Logauswertung von FRST64 nach Virenbefall und Virenbereinigung

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 04-07-2013 (ATTENTION: FRST version is 43 days old)
Ran by SYSTEM on 16-08-2013 14:11:37
Running from F:\
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and an extra Addition.txt log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] %ProgramFiles%\Synaptics\SynTP\SynTPEnh.exe [2122536 2010-05-07] (Synaptics Incorporated)
HKLM\...\Run: [RtHDVCpl] C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe -s [10144288 2010-04-13] (Realtek Semiconductor)
HKLM\...\Run: [QuickSet] C:\Program Files\Dell\QuickSet\QuickSet.exe [3203440 2010-04-06] (Dell Inc.)
HKLM\...\Run: [IntelWireless] "C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" /tf Intel Wireless Tray [1928976 2010-03-05] (Intel(R) Corporation)
HKLM\...\Run: [PrnStatusMX] C:\Program Files\Hewlett-Packard\PrnStatusMX\PrnStatusMX.exe [1238528 2007-08-29] (Marvell Semiconductor, Inc.)
HKLM\...\Run: [DellStage] "C:\Program Files (x86)\Dell Stage\Dell Stage\stage_primary.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\start.umj" --startup [483424 2012-02-01] ()
HKLM-x32\...\RunOnce: ["C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe"] "C:\Program Files (x86)\Dell DataSafe Local Backup\Components\DSUpdate\DSUpdate.exe" [559616 2011-10-22] (Dell)
HKLM-x32\...\Run: []  [x]
HKLM-x32\...\Run: [RoxWatchTray] "C:\Program Files (x86)\Common Files\Roxio Shared\OEM\12.0\SharedCOM\RoxWatchTray12OEM.exe" [240112 2010-11-25] (Sonic Solutions)
HKLM-x32\...\Run: [Desktop Disc Tool] "C:\Program Files (x86)\Roxio\OEM\Roxio Burn\RoxioBurnLauncher.exe" [514544 2010-11-17] ()
HKLM-x32\...\Run: [Dell Webcam Central] "C:\Program Files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" /mode2 [487562 2010-08-19] (Creative Technology Ltd)
HKLM-x32\...\Run: [Microsoft Default Manager] "C:\Program Files (x86)\Microsoft\Search Enhancement Pack\Default Manager\DefMgr.exe" -resume [439568 2010-05-10] (Microsoft Corporation)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] "c:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe" [37960 2013-05-10] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Dell DataSafe Online] C:\Program Files (x86)\Dell\Dell Datasafe Online\NOBuClient.exe [1117528 2010-08-25] (Dell, Inc.)
HKLM-x32\...\Run: [AccuWeatherWidget] "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\accuweather.exe" "C:\Program Files (x86)\Dell Stage\Dell Stage\AccuWeather\start.umj" --startup [968048 2012-02-01] ()
HKLM-x32\...\Run: [ApnUpdater] "C:\Program Files (x86)\Ask.com\Updater\Updater.exe" [1573576 2012-10-16] (Ask)
HKLM-x32\...\Run: [SDTray] "C:\Program Files (x86)\Spybot - Search & Destroy 2\SDTray.exe" [5624784 2013-07-25] (Safer-Networking Ltd.)
HKLM-x32\...\Run: [avgnt] "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min [345144 2013-08-16] (Avira Operations GmbH & Co. KG)
HKU\Gerco\...\Run: [Google Update] "C:\Users\Gerco\AppData\Local\Google\Update\GoogleUpdate.exe" /c [136176 2011-03-27] (Google Inc.)
Startup: C:\Users\Gerco\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\t@x aktuell.lnk
ShortcutTarget: t@x aktuell.lnk ->  (No File)
BootExecute: autocheck autochk * sdnclean64.exe

==================== Services (Whitelisted) =================

S2 AAV UpdateService; C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [128296 2008-10-24] ()
S2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [84024 2013-08-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [108088 2013-08-16] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [589368 2013-08-16] (Avira Operations GmbH & Co. KG)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2010-03-05] ()
S2 SDScannerService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDFSSvc.exe [1817560 2013-05-16] (Safer-Networking Ltd.)
S2 SDUpdateService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDUpdSvc.exe [1033688 2013-05-16] (Safer-Networking Ltd.)
S2 SDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy 2\SDWSCSvc.exe [171928 2013-05-15] (Safer-Networking Ltd.)

==================== Drivers (Whitelisted) ====================

S2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [100712 2013-08-16] (Avira Operations GmbH & Co. KG)
S1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130016 2013-08-16] (Avira Operations GmbH & Co. KG)
S1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-08-16] (Avira Operations GmbH & Co. KG)
S3 STIrUsb; C:\Windows\System32\DRIVERS\irstusb.sys [33792 2008-01-18] (SigmaTel, Inc.)

