Logauswertung von FRST64 nach Virenbefall und Virenbereinigung

exzel · 16.08.2013, 13:45

Hallo zusammen,

Kunde von mir hatte mehrere Viren drauf. Ich habe diese mit Kaspersky, Avira und Bitdefender Rescue CDs herunterbekommen und danach noch Spybot und Mbam im abgesicherten Modus drüberlaufen lassen.

Hier die Logfile von FRST64. Bitte helft mir bei der Viren- bzw. Manipulationsbekämpfung.

Gruß und Dank!

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013 (ATTENTION: FRST version is 43 days old)
Ran by SYSTEM on 16-08-2013 14:11:37
Running from F:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2122536 2010-05-07] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10144288 2010-04-13] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe [3203440 2010-04-06] (Dell Inc.)
HKLM\...\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1928976 2010-03-05] (Intel(R) Corporation)
HKLM\...\Run: [PrnStatusMX] C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [1238528 2007-08-29] (Marvell Semiconductor, Inc.)
HKLM\...\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup [483424 2012-02-01] ()
HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [559616 2011-10-22] (Dell)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [514544 2010-11-17] ()
HKLM-x32\...\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [487562 2010-08-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "c:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)
HKLM-x32\...\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup [968048 2012-02-01] ()
HKLM-x32\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1573576 2012-10-16] (Ask)
HKLM-x32\...\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-08-16] (Avira Operations GmbH & Co. KG)
HKU\Gerco\...\Run: [Google Update] "C:\Users\Gerco\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-03-27] (Google Inc.)
Startup: C:\Users\Gerco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t@x aktuell.lnk
ShortcutTarget: t@x aktuell.lnk ->  (No File)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Services (Whitelisted) =================

S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-16] (Avira Operations GmbH & Co. KG)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-16] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-16] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-16] (Avira Operations GmbH & Co. KG)
S3 STIrUsb; C:\Windows\System32\DRIVERS\irstusb.sys [33792 2008-01-18] (SigmaTel, Inc.)

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\system32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\avgntflt.sys 09E6069EF94B345061B4BD3CEBD974C8
C:\Windows\System32\DRIVERS\avipbb.sys 488486DAD09A5B6C6DBB8B990A8B2307
C:\Windows\System32\DRIVERS\avkmgr.sys 490FA25161BF3E51993EB724ECF0ACEB
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CtClsFlt.sys FBE228ABEAB2BE13B9C3A3A112D4D8DC
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys B6AC71AAA2B10848F57FC49D55A651AF
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys ABBF174CB394F5C437410A788B7E404A
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys 31569A2E836C12014148BF7342716946
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Impcd.sys DD587A55390ED2295BCE6D36AD567DA9
C:\Windows\System32\drivers\RTKVHD64.sys 6E4CCB3AFF07E2B9F2A937385C84B573
C:\Windows\System32\DRIVERS\IntcDAud.sys 03C74719D48056A1078F3A51CEB76BAA
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\irda.sys 05360B1EA5A2ABF620D1D96EBD8BD8F1
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1C62x64.sys 39918DB0EFCF045A1CE6FABBF339F975
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NETw5s64.sys 24F64343F14A119308456E1CA7507B26
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\System32\Drivers\PxHlpa64.sys 87B04878A6D59D6C79251DC960C674C1
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 22D6B47D004A6568C500680BE2972854
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfslh.sys C6CC9297BD53E5229653303E556AA539
C:\Windows\System32\DRIVERS\Sftplaylh.sys 390AA7BC52CEE43F6790CDEA1E776703
C:\Windows\System32\DRIVERS\Sftredirlh.sys 617E29A0B0A2807466560D4C4E338D3E
C:\Windows\System32\DRIVERS\Sftvollh.sys 8F571F016FA1976F445147E9E6C8AE9B
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\irstusb.sys 1A807A037503B285016E61100D04614A
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys C25866BDF0E818E02BB8E76845D26E54
C:\Windows\System32\drivers\tcpip.sys DB74544B75566C974815E79A62433F29
C:\Windows\System32\DRIVERS\tcpip.sys DB74544B75566C974815E79A62433F29
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys 4CE278FC9671BA81A138D70823FCAA09
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\system32\drivers\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\WDKMD.sys FE31110E39A0B11ABAE1BA43A2DC94F9
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wimfltr.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-16 14:09 - 2013-08-16 14:09 - 00000000 ____D C:\FRST
2013-08-16 05:16 - 2013-07-26 00:13 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-16 05:16 - 2013-07-26 00:13 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-16 05:16 - 2013-07-26 00:13 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-16 05:16 - 2013-07-26 00:12 - 19239424 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 15405056 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-16 05:16 - 2013-07-25 22:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-16 05:16 - 2013-07-25 22:13 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-16 05:16 - 2013-07-25 22:13 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 14329344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 02048512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-16 05:16 - 2013-07-25 22:11 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 05:16 - 2013-07-25 22:11 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-16 05:16 - 2013-07-25 21:49 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-16 05:16 - 2013-07-25 21:39 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-16 05:16 - 2013-07-25 20:59 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 05:04 - 2013-07-18 20:58 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-16 05:04 - 2013-07-18 20:41 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 05:04 - 2013-07-06 01:03 - 01910208 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-16 05:03 - 2013-07-09 00:52 - 00224256 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-16 05:03 - 2013-07-09 00:46 - 01472512 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-16 05:03 - 2013-07-09 00:46 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-16 05:03 - 2013-07-09 00:46 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-16 05:03 - 2013-07-08 23:52 - 00175104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 05:03 - 2013-07-08 23:46 - 01166848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 05:03 - 2013-07-08 23:46 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 05:03 - 2013-07-08 23:46 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 05:02 - 2013-07-25 04:25 - 01888768 ____A (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-16 05:02 - 2013-07-25 03:57 - 01620992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 05:02 - 2013-07-09 00:51 - 01217024 ____A (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-16 05:02 - 2013-07-08 23:52 - 00663552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 05:02 - 2013-06-14 23:32 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-16 04:08 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\System32\Drivers\etc\hosts.20130816-110813.backup
2013-08-16 02:51 - 2013-08-16 02:51 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Avira
2013-08-16 02:46 - 2013-08-16 02:46 - 00000000 ____A C:\Users\Gerco\Documents\APNSetup.exe
2013-08-16 02:44 - 2013-08-16 02:43 - 00130016 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-08-16 02:44 - 2013-08-16 02:43 - 00100712 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-08-16 02:44 - 2013-08-16 02:43 - 00028600 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-08-16 02:43 - 2013-08-16 02:45 - 00000000 ____D C:\ProgramData\Avira
2013-08-16 02:43 - 2013-08-16 02:45 - 00000000 ____D C:\ProgramData\Application Data\Avira
2013-08-16 02:43 - 2013-08-16 02:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-16 02:42 - 2013-08-16 04:47 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-16 02:42 - 2013-08-16 04:47 - 00000000 ____D C:\ProgramData\Application Data\Spybot - Search & Destroy
2013-08-16 02:42 - 2013-08-16 02:42 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:45 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-16 02:41 - 2013-08-16 02:41 - 00001341 ____A C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001341 ____A C:\ProgramData\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001071 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001071 ____A C:\ProgramData\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\ProgramData\Application Data\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-16 02:41 - 2013-04-04 07:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-08-16 02:41 - 2009-01-25 06:14 - 00017272 ____A (Safer Networking Limited) C:\Windows\System32\sdnclean64.exe
2013-07-31 04:12 - 2013-07-31 04:12 - 00000000 ____D C:\Users\Gerco\AppData\Local\{BB7F162A-BE2F-4325-BEA7-FADDC0337E80}
2013-07-31 03:31 - 2013-07-31 03:37 - 00147429 ____A C:\Users\Gerco\ESt2012_Geisberger_Gerhard.elfo
2013-07-30 02:42 - 2013-07-30 02:42 - 00000000 ____D C:\Users\Gerco\AppData\Local\{5F7FC26D-0E50-4F71-A9BA-C1615A4E0415}
2013-07-29 05:37 - 2013-08-16 05:10 - 00000000 ____D C:\Windows\System32\MRT
2013-07-28 02:00 - 2013-07-28 02:00 - 00000000 ____D C:\Users\Gerco\AppData\Local\{22403C4F-804D-4DEC-A97B-AE92EF8E2471}
2013-07-27 01:56 - 2013-07-27 01:56 - 00000000 ____D C:\Users\Gerco\AppData\Local\{3C77EFEF-E4C1-429D-9236-1BF3959DFF54}
2013-07-25 12:43 - 2013-07-25 12:43 - 00000000 ____D C:\Users\Gerco\AppData\Local\{FE693B55-937D-40C2-AD23-9C7CC20AE122}
2013-07-24 10:38 - 2013-07-24 10:38 - 00000000 ____D C:\Users\Gerco\AppData\Local\{B70E1F06-BA80-4218-9A67-5AEE5BCF0085}
2013-07-23 07:21 - 2013-07-23 07:21 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\TeamViewer
2013-07-23 03:51 - 2013-07-23 03:51 - 00000000 ____D C:\Users\Gerco\AppData\Local\{36F0B174-ADB2-44B8-AD6D-5C21740E5E85}
2013-07-22 04:52 - 2013-07-23 07:00 - 00147550 ____A C:\Users\Gerco\ESt2012_Geisberger_Gerhard_und_Geisberger_Cornelia.elfo
2013-07-22 03:11 - 2013-07-31 03:46 - 00000000 ____D C:\Users\Gerco\AppData\Local\.elfohilfe
2013-07-22 01:58 - 2013-07-22 01:58 - 00000000 ____D C:\Users\Gerco\AppData\Local\{47443C6C-EC13-454E-8622-2C5974401450}
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\plugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\images
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\hilfe
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\stylesheet
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\signatur
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\schema
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\printxml
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\plugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\eric
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\dict
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\bin\qtplugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\bin
2013-07-21 04:03 - 2013-05-22 00:22 - 00006512 ____A C:\Users\dict\pica_0.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000520 ____A C:\Users\dict\est_12.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000520 ____A C:\Users\dict\est_11.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000520 ____A C:\Users\dict\est_10.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000516 ____A C:\Users\dict\est_09.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\pica_0.dict.sig
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\est_12.dict.sig
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\est_11.dict.sig
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\est_10.dict.sig
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\est_09.dict.sig
2013-07-21 04:03 - 2013-05-21 11:50 - 08172544 ____A C:\Users\bin\QtGui4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 02551296 ____A C:\Users\bin\QtXmlPatterns4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 02291712 ____A C:\Users\eric\QtCore4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 02291712 ____A C:\Users\bin\QtCore4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 01099776 ____A (The OpenSSL Project, hxxp://www.openssl.org/) C:\Users\bin\libeay32.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00970752 ____A C:\Users\bin\QtNetwork4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00894464 ____A C:\Users\bin\QtCLucene4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00722432 ____A C:\Users\bin\qca2.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00587776 ____A C:\Users\bin\QtSql4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00428544 ____A C:\Users\bin\QtHelp4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00339456 ____A C:\Users\eric\QtXml4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00339456 ____A C:\Users\bin\QtXml4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00276480 ____A C:\Users\bin\QtSvg4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00237056 ____A (The OpenSSL Project, hxxp://www.openssl.org/) C:\Users\bin\ssleay32.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00216576 ____A C:\Users\bin\gmp.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00207872 ____A C:\Users\bin\patchw32.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00035328 ____A C:\Users\bin\patch.exe
2013-07-21 04:03 - 2013-05-21 11:50 - 00001176 ____A C:\Users\dict\instv_0.dict
2013-07-21 04:03 - 2013-05-21 11:50 - 00000512 ____A C:\Users\dict\instv_0.dict.sig
2013-07-21 04:03 - 2013-05-21 11:49 - 19562496 ____A (Finanzverwaltung der Länder) C:\Users\eric\erustart.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 18278400 ____A (The ICU Project) C:\Users\eric\icudt48.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 10510848 ____A C:\Users\plugins\plugin_est_11.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 10213888 ____A C:\Users\plugins\plugin_est_12.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 09497600 ____A C:\Users\plugins\plugin_est_10.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 09053184 ____A C:\Users\plugins\plugin_est_09.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 06168576 ____A (Finanzverwaltung der Länder) C:\Users\eric\F80EF.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 05093888 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericbasis.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 04479832 ____A (Microsoft Corporation) C:\Users\bin\vcredist_x86_2008_sp1.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 03829760 ____A (Finanzverwaltung der Länder) C:\Users\eric\umelst.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 03275264 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericprint.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 02334208 ____A (secunet Security Networks AG) C:\Users\eric\eSigner.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01879552 ____A C:\Users\bin\pica.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 01823744 ____A (Apache Software Foundation) C:\Users\eric\xerces.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01673728 ____A C:\Users\bin\installationsverwaltung.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 01664512 ____A (The ICU Project) C:\Users\eric\icuin48.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01640960 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\erictransfer.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01626112 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericxml.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01273344 ____A (The ICU Project) C:\Users\eric\icuuc48.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01232896 ____A (Finanzverwaltung der Länder) C:\Users\eric\bds2f80.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 00949760 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericutil.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00943104 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericcrypt.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00671744 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericapi.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00652288 ____A (Finanzverwaltung der Länder) C:\Users\eric\taview.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00546816 ____A C:\Users\bin\integritaetspruefer.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 00505344 ____A C:\Users\bin\hotlineTool.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 00394472 ____A C:\Users\eric\F89GDX.DAT
2013-07-21 04:03 - 2013-05-21 11:49 - 00351744 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericplugin.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00345088 ____A C:\Users\eric\ericprozess.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 00151552 ____A (Bastiaan Bakker, LifeLine Networks bv ) C:\Users\eric\log4cpp.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00123392 ____A (Finanzverwaltung der Länder) C:\Users\eric\eva.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00115712 ____A (Finanzverwaltung der Länder) C:\Users\eric\bdiff.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00099840 ____A (Finanzverwaltung der Länder) C:\Users\eric\txt2pdf.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00075264 ____A (Finanzverwaltung der Länder) C:\Users\eric\hints.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00061440 ____A C:\Users\eric\F89GDX.idx
2013-07-21 04:03 - 2013-05-21 11:49 - 00003045 ____A C:\Users\eric\rpfest_init.txt
2013-07-21 04:03 - 2013-05-21 11:48 - 00953856 ____A C:\Users\bin\hilfepica.exe
2013-07-21 04:03 - 2013-05-13 02:50 - 01080320 ____A C:\Users\hilfe\elfo.bedienung.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00613376 ____A C:\Users\hilfe\elfo.est.2011.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00595968 ____A C:\Users\hilfe\elfo.est.2010.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00583680 ____A C:\Users\hilfe\elfo.est.2012.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00575488 ____A C:\Users\hilfe\elfo.est.2009.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00024576 ____A C:\Users\hilfe\elfo.est.2011.qhc
2013-07-21 04:03 - 2013-05-13 02:49 - 00024576 ____A C:\Users\hilfe\elfo.est.2010.qhc
2013-07-21 04:03 - 2013-05-13 02:49 - 00024576 ____A C:\Users\hilfe\elfo.est.2009.qhc
2013-07-21 04:03 - 2013-05-13 02:49 - 00024576 ____A C:\Users\hilfe\elfo.bedienung.qhc
2013-07-21 04:03 - 2013-05-13 02:49 - 00017408 ____A C:\Users\hilfe\elfo.est.2012.qhc
2013-07-21 03:49 - 2013-07-21 03:50 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (2).exe
2013-07-21 03:48 - 2013-07-21 03:48 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (1).exe
2013-07-21 03:47 - 2013-07-21 04:03 - 00000980 ____A C:\Users\Public\Desktop\ElsterFormular.lnk
2013-07-21 03:47 - 2013-07-21 04:03 - 00000980 ____A C:\ProgramData\Desktop\ElsterFormular.lnk
2013-07-21 03:46 - 2013-07-21 03:46 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-21 03:33 - 2013-07-21 03:34 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p.exe
2013-07-20 09:39 - 2013-07-20 09:39 - 00000000 ____D C:\Users\Gerco\AppData\Local\{10A4DEBC-444A-4D82-9E50-6778892C30A9}
2013-07-19 01:36 - 2013-07-19 01:36 - 00000000 ____D C:\Users\Gerco\AppData\Local\{68F81983-C0F8-49CF-B790-DC5F8AAA8586}

