context!
Error: Unable to interpret <sceclt.dll> in the current context!
Error: Unable to interpret <ntelogon.dll> in the current context!
Error: Unable to interpret <winlogon.exe> in the current context!
Error: Unable to interpret <logevent.dll> in the current context!
Error: Unable to interpret <user32.DLL> in the current context!
Error: Unable to interpret <explorer.exe> in the current context!
Error: Unable to interpret <iaStor.sys> in the current context!
Error: Unable to interpret <nvstor.sys> in the current context!
Error: Unable to interpret <atapi.sys> in the current context!
Error: Unable to interpret <IdeChnDr.sys> in the current context!
Error: Unable to interpret <viasraid.sys> in the current context!
Error: Unable to interpret <AGP440.sys> in the current context!
Error: Unable to interpret <vaxscsi.sys> in the current context!
Error: Unable to interpret <nvatabus.sys> in the current context!
Error: Unable to interpret <viamraid.sys> in the current context!
Error: Unable to interpret <nvata.sys> in the current context!
Error: Unable to interpret <nvgts.sys> in the current context!
Error: Unable to interpret <iastorv.sys> in the current context!
Error: Unable to interpret <ViPrt.sys> in the current context!
Error: Unable to interpret <eNetHook.dll> in the current context!
Error: Unable to interpret <ahcix86.sys> in the current context!
Error: Unable to interpret <KR10N.sys> in the current context!
Error: Unable to interpret <nvstor32.sys> in the current context!
Error: Unable to interpret <ahcix86s.sys> in the current context!
Error: Unable to interpret </md5stop> in the current context!
Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context!
Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context!
Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context!
Error: Unable to interpret <%USERPROFILE%\*.*> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context!
Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context!
Error: Unable to interpret <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs> in the current context!
Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context!
Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context!
Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context!
Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context!
Error: Unable to interpret </md5start> in the current context!
Error: Unable to interpret <userinit.exe> in the current context!
Error: Unable to interpret <eventlog.dll> in the current context!
Error: Unable to interpret <scecli.dll> in the current context!
Error: Unable to interpret <netlogon.dll> in the current context!
Error: Unable to interpret <cngaudit.dll> in the current context!
Error: Unable to interpret <ws2ifsl.sys> in the current context!
Error: Unable to interpret <sceclt.dll> in the current context!
Error: Unable to interpret <ntelogon.dll> in the current context!
Error: Unable to interpret <winlogon.exe> in the current context!
Error: Unable to interpret <logevent.dll> in the current context!
Error: Unable to interpret <user32.DLL> in the current context!
Error: Unable to interpret <explorer.exe> in the current context!
Error: Unable to interpret <iaStor.sys> in the current context!
Error: Unable to interpret <nvstor.sys> in the current context!
Error: Unable to interpret <atapi.sys> in the current context!
Error: Unable to interpret <IdeChnDr.sys> in the current context!
Error: Unable to interpret <viasraid.sys> in the current context!
Error: Unable to interpret <AGP440.sys> in the current context!
Error: Unable to interpret <vaxscsi.sys> in the current context!
Error: Unable to interpret <nvatabus.sys> in the current context!
Error: Unable to interpret <viamraid.sys> in the current context!
Error: Unable to interpret <nvata.sys> in the current context!
Error: Unable to interpret <nvgts.sys> in the current context!
Error: Unable to interpret <iastorv.sys> in the current context!
Error: Unable to interpret <ViPrt.sys> in the current context!
Error: Unable to interpret <eNetHook.dll> in the current context!
Error: Unable to interpret <ahcix86.sys> in the current context!
Error: Unable to interpret <KR10N.sys> in the current context!
Error: Unable to interpret <nvstor32.sys> in the current context!
Error: Unable to interpret <ahcix86s.sys> in the current context!
Error: Unable to interpret </md5stop> in the current context!
Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context!
Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context!
Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context!
Error: Unable to interpret <%USERPROFILE%\*.*> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context!
Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context!
Error: Unable to interpret <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context!
Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context!
Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context!
Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context!
Error: Unable to interpret </md5start> in the current context!
Error: Unable to interpret <userinit.exe> in the current context!
Error: Unable to interpret <eventlog.dll> in the current context!
Error: Unable to interpret <scecli.dll> in the current context!
Error: Unable to interpret <netlogon.dll> in the current context!
Error: Unable to interpret <cngaudit.dll> in the current context!
Error: Unable to interpret <ws2ifsl.sys> in the current context!
Error: Unable to interpret <sceclt.dll> in the current context!
Error: Unable to interpret <ntelogon.dll> in the current context!
Error: Unable to interpret <winlogon.exe> in the current context!
Error: Unable to interpret <logevent.dll> in the current context!
Error: Unable to interpret <user32.DLL> in the current context!
Error: Unable to interpret <explorer.exe> in the current context!
Error: Unable to interpret <iaStor.sys> in the current context!
Error: Unable to interpret <nvstor.sys> in the current context!
Error: Unable to interpret <atapi.sys> in the current context!
Error: Unable to interpret <IdeChnDr.sys> in the current context!
Error: Unable to interpret <viasraid.sys> in the current context!
Error: Unable to interpret <AGP440.sys> in the current context!
Error: Unable to interpret <vaxscsi.sys> in the current context!
Error: Unable to interpret <nvatabus.sys> in the current context!
Error: Unable to interpret <viamraid.sys> in the current context!
Error: Unable to interpret <nvata.sys> in the current context!
Error: Unable to interpret <nvgts.sys> in the current context!
Error: Unable to interpret <iastorv.sys> in the current context!
Error: Unable to interpret <ViPrt.sys> in the current context!
Error: Unable to interpret <eNetHook.dll> in the current context!
Error: Unable to interpret <ahcix86.sys> in the current context!
Error: Unable to interpret <KR10N.sys> in the current context!
Error: Unable to interpret <nvstor32.sys> in the current context!
Error: Unable to interpret <ahcix86s.sys> in the current context!
Error: Unable to interpret </md5stop> in the current context!
Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context!
Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context!
Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context!
Error: Unable to interpret <%USERPROFILE%\*.*> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context!
Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context!
Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context!
Error: Unable to interpret <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs> in the current context!
Error: Unable to interpret <OTL EXTRAS Logfile:
Code:
OTL Extras logfile created on: 28.02.2012 13:00:04 - Run 1> in the current context!
Error: Unable to interpret <OTL by OldTimer - Version 3.2.33.2    Folder = C:\Dokumente und Einstellungen\Helmi\Desktop> in the current context!
Error: Unable to interpret <Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation> in the current context!