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 1C7857B62DE5994A75B054A9FD4C3825
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D4121AE6D0C0E7E13AA221AA57EF2D49
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 540DAF1CEA6094886D72126FD7C33048
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\system32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\avgntflt.sys 09E6069EF94B345061B4BD3CEBD974C8
C:\Windows\System32\DRIVERS\avipbb.sys 488486DAD09A5B6C6DBB8B990A8B2307
C:\Windows\System32\DRIVERS\avkmgr.sys 490FA25161BF3E51993EB724ECF0ACEB
C:\Windows\system32\DRIVERS\bxvbda.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60a.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 9AC4F97C2D3E93367E2148EA940CD2CD
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CtClsFlt.sys FBE228ABEAB2BE13B9C3A3A112D4D8DC
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys AF2E16242AA723F68F461B6EAE2EAD3D
C:\Windows\system32\DRIVERS\evbda.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Fs_Rec.sys 6BD9295CC032DD3077C671FCCF579A7B
C:\Windows\System32\DRIVERS\fvevol.sys 8F6322049018354F45F05A2FD2D4E5E0
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\HECIx64.sys B6AC71AAA2B10848F57FC49D55A651AF
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys ABBF174CB394F5C437410A788B7E404A
C:\Windows\system32\drivers\iaStorV.sys AAAF44DB3BD0B9D1FB6969B23ECC8366
C:\Windows\System32\DRIVERS\igdkmd64.sys 31569A2E836C12014148BF7342716946
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Impcd.sys DD587A55390ED2295BCE6D36AD567DA9
C:\Windows\System32\drivers\RTKVHD64.sys 6E4CCB3AFF07E2B9F2A937385C84B573
C:\Windows\System32\DRIVERS\IntcDAud.sys 03C74719D48056A1078F3A51CEB76BAA
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\irda.sys 05360B1EA5A2ABF620D1D96EBD8BD8F1
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdclass.sys ==> MD5 is legit
C:\Windows\system32\drivers\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys 97A7070AEA4C058B6418519E869A63B4
C:\Windows\System32\Drivers\ksecpkg.sys 26C43A7C2862447EC59DEDA188D1DA07
C:\Windows\system32\drivers\ksthunk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\L1C62x64.sys 39918DB0EFCF045A1CE6FABBF339F975
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys A5D9106A73DC88564C825D317CAC68AC
C:\Windows\System32\DRIVERS\mrxsmb10.sys D711B3C1D5F42C0C2415687BE09FC163
C:\Windows\System32\DRIVERS\mrxsmb20.sys 9423E9D355C8D303E76B8CFBD8A5C30C
C:\Windows\system32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys 760E38053BF56E501D562B70AD796B88
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NETw5s64.sys 24F64343F14A119308456E1CA7507B26
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys B98F8C6E31CD07B2E6F71F7F648E38C0
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\system32\drivers\nvraid.sys 0A92CB65770442ED0DC44834632F66AD
C:\Windows\system32\drivers\nvstor.sys DAB0E87525C10052BF65F06152F37E4A
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys E9766131EEADE40A27DC27D2D68FBA9C
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\System32\Drivers\PxHlpa64.sys 87B04878A6D59D6C79251DC960C674C1
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys E61608AA35E98999AF9AAEEEA6114B0A
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RtsUStor.sys 22D6B47D004A6568C500680BE2972854
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Sftfslh.sys C6CC9297BD53E5229653303E556AA539
C:\Windows\System32\DRIVERS\Sftplaylh.sys 390AA7BC52CEE43F6790CDEA1E776703
C:\Windows\System32\DRIVERS\Sftredirlh.sys 617E29A0B0A2807466560D4C4E338D3E
C:\Windows\System32\DRIVERS\Sftvollh.sys 8F571F016FA1976F445147E9E6C8AE9B
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys 441FBA48BFF01FDB9D5969EBC1838F0B
C:\Windows\System32\DRIVERS\srv2.sys B4ADEBBF5E3677CCE9651E0F01F7CC28
C:\Windows\System32\DRIVERS\srvnet.sys 27E461F0BE5BFF5FC737328F749538C3
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\irstusb.sys 1A807A037503B285016E61100D04614A
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys C25866BDF0E818E02BB8E76845D26E54
C:\Windows\System32\drivers\tcpip.sys DB74544B75566C974815E79A62433F29
C:\Windows\System32\DRIVERS\tcpip.sys DB74544B75566C974815E79A62433F29
C:\Windows\System32\drivers\tcpipreg.sys 1B16D0BD9841794A6E0CDE0CEF744ABC
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 51C5ECEB1CDEE2468A1748BE550CFBC8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys 4CE278FC9671BA81A138D70823FCAA09
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbccgp.sys 6F1A3157A1C89435352CEB543CDB359C
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\system32\drivers\usbehci.sys C025055FE7B87701EB042095DF1A2D7B
C:\Windows\System32\DRIVERS\usbhub.sys 287C6C9410B111B68B52CA298F7B8C24
C:\Windows\system32\drivers\usbohci.sys 9840FC418B4CBD632D3D0A667A725C31
C:\Windows\System32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\system32\drivers\USBSTOR.SYS FED648B01349A3C8395A5169DB5FB7D6
C:\Windows\system32\drivers\usbuhci.sys 62069A34518BCF9C1FD9E74B3F6DB7CD
C:\Windows\System32\Drivers\usbvideo.sys 454800C2BC7F3927CE030141EE4F4C50
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifimp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys 442783E2CB0DA19873B7A63833FF4CB4
C:\Windows\System32\DRIVERS\WDKMD.sys FE31110E39A0B11ABAE1BA43A2DC94F9
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wimfltr.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\SysWow64\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys AB886378EEB55C6C75B4F2D14B6C869F
C:\Windows\System32\DRIVERS\WUDFRd.sys DDA4CAF29D8C0A297F886BFE561E6659

