| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP)Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
18.06.2013, 09:03
| #1 |
| |  BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Hallo, ich habe mir so eine doooofe BKA-Sperrung (Trojaner) eingefangen. Der PC fährt hoch, für ein paar Sekunden ist mein Desktop ganz normal, dann wird der Bildschirm weiß, nur der Mauszeiger ist zu sehen. Der Task-Manager läßt sich nicht mehr öffnen. Das geht nur ganz kurz vor dem weißen Bildschirm. Reicht aber zeitlich nicht um Prozesse zu killen. Im abgesicherten Modus blinkt ein kleiner weißer Strich aber eine Eingabe ist nicht möglich. Dann öffnet sich XP im abgesicherten Modus. Aber auch hier kommt der weiße Bildschirm. Ich habe an dem Rechner keine Adminrechte und bin nun mit einem Notebook ohne Brenner (CD-Laufwerk defekt) im Netz. Was kann ich tun ??? |
|
18.06.2013, 09:29
| #2 |
| /// the machine /// TB-Ausbilder    | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Hi,
__________________alle 3 SafeMode Varianten versucht? LAN Kabel aus dem Rechner ziehen und dann booten? Im SAfe Mode sollte neben deinem Benutzerkonto auch das standardmäßig installierte Adminkonto angezeigt werden, Login dort bringt Abhilfe?
__________________ |
|
18.06.2013, 10:10
| #3 |
| | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Ok... in Variante 3 (abges. Modus mit Eingabeaufforderung) läßt sich der Taskmanager öffnen und bleibt. Folgende Prozesse werden angezeigt:
__________________cmd.exe csrss.exe Leerlaufprozess lsass.exe services.exe smss.exe svchost.exe svchost.exe svchost.exe System taskmgr.exe winlogon.ex wmiprvse.exe <- nicht immer sichtbar Was ist weiter zu tun? ****************************** Habe hier was beim googlen gefunden: Datei: smss.exe Dies ist das Subsystem des Sitzungs-Managers, das für das Starten einer Benutzer-Sitzung zuständig ist. Dieser Prozess wird vom Thread des Hauptsystems initialisiert und ist für verschiedene Aktivitäten zuständig, einschließlich des Starts der Prozesse "Winlogon" und "Win32" (Csrss.exe) und des Einstellens der Systemvariablen. Nachdem er diese Prozesse gestartet hat, wartet er darauf, dass entweder Winlogon oder Csrss beendet wird. Wenn dies auf normale Weise geschieht, wird das System heruntergefahren; Wenn dies auf unerwartete Weise geschieht, verursacht "smss.exe", dass das System nicht mehr reagiert (hängt). smss.exe Windows Prozess - Was ist das? Wichtig: Die Datei "smss.exe" befindet sich im Ordner C:\Windows\System32. Wenn das nicht der Fall ist, handelt es sich bei smss.exe um einen Virus, Spyware, Trojaner oder Worm! und Charakteristik: ssonsvr.exe befindet sich in einem Unterordner von "C:\Program Files" oder manchmal in einem Unterordner von C:\ - z.B. C:\Program Files\Citrix\ICA Client\. Bekannte Dateigrößen unter Windows 7/XP sind 16656 Bytes (65% aller Vorkommen), 37136 Bytes und 10 weitere Varianten. hxxp://www.file.net/prozess/ssonsvr.exe.html Das Programm hat kein sichtbares Fenster. Die Datei ist keine Windows System Datei. Sie enthält keine Auskunft über die Entwickler. Deshalb bewerten wir diese Datei zu 49% als gefährlich, aber vergleichen Sie diese Wertung mit den Mitglieder Meinungen. Sie können Folgendes tun: beim Hersteller Citrix um Unterstützung bitten das Programm von Ihrem PC löschen (Systemsteuerung ⇒ Software ⇒ Citrix ICA Client oder MetaFrame Presentation Server) Hinweis: Viren und andere schädliche Dateien können sich als ssonsvr.exe tarnen. Insbesondere, wenn sich die Datei in C:\Windows oder C:\Windows\System32 Ordner befindet. Bitte kontrollieren Sie deshalb, ob es sich bei dem Prozess ssonsvr.exe auf Ihrem PC um einen Schädling handelt. ************************************************ Wie kann ich das jetzt kontrollieren? Ich weiß nicht, wie ich in diesem Modus an den Windows Explorer komme. Kann ich einfach diese beiden Prozesse beenden? Bringt das was im abgesicherten Modus? Bin in der Sache halt was grün hinter den Ohren. Geändert von eine_jojo (18.06.2013 um 10:39 Uhr) |
|
18.06.2013, 12:29
| #4 |
| /// the machine /// TB-Ausbilder | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Tasmanager > neuer Task > Explorer.exe geht das? Desktop da?