Error: Unable to interpret <Internet Explorer (Version = 8.0.6001.18372)> in the current context!
Error: Unable to interpret <Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <1,99 Gb Total Physical Memory | 1,71 Gb Available Physical Memory | 85,91% Memory free> in the current context!
Error: Unable to interpret <1,84 Gb Paging File | 1,76 Gb Available in Paging File | 95,58% Paging File free> in the current context!
Error: Unable to interpret <Paging file location(s):  [binary data]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme> in the current context!
Error: Unable to interpret <Drive C: | 145,14 Gb Total Space | 63,82 Gb Free Space | 43,97% Space Free | Partition Type: NTFS> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Computer Name: POWERBOY | User Name: Helmi | Logged in as Administrator.> in the current context!
Error: Unable to interpret <Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan> in the current context!
Error: Unable to interpret <Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Extra Registry (SafeList) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== File Associations ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]> in the current context!
Error: Unable to interpret <.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*> in the current context!
Error: Unable to interpret <.html [@ = ChromeHTML] -- Reg Error: Key error. File not found> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]> in the current context!
Error: Unable to interpret <.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Shell Spawning ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]> in the current context!
Error: Unable to interpret <batfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <cmdfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <comfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*> in the current context!
Error: Unable to interpret <exefile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <htmlfile [edit] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <http [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1"> in the current context!
Error: Unable to interpret <https [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1"> in the current context!
Error: Unable to interpret <piffile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <regfile [merge] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <scrfile [config] -- "%1"> in the current context!
Error: Unable to interpret <scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l> in the current context!
Error: Unable to interpret <scrfile [open] -- "%1" /S> in the current context!
Error: Unable to interpret <txtfile [edit] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1> in the current context!
Error: Unable to interpret <Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()> in the current context!
Error: Unable to interpret <Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()> in the current context!
Error: Unable to interpret <Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Security Center Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]> in the current context!
Error: Unable to interpret <"FirstRunDisabled" = 1> in the current context!
Error: Unable to interpret <"AntiVirusDisableNotify" = 0> in the current context!
Error: Unable to interpret <"FirewallDisableNotify" = 1> in the current context!
Error: Unable to interpret <"UpdatesDisableNotify" = 0> in the current context!
Error: Unable to interpret <"AntiVirusOverride" = 0> in the current context!
Error: Unable to interpret <"FirewallOverride" = 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]> in the current context!
Error: Unable to interpret <"DisableMonitoring" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== System Restore Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]> in the current context!
Error: Unable to interpret <"DisableSR" = 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]> in the current context!
Error: Unable to interpret <"Start" = 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]> in the current context!
Error: Unable to interpret <"Start" = 2> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Firewall Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]> in the current context!
Error: Unable to interpret <"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007> in the current context!
Error: Unable to interpret <"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008> in the current context!
Error: Unable to interpret <"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]> in the current context!
Error: Unable to interpret <"EnableFirewall" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]> in the current context!
Error: Unable to interpret <"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007> in the current context!
Error: Unable to interpret <"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008> in the current context!
Error: Unable to interpret <"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Authorized Applications List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]> in the current context!
Error: Unable to interpret <"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)> in the current context!
Error: Unable to interpret <"C:\Dokumente und Einstellungen\Kathi\Eigene Dateien\Multimessenger\MESSENGR.EXE" = C:\Dokumente und Einstellungen\Kathi\Eigene Dateien\Multimessenger\MESSENGR.EXE:*:Enabled:WEB.DE MultiMessenger -- (WEB.DE GmbH)> in the current context!
Error: Unable to interpret <"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()> in the current context!
Error: Unable to interpret <"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Disabled:Google Earth -- (Google)> in the current context!
Error: Unable to interpret <"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== HKEY_LOCAL_MACHINE Uninstall List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]> in the current context!
Error: Unable to interpret <"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148> in the current context!
Error: Unable to interpret <"{075473F5-846A-448B-BCB3-104AA1760205}" = RecordNow Data> in the current context!
Error: Unable to interpret <"{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message> in the current context!
Error: Unable to interpret <"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA> in the current context!
Error: Unable to interpret <"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148> in the current context!
Error: Unable to interpret <"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java(TM) 6 Update 24> in the current context!
Error: Unable to interpret <"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7> in the current context!
Error: Unable to interpret <"{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}" = Steuer-Spar-Erklärung 2009> in the current context!
Error: Unable to interpret <"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP> in the current context!
Error: Unable to interpret <"{3623704F-1EA9-46FB-A957-7575FB6D9A56}" = Steuer-Spar-Erklärung Lehrer 2012> in the current context!
Error: Unable to interpret <"{48227AEB-DC8E-4A90-A274-0B4A39D699B1}" = Client Security Solution> in the current context!
Error: Unable to interpret <"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater> in the current context!
Error: Unable to interpret <"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml> in the current context!
Error: Unable to interpret <"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth> in the current context!
Error: Unable to interpret <"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler> in the current context!
Error: Unable to interpret <"{6715F979-12BE-4C1C-AAEB-168518204F1B}" = Steuer-Spar-Erklärung Lehrer 2010> in the current context!
Error: Unable to interpret <"{69E8BEBD-B3AA-4981-BA49-AD0AEA731031}" = Nero BackItUp 2 Essentials> in the current context!