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-08-16 14:09 - 2013-08-16 14:09 - 00000000 ____D C:\FRST
2013-08-16 05:16 - 2013-07-26 00:13 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-08-16 05:16 - 2013-07-26 00:13 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-08-16 05:16 - 2013-07-26 00:13 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-08-16 05:16 - 2013-07-26 00:12 - 19239424 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 15405056 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-08-16 05:16 - 2013-07-26 00:12 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-08-16 05:16 - 2013-07-25 22:35 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-08-16 05:16 - 2013-07-25 22:13 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-08-16 05:16 - 2013-07-25 22:13 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 14329344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 02048512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-08-16 05:16 - 2013-07-25 22:12 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-08-16 05:16 - 2013-07-25 22:11 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-08-16 05:16 - 2013-07-25 22:11 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-08-16 05:16 - 2013-07-25 21:49 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-08-16 05:16 - 2013-07-25 21:39 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-08-16 05:16 - 2013-07-25 20:59 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-08-16 05:04 - 2013-07-18 20:58 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-08-16 05:04 - 2013-07-18 20:41 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2013-08-16 05:04 - 2013-07-06 01:03 - 01910208 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-08-16 05:03 - 2013-07-09 00:52 - 00224256 ____A (Microsoft Corporation) C:\Windows\System32\wintrust.dll
2013-08-16 05:03 - 2013-07-09 00:46 - 01472512 ____A (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-08-16 05:03 - 2013-07-09 00:46 - 00184320 ____A (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-08-16 05:03 - 2013-07-09 00:46 - 00139776 ____A (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-08-16 05:03 - 2013-07-08 23:52 - 00175104 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2013-08-16 05:03 - 2013-07-08 23:46 - 01166848 ____A (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2013-08-16 05:03 - 2013-07-08 23:46 - 00140288 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2013-08-16 05:03 - 2013-07-08 23:46 - 00103936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2013-08-16 05:02 - 2013-07-25 04:25 - 01888768 ____A (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-08-16 05:02 - 2013-07-25 03:57 - 01620992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-08-16 05:02 - 2013-07-09 00:51 - 01217024 ____A (Microsoft Corporation) C:\Windows\System32\rpcrt4.dll
2013-08-16 05:02 - 2013-07-08 23:52 - 00663552 ____A (Microsoft Corporation) C:\Windows\SysWOW64\rpcrt4.dll
2013-08-16 05:02 - 2013-06-14 23:32 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2013-08-16 04:08 - 2009-06-10 16:00 - 00000824 ____A C:\Windows\System32\Drivers\etc\hosts.20130816-110813.backup
2013-08-16 02:51 - 2013-08-16 02:51 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Avira
2013-08-16 02:46 - 2013-08-16 02:46 - 00000000 ____A C:\Users\Gerco\Documents\APNSetup.exe
2013-08-16 02:44 - 2013-08-16 02:43 - 00130016 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-08-16 02:44 - 2013-08-16 02:43 - 00100712 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-08-16 02:44 - 2013-08-16 02:43 - 00028600 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-08-16 02:43 - 2013-08-16 02:45 - 00000000 ____D C:\ProgramData\Avira
2013-08-16 02:43 - 2013-08-16 02:45 - 00000000 ____D C:\ProgramData\Application Data\Avira
2013-08-16 02:43 - 2013-08-16 02:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-16 02:42 - 2013-08-16 04:47 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-16 02:42 - 2013-08-16 04:47 - 00000000 ____D C:\ProgramData\Application Data\Spybot - Search & Destroy
2013-08-16 02:42 - 2013-08-16 02:42 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:45 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-16 02:41 - 2013-08-16 02:41 - 00001341 ____A C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001341 ____A C:\ProgramData\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001071 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001071 ____A C:\ProgramData\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\ProgramData\Application Data\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-16 02:41 - 2013-04-04 07:50 - 00025928 ____A (Malwarebytes Corporation) C:\Windows\System32\Drivers\mbam.sys
2013-08-16 02:41 - 2009-01-25 06:14 - 00017272 ____A (Safer Networking Limited) C:\Windows\System32\sdnclean64.exe
2013-07-31 04:12 - 2013-07-31 04:12 - 00000000 ____D C:\Users\Gerco\AppData\Local\{BB7F162A-BE2F-4325-BEA7-FADDC0337E80}
2013-07-31 03:31 - 2013-07-31 03:37 - 00147429 ____A C:\Users\Gerco\ESt2012_Geisberger_Gerhard.elfo