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.06.2013, 12:36
| #5 |
| | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Ja... Desktop ist da. Ich lasse jetzt den OTL Scan laufen... OTL Scan:OTL Logfile:OTL Logfile: Code:
ATTFilter OTL logfile created on: 18.06.2013 13:50:03 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = F:\ Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation Internet Explorer (Version = 8.0.6001.18702) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3,45 Gb Total Physical Memory | 3,20 Gb Available Physical Memory | 92,73% Memory free 5,30 Gb Paging File | 5,22 Gb Available in Paging File | 98,66% Paging File free Paging file location(s): C:\pagefile.sys 2046 4092 [binary data] %SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme Drive C: | 68,36 Gb Total Space | 54,57 Gb Free Space | 79,83% Space Free | Partition Type: NTFS Drive D: | 229,72 Gb Total Space | 227,94 Gb Free Space | 99,23% Space Free | Partition Type: NTFS Drive F: | 119,29 Mb Total Space | 67,40 Mb Free Space | 56,50% Space Free | Partition Type: FAT32 Computer Name: F9999-0TA156389 | User Name: Xy | NOT logged in as Administrator. Boot Mode: SafeMode | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2013.06.18 09:33:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- F:\OTL.exe PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe PRC - [2008.04.14 07:52:40 | 000,401,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe ========== Modules (No Company Name) ========== MOD - [2008.05.02 06:15:38 | 000,010,240 | ---- | M] () -- C:\Programme\Unlocker\UnlockerCOM.dll MOD - [2005.10.19 12:56:28 | 000,125,952 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll ========== Services (SafeList) ========== SRV - File not found [Disabled | Unknown] -- %SystemRoot%\System32\hidserv.dll -- (HidServ) SRV - [2013.02.25 12:02:54 | 000,232,472 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service) SRV - [2013.02.25 11:22:54 | 001,543,704 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service) SRV - [2011.11.03 20:25:08 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Unknown] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6) SRV - [2011.11.03 16:05:39 | 000,550,640 | ---- | M] (Sophos Plc) [On_Demand | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\sdcservice.exe -- (Sophos Device Control Service) SRV - [2011.11.03 16:02:08 | 000,806,912 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Remote Management System\RouterNT.exe -- (Sophos Message Router) SRV - [2011.11.03 16:01:26 | 000,282,624 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Remote Management System\ManagementAgentNT.exe -- (Sophos Agent) SRV - [2011.05.23 16:47:50 | 000,112,800 | ---- | M] (Intel Corporation) [Auto | Unknown] -- C:\WINDOWS\system32\IPROSetMonitor.exe -- (Intel(R) SRV - [2011.02.04 15:05:06 | 000,097,520 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService) SRV - [2011.02.04 15:04:14 | 000,163,056 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService) SRV - [2010.04.16 12:45:14 | 001,111,120 | ---- | M] (NCP Engineering GmbH) [Auto | Unknown] -- C:\Programme\NCP\SecureClient\NCPRWSNT.EXE -- (ncprwsnt) SRV - [2010.02.03 14:45:40 | 000,819,712 | ---- | M] () [Auto | Unknown] -- C:\Programme\NCP\SecureClient\rwsrsu.exe -- (rwsrsu) SRV - [2009.11.19 12:57:34 | 000,091,648 | ---- | M] () [Auto | Unknown] -- C:\Programme\NCP\SecureClient\NCPSEC.EXE -- (NcpSec) SRV - [2008.06.30 14:22:40 | 000,086,016 | ---- | M] (NCP engineering GmbH) [Auto | Unknown] -- C:\Programme\NCP\SecureClient\ncpclcfg.exe -- (ncpclcfg) SRV - [2008.04.14 14:23:30 | 000,118,784 | ---- | M] (Gemplus) [Auto | Unknown] -- C:\Programme\Gemalto\Classic Client\BIN\GCardSrvNT.exe -- (GemSAFE Card Server) SRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl) SRV - [2007.10.19 16:09:52 | 000,057,344 | ---- | M] (Gemalto) [Auto | Unknown] -- C:\Programme\Gemalto\Classic Client\BIN\GslShmSrvc.exe -- (GslShmSrvc ) SRV - [2005.04.27 15:59:24 | 000,241,725 | ---- | M] (Microsoft Corporation) [Auto | Unknown] -- C:\Programme\UPHClean\uphclean.exe -- (UPHClean) SRV - [2005.03.22 20:14:10 | 000,110,592 | ---- | M] () [Auto | Unknown] -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Unknown] -- -- (WDICA) DRV - File not found [Adapter | Unavailable | Unknown] -- -- (PnSson) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDRFRAME) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDRELI) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDFRAME) DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDCOMP) DRV - File not found [Kernel | System | Unknown] -- -- (PCIDump) DRV - File not found [Kernel | System | Unknown] -- -- (lbrtfdc) DRV - File not found [Kernel | System | Unknown] -- -- (i2omgmt) DRV - File not found [Kernel | System | Unknown] -- -- (Changer) DRV - [2011.06.28 03:12:42 | 000,030,368 | ---- | M] (Intel Corporation ) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\iqvw32.sys -- (NAL) DRV - [2011.05.04 17:16:06 | 000,192,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\e1k5132.sys -- (e1kexpress) DRV - [2011.02.21 12:41:34 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\gdrv.sys -- (gdrv) DRV - [2011.02.04 15:06:01 | 000,024,064 | ---- | M] (Sophos Plc) [File_System | System | Unknown] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter) DRV - [2011.02.04 15:05:08 | 000,153,344 | ---- | M] (Sophos Plc) [File_System | System | Unknown] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl) DRV - [2010.09.13 09:06:26 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Unknown] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver) DRV - [2010.09.13 09:05:59 | 000,023,928 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\sdcfilter.sys -- (sdcfilter) DRV - [2010.07.14 13:51:56 | 000,065,584 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Unknown] -- C:\WINDOWS\system32\drivers\ctxusbm.sys -- (ctxusbm) DRV - [2010.01.18 23:50:10 | 000,235,520 | R--- | M] (Intel(R) Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\IntcDAud.sys -- (IntcDAud) DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (ncpvaxp) DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFiltMP) DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFilt) DRV - [2009.10.21 05:22:32 | 001,425,280 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService) DRV - [2009.09.17 22:54:14 | 000,041,088 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI) DRV - [2009.06.25 08:07:44 | 005,095,936 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService) DRV - [2009.06.25 08:07:40 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt) DRV - [2009.06.25 08:07:40 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt) DRV - [2008.06.21 06:44:12 | 000,013,824 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\tpm.sys -- (tpm) DRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl) DRV - [2005.01.13 16:20:36 | 000,012,500 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum) DRV - [2004.12.14 02:00:00 | 000,578,432 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\fus2base.sys -- (FUS2BASE) DRV - [2004.12.14 02:00:00 | 000,053,120 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\avmcowan.sys -- (AVMCOWAN) DRV - [2004.11.13 20:32:12 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Unknown] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (Aspi32) DRV - [2004.11.05 12:39:08 | 000,082,148 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr) DRV - [2004.10.19 14:40:56 | 000,028,207 | ---- | M] (IVT Corporation) [Kernel | Boot | Unknown] -- C:\WINDOWS\system32\drivers\BTHidMgr.sys -- (BTHidMgr) DRV - [2004.10.19 14:37:38 | 000,061,312 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm) DRV - [2004.10.19 12:39:26 | 000,020,096 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio) DRV - [2004.09.21 19:15:34 | 000,010,804 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT) DRV - [2004.08.13 12:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?} IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.forestle.org/ IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A} IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 10.82.*.*;192.168.*.* ========== FireFox ========== FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.) FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN) O1 HOSTS File: ([2006.02.28 05:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc) O4 - HKLM..\Run: [ConnectionCenter] C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.) O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de) O4 - HKLM..\Run: [NcpBudgetGui] C:\Programme\NCP\SecureClient\NcpBudgetGui.exe () O4 - HKLM..\Run: [NcpPopup] C:\Programme\NCP\SecureClient\ncppopup.exe () O4 - HKLM..\Run: [NcpRsuGui] C:\Programme\NCP\SecureClient\rwsrsu.exe () O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc) O4 - Startup: C:\Dokumente und Einstellungen\Xy\Startmenü\Programme\Autostart\Temporäre Daten löschen.lnk = C:\Treiber_Software\Scripte\DelTemp.cmd () O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1 O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc) O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc) O15 - HKCU\..Trusted Domains: wald-rlp.de ([webaccess] https in Vertrauenswürdige Sites) O15 - HKCU\..Trusted Domains: zebit.de ([wi] http in Vertrauenswürdige Sites) O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool) O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284027598921 (WUWebControl Class) O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1302600522627 (MUWebControl Class) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24) O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A2BCF253-89AB-469E-B7B3-D8E63E22EA5B}: DhcpNameServer = 192.168.1.116 192.168.1.117 10.82.6.200 10.82.6.201 O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.) O18 - Protocol\Filter\text/xml - No CLSID value found O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc) O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: GinaDLL - (ncpgina1.dll) - C:\WINDOWS\System32\ncpgina1.dll (NCP) O20 - HKCU Winlogon: Shell - (C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx) - C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx () O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation) O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\Xy\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\Xy\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp O31 - SafeBoot: UseAlternatShell - 1 O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2010.08.11 14:18:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ] O32 - AutoRun File - [2013.04.23 09:14:02 | 000,000,000 | ---D | M] - D:\Autogenes Training_2010-2011 -- [ NTFS ] O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell - "" = AutoRun O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell\AutoRun - "" = Auto&Play O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a O34 - HKLM BootExecute: (autocheck autochk *) O34 - HKLM BootExecute: (pgdfgsvc C 1) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) ========== Files/Folders - Created Within 30 Days ========== [2013.06.18 13:47:01 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\Xy\Recent [2013.06.18 07:18:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbwg [2013.06.18 07:18:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\Xy\Lokale Einstellungen\Anwendungsdaten\Sophos [2013.06.18 07:16:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun [14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2013.06.18 13:25:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat [2013.06.18 13:24:24 | 000,013,507 | ---- | M] () -- C:\WINDOWS\slssyi.kqf [2013.06.18 13:24:22 | 000,052,228 | ---- | M] () -- C:\WINDOWS\iylajp.baq [2013.06.18 13:06:46 | 000,458,732 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat [2013.06.18 13:06:46 | 000,440,820 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat [2013.06.18 13:06:46 | 000,084,698 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat [2013.06.18 13:06:46 | 000,071,138 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat [2013.06.18 07:21:13 | 000,066,839 | ---- | M] () -- C:\WINDOWS\pxbjvf.jdk [2013.06.18 07:20:02 | 000,062,129 | ---- | M] () -- C:\WINDOWS\derx.ovb [2013.06.18 07:19:35 | 000,281,920 | ---- | M] () -- C:\WINDOWS\egxd.nyh [2013.06.18 07:18:28 | 000,290,470 | ---- | M] () -- C:\WINDOWS\mca.ech [2013.06.17 07:55:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl [2013.06.12 07:00:09 | 000,000,244 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Citrix XenApp6 - intern.url [14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2013.06.18 07:19:45 | 000,062,129 | ---- | C] () -- C:\WINDOWS\derx.ovb [2013.06.18 07:19:45 | 000,013,507 | ---- | C] () -- C:\WINDOWS\slssyi.kqf [2013.06.18 07:19:35 | 000,281,920 | ---- | C] () -- C:\WINDOWS\egxd.nyh [2013.06.18 07:18:28 | 000,290,470 | ---- | C] () -- C:\WINDOWS\mca.ech [2013.06.18 07:18:28 | 000,052,228 | ---- | C] () -- C:\WINDOWS\iylajp.baq [2013.06.18 07:17:34 | 000,066,839 | ---- | C] () -- C:\WINDOWS\pxbjvf.jdk [2013.03.05 08:51:06 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini [2012.11.28 15:17:42 | 000,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys [2012.11.28 15:17:39 | 000,012,500 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys [2012.07.13 15:27:32 | 000,190,464 | ---- | C] () -- C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx [2011.11.03 16:01:48 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll [2011.11.03 16:01:48 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe ========== ZeroAccess Check ========== [2010.08.11 14:19:17 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini [HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] [HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] "" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 07:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Apartment [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] "" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Free [HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] "" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation) "ThreadingModel" = Both < End of report > Wenn ich hier richtig gestöbert habe, sollte ich den Inhalt vom OTL.Txt Editor unter 'Benutzerdefinierte Scans/Fixes' einfügen und 'Fix' aktivieren... Geändert von eine_jojo (18.06.2013 um 13:13 Uhr) |