Error: Unable to interpret <"{6B36DEBF-27D0-4B1E-858D-D397091C6C7D}" = HP Precisionscan Pro 3.1> in the current context!
Error: Unable to interpret <"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable> in the current context!
Error: Unable to interpret <"{7661B93C-C34D-43C2-B23A-AAFC267EFB09}" = Steuer-Spar-Erklärung Lehrer 2011> in the current context!
Error: Unable to interpret <"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053> in the current context!
Error: Unable to interpret <"{7726CF62-7B45-4E6D-9266-615346816BCA}" = Rescue and Recovery> in the current context!
Error: Unable to interpret <"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update> in the current context!
Error: Unable to interpret <"{78D7D7CD-A06B-4514-ACBD-8055BF945A8E}" = InfoBibliothek 2> in the current context!
Error: Unable to interpret <"{796E076A-82F7-4D49-98C8-DEC0C3BC733A}" = Diskeeper Lite> in the current context!
Error: Unable to interpret <"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime> in the current context!
Error: Unable to interpret <"{7FC3BBEC-5A91-41B0-9CB8-960EC4421411}" = WCreator3> in the current context!
Error: Unable to interpret <"{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update> in the current context!
Error: Unable to interpret <"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU> in the current context!
Error: Unable to interpret <"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders  (German) 12> in the current context!
Error: Unable to interpret <"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007> in the current context!
Error: Unable to interpret <"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007> in the current context!
Error: Unable to interpret <"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007> in the current context!
Error: Unable to interpret <"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System> in the current context!
Error: Unable to interpret <"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In> in the current context!
Error: Unable to interpret <"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007> in the current context!
Error: Unable to interpret <"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD> in the current context!
Error: Unable to interpret <"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center> in the current context!
Error: Unable to interpret <"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17> in the current context!
Error: Unable to interpret <"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161> in the current context!
Error: Unable to interpret <"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2> in the current context!
Error: Unable to interpret <"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support> in the current context!
Error: Unable to interpret <"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper> in the current context!
Error: Unable to interpret <"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = RecordNow Audio> in the current context!
Error: Unable to interpret <"{AC60C8C1-855E-45AB-8D95-1D16F8A38E78}" = UGuide> in the current context!
Error: Unable to interpret <"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.0 - Deutsch> in the current context!
Error: Unable to interpret <"{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}" = AAVUpdateManager> in the current context!
Error: Unable to interpret <"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = RecordNow Copy> in the current context!
Error: Unable to interpret <"{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo> in the current context!
Error: Unable to interpret <"{B7088B71-86FC-4F5E-B295-68FAB7B6C85B}" = Steuer-Spar-Erklärung 2007> in the current context!
Error: Unable to interpret <"{BA165460-FCF7-4D6C-A7A2-F2321700720F}" = MobileMe Control Panel> in the current context!
Error: Unable to interpret <"{BA7A3288-228D-4031-A93A-B5F6B3415E15}" = Misc> in the current context!
Error: Unable to interpret <"{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}" = Steuer-Spar-Erklärung 2008> in the current context!
Error: Unable to interpret <"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2> in the current context!
Error: Unable to interpret <"{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}" = XP Themes> in the current context!
Error: Unable to interpret <"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1> in the current context!
Error: Unable to interpret <"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1> in the current context!
Error: Unable to interpret <"{D728E945-256D-4477-B377-6BBA693714AC}" = Ergänzung zu Productivity Center für ThinkCentre> in the current context!
Error: Unable to interpret <"{E728E952-DD4F-4BCD-A5C8-40FBFEFF91FE}" = OpenOffice.org Installer 1.0> in the current context!
Error: Unable to interpret <"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX> in the current context!
Error: Unable to interpret <"{F1CD25A0-5401-40B2-BAA9-E267408B16DF}" = Toolbox> in the current context!
Error: Unable to interpret <"{F386C340-DF4B-4BBA-9503-420FB7EDB395}" = Wallpapers> in the current context!
Error: Unable to interpret <"{F5FB4B71-6301-11D4-9AD1-00A0C9B0C5F6}" = InfoBibliothek> in the current context!
Error: Unable to interpret <"{F705E3E1-A471-426B-9A09-73429F3418EE}" = System Migration Assistant> in the current context!
Error: Unable to interpret <"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022> in the current context!
Error: Unable to interpret <"7-Zip" = 7-Zip 9.20> in the current context!
Error: Unable to interpret <"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX> in the current context!
Error: Unable to interpret <"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin> in the current context!
Error: Unable to interpret <"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0> in the current context!
Error: Unable to interpret <"ArcSoft PhotoImpression" = ArcSoft PhotoImpression> in the current context!
Error: Unable to interpret <"Avira AntiVir Desktop" = Avira AntiVir Premium> in the current context!
Error: Unable to interpret <"CAL" = Canon Camera Access Library> in the current context!
Error: Unable to interpret <"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"CCleaner" = CCleaner> in the current context!
Error: Unable to interpret <"CSCLIB" = Canon Camera Support Core Library> in the current context!
Error: Unable to interpret <"DPP" = Canon Utilities Digital Photo Professional 2.2> in the current context!
Error: Unable to interpret <"EOS Utility" = Canon Utilities EOS Utility> in the current context!
Error: Unable to interpret <"HOMESTUDENTR" = Microsoft Office Home and Student 2007> in the current context!
Error: Unable to interpret <"HP Fotodruckprogramm" = HP Fotodruckprogramm> in the current context!
Error: Unable to interpret <"HP Officejet Pro K550 Series" = HP Officejet Pro K550 Serie> in the current context!
Error: Unable to interpret <"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs> in the current context!
Error: Unable to interpret <"ie7" = Windows Internet Explorer 7> in the current context!
Error: Unable to interpret <"ie8" = Windows Internet Explorer 8 Release Candidate 1> in the current context!
Error: Unable to interpret <"InterActual Player" = InterActual Player> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 1.1  (1033)" = Microsoft .NET Framework 1.1> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1> in the current context!
Error: Unable to interpret <"MouseSuite98" = Mouse Suite> in the current context!
Error: Unable to interpret <"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)> in the current context!
Error: Unable to interpret <"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP> in the current context!
Error: Unable to interpret <"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition> in the current context!
