Windows 7 weisser Bildschirm nach der Anmeldung

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by SYSTEM on MININT-N26COSC on 27-03-2014 21:49:38
Running from D:\
Windows 7 Home Premium (X64) OS Language: English(US)
Internet Explorer Version 8
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.


The only official download link for FRST:
Download link for 32-Bit version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/81/ 
Download link for 64-Bit Version: hxxp://www.bleepingcomputer.com/download/farbar-recovery-scan-tool/dl/82/ 
Download link from any site other than Bleeping Computer is unpermitted or outdated.
See tutorial for FRST: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [SynTPEnh] - C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2281256 2011-09-11] (Synaptics Incorporated)
HKLM\...\Run: [HPWirelessAssistant] - C:\Program Files\Hewlett-Packard\HP Wireless Assistant\HPWA_Main.exe [363064 2010-01-27] (Hewlett-Packard)
HKLM\...\Run: [CanonMyPrinter] - C:\Program Files\Canon\MyPrinter\BJMyPrt.exe [2184520 2009-07-26] (CANON INC.)
HKLM\...\Run: [SysTrayApp] - C:\Program Files\IDT\WDM\sttray64.exe [487424 2010-02-01] (IDT, Inc.)
HKLM\...\Run: [Windows Mobile Device Center] - C:\Windows\WindowsMobile\wmdc.exe [660360 2007-05-31] (Microsoft Corporation)
HKLM-x32\...\Run: [] - [X]
HKLM-x32\...\Run: [ApnUpdater] - C:\Program Files (x86)\Ask.com\Updater\Updater.exe [1564872 2012-06-06] (Ask)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [252848 2012-07-03] (Sun Microsystems, Inc.)
HKLM-x32\...\Run: [HP Quick Launch] - C:\Program Files (x86)\Hewlett-Packard\HP Quick Launch\HPMSGSVC.exe [587320 2011-06-14] (Hewlett-Packard Development Company, L.P.)
HKLM-x32\...\Run: [A1Diagnose] - C:\Program Files (x86)\A1 Servicecenter\A1 Diagnose\A1Diagnose.exe [21004392 2014-01-16] (mquadr.at software engineering and consulting GmbH, web: www.mquadr.at, mail: office@mquadr.at)
HKLM\...\RunOnce: [NCPluginUpdater] - "C:\Program Files (x86)\Hewlett-Packard\HP Health Check\ActiveCheck\product_line\NCPluginUpdater.exe" Update [21720 2014-03-25] (Hewlett-Packard)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\Default\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\Default User\...\Run: [HPAdvisorDock] - C:\Program Files (x86)\Hewlett-Packard\HP Advisor\DOCK\HPAdvisorDock.exe [1712184 2010-02-09] ()
HKU\Klaunzer Florian\...\Run: [Google Update] - C:\Users\Klaunzer Florian\AppData\Local\Google\Update\GoogleUpdate.exe [136176 2011-01-30] (Google Inc.)
HKU\Klaunzer Florian\...\Run: [Skype] - C:\Program Files (x86)\Skype\Phone\Skype.exe [20924064 2014-02-10] (Skype Technologies S.A.)
HKU\Klaunzer Florian\...\Policies\system: [DisableLockWorkstation] 0
HKU\Klaunzer Florian\...\Policies\system: [DisableChangePassword] 0
HKU\Klaunzer Florian\...\Winlogon: [Shell] explorer.exe,C:\Users\Klaunzer Florian\AppData\Roaming\cache.dat [72192 2010-10-26] () <==== ATTENTION 

==================== Services (Whitelisted) =================

S2 AESTFilters; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_471277d5d45019ea\AESTSr64.exe [89600 2009-03-03] (Andrea Electronics Corporation)
S2 STacSV; C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_471277d5d45019ea\STacSV64.exe [244736 2010-02-01] (IDT, Inc.)