|
18.06.2013, 13:29
| #6 |
| /// the machine /// TB-Ausbilder | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP)Fixen mit OTL
Code:
ATTFilter :OTL
O20 - HKCU Winlogon: Shell - (C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx) - C:\Dokumente und Einstellungen\Xy\Anwendungsdaten\dbu32.ocx ()
[2013.06.18 07:18:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbwg
[2013.06.18 13:24:24 | 000,013,507 | ---- | M] () -- C:\WINDOWS\slssyi.kqf
[2013.06.18 13:24:22 | 000,052,228 | ---- | M] () -- C:\WINDOWS\iylajp.baq
[2013.06.18 07:21:13 | 000,066,839 | ---- | M] () -- C:\WINDOWS\pxbjvf.jdk
[2013.06.18 07:20:02 | 000,062,129 | ---- | M] () -- C:\WINDOWS\derx.ovb
[2013.06.18 07:19:35 | 000,281,920 | ---- | M] () -- C:\WINDOWS\egxd.nyh
[2013.06.18 07:18:28 | 000,290,470 | ---- | M] () -- C:\WINDOWS\mca.ech
:Commands
[emptytemp]
__________________ --> BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) |
|
18.06.2013, 13:55
| #7 |
| | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Es hat leider nicht funktioniert. Nach dem Neustart kam weiterhin der weiße Bildschirm. Im Virenscanner konnte ich gerade noch so lesen, daß ein Buffer Overflow (C:\windows\system32\svchost.exe) entdeckt wurde. Hier der Logfile nach dem Fix: Error: Unable to interpret <OTL Logfile: Code:
ATTFilter OTL logfile created on: 18.06.2013 13:50:03 - Run 1> in the current context! Error: Unable to interpret <OTL by OldTimer - Version 3.2.69.0 Folder = F:\> in the current context! Error: Unable to interpret <Windows XP Professional Edition Service Pack 3 (Version = 5.1.2600) - Type = NTWorkstation> in the current context! Error: Unable to interpret <Internet Explorer (Version = 8.0.6001.18702)> in the current context! Error: Unable to interpret <Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <3,45 Gb Total Physical Memory | 3,20 Gb Available Physical Memory | 92,73% Memory free> in the current context! Error: Unable to interpret <5,30 Gb Paging File | 5,22 Gb Available in Paging File | 98,66% Paging File free> in the current context! Error: Unable to interpret <Paging file location(s): C:\pagefile.sys 2046 4092 [binary data]> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <%SystemDrive% = C: | %SystemRoot% = C:\WINDOWS | %ProgramFiles% = C:\Programme> in the current context! Error: Unable to interpret <Drive C: | 68,36 Gb Total Space | 54,57 Gb Free Space | 79,83% Space Free | Partition Type: NTFS> in the current context! Error: Unable to interpret <Drive D: | 229,72 Gb Total Space | 227,94 Gb Free Space | 99,23% Space Free | Partition Type: NTFS> in the current context! Error: Unable to interpret <Drive F: | 119,29 Mb Total Space | 67,40 Mb Free Space | 56,50% Space Free | Partition Type: FAT32> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <Computer Name: F9999-0TA156389 | User Name: **** | NOT logged in as Administrator.> in the current context! Error: Unable to interpret <Boot Mode: SafeMode | Scan Mode: Current user> in the current context! Error: Unable to interpret <Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Processes (SafeList) ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <PRC - [2013.06.18 09:33:22 | 000,602,112 | ---- | M] (OldTimer Tools) -- F:\OTL.exe> in the current context! Error: Unable to interpret <PRC - [2008.04.14 07:52:46 | 001,036,800 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\explorer.exe> in the current context! Error: Unable to interpret <PRC - [2008.04.14 07:52:40 | 000,401,920 | ---- | M] (Microsoft Corporation) -- C:\WINDOWS\system32\cmd.exe> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Modules (No Company Name) ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <MOD - [2008.05.02 06:15:38 | 000,010,240 | ---- | M] () -- C:\Programme\Unlocker\UnlockerCOM.dll> in the current context! Error: Unable to interpret <MOD - [2005.10.19 12:56:28 | 000,125,952 | ---- | M] () -- C:\Programme\WinRAR\RarExt.dll> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Services (SafeList) ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <SRV - File not found [Disabled | Unknown] -- %SystemRoot%\System32\hidserv.dll -- (HidServ)> in the current context! Error: Unable to interpret <SRV - [2013.02.25 12:02:54 | 000,232,472 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\AutoUpdate\ALsvc.exe -- (Sophos AutoUpdate Service)> in the current context! Error: Unable to interpret <SRV - [2013.02.25 11:22:54 | 001,543,704 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\Web Intelligence\swi_service.exe -- (swi_service)> in the current context! Error: Unable to interpret <SRV - [2011.11.03 20:25:08 | 002,358,656 | ---- | M] (TeamViewer GmbH) [Auto | Unknown] -- C:\Programme\TeamViewer\Version6\TeamViewer_Service.exe -- (TeamViewer6)> in the current context! Error: Unable to interpret <SRV - [2011.11.03 16:05:39 | 000,550,640 | ---- | M] (Sophos Plc) [On_Demand | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\sdcservice.exe -- (Sophos Device Control Service)> in the current context! Error: Unable to interpret <SRV - [2011.11.03 16:02:08 | 000,806,912 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Remote Management System\RouterNT.exe -- (Sophos Message Router)> in the current context! Error: Unable to interpret <SRV - [2011.11.03 16:01:26 | 000,282,624 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Remote Management System\ManagementAgentNT.exe -- (Sophos Agent)> in the current context! Error: Unable to interpret <SRV - [2011.05.23 16:47:50 | 000,112,800 | ---- | M] (Intel Corporation) [Auto | Unknown] -- C:\WINDOWS\system32\IPROSetMonitor.exe -- (Intel(R)> in the current context! Error: Unable to interpret <SRV - [2011.02.04 15:05:06 | 000,097,520 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\SavService.exe -- (SAVService)> in the current context! Error: Unable to interpret <SRV - [2011.02.04 15:04:14 | 000,163,056 | ---- | M] (Sophos Plc) [Auto | Unknown] -- C:\Programme\Sophos\Sophos Anti-Virus\SAVAdminService.exe -- (SAVAdminService)> in the current context! Error: Unable to interpret <SRV - [2010.04.16 12:45:14 | 001,111,120 | ---- | M] (NCP Engineering GmbH) [Auto | Unknown] -- C:\Programme\NCP\SecureClient\NCPRWSNT.EXE -- (ncprwsnt)> in the current context! Error: Unable to interpret <SRV - [2010.02.03 14:45:40 | 000,819,712 | ---- | M] () [Auto | Unknown] -- C:\Programme\NCP\SecureClient\rwsrsu.exe -- (rwsrsu)> in the current context! Error: Unable to interpret <SRV - [2009.11.19 