Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) (https://www.trojaner-board.de/136802-bka-sperrung-weisser-bildschirm-abgesicherten-modus-xp.html)

eine_jojo 18.06.2013 09:03
BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP)
 
Hallo,
ich habe mir so eine doooofe BKA-Sperrung (Trojaner) eingefangen.
Der PC fährt hoch, für ein paar Sekunden ist mein Desktop ganz normal, dann wird der Bildschirm weiß, nur der Mauszeiger ist zu sehen. Der Task-Manager läßt sich nicht mehr öffnen. Das geht nur ganz kurz vor dem weißen Bildschirm. Reicht aber zeitlich nicht um Prozesse zu killen.
Im abgesicherten Modus blinkt ein kleiner weißer Strich aber eine Eingabe ist nicht möglich. Dann öffnet sich XP im abgesicherten Modus. Aber auch hier kommt der weiße Bildschirm.
Ich habe an dem Rechner keine Adminrechte und bin nun mit einem Notebook ohne Brenner (CD-Laufwerk defekt) im Netz.

Was kann ich tun ???

schrauber 18.06.2013 09:29
Hi,

alle 3 SafeMode Varianten versucht? LAN Kabel aus dem Rechner ziehen und dann booten?
Im SAfe Mode sollte neben deinem Benutzerkonto auch das standardmäßig installierte Adminkonto angezeigt werden, Login dort bringt Abhilfe?

eine_jojo 18.06.2013 10:10
Ok... in Variante 3 (abges. Modus mit Eingabeaufforderung) läßt sich der Taskmanager öffnen und bleibt. Folgende Prozesse werden angezeigt:
cmd.exe
csrss.exe
Leerlaufprozess
lsass.exe
services.exe
smss.exe
svchost.exe
svchost.exe
svchost.exe
System
taskmgr.exe
winlogon.ex
wmiprvse.exe <- nicht immer sichtbar

Was ist weiter zu tun?

******************************
Habe hier was beim googlen gefunden:

Datei: smss.exe

Dies ist das Subsystem des Sitzungs-Managers, das für das Starten einer Benutzer-Sitzung zuständig ist. Dieser Prozess wird vom Thread des Hauptsystems initialisiert und ist für verschiedene Aktivitäten zuständig, einschließlich des Starts der Prozesse "Winlogon" und "Win32" (Csrss.exe) und des Einstellens der Systemvariablen. Nachdem er diese Prozesse gestartet hat, wartet er darauf, dass entweder Winlogon oder Csrss beendet wird. Wenn dies auf normale Weise geschieht, wird das System heruntergefahren; Wenn dies auf unerwartete Weise geschieht, verursacht "smss.exe", dass das System nicht mehr reagiert (hängt). smss.exe Windows Prozess - Was ist das?

Wichtig: Die Datei "smss.exe" befindet sich im Ordner C:\Windows\System32. Wenn das nicht der Fall ist, handelt es sich bei smss.exe um einen Virus, Spyware, Trojaner oder Worm!

und

Charakteristik: ssonsvr.exe befindet sich in einem Unterordner von "C:\Program Files" oder manchmal in einem Unterordner von C:\ - z.B. C:\Program Files\Citrix\ICA Client\. Bekannte Dateigrößen unter Windows 7/XP sind 16656 Bytes (65% aller Vorkommen), 37136 Bytes und 10 weitere Varianten. hxxp://www.file.net/prozess/ssonsvr.exe.html
Das Programm hat kein sichtbares Fenster. Die Datei ist keine Windows System Datei. Sie enthält keine Auskunft über die Entwickler. Deshalb bewerten wir diese Datei zu 49% als gefährlich, aber vergleichen Sie diese Wertung mit den Mitglieder Meinungen.
Sie können Folgendes tun:

beim Hersteller Citrix um Unterstützung bitten
das Programm von Ihrem PC löschen (Systemsteuerung ⇒ Software ⇒ Citrix ICA Client oder MetaFrame Presentation Server)

Hinweis: Viren und andere schädliche Dateien können sich als ssonsvr.exe tarnen. Insbesondere, wenn sich die Datei in C:\Windows oder C:\Windows\System32 Ordner befindet. Bitte kontrollieren Sie deshalb, ob es sich bei dem Prozess ssonsvr.exe auf Ihrem PC um einen Schädling handelt.

************************************************
Wie kann ich das jetzt kontrollieren? Ich weiß nicht, wie ich in diesem Modus an den Windows Explorer komme.
Kann ich einfach diese beiden Prozesse beenden? Bringt das was im abgesicherten Modus?
Bin in der Sache halt was grün hinter den Ohren.

schrauber 18.06.2013 12:29
Tasmanager > neuer Task > Explorer.exe

geht das? Desktop da?

eine_jojo 18.06.2013 12:36
Ja... Desktop ist da.

Ich lasse jetzt den OTL Scan laufen...