2013-07-30 02:42 - 2013-07-30 02:42 - 00000000 ____D C:\Users\Gerco\AppData\Local\{5F7FC26D-0E50-4F71-A9BA-C1615A4E0415}
2013-07-29 05:37 - 2013-08-16 05:10 - 00000000 ____D C:\Windows\System32\MRT
2013-07-28 02:00 - 2013-07-28 02:00 - 00000000 ____D C:\Users\Gerco\AppData\Local\{22403C4F-804D-4DEC-A97B-AE92EF8E2471}
2013-07-27 01:56 - 2013-07-27 01:56 - 00000000 ____D C:\Users\Gerco\AppData\Local\{3C77EFEF-E4C1-429D-9236-1BF3959DFF54}
2013-07-25 12:43 - 2013-07-25 12:43 - 00000000 ____D C:\Users\Gerco\AppData\Local\{FE693B55-937D-40C2-AD23-9C7CC20AE122}
2013-07-24 10:38 - 2013-07-24 10:38 - 00000000 ____D C:\Users\Gerco\AppData\Local\{B70E1F06-BA80-4218-9A67-5AEE5BCF0085}
2013-07-23 07:21 - 2013-07-23 07:21 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\TeamViewer
2013-07-23 03:51 - 2013-07-23 03:51 - 00000000 ____D C:\Users\Gerco\AppData\Local\{36F0B174-ADB2-44B8-AD6D-5C21740E5E85}
2013-07-22 04:52 - 2013-07-23 07:00 - 00147550 ____A C:\Users\Gerco\ESt2012_Geisberger_Gerhard_und_Geisberger_Cornelia.elfo
2013-07-22 03:11 - 2013-07-31 03:46 - 00000000 ____D C:\Users\Gerco\AppData\Local\.elfohilfe
2013-07-22 01:58 - 2013-07-22 01:58 - 00000000 ____D C:\Users\Gerco\AppData\Local\{47443C6C-EC13-454E-8622-2C5974401450}
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\plugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\images
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\hilfe
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\stylesheet
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\signatur
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\schema
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\printxml
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\plugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\eric
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\dict
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\bin\qtplugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\bin
2013-07-21 04:03 - 2013-05-22 00:22 - 00006512 ____A C:\Users\dict\pica_0.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000520 ____A C:\Users\dict\est_12.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000520 ____A C:\Users\dict\est_11.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000520 ____A C:\Users\dict\est_10.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000516 ____A C:\Users\dict\est_09.dict
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\pica_0.dict.sig
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\est_12.dict.sig
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\est_11.dict.sig
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\est_10.dict.sig
2013-07-21 04:03 - 2013-05-22 00:22 - 00000512 ____A C:\Users\dict\est_09.dict.sig
2013-07-21 04:03 - 2013-05-21 11:50 - 08172544 ____A C:\Users\bin\QtGui4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 02551296 ____A C:\Users\bin\QtXmlPatterns4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 02291712 ____A C:\Users\eric\QtCore4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 02291712 ____A C:\Users\bin\QtCore4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 01099776 ____A (The OpenSSL Project, hxxp://www.openssl.org/) C:\Users\bin\libeay32.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00970752 ____A C:\Users\bin\QtNetwork4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00894464 ____A C:\Users\bin\QtCLucene4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00722432 ____A C:\Users\bin\qca2.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00587776 ____A C:\Users\bin\QtSql4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00428544 ____A C:\Users\bin\QtHelp4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00339456 ____A C:\Users\eric\QtXml4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00339456 ____A C:\Users\bin\QtXml4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00276480 ____A C:\Users\bin\QtSvg4.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00237056 ____A (The OpenSSL Project, hxxp://www.openssl.org/) C:\Users\bin\ssleay32.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00216576 ____A C:\Users\bin\gmp.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00207872 ____A C:\Users\bin\patchw32.dll
2013-07-21 04:03 - 2013-05-21 11:50 - 00035328 ____A C:\Users\bin\patch.exe
2013-07-21 04:03 - 2013-05-21 11:50 - 00001176 ____A C:\Users\dict\instv_0.dict
2013-07-21 04:03 - 2013-05-21 11:50 - 00000512 ____A C:\Users\dict\instv_0.dict.sig