==================== One Month Modified Files and Folders =======

2013-08-16 14:09 - 2013-08-16 14:09 - 00000000 ____D C:\FRST
2013-08-16 07:07 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-16 07:07 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default\Local Settings\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default\Local Settings\Application Data\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default User\Local Settings\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default User\Local Settings\Application Data\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:27 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-08-16 07:03 - 2012-09-14 02:59 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-16 07:03 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-08-16 07:03 - 2009-07-13 23:51 - 00029659 ____A C:\Windows\setupact.log
2013-08-16 07:02 - 2009-07-14 00:10 - 01279641 ____A C:\Windows\WindowsUpdate.log
2013-08-16 06:51 - 2012-09-14 02:59 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-16 06:41 - 2011-03-27 05:28 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000UA.job
2013-08-16 06:17 - 2012-10-28 03:43 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-16 05:12 - 2009-07-14 12:58 - 00654852 ____A C:\Windows\System32\perfh007.dat
2013-08-16 05:12 - 2009-07-14 12:58 - 00130434 ____A C:\Windows\System32\perfc007.dat
2013-08-16 05:12 - 2009-07-14 00:13 - 01522350 ____A C:\Windows\System32\PerfStringBackup.INI
2013-08-16 05:10 - 2013-07-29 05:37 - 00000000 ____D C:\Windows\System32\MRT
2013-08-16 05:07 - 2011-10-25 01:00 - 78161360 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-16 05:00 - 2012-10-28 03:43 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-16 05:00 - 2011-07-14 13:23 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-16 04:59 - 2011-04-02 10:07 - 00000000 ____D C:\Users\Gerco\AppData\Local\Adobe
2013-08-16 04:47 - 2013-08-16 02:42 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-16 04:47 - 2013-08-16 02:42 - 00000000 ____D C:\ProgramData\Application Data\Spybot - Search & Destroy
2013-08-16 02:52 - 2011-03-15 17:33 - 00074978 ____A C:\Windows\PFRO.log
2013-08-16 02:51 - 2013-08-16 02:51 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Avira
2013-08-16 02:46 - 2013-08-16 02:46 - 00000000 ____A C:\Users\Gerco\Documents\APNSetup.exe
2013-08-16 02:45 - 2013-08-16 02:43 - 00000000 ____D C:\ProgramData\Avira
2013-08-16 02:45 - 2013-08-16 02:43 - 00000000 ____D C:\ProgramData\Application Data\Avira
2013-08-16 02:45 - 2013-08-16 02:41 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-16 02:43 - 2013-08-16 02:44 - 00130016 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-08-16 02:43 - 2013-08-16 02:44 - 00100712 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-08-16 02:43 - 2013-08-16 02:44 - 00028600 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-08-16 02:43 - 2013-08-16 02:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-16 02:42 - 2013-08-16 02:42 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00001341 ____A C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001341 ____A C:\ProgramData\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001071 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001071 ____A C:\ProgramData\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\ProgramData\Application Data\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-16 00:36 - 2012-09-14 02:59 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-16 00:33 - 2011-03-15 23:55 - 00000000 ____D C:\ProgramData\Sonic
2013-08-16 00:33 - 2011-03-15 23:55 - 00000000 ____D C:\ProgramData\Application Data\Sonic
2013-08-13 07:35 - 2011-03-27 05:28 - 00001068 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000Core.job
2013-08-02 11:16 - 2013-05-22 05:26 - 00000000 ____D C:\Program Files\My Dell
2013-08-02 11:16 - 2011-03-27 05:00 - 00000000 ____D C:\ProgramData\PCDr
2013-08-02 11:16 - 2011-03-27 05:00 - 00000000 ____D C:\ProgramData\Application Data\PCDr
2013-08-02 11:16 - 2011-03-27 04:56 - 00000000 ____D C:\users\Gerco
2013-08-02 11:16 - 2009-07-14 13:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-08-02 11:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\NDF
2013-08-02 11:15 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
2013-07-31 04:12 - 2013-07-31 04:12 - 00000000 ____D C:\Users\Gerco\AppData\Local\{BB7F162A-BE2F-4325-BEA7-FADDC0337E80}
2013-07-31 03:46 - 2013-07-22 03:11 - 00000000 ____D C:\Users\Gerco\AppData\Local\.elfohilfe
2013-07-31 03:37 - 2013-07-31 03:31 - 00147429 ____A C:\Users\Gerco\ESt2012_Geisberger_Gerhard.elfo
2013-07-30 02:42 - 2013-07-30 02:42 - 00000000 ____D C:\Users\Gerco\AppData\Local\{5F7FC26D-0E50-4F71-A9BA-C1615A4E0415}
2013-07-28 02:00 - 2013-07-28 02:00 - 00000000 ____D C:\Users\Gerco\AppData\Local\{22403C4F-804D-4DEC-A97B-AE92EF8E2471}
2013-07-27 01:56 - 2013-07-27 01:56 - 00000000 ____D C:\Users\Gerco\AppData\Local\{3C77EFEF-E4C1-429D-9236-1BF3959DFF54}
2013-07-26 00:13 - 2013-08-16 05:16 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-26 00:13 - 2013-08-16 05:16 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-26 00:13 - 2013-08-16 05:16 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-26 00:12 - 2013-08-16 05:16 - 19239424 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 15405056 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-25 22:35 - 2013-08-16 05:16 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-25 22:13 - 2013-08-16 05:16 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-25 22:13 - 2013-08-16 05:16 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 14329344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 02048512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-25 22:11 - 2013-08-16 05:16 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-25 22:11 - 2013-08-16 05:16 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-25 21:49 - 2013-08-16 05:16 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-25 21:39 - 2013-08-16 05:16 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-25 20:59 - 2013-08-16 05:16 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 12:43 - 2013-07-25 12:43 - 00000000 ____D C:\Users\Gerco\AppData\Local\{FE693B55-937D-40C2-AD23-9C7CC20AE122}
2013-07-25 04:25 - 2013-08-16 05:02 - 01888768 ____A (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-25 03:57 - 2013-08-16 05:02 - 01620992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-24 10:38 - 2013-07-24 10:38 - 00000000 ____D C:\Users\Gerco\AppData\Local\{B70E1F06-BA80-4218-9A67-5AEE5BCF0085}
2013-07-23 07:30 - 2012-08-26 07:57 - 00000000 ____D C:\Users\Gerco\Documents\Handbuch
2013-07-23 07:21 - 2013-07-23 07:21 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\TeamViewer
2013-07-23 07:00 - 2013-07-22 04:52 - 00147550 ____A C:\Users\Gerco\ESt2012_Geisberger_Gerhard_und_Geisberger_Cornelia.elfo
2013-07-23 03:51 - 2013-07-23 03:51 - 00000000 ____D C:\Users\Gerco\AppData\Local\{36F0B174-ADB2-44B8-AD6D-5C21740E5E85}
2013-07-22 03:04 - 2012-08-22 09:47 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\elsterformular
2013-07-22 01:58 - 2013-07-22 01:58 - 00000000 ____D C:\Users\Gerco\AppData\Local\{47443C6C-EC13-454E-8622-2C5974401450}
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\plugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\images
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\hilfe
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\stylesheet
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\signatur
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\schema
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\printxml
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\plugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\eric
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\dict
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\bin\qtplugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\bin
2013-07-21 04:03 - 2013-07-21 03:47 - 00000980 ____A C:\Users\Public\Desktop\ElsterFormular.lnk
2013-07-21 04:03 - 2013-07-21 03:47 - 00000980 ____A C:\ProgramData\Desktop\ElsterFormular.lnk
2013-07-21 03:50 - 2013-07-21 03:49 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (2).exe
2013-07-21 03:48 - 2013-07-21 03:48 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (1).exe
2013-07-21 03:46 - 2013-07-21 03:46 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-21 03:46 - 2012-08-22 09:42 - 00000000 ____D C:\Users\Gerco\bin
2013-07-21 03:46 - 2012-08-22 09:42 - 00000000 ____D C:\ProgramData\elsterformular
2013-07-21 03:46 - 2012-08-22 09:42 - 00000000 ____D C:\ProgramData\Application Data\elsterformular
2013-07-21 03:34 - 2013-07-21 03:33 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p.exe
2013-07-20 09:39 - 2013-07-20 09:39 - 00000000 ____D C:\Users\Gerco\AppData\Local\{10A4DEBC-444A-4D82-9E50-6778892C30A9}
2013-07-19 01:36 - 2013-07-19 01:36 - 00000000 ____D C:\Users\Gerco\AppData\Local\{68F81983-C0F8-49CF-B790-DC5F8AAA8586}
2013-07-18 20:58 - 2013-08-16 05:04 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-07-18 20:41 - 2013-08-16 05:04 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