OTL Scan:OTL Logfile:OTL Logfile:
Code:
OTL logfile created on: 18.06.2013 13:50:03 - Run 1
OTL by OldTimer - Version 3.2.69.0    Folder = F:\
Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation
Internet Explorer (Version = 8.0.6001.18702)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
3,45 Gb Total Physical Memory | 3,20 Gb Available Physical Memory | 92,73% Memory free
5,30 Gb Paging File | 5,22 Gb Available in Paging File | 98,66% Paging File free
Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme
Drive C: | 68,36 Gb Total Space | 54,57 Gb Free Space | 79,83% Space Free | Partition Type: NTFS
Drive D: | 229,72 Gb Total Space | 227,94 Gb Free Space | 99,23% Space Free | Partition Type: NTFS
Drive F: | 119,29 Mb Total Space | 67,40 Mb Free Space | 56,50% Space Free | Partition Type: FAT32
 
Computer Name: F9999-0TA156389 | User Name: Xy | NOT logged in as Administrator.
Boot Mode: SafeMode | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2013.06.18 09:33:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- F:\OTL.exe
PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe
PRC - [2008.04.14 07:52:40 | 000,401,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2008.05.02 06:15:38 | 000,010,240 | ---- | M] () -- C:\Programme\Unlocker\UnlockerCOM.dll
MOD - [2005.10.19 12:56:28 | 000,125,952 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll
 
 
========== Services (SafeList) ==========
 
SRV - File not found [Disabled | Unknown] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)
SRV - [2013.02.25 12:02:54 | 000,232,472 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)
SRV - [2013.02.25 11:22:54 | 001,543,704 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)
SRV - [2011.11.03 20:25:08 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Unknown] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)
SRV - [2011.11.03 16:05:39 | 000,550,640 | ---- | M] (Sophos Plc) [On_Demand | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\sdcservice.exe -- (Sophos Device Control Service)
SRV - [2011.11.03 16:02:08 | 000,806,912 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Remote Management System\RouterNT.exe -- (Sophos Message Router)
SRV - [2011.11.03 16:01:26 | 000,282,624 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Remote Management System\ManagementAgentNT.exe -- (Sophos Agent)
SRV - [2011.05.23 16:47:50 | 000,112,800 | ---- | M] (Intel Corporation) [Auto | Unknown] -- C:\WINDOWS\system32\IPROSetMonitor.exe -- (Intel(R)
SRV - [2011.02.04 15:05:06 | 000,097,520 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)
SRV - [2011.02.04 15:04:14 | 000,163,056 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)
SRV - [2010.04.16 12:45:14 | 001,111,120 | ---- | M] (NCP Engineering GmbH) [Auto | Unknown] -- C:\Programme\NCP\SecureClient\NCPRWSNT.EXE -- (ncprwsnt)
SRV - [2010.02.03 14:45:40 | 000,819,712 | ---- | M] () [Auto | Unknown] -- C:\Programme\NCP\SecureClient\rwsrsu.exe -- (rwsrsu)
SRV - [2009.11.19 12:57:34 | 000,091,648 | ---- | M] () [Auto | Unknown] -- C:\Programme\NCP\SecureClient\NCPSEC.EXE -- (NcpSec)
SRV - [2008.06.30 14:22:40 | 000,086,016 | ---- | M] (NCP engineering GmbH) [Auto | Unknown] -- C:\Programme\NCP\SecureClient\ncpclcfg.exe -- (ncpclcfg)
SRV - [2008.04.14 14:23:30 | 000,118,784 | ---- | M] (Gemplus) [Auto | Unknown] -- C:\Programme\Gemalto\Classic Client\BIN\GCardSrvNT.exe -- (GemSAFE Card Server)
SRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl)
SRV - [2007.10.19 16:09:52 | 000,057,344 | ---- | M] (Gemalto) [Auto | Unknown] -- C:\Programme\Gemalto\Classic Client\BIN\GslShmSrvc.exe -- (GslShmSrvc )
SRV - [2005.04.27 15:59:24 | 000,241,725 | ---- | M] (Microsoft Corporation) [Auto | Unknown] -- C:\Programme\UPHClean\uphclean.exe -- (UPHClean)
SRV - [2005.03.22 20:14:10 | 000,110,592 | ---- | M] () [Auto | Unknown] -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (WDICA)
DRV - File not found [Adapter | Unavailable | Unknown] --  -- (PnSson)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (PDRFRAME)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (PDRELI)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (PDFRAME)
DRV - File not found [Kernel | On_Demand | Unknown] --  -- (PDCOMP)
DRV - File not found [Kernel | System | Unknown] --  -- (PCIDump)
DRV - File not found [Kernel | System | Unknown] --  -- (lbrtfdc)
DRV - File not found [Kernel | System | Unknown] --  -- (i2omgmt)
DRV - File not found [Kernel | System | Unknown] --  -- (Changer)
DRV - [2011.06.28 03:12:42 | 000,030,368 | ---- | M] (Intel Corporation ) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\iqvw32.sys -- (NAL)
DRV - [2011.05.04 17:16:06 | 000,192,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\e1k5132.sys -- (e1kexpress)
DRV - [2011.02.21 12:41:34 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\gdrv.sys -- (gdrv)
DRV - [2011.02.04 15:06:01 | 000,024,064 | ---- | M] (Sophos Plc) [File_System | System | Unknown] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)
DRV - [2011.02.04 15:05:08 | 000,153,344 | ---- | M] (Sophos Plc) [File_System | System | Unknown] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)
DRV - [2010.09.13 09:06:26 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Unknown] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)
DRV - [2010.09.13 09:05:59 | 000,023,928 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\sdcfilter.sys -- (sdcfilter)
DRV - [2010.07.14 13:51:56 | 000,065,584 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Unknown] -- C:\WINDOWS\system32\drivers\ctxusbm.sys -- (ctxusbm)
DRV - [2010.01.18 23:50:10 | 000,235,520 | R--- | M] (Intel(R) Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\IntcDAud.sys -- (IntcDAud)
DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (ncpvaxp)
DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFiltMP)
DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFilt)
DRV - [2009.10.21 05:22:32 | 001,425,280 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)
DRV - [2009.09.17 22:54:14 | 000,041,088 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI)
DRV - [2009.06.25 08:07:44 | 005,095,936 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)
DRV - [2009.06.25 08:07:40 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)
DRV - [2009.06.25 08:07:40 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)
DRV - [2008.06.21 06:44:12 | 000,013,824 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\tpm.sys -- (tpm)
DRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl)
DRV - [2005.01.13 16:20:36 | 000,012,500 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)
DRV - [2004.12.14 02:00:00 | 000,578,432 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\fus2base.sys -- (FUS2BASE)
DRV - [2004.12.14 02:00:00 | 000,053,120 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\avmcowan.sys -- (AVMCOWAN)
DRV - [2004.11.13 20:32:12 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Unknown] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (Aspi32)
DRV - [2004.11.05 12:39:08 | 000,082,148 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)
DRV - [2004.10.19 14:40:56 | 000,028,207 | ---- | M] (IVT Corporation) [Kernel | Boot | Unknown] -- C:\WINDOWS\system32\drivers\BTHidMgr.sys -- (BTHidMgr)
DRV - [2004.10.19 14:37:38 | 000,061,312 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)
DRV - [2004.10.19 12:39:26 | 000,020,096 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)
DRV - [2004.09.21 19:15:34 | 000,010,804 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT)
DRV - [2004.08.13 12:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.forestle.org/
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 10.82.*.*;192.168.*.*
 
