| |
| |||||||
Log-Analyse und Auswertung: Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasenWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
28.02.2012, 12:33
| #1 |
 |  Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen Hallo zusammen! Ich bin neu hier in der Community und bin um jede Hilfe sehr dankbar! Ich hoffe, da mein Problem hier wohl schon bekannt ist, dass ihr mir auch helfen könnt! Seit einer Woche kommt, immer wenn ich meinen Rechner mit dem Internet verbinde die bekannte Meldung: Achtung! Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterladen! Meine "Anti Vir Premimum" Software hat hier wohl versagt und zeigt nach einem vollständigen Systemcheck keine Funde an! Die geforderten Files zu erstellen war ohne Internetverbindung gar nicht so einfach! Ich hoffe jedoch, ich habe alles hinbekommen! Ich würde mich über eine Hilfe von euch freuen! Sportie |
|
28.02.2012, 12:36
| #2 |
| /// Malware-holic   | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen hi,
__________________starte mal neu, drücke f8 wähle abgesicherter modus mit netzwerk, melde dich im infiziertem konto an, stelle die internet verbindung her. Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
explorer.exe
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\system32\*.dll /lockedfiles
%USERPROFILE%\*.*
%USERPROFILE%\Local Settings\Temp\*.exe
%USERPROFILE%\Local Settings\Temp\*.dll
%USERPROFILE%\Application Data\*.exe
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
CREATERESTOREPOINT
__________________ |
|
28.02.2012, 13:28
| #3 |
| | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen Bin noch etwas langsam, aber ich hoffe ich habe bisher alles richtig gemacht!?
__________________ |
|
28.02.2012, 17:44
| #4 |
| /// Malware-holic | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen hi dieses script sowie evtl. folgende scripts sind nur für den jeweiligen user. wenn ihr probleme habt, eröffnet eigene topics und wartet auf, für euch angepasste scripts. • Starte bitte die OTL.exe • Kopiere nun das Folgende in die Textbox. Code:
ATTFilter :OTL
O4 - HKCU..\Run: [{FA7C4B0A-4FC4-11DC-8D75-806D6172696F}] C:\Dokumente und Einstellungen\Helmi\Anwendungsdaten\Microsoft\torrent.exe ()
:Files
C:\Dokumente und Einstellungen\Helmi\Anwendungsdaten\Microsoft\torrent.exe
:Commands
[purity]
[EMPTYFLASH]
[emptytemp]
[Reboot]
• Schliesse bitte nun alle Programme. • Klicke nun bitte auf den Fix Button. • OTL kann gegebenfalls einen Neustart verlangen. Bitte dies zulassen. • Nach dem Neustart findest Du ein Textdokument, dessen inhalt in deiner nächsten antwort hier reinkopieren. starte in den normalen modus. falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang in den Thread posten! Drücke bitte die  + E Taste.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
28.02.2012, 19:02
| #5 |
| | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen All processes killed Error: Unable to interpret <activexactivex> in the current context! Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context! Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context! Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context! Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context! Error: Unable to interpret </md5start> in the current context! Error: Unable to interpret <userinit.exe> in the current context! Error: Unable to interpret <eventlog.dll> in the current context! Error: Unable to interpret <scecli.dll> in the current context! Error: Unable to interpret <netlogon.dll> in the current context! Error: Unable to interpret <cngaudit.dll> in the current context! Error: Unable to interpret <ws2ifsl.sys> in the current context! Error: Unable to interpret <sceclt.dll> in the current context! Error: Unable to interpret <ntelogon.dll> in the current context! Error: Unable to interpret <winlogon.exe> in the current context! Error: Unable to interpret <logevent.dll> in the current context! Error: Unable to interpret <user32.DLL> in the current context! Error: Unable to interpret <explorer.exe> in the current context! Error: Unable to interpret <iaStor.sys> in the current context! Error: Unable to interpret <nvstor.sys> in the current context! Error: Unable to interpret <atapi.sys> in the current context! Error: Unable to interpret <IdeChnDr.sys> in the current context! Error: Unable to interpret <viasraid.sys> in the current context! Error: Unable to interpret <AGP440.sys> in the current context! Error: Unable to interpret <vaxscsi.sys> in the current context! Error: Unable to interpret <nvatabus.sys> in the current context! Error: Unable to interpret <viamraid.sys> in the current context! Error: Unable to interpret <nvata.sys> in the current context! Error: Unable to interpret <nvgts.sys> in the current context! Error: Unable to interpret <iastorv.sys> in the current context! Error: Unable to interpret <ViPrt.sys> in the current context! Error: Unable to interpret <eNetHook.dll> in the current context! Error: Unable to interpret <ahcix86.sys> in the current context! Error: Unable to interpret <KR10N.sys> in the current context! Error: Unable to interpret <nvstor32.sys> in the current context! Error: Unable to interpret <ahcix86s.sys> in the current context! Error: Unable to interpret </md5stop> in the current context! Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context! Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context! Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context! Error: Unable to interpret <%USERPROFILE%\*.*> in the current context! Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context! Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context! Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context! Error: Unable to interpret <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs> in the current context! Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context! Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context! Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context! Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context! Error: Unable to interpret </md5start> in the current context! Error: Unable to interpret <userinit.exe> in the current context! Error: Unable to interpret <eventlog.dll> in the current context! Error: Unable to interpret <scecli.dll> in the current context! Error: Unable to interpret <netlogon.dll> in the current context! Error: Unable to interpret <cngaudit.dll> in the current context! Error: Unable to interpret <ws2ifsl.sys> in the current context! Error: Unable to interpret <sceclt.dll> in the current context! Error: Unable to interpret <ntelogon.dll> in the current context! Error: Unable to interpret <winlogon.exe> in the current context! Error: Unable to interpret <logevent.dll> in the current context! Error: Unable to interpret <user32.DLL> in the current context! Error: Unable to interpret <explorer.exe> in the current context! Error: Unable to interpret <iaStor.sys> in the current context! Error: Unable to interpret <nvstor.sys> in the current context! Error: Unable to interpret <atapi.sys> in the current context! Error: Unable to interpret <IdeChnDr.sys> in the current context! Error: Unable to interpret <viasraid.sys> in the current context! Error: Unable to interpret <AGP440.sys> in the current context! Error: Unable to interpret <vaxscsi.sys> in the current context! Error: Unable to interpret <nvatabus.sys> in the current context! Error: Unable to interpret <viamraid.sys> in the current context! Error: Unable to interpret <nvata.sys> in the current context! Error: Unable to interpret <nvgts.sys> in the current context! Error: Unable to interpret <iastorv.sys> in the current context! Error: Unable to interpret <ViPrt.sys> in the current context! Error: Unable to interpret <eNetHook.dll> in the current context! Error: Unable to interpret <ahcix86.sys> in the current context! Error: Unable to interpret <KR10N.sys> in the current context! Error: Unable to interpret <nvstor32.sys> in the current context! Error: Unable to interpret <ahcix86s.sys> in the current context! Error: Unable to interpret </md5stop> in the current context! Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context! Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context! Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context! Error: Unable to interpret <%USERPROFILE%\*.*> in the current context! Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context! Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context! Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context! Error: Unable to interpret <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <%SYSTEMDRIVE%\*.> in the current context! Error: Unable to interpret <%PROGRAMFILES%\*.exe> in the current context! Error: Unable to interpret <%LOCALAPPDATA%\*.exe> in the current context! Error: Unable to interpret <%systemroot%\*. /mp /s> in the current context! Error: Unable to interpret </md5start> in the current context! Error: Unable to interpret <userinit.exe> in the current context! Error: Unable to interpret <eventlog.dll> in the current context! Error: Unable to interpret <scecli.dll> in the current context! Error: Unable to interpret <netlogon.dll> in the current context! Error: Unable to interpret <cngaudit.dll> in the current context! Error: Unable to interpret <ws2ifsl.sys> in the current context! Error: Unable to interpret <sceclt.dll> in the current context! Error: Unable to interpret <ntelogon.dll> in the current context! Error: Unable to interpret <winlogon.exe> in the current context! Error: Unable to interpret <logevent.dll> in the current context! Error: Unable to interpret <user32.DLL> in the current context! Error: Unable to interpret <explorer.exe> in the current context! Error: Unable to interpret <iaStor.sys> in the current context! Error: Unable to interpret <nvstor.sys> in the current context! Error: Unable to interpret <atapi.sys> in the current context! Error: Unable to interpret <IdeChnDr.sys> in the current context! Error: Unable to interpret <viasraid.sys> in the current context! Error: Unable to interpret <AGP440.sys> in the current context! Error: Unable to interpret <vaxscsi.sys> in the current context! Error: Unable to interpret <nvatabus.sys> in the current context! Error: Unable to interpret <viamraid.sys> in the current context! Error: Unable to interpret <nvata.sys> in the current context! Error: Unable to interpret <nvgts.sys> in the current context! Error: Unable to interpret <iastorv.sys> in the current context! Error: Unable to interpret <ViPrt.sys> in the current context! Error: Unable to interpret <eNetHook.dll> in the current context! Error: Unable to interpret <ahcix86.sys> in the current context! Error: Unable to interpret <KR10N.sys> in the current context! Error: Unable to interpret <nvstor32.sys> in the current context! Error: Unable to interpret <ahcix86s.sys> in the current context! Error: Unable to interpret </md5stop> in the current context! Error: Unable to interpret <%systemroot%\system32\drivers\*.sys /lockedfiles> in the current context! Error: Unable to interpret <%systemroot%\System32\config\*.sav> in the current context! Error: Unable to interpret <%systemroot%\system32\*.dll /lockedfiles> in the current context! Error: Unable to interpret <%USERPROFILE%\*.*> in the current context! Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.exe> in the current context! Error: Unable to interpret <%USERPROFILE%\Local Settings\Temp\*.dll> in the current context! Error: Unable to interpret <%USERPROFILE%\Application Data\*.exe> in the current context! Error: Unable to interpret <HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs> in the current context! Error: Unable to interpret <OTL EXTRAS Logfile: Code:
ATTFilter OTL Extras logfile created on: 28.02.2012 13:00:04 - Run 1> in the current context!
Error: Unable to interpret <OTL by OldTimer - Version 3.2.33.2 Folder = C:\Dokumente und Einstellungen\Helmi\Desktop> in the current context!
Error: Unable to interpret <Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation> in the current context!
Error: Unable to interpret <Internet Explorer (Version = 8.0.6001.18372)> in the current context!
Error: Unable to interpret <Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <1,99 Gb Total Physical Memory | 1,71 Gb Available Physical Memory | 85,91% Memory free> in the current context!
Error: Unable to interpret <1,84 Gb Paging File | 1,76 Gb Available in Paging File | 95,58% Paging File free> in the current context!
Error: Unable to interpret <Paging file location(s): [binary data]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme> in the current context!
Error: Unable to interpret <Drive C: | 145,14 Gb Total Space | 63,82 Gb Free Space | 43,97% Space Free | Partition Type: NTFS> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Computer Name: POWERBOY | User Name: Helmi | Logged in as Administrator.> in the current context!
Error: Unable to interpret <Boot Mode: SafeMode with Networking | Scan Mode: Current user | Quick Scan> in the current context!
Error: Unable to interpret <Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Extra Registry (SafeList) ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== File Associations ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]> in the current context!
Error: Unable to interpret <.cpl [@ = cplfile] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*> in the current context!
Error: Unable to interpret <.html [@ = ChromeHTML] -- Reg Error: Key error. File not found> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]> in the current context!
Error: Unable to interpret <.html [@ = FirefoxHTML] -- C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Shell Spawning ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]> in the current context!
Error: Unable to interpret <batfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <cmdfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <comfile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <cplfile [cplopen] -- rundll32.exe shell32.dll,Control_RunDLL "%1",%*> in the current context!
Error: Unable to interpret <exefile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <htmlfile [edit] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <http [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1"> in the current context!
Error: Unable to interpret <https [open] -- "C:\Programme\Google\Chrome\Application\chrome.exe" -- "%1"> in the current context!
Error: Unable to interpret <piffile [open] -- "%1" %*> in the current context!
Error: Unable to interpret <regfile [merge] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <scrfile [config] -- "%1"> in the current context!
Error: Unable to interpret <scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l> in the current context!
Error: Unable to interpret <scrfile [open] -- "%1" /S> in the current context!
Error: Unable to interpret <txtfile [edit] -- Reg Error: Key error.> in the current context!
Error: Unable to interpret <Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1> in the current context!
Error: Unable to interpret <Directory [AddToPlaylistVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()> in the current context!
Error: Unable to interpret <Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Directory [PlayWithVLC] -- "C:\Programme\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()> in the current context!
Error: Unable to interpret <Folder [open] -- %SystemRoot%\Explorer.exe /idlist,%I,%L (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Folder [explore] -- %SystemRoot%\Explorer.exe /e,/idlist,%I,%L (Microsoft Corporation)> in the current context!
Error: Unable to interpret <Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Security Center Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]> in the current context!
Error: Unable to interpret <"FirstRunDisabled" = 1> in the current context!
Error: Unable to interpret <"AntiVirusDisableNotify" = 0> in the current context!