Error: Unable to interpret <"NeroVision!UninstallKey" = NeroVision Express 3> in the current context!
Error: Unable to interpret <"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs> in the current context!
Error: Unable to interpret <"PDF Maker Pilot Demo_is1" = PDF Maker Pilot Demo version 1.23> in the current context!
Error: Unable to interpret <"PhotoStitch" = Canon Utilities PhotoStitch> in the current context!
Error: Unable to interpret <"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"Remove Multimedia Center" = Remove Multimedia Center> in the current context!
Error: Unable to interpret <"Sony Ericsson S312 driver" = Sony Ericsson S312 driver v3.5.3.0> in the current context!
Error: Unable to interpret <"VLC media player" = VLC media player 1.0.2> in the current context!
Error: Unable to interpret <"WEB.DE MultiMessenger" = WEB.DE MultiMessenger> in the current context!
Error: Unable to interpret <"Windows Media Format Runtime" = Windows Media Format 11 runtime> in the current context!
Error: Unable to interpret <"Windows Media Player" = Windows Media Player 11> in the current context!
Error: Unable to interpret <"Windows XP Service Pack" = Windows XP Service Pack 3> in the current context!
Error: Unable to interpret <"WinZip" = WinZip> in the current context!
Error: Unable to interpret <"WMCSetup" = Windows Media Connect> in the current context!
Error: Unable to interpret <"WMFDist11" = Windows Media Format 11 runtime> in the current context!
Error: Unable to interpret <"wmp11" = Windows Media Player 11> in the current context!
Error: Unable to interpret <"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0> in the current context!
Error: Unable to interpret <"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Last 10 Event Log Errors ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ Application Events ]> in the current context!
Error: Unable to interpret <Error - 29.06.2011 04:54:47 | Computer Name = POWERBOY | Source = MsiInstaller | ID = 1023> in the current context!
Error: Unable to interpret <Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update "KB2478658"> in the current context!
Error: Unable to interpret < konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in> in the current context!
Error: Unable to interpret < der Protokolldatei C:\WINDOWS\system32\config\SYSTEM~1\LOKALE~1\Temp\Microsoft > in the current context!
Error: Unable to interpret <.NET Framework 2.0-KB2478658_20110629_085238968-Msi0.txt enthalten.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 29.06.2011 04:54:48 | Computer Name = POWERBOY | Source = HotFixInstaller | ID = 5000> in the current context!
Error: Unable to interpret <Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb2478658,> in the current context!
Error: Unable to interpret < P2 1031, P3 1603, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10 > in the current context!
Error: Unable to interpret <0.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.07.2011 16:15:24 | Computer Name = POWERBOY | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Stillstehende Anwendung msimn.exe, Version 6.0.2900.5512, Stillstandmodul> in the current context!
Error: Unable to interpret < hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.07.2011 16:15:59 | Computer Name = POWERBOY | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Stillstehende Anwendung WINWORD.EXE, Version 12.0.6545.5000, Stillstandmodul> in the current context!
Error: Unable to interpret < hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.07.2011 16:17:51 | Computer Name = POWERBOY | Source = Application Error | ID = 1000> in the current context!
Error: Unable to interpret <Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes> in the current context!
Error: Unable to interpret < Modul , Version 0.0.0.0, Fehleradresse 0x00000000.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ OSession Events ]> in the current context!
Error: Unable to interpret <Error - 08.07.2009 14:39:07 | Computer Name = POWERBOY | Source = Microsoft Office 12 Sessions | ID = 7001> in the current context!
Error: Unable to interpret <Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:> in the current context!
Error: Unable to interpret < 12.0.6504.5001, Microsoft Office Version: 12.0.6215.1000. This session lasted 12260> in the current context!
Error: Unable to interpret < seconds with 540 seconds of active time.  This session ended with a crash.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ System Events ]> in the current context!
Error: Unable to interpret <Error - 26.02.2012 14:56:40 | Computer Name = POWERBOY | Source = Windows Update Agent | ID = 16> in the current context!
Error: Unable to interpret <Description = Verbindung nicht möglich: Es konnte keine Verbindung mit dem Dienst> in the current context!
Error: Unable to interpret < "Automatische Updates" hergestellt werden, daher können Updates nicht nach dem > in the current context!
Error: Unable to interpret <angegebenen Zeitplan heruntergeladen und installiert werden. Es wird weiterhin versucht,> in the current context!
Error: Unable to interpret < eine Verbindung herzustellen.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:38:11 | Computer Name = POWERBOY | Source = DCOM | ID = 10010> in the current context!
Error: Unable to interpret <Description = Der Server "{8BC3F05E-D86B-11D0-A075-00C04FB68820}" konnte innerhalb> in the current context!
Error: Unable to interpret < des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:44:43 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"> in the current context!
Error: Unable to interpret < mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {1BE1F766-5536-11D1-B726-00C04FB926AF}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:45:19 | Computer Name = POWERBOY | Source = Service Control Manager | ID = 7001> in the current context!
Error: Unable to interpret <Description = Der Dienst "Simple Mail Transfer Protocol (SMTP)" ist vom Dienst "IIS> in the current context!
Error: Unable to interpret < Admin" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:45:19 | Computer Name = POWERBOY | Source = Service Control Manager | ID = 7001> in the current context!
Error: Unable to interpret <Description = Der Dienst "WWW-Publishing" ist vom Dienst "IIS Admin" abhängig, der> in the current context!
Error: Unable to interpret < aufgrund folgenden Fehlers nicht gestartet wurde:  %%1068> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:45:19 | Computer Name = POWERBOY | Source = Service Control Manager | ID = 7026> in the current context!
Error: Unable to interpret <Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:> in the current context!
Error: Unable to interpret <  avgio  avipbb  Fips  intelppm  ssmdrv> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:52:48 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"> in the current context!
Error: Unable to interpret < mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:53:04 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"> in the current context!
Error: Unable to interpret < mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 08:09:06 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"> in the current context!
Error: Unable to interpret < mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 08:09:12 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"> in the current context!
Error: Unable to interpret < mit den Argumenten ""  gestartet wurde, um den folgenden Server zu verwenden:  {A1F4E726-8CF1-11D1-BF92-0060081ED811}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret << End of report >
--- --- ---
> in the current context!
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{FA7C4B0A-4FC4-11DC-8D75-806D6172696F} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA7C4B0A-4FC4-11DC-8D75-806D6172696F}\ not found.
C:\Dokumente und Einstellungen\Helmi\Anwendungsdaten\Microsoft\torrent.exe moved successfully.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 41 bytes