 
========== FireFox ==========
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)
FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)
 
 
 
O1 HOSTS File: ([2006.02.28 05:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1      localhost
O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)
O4 - HKLM..\Run: [ConnectionCenter] C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)
O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)
O4 - HKLM..\Run: [NcpBudgetGui] C:\Programme\NCP\SecureClient\NcpBudgetGui.exe ()
O4 - HKLM..\Run: [NcpPopup] C:\Programme\NCP\SecureClient\ncppopup.exe ()
O4 - HKLM..\Run: [NcpRsuGui] C:\Programme\NCP\SecureClient\rwsrsu.exe ()
O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)
O4 - Startup: C:\Dokumente und Einstellungen\Xy\Startmenü\Programme\Autostart\Temporäre Daten löschen.lnk = C:\Treiber_Software\Scripte\DelTemp.cmd ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1
O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)
O15 - HKCU\..Trusted Domains: wald-rlp.de ([webaccess] https in Vertrauenswürdige Sites)
O15 - HKCU\..Trusted Domains: zebit.de ([wi] http in Vertrauenswürdige Sites)
O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)
O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284027598921 (WUWebControl Class)
O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1302600522627 (MUWebControl Class)
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A2BCF253-89AB-469E-B7B3-D8E63E22EA5B}: DhcpNameServer = 192.168.1.116 192.168.1.117 10.82.6.200 10.82.6.201
O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)
O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)
O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
O18 - Protocol\Filter\text/xml - No CLSID value found
O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)
O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: GinaDLL - (ncpgina1.dll) - C:\WINDOWS\System32\ncpgina1.dll (NCP)
O20 - HKCU Winlogon: Shell - (C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx) - C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx ()
O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)
O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home
O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Xy\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Xy\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp
O31 - SafeBoot: UseAlternatShell - 1
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2010.08.11 14:18:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]
O32 - AutoRun File - [2013.04.23 09:14:02 | 000,000,000 | ---D | M] - D:\Autogenes Training_2010-2011 -- [ NTFS ]
O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell - "" = AutoRun
O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell\AutoRun - "" = Auto&Play
O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a
O34 - HKLM BootExecute: (autocheck autochk *)
O34 - HKLM BootExecute: (pgdfgsvc C 1)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.06.18 13:47:01 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Xy\Recent
[2013.06.18 07:18:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbwg
[2013.06.18 07:18:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Xy\Lokale Einstellungen\Anwendungsdaten\Sophos
[2013.06.18 07:16:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun
[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013.06.18 13:25:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat
[2013.06.18 13:24:24 | 000,013,507 | ---- | M] () -- C:\WINDOWS\slssyi.kqf
[2013.06.18 13:24:22 | 000,052,228 | ---- | M] () -- C:\WINDOWS\iylajp.baq
[2013.06.18 13:06:46 | 000,458,732 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat
[2013.06.18 13:06:46 | 000,440,820 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat
[2013.06.18 13:06:46 | 000,084,698 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat
[2013.06.18 13:06:46 | 000,071,138 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat
[2013.06.18 07:21:13 | 000,066,839 | ---- | M] () -- C:\WINDOWS\pxbjvf.jdk
[2013.06.18 07:20:02 | 000,062,129 | ---- | M] () -- C:\WINDOWS\derx.ovb
[2013.06.18 07:19:35 | 000,281,920 | ---- | M] () -- C:\WINDOWS\egxd.nyh
[2013.06.18 07:18:28 | 000,290,470 | ---- | M] () -- C:\WINDOWS\mca.ech
[2013.06.17 07:55:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl
[2013.06.12 07:00:09 | 000,000,244 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Citrix XenApp6 - intern.url
[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013.06.18 07:19:45 | 000,062,129 | ---- | C] () -- C:\WINDOWS\derx.ovb
[2013.06.18 07:19:45 | 000,013,507 | ---- | C] () -- C:\WINDOWS\slssyi.kqf
[2013.06.18 07:19:35 | 000,281,920 | ---- | C] () -- C:\WINDOWS\egxd.nyh
[2013.06.18 07:18:28 | 000,290,470 | ---- | C] () -- C:\WINDOWS\mca.ech
[2013.06.18 07:18:28 | 000,052,228 | ---- | C] () -- C:\WINDOWS\iylajp.baq
[2013.06.18 07:17:34 | 000,066,839 | ---- | C] () -- C:\WINDOWS\pxbjvf.jdk
[2013.03.05 08:51:06 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini
[2012.11.28 15:17:42 | 000,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys
[2012.11.28 15:17:39 | 000,012,500 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys
[2012.07.13 15:27:32 | 000,190,464 | ---- | C] () -- C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx
[2011.11.03 16:01:48 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll
[2011.11.03 16:01:48 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe
 
