Win XP: Win XP: regedit oeffnet sich nicht

Versuch´s mal so:
http://www.pctipp.ch/praxishilfe/kummerkasten/windowsxp/24952/bearbeiten_der_registry_aktivieren_deaktivieren.html

Da sind gäste am werke.Bitte datensicherung erstellen mit knoppix.Dann logfile von Hijacckthis hier einstellen,für einen ersten überblick.
System muß wahrscheinlich neu instaliert werden.

FIXEN :
[X] - O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll

Prüfen : neutral....
[?] - O9 - Extra button: Enable Right Click - {549D3A89-1496-42B4-BC43-BF1D6E8E3EE7} - C:\WINDOWS\system32\shdocvw.dll
[?] - O9 - Extra button: RawRequest - {549D3A97-1496-42B4-BC43-BF1D6E8E3EE7} - C:\WINDOWS\system32\shdocvw.dll
[?] - O9 - Extra button: JsConsole - {549D3A98-1496-42B4-BC43-BF1D6E8E3EE7} - C:\WINDOWS\system32\shdocvw.dll
[?] - O9 - Extra button: Analyze Frames - {549D3A99-1496-42B4-BC43-BF1D6E8E3EE7} - C:\WINDOWS\system32\shdocvw.dll
[?] - O9 - Extra button: Sleuth - {F3D1ABFB-AB7F-4ea2-A9B2-23D41D1CDCF6} - C:\WINDOWS\system32\shdocvw.dll


IE8 ist der Stand der Dinge !!!! 

Kein Anti-Viren-Programm?

vielen dank HCK fuer deine hilfe

Malwarebytes' Anti-Malware 1.36
Datenbank Version: 1976
Windows 5.1.2600 Service Pack 3

13/04/2009 17:36:08
mbam-log-2009-04-13 (17-36-08).txt

Scan-Methode: Quick-Scan
Durchsuchte Objekte: 62988
Laufzeit: 10 minute(s), 51 second(s)

Infizierte Speicherprozesse: 0
Infizierte Speichermodule: 0
Infizierte Registrierungsschlüssel: 2
Infizierte Registrierungswerte: 0
Infizierte Dateiobjekte der Registrierung: 1
Infizierte Verzeichnisse: 1
Infizierte Dateien: 3

Infizierte Speicherprozesse:
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule:
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel:
HKEY_CURRENT_USER\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.
HKEY_LOCAL_MACHINE\SOFTWARE\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.

Infizierte Registrierungswerte:
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung:
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Winlogon\Userinit (Hijack.UserInit) -> Bad: (C:\WINDOWS\system32\userinit.exe,C:\Windows\lsass.exe) Good: (userinit.exe) -> Quarantined and deleted successfully.

Infizierte Verzeichnisse:
C:\WINDOWS\system32\Bifrost (Backdoor.Bifrose) -> Quarantined and deleted successfully.

Infizierte Dateien:
C:\Documents and Settings\Administrateur\Application Data\tazebama\zPharaoh.dat (Worm.Mabezat) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nmdfgds0.dll (Spyware.OnLineGames) -> Quarantined and deleted successfully.
C:\WINDOWS\system32\nmdfgds1.dll (Spyware.OnLineGames) -> Quarantined and deleted successfully.