User: Helmi
->Flash cache emptied: 487 bytes

User: Kathi
->Flash cache emptied: 7755 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32768 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 32902 bytes
->Flash cache emptied: 0 bytes

User: Helmi
->Temp folder emptied: 15705548 bytes
->Temporary Internet Files folder emptied: 5349408 bytes
->Java cache emptied: 66891100 bytes
->FireFox cache emptied: 44571657 bytes
->Apple Safari cache emptied: 2072576 bytes
->Flash cache emptied: 0 bytes

User: Kathi
->Temp folder emptied: 151293147 bytes
->Temporary Internet Files folder emptied: 592124193 bytes
->Java cache emptied: 35554730 bytes
->FireFox cache emptied: 72355215 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 66432 bytes

User: NetworkService
->Temp folder emptied: 66264 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 19569 bytes
%systemroot%\System32 .tmp files removed: 10801159 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 479703 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 951,00 mb


OTL by OldTimer - Version 3.2.33.2 log created on 02282012_185012

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

Sportie 28.02.2012 19:17
Das Hochladen sollte soweit geklappt haben!
War mir bei der Angabe "Link zum Thema im Forum" nicht sicher!
Habe die Adresse von oben kopiert! Passt das so?

Vielen Dank für dein Verständnis und deine Hilfe!

markusg 28.02.2012 19:54
das ist nicht das script was in dem letzten post steht, noch mal bitte.

Sportie 28.02.2012 21:59
All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{FA7C4B0A-4FC4-11DC-8D75-806D6172696F} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA7C4B0A-4FC4-11DC-8D75-806D6172696F}\ not found.
File C:\Dokumente und Einstellungen\Helmi\Anwendungsdaten\Microsoft\torrent.exe not found.
========== COMMANDS ==========

[EMPTYFLASH]

User: Administrator

User: All Users

User: Default User
->Flash cache emptied: 0 bytes

User: Helmi
->Flash cache emptied: 470 bytes

User: Kathi
->Flash cache emptied: 0 bytes

User: LocalService

User: NetworkService

Total Flash Files Cleaned = 0,00 mb


[EMPTYTEMP]

User: Administrator
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Helmi
->Temp folder emptied: 1378 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 38268112 bytes
->Apple Safari cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: Kathi
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 0 bytes
->Flash cache emptied: 0 bytes

User: LocalService
->Temp folder emptied: 66016 bytes
->Temporary Internet Files folder emptied: 33170 bytes

User: NetworkService
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 16895 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 37,00 mb


OTL by OldTimer - Version 3.2.33.2 log created on 02282012_211023

Files\Folders moved on Reboot...
File\Folder C:\WINDOWS\temp\Perflib_Perfdata_8f8.dat not found!

Registry entries deleted on Reboot...

Sportie 29.02.2012 11:43
Hallo, ich hoffe ich habe jetzt das richtige script eingetragen!
Falls nicht, bräuchte ich nochmals deine Hilfe!

markusg 29.02.2012 12:38
passt :-)
Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!
Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich
ziehen und eine Bereinigung der Infektion noch erschweren.

Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
  • Besuche folgende Seite für Downloadlinks und Anweisungen für dieses
    Tool

    Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Hinweis:
    Gehe sicher das all deine Anti Virus und Anti Malware Programme abgeschalten sind, damit diese Combofix nicht bei der Arbeit stören.
  • Poste bitte die C:\Combofix.txt in deiner nächsten Antwort.

Sportie 29.02.2012 13:11
Gibt es eine bestimmte Quelle die ich nutzen sollte für den Download von Combofix.exe, oder suche ich einfach irgend eine Freeware-Seite im Internet?

Sportie 29.02.2012 13:20
Jetzt bin ich auf der richtigen Seite gelandet! Sorry!

