| |
| |||||||
Log-Analyse und Auswertung: MBAM-Seite nicht aufrufbar / MSIBF4D.tmp (HackTool.Hiderun)Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML. |
 |
22.01.2012, 15:52
| #1 | |
| |  MBAM-Seite nicht aufrufbar / MSIBF4D.tmp (HackTool.Hiderun) Vorab: Das vorliegende System kann ausschließlich über einen Proxy auf das Internet zugreifen. Das System wurde vor wenigen Wochen neu aufgesetzt. Das OS wurde legal erworben, konnte bisher allerdings noch nicht online aktiviert werden (via Proxy nicht möglich). Vermutlich ist dies der Grund für die Infektion, da Update-Dienste deaktiviert wurden. Dem Nutzer war dies nicht bewusst. Eine Aktivierung wird frühstens in zwei Wochen statt finden können (nach Umzug und Freischaltung des neuen Zugangs, dann kein Proxy mehr). Falls aus diesen Gründen keine Hilfestellung erfolgen kann, bitte ich darum darauf hinzuweisen. Da ich nur der Formatier-Doktor bin, wird dies dann meine Aufgabe sein. Ich wollte mir und dem Nutzer jedoch den Aufwand ersparen, sofern hier nicht eine simplere Lösung erarbetiet werden kann. Somit hoffe ich, dass gemeinsam eine Lösung gefunden werden kann. Ansonsten wird es wohl ein weiterer Fall für Format C. Zum Problem: Seit wenigen Tagen liegt (mindestens) ein infiziertes Objekt auf der Systempartition vor. Das Problem wurde erkannt, als zunächst ein MBAM-Update fehlschlug und danach das Aufrufen der MBAM-Seite nicht mehr möglich war. Jegliche Browser geben als Fehler eine Netzwerk-Zeitüberschreitung an. Erneutes Aufspielen von MBAM und ein erfolgreiches Update haben einen Full-Scan ermöglicht. Gefunden wurde HackTool.Hiderun im Verzeichnis C:\Windows\Installer\MSIBF4D.tmp. Das Abspeichern der Log-Datei im regulären Verzeichnis "C:\Users\PoS\AppData\Roaming\Malwarebytes\Malwarebytes' Anti-Malware\Logs" funktioniert nicht, allerdings konnte ich die Datei auf dem Desktop abspeichern. Das Log kann hier eingesehen werden: Zitat:
Es wurde nichts unternommen und nach Anleitung verfahren. - defogger problemlos ausgeführt und neugestartet - OTL erfolgreich ausgeführt - GMER erfolgreich ausgeführt OTL-Log: OTL logfile created on: 22.01.2012 15:06:45 - Run 1 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\PoS\Desktop Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,00 Gb Total Physical Memory | 1,45 Gb Available Physical Memory | 72,52% Memory free 4,00 Gb Paging File | 3,21 Gb Available in Paging File | 80,37% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 45,74 Gb Total Space | 31,28 Gb Free Space | 68,40% Space Free | Partition Type: NTFS Drive D: | 244,14 Gb Total Space | 129,32 Gb Free Space | 52,97% Space Free | Partition Type: NTFS Drive G: | 97,66 Gb Total Space | 45,06 Gb Free Space | 46,14% Space Free | Partition Type: NTFS Drive M: | 126,95 Gb Total Space | 33,42 Gb Free Space | 26,32% Space Free | Partition Type: NTFS Drive P: | 48,83 Gb Total Space | 46,05 Gb Free Space | 94,32% Space Free | Partition Type: NTFS Drive S: | 48,76 Gb Total Space | 33,02 Gb Free Space | 67,72% Space Free | Partition Type: NTFS Drive T: | 205,08 Gb Total Space | 115,46 Gb Free Space | 56,30% Space Free | Partition Type: NTFS Drive W: | 114,26 Gb Total Space | 91,35 Gb Free Space | 79,95% Space Free | Partition Type: NTFS Computer Name: CYLONUS | User Name: PoS | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012.01.22 14:34:07 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\PoS\Desktop\OTL.exe PRC - [2011.12.09 12:40:20 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Avira\AntiVir Desktop\avshadow.exe PRC - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Avira\AntiVir Desktop\sched.exe PRC - [2011.12.09 12:39:54 | 000,258,512 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Avira\AntiVir Desktop\avgnt.exe PRC - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- P:\Avira\AntiVir Desktop\avguard.exe PRC - [2011.11.23 14:17:10 | 000,072,976 | ---- | M] (SANDBOXIE L.T.D) -- P:\Sandboxie 3.62\SbieSvc.exe PRC - [2011.08.22 17:57:30 | 000,025,600 | ---- | M] (Creative Technology Ltd) -- C:\Windows\System32\Ctxfihlp.exe PRC - [2011.07.08 15:58:54 | 000,395,928 | ---- | M] (Acronis) -- C:\Programme\Common Files\Acronis\Schedule2\schedhlp.exe PRC - [2011.07.08 15:58:48 | 000,846,576 | ---- | M] (Acronis) -- C:\Programme\Common Files\Acronis\Schedule2\schedul2.exe PRC - [2011.07.08 15:57:08 | 002,673,688 | ---- | M] () -- P:\4 Soft System Tools\WD Acronis True Image\TrueImageMonitor.exe PRC - [2011.06.24 05:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe PRC - [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010.12.19 03:50:30 | 000,286,720 | ---- | M] (Creative Technology Ltd) -- C:\Programme\Creative\Shared Files\CTAudSvc.exe PRC - [2010.11.20 22:29:19 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe ========== Modules (No Company Name) ========== MOD - [2011.07.08 16:01:12 | 001,027,120 | ---- | M] () -- P:\4 Soft System Tools\WD Acronis True Image\tishell.dll MOD - [2011.07.08 15:57:08 | 002,673,688 | ---- | M] () -- P:\4 Soft System Tools\WD Acronis True Image\TrueImageMonitor.exe MOD - [2011.07.08 15:56:48 | 000,071,008 | ---- | M] () -- C:\Programme\Acronis\TrueImageHome\Common\rpc_client.dll MOD - [2010.07.04 22:32:38 | 000,010,752 | ---- | M] () -- P:\Unlocker\UnlockerCOM.dll ========== Win32 Services (SafeList) ========== SRV - [2011.12.23 13:16:22 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\AL6Licensing.exe -- (Creative ALchemy AL6 Licensing Service) SRV - [2011.12.23 13:15:29 | 000,079,360 | ---- | M] (Creative Labs) [On_Demand | Stopped] -- C:\Program Files\Common Files\Creative Labs Shared\Service\CTAELicensing.exe -- (Creative Audio Engine Licensing Service) SRV - [2011.12.18 16:37:03 | 000,419,624 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2011.12.09 12:40:05 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- P:\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2011.12.09 12:39:54 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- P:\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2011.11.23 14:17:10 | 000,072,976 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- P:\Sandboxie 3.62\SbieSvc.exe -- (SbieSvc) SRV - [2011.09.27 20:03:28 | 000,295,192 | ---- | M] (Logitech, Inc.) [On_Demand | Stopped] -- C:\Programme\Common Files\LogiShrd\Bluetooth\LBTServ.exe -- (LBTServ) SRV - [2011.07.08 15:58:48 | 000,846,576 | ---- | M] (Acronis) [Auto | Running] -- C:\Program Files\Common Files\Acronis\Schedule2\schedul2.exe -- (AcrSch2Svc) SRV - [2011.06.06 12:55:28 | 000,064,952 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice) SRV - [2010.12.19 03:50:30 | 000,286,720 | ---- | M] (Creative Technology Ltd) [Auto | Running] -- C:\Programme\Creative\Shared Files\CTAudSvc.exe -- (CTAudSvcService) SRV - [2009.07.14 02:16:15 | 000,016,384 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\StorSvc.dll -- (StorSvc) SRV - [2009.07.14 02:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009.07.14 02:16:12 | 001,004,544 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\PeerDistSvc.dll -- (PeerDistSvc) SRV - [2009.07.14 02:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Programme\Windows Defender\MpSvc.dll -- (WinDefend) ========== Driver Services (SafeList) ========== DRV - [2011.12.11 04:39:57 | 000,601,408 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\timntr.sys -- (timounter) DRV - [2011.12.11 04:39:51 | 000,125,472 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vididr.sys -- (vididr) DRV - [2011.12.11 04:39:50 | 000,083,392 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\vsflt53.sys -- (vidsflt53) Acronis Disk Storage Filter (53) DRV - [2011.12.11 04:39:49 | 000,169,088 | ---- | M] (Acronis) [Kernel | Boot | Running] -- C:\Windows\system32\DRIVERS\snapman.sys -- (snapman) DRV - [2011.12.11 04:27:25 | 000,231,376 | ---- | M] (TrueCrypt Foundation) [Kernel | System | Running] -- C:\Windows\System32\drivers\truecrypt.sys -- (truecrypt) DRV - [2011.12.09 12:40:20 | 000,134,856 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2011.12.09 12:40:20 | 000,074,640 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2011.12.09 12:40:20 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011.11.23 14:17:08 | 000,131,856 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- P:\Sandboxie 3.62\SbieDrv.sys -- (SbieDrv) DRV - [2011.09.02 07:31:28 | 000,039,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LMouFilt.Sys -- (LMouFilt) DRV - [2011.09.02 07:31:28 | 000,030,360 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LUsbFilt.sys -- (LUsbFilt) DRV - [2011.09.02 07:31:20 | 000,041,240 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\LHidFilt.Sys -- (LHidFilt) DRV - [2011.09.02 07:30:58 | 000,022,040 