========== ZeroAccess Check ==========
 
[2010.08.11 14:19:17 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 07:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both

< End of report >
--- --- ---


Wenn ich hier richtig gestöbert habe, sollte ich den Inhalt vom OTL.Txt Editor unter 'Benutzerdefinierte Scans/Fixes' einfügen und 'Fix' aktivieren...

schrauber 18.06.2013 13:29

Fixen mit OTL

  • Starte bitte die OTL.exe.
  • Kopiere nun den Inhalt aus der Codebox in die Textbox.
Code:
:OTL
O20 - HKCU Winlogon: Shell - (C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx) - C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx ()
[2013.06.18 07:18:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbwg
[2013.06.18 13:24:24 | 000,013,507 | ---- | M] () -- C:\WINDOWS\slssyi.kqf
[2013.06.18 13:24:22 | 000,052,228 | ---- | M] () -- C:\WINDOWS\iylajp.baq
[2013.06.18 07:21:13 | 000,066,839 | ---- | M] () -- C:\WINDOWS\pxbjvf.jdk
[2013.06.18 07:20:02 | 000,062,129 | ---- | M] () -- C:\WINDOWS\derx.ovb
[2013.06.18 07:19:35 | 000,281,920 | ---- | M] () -- C:\WINDOWS\egxd.nyh
[2013.06.18 07:18:28 | 000,290,470 | ---- | M] () -- C:\WINDOWS\mca.ech
:Commands
[emptytemp]
  • Solltest du deinen Benutzernamen z. B. durch "*****" unkenntlich gemacht haben, so füge an entsprechender Stelle deinen richtigen Benutzernamen ein. Andernfalls wird der Fix nicht funktionieren.
  • Schließe bitte nun alle Programme.
  • Klicke nun bitte auf den Fix Button.
  • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen.
  • Nach dem Neustart findest Du ein Textdokument auf deinem Desktop.
    ( Auch zu finden unter C:\_OTL\MovedFiles\<Uhrzeit_Datum>.txt)
    Kopiere nun den Inhalt hier in Deinen Thread

eine_jojo 18.06.2013 13:55
Es hat leider nicht funktioniert. Nach dem Neustart kam weiterhin der weiße Bildschirm. Im Virenscanner konnte ich gerade noch so lesen, daß ein Buffer Overflow (C:\windows\system32\svchost.exe) entdeckt wurde.

Hier der Logfile nach dem Fix:

Error: Unable to interpret <OTL Logfile:
Code:
OTL logfile created on: 18.06.2013 13:50:03 - Run 1> in the current context!
Error: Unable to interpret <OTL by OldTimer - Version 3.2.69.0    Folder = F:\> in the current context!
Error: Unable to interpret <Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation> in the current context!
Error: Unable to interpret <Internet Explorer (Version = 8.0.6001.18702)> in the current context!
Error: Unable to interpret <Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <3,45 Gb Total Physical Memory | 3,20 Gb Available Physical Memory | 92,73% Memory free> in the current context!
Error: Unable to interpret <5,30 Gb Paging File | 5,22 Gb Available in Paging File | 98,66% Paging File free> in the current context!
Error: Unable to interpret <Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme> in the current context!
Error: Unable to interpret <Drive C: | 68,36 Gb Total Space | 54,57 Gb Free Space | 79,83% Space Free | Partition Type: NTFS> in the current context!
Error: Unable to interpret <Drive D: | 229,72 Gb Total Space | 227,94 Gb Free Space | 99,23% Space Free | Partition Type: NTFS> in the current context!
Error: Unable to interpret <Drive F: | 119,29 Mb Total Space | 67,40 Mb Free Space | 56,50% Space Free | Partition Type: FAT32> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Computer Name: F9999-0TA156389 | User Name: **** | NOT logged in as Administrator.> in the current context!
Error: Unable to interpret <Boot Mode: SafeMode | Scan Mode: Current user> in the current context!
Error: Unable to interpret <Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Processes (SafeList) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <PRC - [2013.06.18 09:33:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- F:\OTL.exe> in the current context!
Error: Unable to interpret <PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe> in the current context!
Error: Unable to interpret <PRC - [2008.04.14 07:52:40 | 000,401,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Modules (No Company Name) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <MOD - [2008.05.02 06:15:38 | 000,010,240 | ---- | M] () -- C:\Programme\Unlocker\UnlockerCOM.dll> in the current context!
Error: Unable to interpret <MOD - [2005.10.19 12:56:28 | 000,125,952 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Services (SafeList) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <SRV - File not found [Disabled | Unknown] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)> in the current context!
Error: Unable to interpret <SRV - [2013.02.25 12:02:54 | 000,232,472 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)> in the current context!
Error: Unable to interpret <SRV - [2013.02.25 11:22:54 | 001,543,704 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)> in the current context!
Error: Unable to interpret <SRV - [2011.11.03 20:25:08 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Unknown] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)> in the current context!
Error: Unable to interpret <SRV - [2011.11.03 16:05:39 | 000,550,640 | ---- | M] (Sophos Plc) [On_Demand | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\sdcservice.exe -- (Sophos Device Control Service)> in the current context!
Error: Unable to interpret <SRV - [2011.11.03 16:02:08 | 000,806,912 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Remote Management System\RouterNT.exe -- (Sophos Message Router)> in the current context!
Error: Unable to interpret <SRV - [2011.11.03 16:01:26 | 000,282,624 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Remote Management System\ManagementAgentNT.exe -- (Sophos Agent)> in the current context!
Error: Unable to interpret <SRV - [2011.05.23 16:47:50 | 000,112,800 | ---- | M] (Intel Corporation) [Auto | Unknown] -- C:\WINDOWS\system32\IPROSetMonitor.exe -- (Intel(R)> in the current context!
Error: Unable to interpret <SRV - [2011.02.04 15:05:06 | 000,097,520 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)> in the current context!
Error: Unable to interpret <SRV - [2011.02.04 15:04:14 | 000,163,056 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)> in the current context!
Error: Unable to interpret <SRV - [2010.04.16 12:45:14 | 001,111,120 | ---- | M] (NCP Engineering GmbH) [Auto | Unknown] -- C:\Programme\NCP\SecureClient\NCPRWSNT.EXE -- (ncprwsnt)> in the current context!
Error: Unable to interpret <SRV - [2010.02.03 14:45:40 | 000,819,712 | ---- | M] () [Auto | Unknown] -- C:\Programme\NCP\SecureClient\rwsrsu.exe -- (rwsrsu)> in the current context!
Error: Unable to interpret <SRV - [2009.11.19 12:57:34 | 000,091,648 | ---- | M] () [Auto | Unknown] -- C:\Programme\NCP\SecureClient\NCPSEC.EXE -- (NcpSec)> in the current context!
Error: Unable to interpret <SRV - [2008.06.30 14:22:40 | 000,086,016 | ---- | M] (NCP engineering GmbH) [Auto | Unknown] -- C:\Programme\NCP\SecureClient\ncpclcfg.exe -- (ncpclcfg)> in the current context!
Error: Unable to interpret <SRV - [2008.04.14 14:23:30 | 000,118,784 | ---- | M] (Gemplus) [Auto | Unknown] -- C:\Programme\Gemalto\Classic Client\BIN\GCardSrvNT.exe -- (GemSAFE Card Server)> in the current context!
Error: Unable to interpret <SRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl)> in the current context!
Error: Unable to interpret <SRV - [2007.10.19 16:09:52 | 000,057,344 | ---- | M] (Gemalto) [Auto | Unknown] -- C:\Programme\Gemalto\Classic Client\BIN\GslShmSrvc.exe -- (GslShmSrvc )> in the current context!
Error: Unable to interpret <SRV - [2005.04.27 15:59:24 | 000,241,725 | ---- | M] (Microsoft Corporation) [Auto | Unknown] -- C:\Programme\UPHClean\uphclean.exe -- (UPHClean)> in the current context!
Error: Unable to interpret <SRV - [2005.03.22 20:14:10 | 000,110,592 | ---- | M] () [Auto | Unknown] -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Driver Services (SafeList) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] --  -- (WDICA)> in the current context!
Error: Unable to interpret <DRV - File not found [Adapter | Unavailable | Unknown] --  -- (PnSson)> in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] --  -- (PDRFRAME)> in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] --  -- (PDRELI)> in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] --  -- (PDFRAME)> in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] --  -- (PDCOMP)> in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | System | Unknown] --  -- (PCIDump)> in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | System | Unknown] --  -- (lbrtfdc)> in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | System | Unknown] --  -- (i2omgmt)> in the current context!
Error: Unable to interpret <DRV - File not found [Kernel | System | Unknown] --  -- (Changer)> in the current context!
Error: Unable to interpret <DRV - [2011.06.28 03:12:42 | 000,030,368 | ---- | M] (Intel Corporation ) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\iqvw32.sys -- (NAL)> in the current context!
Error: Unable to interpret <DRV - [2011.05.04 17:16:06 | 000,192,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\e1k5132.sys -- (e1kexpress)> in the current context!
Error: Unable to interpret <DRV - [2011.02.21 12:41:34 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\gdrv.sys -- (gdrv)> in the current context!
Error: Unable to interpret <DRV - [2011.02.04 15:06:01 | 000,024,064 | ---- | M] (Sophos Plc) [File_System | System | Unknown] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)> in the current context!
Error: Unable to interpret <DRV - [2011.02.04 15:05:08 | 000,153,344 | ---- | M] (Sophos Plc) [File_System | System | Unknown] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)> in the current context!
Error: Unable to interpret <DRV - [2010.09.13 09:06:26 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Unknown] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)> in the current context!