Error: Unable to interpret <"FirewallDisableNotify" = 1> in the current context!
Error: Unable to interpret <"UpdatesDisableNotify" = 0> in the current context!
Error: Unable to interpret <"AntiVirusOverride" = 0> in the current context!
Error: Unable to interpret <"FirewallOverride" = 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\AhnlabAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ComputerAssociatesAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\KasperskyAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\PandaFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SophosAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\SymantecFirewall]> in the current context!
Error: Unable to interpret <"DisableMonitoring" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TinyFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendAntiVirus]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\TrendFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\ZoneLabsFirewall]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== System Restore Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\SystemRestore]> in the current context!
Error: Unable to interpret <"DisableSR" = 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Sr]> in the current context!
Error: Unable to interpret <"Start" = 0> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SrService]> in the current context!
Error: Unable to interpret <"Start" = 2> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Firewall Settings ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\GloballyOpenPorts\List]> in the current context!
Error: Unable to interpret <"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007> in the current context!
Error: Unable to interpret <"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008> in the current context!
Error: Unable to interpret <"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]> in the current context!
Error: Unable to interpret <"EnableFirewall" = 1> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\GloballyOpenPorts\List]> in the current context!
Error: Unable to interpret <"1900:UDP" = 1900:UDP:LocalSubNet:Enabled:@xpsp2res.dll,-22007> in the current context!
Error: Unable to interpret <"2869:TCP" = 2869:TCP:LocalSubNet:Enabled:@xpsp2res.dll,-22008> in the current context!
Error: Unable to interpret <"10243:TCP" = 10243:TCP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10280:UDP" = 10280:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10281:UDP" = 10281:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10282:UDP" = 10282:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10283:UDP" = 10283:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret <"10284:UDP" = 10284:UDP:LocalSubNet:Enabled:Windows Media Player-Netzwerkfreigabedienst> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Authorized Applications List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile\AuthorizedApplications\List]> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]> in the current context!
Error: Unable to interpret <"C:\Programme\Mozilla Firefox\firefox.exe" = C:\Programme\Mozilla Firefox\firefox.exe:*:Enabled:Firefox -- (Mozilla Corporation)> in the current context!
Error: Unable to interpret <"C:\Dokumente und Einstellungen\Kathi\Eigene Dateien\Multimessenger\MESSENGR.EXE" = C:\Dokumente und Einstellungen\Kathi\Eigene Dateien\Multimessenger\MESSENGR.EXE:*:Enabled:WEB.DE MultiMessenger -- (WEB.DE GmbH)> in the current context!
Error: Unable to interpret <"C:\Programme\VideoLAN\VLC\vlc.exe" = C:\Programme\VideoLAN\VLC\vlc.exe:*:Enabled:VLC media player -- ()> in the current context!
Error: Unable to interpret <"C:\Programme\Google\Google Earth\client\googleearth.exe" = C:\Programme\Google\Google Earth\client\googleearth.exe:*:Disabled:Google Earth -- (Google)> in the current context!
Error: Unable to interpret <"C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe" = C:\Programme\Gemeinsame Dateien\Apple\Apple Application Support\WebKit2WebProcess.exe:*:Enabled:WebKit -- (Apple Inc.)> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== HKEY_LOCAL_MACHINE Uninstall List ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]> in the current context!
Error: Unable to interpret <"{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}" = Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148> in the current context!
Error: Unable to interpret <"{075473F5-846A-448B-BCB3-104AA1760205}" = RecordNow Data> in the current context!
Error: Unable to interpret <"{1007F41F-7D69-468E-8017-3849A5A973C2}" = ThinkVantage Technologies Welcome Message> in the current context!
Error: Unable to interpret <"{1206EF92-2E83-4859-ACCB-2048C3CB7DA6}" = Sonic DLA> in the current context!
Error: Unable to interpret <"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148> in the current context!
Error: Unable to interpret <"{26A24AE4-039D-4CA4-87B4-2F83216010FF}" = Java(TM) 6 Update 24> in the current context!
Error: Unable to interpret <"{30465B6C-B53F-49A1-9EBA-A3F187AD502E}" = Sonic Update Manager> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0150060}" = J2SE Runtime Environment 5.0 Update 6> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160020}" = Java(TM) 6 Update 2> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160030}" = Java(TM) 6 Update 3> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160050}" = Java(TM) 6 Update 5> in the current context!
Error: Unable to interpret <"{3248F0A8-6813-11D6-A77B-00B0D0160070}" = Java(TM) 6 Update 7> in the current context!
Error: Unable to interpret <"{32E00E5E-22B1-4D5A-9DC2-CD75E087A5E6}" = Steuer-Spar-Erklärung 2009> in the current context!
Error: Unable to interpret <"{350C97B3-3D7C-4EE8-BAA9-00BCB3D54227}" = WebFldrs XP> in the current context!
Error: Unable to interpret <"{3623704F-1EA9-46FB-A957-7575FB6D9A56}" = Steuer-Spar-Erklärung Lehrer 2012> in the current context!
Error: Unable to interpret <"{48227AEB-DC8E-4A90-A274-0B4A39D699B1}" = Client Security Solution> in the current context!
Error: Unable to interpret <"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater> in the current context!
Error: Unable to interpret <"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml> in the current context!
Error: Unable to interpret <"{5A3C1721-F8ED-11E0-8AFB-B8AC6F97B88E}" = Google Earth> in the current context!
Error: Unable to interpret <"{6675CA7F-E51B-4F6A-99D4-F8F0124C6EAA}" = Sonic Express Labeler> in the current context!
Error: Unable to interpret <"{6715F979-12BE-4C1C-AAEB-168518204F1B}" = Steuer-Spar-Erklärung Lehrer 2010> in the current context!
Error: Unable to interpret <"{69E8BEBD-B3AA-4981-BA49-AD0AEA731031}" = Nero BackItUp 2 Essentials> in the current context!
Error: Unable to interpret <"{6B36DEBF-27D0-4B1E-858D-D397091C6C7D}" = HP Precisionscan Pro 3.1> in the current context!
Error: Unable to interpret <"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable> in the current context!
Error: Unable to interpret <"{7661B93C-C34D-43C2-B23A-AAFC267EFB09}" = Steuer-Spar-Erklärung Lehrer 2011> in the current context!
Error: Unable to interpret <"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053> in the current context!
Error: Unable to interpret <"{7726CF62-7B45-4E6D-9266-615346816BCA}" = Rescue and Recovery> in the current context!
Error: Unable to interpret <"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update> in the current context!
Error: Unable to interpret <"{78D7D7CD-A06B-4514-ACBD-8055BF945A8E}" = InfoBibliothek 2> in the current context!