12:57:34 | 000,091,648 | ---- | M] () [Auto | Unknown] -- C:\Programme\NCP\SecureClient\NCPSEC.EXE -- (NcpSec)> in the current context! Error: Unable to interpret <SRV - [2008.06.30 14:22:40 | 000,086,016 | ---- | M] (NCP engineering GmbH) [Auto | Unknown] -- C:\Programme\NCP\SecureClient\ncpclcfg.exe -- (ncpclcfg)> in the current context! Error: Unable to interpret <SRV - [2008.04.14 14:23:30 | 000,118,784 | ---- | M] (Gemplus) [Auto | Unknown] -- C:\Programme\Gemalto\Classic Client\BIN\GCardSrvNT.exe -- (GemSAFE Card Server)> in the current context! Error: Unable to interpret <SRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl)> in the current context! Error: Unable to interpret <SRV - [2007.10.19 16:09:52 | 000,057,344 | ---- | M] (Gemalto) [Auto | Unknown] -- C:\Programme\Gemalto\Classic Client\BIN\GslShmSrvc.exe -- (GslShmSrvc )> in the current context! Error: Unable to interpret <SRV - [2005.04.27 15:59:24 | 000,241,725 | ---- | M] (Microsoft Corporation) [Auto | Unknown] -- C:\Programme\UPHClean\uphclean.exe -- (UPHClean)> in the current context! Error: Unable to interpret <SRV - [2005.03.22 20:14:10 | 000,110,592 | ---- | M] () [Auto | Unknown] -- C:\Programme\IVT Corporation\BlueSoleil\BTNtService.exe -- (BlueSoleil Hid Service)> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Driver Services (SafeList) ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] -- -- (WDICA)> in the current context! Error: Unable to interpret <DRV - File not found [Adapter | Unavailable | Unknown] -- -- (PnSson)> in the current context! Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDRFRAME)> in the current context! Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDRELI)> in the current context! Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDFRAME)> in the current context! Error: Unable to interpret <DRV - File not found [Kernel | On_Demand | Unknown] -- -- (PDCOMP)> in the current context! Error: Unable to interpret <DRV - File not found [Kernel | System | Unknown] -- -- (PCIDump)> in the current context! Error: Unable to interpret <DRV - File not found [Kernel | System | Unknown] -- -- (lbrtfdc)> in the current context! Error: Unable to interpret <DRV - File not found [Kernel | System | Unknown] -- -- (i2omgmt)> in the current context! Error: Unable to interpret <DRV - File not found [Kernel | System | Unknown] -- -- (Changer)> in the current context! Error: Unable to interpret <DRV - [2011.06.28 03:12:42 | 000,030,368 | ---- | M] (Intel Corporation ) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\iqvw32.sys -- (NAL)> in the current context! Error: Unable to interpret <DRV - [2011.05.04 17:16:06 | 000,192,168 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\e1k5132.sys -- (e1kexpress)> in the current context! Error: Unable to interpret <DRV - [2011.02.21 12:41:34 | 000,017,488 | ---- | M] (Windows (R) 2000 DDK provider) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\gdrv.sys -- (gdrv)> in the current context! Error: Unable to interpret <DRV - [2011.02.04 15:06:01 | 000,024,064 | ---- | M] (Sophos Plc) [File_System | System | Unknown] -- C:\WINDOWS\system32\drivers\savonaccessfilter.sys -- (SAVOnAccessFilter)> in the current context! Error: Unable to interpret <DRV - [2011.02.04 15:05:08 | 000,153,344 | ---- | M] (Sophos Plc) [File_System | System | Unknown] -- C:\WINDOWS\system32\drivers\savonaccesscontrol.sys -- (SAVOnAccessControl)> in the current context! Error: Unable to interpret <DRV - [2010.09.13 09:06:26 | 000,014,976 | ---- | M] (Sophos Plc) [Kernel | Disabled | Unknown] -- C:\WINDOWS\system32\drivers\SophosBootDriver.sys -- (SophosBootDriver)> in the current context! Error: Unable to interpret <DRV - [2010.09.13 09:05:59 | 000,023,928 | ---- | M] (Sophos Plc) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\sdcfilter.sys -- (sdcfilter)> in the current context! Error: Unable to interpret <DRV - [2010.07.14 13:51:56 | 000,065,584 | ---- | M] (Citrix Systems, Inc.) [Kernel | System | Unknown] -- C:\WINDOWS\system32\drivers\ctxusbm.sys -- (ctxusbm)> in the current context! Error: Unable to interpret <DRV - [2010.01.18 23:50:10 | 000,235,520 | R--- | M] (Intel(R) Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\IntcDAud.sys -- (IntcDAud)> in the current context! Error: Unable to interpret <DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (ncpvaxp)> in the current context! Error: Unable to interpret <DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFiltMP)> in the current context! Error: Unable to interpret <DRV - [2009.12.22 19:59:02 | 000,081,320 | ---- | M] (NCP Engineering GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ncpvaxp.sys -- (NcpFilt)> in the current context! Error: Unable to interpret <DRV - [2009.10.21 05:22:32 | 001,425,280 | R--- | M] (VIA Technologies, Inc.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\viahduaa.sys -- (VIAHdAudAddService)> in the current context! Error: Unable to interpret <DRV - [2009.09.17 22:54:14 | 000,041,088 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\HECI.sys -- (HECI)> in the current context! Error: Unable to interpret <DRV - [2009.06.25 08:07:44 | 005,095,936 | ---- | M] (Realtek Semiconductor Corp.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\RtkHDAud.sys -- (IntcAzAudAddService)> in the current context! Error: Unable to interpret <DRV - [2009.06.25 08:07:40 | 001,684,736 | ---- | M] (Creative) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Ambfilt.sys -- (Ambfilt)> in the current context! Error: Unable to interpret <DRV - [2009.06.25 08:07:40 | 001,389,056 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\Monfilt.sys -- (Monfilt)> in the current context! Error: Unable to interpret <DRV - [2008.06.21 06:44:12 | 000,013,824 | R--- | M] (Intel Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\tpm.sys -- (tpm)> in the current context! Error: Unable to interpret <DRV - [2008.04.14 07:52:34 | 000,088,576 | ---- | M] (Microsoft Corporation) [Unknown (-1) | Unknown (-1) | Unknown] -- C:\WINDOWS\system32\wbem\wmiaprpl.dll -- (WmiApRpl)> in the current context! Error: Unable to interpret <DRV - [2005.01.13 16:20:36 | 000,012,500 | ---- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\vbtenum.sys -- (BTHidEnum)> in the current context! Error: Unable to interpret <DRV - [2004.12.14 02:00:00 | 000,578,432 | ---- | M] (AVM Berlin) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\fus2base.sys -- (FUS2BASE)> in the current context! Error: Unable to interpret <DRV - [2004.12.14 02:00:00 | 000,053,120 | ---- | M] (AVM GmbH) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\avmcowan.sys -- (AVMCOWAN)> in the current context! Error: Unable to interpret <DRV - [2004.11.13 20:32:12 | 000,016,877 | ---- | M] (Adaptec) [Kernel | Auto | Unknown] -- C:\WINDOWS\System32\drivers\ASPI32.SYS -- (Aspi32)> in the current context! Error: Unable to interpret <DRV - [2004.11.05 12:39:08 | 000,082,148 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VcommMgr.sys -- (VcommMgr)> in the current context! Error: Unable to interpret <DRV - [2004.10.19 14:40:56 | 000,028,207 | ---- | M] (IVT Corporation) [Kernel | Boot | Unknown] -- C:\WINDOWS\system32\drivers\BTHidMgr.sys -- (BTHidMgr)> in the current context! Error: Unable to interpret <DRV - [2004.10.19 14:37:38 | 000,061,312 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\VComm.sys -- (VComm)> in the current context! Error: Unable to interpret <DRV - [2004.10.19 12:39:26 | 000,020,096 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\blueletaudio.sys -- (BlueletAudio)> in the current context! Error: Unable to interpret <DRV - [2004.09.21 19:15:34 | 000,010,804 | ---- | M] (IVT Corporation) [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\BtNetDrv.sys -- (BT)> in the current context! Error: Unable to interpret <DRV - [2004.08.13 12:56:20 | 000,005,810 | R--- | M] () [Kernel | On_Demand | Unknown] -- C:\WINDOWS\system32\drivers\ASACPI.sys -- (MTsensor)> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Standard Registry (SafeList) ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Internet Explorer ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}> in the current context! Error: Unable to interpret <IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src={referrer:source?}> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://de.forestle.org/> in the current context! Error: Unable to interpret <IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}> in the current context! Error: Unable to interpret <IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://search.live.com/results.aspx?q={searchTerms}&src=IE-SearchBox&Form=IE8SRC> in the current context! Error: Unable to interpret <IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0> in the current context! Error: Unable to interpret <IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = 10.82.*.*;192.168.*.*> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== FireFox ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\WINDOWS\system32\Macromed\Flash\NPSWF32.dll ()> in the current context! Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)> in the current context! Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Programme\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)> in the current context! Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: C:\WINDOWS\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation)> in the current context! Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@tracker-software.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf: C:\Programme\Tracker Software\PDF Viewer\npPDFXCviewNPPlugin.dll (Tracker Software Products Ltd.)> in the current context! Error: Unable to interpret <FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.4: C:\Programme\VideoLAN\VLC\npvlc.dll (VideoLAN)> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <O1 HOSTS File: ([2006.02.28 05:00:00 | 000,000,820 | ---- | M]) - C:\WINDOWS\system32\drivers\etc\hosts> in the current context! Error: Unable to interpret <O1 - Hosts: 127.0.0.1 localhost> in the current context! Error: Unable to interpret <O2 - BHO: (Sophos Web Content Scanner) - {39EA7695-B3F2-4C44-A4BC-297ADA8FD235} - C:\Programme\Sophos\Sophos Anti-Virus\SophosBHO.dll (Sophos Plc)> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [ConnectionCenter] C:\Programme\Citrix\ICA Client\concentr.exe (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [FreePDF Assistant] C:\Programme\FreePDF_XP\fpassist.exe (shbox.de)> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [NcpBudgetGui] C:\Programme\NCP\SecureClient\NcpBudgetGui.exe ()> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [NcpPopup] C:\Programme\NCP\SecureClient\ncppopup.exe ()> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [NcpRsuGui] C:\Programme\NCP\SecureClient\rwsrsu.exe ()> in the current context! Error: Unable to interpret <O4 - HKLM..\Run: [Sophos AutoUpdate Monitor] C:\Programme\Sophos\AutoUpdate\ALMon.exe (Sophos Plc)> in the current context! Error: Unable to interpret <O4 - Startup: C:\Dokumente und Einstellungen\****\Startmenü\Programme\Autostart\Temporäre Daten löschen.lnk = C:\Treiber_Software\Scripte\DelTemp.cmd ()> in the current context! Error: Unable to interpret <O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: HonorAutoRunSetting = 1> in the current context! Error: Unable to interpret <O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145> in the current context! Error: Unable to interpret <O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)> in the current context! Error: Unable to interpret <O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)> in the current context! Error: Unable to interpret <O10 - Protocol_Catalog9\Catalog_Entries\000000000008 - C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\Sophos Web Intelligence\swi_lsp.dll (Sophos Plc)> in the current context! Error: Unable to interpret <O15 - HKCU\..Trusted Domains: wald-rlp.de ([webaccess] https in Vertrauenswürdige Sites)> in the current context! Error: Unable to interpret <O15 - HKCU\..Trusted Domains: zebit.de ([wi] http in Vertrauenswürdige Sites)> in the current context! Error: Unable to interpret <O16 - DPF: {17492023-C23A-453E-A040-C7C580BBF700} hxxp://download.microsoft.com/download/E/5/6/E5611B10-0D6D-4117-8430-A67417AA88CD/LegitCheckControl.cab (Windows Genuine Advantage Validation Tool)> in the current context! Error: Unable to interpret <O16 - DPF: {6414512B-B978-451D-A0D8-FCFDF33E833C} hxxp://update.microsoft.com/windowsupdate/v6/V5Controls/en/x86/client/wuweb_site.cab?1284027598921 (WUWebControl Class)> in the current context! Error: Unable to interpret <O16 - DPF: {6E32070A-766D-4EE6-879C-DC1FA91D2FC3} hxxp://www.update.microsoft.com/microsoftupdate/v6/V5Controls/en/x86/client/muweb_site.cab?1302600522627 (MUWebControl Class)> in the current context! Error: Unable to interpret <O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)> in the current context! Error: Unable to interpret <O16 - DPF: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)> in the current context! Error: Unable to interpret <O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_24-windows-i586.cab (Java Plug-in 1.6.0_24)> in the current context! Error: Unable to interpret <O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A2BCF253-89AB-469E-B7B3-D8E63E22EA5B}: DhcpNameServer = 192.168.1.116 192.168.1.117 10.82.6.200 10.82.6.201> in the current context! Error: Unable to interpret <O18 - Protocol\Handler\ipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)> in the current context! Error: Unable to interpret <O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)> in the current context! Error: Unable to interpret <O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Gemeinsame Dateien\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation)> in the current context! Error: Unable to interpret <O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Gemeinsame Dateien\Microsoft Shared\Web Components\11\OWC11.DLL (Microsoft Corporation)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica; charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=euc-jp {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=ISO-8859-1 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=MS936 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=MS949 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=MS950 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=UTF8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\application/x-ica;charset=UTF-8 {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\ica {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Programme\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)> in the current context! Error: Unable to interpret <O18 - Protocol\Filter\text/xml - No CLSID value found> in the current context! Error: Unable to interpret <O20 - AppInit_DLLs: (C:\PROGRA~1\Sophos\SOPHOS~1\SOPHOS~1.DLL) - C:\Programme\Sophos\Sophos Anti-Virus\sophos_detoured.dll (Sophos Plc)> in the current context! Error: Unable to interpret <O20 - HKLM Winlogon: Shell - (Explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)> in the current context! Error: Unable to interpret <O20 - HKLM Winlogon: UserInit - (C:\WINDOWS\system32\userinit.exe) - C:\WINDOWS\system32\userinit.exe (Microsoft Corporation)> in the current context! Error: Unable to interpret <O20 - HKLM Winlogon: GinaDLL - (ncpgina1.dll) - C:\WINDOWS\System32\ncpgina1.dll (NCP)> in the current context! Error: Unable to interpret <O20 - HKCU Winlogon: Shell - (C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx) - C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx ()> in the current context! Error: Unable to interpret <O20 - HKCU Winlogon: Shell - (explorer.exe) - C:\WINDOWS\explorer.exe (Microsoft Corporation)> in the current context! Error: Unable to interpret <O24 - Desktop Components:0 (Die derzeitige Homepage) - About:Home> in the current context! Error: Unable to interpret <O24 - Desktop WallPaper: C:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp> in the current context! Error: Unable to interpret <O24 - Desktop BackupWallPaper: C:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\Microsoft\Wallpaper1.bmp> in the current context! Error: Unable to interpret <O31 - SafeBoot: UseAlternatShell - 1> in the current context! Error: Unable to interpret <O32 - HKLM CDRom: AutoRun - 1> in the current context! Error: Unable to interpret <O32 - AutoRun File - [2010.08.11 14:18:15 | 000,000,000 | ---- | M] () - C:\AUTOEXEC.BAT -- [ NTFS ]> in the current context! Error: Unable to interpret <O32 - AutoRun File - [2013.04.23 09:14:02 | 000,000,000 | ---D | M] - D:\Autogenes Training_2010-2011 -- [ NTFS ]> in the current context! Error: Unable to interpret <O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell - "" = AutoRun> in the current context! Error: Unable to interpret <O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell\AutoRun - "" = Auto&Play> in the current context! Error: Unable to interpret <O33 - MountPoints2\{71c702bc-3da9-11e0-9845-20cf305556b1}\Shell\AutoRun\command - "" = F:\LaunchU3.exe -a> in the current context! Error: Unable to interpret <O34 - HKLM BootExecute: (autocheck autochk *)> in the current context! Error: Unable to interpret <O34 - HKLM BootExecute: (pgdfgsvc C 1)> in the current context! Error: Unable to interpret <O35 - HKLM\..comfile [open] -- "%1" %*> in the current context! Error: Unable to interpret <O35 - HKLM\..exefile [open] -- "%1" %*> in the current context! Error: Unable to interpret <O37 - HKLM\...com [@ = comfile] -- "%1" %*> in the current context! Error: Unable to interpret <O37 - HKLM\...exe [@ = exefile] -- "%1" %*> in the current context! Error: Unable to interpret <O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)> in the current context! Error: Unable to interpret <O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Files/Folders - Created Within 30 Days ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[2013.06.18 13:47:01 | 000,000,000 | RH-D | C] -- C:\Dokumente und Einstellungen\****\Recent> in the current context! Error: Unable to interpret <[2013.06.18 07:18:28 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbwg> in the current context! Error: Unable to interpret <[2013.06.18 07:18:00 | 000,000,000 | ---D | C] -- C:\Dokumente und Einstellungen\****\Lokale Einstellungen\Anwendungsdaten\Sophos> in the current context! Error: Unable to interpret <[2013.06.18 07:16:33 | 000,000,000 | ---D | C] -- C:\WINDOWS\Sun> in the current context! Error: Unable to interpret <[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Files - Modified Within 30 Days ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[2013.06.18 13:25:48 | 000,002,048 | --S- | M] () -- C:\WINDOWS\bootstat.dat> in the current context! Error: Unable to interpret <[2013.06.18 13:24:24 | 000,013,507 | ---- | M] () -- C:\WINDOWS\slssyi.kqf> in the current context! Error: Unable to interpret <[2013.06.18 13:24:22 | 000,052,228 | ---- | M] () -- C:\WINDOWS\iylajp.baq> in the current context! Error: Unable to interpret <[2013.06.18 13:06:46 | 000,458,732 | ---- | M] () -- C:\WINDOWS\System32\perfh007.dat> in the current context! Error: Unable to interpret <[2013.06.18 13:06:46 | 000,440,820 | ---- | M] () -- C:\WINDOWS\System32\perfh009.dat> in the current context! Error: Unable to interpret <[2013.06.18 13:06:46 | 000,084,698 | ---- | M] () -- C:\WINDOWS\System32\perfc007.dat> in the current context! Error: Unable to interpret <[2013.06.18 13:06:46 | 000,071,138 | ---- | M] () -- C:\WINDOWS\System32\perfc009.dat> in the current context! Error: Unable to interpret <[2013.06.18 07:21:13 | 000,066,839 | ---- | M] () -- C:\WINDOWS\pxbjvf.jdk> in the current context! Error: Unable to interpret <[2013.06.18 07:20:02 | 000,062,129 | ---- | M] () -- C:\WINDOWS\derx.ovb> in the current context! Error: Unable to interpret <[2013.06.18 07:19:35 | 000,281,920 | ---- | M] () -- C:\WINDOWS\egxd.nyh> in the current context! Error: Unable to interpret <[2013.06.18 07:18:28 | 000,290,470 | ---- | M] () -- C:\WINDOWS\mca.ech> in the current context! Error: Unable to interpret <[2013.06.17 07:55:51 | 000,002,206 | ---- | M] () -- C:\WINDOWS\System32\wpa.dbl> in the current context! Error: Unable to interpret <[2013.06.12 07:00:09 | 000,000,244 | ---- | M] () -- C:\Dokumente und Einstellungen\All Users\Desktop\Citrix XenApp6 - intern.url> in the current context! Error: Unable to interpret <[14 C:\WINDOWS\System32\*.tmp files -> C:\WINDOWS\System32\*.tmp -> ]> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== Files Created - No Company Name ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[2013.06.18 07:19:45 | 000,062,129 | ---- | C] () -- C:\WINDOWS\derx.ovb> in the current context! Error: Unable to interpret <[2013.06.18 07:19:45 | 000,013,507 | ---- | C] () -- C:\WINDOWS\slssyi.kqf> in