==================== Drivers (Whitelisted) ====================

S1 DVMIO; C:\Windows\System32\DRIVERS\dvmio.sys [20056 2009-11-11] (DeviceVM, Inc.)
S3 ewusbnet; system32\DRIVERS\ewusbnet.sys [X]
S3 ew_hwusbdev; system32\DRIVERS\ew_hwusbdev.sys [X]
S3 huawei_enumerator; system32\DRIVERS\ew_jubusenum.sys [X]
S3 hwdatacard; system32\DRIVERS\ewusbmdm.sys [X]
S3 hwusbdev; system32\DRIVERS\ewusbdev.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-27 21:21 - 2014-03-27 21:49 - 00000000 ____D () C:\FRST
2014-03-26 12:40 - 2014-03-26 12:40 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-26 12:40 - 2014-03-26 12:40 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-26 12:40 - 2014-03-26 12:40 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\Skype
2014-03-26 10:53 - 2014-03-26 10:54 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{5CAEBD3A-1007-4081-A700-9A9E8D24CC90}
2014-03-25 10:12 - 2014-03-25 10:12 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{B2381CA2-4132-4E6D-9988-1B62EAB6D83D}
2014-03-24 11:08 - 2014-03-24 11:08 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{9FEE7C20-162D-44E1-A2D4-09A0286650CA}
2014-03-23 01:07 - 2014-03-23 01:07 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{6BBC988F-3A8D-434E-8FD3-7788AC3604D4}
2014-03-20 11:51 - 2014-03-20 11:51 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{858FB52F-49CF-4F55-A85B-B221A639BE72}
2014-03-19 11:12 - 2014-03-19 11:12 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{5090E029-BD38-4230-B0F8-161EA7F3A13A}
2014-03-18 10:31 - 2014-03-18 10:31 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{1EC587C7-9DE7-423A-846A-2077FAA763B2}
2014-03-17 11:41 - 2014-03-17 11:42 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{5FA23BA3-6BC3-4986-929A-8C42C1F5C2DD}
2014-03-16 01:15 - 2014-03-16 01:15 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{B6147EE9-DAD5-4122-AD9A-703A7D566D15}
2014-03-14 10:54 - 2014-03-14 10:54 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{E15AD0AC-75B0-41B5-90D2-A6C82A198DC6}
2014-03-12 10:41 - 2014-03-12 10:41 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{B08C1510-65E5-47F4-8B9C-2606FB075AD2}
2014-03-11 12:03 - 2014-03-11 12:03 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{EC8AC669-15EE-4551-BA72-261BC9469A80}
2014-03-10 04:28 - 2014-03-10 04:28 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{E828E4D0-6EC1-4D5E-BE5B-774A3B67ADDC}
2014-03-09 10:12 - 2014-03-09 10:12 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{BAECFCC3-B577-4753-BE79-543D245A8088}
2014-03-08 11:16 - 2014-03-08 11:17 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{4F4FBA74-1FC2-4F6A-B113-EA5B992030A2}
2014-03-07 11:46 - 2014-03-07 11:46 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{D61356FB-CD35-48ED-AAB5-FCE37425B414}
2014-03-05 22:14 - 2014-03-05 22:14 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{4B22296A-F030-445A-A92A-3EADDA03AEE7}
2014-03-02 06:44 - 2014-03-02 06:44 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{06BE3F98-A923-4B66-B397-E0E157416F85}
2014-03-01 00:58 - 2014-03-01 00:58 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{76A7AAA8-620B-498C-A90B-FB517EED4767}
2014-02-28 03:39 - 2014-02-28 03:39 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{E00665C4-A9C3-44D5-A9A6-96317F1C46AC}
2014-02-25 03:42 - 2014-02-25 03:43 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{67CF1A5C-DFBC-4A43-A421-D2DEB81690CC}