2013-07-21 04:03 - 2013-05-21 11:49 - 19562496 ____A (Finanzverwaltung der Länder) C:\Users\eric\erustart.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 18278400 ____A (The ICU Project) C:\Users\eric\icudt48.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 10510848 ____A C:\Users\plugins\plugin_est_11.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 10213888 ____A C:\Users\plugins\plugin_est_12.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 09497600 ____A C:\Users\plugins\plugin_est_10.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 09053184 ____A C:\Users\plugins\plugin_est_09.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 06168576 ____A (Finanzverwaltung der Länder) C:\Users\eric\F80EF.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 05093888 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericbasis.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 04479832 ____A (Microsoft Corporation) C:\Users\bin\vcredist_x86_2008_sp1.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 03829760 ____A (Finanzverwaltung der Länder) C:\Users\eric\umelst.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 03275264 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericprint.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 02334208 ____A (secunet Security Networks AG) C:\Users\eric\eSigner.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01879552 ____A C:\Users\bin\pica.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 01823744 ____A (Apache Software Foundation) C:\Users\eric\xerces.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01673728 ____A C:\Users\bin\installationsverwaltung.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 01664512 ____A (The ICU Project) C:\Users\eric\icuin48.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01640960 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\erictransfer.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01626112 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericxml.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01273344 ____A (The ICU Project) C:\Users\eric\icuuc48.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 01232896 ____A (Finanzverwaltung der Länder) C:\Users\eric\bds2f80.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 00949760 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericutil.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00943104 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericcrypt.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00671744 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericapi.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00652288 ____A (Finanzverwaltung der Länder) C:\Users\eric\taview.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00546816 ____A C:\Users\bin\integritaetspruefer.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 00505344 ____A C:\Users\bin\hotlineTool.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 00394472 ____A C:\Users\eric\F89GDX.DAT
2013-07-21 04:03 - 2013-05-21 11:49 - 00351744 ____A (Bayerisches Landesamt für Steuern) C:\Users\eric\ericplugin.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00345088 ____A C:\Users\eric\ericprozess.exe
2013-07-21 04:03 - 2013-05-21 11:49 - 00151552 ____A (Bastiaan Bakker, LifeLine Networks bv ) C:\Users\eric\log4cpp.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00123392 ____A (Finanzverwaltung der Länder) C:\Users\eric\eva.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00115712 ____A (Finanzverwaltung der Länder) C:\Users\eric\bdiff.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00099840 ____A (Finanzverwaltung der Länder) C:\Users\eric\txt2pdf.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00075264 ____A (Finanzverwaltung der Länder) C:\Users\eric\hints.dll
2013-07-21 04:03 - 2013-05-21 11:49 - 00061440 ____A C:\Users\eric\F89GDX.idx
2013-07-21 04:03 - 2013-05-21 11:49 - 00003045 ____A C:\Users\eric\rpfest_init.txt
2013-07-21 04:03 - 2013-05-21 11:48 - 00953856 ____A C:\Users\bin\hilfepica.exe
2013-07-21 04:03 - 2013-05-13 02:50 - 01080320 ____A C:\Users\hilfe\elfo.bedienung.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00613376 ____A C:\Users\hilfe\elfo.est.2011.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00595968 ____A C:\Users\hilfe\elfo.est.2010.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00583680 ____A C:\Users\hilfe\elfo.est.2012.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00575488 ____A C:\Users\hilfe\elfo.est.2009.qch
2013-07-21 04:03 - 2013-05-13 02:49 - 00024576 ____A C:\Users\hilfe\elfo.est.2011.qhc
2013-07-21 04:03 - 2013-05-13 02:49 - 00024576 ____A C:\Users\hilfe\elfo.est.2010.qhc
2013-07-21 04:03 - 2013-05-13 02:49 - 00024576 ____A C:\Users\hilfe\elfo.est.2009.qhc
2013-07-21 04:03 - 2013-05-13 02:49 - 00024576 ____A C:\Users\hilfe\elfo.bedienung.qhc
2013-07-21 04:03 - 2013-05-13 02:49 - 00017408 ____A C:\Users\hilfe\elfo.est.2012.qhc
2013-07-21 03:49 - 2013-07-21 03:50 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (2).exe
2013-07-21 03:48 - 2013-07-21 03:48 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (1).exe
2013-07-21 03:47 - 2013-07-21 04:03 - 00000980 ____A C:\Users\Public\Desktop\ElsterFormular.lnk
2013-07-21 03:47 - 2013-07-21 04:03 - 00000980 ____A C:\ProgramData\Desktop\ElsterFormular.lnk
2013-07-21 03:46 - 2013-07-21 03:46 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-21 03:33 - 2013-07-21 03:34 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p.exe
2013-07-20 09:39 - 2013-07-20 09:39 - 00000000 ____D C:\Users\Gerco\AppData\Local\{10A4DEBC-444A-4D82-9E50-6778892C30A9}
2013-07-19 01:36 - 2013-07-19 01:36 - 00000000 ____D C:\Users\Gerco\AppData\Local\{68F81983-C0F8-49CF-B790-DC5F8AAA8586}