Error: Unable to interpret <"{796E076A-82F7-4D49-98C8-DEC0C3BC733A}" = Diskeeper Lite> in the current context!
Error: Unable to interpret <"{7BE15435-2D3E-4B58-867F-9C75BED0208C}" = QuickTime> in the current context!
Error: Unable to interpret <"{7FC3BBEC-5A91-41B0-9CB8-960EC4421411}" = WCreator3> in the current context!
Error: Unable to interpret <"{8675339C-128C-44DD-83BF-0A5D6ABD8297}" = System Update> in the current context!
Error: Unable to interpret <"{8937FCB2-2FC6-4FC3-9FB5-DE2C92DB9C38}" = Microsoft .NET Framework 2.0 Language Pack - DEU> in the current context!
Error: Unable to interpret <"{90120000-0010-0407-0000-0000000FF1CE}" = Microsoft Software Update for Web Folders (German) 12> in the current context!
Error: Unable to interpret <"{90120000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-001F-0407-0000-0000000FF1CE}_HOMESTUDENTR_{928D7B99-2BEA-49F9-83B8-20FA57860643}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2007> in the current context!
Error: Unable to interpret <"{90120000-001F-0409-0000-0000000FF1CE}_HOMESTUDENTR_{1FF96026-A04A-4C3E-B50A-BB7022654D0F}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2007> in the current context!
Error: Unable to interpret <"{90120000-001F-040C-0000-0000000FF1CE}_HOMESTUDENTR_{71F055E8-E2C6-4214-BB3D-BFE03561B89E}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2007> in the current context!
Error: Unable to interpret <"{90120000-001F-0410-0000-0000000FF1CE}_HOMESTUDENTR_{A23BFC95-4A73-410F-9248-4C2B48E38C49}" = Microsoft Office Proofing Tools 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System> in the current context!
Error: Unable to interpret <"{90120000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-006E-0407-0000-0000000FF1CE}_HOMESTUDENTR_{A6353E8F-5B8D-47CC-8737-DFF032ED3973}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90120000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2007> in the current context!
Error: Unable to interpret <"{90120000-00A1-0407-0000-0000000FF1CE}_HOMESTUDENTR_{DB2ACBD1-65B1-4FC5-881E-4E75C668E7E2}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In> in the current context!
Error: Unable to interpret <"{91120000-002F-0000-0000-0000000FF1CE}" = Microsoft Office Home and Student 2007> in the current context!
Error: Unable to interpret <"{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}" = Microsoft Office 2007 Service Pack 3 (SP3)> in the current context!
Error: Unable to interpret <"{91810AFC-A4F8-4EBA-A5AA-B198BBC81144}" = InterVideo WinDVD> in the current context!
Error: Unable to interpret <"{986F64DC-FF15-449D-998F-EE3BCEC6666A}" = Help Center> in the current context!
Error: Unable to interpret <"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17> in the current context!
Error: Unable to interpret <"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161> in the current context!
Error: Unable to interpret <"{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}" = Microsoft .NET Framework 3.0 Service Pack 2> in the current context!
Error: Unable to interpret <"{A83279FD-CA4B-4206-9535-90974DE76654}" = Apple Application Support> in the current context!
Error: Unable to interpret <"{A92DAB39-4E2C-4304-9AB6-BC44E68B55E2}" = Google Update Helper> in the current context!
Error: Unable to interpret <"{AB708C9B-97C8-4AC9-899B-DBF226AC9382}" = RecordNow Audio> in the current context!
Error: Unable to interpret <"{AC60C8C1-855E-45AB-8D95-1D16F8A38E78}" = UGuide> in the current context!
Error: Unable to interpret <"{AC76BA86-7AD7-1031-7B44-A95000000001}" = Adobe Reader 9.5.0 - Deutsch> in the current context!
Error: Unable to interpret <"{AFA42FE1-A5C3-485F-9180-BFCF5BF1F1C3}" = AAVUpdateManager> in the current context!
Error: Unable to interpret <"{B12665F4-4E93-4AB4-B7FC-37053B524629}" = RecordNow Copy> in the current context!
Error: Unable to interpret <"{B334D9AE-1393-423E-97C0-3BDC3360E692}" = Sonic Icons for Lenovo> in the current context!
Error: Unable to interpret <"{B7088B71-86FC-4F5E-B295-68FAB7B6C85B}" = Steuer-Spar-Erklärung 2007> in the current context!
Error: Unable to interpret <"{BA165460-FCF7-4D6C-A7A2-F2321700720F}" = MobileMe Control Panel> in the current context!
Error: Unable to interpret <"{BA7A3288-228D-4031-A93A-B5F6B3415E15}" = Misc> in the current context!
Error: Unable to interpret <"{BBE67B86-FCD7-4D3C-8B00-063DEAD8E30C}" = Steuer-Spar-Erklärung 2008> in the current context!
Error: Unable to interpret <"{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}" = Microsoft .NET Framework 2.0 Service Pack 2> in the current context!
Error: Unable to interpret <"{C54ED2B6-1AF2-416F-BBA8-5E2B8CDCB5C4}" = XP Themes> in the current context!
Error: Unable to interpret <"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1> in the current context!
Error: Unable to interpret <"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1> in the current context!
Error: Unable to interpret <"{D728E945-256D-4477-B377-6BBA693714AC}" = Ergänzung zu Productivity Center für ThinkCentre> in the current context!
Error: Unable to interpret <"{E728E952-DD4F-4BCD-A5C8-40FBFEFF91FE}" = OpenOffice.org Installer 1.0> in the current context!
Error: Unable to interpret <"{F0A37341-D692-11D4-A984-009027EC0A9C}" = SoundMAX> in the current context!
Error: Unable to interpret <"{F1CD25A0-5401-40B2-BAA9-E267408B16DF}" = Toolbox> in the current context!
Error: Unable to interpret <"{F386C340-DF4B-4BBA-9503-420FB7EDB395}" = Wallpapers> in the current context!
Error: Unable to interpret <"{F5FB4B71-6301-11D4-9AD1-00A0C9B0C5F6}" = InfoBibliothek> in the current context!
Error: Unable to interpret <"{F705E3E1-A471-426B-9A09-73429F3418EE}" = System Migration Assistant> in the current context!
Error: Unable to interpret <"{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022> in the current context!
Error: Unable to interpret <"7-Zip" = 7-Zip 9.20> in the current context!
Error: Unable to interpret <"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX> in the current context!
Error: Unable to interpret <"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin> in the current context!
Error: Unable to interpret <"Adobe Photoshop Elements 2.0" = Adobe Photoshop Elements 2.0> in the current context!