Error: Unable to interpret <DRV - [2010.09.13 09:05:59 | 000,023,928 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\sdcfilter.sys -- (sdcfilter)> in the current context!
Error: Unable to interpret <DRV - [2010.07.14 13:51:56 | 000,065,584 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Unknown] -- C:\WINDOWS\system32\drivers\ctxusbm.sys -- (ctxusbm)> in the current context!
Error: Unable to interpret <DRV - [2010.01.18 23:50:10 | 000,235,520 | R--- | M] (Intel(R) Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\IntcDAud.sys -- (IntcDAud)> in the current context!
Error: Unable to interpret <DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (ncpvaxp)> in the current context!
Error: Unable to interpret <DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFiltMP)> in the current context!
Error: Unable to interpret <DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFilt)> in the current context!
Error: Unable to interpret <DRV - [2009.10.21 05:22:32 | 001,425,280 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)> in the current context!
Error: Unable to interpret <DRV - [2009.09.17 22:54:14 | 000,041,088 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI)> in the current context!
Error: Unable to interpret <DRV - [2009.06.25 08:07:44 | 005,095,936 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)> in the current context!
Error: Unable to interpret <DRV - [2009.06.25 08:07:40 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)> in the current context!
Error: Unable to interpret <DRV - [2009.06.25 08:07:40 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)> in the current context!
Error: Unable to interpret <DRV - [2008.06.21 06:44:12 | 000,013,824 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\tpm.sys -- (tpm)> in the current context!
Error: Unable to interpret <DRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl)> in the current context!
Error: Unable to interpret <DRV - [2005.01.13 16:20:36 | 000,012,500 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)> in the current context!
Error: Unable to interpret <DRV - [2004.12.14 02:00:00 | 000,578,432 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\fus2base.sys -- (FUS2BASE)> in the current context!
Error: Unable to interpret <DRV - [2004.12.14 02:00:00 | 000,053,120 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\avmcowan.sys -- (AVMCOWAN)> in the current context!
Error: Unable to interpret <DRV - [2004.11.13 20:32:12 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Unknown] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (Aspi32)> in the current context!
Error: Unable to interpret <DRV - [2004.11.05 12:39:08 | 000,082,148 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)> in the current context!
Error: Unable to interpret <DRV - [2004.10.19 14:40:56 | 000,028,207 | ---- | M] (IVT Corporation) [Kernel | Boot | Unknown] -- C:\WINDOWS\system32\drivers\BTHidMgr.sys -- (BTHidMgr)> in the current context!
Error: Unable to interpret <DRV - [2004.10.19 14:37:38 | 000,061,312 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)> in the current context!
Error: Unable to interpret <DRV - [2004.10.19 12:39:26 | 000,020,096 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)> in the current context!
Error: Unable to interpret <DRV - [2004.09.21 19:15:34 | 000,010,804 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT)> in the current context!
Error: Unable to interpret <DRV - [2004.08.13 12:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Standard Registry (SafeList) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Internet Explorer ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}> in the current context!
Error: Unable to interpret <IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.forestle.org/> in the current context!
Error: Unable to interpret <IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}> in the current context!
Error: Unable to interpret <IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC> in the current context!
Error: Unable to interpret <IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0> in the current context!
Error: Unable to interpret <IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 10.82.*.*;192.168.*.*> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== FireFox ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()> in the current context!
Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)> in the current context!
Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)> in the current context!
Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)> in the current context!
Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)> in the current context!
Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <O1 HOSTS File: ([2006.02.28 05:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts> in the current context!
Error: Unable to interpret <O1 - Hosts: 127.0.0.1      localhost> in the current context!
Error: Unable to interpret <O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)> in the current context!
Error: Unable to interpret <O4 - HKLM..\Run: [ConnectionCenter] C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)> in the current context!
Error: Unable to interpret <O4 - HKLM..\Run: [NcpBudgetGui] C:\Programme\NCP\SecureClient\NcpBudgetGui.exe ()> in the current context!
Error: Unable to interpret <O4 - HKLM..\Run: [NcpPopup] C:\Programme\NCP\SecureClient\ncppopup.exe ()> in the current context!
Error: Unable to interpret <O4 - HKLM..\Run: [NcpRsuGui] C:\Programme\NCP\SecureClient\rwsrsu.exe ()> in the current context!
Error: Unable to interpret <O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)> in the current context!
Error: Unable to interpret <O4 - Startup: C:\Dokumente und Einstellungen\****\Startmenü\Programme\Autostart\Temporäre Daten löschen.lnk = C:\Treiber_Software\Scripte\DelTemp.cmd ()> in the current context!
Error: Unable to interpret <O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1> in the current context!
Error: Unable to interpret <O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145> in the current context!
Error: Unable to interpret <O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)> in the current context!
Error: Unable to interpret <O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)> in the current context!
Error: Unable to interpret <O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)> in the current context!
Error: Unable to interpret <O15 - HKCU\..Trusted Domains: wald-rlp.de ([webaccess] https in Vertrauenswürdige Sites)> in the current context!
Error: Unable to interpret <O15 - HKCU\..Trusted Domains: zebit.de ([wi] http in Vertrauenswürdige Sites)> in the current context!
Error: Unable to interpret <O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)> in the current context!
Error: Unable to interpret <O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284027598921 (WUWebControl Class)> in the current context!
Error: Unable to interpret <O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1302600522627 (MUWebControl Class)> in the current context!
Error: Unable to interpret <O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)> in the current context!
Error: Unable to interpret <O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)> in the current context!
Error: Unable to interpret <O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)> in the current context!
Error: Unable to interpret <O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A2BCF253-89AB-469E-B7B3-D8E63E22EA5B}: DhcpNameServer = 192.168.1.116 192.168.1.117 10.82.6.200 10.82.6.201> in the current context!
Error: Unable to interpret <O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)> in the current context!
Error: Unable to interpret <O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)> in the current context!