Files to move or delete:
====================
C:\Users\bin\hilfepica.exe
C:\Users\bin\hotlineTool.exe
C:\Users\bin\installationsverwaltung.exe
C:\Users\bin\integritaetspruefer.exe
C:\Users\bin\patch.exe
C:\Users\bin\pica.exe
C:\Users\bin\vcredist_x86_2008_sp1.exe
C:\Users\eric\bds2f80.exe
C:\Users\eric\ericprozess.exe
C:\Users\eric\erustart.exe
C:\Users\eric\F80EF.exe
C:\Users\eric\umelst.exe

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-07-03 08:54:17
Restore point made on: 2013-07-09 01:35:24
Restore point made on: 2013-07-12 07:27:28
Restore point made on: 2013-07-12 13:05:26
Restore point made on: 2013-07-16 01:22:17
Restore point made on: 2013-07-23 04:02:43
Restore point made on: 2013-07-23 08:44:30
Restore point made on: 2013-07-27 02:04:52
Restore point made on: 2013-07-29 05:31:23
Restore point made on: 2013-08-02 00:49:00
Restore point made on: 2013-08-16 05:06:57
Restore point made on: 2013-08-16 06:15:26

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=E:
description             Windows Boot Manager
locale                  de-de
inherit                 {globalsettings}
default                 {default}
resumeobject            {97ef55d0-4f9d-11e0-8da6-df4b74b9fb5e}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-de
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {97ef55d0-4f9d-11e0-8da6-df4b74b9fb5e}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{97ef55d3-4f9d-11e0-8da6-df4b74b9fb5e}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{97ef55d3-4f9d-11e0-8da6-df4b74b9fb5e}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {97ef55d0-4f9d-11e0-8da6-df4b74b9fb5e}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=E:
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {97ef55d3-4f9d-11e0-8da6-df4b74b9fb5e}
description             Ramdisk Options
ramdisksdidevice        partition=E:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 18%
Total physical RAM: 2932.52 MB
Available physical RAM: 2379.8 MB
Total Pagefile: 2930.67 MB
Available Pagefile: 2370.69 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:283.34 GB) (Free:227.56 GB) NTFS (Disk=0 Partition=3)
Drive e: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:5.53 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive f: (LEXAR) (Removable) (Total:3.7 GB) (Free:0.73 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 07F2837E)
Partition 1: (Not Active) - (Size=102 MB) - (Type=DE)
Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=283 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=4 GB) - (Type=0B)


LastRegBack: 2012-11-23 03:34

==================== End Of Log ============================

cosinus · 16.08.2013, 13:57

Hallo,

Zitat:

Kunde von mir hatte mehrere Viren drauf.

Ein Kunde von dir?

Bist du ein IT-Dienstleister bzw hast du eine PC-Werkstatt?

exzel · 16.08.2013, 15:08

Bin IT-Dienstleister. Bevor jetzt irgendwelche Fragen bezüglich meines Tätigkeitsfeldes kommen. Ich bin nicht auf Virensuche derart spezialisiert wie manche User hier im Forum, die mir auch schon geholfen haben.

cosinus · 17.08.2013, 14:14

Hast du die Logs der Virenscanner mit den Funden noch?

exzel · 17.08.2013, 14:16

Danke für die Rückmeldung.

Hmm... Da müsste ich nochmal nachsehen. Bei der Kaspersky CD könnte ich die noch haben.

Ich stelle sie dann rein, ok? Kann ich sonst noch irgendwas tun?

cosinus · 17.08.2013, 14:17

Poste diese Logs erstmal in CODE-Tags...dann sehen wir weiter

exzel · 17.08.2013, 14:59

Hallo und danke für die Rückmeldung.

Also hier das Log.

Code:

ATTFilter

Status: Gelöscht  (Ereignisse: 14)	
12.08.13 17:06	Gelöscht	trojanisches Programm Trojan-Ransom.Win32.Foreign.gcox	C:/Users/Gerco/AppData/Roaming/data.dat	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm Exploit.Java.CVE-2013-0431.g	C:/Users/Gerco/AppData/Local/Temp/jar_cache40738514793327354.tmp	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm Exploit.Java.CVE-2013-0431.g	C:/Users/Gerco/AppData/Local/Temp/jar_cache4097872476894490395.tmp	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm HEUR:Exploit.Java.CVE-2012-1723.gen	C:/Users/Gerco/AppData/Local/Temp/jar_cache5331582420954945585.tmp	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm HEUR:Exploit.Java.Generic	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm HEUR:Exploit.Java.CVE-2012-1723.gen	C:/Users/Gerco/AppData/Local/Temp/jar_cache5920237745829351955.tmp	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm HEUR:Exploit.Java.CVE-2013-0431.gen	C:/Users/Gerco/AppData/Local/Temp/jar_cache6198916500890633881.tmp	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm HEUR:Exploit.Java.CVE-2012-1723.gen	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm Exploit.Java.CVE-2013-0431.g	C:/Users/Gerco/AppData/Local/Temp/jar_cache6450737252490299601.tmp	Hoch	
12.08.13 17:05	Gelöscht	trojanisches Programm Exploit.Java.CVE-2012-1723.lq	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp//AxQwsAx.class	Hoch	
12.08.13 17:06	Gelöscht	trojanisches Programm HEUR:Exploit.Java.CVE-2012-1723.gen	C:/Users/Gerco/AppData/Local/Temp/jar_cache6851122382070680027.tmp	Hoch	
12.08.13 17:06	Gelöscht	trojanisches Programm HEUR:Exploit.Java.CVE-2012-1723.gen	C:/Users/Gerco/AppData/Local/Temp/jar_cache712013472416579903.tmp	Hoch	
12.08.13 17:06	Gelöscht	trojanisches Programm Exploit.Java.CVE-2013-0431.g	C:/Users/Gerco/AppData/Local/Temp/jar_cache8953720277976325353.tmp	Hoch	
12.08.13 17:06	Gelöscht	trojanisches Programm HEUR:Exploit.Java.Generic	C:/Users/Gerco/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/17/126397d1-36900cde	Hoch

cosinus · 17.08.2013, 16:04

Waren das die einzigen Funde?

exzel · 17.08.2013, 17:00

Ja. Ich habe noch einmal den vollständigen Bericht mir anzeigen lassen. Dort wurden zwar
116 Funde angezeigt. Aber es kommt in diesem Bericht immer mehrmals die gleiche Datei vor. Ich habe die Dateinamen bei den beiden Berichten stichprobenartig verglichen. Sie stimmten überein. Hier der vollständige Bericht.