Error: Unable to interpret <"ArcSoft PhotoImpression" = ArcSoft PhotoImpression> in the current context!
Error: Unable to interpret <"Avira AntiVir Desktop" = Avira AntiVir Premium> in the current context!
Error: Unable to interpret <"CAL" = Canon Camera Access Library> in the current context!
Error: Unable to interpret <"CameraWindowDVC5" = Canon Camera Window DC_DV 5 for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"CameraWindowDVC6" = Canon Camera Window DC_DV 6 for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"CameraWindowMC" = Canon Camera Window MC 6 for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"CANON iMAGE GATEWAY Task" = CANON iMAGE GATEWAY Task for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"Canon Internet Library for ZoomBrowser EX" = Canon Internet Library for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"CCleaner" = CCleaner> in the current context!
Error: Unable to interpret <"CSCLIB" = Canon Camera Support Core Library> in the current context!
Error: Unable to interpret <"DPP" = Canon Utilities Digital Photo Professional 2.2> in the current context!
Error: Unable to interpret <"EOS Utility" = Canon Utilities EOS Utility> in the current context!
Error: Unable to interpret <"HOMESTUDENTR" = Microsoft Office Home and Student 2007> in the current context!
Error: Unable to interpret <"HP Fotodruckprogramm" = HP Fotodruckprogramm> in the current context!
Error: Unable to interpret <"HP Officejet Pro K550 Series" = HP Officejet Pro K550 Serie> in the current context!
Error: Unable to interpret <"IDNMitigationAPIs" = Microsoft Internationalized Domain Names Mitigation APIs> in the current context!
Error: Unable to interpret <"ie7" = Windows Internet Explorer 7> in the current context!
Error: Unable to interpret <"ie8" = Windows Internet Explorer 8 Release Candidate 1> in the current context!
Error: Unable to interpret <"InterActual Player" = InterActual Player> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 2.0 Language Pack - DEU" = Microsoft .NET Framework 2.0 Language Pack - DEU> in the current context!
Error: Unable to interpret <"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1> in the current context!
Error: Unable to interpret <"MouseSuite98" = Mouse Suite> in the current context!
Error: Unable to interpret <"Mozilla Firefox 9.0.1 (x86 de)" = Mozilla Firefox 9.0.1 (x86 de)> in the current context!
Error: Unable to interpret <"MSCompPackV1" = Microsoft Compression Client Pack 1.0 for Windows XP> in the current context!
Error: Unable to interpret <"Nero - Burning Rom!UninstallKey" = Nero 6 Ultra Edition> in the current context!
Error: Unable to interpret <"NeroVision!UninstallKey" = NeroVision Express 3> in the current context!
Error: Unable to interpret <"NLSDownlevelMapping" = Microsoft National Language Support Downlevel APIs> in the current context!
Error: Unable to interpret <"PDF Maker Pilot Demo_is1" = PDF Maker Pilot Demo version 1.23> in the current context!
Error: Unable to interpret <"PhotoStitch" = Canon Utilities PhotoStitch> in the current context!
Error: Unable to interpret <"RAW Image Task" = Canon RAW Image Task for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"RemoteCaptureTask" = Canon RemoteCapture Task for ZoomBrowser EX> in the current context!
Error: Unable to interpret <"Remove Multimedia Center" = Remove Multimedia Center> in the current context!
Error: Unable to interpret <"Sony Ericsson S312 driver" = Sony Ericsson S312 driver v3.5.3.0> in the current context!
Error: Unable to interpret <"VLC media player" = VLC media player 1.0.2> in the current context!
Error: Unable to interpret <"WEB.DE MultiMessenger" = WEB.DE MultiMessenger> in the current context!
Error: Unable to interpret <"Windows Media Format Runtime" = Windows Media Format 11 runtime> in the current context!
Error: Unable to interpret <"Windows Media Player" = Windows Media Player 11> in the current context!
Error: Unable to interpret <"Windows XP Service Pack" = Windows XP Service Pack 3> in the current context!
Error: Unable to interpret <"WinZip" = WinZip> in the current context!
Error: Unable to interpret <"WMCSetup" = Windows Media Connect> in the current context!
Error: Unable to interpret <"WMFDist11" = Windows Media Format 11 runtime> in the current context!
Error: Unable to interpret <"wmp11" = Windows Media Player 11> in the current context!
Error: Unable to interpret <"Wudf01000" = Microsoft User-Mode Driver Framework Feature Pack 1.0> in the current context!
Error: Unable to interpret <"ZoomBrowser EX" = Canon Utilities ZoomBrowser EX> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <========== Last 10 Event Log Errors ==========> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ Application Events ]> in the current context!
Error: Unable to interpret <Error - 29.06.2011 04:54:47 | Computer Name = POWERBOY | Source = MsiInstaller | ID = 1023> in the current context!
Error: Unable to interpret <Description = Produkt: Microsoft .NET Framework 2.0 Service Pack 2 - Update "KB2478658"> in the current context!
Error: Unable to interpret < konnte nicht installiert werden. Fehlercode 1603. Weitere Informationen sind in> in the current context!
Error: Unable to interpret < der Protokolldatei C:\WINDOWS\system32\config\SYSTEM~1\LOKALE~1\Temp\Microsoft > in the current context!
Error: Unable to interpret <.NET Framework 2.0-KB2478658_20110629_085238968-Msi0.txt enthalten.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 29.06.2011 04:54:48 | Computer Name = POWERBOY | Source = HotFixInstaller | ID = 5000> in the current context!
Error: Unable to interpret <Description = EventType visualstudio8setup, P1 microsoft .net framework 2.0-kb2478658,> in the current context!
Error: Unable to interpret < P2 1031, P3 1603, P4 msi, P5 f, P6 9.0.40215.0, P7 install, P8 x86, P9 xp, P10 > in the current context!
Error: Unable to interpret <0.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.07.2011 16:15:24 | Computer Name = POWERBOY | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Stillstehende Anwendung msimn.exe, Version 6.0.2900.5512, Stillstandmodul> in the current context!
Error: Unable to interpret < hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.07.2011 16:15:59 | Computer Name = POWERBOY | Source = Application Hang | ID = 1002> in the current context!
Error: Unable to interpret <Description = Stillstehende Anwendung WINWORD.EXE, Version 12.0.6545.5000, Stillstandmodul> in the current context!
Error: Unable to interpret < hungapp, Version 0.0.0.0, Stillstandadresse 0x00000000.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 03.07.2011 16:17:51 | Computer Name = POWERBOY | Source = Application Error | ID = 1000> in the current context!
Error: Unable to interpret <Description = Fehlgeschlagene Anwendung explorer.exe, Version 6.0.2900.5512, fehlgeschlagenes> in the current context!