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\L8042Kbd.sys -- (L8042Kbd) DRV - [2011.08.22 19:24:44 | 001,178,200 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ha20x2k.sys -- (ha20x2k) DRV - [2011.08.22 19:24:34 | 000,095,832 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\emupia2k.sys -- (emupia) DRV - [2011.08.22 19:24:22 | 000,158,808 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ctsfm2k.sys -- (ctsfm2k) DRV - [2011.08.22 19:24:12 | 000,014,424 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ctprxy2k.sys -- (ctprxy2k) DRV - [2011.08.22 19:24:00 | 000,130,136 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ctoss2k.sys -- (ossrv) DRV - [2011.08.22 19:23:50 | 000,347,144 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ctdvda2k.sys -- (ctdvda2k) DRV - [2011.08.22 19:23:36 | 000,528,344 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ctaud2k.sys -- (ctaud2k) Creative Audio Driver (WDM) DRV - [2011.08.22 19:23:24 | 000,511,064 | ---- | M] (Creative Technology Ltd) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ctac32k.sys -- (ctac32k) DRV - [2011.08.22 19:23:14 | 001,324,120 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CTEXFIFX.SYS -- (CTEXFIFX.SYS) DRV - [2011.08.22 19:23:14 | 001,324,120 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CTEXFIFX.sys -- (CTEXFIFX) DRV - [2011.08.22 19:23:02 | 000,072,792 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CTHWIUT.SYS -- (CTHWIUT.SYS) DRV - [2011.08.22 19:23:02 | 000,072,792 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CTHWIUT.sys -- (CTHWIUT) DRV - [2011.08.22 19:22:50 | 000,171,096 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CT20XUT.SYS -- (CT20XUT.SYS) DRV - [2011.08.22 19:22:50 | 000,171,096 | ---- | M] (Creative Technology Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\CT20XUT.sys -- (CT20XUT) DRV - [2011.03.18 17:08:54 | 000,025,240 | ---- | M] (Almico Software) [Kernel | Boot | Running] -- C:\Windows\system32\speedfan.sys -- (speedfan) DRV - [2010.11.20 22:29:24 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt) DRV - [2010.11.20 22:29:03 | 000,175,360 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vmbus.sys -- (vmbus) DRV - [2010.11.20 22:29:03 | 000,062,464 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\dmvsc.sys -- (dmvsc) DRV - [2010.11.20 22:29:03 | 000,040,704 | ---- | M] (Microsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\system32\drivers\vmstorfl.sys -- (storflt) DRV - [2010.11.20 22:29:03 | 000,028,032 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\storvsc.sys -- (storvsc) DRV - [2010.11.20 22:29:03 | 000,027,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\TsUsbGD.sys -- (TsUsbGD) DRV - [2010.11.20 22:29:03 | 000,017,920 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\VMBusHID.sys -- (VMBusHID) DRV - [2010.11.20 22:29:03 | 000,005,632 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\system32\drivers\vms3cap.sys -- (s3cap) DRV - [2010.06.17 14:14:27 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2009.07.13 23:09:17 | 004,194,816 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (atikmdag) DRV - [1996.04.03 20:33:26 | 000,005,248 | ---- | M] () [Kernel | Boot | Running] -- C:\Windows\system32\giveio.sys -- (giveio) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/ IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = proxy.local:8080 ========== FireFox ========== FF - prefs.js..browser.search.defaultenginename: "Yahoo" FF - prefs.js..browser.search.order.1: "Yahoo" FF - prefs.js..browser.search.order.2: "" FF - prefs.js..browser.search.param.yahoo-fr: "w3i&type=W3i_DS,157,0_0,Search,20111250,16981,0,24,0" FF - prefs.js..browser.search.selectedEngine: "Yahoo" FF - prefs.js..browser.search.update: false FF - prefs.js..browser.startup.homepage: "www.google.de " FF - prefs.js..network.proxy.backup.ftp: "88.85.125.78" FF - prefs.js..network.proxy.backup.ftp_port: 8080 FF - prefs.js..network.proxy.backup.socks: "88.85.125.78" FF - prefs.js..network.proxy.backup.socks_port: 8080 FF - prefs.js..network.proxy.backup.ssl: "88.85.125.78" FF - prefs.js..network.proxy.backup.ssl_port: 8080 FF - prefs.js..network.proxy.ftp: "proxy.local" FF - prefs.js..network.proxy.ftp_port: 8080 FF - prefs.js..network.proxy.http: "proxy.local" FF - prefs.js..network.proxy.http_port: 8080 FF - prefs.js..network.proxy.share_proxy_settings: true FF - prefs.js..network.proxy.socks: "proxy.local" FF - prefs.js..network.proxy.socks_port: 8080 FF - prefs.js..network.proxy.ssl: "proxy.local" FF - prefs.js..network.proxy.ssl_port: 8080 FF - prefs.js..network.proxy.type: 1 FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Components: P:\Mozilla Firefox\components [2012.01.08 18:36:43 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 8.0.1\extensions\\Plugins: P:\Mozilla Firefox\plugins FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: P:\Mozilla Thunderbird\components [2011.12.10 13:54:49 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Plugins: P:\Mozilla Thunderbird\plugins FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: P:\Mozilla Firefox\components [2012.01.08 18:36:43 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: P:\Mozilla Firefox\plugins [2011.11.28 19:42:15 | 000,000,000 | ---D | M] (No name found) -- C:\Users\PoS\AppData\Roaming\mozilla\Extensions [2012.01.20 02:59:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\PoS\AppData\Roaming\mozilla\Firefox\Profiles\a2lznuoy.default\extensions [2012.01.11 20:36:42 | 000,000,000 | ---D | M] (HTTPS-Everywhere) -- C:\Users\PoS\AppData\Roaming\mozilla\Firefox\Profiles\a2lznuoy.default\extensions\https-everywhere@eff.org [2012.01.22 14:10:06 | 000,000,000 | ---D | M] (No name found) -- C:\Users\PoS\AppData\Roaming\mozilla\Firefox\Profiles\v5q31km0.Proxy\extensions () (No name found) -- C:\USERS\POS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\A2LZNUOY.DEFAULT\EXTENSIONS\{73A6FE31-595D-460B-A920-FCC0F8843232}.XPI () (No name found) -- C:\USERS\POS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\A2LZNUOY.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI () (No name found) -- C:\USERS\POS\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\A2LZNUOY.DEFAULT\EXTENSIONS\{D4DD63FA-01E4-46A7-B6B1-EDAB7D6AD389}.XPI O1 HOSTS File: ([2009.06.10 22:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [Acronis Scheduler2 Service] C:\Program Files\Common Files\Acronis\Schedule2\schedhlp.exe (Acronis) O4 - HKLM..\Run: [avgnt] P:\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CTxfiHlp] C:\Windows\System32\Ctxfihlp.exe (Creative Technology Ltd) O4 - HKLM..\Run: [EvtMgr6] P:\Logitech\SetPointP\SetPoint.exe (Logitech, Inc.) O4 - HKLM..\Run: [TrueImageMonitor.exe] P:\4 Soft System Tools\WD Acronis True Image\TrueImageMonitor.exe () O4 - HKLM..\Run: [VolPanel] C:\Program Files\Creative\Volume Panel\VolPanlu.exe (Creative Technology Ltd) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Nach Microsoft &Excel exportieren - P:\Microsoft Office\OFFICE11\EXCEL.EXE (Microsoft Corporation) O9 - Extra Button: Recherchieren - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - P:\Microsoft Office\OFFICE11\REFIEBAR.DLL (Microsoft Corporation) O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-0016-0000-0030-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_30-windows-i586.cab (Java Plug-in 1.6.0_30) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.250 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{19E04EBC-0F30-46C3-8DF4-6DBA97C24F97}: DhcpNameServer = 192.168.0.250 O18 - Protocol\Handler\msdaipp\0x00000001 {E1D2BF42-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\msdaipp\oledb {E1D2BF40-A96B-11d1-9C6B-0000F875AC61} - C:\Programme\Common Files\System\Ole DB\MSDAIPP.DLL (Microsoft Corporation) O18 - Protocol\Handler\mso-offdap11 {32505114-5902-49B2-880A-1F7738E5A384} - C:\Programme\Common Files\microsoft shared\Web Components\11\OWC11.DLL (Microsoft Corporation) O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O18 - Protocol\Filter\text/xml {807553E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE11\MSOXMLMF.DLL (Microsoft Corporation) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) -C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O20 - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\Programme\Common Files\LogiShrd\Bluetooth\LBTWLgn.dll (Logitech, Inc.) O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009.06.10 22:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{a47f7764-3a3b-11e1-9277-806e6f6e6963}\Shell - "" = AutoRun O33 - MountPoints2\{a47f7764-3a3b-11e1-9277-806e6f6e6963}\Shell\AutoRun\command - "" = C:\Windows\system32\RunDLL32.EXE Shell32.DLL,ShellExec_RunDLL