Code:

ATTFilter

Ergebnis: Gefunden  (Ereignisse: 116)	
12.08.13 17:06	C:/Users/Gerco/AppData/Roaming/data.dat		
12.08.13 14:24	C:/Users/Gerco/AppData/Roaming/data.dat		
12.08.13 13:46	C:/Users/Gerco/AppData/Roaming/data.dat		
12.08.13 13:00	C:/Users/Gerco/AppData/Roaming/data.dat		
12.08.13 12:24	C:/Users/Gerco/AppData/Roaming/data.dat		
12.08.13 11:37	C:/Users/Gerco/AppData/Roaming/data.dat		
12.08.13 10:56	C:/Users/Gerco/AppData/Roaming/data.dat		
12.08.13 17:06	C:/Users/Gerco/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/17/126397d1-36900cde		
12.08.13 14:24	C:/Users/Gerco/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/17/126397d1-36900cde		
12.08.13 13:00	C:/Users/Gerco/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/17/126397d1-36900cde		
12.08.13 11:37	C:/Users/Gerco/AppData/LocalLow/Sun/Java/Deployment/cache/6.0/17/126397d1-36900cde		
12.08.13 17:06	C:/Users/Gerco/AppData/Local/Temp/jar_cache8953720277976325353.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache8953720277976325353.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache8953720277976325353.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache8953720277976325353.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache8953720277976325353.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache8953720277976325353.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache8953720277976325353.tmp		
12.08.13 17:06	C:/Users/Gerco/AppData/Local/Temp/jar_cache712013472416579903.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache712013472416579903.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache712013472416579903.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache712013472416579903.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache712013472416579903.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache712013472416579903.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache712013472416579903.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache6851122382070680027.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache6851122382070680027.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache6851122382070680027.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache6851122382070680027.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache6851122382070680027.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache6851122382070680027.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache6851122382070680027.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache6450737252490299601.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache6450737252490299601.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache6450737252490299601.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache6450737252490299601.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache6450737252490299601.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache6450737252490299601.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache6450737252490299601.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache6198916500890633881.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache6198916500890633881.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache6198916500890633881.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache6198916500890633881.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache6198916500890633881.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache6198916500890633881.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache6198916500890633881.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp/AxQwsAx.class		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp/AxQwsAx.class		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp/AxQwsAx.class		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp/AxQwsAx.class		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp/AxQwsAx.class		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp/AxQwsAx.class		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp/AxQwsAx.class		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache6135539993788642647.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache5920237745829351955.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache5920237745829351955.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache5920237745829351955.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache5920237745829351955.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache5920237745829351955.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache5920237745829351955.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache5920237745829351955.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache5846394655433957283.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache5331582420954945585.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache5331582420954945585.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache5331582420954945585.tmp		
12.08.13 13:30	C:/Users/Gerco/AppData/Local/Temp/jar_cache5331582420954945585.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache5331582420954945585.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache5331582420954945585.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache5331582420954945585.tmp		
12.08.13 17:05	C:/Users/Gerco/AppData/Local/Temp/jar_cache4097872476894490395.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache4097872476894490395.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache4097872476894490395.tmp		
12.08.13 13:29	C:/Users/Gerco/AppData/Local/Temp/jar_cache4097872476894490395.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache4097872476894490395.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache4097872476894490395.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache4097872476894490395.tmp		
12.08.13 16:09	C:/Users/Gerco/AppData/Local/Temp/jar_cache40738514793327354.tmp		
12.08.13 14:55	C:/Users/Gerco/AppData/Local/Temp/jar_cache40738514793327354.tmp		
12.08.13 14:14	C:/Users/Gerco/AppData/Local/Temp/jar_cache40738514793327354.tmp		
12.08.13 13:29	C:/Users/Gerco/AppData/Local/Temp/jar_cache40738514793327354.tmp		
12.08.13 12:49	C:/Users/Gerco/AppData/Local/Temp/jar_cache40738514793327354.tmp		
12.08.13 12:07	C:/Users/Gerco/AppData/Local/Temp/jar_cache40738514793327354.tmp		
12.08.13 11:26	C:/Users/Gerco/AppData/Local/Temp/jar_cache40738514793327354.tmp

cosinus · 17.08.2013, 21:05

Rootkitscan mit GMER

Bitte lade dir

GMER herunter: (Dateiname zufällig)

Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
WARNING !!!
GMER has found system modification, which might have been caused by ROOTKIT activity.
Do you want to fully scan your system ?

Unbedingt auf "No" klicken.
Entferne rechts den Haken bei: IAT/EAT und Show All
Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
Starte den Scan mit "Scan".
Mache nichts am Computer während der Scan läuft.
Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.

Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!

Tauchen Probleme auf?

Probiere alternativ den abgesicherten Modus.
Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.

Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

exzel · 18.08.2013, 14:24

Ok. Mbam läuft noch. Hier schon mal das Log von Gmer. Dank!

Code:

ATTFilter

GMER 2.1.19163 - hxxp://www.gmer.net
Rootkit scan 2013-08-18 10:00:53
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD32 rev.01.0 298,09GB
Running: icwu04kp.exe; Driver: C:\Users\Gerco\AppData\Local\Temp\ugloqpog.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 560                                                                             fffff80003202000 45 bytes [00, 00, 00, 00, 00, 00, 00, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 607                                                                             fffff8000320202f 16 bytes [00, 00, 00, 00, 00, 00, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               00000000768e1465 2 bytes [8E, 76]
.text     C:\Program Files (x86)\Ask.com\Updater\Updater.exe[4168] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              00000000768e14bb 2 bytes [8E, 76]
.text     ...                                                                                                                                            * 2
.text     C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4276] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 69                    00000000768e1465 2 bytes [8E, 76]
.text     C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe[4276] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 155                   00000000768e14bb 2 bytes [8E, 76]
.text     ...                                                                                                                                            * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69   00000000768e1465 2 bytes [8E, 76]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[2092] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000768e14bb 2 bytes [8E, 76]
.text     ...                                                                                                                                            * 2

---- Threads - GMER 2.1 ----

Thread    C:\Windows\System32\svchost.exe [908:492]                                                                                                      000007fefc27f2f4
Thread    C:\Windows\System32\svchost.exe [908:420]                                                                                                      000007fefc1f6204
Thread    C:\Windows\System32\svchost.exe [908:1048]                                                                                                     000007fefb442070
Thread    C:\Windows\System32\svchost.exe [908:1060]                                                                                                     000007fefb2e5428
Thread    C:\Windows\System32\svchost.exe [908:2816]                                                                                                     000007fefdb820c0
Thread    C:\Windows\System32\svchost.exe [908:3108]                                                                                                     000007fef8ca6b8c
Thread    C:\Windows\System32\svchost.exe [908:3120]                                                                                                     000007fef8ca1d88

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4D36E972-E325-11CE-BFC1-08002BE10318}\{86BEC9CA-9EB6-4981-A4BB-86B97F330C3F}\Connection@Name    isatap.{8DACBA07-9028-453F-944E-B06C98A36DFF}
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Bind       \Device\{6255BF10-B316-4D4E-88A3-46CA0B715D0D}?\Device\{847726B5-908F-4459-B2A9-6C4F21B22678}?\Device\{86BEC9CA-9EB6-4981-A4BB-86B97F330C3F}?\Device\{FB495146-8775-4C99-890A-59BD02C5B55B}?
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Route      "{6255BF10-B316-4D4E-88A3-46CA0B715D0D}"?"{847726B5-908F-4459-B2A9-6C4F21B22678}"?"{86BEC9CA-9EB6-4981-A4BB-86B97F330C3F}"?"{FB495146-8775-4C99-890A-59BD02C5B55B}"?
Reg       HKLM\SYSTEM\CurrentControlSet\Control\Network\{4d36e975-e325-11ce-bfc1-08002be10318}\{2B07FAA1-8217-4E30-B5EC-FD4501E773BB}\Linkage@Export     \Device\TCPIP6TUNNEL_{6255BF10-B316-4D4E-88A3-46CA0B715D0D}?\Device\TCPIP6TUNNEL_{847726B5-908F-4459-B2A9-6C4F21B22678}?\Device\TCPIP6TUNNEL_{86BEC9CA-9EB6-4981-A4BB-86B97F330C3F}?\Device\TCPIP6TUNNEL_{FB495146-8775-4C99-890A-59BD02C5B55B}?
Reg       HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{86BEC9CA-9EB6-4981-A4BB-86B97F330C3F}@InterfaceName                         isatap.{8DACBA07-9028-453F-944E-B06C98A36DFF}
Reg       HKLM\SYSTEM\CurrentControlSet\services\iphlpsvc\Parameters\Isatap\{86BEC9CA-9EB6-4981-A4BB-86B97F330C3F}@ReusableType                          0

---- EOF - GMER 2.1 ----

Und hier das mbam Protokoll

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.06.1.1005
www.malwarebytes.org

Database version: v2013.08.18.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 10.0.9200.16660
Gerco :: GERCO-PC [administrator]

18.08.2013 12:52:55
mbar-log-2013-08-18 (12-52-55).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUM | P2P
Scan options disabled: PUP
Objects scanned: 261370
Time elapsed: 43 minute(s), 26 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

cosinus · 18.08.2013, 22:47

Adware/Junkware/Toolbars entfernen

1. Schritt: adwCleaner

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

exzel · 19.08.2013, 09:29

Hallo!

Die Logfiles sind im Anhang.

Dank!

cosinus · 19.08.2013, 10:34

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:

Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.

exzel · 19.08.2013, 10:53

Ich hatte versucht alle Protokolle als Code einzufügen, aber da gab es Probleme.

Dann versuche ich die Protokolle einzufügen, welche der Platz zulässt. JRT ging leider nicht mehr rein.

AdwCleaner[S4].txt

Code:

ATTFilter

# AdwCleaner v2.306 - Datei am 19/08/2013 um 10:05:35 erstellt
# Aktualisiert am 19/07/2013 von Xplode
# Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits)
# Benutzer : Gerco - GERCO-PC
# Bootmodus : Abgesicherter Modus
# Ausgeführt unter : C:\Users\Gerco\Desktop\adwcleaner.exe
# Option [Löschen]


**** [Dienste] ****


***** [Dateien / Ordner] *****


***** [Registrierungsdatenbank] *****


***** [Internet Browser] *****

-\\ Internet Explorer v10.0.9200.16660

[OK] Die Registrierungsdatenbank ist sauber.

-\\ Google Chrome v28.0.1500.95

Datei : C:\Users\Gerco\AppData\Local\Google\Chrome\User Data\Default\Preferences

[OK] Die Datei ist sauber.

