weißer Bildschirm Windows 7

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 17-07-2013 02
Ran by SYSTEM on 17-07-2013 16:55:20
Running from H:\
Windows 7 Professional (X86) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> FRST is updated to run from normal or Safe mode to produce a full FRST.txt log and Addition.txt log.

==================== Registry (Whitelisted) ==================

HKU\Christian Schmid\...\Run: [swg] - "C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [x]
HKU\Christian Schmid\...\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] - "C:\Program Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe" [x]
HKU\Christian Schmid\...\Run: [Skype] - "C:\Program Files\Skype\Phone\Skype.exe" /nosplash /minimized [ 2012-07-13] (Skype Technologies S.A.)
HKU\Christian Schmid\...\Run: [hvpgiqqqyzbamvz] - C:\ProgramData\hvpgiqqqyzbamvzdaoie.exe [x]
HKU\Christian Schmid\...\Winlogon: [Shell] explorer.exe,C:\Users\Christian Schmid\AppData\Roaming\skype.dat <==== ATTENTION 
HKU\Default\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-13] (Microsoft Corporation)
HKU\Default\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe /default [ 2010-01-14] ()
HKU\Default User\...\RunOnce: [mctadmin] - C:\Windows\System32\mctadmin.exe [ 2009-07-13] (Microsoft Corporation)
HKU\Default User\...\RunOnce: [ScrSav] - C:\Program Files\Acer\Screensaver\run_Acer.exe /default [ 2010-01-14] ()
plication Support\APSDaemon.exe [59240 2011-11-01] (Apple Inc.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [421736 2011-12-07] (Apple Inc.)
HKLM\...\Run: [SunJavaUpdateSched] - C:\Program Files\Common Files\Java\Java Update\jusched.exe [254696 2012-01-18] (Sun Microsystems, Inc.)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [919008 2012-07-27] (Adobe Systems Incorporated)

========================== Services (Whitelisted) =================

S2 ePowerSvc; C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe [735776 2010-04-23] (Acer Incorporated)
S2 GREGService; C:\Program Files\Acer\Registration\GREGsvc.exe [23584 2010-01-08] (Acer Incorporated)
S2 NIS; C:\Program Files\Norton Internet Security\Engine\19.9.1.14\diMaster.dll [309688 2012-04-12] (Symantec Corporation)
S2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [250368 2010-03-08] (NewTech Infosystems, Inc.)
S2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144640 2009-11-05] (NewTech Infosystems, Inc.)
S2 OpenVPNService; C:\Program Files\OpenVPN\bin\openvpnserv.exe [36352 2010-11-08] ()
S2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [260640 2010-01-29] (Acer Incorporated)
S2 Updater Service; C:\Program Files\Acer\Acer Updater\UpdaterService.exe [243232 2010-01-28] (Acer Group)