==================== One Month Modified Files and Folders =======

2013-08-16 14:09 - 2013-08-16 14:09 - 00000000 ____D C:\FRST
2013-08-16 07:07 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-08-16 07:07 - 2009-07-13 23:45 - 00014240 ___AH C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default\Local Settings\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default\Local Settings\Application Data\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default\AppData\Local\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default User\Local Settings\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default User\Local Settings\Application Data\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:34 - 00000000 ____D C:\Users\Default User\AppData\Local\SoftThinks
2013-08-16 07:04 - 2011-03-16 00:27 - 00000000 ____D C:\Program Files (x86)\Dell DataSafe Local Backup
2013-08-16 07:03 - 2012-09-14 02:59 - 00001104 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2013-08-16 07:03 - 2009-07-14 00:08 - 00000006 ___AH C:\Windows\Tasks\SA.DAT
2013-08-16 07:03 - 2009-07-13 23:51 - 00029659 ____A C:\Windows\setupact.log
2013-08-16 07:02 - 2009-07-14 00:10 - 01279641 ____A C:\Windows\WindowsUpdate.log
2013-08-16 06:51 - 2012-09-14 02:59 - 00001108 ____A C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2013-08-16 06:41 - 2011-03-27 05:28 - 00001120 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000UA.job
2013-08-16 06:17 - 2012-10-28 03:43 - 00000884 ____A C:\Windows\Tasks\Adobe Flash Player Updater.job
2013-08-16 05:12 - 2009-07-14 12:58 - 00654852 ____A C:\Windows\System32\perfh007.dat
2013-08-16 05:12 - 2009-07-14 12:58 - 00130434 ____A C:\Windows\System32\perfc007.dat
2013-08-16 05:12 - 2009-07-14 00:13 - 01522350 ____A C:\Windows\System32\PerfStringBackup.INI
2013-08-16 05:10 - 2013-07-29 05:37 - 00000000 ____D C:\Windows\System32\MRT
2013-08-16 05:07 - 2011-10-25 01:00 - 78161360 ____A (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-08-16 05:00 - 2012-10-28 03:43 - 00692104 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2013-08-16 05:00 - 2011-07-14 13:23 - 00071048 ____A (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2013-08-16 04:59 - 2011-04-02 10:07 - 00000000 ____D C:\Users\Gerco\AppData\Local\Adobe
2013-08-16 04:47 - 2013-08-16 02:42 - 00000000 ____D C:\ProgramData\Spybot - Search & Destroy
2013-08-16 04:47 - 2013-08-16 02:42 - 00000000 ____D C:\ProgramData\Application Data\Spybot - Search & Destroy
2013-08-16 02:52 - 2011-03-15 17:33 - 00074978 ____A C:\Windows\PFRO.log
2013-08-16 02:51 - 2013-08-16 02:51 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Avira
2013-08-16 02:46 - 2013-08-16 02:46 - 00000000 ____A C:\Users\Gerco\Documents\APNSetup.exe
2013-08-16 02:45 - 2013-08-16 02:43 - 00000000 ____D C:\ProgramData\Avira
2013-08-16 02:45 - 2013-08-16 02:43 - 00000000 ____D C:\ProgramData\Application Data\Avira
2013-08-16 02:45 - 2013-08-16 02:41 - 00000000 ____D C:\Program Files (x86)\Spybot - Search & Destroy 2
2013-08-16 02:43 - 2013-08-16 02:44 - 00130016 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avipbb.sys
2013-08-16 02:43 - 2013-08-16 02:44 - 00100712 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avgntflt.sys
2013-08-16 02:43 - 2013-08-16 02:44 - 00028600 ____A (Avira Operations GmbH & Co. KG) C:\Windows\System32\Drivers\avkmgr.sys
2013-08-16 02:43 - 2013-08-16 02:43 - 00000000 ____D C:\Program Files (x86)\Avira
2013-08-16 02:42 - 2013-08-16 02:42 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00001341 ____A C:\Users\Public\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001341 ____A C:\ProgramData\Desktop\Spybot-S&D Start Center.lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001071 ____A C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00001071 ____A C:\ProgramData\Desktop\ Malwarebytes Anti-Malware .lnk
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\ProgramData\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\ProgramData\Application Data\Malwarebytes
2013-08-16 02:41 - 2013-08-16 02:41 - 00000000 ____D C:\Program Files (x86)\Malwarebytes' Anti-Malware
2013-08-16 00:36 - 2012-09-14 02:59 - 00000000 ____D C:\Program Files (x86)\Google
2013-08-16 00:33 - 2011-03-15 23:55 - 00000000 ____D C:\ProgramData\Sonic
2013-08-16 00:33 - 2011-03-15 23:55 - 00000000 ____D C:\ProgramData\Application Data\Sonic
2013-08-13 07:35 - 2011-03-27 05:28 - 00001068 ____A C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-164856147-3035719939-2722879568-1000Core.job
2013-08-02 11:16 - 2013-05-22 05:26 - 00000000 ____D C:\Program Files\My Dell
2013-08-02 11:16 - 2011-03-27 05:00 - 00000000 ____D C:\ProgramData\PCDr
2013-08-02 11:16 - 2011-03-27 05:00 - 00000000 ____D C:\ProgramData\Application Data\PCDr
2013-08-02 11:16 - 2011-03-27 04:56 - 00000000 ____D C:\users\Gerco
2013-08-02 11:16 - 2009-07-14 13:18 - 00000000 ___RD C:\Users\Public\Recorded TV
2013-08-02 11:16 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\System32\NDF
2013-08-02 11:15 - 2009-07-13 22:20 - 00000000 ____D C:\Windows\registration
2013-07-31 04:12 - 2013-07-31 04:12 - 00000000 ____D C:\Users\Gerco\AppData\Local\{BB7F162A-BE2F-4325-BEA7-FADDC0337E80}
2013-07-31 03:46 - 2013-07-22 03:11 - 00000000 ____D C:\Users\Gerco\AppData\Local\.elfohilfe
2013-07-31 03:37 - 2013-07-31 03:31 - 00147429 ____A C:\Users\Gerco\ESt2012_Geisberger_Gerhard.elfo
2013-07-30 02:42 - 2013-07-30 02:42 - 00000000 ____D C:\Users\Gerco\AppData\Local\{5F7FC26D-0E50-4F71-A9BA-C1615A4E0415}
2013-07-28 02:00 - 2013-07-28 02:00 - 00000000 ____D C:\Users\Gerco\AppData\Local\{22403C4F-804D-4DEC-A97B-AE92EF8E2471}
2013-07-27 01:56 - 2013-07-27 01:56 - 00000000 ____D C:\Users\Gerco\AppData\Local\{3C77EFEF-E4C1-429D-9236-1BF3959DFF54}