*************************

AdwCleaner[R1].txt - [5538 octets] - [19/08/2013 09:56:30]
AdwCleaner[S1].txt - [346 octets] - [19/08/2013 09:57:17]
AdwCleaner[S2].txt - [5659 octets] - [19/08/2013 09:57:37]
AdwCleaner[S3].txt - [1035 octets] - [19/08/2013 10:01:52]
AdwCleaner[S4].txt - [968 octets] - [19/08/2013 10:05:35]

########## EOF - C:\AdwCleaner[S4].txt - [1027 octets] ##########

FRST Logfile:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 19-08-2013
Ran by Gerco (administrator) on 19-08-2013 10:12:14
Running from C:\Users\Gerco\Desktop
Windows 7 Home Premium Service Pack 1 (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Safe Mode (minimal)

==================== Processes (Whitelisted) =================


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2122536 2010-05-08] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] - C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [10144288 2010-04-14] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] - C:\Program Files\Dell\QuickSet\QuickSet.exe [3203440 2010-04-06] (Dell Inc.)
HKLM\...\Run: [IntelWireless] - C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1928976 2010-03-05] (Intel(R) Corporation)
HKLM\...\Run: [PrnStatusMX] - C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [1238528 2007-08-29] (Marvell Semiconductor, Inc.)
HKLM\...\Run: [DellStage] - C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj [483424 2012-02-01] ()
HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] - "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [559616 2011-10-22] (Dell)
HKCU\...\Run: [Google Update] - C:\Users\Gerco\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-03-27] (Google Inc.)
HKLM-x32\...\Run: [] -  [x]
HKLM-x32\...\Run: [RoxWatchTray] - C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] - C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe [514544 2010-11-17] ()
HKLM-x32\...\Run: [Dell Webcam Central] - C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe [487562 2010-08-20] (Creative Technology Ltd)
HKLM-x32\...\Run: [Microsoft Default Manager] - C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - c:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dell DataSafe Online] - C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-26] (Dell, Inc.)
HKLM-x32\...\Run: [AccuWeatherWidget] - C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj [2835443 2012-02-01] ()
HKLM-x32\...\Run: [SDTray] - C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [avgnt] - C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [345144 2013-08-16] (Avira Operations GmbH & Co. KG)
Startup: C:\Users\Gerco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t@x aktuell.lnk
ShortcutTarget: t@x aktuell.lnk -> C:\Users\Gerco\Documents\taxaktuell.exe ()
BootExecute: autocheck autochk * sdnclean64.exe

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/USCON/8
SearchScopes: HKLM - DefaultScope value is missing.
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKCU - {35AA71D2-ACEF-479E-AB4C-F82601B3C799} URL = 
SearchScopes: HKCU - {41C9FBC7-8E9F-498A-85FC-EB4D35A55662} URL = hxxp://www.google.de/search?q={searchTerms}
SearchScopes: HKCU - {6F5F8B64-2739-4E9F-9DFF-1E37FCF070BF} URL = 
BHO: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Java(tm) Plug-In SSV Helper - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm - {9030D464-4C02-4ABF-8ECC-5164760863C6} - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Windows Live Messenger Companion Helper - {9FDDE16B-836F-4806-AB1F-1455CBEFF289} - C:\Program Files (x86)\Windows Live\Companion\companioncore.dll (Microsoft Corporation)
BHO-x32: Bing Bar Helper - {d2ce3e00-f94a-4740-988e-03dc2f38c34f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM-x32 - Bing Bar - {8dcb7100-df86-4384-8842-8fa844297b3f} - C:\Program Files (x86)\Microsoft\BingBar\BingExt.dll (Microsoft Corporation.)
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} -  No File
Handler-x32: skype-ie-addon-data - {91774881-D725-4E58-B298-07617B9B86A8} - C:\Program Files (x86)\Skype\Toolbars\Internet Explorer\skypeieplugin.dll (Skype Technologies S.A.)
Handler-x32: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt

Chrome: 
=======
CHR HomePage: hxxp://www.google.de/
CHR DefaultSearchURL: (Google) - {google:baseURL}search?{google:RLZ}{google:acceptedSuggestion}{google:originalQueryForSuggestion}{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}sourceid=chrome&ie={inputEncoding}&q={searchTerms}
CHR DefaultSuggestURL: (Google) - {google:baseSuggestURL}search?{google:searchFieldtrialParameter}{google:instantFieldTrialGroupParameter}client=chrome&hl={language}&q={searchTerms}
CHR Plugin: (Shockwave Flash) - C:\Users\Gerco\AppData\Local\Google\Chrome\Application\25.0.1364.152\gcswf32.dll No File
CHR Plugin: (Java Deployment Toolkit 6.0.230.5) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npdeployJava1.dll No File
CHR Plugin: (Java(TM) Platform SE 6 U23) - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll No File
CHR Plugin: (Adobe Acrobat) - c:\Program Files (x86)\Adobe\Reader 10.0\Reader\Browser\nppdf32.dll (Adobe Systems Inc.)
CHR Plugin: (Silverlight Plug-In) - c:\Program Files (x86)\Microsoft Silverlight\4.0.50401.0\npctrl.dll No File
CHR Plugin: (Chrome PDF Viewer) - C:\Users\Gerco\AppData\Local\Google\Chrome\Application\25.0.1364.152\pdf.dll No File
CHR Plugin: (Google Gears 0.5.33.0) - C:\Users\Gerco\AppData\Local\Google\Chrome\Application\25.0.1364.152\gears.dll No File
CHR Plugin: (Bing Bar) - C:\Program Files (x86)\MSN Toolbar\Platform\6.0.2282.0\npwinext.dll No File
CHR Plugin: (Windows Live\u0099 Photo Gallery) - C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
CHR Plugin: (Google Update) - C:\Users\Gerco\AppData\Local\Google\Update\1.2.183.39\npGoogleOneClick8.dll No File
CHR Plugin: (Default Plug-in) - default_plugin No File
CHR Extension: (AT_YannArthus-BertrandV2) - C:\Users\Gerco\AppData\Local\Google\Chrome\User Data\Default\Extensions\plaekpceeonanmjojailaojkconcgofc\3_0
CHR StartMenuInternet: Google Chrome - C:\Users\Gerco\AppData\Local\Google\Chrome\Application\chrome.exe