markusg 29.02.2012 13:21
hi, die seiten die im tutorial stehen

Sportie 29.02.2012 13:53
Combofix Logfile:
Code:
ComboFix 12-02-29.01 - Helmi 29.02.2012  13:40:23.1.2 - x86
Microsoft Windows XP Professional  5.1.2600.3.1252.49.1031.18.2038.1292 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Helmi\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Helmi\4.0
c:\dokumente und einstellungen\Helmi\Anwendungsdaten\.#
c:\dokumente und einstellungen\Helmi\Anwendungsdaten\ACD Systems\ACDSee\ImageDB.ddf
C:\Install.exe
c:\windows\IsUn0407.exe
c:\windows\system32\Cache
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-01-28 bis 2012-02-29  ))))))))))))))))))))))))))))))
.
.
2012-02-28 17:50 . 2012-02-28 21:02        --------        d-----w-        C:\_OTL
2012-02-28 10:55 . 2012-02-28 10:55        --------        d-----w-        c:\programme\7-Zip
2012-02-22 20:18 . 2012-02-22 20:18        --------        d-----r-        c:\dokumente und einstellungen\LocalService\Favoriten
2012-02-16 19:58 . 2012-01-11 19:06        3072        ------w-        c:\windows\system32\iacenc.dll
2012-02-16 19:58 . 2012-01-11 19:06        3072        ------w-        c:\windows\system32\dllcache\iacenc.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-12 17:20 . 2006-01-27 01:00        1860096        ----a-w-        c:\windows\system32\win32k.sys
2012-01-02 17:45 . 2011-06-16 10:31        414368        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-21 18:45 . 2011-10-04 15:38        121816        ----a-w-        c:\programme\mozilla firefox\components\browsercomps.dll
2004-08-04 12:00        94800        --sh--w-        c:\windows\twain.dll
2008-04-14 02:22        50688        --sh--w-        c:\windows\twain_32.dll
2011-02-08 13:33        978944        --sha-w-        c:\windows\system32\mfc42.dll
2008-04-14 02:22        57344        --sh--w-        c:\windows\system32\msvcirt.dll
2008-04-14 02:22        413696        --sha-w-        c:\windows\system32\msvcp60.dll
2008-04-14 02:22        343040        --sha-w-        c:\windows\system32\msvcrt.dll
2010-12-20 17:32        551936        --sh--w-        c:\windows\system32\oleaut32.dll
2008-04-14 02:22        84992        --sh--w-        c:\windows\system32\olepro32.dll
2008-04-14 02:22        12288        --sha-w-        c:\windows\system32\regsvr32.exe
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAShCut.exe" [2005-01-07 61952]
"Mouse Suite 98 Daemon"="ICO.EXE" [2007-04-26 49152]
"SoundMAXPnP"="c:\programme\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-10-06 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-10-06 114688]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-10-06 94208]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-10-29 249064]
"cssauth"="c:\programme\Lenovo\Client Security Solution\cssauth.exe" [2006-05-12 2333440]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Gamma Loader.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^WinZip Quick Pick.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-05-29 17:41        149040        ----a-w-        c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2002-03-28 08:41        188416        ----a-w-        c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWUTOOLBOX]
2005-09-19 09:31        352256        ----a-w-        c:\programme\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDService.exe]
2006-03-13 14:38        41472        ----a-r-        c:\programme\Lenovo\SafeGuard PrivateDisk\pdservice.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-11-03 07:56        204288        ----a-w-        c:\programme\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\Dokumente und Einstellungen\\Kathi\\Eigene Dateien\\Multimessenger\\MESSENGR.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programme\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
R2 AAV UpdateService;AAV UpdateService;c:\programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [24.10.2008 16:35 128296]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\programme\Avira\AntiVir Desktop\avmailc.exe [09.04.2011 13:34 340136]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [15.05.2009 15:14 136360]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [09.04.2011 13:34 428200]
R2 PrivateDisk;PrivateDisk;c:\programme\Lenovo\SafeGuard PrivateDisk\privatediskm.sys [13.03.2006 15:05 58368]
R2 smi2;smi2;c:\programme\SMI2\smi2.sys [12.05.2006 17:10 3968]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [07.01.2010 17:19 135664]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [07.01.2010 17:19 135664]
S3 pelps2m;PS/2 Mouse Filter Driver;c:\windows\system32\drivers\pelps2m.sys [31.07.2007 03:42 18048]
S3 SE1008mdm;Sony Ericsson SE1008 Mobile Device Full USB Driver;c:\windows\system32\drivers\SE1008mdm.sys [15.05.2010 11:48 58536]
.
Inhalt des "geplante Tasks" Ordners
.
2012-02-23 c:\windows\Tasks\20110926_182700_Helmi6.job
- c:\programme\Nero\Nero 7\Nero BackItUp\BackItUp.exe [2007-05-24 15:37]
.
2012-02-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2012-02-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-07 16:19]
.
2012-02-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-07 16:19]
.
2012-02-29 c:\windows\Tasks\User_Feed_Synchronization-{32D825F6-723A-4824-9E1E-74B523A8F526}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 01:01]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\dokumente und einstellungen\Helmi\Anwendungsdaten\Mozilla\Firefox\Profiles\j4006pnc.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Notify-NavLogon - (no file)
AddRemove-Adobe Photoshop Elements 2.0 - c:\windows\ISUN0407.EXE
AddRemove-ArcSoft PhotoImpression - c:\windows\IsUn0407.exe
AddRemove-HP Fotodruckprogramm - c:\windows\IsUn0407.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-02-29 13:47
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\igfxdev.dll
.
- - - - - - - > 'lsass.exe'(720)
c:\programme\Avira\AntiVir Desktop\avsda.dll
.
Zeit der Fertigstellung: 2012-02-29  13:50:14
ComboFix-quarantined-files.txt  2012-02-29 12:50
.
Vor Suchlauf: 19 Verzeichnis(se), 67.343.536.128 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 67.752.726.528 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 445D5FDFC712E523F7DEFA9FD189D193
--- --- ---

markusg 29.02.2012 14:06
malwarebytes:
Downloade Dir bitte Malwarebytes
  • Installiere
    das Programm in den vorgegebenen Pfad.
    Vista und Win7 User mit Rechtsklick "als Administrator starten"
  • Starte Malwarebytes, klicke auf Aktualisierung --> Suche
    nach Aktualisierung
  • Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
  • Wenn der Scan beendet
    ist, klicke auf Ergebnisse anzeigen.
  • Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
  • Poste
    das Logfile, welches sich in Notepad öffnet, hier in den Thread.
  • Nachträglich kannst du den Bericht unter "Log Dateien" finden.

Sportie 29.02.2012 18:12
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.02.29.03

Windows XP Service Pack 3 x86 NTFS
Internet Explorer 8.0.6001.18372
Helmi :: POWERBOY [Administrator]

29.02.2012 14:24:55
mbam-log-2012-02-29 (14-24-55).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 352758
Laufzeit: 2 Stunde(n), 29 Minute(n), 2 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

markusg 29.02.2012 18:14
lade den CCleaner standard:
CCleaner Download - CCleaner 3.16.1666
falls der CCleaner
bereits instaliert, überspringen.
instalieren, öffnen, extras, liste der instalierten programme, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Sportie 29.02.2012 18:46
7-Zip 9.20 29.02.2012 notwendig
AAVUpdateManager Wolters Kluwer Deutschland GmbH 06.02.2012 32,1MB 18.00.0000 unbekannt
Adobe Flash Player 11 Plugin Adobe Systems Incorporated 29.02.2012 11.1.102.55 unbekannt
Adobe Flash Player ActiveX Adobe Systems Incorporated 29.02.2012 9.0.47.0 unbekannt
Adobe Reader 9.5.0 - Deutsch Adobe Systems Incorporated 29.01.2012 120,1MB 9.5.0 notwendig
Apple Application Support Apple Inc. 01.11.2011 62,9MB 2.1.5 unnötig