==================== Drivers (Whitelisted) ====================

S3 AmUStor; C:\Windows\system32\drivers\AmUStor.SYS [25600 2010-03-12] (Alcor Micro, Corp.)
S1 BHDrvx86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\BASHDefs\20130531.001\BHDrvx86.sys [1002072 2013-05-31] (Symantec Corporation)
S3 btwampfl; C:\Windows\System32\drivers\btwampfl.sys [286248 2010-04-22] (Broadcom Corporation.)
S1 ccSet_NIS; C:\Windows\system32\drivers\NIS\1309010.00E\ccSetx86.sys [132768 2012-06-06] (Symantec Corporation)
S1 eeCtrl; C:\Program Files\Common Files\Symantec Shared\EENGINE\eeCtrl.sys [376480 2012-08-09] (Symantec Corporation)
S3 EraserUtilRebootDrv; C:\Program Files\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [106656 2012-08-09] (Symantec Corporation)
S3 hwusbdev; C:\Windows\System32\DRIVERS\ewusbdev.sys [101120 2009-10-12] (Huawei Technologies Co., Ltd.)
S1 IDSVix86; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\IPSDefs\20130607.001\IDSvix86.sys [386720 2012-08-31] (Symantec Corporation)
S3 NAVENG; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130607.024\NAVENG.SYS [93272 2013-05-23] (Symantec Corporation)
S3 NAVEX15; C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_19.1.0.28\Definitions\VirusDefs\20130607.024\NAVEX15.SYS [1611992 2013-05-23] (Symantec Corporation)
S3 SRTSP; C:\Windows\System32\Drivers\NIS\1309010.00E\SRTSP.SYS [574112 2012-07-05] (Symantec Corporation)
S1 SRTSPX; C:\Windows\system32\drivers\NIS\1309010.00E\SRTSPX.SYS [32928 2012-07-05] (Symantec Corporation)
S0 SymDS; C:\Windows\System32\drivers\NIS\1309010.00E\SYMDS.SYS [340088 2011-07-25] (Symantec Corporation)
S0 SymEFA; C:\Windows\System32\drivers\NIS\1309010.00E\SYMEFA.SYS [924320 2012-05-21] (Symantec Corporation)
S3 SymEvent; C:\Windows\system32\Drivers\SYMEVENT.SYS [141944 2012-06-12] (Symantec Corporation)
S1 SymIRON; C:\Windows\system32\drivers\NIS\1309010.00E\Ironx86.SYS [149624 2012-04-17] (Symantec Corporation)
S1 SymNetS; C:\Windows\System32\Drivers\NIS\1309010.00E\SYMNETS.SYS [318584 2012-04-17] (Symantec Corporation)
S3 tap0901; C:\Windows\System32\DRIVERS\tap0901.sys [26112 2010-11-08] (The OpenVPN Project)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-07-17 16:55 - 2013-07-17 16:55 - 00000000 ____D C:\FRST
2013-06-25 13:05 - 2013-07-17 06:48 - 00000004 _____ C:\Users\Christian Schmid\AppData\Roaming\skype.ini
2013-06-24 22:13 - 2013-06-24 22:13 - 00000000 _____ C:\Windows\System32\sho15AC.tmp
2013-06-23 02:11 - 2013-05-07 21:38 - 01293672 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tcpip.sys
2013-06-23 02:10 - 2013-05-12 20:45 - 01160192 _____ (Microsoft Corporation) C:\Windows\System32\crypt32.dll
2013-06-23 02:10 - 2013-05-12 20:45 - 00140288 _____ (Microsoft Corporation) C:\Windows\System32\cryptsvc.dll
2013-06-23 02:10 - 2013-05-12 20:45 - 00103936 _____ (Microsoft Corporation) C:\Windows\System32\cryptnet.dll
2013-06-23 02:10 - 2013-05-12 19:08 - 00903168 _____ (Microsoft Corporation) C:\Windows\System32\certutil.exe
2013-06-23 02:10 - 2013-05-12 19:08 - 00043008 _____ (Microsoft Corporation) C:\Windows\System32\certenc.dll
2013-06-23 02:09 - 2013-05-16 10:21 - 01231872 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-06-23 02:09 - 2013-05-16 10:21 - 00981504 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-06-23 02:09 - 2013-05-16 10:21 - 00132096 _____ (Microsoft Corporation) C:\Windows\System32\url.dll
2013-06-23 02:09 - 2013-05-16 10:18 - 06034432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-06-23 02:09 - 2013-05-16 10:18 - 00627712 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-06-23 02:09 - 2013-05-16 10:18 - 00067584 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2013-06-23 02:09 - 2013-05-16 10:17 - 11020800 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-06-23 02:09 - 2013-05-16 10:17 - 02078208 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-06-23 02:09 - 2013-05-16 10:17 - 00176640 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-06-23 02:09 - 2013-05-16 10:17 - 00048128 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-06-23 02:09 - 2013-05-16 08:44 - 01638912 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-06-23 02:09 - 2013-05-09 19:20 - 00024576 _____ (Microsoft Corporation) C:\Windows\System32\cryptdlg.dll
2013-06-23 02:09 - 2013-05-05 21:06 - 03968872 _____ (Microsoft Corporation) C:\Windows\System32\ntkrnlpa.exe
2013-06-23 02:09 - 2013-05-05 21:06 - 03913576 _____ (Microsoft Corporation) C:\Windows\System32\ntoskrnl.exe
2013-06-23 02:09 - 2013-04-25 20:55 - 00492544 _____ (Microsoft Corporation) C:\Windows\System32\win32spl.dll