E:\index.htm O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {411EDCF7-755D-414E-A74B-3DCD6583F589} - Microsoft .NET Framework 1.1 Service Pack 1 (KB867460) ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {73FA19D0-2D75-11D2-995D-00C04F98BBC9} - Webordner ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {87CAAC90-103F-482F-9239-AD0191AD35A0} - Themes Setup ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1} - .NET Framework ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found MsConfig - StartUpFolder: C:^Users^PoS^AppData^Roaming^Microsoft^Windows^Start Menu^Programs^Startup^Logitech . Produktregistrierung.lnk - C:\Programme\Common Files\LogiShrd\eReg\SetPoint\eReg.exe - (Leader Technologies/Logitech) MsConfig - StartUpReg: SandboxieControl - hkey= - key= - P:\Sandboxie 3.62\SbieCtrl.exe (SANDBOXIE L.T.D) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012.01.22 14:37:29 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\PoS\Desktop\OTL.exe [2012.01.22 14:35:29 | 000,000,000 | ---D | C] -- C:\Users\PoS\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten-Dateien [2012.01.22 14:17:58 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012.01.22 14:17:56 | 000,020,464 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012.01.21 02:38:49 | 000,000,000 | ---D | C] -- C:\unepic [2012.01.16 21:25:44 | 000,000,000 | ---D | C] -- C:\ProgramData\Caphyon [2012.01.16 21:25:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\No23 Recorder [2012.01.15 02:40:59 | 000,000,000 | ---D | C] -- C:\CompAdmin [2012.01.14 15:56:54 | 000,000,000 | ---D | C] -- C:\Users\PoS\AppData\Roaming\Opera [2012.01.14 15:56:54 | 000,000,000 | ---D | C] -- C:\Users\PoS\AppData\Local\Opera [2012.01.13 20:15:34 | 000,000,000 | ---D | C] -- C:\Users\PoS\AppData\Local\HP [2012.01.11 19:42:55 | 000,000,000 | ---D | C] -- C:\Users\PoS\AppData\Roaming\WinRAR [2012.01.09 22:58:18 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation [2012.01.09 22:58:14 | 000,000,000 | ---D | C] -- C:\Program Files\AGEIA Technologies [2012.01.09 22:58:14 | 000,000,000 | ---D | C] -- C:\Windows\System32\AGEIA [2012.01.09 22:57:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect 2 [2012.01.09 22:37:27 | 000,000,000 | ---D | C] -- C:\Users\PoS\Documents\BioWare [2012.01.09 22:36:39 | 000,000,000 | ---D | C] -- C:\ProgramData\Media Center Programs [2012.01.09 22:36:37 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Mass Effect [2012.01.09 22:36:37 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\BioWare [2012.01.08 22:14:18 | 000,000,000 | ---D | C] -- C:\Users\PoS\Application Data [2012.01.08 22:13:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Office [2012.01.08 22:13:00 | 000,000,000 | ---D | C] -- C:\Program Files\Common Files\DESIGNER [2012.01.08 22:12:51 | 000,000,000 | ---D | C] -- C:\Windows\PCHEALTH [2012.01.08 22:12:51 | 000,000,000 | ---D | C] -- C:\Program Files\Microsoft.NET [2012.01.08 19:27:47 | 000,000,000 | ---D | C] -- C:\Users\PoS\AppData\Local\Atari [2012.01.08 19:23:53 | 000,000,000 | RH-D | C] -- C:\Users\PoS\AppData\Roaming\SecuROM [2012.01.08 18:47:20 | 000,000,000 | ---D | C] -- C:\Users\PoS\AppData\Roaming\gnupg [2012.01.08 17:36:54 | 000,000,000 | ---D | C] -- C:\Users\PoS\.pdfsam [2011.12.10 23:43:52 | 000,060,928 | ---- | C] ( ) -- C:\Windows\System32\a3d.dll [2011.12.10 23:43:51 | 000,012,800 | ---- | C] ( ) -- C:\Windows\System32\killapps.exe ========== Files - Modified Within 30 Days ========== [2012.01.22 15:07:50 | 000,654,096 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012.01.22 15:07:50 | 000,615,760 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012.01.22 15:07:50 | 000,130,952 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012.01.22 15:07:50 | 000,107,396 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012.01.22 15:03:07 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012.01.22 15:03:00 | 1609,424,896 | -HS- | M] () -- C:\hiberfil.sys [2012.01.22 15:02:27 | 000,020,976 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012.01.22 15:02:27 | 000,020,976 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012.01.22 15:00:11 | 000,000,000 | ---- | M] () -- C:\Users\PoS\defogger_reenable [2012.01.22 14:35:37 | 000,056,727 | ---- | M] () -- C:\Users\PoS\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html [2012.01.22 14:35:01 | 000,302,592 | ---- | M] () -- C:\Users\PoS\Desktop\g17f3izv.exe [2012.01.22 14:34:07 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\PoS\Desktop\OTL.exe [2012.01.22 14:33:46 | 000,050,477 | ---- | M] () -- C:\Users\PoS\Desktop\Defogger.exe [2012.01.22 14:16:42 | 000,002,060 | -H-- | M] () -- C:\Users\PoS\Documents\Default.rdp [2012.01.22 12:58:49 | 000,004,096 | -H-- | M] () -- C:\Users\PoS\AppData\Local\keyfile3.drm [2012.01.22 04:05:41 | 000,054,832 | ---- | M] () -- C:\Windows\System32\BMXStateBkp-{00000002-00000000-00000007-00001102-00000005-00211102}.rfx [2012.01.22 04:05:41 | 000,054,832 | ---- | M] () -- C:\Windows\System32\BMXState-{00000002-00000000-00000007-00001102-00000005-00211102}.rfx [2012.01.22 04:05:41 | 000,000,788 | ---- | M] () -- C:\Windows\System32\DVCState-{00000002-00000000-00000007-00001102-00000005-00211102}.rfx [2012.01.16 20:03:09 | 000,445,016 | ---- | M] (Creative Labs) -- C:\Windows\System32\wrap_oal.dll [2012.01.16 20:03:09 | 000,000,087 | RH-- | M] () -- C:\Windows\ctfile.rfc [2012.01.09 10:00:07 | 000,320,016 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012.01.08 22:13:39 | 000,000,400 | ---- | M] () -- C:\Windows\ODBC.INI [2012.01.08 19:14:58 | 000,000,730 | ---- | M] () -- C:\Users\PoS\Desktop\Dropbox.lnk ========== Files Created - No Company Name ========== [2012.01.22 15:00:11 | 000,000,000 | ---- | C] () -- C:\Users\PoS\defogger_reenable [2012.01.22 14:37:29 | 000,302,592 | ---- | C] () -- C:\Users\PoS\Desktop\g17f3izv.exe [2012.01.22 14:37:29 | 000,050,477 | ---- | C] () -- C:\Users\PoS\Desktop\Defogger.exe [2012.01.22 14:35:29 | 000,056,727 | ---- | C] () -- C:\Users\PoS\Desktop\69886-alle-hilfesuchenden-eroeffnung-themas-beachten.html [2012.01.22 12:58:49 | 000,004,096 | -H-- | C] () -- C:\Users\PoS\AppData\Local\keyfile3.drm [2012.01.17 00:31:24 | 000,054,832 | ---- | C] () -- C:\Windows\System32\BMXState-{00000002-00000000-00000007-00001102-00000005-00211102}.rfx [2012.01.17 00:31:24 | 000,000,788 | ---- | C] () -- C:\Windows\System32\DVCState-{00000002-00000000-00000007-00001102-00000005-00211102}.rfx [2012.01.14 15:56:53 | 000,000,559 | ---- | C] () -- C:\Users\PoS\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Opera.lnk [2012.01.09 19:44:30 | 000,000,654 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader.lnk [2012.01.09 19:44:30 | 000,000,639 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Deinstallationsprogramm.lnk [2012.01.09 19:44:30 | 000,000,624 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\JDownloader Update.lnk [2012.01.08 22:13:39 | 000,000,400 | ---- | C] () -- C:\Windows\ODBC.INI [2012.01.08 19:09:16 | 000,000,730 | ---- | C] () -- C:\Users\PoS\Desktop\Dropbox.lnk [2011.12.19 20:19:15 | 000,006,144 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2011.12.18 21:22:28 | 000,000,091 | ---- | C] () -- C:\Users\PoS\AppData\Local\fusioncache.dat [2011.12.11 02:38:24 | 000,148,480 | ---- | C] () -- C:\Windows\System32\APOMngr.DLL [2011.12.11 02:38:24 | 000,073,728 | ---- | C] () -- C:\Windows\System32\CmdRtr.DLL [2011.12.11 00:01:16 | 000,001,836 | ---- | C] () -- C:\Windows\Sandboxie.ini [2011.12.10 23:43:52 | 000,016,384 | ---- | C] () -- C:\Windows\System32\regplib.exe [2011.12.10 23:43:52 | 000,002,560 | ---- | C] () -- C:\Windows\System32\CtxfiRes.dll [2011.12.10 23:43:52 | 000,002,560 | ---- | C] () -- C:\Windows\CTXFIRES.DLL [2011.12.10 23:43:51 | 000,007,680 | ---- | C] () -- C:\Windows\System32\enlocstr.exe [2011.12.10 23:43:49 | 000,321,512 | ---- | C] () -- C:\Windows\System32\ctdlang.dat [2011.12.10 23:43:49 | 000,056,509 | ---- | C] () -- C:\Windows\System32\ctdnlstr.dat [2011.12.10 23:43:49 | 000,000,285 | ---- | C] () -- C:\Windows\System32\kill.ini [2011.12.10 23:43:48 | 000,021,208 | ---- | C] () -- C:\Windows\System32\instwdm.ini [2011.12.10 23:43:48 | 000,000,054 | ---- | C] () -- C:\Windows\System32\ctzapxx.ini [2011.12.10 20:35:40 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2011.12.10 12:31:36 | 000,007,653 | ---- | C] () -- C:\Users\PoS\AppData\Local\resmon.resmoncfg [2011.11.28 19:24:46 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2011.11.28 19:24:46 | 000,000,000 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat [2011.06.10 06:34:52 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll [2011.04.12 02:30:05 | 000,654,096 