Error: Unable to interpret < Modul , Version 0.0.0.0, Fehleradresse 0x00000000.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ OSession Events ]> in the current context!
Error: Unable to interpret <Error - 08.07.2009 14:39:07 | Computer Name = POWERBOY | Source = Microsoft Office 12 Sessions | ID = 7001> in the current context!
Error: Unable to interpret <Description = ID: 1, Application Name: Microsoft Office Excel, Application Version:> in the current context!
Error: Unable to interpret < 12.0.6504.5001, Microsoft Office Version: 12.0.6215.1000. This session lasted 12260> in the current context!
Error: Unable to interpret < seconds with 540 seconds of active time. This session ended with a crash.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <[ System Events ]> in the current context!
Error: Unable to interpret <Error - 26.02.2012 14:56:40 | Computer Name = POWERBOY | Source = Windows Update Agent | ID = 16> in the current context!
Error: Unable to interpret <Description = Verbindung nicht möglich: Es konnte keine Verbindung mit dem Dienst> in the current context!
Error: Unable to interpret < "Automatische Updates" hergestellt werden, daher können Updates nicht nach dem > in the current context!
Error: Unable to interpret <angegebenen Zeitplan heruntergeladen und installiert werden. Es wird weiterhin versucht,> in the current context!
Error: Unable to interpret < eine Verbindung herzustellen.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:38:11 | Computer Name = POWERBOY | Source = DCOM | ID = 10010> in the current context!
Error: Unable to interpret <Description = Der Server "{8BC3F05E-D86B-11D0-A075-00C04FB68820}" konnte innerhalb> in the current context!
Error: Unable to interpret < des angegebenen Zeitabschnitts mit DCOM nicht registriert werden.> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:44:43 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "EventSystem"> in the current context!
Error: Unable to interpret < mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {1BE1F766-5536-11D1-B726-00C04FB926AF}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:45:19 | Computer Name = POWERBOY | Source = Service Control Manager | ID = 7001> in the current context!
Error: Unable to interpret <Description = Der Dienst "Simple Mail Transfer Protocol (SMTP)" ist vom Dienst "IIS> in the current context!
Error: Unable to interpret < Admin" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: %%1068> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:45:19 | Computer Name = POWERBOY | Source = Service Control Manager | ID = 7001> in the current context!
Error: Unable to interpret <Description = Der Dienst "WWW-Publishing" ist vom Dienst "IIS Admin" abhängig, der> in the current context!
Error: Unable to interpret < aufgrund folgenden Fehlers nicht gestartet wurde: %%1068> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:45:19 | Computer Name = POWERBOY | Source = Service Control Manager | ID = 7026> in the current context!
Error: Unable to interpret <Description = Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen:> in the current context!
Error: Unable to interpret < avgio avipbb Fips intelppm ssmdrv> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:52:48 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"> in the current context!
Error: Unable to interpret < mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 07:53:04 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"> in the current context!
Error: Unable to interpret < mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 08:09:06 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"> in the current context!
Error: Unable to interpret < mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret <Error - 28.02.2012 08:09:12 | Computer Name = POWERBOY | Source = DCOM | ID = 10005> in the current context!
Error: Unable to interpret <Description = Bei DCOM ist der Fehler "%1084" aufgetreten, als der Dienst "StiSvc"> in the current context!
Error: Unable to interpret < mit den Argumenten "" gestartet wurde, um den folgenden Server zu verwenden: {A1F4E726-8CF1-11D1-BF92-0060081ED811}> in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret < > in the current context!
Error: Unable to interpret << End of report >
> in the current context! ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{FA7C4B0A-4FC4-11DC-8D75-806D6172696F} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA7C4B0A-4FC4-11DC-8D75-806D6172696F}\ not found. C:\Dokumente und Einstellungen\Helmi\Anwendungsdaten\Microsoft\torrent.exe moved successfully. ========== COMMANDS ========== [EMPTYFLASH] User: Administrator User: All Users User: Default User ->Flash cache emptied: 41 bytes User: Helmi ->Flash cache emptied: 487 bytes User: Kathi ->Flash cache emptied: 7755 bytes User: LocalService User: NetworkService Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32768 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 32902 bytes ->Flash cache emptied: 0 bytes User: Helmi ->Temp folder emptied: 15705548 bytes ->Temporary Internet Files folder emptied: 5349408 bytes ->Java cache emptied: 66891100 bytes ->FireFox cache emptied: 44571657 bytes ->Apple Safari cache emptied: 2072576 bytes ->Flash cache emptied: 0 bytes User: Kathi ->Temp folder emptied: 151293147 bytes ->Temporary Internet Files folder emptied: 592124193 bytes ->Java cache emptied: 35554730 bytes ->FireFox cache emptied: 72355215 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 66432 bytes User: NetworkService ->Temp folder emptied: 66264 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 19569 bytes %systemroot%\System32 .tmp files removed: 10801159 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 479703 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 951,00 mb OTL by OldTimer - Version 3.2.33.2 log created on 02282012_185012 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
28.02.2012, 19:17
| #6 |
| | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen Das Hochladen sollte soweit geklappt haben! War mir bei der Angabe "Link zum Thema im Forum" nicht sicher! Habe die Adresse von oben kopiert! Passt das so? Vielen Dank für dein Verständnis und deine Hilfe! |
|
28.02.2012, 19:54
| #7 |
| /// Malware-holic | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen das ist nicht das script was in dem letzten post steht, noch mal bitte.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
28.02.2012, 21:59
| #8 |
| | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\Software\Microsoft\Windows\CurrentVersion\Run\\{FA7C4B0A-4FC4-11DC-8D75-806D6172696F} not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FA7C4B0A-4FC4-11DC-8D75-806D6172696F}\ not found. File C:\Dokumente und Einstellungen\Helmi\Anwendungsdaten\Microsoft\torrent.exe not found. ========== COMMANDS ========== [EMPTYFLASH] User: Administrator User: All Users User: Default User ->Flash cache emptied: 0 bytes User: Helmi ->Flash cache emptied: 470 bytes User: Kathi ->Flash cache emptied: 0 bytes User: LocalService User: NetworkService Total Flash Files Cleaned = 0,00 mb [EMPTYTEMP] User: Administrator ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes User: All Users User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Helmi ->Temp folder emptied: 1378 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 38268112 bytes ->Apple Safari cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Kathi ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Java cache emptied: 0 bytes ->FireFox cache emptied: 0 bytes ->Flash cache emptied: 0 bytes User: LocalService ->Temp folder emptied: 66016 bytes ->Temporary Internet Files folder emptied: 33170 bytes User: NetworkService ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 33170 bytes %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 0 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 16895 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 37,00 mb OTL by OldTimer - Version 3.2.33.2 log created on 02282012_211023 Files\Folders moved on Reboot... File\Folder C:\WINDOWS\temp\Perflib_Perfdata_8f8.dat not found! Registry entries deleted on Reboot... |
|
29.02.2012, 11:43
| #9 |
| | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen Hallo, ich hoffe ich habe jetzt das richtige script eingetragen! Falls nicht, bräuchte ich nochmals deine Hilfe! |
|
29.02.2012, 12:38
| #10 |
| /// Malware-holic | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen passt :-) Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde! Bitte downloade dir Combofix.exe und speichere es unbedingt auf deinem Desktop.