2013-07-26 00:13 - 2013-08-16 05:16 - 02241024 ____A (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-07-26 00:13 - 2013-08-16 05:16 - 01365504 ____A (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-07-26 00:13 - 2013-08-16 05:16 - 00051712 ____A (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-07-26 00:12 - 2013-08-16 05:16 - 19239424 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 15405056 ____A (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 03958784 ____A (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 02647040 ____A (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00855552 ____A (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00603136 ____A (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00526336 ____A (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00136704 ____A (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00067072 ____A (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00053760 ____A (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-07-26 00:12 - 2013-08-16 05:16 - 00039936 ____A (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-07-25 22:35 - 2013-08-16 05:16 - 02706432 ____A (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-07-25 22:13 - 2013-08-16 05:16 - 01767936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2013-07-25 22:13 - 2013-08-16 05:16 - 01141248 ____A (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 14329344 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 02877440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 02048512 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00690688 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00493056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00391168 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00109056 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesysprep.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00061440 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2013-07-25 22:12 - 2013-08-16 05:16 - 00039936 ____A (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2013-07-25 22:11 - 2013-08-16 05:16 - 13761024 ____A (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2013-07-25 22:11 - 2013-08-16 05:16 - 00033280 ____A (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2013-07-25 21:49 - 2013-08-16 05:16 - 02706432 ____A (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2013-07-25 21:39 - 2013-08-16 05:16 - 00089600 ____A (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-07-25 20:59 - 2013-08-16 05:16 - 00071680 ____A (Microsoft Corporation) C:\Windows\SysWOW64\RegisterIEPKEYs.exe
2013-07-25 12:43 - 2013-07-25 12:43 - 00000000 ____D C:\Users\Gerco\AppData\Local\{FE693B55-937D-40C2-AD23-9C7CC20AE122}
2013-07-25 04:25 - 2013-08-16 05:02 - 01888768 ____A (Microsoft Corporation) C:\Windows\System32\WMVDECOD.DLL
2013-07-25 03:57 - 2013-08-16 05:02 - 01620992 ____A (Microsoft Corporation) C:\Windows\SysWOW64\WMVDECOD.DLL
2013-07-24 10:38 - 2013-07-24 10:38 - 00000000 ____D C:\Users\Gerco\AppData\Local\{B70E1F06-BA80-4218-9A67-5AEE5BCF0085}
2013-07-23 07:30 - 2012-08-26 07:57 - 00000000 ____D C:\Users\Gerco\Documents\Handbuch
2013-07-23 07:21 - 2013-07-23 07:21 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\TeamViewer
2013-07-23 07:00 - 2013-07-22 04:52 - 00147550 ____A C:\Users\Gerco\ESt2012_Geisberger_Gerhard_und_Geisberger_Cornelia.elfo
2013-07-23 03:51 - 2013-07-23 03:51 - 00000000 ____D C:\Users\Gerco\AppData\Local\{36F0B174-ADB2-44B8-AD6D-5C21740E5E85}
2013-07-22 03:04 - 2012-08-22 09:47 - 00000000 ____D C:\Users\Gerco\AppData\Roaming\elsterformular
2013-07-22 01:58 - 2013-07-22 01:58 - 00000000 ____D C:\Users\Gerco\AppData\Local\{47443C6C-EC13-454E-8622-2C5974401450}
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\plugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\images
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\hilfe
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\stylesheet
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\signatur
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\schema
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\printxml
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\eric\plugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\eric
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\dict
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\Users\bin\qtplugins
2013-07-21 04:03 - 2013-07-21 04:03 - 00000000 ____D C:\users\bin
2013-07-21 04:03 - 2013-07-21 03:47 - 00000980 ____A C:\Users\Public\Desktop\ElsterFormular.lnk
2013-07-21 04:03 - 2013-07-21 03:47 - 00000980 ____A C:\ProgramData\Desktop\ElsterFormular.lnk
2013-07-21 03:50 - 2013-07-21 03:49 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (2).exe
2013-07-21 03:48 - 2013-07-21 03:48 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p (1).exe
2013-07-21 03:46 - 2013-07-21 03:46 - 00000000 ____D C:\Program Files (x86)\ElsterFormular
2013-07-21 03:46 - 2012-08-22 09:42 - 00000000 ____D C:\Users\Gerco\bin
2013-07-21 03:46 - 2012-08-22 09:42 - 00000000 ____D C:\ProgramData\elsterformular
2013-07-21 03:46 - 2012-08-22 09:42 - 00000000 ____D C:\ProgramData\Application Data\elsterformular
2013-07-21 03:34 - 2013-07-21 03:33 - 69486216 ____A (Landesfinanzdirektion Thüringen) C:\Users\Gerco\Downloads\ElsterFormular-14.3.20130522p.exe
2013-07-20 09:39 - 2013-07-20 09:39 - 00000000 ____D C:\Users\Gerco\AppData\Local\{10A4DEBC-444A-4D82-9E50-6778892C30A9}
2013-07-19 01:36 - 2013-07-19 01:36 - 00000000 ____D C:\Users\Gerco\AppData\Local\{68F81983-C0F8-49CF-B790-DC5F8AAA8586}
2013-07-18 20:58 - 2013-08-16 05:04 - 00002048 ____A (Microsoft Corporation) C:\Windows\System32\tzres.dll
2013-07-18 20:41 - 2013-08-16 05:04 - 00002048 ____A (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