==================== Services (Whitelisted) =================

S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-16] (Avira Operations GmbH & Co. KG)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-16] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-16] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-16] (Avira Operations GmbH & Co. KG)
S3 STIrUsb; C:\Windows\System32\DRIVERS\irstusb.sys [33792 2008-01-19] (SigmaTel, Inc.)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-19 10:09 - 2013-08-19 10:09 - 00000000 ____D C:\Windows\ERUNT
2013-08-19 10:05 - 2013-08-19 10:05 - 00001096 _____ C:\AdwCleaner[S4].txt
2013-08-19 10:01 - 2013-08-19 10:02 - 00001035 _____ C:\AdwCleaner[S3].txt
2013-08-19 09:57 - 2013-08-19 09:57 - 00005659 _____ C:\AdwCleaner[S2].txt
2013-08-19 09:57 - 2013-08-19 09:57 - 00000346 _____ C:\AdwCleaner[S1].txt
2013-08-19 09:56 - 2013-08-19 09:56 - 00005538 _____ C:\AdwCleaner[R1].txt
2013-08-19 09:52 - 2013-08-19 09:47 - 01575812 _____ (Farbar) C:\Users\Gerco\Desktop\FRST64.exe
2013-08-19 09:52 - 2013-08-19 09:46 - 01018305 _____ (Thisisu) C:\Users\Gerco\Desktop\JRT.exe
2013-08-19 09:52 - 2013-08-19 09:46 - 00666633 _____ C:\Users\Gerco\Desktop\adwcleaner.exe
2013-08-18 10:08 - 2013-08-18 14:49 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-08-18 09:27 - 2013-08-18 09:27 - 00377856 _____ C:\Users\Gerco\Desktop\icwu04kp.exe
2013-08-16 21:09 - 2013-08-16 21:09 - 00000000 ____D C:\FRST
2013-08-16 15:51 - 2013-08-16 15:51 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-16 12:16 - 2013-07-26 07:13 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-08-16 12:16 - 2013-07-26 07:13 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-08-16 12:16 - 2013-07-26 07:13 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-08-16 12:16 - 2013-07-26 07:12 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-08-16 12:16 - 2013-07-26 07:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-08-16 12:16 - 2013-07-26 05:35 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-08-16 12:16 - 2013-07-26 05:13 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-16 12:16 - 2013-07-26 05:13 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-16 12:16 - 2013-07-26 05:12 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-16 12:16 - 2013-07-26 05:11 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 12:16 - 2013-07-26 05:11 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-16 12:16 - 2013-07-26 04:49 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-16 12:16 - 2013-07-26 04:39 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-08-16 12:16 - 2013-07-26 03:59 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 12:04 - 2013-07-19 03:58 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2013-08-16 12:04 - 2013-07-19 03:41 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 12:04 - 2013-07-06 08:03 - 01910208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tcpip.sys
2013-08-16 12:03 - 2013-07-09 07:52 - 00224256 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2013-08-16 12:03 - 2013-07-09 07:46 - 01472512 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2013-08-16 12:03 - 2013-07-09 07:46 - 00184320 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2013-08-16 12:03 - 2013-07-09 07:46 - 00139776 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2013-08-16 12:03 - 2013-07-09 06:52 - 00175104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 12:03 - 2013-07-09 06:46 - 01166848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 12:03 - 2013-07-09 06:46 - 00140288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 12:03 - 2013-07-09 06:46 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 12:02 - 2013-07-25 11:25 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-08-16 12:02 - 2013-07-25 10:57 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 12:02 - 2013-07-09 07:51 - 01217024 _____ (Microsoft Corporation) C:\Windows\system32\rpcrt4.dll
2013-08-16 12:02 - 2013-07-09 06:52 - 00663552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 12:02 - 2013-06-15 06:32 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2013-08-16 11:08 - 2009-06-10 23:00 - 00000824 _____ C:\Windows\system32\Drivers\etc\hosts.20130816-110813.backup
2013-08-16 09:51 - 2013-08-16 09:51 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Avira
2013-08-16 09:46 - 2013-08-16 09:46 - 00000000 _____ C:\Users\Gerco\Documents\APNSetup.exe
2013-08-16 09:44 - 2013-08-16 09:43 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-16 09:44 - 2013-08-16 09:43 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-16 09:44 - 2013-08-16 09:43 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-16 09:43 - 2013-08-16 09:45 - 00000000 ____D C:\ProgramData\Avira
2013-08-16 09:43 - 2013-08-16 09:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-16 09:42 - 2013-08-16 11:47 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-16 09:42 - 2013-08-16 09:42 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Malwarebytes
2013-08-16 09:41 - 2013-08-16 09:45 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-16 09:41 - 2013-08-16 09:41 - 00001341 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 09:41 - 2013-08-16 09:41 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 09:41 - 2013-08-16 09:41 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 09:41 - 2013-08-16 09:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-16 09:41 - 2013-04-04 14:50 - 00025928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2013-08-16 09:41 - 2009-01-25 13:14 - 00017272 _____ (Safer Networking Limited) C:\Windows\system32\sdnclean64.exe
2013-08-09 04:20 - 2013-08-09 04:20 - 12081912 _____ (Malwarebytes Corp.) C:\Users\Gerco\Desktop\mbar-1.06.1.1005.exe
2013-07-31 10:31 - 2013-07-31 10:37 - 00147429 _____ C:\Users\Gerco\ESt2012_Geisberger_Gerhard.elfo
2013-07-29 12:37 - 2013-08-16 12:10 - 00000000 ____D C:\Windows\system32\MRT
2013-07-23 14:21 - 2013-07-23 14:21 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\TeamViewer
2013-07-22 11:52 - 2013-07-23 14:00 - 00147550 _____ C:\Users\Gerco\ESt2012_Geisberger_Gerhard_und_Geisberger_Cornelia.elfo
2013-07-22 10:11 - 2013-07-31 10:46 - 00000000 ____D C:\Users\Gerco\AppData\Local\.elfohilfe
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\plugins
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\images
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\hilfe
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\stylesheet
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\signatur
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\schema
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\printxml
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\plugins
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\dict
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\bin\qtplugins
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\bin
2013-07-21 11:03 - 2013-05-22 07:22 - 00006512 _____ C:\Users\dict\pica_0.dict
2013-07-21 11:03 - 2013-05-22 07:22 - 00000520 _____ C:\Users\dict\est_12.dict
2013-07-21 11:03 - 2013-05-22 07:22 - 00000520 _____ C:\Users\dict\est_11.dict
2013-07-21 11:03 - 2013-05-22 07:22 - 00000520 _____ C:\Users\dict\est_10.dict
2013-07-21 11:03 - 2013-05-22 07:22 - 00000516 _____ C:\Users\dict\est_09.dict
2013-07-21 11:03 - 2013-05-22 07:22 - 00000512 _____ C:\Users\dict\pica_0.dict.sig
2013-07-21 11:03 - 2013-05-22 07:22 - 00000512 _____ C:\Users\dict\est_12.dict.sig
2013-07-21 11:03 - 2013-05-22 07:22 - 00000512 _____ C:\Users\dict\est_11.dict.sig
2013-07-21 11:03 - 2013-05-22 07:22 - 00000512 _____ C:\Users\dict\est_10.dict.sig
2013-07-21 11:03 - 2013-05-22 07:22 - 00000512 _____ C:\Users\dict\est_09.dict.sig
2013-07-21 11:03 - 2013-05-21 18:50 - 08172544 _____ C:\Users\bin\QtGui4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 02551296 _____ C:\Users\bin\QtXmlPatterns4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 02291712 _____ C:\Users\eric\QtCore4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 02291712 _____ C:\Users\bin\QtCore4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 01099776 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Users\bin\libeay32.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00970752 _____ C:\Users\bin\QtNetwork4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00894464 _____ C:\Users\bin\QtCLucene4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00722432 _____ C:\Users\bin\qca2.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00587776 _____ C:\Users\bin\QtSql4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00428544 _____ C:\Users\bin\QtHelp4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00339456 _____ C:\Users\eric\QtXml4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00339456 _____ C:\Users\bin\QtXml4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00276480 _____ C:\Users\bin\QtSvg4.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00237056 _____ (The OpenSSL Project, hxxp://www.openssl.org/) C:\Users\bin\ssleay32.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00216576 _____ C:\Users\bin\gmp.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00207872 _____ C:\Users\bin\patchw32.dll
2013-07-21 11:03 - 2013-05-21 18:50 - 00035328 _____ C:\Users\bin\patch.exe
2013-07-21 11:03 - 2013-05-21 18:50 - 00001176 _____ C:\Users\dict\instv_0.dict
2013-07-21 11:03 - 2013-05-21 18:50 - 00000512 _____ C:\Users\dict\instv_0.dict.sig
2013-07-21 11:03 - 2013-05-21 18:49 - 19562496 _____ (Finanzverwaltung der Länder) C:\Users\eric\erustart.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 18278400 _____ (The ICU Project) C:\Users\eric\icudt48.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 10510848 _____ C:\Users\plugins\plugin_est_11.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 10213888 _____ C:\Users\plugins\plugin_est_12.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 09497600 _____ C:\Users\plugins\plugin_est_10.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 09053184 _____ C:\Users\plugins\plugin_est_09.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 06168576 _____ (Finanzverwaltung der Länder) C:\Users\eric\F80EF.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 05093888 _____ (Bayerisches Landesamt für Steuern) C:\Users\eric\ericbasis.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 04479832 _____ (Microsoft Corporation) C:\Users\bin\vcredist_x86_2008_sp1.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 03829760 _____ (Finanzverwaltung der Länder) C:\Users\eric\umelst.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 03275264 _____ (Bayerisches Landesamt für Steuern) C:\Users\eric\ericprint.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 02334208 _____ (secunet Security Networks AG) C:\Users\eric\eSigner.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 01879552 _____ C:\Users\bin\pica.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 01823744 _____ (Apache Software Foundation) C:\Users\eric\xerces.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 01673728 _____ C:\Users\bin\installationsverwaltung.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 01664512 _____ (The ICU Project) C:\Users\eric\icuin48.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 01640960 _____ (Bayerisches Landesamt für Steuern) C:\Users\eric\erictransfer.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 01626112 _____ (Bayerisches Landesamt für Steuern) C:\Users\eric\ericxml.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 01273344 _____ (The ICU Project) C:\Users\eric\icuuc48.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 01232896 _____ (Finanzverwaltung der Länder) C:\Users\eric\bds2f80.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 00949760 _____ (Bayerisches Landesamt für Steuern) C:\Users\eric\ericutil.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00943104 _____ (Bayerisches Landesamt für Steuern) C:\Users\eric\ericcrypt.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00671744 _____ (Bayerisches Landesamt für Steuern) C:\Users\eric\ericapi.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00652288 _____ (Finanzverwaltung der Länder) C:\Users\eric\taview.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00546816 _____ C:\Users\bin\integritaetspruefer.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 00505344 _____ C:\Users\bin\hotlineTool.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 00394472 _____ C:\Users\eric\F89GDX.DAT
2013-07-21 11:03 - 2013-05-21 18:49 - 00351744 _____ (Bayerisches Landesamt für Steuern) C:\Users\eric\ericplugin.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00345088 _____ C:\Users\eric\ericprozess.exe
2013-07-21 11:03 - 2013-05-21 18:49 - 00151552 _____ (Bastiaan Bakker, LifeLine Networks bv ) C:\Users\eric\log4cpp.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00123392 _____ (Finanzverwaltung der Länder) C:\Users\eric\eva.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00115712 _____ (Finanzverwaltung der Länder) C:\Users\eric\bdiff.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00099840 _____ (Finanzverwaltung der Länder) C:\Users\eric\txt2pdf.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00075264 _____ (Finanzverwaltung der Länder) C:\Users\eric\hints.dll
2013-07-21 11:03 - 2013-05-21 18:49 - 00061440 _____ C:\Users\eric\F89GDX.idx
2013-07-21 11:03 - 2013-05-21 18:49 - 00003045 _____ C:\Users\eric\rpfest_init.txt
2013-07-21 11:03 - 2013-05-21 18:48 - 00953856 _____ C:\Users\bin\hilfepica.exe
2013-07-21 11:03 - 2013-05-13 09:50 - 01080320 _____ C:\Users\hilfe\elfo.bedienung.qch
2013-07-21 11:03 - 2013-05-13 09:49 - 00613376 _____ C:\Users\hilfe\elfo.est.2011.qch
2013-07-21 11:03 - 2013-05-13 09:49 - 00595968 _____ C:\Users\hilfe\elfo.est.2010.qch
2013-07-21 11:03 - 2013-05-13 09:49 - 00583680 _____ C:\Users\hilfe\elfo.est.2012.qch
2013-07-21 11:03 - 2013-05-13 09:49 - 00575488 _____ C:\Users\hilfe\elfo.est.2009.qch
2013-07-21 11:03 - 2013-05-13 09:49 - 00024576 _____ C:\Users\hilfe\elfo.est.2011.qhc
2013-07-21 11:03 - 2013-05-13 09:49 - 00024576 _____ C:\Users\hilfe\elfo.est.2010.qhc
2013-07-21 11:03 - 2013-05-13 09:49 - 00024576 _____ C:\Users\hilfe\elfo.est.2009.qhc
2013-07-21 11:03 - 2013-05-13 09:49 - 00024576 _____ C:\Users\hilfe\elfo.bedienung.qhc
2013-07-21 11:03 - 2013-05-13 09:49 - 00017408 _____ C:\Users\hilfe\elfo.est.2012.qhc
2013-07-21 10:49 - 2013-07-21 10:50 - 69486216 _____ (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (2).exe
2013-07-21 10:48 - 2013-07-21 10:48 - 69486216 _____ (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (1).exe
2013-07-21 10:47 - 2013-07-21 11:03 - 00000980 _____ C:\Users\Public\Desktop\ElsterFormular.lnk
2013-07-21 10:46 - 2013-07-21 10:46 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-21 10:33 - 2013-07-21 10:34 - 69486216 _____ (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p.exe