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2011.04.12 02:30:05 | 000,295,922 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2011.04.12 02:30:05 | 000,130,952 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2011.04.12 02:30:05 | 000,038,104 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2010.11.20 22:29:26 | 000,066,048 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2009.12.14 22:47:54 | 000,526,848 | ---- | C] () -- C:\Windows\System32\hpgtg400.dll [2009.08.03 00:21:54 | 000,197,912 | ---- | C] () -- C:\Windows\System32\physxcudart_20.dll [2009.08.03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelTraditionalChinese.dll [2009.08.03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSwedish.dll [2009.08.03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSpanish.dll [2009.08.03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelSimplifiedChinese.dll [2009.08.03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelPortugese.dll [2009.08.03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelKorean.dll [2009.08.03 00:21:54 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelJapanese.dll [2009.08.03 00:21:52 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelGerman.dll [2009.08.03 00:21:52 | 000,058,648 | ---- | C] () -- C:\Windows\System32\AgCPanelFrench.dll [2009.07.14 05:57:37 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2009.07.14 05:33:53 | 000,320,016 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2009.07.14 03:05:48 | 000,615,760 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2009.07.14 03:05:48 | 000,291,294 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2009.07.14 03:05:48 | 000,107,396 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2009.07.14 03:05:48 | 000,031,548 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2009.07.14 03:05:05 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2009.07.14 03:04:11 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2009.07.14 00:55:01 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2009.07.14 00:51:43 | 000,073,728 | ---- | C] () -- C:\Windows\System32\BthpanContextHandler.dll [2009.07.14 00:42:10 | 000,064,000 | ---- | C] () -- C:\Windows\System32\BWContextHandler.dll [2009.06.10 22:26:10 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [1996.04.03 20:33:26 | 000,005,248 | ---- | C] () -- C:\Windows\System32\giveio.sys ========== LOP Check ========== [2011.12.20 00:43:29 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\Canneverbe Limited [2012.01.17 23:52:39 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\Dropbox [2011.12.17 22:04:15 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\FileZilla [2011.12.22 03:39:15 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\foobar2000 [2012.01.08 18:47:20 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\gnupg [2011.12.20 00:54:14 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\ImgBurn [2011.12.10 22:39:09 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\IsolatedStorage [2011.12.10 23:03:54 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\Leadertech [2011.12.18 00:11:51 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\LibreOffice [2011.12.10 23:41:39 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\LyX2.0 [2012.01.14 15:56:54 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\Opera [2011.12.10 20:35:44 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\pdfforge [2011.12.18 01:40:03 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\runic games [2011.12.10 21:47:49 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\Symyx [2011.12.12 18:01:17 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\Thunderbird [2011.12.18 01:42:21 | 000,000,000 | ---D | M] -- C:\Users\PoS\AppData\Roaming\Ubisoft [2009.07.14 05:53:46 | 000,018,272 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %SYSTEMDRIVE%\*. > [2011.11.28 19:30:25 | 000,000,000 | -HSD | M] -- C:\$Recycle.Bin [2012.01.15 02:42:11 | 000,000,000 | ---D | M] -- C:\CompAdmin [2012.01.16 21:25:44 | 000,000,000 | -H-D | M] -- C:\Config.Msi [2009.07.14 05:53:55 | 000,000,000 | -HSD | M] -- C:\Documents and Settings [2011.11.28 19:30:03 | 000,000,000 | -HSD | M] -- C:\Dokumente und Einstellungen [2009.07.14 03:37:05 | 000,000,000 | ---D | M] -- C:\PerfLogs [2012.01.09 22:58:14 | 000,000,000 | R--D | M] -- C:\Program Files [2012.01.16 