Apple Software Update Apple Inc. 01.11.2011 2,38MB 2.1.3.127 unnötig
Avira AntiVir Premium Avira GmbH 29.02.2012 10.2.0.735 notwendig
Canon Camera Access Library 29.02.2012 8.1.1.17 unnötig
Canon Camera Support Core Library 29.02.2012 7.3.1.6 unnötig
Canon Camera Window DC_DV 5 for ZoomBrowser EX 29.02.2012 5.4.5.17unnötig
Canon Camera Window DC_DV 6 for ZoomBrowser EX 29.02.2012 6.2.0.8 unnötig
Canon Camera Window MC 6 for ZoomBrowser EX 29.02.2012 6.1.0.7 unnötig
CANON iMAGE GATEWAY Task for ZoomBrowser EX 29.02.2012 1.2.0.5 unnötig
Canon Internet Library for ZoomBrowser EX 29.02.2012 1.4.2.6 unnötig
Canon RAW Image Task for ZoomBrowser EX 29.02.2012 2.4.0.7 unnötig
Canon RemoteCapture Task for ZoomBrowser EX 29.02.2012 1.5.0.5 unnötig
Canon Utilities Digital Photo Professional 2.2 29.02.2012 2.2.0.1 unnötig
Canon Utilities EOS Utility 29.02.2012 1.1.0.8 unnötig
Canon Utilities PhotoStitch 29.02.2012 3.1.18.42 unnötig
Canon Utilities ZoomBrowser EX 29.02.2012 5.7.0.74 unnötig
CCleaner Piriform 29.02.2012 3.16 notwendig
Client Security Solution Lenovo Group Limited 31.07.2007 125,8MB 7.00.0017.00 unbekannt
Compatibility Pack für 2007 Office System Microsoft Corporation 20.02.2012 238MB 12.0.6612.1000 notwendig
Diskeeper Lite Diskeeper Corporation 31.07.2007 11,6MB 9.0.541 notwendig
Ergänzung zu Productivity Center für ThinkCentre 29.02.2012 1.02b notwendig
Google Earth Google 24.11.2011 92,8MB 6.1.0.5001 unnötig
Help Center 29.02.2012 1.03 unbekannt
High Definition Audio - KB888111 Microsoft Corporation 20040219.000000 unbekannt
HP Officejet Pro K550 Serie HP 29.02.2012 notwendig 1.3
HP Precisionscan Pro 3.1 Hewlett-Packard 25.03.2011 68,5MB 3.1.3.0000 notwendig
InfoBibliothek Akademische Arbeitsgemeinschaft 29.02.2012 notwendig
InfoBibliothek 2 Akademische Arbeitsgemeinschaft Verlag Wolters Kluwer GmbH 06.02.2012 29,4MB 1.08.03.01 notwendig
InterActual Player 29.02.2012 unbekannt
InterVideo WinDVD InterVideo Inc. 29.02.2012 5.0-B11.308 unbekannt
J2SE Runtime Environment 5.0 Update 6 Sun Microsystems, Inc. 31.07.2007 152,3MB 1.5.0.60 unbekannt
Java(TM) 6 Update 2 Sun Microsystems, Inc. 21.08.2007 111,2MB 1.6.0.20unnötig
Java(TM) 6 Update 24 Sun Microsystems, Inc. 28.11.2008 90,5MB 6.0.240 unnötig
Java(TM) 6 Update 3 Sun Microsystems, Inc. 30.10.2007 111,3MB 1.6.0.30unnötig
Java(TM) 6 Update 5 Sun Microsystems, Inc. 25.05.2008 114,2MB 1.6.0.50unnötig
Java(TM) 6 Update 7 Sun Microsystems, Inc. 07.08.2008 114,3MB 1.6.0.70unnötig
Malwarebytes Anti-Malware Version 1.60.1.1000 Malwarebytes Corporation 29.02.2012 1.60.1.1000 notwendig
Microsoft .NET Framework 1.1 14.01.2012 unbekannt
Microsoft .NET Framework 2.0 Language Pack - DEU Microsoft Corporation 31.07.2007 unbekannt
Microsoft .NET Framework 2.0 Service Pack 2 Microsoft Corporation 16.02.2012 184,3MB 2.2.30729unbekannt
Microsoft .NET Framework 3.0 Service Pack 2 Microsoft Corporation 23.06.2010 209MB 3.2.30729unbekannt
Microsoft .NET Framework 3.5 SP1 Microsoft Corporation 14.01.2012unbekannt
Microsoft Compression Client Pack 1.0 for Windows XP Microsoft Corporation 21.08.2007unbekannt 1
Microsoft Office File Validation Add-In Microsoft Corporation 15.09.2011 11,2MB 14.0.5130.5003unbekannt
Microsoft Office Home and Student 2007 Microsoft Corporation 20.02.2012 12.0.6612.1000notwendig
Microsoft User-Mode Driver Framework Feature Pack 1.0 Microsoft Corporation 21.08.2007unbekannt
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 Microsoft Corporation 24.01.2012 0,11MB 8.0.50727.4053unbekannt
Microsoft Visual C++ 2005 Redistributable Microsoft Corporation 16.06.2011 5,28MB 8.0.61001unbekannt
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 Microsoft Corporation 31.07.2009 0,15MB 9.0.30729.4148unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 Microsoft Corporation 24.02.2011 6,04MB 9.0.21022unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 Microsoft Corporation 15.05.2009 10,9MB 9.0.30729unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 Microsoft Corporation 17.11.2010 10,2MB 9.0.30729.4148unbekannt
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 Microsoft Corporation 16.06.2011 10,2MB 9.0.30729.6161unbekannt
MobileMe Control Panel Apple Inc. 30.04.2010 6,60MB 3.0.1.1 unnötig
Mouse Suite unbekannt
Mozilla Firefox 9.0.1 (x86 de) Mozilla 29.02.2012 9.0.1 notwendig
MSXML 4.0 SP2 (KB927978) Microsoft Corporation 31.07.2007 2,59MB 4.20.9841.0 unbekannt
MSXML 4.0 SP2 (KB936181) Microsoft Corporation 21.08.2007 2,62MB 4.20.9848.0 unbekannt
MSXML 4.0 SP2 (KB954430) Microsoft Corporation 12.11.2008 2,67MB 4.20.9870.0 unbekannt
MSXML 4.0 SP2 (KB973688) Microsoft Corporation 25.11.2009 2,77MB 4.20.9876.0 unbekannt
MSXML 6.0 Parser (KB933579) Microsoft Corporation 21.08.2007 1,30MB 6.10.1200.0 unbekannt
Nero 6 Ultra Edition 29.02.2012 notwendig
Nero BackItUp 2 Essentials Nero AG 10.10.2008 121,3MB 7.02.8835notwendig
NeroVision Express 3 29.02.2012 notwendig
neroxml Nero AG 10.10.2008 1,24MB 1.0.0notwendig
OpenOffice.org Installer 1.0 Sun Microsystems 07.08.2008 2,39MB 1.0.9221notwendig
PDF Maker Pilot Demo version 1.23 29.02.2012 notwendig
QuickTime Apple Inc. 01.11.2011 73,3MB 7.71.80.42notwendig
RecordNow Audio Sonic Solutions 21.08.2007 17,2MB 2.0.4.2unbekannt
RecordNow Copy Sonic Solutions 21.08.2007 16,9MB 2.0.4.2unbekannt
RecordNow Data Sonic Solutions 21.08.2007 16,6MB 2.0.4.2unbekannt
Remove Multimedia Center 29.02.2012unbekannt
Rescue and Recovery Lenovo Group Limited 31.07.2007 119,2MB 3.10.0017.00unbekannt
Rescue and Recovery Critical Patch for Windows Update (KB917422) Lenovo Group Limited. 21.08.2007 0,38MB 1.00.0004unbekannt
Sonic DLA Sonic Solutions 31.07.2007 2,82MB 5.2.0unbekannt
Sonic Express Labeler Sonic Solutions 21.08.2007 13,5MB 2.1.0.2unbekannt
Sonic Icons for Lenovo Lenovo 31.07.2007 0,20MB 1.0.2unbekannt
Sonic Update Manager Sonic Solutions 31.07.2007 2,39MB 3.0.0unbekannt
Sony Ericsson S312 driver v3.5.3.0 29.02.2012unnötig
SoundMAX Analog Devices 31.07.2007 5.10.01.6100unbekannt
Steuer-Spar-Erklärung 2007 29.02.2012 12.04notwendig
Steuer-Spar-Erklärung 2008 Akademische Arbeitsgemeinschaft 18.05.2008 159,0MB 13.02.0000 notwendig
Steuer-Spar-Erklärung 2009 Akademische Arbeitsgemeinschaft Verlag 12.04.2009 269MB 14.01.0000 notwendig
Steuer-Spar-Erklärung Lehrer 2010 Akademische Arbeitsgemeinschaft Verlag 11.11.2011 305MB 15.14 notwendig
Steuer-Spar-Erklärung Lehrer 2011 Akademische Arbeitsgemeinschaft Verlag 01.05.2011 371MB 16.10 notwendig
Steuer-Spar-Erklärung Lehrer 2012 Wolters Kluwer Deutschland GmbH 06.02.2012 332MB 17.05 notwendig
System Migration Assistant Lenovo Group Limited. 21.08.2007 28,6MB 5.20.0037notwendig
ThinkVantage System Update Lenovo 21.08.2007 10,9MB 3.01.0010 notwendig
VLC media player 1.0.2 VideoLAN Team 29.02.2012 1.0.2notwendig
WCreator3 InterVideo Inc. 29.02.2012 3.0.01.196unbekannt
WEB.DE MultiMessenger WEB.DE GmbH 29.02.2012 3.60.2563 unnötig
Windows Genuine Advantage Validation Tool (KB892130) Microsoft Corporation 16.06.2008 unbekannt
Windows Internet Explorer 8 Release Candidate 1 Microsoft Corporation 01.02.2009 20090115.021447 unnötig
Windows Media Format 11 runtime 29.02.2012 unnötig
Windows Media Player 11 29.02.2012 notwendig
Windows XP Service Pack 3 Microsoft Corporation 03.09.2008 20080414.031514 notwendig
WinZip WinZip Computing, Inc. 29.02.2012 8.1 SR-1 (5266g) notwendig