==================== One Month Modified Files and Folders =======

2013-08-19 10:11 - 2013-08-19 10:11 - 00098269 _____ C:\Users\Gerco\Desktop\JRT.txt
2013-08-19 10:09 - 2013-08-19 10:09 - 00000000 ____D C:\Windows\ERUNT
2013-08-19 10:06 - 2012-09-14 09:59 - 00001104 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-19 10:06 - 2011-03-16 07:34 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-08-19 10:06 - 2011-03-16 07:34 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-08-19 10:06 - 2011-03-16 07:27 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-08-19 10:06 - 2009-07-14 07:08 - 00000006 ____H C:\Windows\Tasks\SA.DAT
2013-08-19 10:06 - 2009-07-14 06:51 - 00030902 _____ C:\Windows\setupact.log
2013-08-19 10:05 - 2013-08-19 10:05 - 00001096 _____ C:\AdwCleaner[S4].txt
2013-08-19 10:02 - 2013-08-19 10:01 - 00001035 _____ C:\AdwCleaner[S3].txt
2013-08-19 09:57 - 2013-08-19 09:57 - 00005659 _____ C:\AdwCleaner[S2].txt
2013-08-19 09:57 - 2013-08-19 09:57 - 00000346 _____ C:\AdwCleaner[S1].txt
2013-08-19 09:56 - 2013-08-19 09:56 - 00005538 _____ C:\AdwCleaner[R1].txt
2013-08-19 09:54 - 2009-07-14 07:10 - 01374487 _____ C:\Windows\WindowsUpdate.log
2013-08-19 09:54 - 2009-07-14 06:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-19 09:54 - 2009-07-14 06:45 - 00014240 ____H C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-19 09:47 - 2013-08-19 09:52 - 01575812 _____ (Farbar) C:\Users\Gerco\Desktop\FRST64.exe
2013-08-19 09:46 - 2013-08-19 09:52 - 01018305 _____ (Thisisu) C:\Users\Gerco\Desktop\JRT.exe
2013-08-19 09:46 - 2013-08-19 09:52 - 00666633 _____ C:\Users\Gerco\Desktop\adwcleaner.exe
2013-08-18 14:49 - 2013-08-18 10:08 - 00000000 ____D C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2013-08-18 14:41 - 2011-03-27 12:28 - 00001120 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000UA.job
2013-08-18 14:17 - 2012-10-28 10:43 - 00000884 _____ C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-18 13:51 - 2012-09-14 09:59 - 00001108 _____ C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-18 12:55 - 2009-07-14 19:58 - 00654852 _____ C:\Windows\system32\perfh007.dat
2013-08-18 12:55 - 2009-07-14 19:58 - 00130434 _____ C:\Windows\system32\perfc007.dat
2013-08-18 12:55 - 2009-07-14 07:13 - 01500358 _____ C:\Windows\system32\PerfStringBackup.INI
2013-08-18 09:35 - 2011-03-16 06:55 - 00000000 ____D C:\ProgramData\Sonic
2013-08-18 09:27 - 2013-08-18 09:27 - 00377856 _____ C:\Users\Gerco\Desktop\icwu04kp.exe
2013-08-16 21:09 - 2013-08-16 21:09 - 00000000 ____D C:\FRST
2013-08-16 15:51 - 2013-08-16 15:51 - 00083672 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2013-08-16 15:39 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\rescache
2013-08-16 12:10 - 2013-07-29 12:37 - 00000000 ____D C:\Windows\system32\MRT
2013-08-16 12:07 - 2011-10-25 08:00 - 78161360 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2013-08-16 12:00 - 2012-10-28 10:43 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-16 12:00 - 2012-10-28 10:43 - 00003822 _____ C:\Windows\System32\Tasks\Adobe Flash Player Updater
2013-08-16 12:00 - 2011-07-14 20:23 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-16 11:59 - 2011-04-02 17:07 - 00000000 ____D C:\Users\Gerco\AppData\Local\Adobe
2013-08-16 11:47 - 2013-08-16 09:42 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-16 09:52 - 2011-03-16 00:33 - 00074978 _____ C:\Windows\PFRO.log
2013-08-16 09:51 - 2013-08-16 09:51 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Avira
2013-08-16 09:46 - 2013-08-16 09:46 - 00000000 _____ C:\Users\Gerco\Documents\APNSetup.exe
2013-08-16 09:45 - 2013-08-16 09:43 - 00000000 ____D C:\ProgramData\Avira
2013-08-16 09:45 - 2013-08-16 09:41 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-16 09:43 - 2013-08-16 09:44 - 00130016 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2013-08-16 09:43 - 2013-08-16 09:44 - 00100712 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2013-08-16 09:43 - 2013-08-16 09:44 - 00028600 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2013-08-16 09:43 - 2013-08-16 09:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-16 09:42 - 2013-08-16 09:42 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Malwarebytes
2013-08-16 09:41 - 2013-08-16 09:41 - 00001341 _____ C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 09:41 - 2013-08-16 09:41 - 00001071 _____ C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 09:41 - 2013-08-16 09:41 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 09:41 - 2013-08-16 09:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-16 07:36 - 2012-09-14 09:59 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-13 14:35 - 2011-03-27 12:28 - 00001068 _____ C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000Core.job
2013-08-09 04:20 - 2013-08-09 04:20 - 12081912 _____ (Malwarebytes Corp.) C:\Users\Gerco\Desktop\mbar-1.06.1.1005.exe
2013-08-02 18:16 - 2013-05-22 12:26 - 00000000 ____D C:\Program Files\My Dell
2013-08-02 18:16 - 2011-03-27 12:34 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Google Chrome
2013-08-02 18:16 - 2011-03-27 12:00 - 00000000 ____D C:\ProgramData\PCDr
2013-08-02 18:16 - 2011-03-27 11:56 - 00000000 ____D C:\Users\Gerco
2013-08-02 18:16 - 2009-07-14 20:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-08-02 18:16 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\system32\NDF
2013-08-02 18:15 - 2009-07-14 05:20 - 00000000 ____D C:\Windows\registration
2013-07-31 10:46 - 2013-07-22 10:11 - 00000000 ____D C:\Users\Gerco\AppData\Local\.elfohilfe
2013-07-31 10:37 - 2013-07-31 10:31 - 00147429 _____ C:\Users\Gerco\ESt2012_Geisberger_Gerhard.elfo
2013-07-26 07:13 - 2013-08-16 12:16 - 02241024 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2013-07-26 07:13 - 2013-08-16 12:16 - 01365504 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2013-07-26 07:13 - 2013-08-16 12:16 - 00051712 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2013-07-26 07:12 - 2013-08-16 12:16 - 19239424 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 15405056 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 03958784 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 02647040 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 00855552 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 00603136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 00526336 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 00136704 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 00067072 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 00053760 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2013-07-26 07:12 - 2013-08-16 12:16 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2013-07-26 05:35 - 2013-08-16 12:16 - 02706432 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2013-07-26 05:13 - 2013-08-16 12:16 - 01767936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-26 05:13 - 2013-08-16 12:16 - 01141248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 14329344 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 02877440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 02048512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 00690688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 00493056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 00391168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 00109056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 00061440 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-26 05:12 - 2013-08-16 12:16 - 00039936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-26 05:11 - 2013-08-16 12:16 - 13761024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-26 05:11 - 2013-08-16 12:16 - 00033280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-26 04:49 - 2013-08-16 12:16 - 02706432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-26 04:39 - 2013-08-16 12:16 - 00089600 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2013-07-26 03:59 - 2013-08-16 12:16 - 00071680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 11:25 - 2013-08-16 12:02 - 01888768 _____ (Microsoft Corporation) C:\Windows\system32\WMVDECOD.DLL
2013-07-25 10:57 - 2013-08-16 12:02 - 01620992 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-23 14:30 - 2012-08-26 14:57 - 00000000 ____D C:\Users\Gerco\Documents\Handbuch
2013-07-23 14:21 - 2013-07-23 14:21 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\TeamViewer
2013-07-23 14:00 - 2013-07-22 11:52 - 00147550 _____ C:\Users\Gerco\ESt2012_Geisberger_Gerhard_und_Geisberger_Cornelia.elfo
2013-07-23 12:10 - 2013-05-22 12:28 - 00003440 _____ C:\Windows\System32\Tasks\PCDEventLauncherTask
2013-07-22 10:04 - 2012-08-22 16:47 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\elsterformular
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\plugins
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\images
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\hilfe
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\stylesheet
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\signatur
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\schema
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\printxml
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric\plugins
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\eric
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\dict
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\bin\qtplugins
2013-07-21 11:03 - 2013-07-21 11:03 - 00000000 ____D C:\Users\bin
2013-07-21 11:03 - 2013-07-21 10:47 - 00000980 _____ C:\Users\Public\Desktop\ElsterFormular.lnk
2013-07-21 10:50 - 2013-07-21 10:49 - 69486216 _____ (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (2).exe
2013-07-21 10:48 - 2013-07-21 10:48 - 69486216 _____ (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (1).exe
2013-07-21 10:46 - 2013-07-21 10:46 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-21 10:46 - 2012-08-22 16:42 - 00000000 ____D C:\Users\Gerco\bin
2013-07-21 10:46 - 2012-08-22 16:42 - 00000000 ____D C:\ProgramData\elsterformular
2013-07-21 10:34 - 2013-07-21 10:33 - 69486216 _____ (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p.exe

Files to move or delete:
====================
C:\Users\bin\hilfepica.exe
C:\Users\bin\hotlineTool.exe
C:\Users\bin\installationsverwaltung.exe
C:\Users\bin\integritaetspruefer.exe
C:\Users\bin\patch.exe
C:\Users\bin\pica.exe
C:\Users\bin\vcredist_x86_2008_sp1.exe
C:\Users\eric\bds2f80.exe
C:\Users\eric\ericprozess.exe
C:\Users\eric\erustart.exe
C:\Users\eric\F80EF.exe
C:\Users\eric\umelst.exe

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2013-08-16 15:29

==================== End Of Log ============================

--- --- ---

--- --- ---

--- --- ---

--- --- ---

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 19-08-2013
Ran by Gerco at 2013-08-19 10:13:21
Running from C:\Users\Gerco\Desktop
Boot Mode: Safe Mode (minimal)
==========================================================