21:25:44 | 000,000,000 | -H-D | M] -- C:\ProgramData [2011.11.28 19:30:03 | 000,000,000 | -HSD | M] -- C:\Programme [2011.11.28 19:30:04 | 000,000,000 | -HSD | M] -- C:\Recovery [2011.12.11 01:54:43 | 000,000,000 | -HSD | M] -- C:\RECYCLER [2011.12.11 00:02:05 | 000,000,000 | R--D | M] -- C:\Sandbox [2012.01.22 15:08:05 | 000,000,000 | -HSD | M] -- C:\System Volume Information [2012.01.21 02:38:49 | 000,000,000 | ---D | M] -- C:\unepic [2011.11.28 19:30:16 | 000,000,000 | R--D | M] -- C:\Users [2012.01.16 20:03:09 | 000,000,000 | ---D | M] -- C:\Windows < %PROGRAMFILES%\*.exe > < %LOCALAPPDATA%\*.exe > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.manifest /3 > < MD5 for: AFD.SYS > [2010.11.20 22:29:19 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=1151FD4FB0216CFED887BFDE29EBD516 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17514_none_d9efac7dbcaf385b\afd.sys [2011.04.25 03:18:03 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=9EBBBA55060F786F0FCAA3893BFA2806 -- C:\Windows\System32\drivers\afd.sys [2011.04.25 03:18:03 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=9EBBBA55060F786F0FCAA3893BFA2806 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.17603_none_d9f97e05bca8003a\afd.sys [2011.04.25 04:24:09 | 000,338,944 | ---- | M] (Microsoft Corporation) MD5=C427F91A748CD342A2B3F9278D9FD6A5 -- C:\Windows\winsxs\x86_microsoft-windows-winsock-core_31bf3856ad364e35_6.1.7601.21712_none_da774a9ad5cea29e\afd.sys < MD5 for: EXPLORER.EXE > [2011.02.26 06:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_54149f9ef14031fc\explorer.exe [2010.11.20 22:29:20 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_53bc10fdd7fe87ca\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\explorer.exe [2011.02.25 06:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- C:\Windows\winsxs\x86_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_5389023fd8245f84\explorer.exe < MD5 for: REGEDIT.EXE > [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\regedit.exe [2009.07.14 02:14:30 | 000,398,336 | ---- | M] (Microsoft Corporation) MD5=8A4883F5E7AC37444F23279239553878 -- C:\Windows\winsxs\x86_microsoft-windows-registry-editor_31bf3856ad364e35_6.1.7600.16385_none_f4050b883d2c3c08\regedit.exe < MD5 for: USERINIT.EXE > [2010.11.20 22:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe [2010.11.20 22:29:06 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe < MD5 for: WININIT.EXE > [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009.07.14 02:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2010.11.20 22:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe [2010.11.20 22:29:06 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe < HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs > HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Required: DebugWindows [binary data] HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems\\Windows: %SystemRoot%\system32\csrss.exe ObjectDirectory=\Windows SharedSection=1024,12288,512 Windows=On SubSystemType=Windows ServerDll=basesrv,1 ServerDll=winsrv:UserServerDllInitialization,3 ServerDll=winsrv:ConServerDllInitialization,2 ServerDll=sxssrv,4 ProfileControl=Off MaxRequestThreads=16 < HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU > < HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs > HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install\\LastSuccessTime: 2011-12-23 12:30:47 < End of report > |
|
31.01.2012, 16:41
| #2 |
| | MBAM-Seite nicht aufrufbar / MSIBF4D.tmp (HackTool.Hiderun) Thema kann gelöscht/geschlossen werden. Problem wurde mittels Format C gelöst.
__________________Falls man mir noch mitteilen möchte, warum in diesem Fall konkret keine Hilfe angeboten wurde, darf man dies gern tun. Lag es jetzt wirklich nur daran, dass die Windows-Version noch nicht aktiviert worden war? MfG  |
|
| Themen zu MBAM-Seite nicht aufrufbar / MSIBF4D.tmp (HackTool.Hiderun) |
| 0x00000001, 192.168.0.2, adobe, antivir, aufrufe, autorun, avg, avira, bho, browser, dateisystem, defender, desktop, excel, excel.exe, explorer, fehler, firefox, hacktool.hiderun, helper, heuristiks/extra, heuristiks/shuriken, internet, locker, log-datei, logfile, mozilla thunderbird, nicht möglich, otl-log, plug-in, port, problem, proxy, registry, required, rundll, software, system, webcheck, windows |
Linear-Darstellung