info.txt logfile of random's system information tool 1.06 2009-04-13 18:00:45

======Uninstall list======

-->rundll32.exe setupapi.dll,InstallHinfSection DefaultUninstall 132 C:\WINDOWS\INF\PCHealth.inf
Acoustica MP3 Audio Mixer-->C:\PROGRA~1\ACOUST~1\UNWISE.EXE C:\PROGRA~1\ACOUST~1\INSTALL.LOG
Adobe Flash Player 10 ActiveX-->C:\WINDOWS\system32\Macromed\Flash\uninstall_activeX.exe
Adobe Flash Player 10 Plugin-->C:\WINDOWS\system32\Macromed\Flash\uninstall_plugin.exe
Apple Mobile Device Support-->MsiExec.exe /I{EC4455AB-F155-4CC1-A4C5-88F3777F9886}
Apple Software Update-->MsiExec.exe /I{6956856F-B6B3-4BE0-BA0B-8F495BE32033}
Archiveur WinRAR-->C:\Program Files\WinRAR\uninstall.exe
AusLogics BoostSpeed-->"C:\Program Files\Auslogics\AusLogics BoostSpeed\unins000.exe"
Autorun Virus Remover 2.3-->"C:\Program Files\AutorunRemover\unins000.exe"
Bonjour-->MsiExec.exe /I{8A25392D-C5D2-4E79-A2BD-C15DDC5B0959}
CuteFTP 8 Professional-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{91F34319-08DE-457A-99C0-0BCDFAC145B9}\Setup.exe" -l0x9
Download Accelerator Plus -->C:\PROGRA~1\DAP\UNWISE.EXE C:\PROGRA~1\DAP\INSTALL.LOG
FLAC Installer 1.1.2a (remove only)-->C:\Program Files\FLAC\uninstall.exe
HijackThis 2.0.2-->"C:\Program Files\Trend Micro\HijackThis\HijackThis.exe" /uninstall
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB953595)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall  /qb+ REBOOTPROMPT=""
Hotfix for Microsoft .NET Framework 3.5 SP1 (KB958484)-->C:\WINDOWS\system32\msiexec.exe /package {CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9} /uninstall {A7EEA2F2-BFCD-4A54-A575-7B81A786E658} /qb+ REBOOTPROMPT=""
Indeo® software-->C:\WINDOWS\IsUninst.exe -f"C:\Program Files\Intel\Indeo\Uninst.isu" -c"C:\Program Files\Intel\Indeo\SavedSystemFiles\indounin.dll"
Intel(R) Extreme Graphics Driver-->RUNDLL32.EXE C:\WINDOWS\system32\ialmrem.dll,UninstallW2KIGfx PCI\VEN_8086&DEV_2562
Java(TM) 6 Update 11-->MsiExec.exe /X{26A24AE4-039D-4CA4-87B4-2F83216011FF}
Java(TM) 6 Update 7-->MsiExec.exe /I{3248F0A8-6813-11D6-A77B-00B0D0160070}
K-Lite Mega Codec Pack 1.47-->"C:\Program Files\K-Lite Codec Pack\unins000.exe"
LG EV-DO USB MODEM-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{94EDC857-E032-47C6-9056-7EE279295EB3}\Setup.exe" -l0x9
Malwarebytes' Anti-Malware-->"C:\Program Files\Malwarebytes' Anti-Malware\unins000.exe"
Microsoft .NET Framework 2.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{72AD53CC-CCC0-3757-8480-9EE176866A7C}
Microsoft .NET Framework 2.0 Service Pack 2-->MsiExec.exe /I{C09FB3CD-3D0C-3F2D-899A-6A1D67F2073F}
Microsoft .NET Framework 3.0 Service Pack 2 Language Pack - FRA-->MsiExec.exe /I{0BD83598-C2EF-3343-847B-7D2E84599128}
Microsoft .NET Framework 3.0 Service Pack 2-->MsiExec.exe /I{A3051CD0-2F64-3813-A88D-B8DCCDE8F8C7}
Microsoft .NET Framework 3.5 Language Pack SP1 - fra-->MsiExec.exe /I{3E31821C-7917-367E-938E-E65FC413EA31}
Microsoft .NET Framework 3.5 SP1-->C:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 SP1\setup.exe
Microsoft .NET Framework 3.5 SP1-->MsiExec.exe /I{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}
Microsoft Windows Media Video 9 VCM-->RunDll32 advpack.dll,LaunchINFSection C:\WINDOWS\INF\wmv9vcm.inf, Uninstall
Mise à jour de sécurité pour Windows XP (KB923789)-->C:\WINDOWS\system32\MacroMed\Flash\genuinst.exe C:\WINDOWS\system32\MacroMed\Flash\KB923789.inf
Module linguistique Microsoft .NET Framework 3.5 SP1- fra-->c:\WINDOWS\Microsoft.NET\Framework\v3.5\Microsoft .NET Framework 3.5 Language Pack SP1 - fra\setup.exe
Mozilla ActiveX Control v1.7.12-->C:\Program Files\Mozilla ActiveX Control v1.7.12\uninst.exe
Mozilla Firefox (3.0.7)-->C:\Program Files\Mozilla Firefox\uninstall\helper.exe
Nuclear Coffee - VideoGet-->"C:\Program Files\Nuclear Coffee\VideoGet\unins000.exe"
Opera 9.64-->MsiExec.exe /X{E1BBBAC5-2857-4155-82A6-54492CE88620}
QuickTime-->MsiExec.exe /I{216AB108-2AE1-4130-B3D5-20B2C4C80F8F}
Realtek AC'97 Audio-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\engine\6\INTEL3~1\ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{FB08F381-6533-4108-B7DD-039E11FBC27E}\setup.exe" REMOVE
Trojan Guarder Gold Version 7.40-->"C:\Program Files\Trojan Guarder Gold Version\unins000.exe"
Ulead PhotoImpact 12-->RunDll32 C:\PROGRA~1\FICHIE~1\INSTAL~1\PROFES~1\RunTime\0701\Intel32\Ctor.dll,LaunchSetup "C:\Program Files\InstallShield Installation Information\{11AFE21E-B193-430D-B57A-DFF7815BB962}\Setup.exe" -l0x9
User Profile Hive Cleanup Service-->MsiExec.exe /I{FF77941A-2BFA-4A18-BE2E-69B9498E4D55}
Winamp (remove only)-->"C:\Program Files\Winamp\UninstWA.exe"
Windows Live Messenger-->MsiExec.exe /X{2B091530-69AA-442E-AB09-39ED06B58220}
Windows Media Format 11 runtime-->"C:\Program Files\Windows Media Player\wmsetsdk.exe" /UninstallAll
XML Paper Specification Shared Components Language Pack 1.0-->"C:\WINDOWS\$NtUninstallXPSEPSCLP$\spuninst\spuninst.exe"
XP Codec Pack-->C:\Program Files\XP Codec Pack\Uninstall.exe
XviD 1.2.-127 +SMP Alpha uninstall-->"C:\Program Files\XviD\unins000.exe"