the current context! Error: Unable to interpret <[2013.06.18 07:19:35 | 000,281,920 | ---- | C] () -- C:\WINDOWS\egxd.nyh> in the current context! Error: Unable to interpret <[2013.06.18 07:18:28 | 000,290,470 | ---- | C] () -- C:\WINDOWS\mca.ech> in the current context! Error: Unable to interpret <[2013.06.18 07:18:28 | 000,052,228 | ---- | C] () -- C:\WINDOWS\iylajp.baq> in the current context! Error: Unable to interpret <[2013.06.18 07:17:34 | 000,066,839 | ---- | C] () -- C:\WINDOWS\pxbjvf.jdk> in the current context! Error: Unable to interpret <[2013.03.05 08:51:06 | 000,000,069 | ---- | C] () -- C:\WINDOWS\NeroDigital.ini> in the current context! Error: Unable to interpret <[2012.11.28 15:17:42 | 000,013,304 | ---- | C] () -- C:\WINDOWS\System32\drivers\BTNetFilter.sys> in the current context! Error: Unable to interpret <[2012.11.28 15:17:39 | 000,012,500 | ---- | C] () -- C:\WINDOWS\System32\drivers\vbtenum.sys> in the current context! Error: Unable to interpret <[2012.07.13 15:27:32 | 000,190,464 | ---- | C] () -- C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx> in the current context! Error: Unable to interpret <[2011.11.03 16:01:48 | 000,116,224 | ---- | C] () -- C:\WINDOWS\System32\redmonnt.dll> in the current context! Error: Unable to interpret <[2011.11.03 16:01:48 | 000,045,056 | ---- | C] () -- C:\WINDOWS\System32\unredmon.exe> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <========== ZeroAccess Check ==========> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[2010.08.11 14:19:17 | 000,000,227 | RHS- | M] () -- C:\WINDOWS\assembly\Desktop.ini> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]> in the current context! Error: Unable to interpret <"" = %SystemRoot%\system32\shdocvw.dll -- [2008.04.14 07:52:26 | 001,499,136 | ---- | M] (Microsoft Corporation)> in the current context! Error: Unable to interpret <"ThreadingModel" = Apartment> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]> in the current context! Error: Unable to interpret <"" = C:\WINDOWS\system32\wbem\fastprox.dll -- [2009.02.09 12:51:44 | 000,473,600 | ---- | M] (Microsoft Corporation)> in the current context! Error: Unable to interpret <"ThreadingModel" = Free> in the current context! Error: Unable to interpret < > in the current context! Error: Unable to interpret <[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]> in the current context! Error: Unable to interpret <"" = C:\WINDOWS\system32\wbem\wbemess.dll -- [2008.04.14 07:52:34 | 000,273,920 | ---- | M] (Microsoft Corporation)> in the current context! Error: Unable to interpret <"ThreadingModel" = Both> in the current context! Error: Unable to interpret << End of report > > in the current context! OTL by OldTimer - Version 3.2.69.0 log created on 06182013_143002 ***** Ich habe im abgesicherten Modus nachgeschaut. Die svchost.exe ist eine Anwendung die 2008 geändert wurde. Also nix neues... hm Werde den Scan und Fix nochmal wiederholen. |
|
18.06.2013, 14:06
| #8 |
| /// the machine /// TB-Ausbilder | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Immer locker bleiben. NIEMAND hat gesagt Du sollst das komplette OTL log in die Box kopieren und FIx drücken!! Willst Du den Rechner schrotten? Mach nur das was ich oben gepostet hab.
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
18.06.2013, 14:18
| #9 |
| | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Sorry... ich bin vielleicht wirklich im Moment nicht so locker... Ich habe nun brav nur den Inhalt deiner CodeBox eingefügt und den Fix-Button betätigt. Der Neustart wurde verlangt und der weiße Bildschirm ist weg... puhhhh 1000 Dank !!!!! Hier der OTL_MovedFiles: All processes killed ========== OTL ========== Registry value HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell:C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx deleted successfully. C:\Dokumente und Einstellungen\****\Anwendungsdaten\dbu32.ocx moved successfully. C:\Dokumente und Einstellungen\All Users\Anwendungsdaten\dbwg folder moved successfully. C:\WINDOWS\slssyi.kqf moved successfully. C:\WINDOWS\iylajp.baq moved successfully. C:\WINDOWS\pxbjvf.jdk moved successfully. C:\WINDOWS\derx.ovb moved successfully. C:\WINDOWS\egxd.nyh moved successfully. C:\WINDOWS\mca.ech moved successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator User: All Users User: Default User ->Temp folder emptied: 0 bytes Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. ->Temporary Internet Files folder emptied: 33170 bytes User: **** ->Temp folder emptied: 661023 bytes Unable to locate HKLM\Software\Microsoft\Windows\CurrentVersion\RunOnce key. ->Temporary Internet Files folder emptied: 2949254 bytes ->Java cache emptied: 200275 bytes ->Flash cache emptied: 470 bytes User: LocalService User: NetworkService User: Wartung %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 13675591 bytes %systemroot%\System32\dllcache .tmp files removed: 0 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 586 bytes RecycleBin emptied: 0 bytes Total Files Cleaned = 17,00 mb OTL by OldTimer - Version 3.2.69.0 log created on 06182013_151639 |
|
18.06.2013, 18:22
| #10 |
| /// the machine /// TB-Ausbilder | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Siehste  und jetzt bitte ein OTL log aus dem normalen Windows
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.06.2013, 06:32
| #11 |
| | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Du weißt... von wegen grün hinter den Ohren ;-)... wo finde ich den OTL log aus dem normalen Windows? |
|
19.06.2013, 08:21
| #12 |
| /// the machine /// TB-Ausbilder | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Lad OTL einfach neu auf den Desktop
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.06.2013, 08:34
| #13 |
| | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) mh... bei mir war keine Datei auf dem Desktop. Habe auch gerade C:\ nach "OTL" durchsuchen lassen... nix. Ich hatte nur diese (siehe oben) auf dem USB-Stick unter _OTL. |
|
19.06.2013, 08:58
| #14 |
| /// the machine /// TB-Ausbilder | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Du hast doch gerade eben OTL laufen lassen im SAfe Mode  . Wo haste das her? selbst geschnitzt? Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop ( falls noch nicht vorhanden ).
__________________ gruß, schrauber Proud Member of UNITE and ASAP since 2009 Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM! |
|
19.06.2013, 09:24
| #15 |
| | BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) Ich hatte OTL auf einem USB-Stick geladen und von dort gestartet. Wahrscheinlich wurde der log auch dort abgelegt. |
|
| Themen zu BKA-Sperrung - weißer Bildschirm auch im abgesicherten Modus (XP) |
| abgesicherte, abgesicherten, adminrechte, bildschirm, bli, blinkt, brenner, defekt, desktop, eingabe, kleiner, mauszeiger, modus, nicht mehr, notebook, prozesse, rechner, rechte, sekunden, task-manager, troja, trojaner, weiße, weißer, öffnet |
Textbox. 
Linear-Darstellung