==================== Installed Programs =======================

   
AAVUpdateManager (x32 Version: 15.00.0000)
Adobe Flash Player 11 ActiveX (x32 Version: 11.8.800.94)
Adobe Reader X (10.1.7) MUI (x32 Version: 10.1.7)
Advanced Audio FX Engine (x32 Version: 1.12.05)
Atheros Communications Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (x32 Version: 1.0.0.23)
Avira Free Antivirus (x32 Version: 13.0.0.3885)
Bing Bar (x32 Version: 7.0.609.0)
D3DX10 (x32 Version: 15.4.2368.0902)
Dell DataSafe Local Backup - Support Software (x32 Version: 9.4.60)
Dell DataSafe Local Backup (x32 Version: 9.4.60)
Dell DataSafe Online (x32 Version: 2.1.19634)
Dell Edoc Viewer (Version: 1.0.0)
Dell Getting Started Guide (x32 Version: 1.00.0000)
Dell MusicStage (x32 Version: 1.4.162.0)
Dell PhotoStage (x32 Version: 1.5.0.30)
Dell Stage (x32 Version: 1.7.209.0)
Dell VideoStage (x32 Version: 1.1.1.1408)
Dell Webcam Central (x32 Version: 2.00.35)
DirectX 9 Runtime (x32 Version: 1.00.0000)
eBay (x32 Version: 1.4.0)
ElsterFormular (x32 Version: 14.3.20130522)
Google Chrome (HKCU Version: 28.0.1500.95)
Google Earth Plug-in (x32 Version: 7.1.1.1888)
Google Update Helper (x32 Version: 1.3.21.153)
Intel PROSet Wireless
Intel(R) Graphics Media Accelerator Driver (x32 Version: 8.15.10.2182)
Intel(R) Management Engine Components (x32 Version: 6.0.0.1179)
Intel(R) PROSet/Wireless WiFi-Software (Version: 13.02.0000)
Intel(R) Wireless Display (Version: 1.2.20.0)
Java Auto Updater (x32 Version: 2.0.7.2)
Java(TM) 6 Update 37 (x32 Version: 6.0.370)
Java(TM) 6 Update 38 (64-bit) (Version: 6.0.380)
Junk Mail filter update (x32 Version: 15.4.3502.0922)
LoJack Factory Installer (x32 Version: 1.0.0)
Malwarebytes Anti-Malware Version 1.75.0.1300 (x32 Version: 1.75.0.1300)
Mesh Runtime (x32 Version: 15.4.5722.2)
Messenger Companion (x32 Version: 15.4.3502.0922)
Microsoft .NET Framework 4 Client Profile DEU Language Pack (Version: 4.0.30319)
Microsoft Application Error Reporting (Version: 12.0.6015.5000)
Microsoft Default Manager (x32 Version: 2.2.114.0)
Microsoft Office 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (Version: 14.0.4763.1000)
Microsoft Office Klick-und-Los 2010 (x32 Version: 14.0.4763.1000)
Microsoft Office Starter 2010 - Deutsch (x32 Version: 14.0.4763.1000)
Microsoft PowerPoint Viewer (x32 Version: 14.0.7015.1000)
Microsoft Silverlight (Version: 5.1.20513.0)
Microsoft SQL Server 2005 Compact Edition [ENU] (x32 Version: 3.1.0000)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (x32 Version: 8.0.50727.4053)
Microsoft Visual C++ 2005 Redistributable - KB2467175 (x32 Version: 8.0.51011)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.58299)
Microsoft Visual C++ 2005 Redistributable (x32 Version: 8.0.61001)
Microsoft Visual C++ 2008 ATL Update kb973924 - x64 9.0.30729.4148 (Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x64 9.0.30729.5570 (Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (x32 Version: 9.0.30729.5570)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (Version: 9.0.30729.6161)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (x32 Version: 9.0.30729)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (x32 Version: 9.0.30729.4148)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (x32 Version: 9.0.30729.6161)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (x32 Version: 10.0.40219)
MSVCRT (x32 Version: 15.4.2862.0708)
MSVCRT_amd64 (x32 Version: 15.4.2862.0708)
MSXML 4.0 SP2 (KB973688) (x32 Version: 4.20.9876.0)
My Dell (Version: 3.3.6261.27)
PhotoShowExpress (x32 Version: 2.0.063)
Quickset64 (Version: 10.6.2)
RBVirtualFolder64Inst (Version: 1.00.0000)
Realtek High Definition Audio Driver (x32 Version: 6.0.1.6088)
rosoft .NET Framework 4 Client Profile (Version: 4.0.30319)
Roxio Activation Module (x32 Version: 1.0)
Roxio BackOnTrack (x32 Version: 1.3.3)
Roxio Burn (x32 Version: 1.8)
Roxio Creator Starter (x32 Version: 1.0.439)
Roxio Creator Starter (x32 Version: 12.1.77.0)
Roxio Creator Starter (x32 Version: 5.0.0)
Roxio Express Labeler 3 (x32 Version: 3.2.2)
Roxio File Backup (Version: 1.3.2)
Skype Toolbars (x32 Version: 1.0.4051)
Skype™ 5.10 (x32 Version: 5.10.116)
Sonic CinePlayer Decoder Pack (x32 Version: 4.3.0)
Spybot - Search & Destroy (x32 Version: 2.1.21)
STEUEReasy 2011 (x32 Version: 16.01)
Synaptics Pointing Device Driver (Version: 15.0.20.0)
t@x 2012 (HKCU Version: 19.00.7303)
Update for Microsoft .NET Framework 4 Client Profile (KB2468871) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2473228) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2533523) (x32 Version: 1)
Update for Microsoft .NET Framework 4 Client Profile (KB2600217) (x32 Version: 1)
Update Installer for WildTangent Games App (x32)
WildTangent Games App (Dell Games) (x32 Version: 4.0.10.5)
WildTangent Games App (x32 Version: 4.0.10.5)
WildTangent-Spiele (x32 Version: 1.0.0.71)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3502.0922)
Windows Live Essentials (x32 Version: 15.4.3555.0308)
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922)
Windows Live ID Sign-in Assistant (Version: 7.250.4232.0)
Windows Live Installer (x32 Version: 15.4.3502.0922)
Windows Live Language Selector (Version: 15.4.3555.0308)
Windows Live Mail (x32 Version: 15.4.3502.0922)
Windows Live Mesh (x32 Version: 15.4.3502.0922)
Windows Live Mesh ActiveX control for remote connections (x32 Version: 15.4.5722.2)
Windows Live Messenger (x32 Version: 15.4.3538.0513)
Windows Live Messenger Companion Core (x32 Version: 15.4.3502.0922)
Windows Live MIME IFilter (Version: 15.4.3502.0922)
Windows Live Movie Maker (x32 Version: 15.4.3502.0922)
Windows Live Photo Common (x32 Version: 15.4.3502.0922)
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922)
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109)
Windows Live Remote Client (Version: 15.4.5722.2)
Windows Live Remote Client Resources (Version: 15.4.5722.2)
Windows Live Remote Service (Version: 15.4.5722.2)
Windows Live Remote Service Resources (Version: 15.4.5722.2)
Windows Live SOXE (x32 Version: 15.4.3502.0922)
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922)
Windows Live UX Platform (x32 Version: 15.4.3502.0922)
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109)
Windows Live Writer (x32 Version: 15.4.3502.0922)
Windows Live Writer Resources (x32 Version: 15.4.3502.0922)

==================== Restore Points  =========================

23-07-2013 09:02:11 Windows Update
23-07-2013 13:44:14 Windows Update
27-07-2013 07:04:25 Windows Update
29-07-2013 10:29:28 Windows Update
02-08-2013 05:48:30 Windows Update
16-08-2013 10:06:37 Windows Update
16-08-2013 11:15:04 Windows Update
18-08-2013 10:43:01 Malwarebytes Anti-Rootkit Restore Point

==================== Hosts content: ==========================

2009-07-14 04:34 - 2013-08-16 11:08 - 00449438 ____R C:\Windows\system32\Drivers\etc\hosts
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info
127.0.0.1	www.123fporn.info
127.0.0.1	123haustiereundmehr.com
127.0.0.1	www.123haustiereundmehr.com
127.0.0.1	123moviedownload.com

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {02238134-E1F8-41A0-8E32-335A99CA0B5E} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\My Dell\uaclauncher.exe [2013-05-07] (PC-Doctor, Inc.)
Task: {06EA5219-736C-459E-B2D9-BD146E7A9343} - System32\Tasks\SystemToolsDailyTest => C:\Windows\System32\uaclauncher.exe No File
Task: {071F9E22-0433-436E-9D7D-ED735FA435E1} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000UA => C:\Users\Gerco\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-27] (Google Inc.)
Task: {23D8FFAF-4B45-4A13-B725-79FA2720852C} - System32\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000Core => C:\Users\Gerco\AppData\Local\Google\Update\GoogleUpdate.exe [2011-03-27] (Google Inc.)
Task: {295F53F2-781A-4256-A424-2581688D181C} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14] (Google Inc.)
Task: {34E30F3B-E819-409C-A7E3-8BF7F2248F46} - System32\Tasks\Scheduled Update for Ask Toolbar => C:\Program Files (x86)\Ask.com\UpdateTask.exe No File
Task: {390EA342-CBFD-48BA-9E7B-D62FC0E3273A} - System32\Tasks\Games\UpdateCheck_S-1-5-21-164856147-3035719939-2722879568-1000
Task: {6870DA92-C80A-4CD0-99CE-7E3CEC9F2AEB} - System32\Tasks\LoJack for Laptops Install => C:\Program Files (x86)\Absolute Software\LoJack Install\FactoryInstaller.exe [2009-11-26] (Absolute Software)
Task: {744CCF3A-029D-4433-A813-55DDC1F1B02F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-09-14] (Google Inc.)
Task: {88902A84-CCE8-4D70-BA59-EE89F0FBE51F} - System32\Tasks\Microsoft\Windows Live\SOXE\Extractor Definitions Update Task
Task: {9C44986A-0794-4CC0-957E-068DD52C1F50} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-08-16] (Adobe Systems Incorporated)
Task: {D9AA7813-6417-44A0-87E5-F9037CAB2C59} - System32\Tasks\PCDEventLauncherTask => C:\Program Files\My Dell\sessionchecker.exe [2013-05-07] (PC-Doctor, Inc.)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000Core.job => C:\Users\Gerco\AppData\Local\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000UA.job => C:\Users\Gerco\AppData\Local\Google\Update\GoogleUpdate.exe

==================== Faulty Device Manager Devices =============

Name: Security Processor Loader Driver
Description: Security Processor Loader Driver
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: spldr
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================

System errors:
=============
Error: (08/19/2013 10:12:08 AM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068


Microsoft Office Sessions:
=========================

==================== Memory info =========================== 

Percentage of memory in use: 19%
Total physical RAM: 2932.52 MB
Available physical RAM: 2361.61 MB
Total Pagefile: 5863.23 MB
Available Pagefile: 5301.28 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:283.34 GB) (Free:228.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 07F2837E)
Partition 1: (Not Active) - (Size=102 MB) - (Type=DE)
Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=283 GB) - (Type=07 NTFS)

==================== End Of Log ============================

17.08.2013, 14:14	#4
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Logauswertung von FRST64 nach Virenbefall und Virenbereinigung Hast du die Logs der Virenscanner mit den Funden noch? __________________ Logfiles bitte immer in CODE-Tags posten

17.08.2013, 14:17	#6
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Logauswertung von FRST64 nach Virenbefall und Virenbereinigung Poste diese Logs erstmal in CODE-Tags...dann sehen wir weiter __________________ --> Logauswertung von FRST64 nach Virenbefall und Virenbereinigung

17.08.2013, 16:04	#8
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Logauswertung von FRST64 nach Virenbefall und Virenbereinigung Waren das die einzigen Funde? __________________ Logfiles bitte immer in CODE-Tags posten

Logauswertung von FRST64 nach Virenbefall und Virenbereinigung

Log-Analyse und Auswertung: Logauswertung von FRST64 nach Virenbefall und Virenbereinigung