Error: Unable to interpret <O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)> in the current context!
Error: Unable to interpret <O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context!
Error: Unable to interpret <O18 - Protocol\Filter\text/xml - No CLSID value found> in the current context!
Error: Unable to interpret <O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)> in the current context!
Error: Unable to interpret <O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <O20 - HKLM Winlogon: GinaDLL - (ncpgina1.dll) - C:\WINDOWS\System32\ncpgina1.dll (NCP)> in the current context!
Error: Unable to interpret <O20 - HKCU Winlogon: Shell - (C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx) - C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx ()> in the current context!
Error: Unable to interpret <O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home> in the current context!
Error: Unable to interpret <O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp> in the current context!
Error: Unable to interpret <O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp> in the current context!
Error: Unable to interpret <O31 - SafeBoot: UseAlternatShell - 1> in the current context!
Error: Unable to interpret <O32 - HKLM CDRom: AutoRun - 1> in the current context!
Error: Unable to interpret <O32 - AutoRun File - [2010.08.11 14:18:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]> in the current context!
Error: Unable to interpret <O32 - AutoRun File - [2013.04.23 09:14:02 | 000,000,000 | ---D | M] - D:\Autogenes Training_2010-2011 -- [ NTFS ]> in the current context!
Error: Unable to interpret <O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell - "" = AutoRun> in the current context!
Error: Unable to interpret <O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell\AutoRun - "" = Auto&Play> in the current context!
Error: Unable to interpret <O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a> in the current context!
Error: Unable to interpret <O34 - HKLM BootExecute: (autocheck autochk *)> in the current context!
Error: Unable to interpret <O34 - HKLM BootExecute: (pgdfgsvc C 1)> in the current context!
Error: Unable to interpret <O35 - HKLM\..comfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <O35 - HKLM\..exefile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <O37 - HKLM\...com [@ = comfile] -- "%1" %*> in the current context!
Error: Unable to interpret <O37 - HKLM\...exe [@ = exefile] -- "%1" %*> in the current context!
Error: Unable to interpret <O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)> in the current context!
Error: Unable to interpret <O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Files/Folders - Created Within 30 Days ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[2013.06.18 13:47:01 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\****\Recent> in the current context!
Error: Unable to interpret <[2013.06.18 07:18:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbwg> in the current context!
Error: Unable to interpret <[2013.06.18 07:18:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\Sophos> in the current context!
Error: Unable to interpret <[2013.06.18 07:16:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun> in the current context!
Error: Unable to interpret <[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Files - Modified Within 30 Days ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[2013.06.18 13:25:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat> in the current context!
Error: Unable to interpret <[2013.06.18 13:24:24 | 000,013,507 | ---- | M] () -- C:\WINDOWS\slssyi.kqf> in the current context!
Error: Unable to interpret <[2013.06.18 13:24:22 | 000,052,228 | ---- | M] () -- C:\WINDOWS\iylajp.baq> in the current context!
Error: Unable to interpret <[2013.06.18 13:06:46 | 000,458,732 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat> in the current context!
Error: Unable to interpret <[2013.06.18 13:06:46 | 000,440,820 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat> in the current context!
Error: Unable to interpret <[2013.06.18 13:06:46 | 000,084,698 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat> in the current context!
Error: Unable to interpret <[2013.06.18 13:06:46 | 000,071,138 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat> in the current context!
Error: Unable to interpret <[2013.06.18 07:21:13 | 000,066,839 | ---- | M] () -- C:\WINDOWS\pxbjvf.jdk> in the current context!
Error: Unable to interpret <[2013.06.18 07:20:02 | 000,062,129 | ---- | M] () -- C:\WINDOWS\derx.ovb> in the current context!
Error: Unable to interpret <[2013.06.18 07:19:35 | 000,281,920 | ---- | M] () -- C:\WINDOWS\egxd.nyh> in the current context!
Error: Unable to interpret <[2013.06.18 07:18:28 | 000,290,470 | ---- | M] () -- C:\WINDOWS\mca.ech> in the current context!
Error: Unable to interpret <[2013.06.17 07:55:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl> in the current context!
Error: Unable to interpret <[2013.06.12 07:00:09 | 000,000,244 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Citrix XenApp6 - intern.url> in the current context!
Error: Unable to interpret <[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Files Created - No Company Name ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[2013.06.18 07:19:45 | 000,062,129 | ---- | C] () -- C:\WINDOWS\derx.ovb> in the current context!
Error: Unable to interpret <[2013.06.18 07:19:45 | 000,013,507 | ---- | C] () -- C:\WINDOWS\slssyi.kqf> in the current context!
Error: Unable to interpret <[2013.06.18 07:19:35 | 000,281,920 | ---- | C] () -- C:\WINDOWS\egxd.nyh> in the current context!
Error: Unable to interpret <[2013.06.18 07:18:28 | 000,290,470 | ---- | C] () -- C:\WINDOWS\mca.ech> in the current context!
Error: Unable to interpret <[2013.06.18 07:18:28 | 000,052,228 | ---- | C] () -- C:\WINDOWS\iylajp.baq> in the current context!
Error: Unable to interpret <[2013.06.18 07:17:34 | 000,066,839 | ---- | C] () -- C:\WINDOWS\pxbjvf.jdk> in the current context!
Error: Unable to interpret <[2013.03.05 08:51:06 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini> in the current context!
Error: Unable to interpret <[2012.11.28 15:17:42 | 000,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys> in the current context!
Error: Unable to interpret <[2012.11.28 15:17:39 | 000,012,500 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys> in the current context!
Error: Unable to interpret <[2012.07.13 15:27:32 | 000,190,464 | ---- | C] () -- C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx> in the current context!
Error: Unable to interpret <[2011.11.03 16:01:48 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll> in the current context!
Error: Unable to interpret <[2011.11.03 16:01:48 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== ZeroAccess Check ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[2010.08.11 14:19:17 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]> in the current context!
Error: Unable to interpret <"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 07:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)> in the current context!
Error: Unable to interpret <"ThreadingModel" = Apartment> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]> in the current context!
Error: Unable to interpret <"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)> in the current context!
Error: Unable to interpret <"ThreadingModel" = Free> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]> in the current context!
Error: Unable to interpret <"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)> in the current context!
Error: Unable to interpret <"ThreadingModel" = Both> in the current context!
Error: Unable to interpret << End of report >
--- --- ---
> in the current context!