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
29.02.2012, 13:11
| #11 |
| | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen Gibt es eine bestimmte Quelle die ich nutzen sollte für den Download von Combofix.exe, oder suche ich einfach irgend eine Freeware-Seite im Internet? |
|
29.02.2012, 13:20
| #12 |
| | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen Jetzt bin ich auf der richtigen Seite gelandet! Sorry! |
|
29.02.2012, 13:21
| #13 |
| /// Malware-holic | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen hi, die seiten die im tutorial stehen
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
29.02.2012, 13:53
| #14 |
| | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen Combofix Logfile: Code:
ATTFilter ComboFix 12-02-29.01 - Helmi 29.02.2012 13:40:23.1.2 - x86
Microsoft Windows XP Professional 5.1.2600.3.1252.49.1031.18.2038.1292 [GMT 1:00]
ausgeführt von:: c:\dokumente und einstellungen\Helmi\Desktop\ComboFix.exe
AV: AntiVir Desktop *Disabled/Updated* {C19476D9-52BC-4E93-8AF3-CCF59F7AE8FE}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\dokumente und einstellungen\Helmi\4.0
c:\dokumente und einstellungen\Helmi\Anwendungsdaten\.#
c:\dokumente und einstellungen\Helmi\Anwendungsdaten\ACD Systems\ACDSee\ImageDB.ddf
C:\Install.exe
c:\windows\IsUn0407.exe
c:\windows\system32\Cache
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-01-28 bis 2012-02-29 ))))))))))))))))))))))))))))))
.
.
2012-02-28 17:50 . 2012-02-28 21:02 -------- d-----w- C:\_OTL
2012-02-28 10:55 . 2012-02-28 10:55 -------- d-----w- c:\programme\7-Zip
2012-02-22 20:18 . 2012-02-22 20:18 -------- d-----r- c:\dokumente und einstellungen\LocalService\Favoriten
2012-02-16 19:58 . 2012-01-11 19:06 3072 ------w- c:\windows\system32\iacenc.dll
2012-02-16 19:58 . 2012-01-11 19:06 3072 ------w- c:\windows\system32\dllcache\iacenc.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-01-12 17:20 . 2006-01-27 01:00 1860096 ----a-w- c:\windows\system32\win32k.sys
2012-01-02 17:45 . 2011-06-16 10:31 414368 ----a-w- c:\windows\system32\FlashPlayerCPLApp.cpl
2012-01-21 18:45 . 2011-10-04 15:38 121816 ----a-w- c:\programme\mozilla firefox\components\browsercomps.dll
2004-08-04 12:00 94800 --sh--w- c:\windows\twain.dll
2008-04-14 02:22 50688 --sh--w- c:\windows\twain_32.dll
2011-02-08 13:33 978944 --sha-w- c:\windows\system32\mfc42.dll
2008-04-14 02:22 57344 --sh--w- c:\windows\system32\msvcirt.dll
2008-04-14 02:22 413696 --sha-w- c:\windows\system32\msvcp60.dll
2008-04-14 02:22 343040 --sha-w- c:\windows\system32\msvcrt.dll
2010-12-20 17:32 551936 --sh--w- c:\windows\system32\oleaut32.dll
2008-04-14 02:22 84992 --sh--w- c:\windows\system32\olepro32.dll
2008-04-14 02:22 12288 --sha-w- c:\windows\system32\regsvr32.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WMPNSCFG"="c:\programme\Windows Media Player\WMPNSCFG.exe" [2006-11-03 204288]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Verknüpfung mit der High Definition Audio-Eigenschaftenseite"="HDAShCut.exe" [2005-01-07 61952]
"Mouse Suite 98 Daemon"="ICO.EXE" [2007-04-26 49152]
"SoundMAXPnP"="c:\programme\Analog Devices\Core\smax4pnp.exe" [2006-12-18 868352]
"DLA"="c:\windows\System32\DLA\DLACTRLW.EXE" [2006-02-02 122940]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2006-10-06 98304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2006-10-06 114688]
"Persistence"="c:\windows\system32\igfxpers.exe" [2006-10-06 94208]
"avgnt"="c:\programme\Avira\AntiVir Desktop\avgnt.exe" [2011-03-04 281768]
"SunJavaUpdateSched"="c:\programme\Gemeinsame Dateien\Java\Java Update\jusched.exe" [2010-10-29 249064]
"cssauth"="c:\programme\Lenovo\Client Security Solution\cssauth.exe" [2006-05-12 2333440]
"APSDaemon"="c:\programme\Gemeinsame Dateien\Apple\Apple Application Support\APSDaemon.exe" [2011-09-27 59240]
"QuickTime Task"="c:\programme\QuickTime\QTTask.exe" [2011-10-24 421888]
"Adobe Reader Speed Launcher"="c:\programme\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-01-03 37296]
"Adobe ARM"="c:\programme\Gemeinsame Dateien\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Run]
"CTFMON.EXE"="c:\windows\system32\CTFMON.EXE" [2008-04-14 15360]
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^Adobe Gamma Loader.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\Adobe Gamma Loader.lnk
backup=c:\windows\pss\Adobe Gamma Loader.lnkCommon Startup
.
[HKLM\~\startupfolder\C:^Dokumente und Einstellungen^All Users^Startmenü^Programme^Autostart^WinZip Quick Pick.lnk]
path=c:\dokumente und einstellungen\All Users\Startmenü\Programme\Autostart\WinZip Quick Pick.lnk
backup=c:\windows\pss\WinZip Quick Pick.lnkCommon Startup
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}]
2007-05-29 17:41 149040 ----a-w- c:\programme\Gemeinsame Dateien\Ahead\Lib\NMBgMonitor.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPDJ Taskbar Utility]
2002-03-28 08:41 188416 ----a-w- c:\windows\system32\spool\drivers\w32x86\3\hpztsb05.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\HPWUTOOLBOX]
2005-09-19 09:31 352256 ----a-w- c:\programme\HP\HP Officejet Pro K550 Series\Toolbox\HPWUTBX.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDService.exe]
2006-03-13 14:38 41472 ----a-r- c:\programme\Lenovo\SafeGuard PrivateDisk\pdservice.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\WMPNSCFG]
2006-11-03 07:56 204288 ----a-w- c:\programme\Windows Media Player\wmpnscfg.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Monitoring\SymantecFirewall]
"DisableMonitoring"=dword:00000001
.