==================== One Month Modified Files and Folders =======

2013-07-17 16:55 - 2013-07-17 16:55 - 00000000 ____D C:\FRST
2013-07-17 06:48 - 2013-06-25 13:05 - 00000004 _____ C:\Users\Christian Schmid\AppData\Roaming\skype.ini
2013-07-17 06:48 - 2010-09-20 01:12 - 01811173 _____ C:\Windows\WindowsUpdate.log
2013-07-17 06:40 - 2009-07-13 20:34 - 00009712 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-07-17 06:40 - 2009-07-13 20:34 - 00009712 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-07-17 06:32 - 2009-07-13 20:39 - 00111789 _____ C:\Windows\setupact.log
2013-07-09 04:02 - 2011-07-07 03:37 - 00000000 ____D C:\Users\Christian Schmid\AppData\Roaming\Skype
2013-06-25 12:57 - 2010-11-10 11:10 - 00000000 ____D C:\Users\Christian Schmid\AppData\Local\Google
2013-06-25 12:42 - 2011-08-19 09:30 - 00000000 ____D C:\Users\Christian Schmid\AppData\Local\CrashDumps
2013-06-25 00:06 - 2010-11-11 04:55 - 00000000 ____D C:\MerkurOfficeCenter
2013-06-24 22:13 - 2013-06-24 22:13 - 00000000 _____ C:\Windows\System32\sho15AC.tmp
2013-06-24 22:12 - 2013-04-04 22:38 - 00009269 _____ C:\Windows\IE10_main.log
2013-06-24 22:11 - 2012-03-30 11:20 - 00692104 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-06-24 22:11 - 2012-03-30 11:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-06-24 12:16 - 2009-07-13 18:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-06-24 12:01 - 2010-11-10 12:46 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-06-23 02:01 - 2011-05-05 20:45 - 73381792 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-06-23 01:59 - 2011-07-07 03:38 - 00002133 _____ C:\Users\Public\Desktop\Google Chrome.lnk

Files to move or delete:
====================
C:\Users\Christian Schmid\AppData\Roaming\skype.dat
C:\Users\Christian Schmid\AppData\Roaming\skype.ini

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2013-04-11 11:36:18
Restore point made on: 2013-04-13 07:22:41
Restore point made on: 2013-04-24 22:02:48
Restore point made on: 2013-05-15 09:32:05
Restore point made on: 2013-06-23 02:00:45
Restore point made on: 2013-06-24 11:58:43
Restore point made on: 2013-06-24 12:26:31
Restore point made on: 2013-07-17 06:37:23

==================== Memory info =========================== 

Percentage of memory in use: 8%
Total physical RAM: 7860.48 MB
Available physical RAM: 7189.42 MB
Total Pagefile: 7858.76 MB
Available Pagefile: 7200.18 MB
Total Virtual: 2047.88 MB
Available Virtual: 1934.59 MB

==================== Drives ================================

Drive c: (Acer) (Fixed) (Total:106.34 GB) (Free:56.49 GB) NTFS
Drive e: (DATA) (Fixed) (Total:103.45 GB) (Free:103.17 GB) NTFS
Drive f: (PQSERVICE) (Fixed) (Total:23 GB) (Free:4.46 GB) NTFS
Drive h: (PNY TRNF) (Removable) (Total:15.22 GB) (Free:15.21 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM RESERVED) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 233 GB) (Disk ID: C91AC514)
Partition 1: (Not Active) - (Size=23 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=106 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=103 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 15 GB) (Disk ID: C3072E18)
Partition 1: (Active) - (Size=15 GB) - (Type=0C)


LastRegBack: 2013-06-25 01:05

==================== End Of Log ============================