Files to move or delete:
====================
C:\Users\bin\hilfepica.exe
C:\Users\bin\hotlineTool.exe
C:\Users\bin\installationsverwaltung.exe
C:\Users\bin\integritaetspruefer.exe
C:\Users\bin\patch.exe
C:\Users\bin\pica.exe
C:\Users\bin\vcredist_x86_2008_sp1.exe
C:\Users\eric\bds2f80.exe
C:\Users\eric\ericprozess.exe
C:\Users\eric\erustart.exe
C:\Users\eric\F80EF.exe
C:\Users\eric\umelst.exe

==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-07-03 08:54:17
Restore point made on: 2013-07-09 01:35:24
Restore point made on: 2013-07-12 07:27:28
Restore point made on: 2013-07-12 13:05:26
Restore point made on: 2013-07-16 01:22:17
Restore point made on: 2013-07-23 04:02:43
Restore point made on: 2013-07-23 08:44:30
Restore point made on: 2013-07-27 02:04:52
Restore point made on: 2013-07-29 05:31:23
Restore point made on: 2013-08-02 00:49:00
Restore point made on: 2013-08-16 05:06:57
Restore point made on: 2013-08-16 06:15:26

==================== BCD ================================

Windows-Start-Manager
---------------------
Bezeichner              {bootmgr}
device                  partition=E:
description             Windows Boot Manager
locale                  de-de
inherit                 {globalsettings}
default                 {default}
resumeobject            {97ef55d0-4f9d-11e0-8da6-df4b74b9fb5e}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Windows-Startladeprogramm
-------------------------
Bezeichner              {default}
device                  partition=C:
path                    \Windows\system32\winload.exe
description             Windows 7
locale                  de-de
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \Windows
resumeobject            {97ef55d0-4f9d-11e0-8da6-df4b74b9fb5e}
nx                      OptIn

Windows-Startladeprogramm
-------------------------
Bezeichner              {current}
device                  ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{97ef55d3-4f9d-11e0-8da6-df4b74b9fb5e}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[E:]\Recovery\WindowsRE\Winre.wim,{97ef55d3-4f9d-11e0-8da6-df4b74b9fb5e}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Wiederaufnahme aus dem Ruhezustand
----------------------------------
Bezeichner              {97ef55d0-4f9d-11e0-8da6-df4b74b9fb5e}
device                  partition=C:
path                    \Windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
debugoptionenabled      No

Windows-Speichertestprogramm
----------------------------
Bezeichner              {memdiag}
device                  partition=E:
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS-Einstellungen
-----------------
Bezeichner              {emssettings}
bootems                 Yes

Debuggereinstellungen
---------------------
Bezeichner              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM-Defekte
-----------
Bezeichner              {badmemory}

Globale Einstellungen
---------------------
Bezeichner              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Startladeprogramm-Einstellungen
-------------------------------
Bezeichner              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisoreinstellungen
-------------------
Bezeichner              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Einstellungen zur Ladeprogrammfortsetzung
-----------------------------------------
Bezeichner              {resumeloadersettings}
inherit                 {globalsettings}

Ger„teoptionen
--------------
Bezeichner              {97ef55d3-4f9d-11e0-8da6-df4b74b9fb5e}
description             Ramdisk Options
ramdisksdidevice        partition=E:
ramdisksdipath          \Recovery\WindowsRE\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 18%
Total physical RAM: 2932.52 MB
Available physical RAM: 2379.8 MB
Total Pagefile: 2930.67 MB
Available Pagefile: 2370.69 MB
Total Virtual: 8192 MB
Available Virtual: 8191.87 MB

==================== Drives ================================

Drive c: (OS) (Fixed) (Total:283.34 GB) (Free:227.56 GB) NTFS (Disk=0 Partition=3)
Drive e: (RECOVERY) (Fixed) (Total:14.65 GB) (Free:5.53 GB) NTFS (Disk=0 Partition=2) ==>[System with boot components (obtained from reading drive)]
Drive f: (LEXAR) (Removable) (Total:3.7 GB) (Free:0.73 GB) FAT32 (Disk=1 Partition=1)
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or Vista) (Size: 298 GB) (Disk ID: 07F2837E)
Partition 1: (Not Active) - (Size=102 MB) - (Type=DE)
Partition 2: (Active) - (Size=15 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=283 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 4 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=4 GB) - (Type=0B)


LastRegBack: 2012-11-23 03:34

==================== End Of Log ============================