=====HijackThis Backups=====

O9 - Extra button: PalTalk - {4EAFEF58-EEFA-4116-983D-03B49BCBFFFE} - C:\WINDOWS\system32\shdocvw.dll [2009-03-25]
O9 - Extra button: Enable Right Click - {549D3A89-1496-42B4-BC43-BF1D6E8E3EE7} - C:\WINDOWS\system32\shdocvw.dll [2009-04-12]
O2 - BHO: DAPHelper Class - {0000CC75-ACF3-4cac-A0A9-DD3868E06852} - C:\Program Files\DAP\DAPBHO.dll [2009-04-12]
O9 - Extra button: RawRequest - {549D3A97-1496-42B4-BC43-BF1D6E8E3EE7} - C:\WINDOWS\system32\shdocvw.dll [2009-04-12]
O9 - Extra button: Sleuth - {F3D1ABFB-AB7F-4ea2-A9B2-23D41D1CDCF6} - C:\WINDOWS\system32\shdocvw.dll [2009-04-12]
O9 - Extra button: Analyze Frames - {549D3A99-1496-42B4-BC43-BF1D6E8E3EE7} - C:\WINDOWS\system32\shdocvw.dll [2009-04-12]
O9 - Extra button: JsConsole - {549D3A98-1496-42B4-BC43-BF1D6E8E3EE7} - C:\WINDOWS\system32\shdocvw.dll [2009-04-12]
F2 - REG:system.ini: Shell=explorer-namawude.exe [2009-04-12]

======Security center information======

AV: ESET NOD32 antivirus system 2.70

======System event log======

Computer Name: KIWI819
Event Code: 2506
Message: La valeur nommée AutoShareWks dans la clé de Registre du serveur LanmanServer\Parameters était non valide et a été
ignorée. Si vous voulez modifier la valeur, modifiez la à une valeur de type
correct qui est dans des limites acceptables ou supprimez la valeur pour utiliser
celle par défaut. Cette valeur a peut-être été définie par une ancienne application
qui ne connaissait pas les limites correctes.