[HKLM\~\services\sharedaccess\parameters\firewallpolicy\standardprofile\AuthorizedApplications\List]
"%windir%\\system32\\sessmgr.exe"=
"%windir%\\Network Diagnostic\\xpnetdiag.exe"=
"c:\\Programme\\Mozilla Firefox\\firefox.exe"=
"c:\\Dokumente und Einstellungen\\Kathi\\Eigene Dateien\\Multimessenger\\MESSENGR.EXE"=
"c:\\Programme\\Microsoft Office\\Office12\\ONENOTE.EXE"=
"c:\\Programme\\VideoLAN\\VLC\\vlc.exe"=
"c:\\Programme\\Google\\Google Earth\\client\\googleearth.exe"=
"c:\\Programme\\Gemeinsame Dateien\\Apple\\Apple Application Support\\WebKit2WebProcess.exe"=
.
R2 AAV UpdateService;AAV UpdateService;c:\programme\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [24.10.2008 16:35 128296]
R2 AntiVirMailService;Avira AntiVir MailGuard;c:\programme\Avira\AntiVir Desktop\avmailc.exe [09.04.2011 13:34 340136]
R2 AntiVirSchedulerService;Avira AntiVir Planer;c:\programme\Avira\AntiVir Desktop\sched.exe [15.05.2009 15:14 136360]
R2 AntiVirWebService;Avira AntiVir WebGuard;c:\programme\Avira\AntiVir Desktop\avwebgrd.exe [09.04.2011 13:34 428200]
R2 PrivateDisk;PrivateDisk;c:\programme\Lenovo\SafeGuard PrivateDisk\privatediskm.sys [13.03.2006 15:05 58368]
R2 smi2;smi2;c:\programme\SMI2\smi2.sys [12.05.2006 17:10 3968]
S2 gupdate;Google Update Service (gupdate);c:\programme\Google\Update\GoogleUpdate.exe [07.01.2010 17:19 135664]
S3 gupdatem;Google Update-Dienst (gupdatem);c:\programme\Google\Update\GoogleUpdate.exe [07.01.2010 17:19 135664]
S3 pelps2m;PS/2 Mouse Filter Driver;c:\windows\system32\drivers\pelps2m.sys [31.07.2007 03:42 18048]
S3 SE1008mdm;Sony Ericsson SE1008 Mobile Device Full USB Driver;c:\windows\system32\drivers\SE1008mdm.sys [15.05.2010 11:48 58536]
.
Inhalt des "geplante Tasks" Ordners
.
2012-02-23 c:\windows\Tasks\20110926_182700_Helmi6.job
- c:\programme\Nero\Nero 7\Nero BackItUp\BackItUp.exe [2007-05-24 15:37]
.
2012-02-28 c:\windows\Tasks\AppleSoftwareUpdate.job
- c:\programme\Apple Software Update\SoftwareUpdate.exe [2011-06-01 16:57]
.
2012-02-29 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-07 16:19]
.
2012-02-29 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\programme\Google\Update\GoogleUpdate.exe [2010-01-07 16:19]
.
2012-02-29 c:\windows\Tasks\User_Feed_Synchronization-{32D825F6-723A-4824-9E1E-74B523A8F526}.job
- c:\windows\system32\msfeedssync.exe [2006-10-17 01:01]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
IE: Nach Microsoft &Excel exportieren - c:\progra~1\MICROS~2\Office10\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
LSP: c:\programme\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\dokumente und einstellungen\Helmi\Anwendungsdaten\Mozilla\Firefox\Profiles\j4006pnc.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - user.js: yahoo.homepage.dontask - true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Notify-NavLogon - (no file)
AddRemove-Adobe Photoshop Elements 2.0 - c:\windows\ISUN0407.EXE
AddRemove-ArcSoft PhotoImpression - c:\windows\IsUn0407.exe
AddRemove-HP Fotodruckprogramm - c:\windows\IsUn0407.exe
AddRemove-Microsoft Interactive Training - c:\windows\IsUn0407.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-02-29 13:47
Windows 5.1.2600 Service Pack 3 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'winlogon.exe'(664)
c:\windows\system32\igfxdev.dll
.
- - - - - - - > 'lsass.exe'(720)
c:\programme\Avira\AntiVir Desktop\avsda.dll
.
Zeit der Fertigstellung: 2012-02-29 13:50:14
ComboFix-quarantined-files.txt 2012-02-29 12:50
.
Vor Suchlauf: 19 Verzeichnis(se), 67.343.536.128 Bytes frei
Nach Suchlauf: 23 Verzeichnis(se), 67.752.726.528 Bytes frei
.
WindowsXP-KB310994-SP2-Pro-BootDisk-DEU.exe
[boot loader]
timeout=2
default=multi(0)disk(0)rdisk(0)partition(1)\WINDOWS
[operating systems]
c:\cmdcons\BOOTSECT.DAT="Microsoft Windows Recovery Console" /cmdcons
UnsupportedDebug="do not select this" /debug
multi(0)disk(0)rdisk(0)partition(1)\WINDOWS="Microsoft Windows XP Professional" /noexecute=optin /fastdetect
.
- - End Of File - - 445D5FDFC712E523F7DEFA9FD189D193
|
|
29.02.2012, 14:06
| #15 |
| /// Malware-holic | Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen malwarebytes: Downloade Dir bitte Malwarebytes
__________________ -Verdächtige mails bitte an uns zur Analyse weiterleiten: markusg.trojaner-board@web.de Weiterleiten Anleitung: http://markusg.trojaner-board.de Mails bitte vorerst nach obiger Anleitung an markusg.trojaner-board@web.de Weiterleiten Wenn Ihr uns unterstützen möchtet |
|
| Themen zu Aus Sicherheitsgründen wurde Ihr Windowssystem blockiert - Bezahlen und runterlasen |
| achtung, anti, anti vir, blockiert, community, einfach, erstellen, files, funde, hallo zusammen, hoffe, interne, internet, internetverbindung, meldung, neu, ohne internetverbindung, problem, rechner, runterladen, software, verbindung, windowssystem gesperrt virus bezahlen entfernen, woche, würde, zusammen |
Linear-Darstellung