markusg 29.02.2012 18:56
deinstaliere:
Adobe Flash Player alle
Adobe - Adobe Flash Player installieren
neueste version laden
adobe reader:
Adobe - Adobe Reader herunterladen - Alle Versionen
haken bei mcafee security scan raus nehmen

bitte auch mal den adobe reader wie folgt konfigurieren:
adobe reader öffnen, bearbeiten, voreinstellungen.
allgemein:
nur zertifizierte zusatz module verwenden, anhaken.
internet:
hier sollte alles deaktiviert werden, es ist sehr unsicher pdfs automatisch zu öffnen, zu downloaden etc.
es ist immer besser diese direkt abzuspeichern da man nur so die kontrolle hat was auf dem pc vor geht.
bei javascript den haken bei java script verwenden raus nehmen
bei updater, automatisch instalieren wählen.
übernehmen /ok



deinstaliere:
Apple : alle
Canon : alle
Google
Help Center
InterActual
InterVideo
J2SE
Java: alle
Download der kostenlosen Java-Software
downloade java jre, instalieren

deinstaliere:
MobileMe
OpenOffice

öffne otl, bereinigen neustart.
öffne ccleaner analysieren bereinigen neustart.
testen ob alles wie gewohnt läuft

Sportie 29.02.2012 20:39
Hallo, bin gerade am Installieren der neuen Versionen und dabei kommt folgende Fehlermeldung: Quick Time ist nicht verfügbar - Die Initialisierung von QuickTime ist fehlgeschlagen. Fehler: 0. Bitte stellen Sie sicher, dass QuickTime korrekt installiert wurde.

Habe ich etwas zuviel gelöscht?
Wie kann ich diesen Fehler beheben?

Danke für die weitere Hilfestellung!

markusg 29.02.2012 20:44
instaliere es mal neu:
Apple - QuickTime - Download
geht das?

Sportie 02.03.2012 17:16
Hallo! Habe nun die Liste abgearbeitet! QuickTime ist wieder drauf! Brauche ich das Ding, oder kann ich es jetzt wieder löschen?
Die Einstellungen bei Adobe habe ich geändert!
Wie kann ich meine Kiste vor weiteren Angriffen schützen?
Wäre um weitere Tipps sehr dankbar!

Sportie


Alle Zeitangaben in WEZ +1. Es ist jetzt 12:34 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19