Record Number: 5
Source Name: Server
Time Written: 20090404151942.000000+000
Event Type: Avertissement
User:

Computer Name: KIWI819
Event Code: 6005
Message: Le service d'Enregistrement d'événement a démarré.

Record Number: 4
Source Name: EventLog
Time Written: 20090404151936.000000+000
Event Type: Informations
User:

Computer Name: KIWI819
Event Code: 6009
Message: Microsoft (R) Windows (R) 5.01. 2600 Service Pack 3 Uniprocessor Free.

Record Number: 3
Source Name: EventLog
Time Written: 20090404151936.000000+000
Event Type: Informations
User:

Computer Name: KIWI819
Event Code: 6006
Message: Le service d'Enregistrement d'événement a été arrêté.

Record Number: 2
Source Name: EventLog
Time Written: 20090404151833.000000+000
Event Type: Informations
User:

Computer Name: KIWI819
Event Code: 20159
Message: La connexion à KWI819 effectuée par l'utilisateur bayn utilisant le périphérique COM3 a été déconnectée.

Record Number: 1
Source Name: RemoteAccess
Time Written: 20090404151827.000000+000
Event Type: Informations
User:

=====Application event log=====

Computer Name: KIWI819
Event Code: 1041
Message: Windows ne peut pas effectuer de requête sur l'entrée DllName du Registre pour {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}.

Record Number: 5
Source Name: Userenv
Time Written: 20090404151941.000000+000
Event Type: erreur
User: AUTORITE NT\SYSTEM

Computer Name: KIWI819
Event Code: 1041
Message: Windows ne peut pas effectuer de requête sur l'entrée DllName du Registre pour {7B849a69-220F-451E-B3FE-2CB811AF94AE}.

Record Number: 4
Source Name: Userenv
Time Written: 20090404151941.000000+000
Event Type: erreur
User: AUTORITE NT\SYSTEM

Computer Name: KIWI819
Event Code: 1041
Message: Windows ne peut pas effectuer de requête sur l'entrée DllName du Registre pour {CF7639F3-ABA2-41DB-97F2-81E2C5DBFC5D}.

Record Number: 3
Source Name: Userenv
Time Written: 20090404151941.000000+000
Event Type: erreur
User: AUTORITE NT\SYSTEM

Computer Name: KIWI819
Event Code: 1041
Message: Windows ne peut pas effectuer de requête sur l'entrée DllName du Registre pour {7B849a69-220F-451E-B3FE-2CB811AF94AE}.

Record Number: 2
Source Name: Userenv
Time Written: 20090404151941.000000+000
Event Type: erreur
User: AUTORITE NT\SYSTEM

Computer Name: KIWI819
Event Code: 1010
Message: User profile hive cleanup service stopped successfully.

Record Number: 1
Source Name: UPHClean
Time Written: 20090404151829.000000+000
Event Type: Informations
User:

======Environment variables======

"ComSpec"=%SystemRoot%\system32\cmd.exe
"Path"=%SystemRoot%\system32;%SystemRoot%;%SystemRoot%\System32\Wbem;C:\Program Files\Fichiers communs\Ulead Systems\MPEG;C:\Program Files\Ulead Systems\Ulead DVD MovieFactory 3 Disc Creator Trial;C:\Program Files\K-Lite Codec Pack\QuickTime\QTSystem\
"windir"=%SystemRoot%
"FP_NO_HOST_CHECK"=NO
"OS"=Windows_NT
"PROCESSOR_ARCHITECTURE"=x86
"PROCESSOR_LEVEL"=15
"PROCESSOR_IDENTIFIER"=x86 Family 15 Model 2 Stepping 9, GenuineIntel
"PROCESSOR_REVISION"=0209
"NUMBER_OF_PROCESSORS"=1
"PATHEXT"=.COM;.EXE;.BAT;.CMD;.VBS;.VBE;.JS;.JSE;.WSF;.WSH
"TEMP"=%SystemRoot%\TEMP
"TMP"=%SystemRoot%\TEMP
"CLASSPATH"=.;C:\Program Files\Java\jre6\lib\ext\QTJava.zip
"QTJAVA"=C:\Program Files\Java\jre6\lib\ext\QTJava.zip

-----------------EOF-----------------