OTL by OldTimer - Version 3.2.69.0 log created on 06182013_143002


*****
Ich habe im abgesicherten Modus nachgeschaut. Die svchost.exe ist eine Anwendung die 2008 geändert wurde. Also nix neues... hm

Werde den Scan und Fix nochmal wiederholen.

schrauber 18.06.2013 14:06
Immer locker bleiben. NIEMAND hat gesagt Du sollst das komplette OTL log in die Box kopieren und FIx drücken!! Willst Du den Rechner schrotten?

Mach nur das was ich oben gepostet hab.

eine_jojo 18.06.2013 14:18
Sorry... ich bin vielleicht wirklich im Moment nicht so locker...

Ich habe nun brav nur den Inhalt deiner CodeBox eingefügt und den Fix-Button betätigt. Der Neustart wurde verlangt und der weiße Bildschirm ist weg... puhhhh

1000 Dank !!!!!

Hier der OTL_MovedFiles:

All processes killed
========== OTL ==========
Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx deleted successfully.
C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx moved successfully.
C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbwg folder moved successfully.
C:\WINDOWS\slssyi.kqf moved successfully.
C:\WINDOWS\iylajp.baq moved successfully.
C:\WINDOWS\pxbjvf.jdk moved successfully.
C:\WINDOWS\derx.ovb moved successfully.
C:\WINDOWS\egxd.nyh moved successfully.
C:\WINDOWS\mca.ech moved successfully.
========== COMMANDS ==========

[EMPTYTEMP]

User: Administrator

User: All Users

User: Default User
->Temp folder emptied: 0 bytes
Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key.
Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key.
Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key.
Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key.
Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key.
Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key.
Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key.
->Temporary Internet Files folder emptied: 33170 bytes

User: ****
->Temp folder emptied: 661023 bytes
Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key.
->Temporary Internet Files folder emptied: 2949254 bytes
->Java cache emptied: 200275 bytes
->Flash cache emptied: 470 bytes

User: LocalService

User: NetworkService

User: Wartung

%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 13675591 bytes
%systemroot%\System32\dllcache .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 586 bytes
RecycleBin emptied: 0 bytes

Total Files Cleaned = 17,00 mb


OTL by OldTimer - Version 3.2.69.0 log created on 06182013_151639

schrauber 18.06.2013 18:22
Siehste :)

und jetzt bitte ein OTL log aus dem normalen Windows :)

eine_jojo 19.06.2013 06:32
Du weißt... von wegen grün hinter den Ohren ;-)... wo finde ich den OTL log aus dem normalen Windows?

schrauber 19.06.2013 08:21
Lad OTL einfach neu auf den Desktop :)

eine_jojo 19.06.2013 08:34
mh... bei mir war keine Datei auf dem Desktop. Habe auch gerade C:\ nach "OTL" durchsuchen lassen... nix. Ich hatte nur diese (siehe oben) auf dem USB-Stick unter _OTL.

schrauber 19.06.2013 08:58
Du hast doch gerade eben OTL laufen lassen im SAfe Mode ;). Wo haste das her? selbst geschnitzt? ;)

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden ).
  • Doppelklick auf die OTL.exe
  • Oben findest Du ein Kästchen mit Ausgabe. Wähle bitte Minimal Ausgabe
  • Unter Extra Registry, wähle bitte Use SafeList
  • Klicke nun auf Run Scan links oben
  • Wenn der Scan beendet wurde werden 2 Logfiles erstellt
  • Poste die Logfiles hier in den Thread.

eine_jojo 19.06.2013 09:24
Ich hatte OTL auf einem USB-Stick geladen und von dort gestartet. Wahrscheinlich wurde der log auch dort abgelegt.


Alle Zeitangaben in WEZ +1. Es ist jetzt 15:24 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131