==================== One Month Modified Files and Folders =======

2014-03-27 21:49 - 2014-03-27 21:21 - 00000000 ____D () C:\FRST
2014-03-27 12:45 - 2010-07-05 15:53 - 01264280 _____ () C:\Windows\WindowsUpdate.log
2014-03-27 12:41 - 2013-09-15 11:14 - 00000004 _____ () C:\Users\Klaunzer Florian\AppData\Roaming\cache.ini
2014-03-27 12:37 - 2009-07-13 20:45 - 00023248 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-27 12:37 - 2009-07-13 20:45 - 00023248 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-27 12:34 - 2010-05-18 20:00 - 00654400 _____ () C:\Windows\System32\perfh007.dat
2014-03-27 12:34 - 2010-05-18 20:00 - 00130240 _____ () C:\Windows\System32\perfc007.dat
2014-03-27 12:34 - 2009-07-13 21:13 - 01498742 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-03-27 12:31 - 2012-11-11 08:20 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Roaming\Skype
2014-03-27 12:30 - 2012-11-12 10:56 - 00001126 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-03-27 12:30 - 2012-02-19 02:11 - 00030547 _____ () C:\Windows\setupact.log
2014-03-27 12:30 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-27 11:47 - 2012-11-12 10:56 - 00001130 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-03-27 11:47 - 2011-01-30 03:49 - 00001164 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3447022846-1066447705-3433553858-1000UA.job
2014-03-26 22:47 - 2011-01-30 03:49 - 00001112 _____ () C:\Windows\Tasks\GoogleUpdateTaskUserS-1-5-21-3447022846-1066447705-3433553858-1000Core.job
2014-03-26 22:42 - 2012-11-12 10:56 - 00004126 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-03-26 22:42 - 2012-11-12 10:56 - 00003874 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-03-26 22:42 - 2011-01-30 03:49 - 00004156 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3447022846-1066447705-3433553858-1000UA
2014-03-26 22:42 - 2011-01-30 03:49 - 00003760 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskUserS-1-5-21-3447022846-1066447705-3433553858-1000Core
2014-03-26 13:09 - 2014-01-02 12:02 - 00000376 _____ () C:\Windows\Tasks\HPCeeScheduleForKlaunzer Florian.job
2014-03-26 12:40 - 2014-03-26 12:40 - 00002699 _____ () C:\Users\Public\Desktop\Skype.lnk
2014-03-26 12:40 - 2014-03-26 12:40 - 00000000 ___RD () C:\Program Files (x86)\Skype
2014-03-26 12:40 - 2014-03-26 12:40 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\Skype
2014-03-26 12:40 - 2012-11-11 08:20 - 00000000 ____D () C:\ProgramData\Skype
2014-03-26 12:14 - 2014-01-02 12:02 - 00003252 _____ () C:\Windows\System32\Tasks\HPCeeScheduleForKlaunzer Florian
2014-03-26 12:13 - 2011-12-07 12:26 - 00000000 _____ () C:\Windows\System32\HP_ActiveX_Patch_NOT_DETECTED.txt
2014-03-26 12:13 - 2011-01-25 00:52 - 00000052 _____ () C:\Windows\SysWOW64\DOErrors.log
2014-03-26 12:06 - 2011-01-30 03:49 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\Google
2014-03-26 10:54 - 2014-03-26 10:53 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{5CAEBD3A-1007-4081-A700-9A9E8D24CC90}
2014-03-25 10:12 - 2014-03-25 10:12 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{B2381CA2-4132-4E6D-9988-1B62EAB6D83D}
2014-03-24 11:08 - 2014-03-24 11:08 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{9FEE7C20-162D-44E1-A2D4-09A0286650CA}
2014-03-23 01:07 - 2014-03-23 01:07 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{6BBC988F-3A8D-434E-8FD3-7788AC3604D4}
2014-03-20 11:51 - 2014-03-20 11:51 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{858FB52F-49CF-4F55-A85B-B221A639BE72}
2014-03-19 11:12 - 2014-03-19 11:12 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{5090E029-BD38-4230-B0F8-161EA7F3A13A}
2014-03-18 10:31 - 2014-03-18 10:31 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{1EC587C7-9DE7-423A-846A-2077FAA763B2}
2014-03-17 11:42 - 2014-03-17 11:41 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{5FA23BA3-6BC3-4986-929A-8C42C1F5C2DD}
2014-03-17 09:10 - 2011-01-30 03:50 - 00002409 _____ () C:\Users\Klaunzer Florian\Desktop\Google Chrome.lnk
2014-03-16 01:15 - 2014-03-16 01:15 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{B6147EE9-DAD5-4122-AD9A-703A7D566D15}
2014-03-14 10:54 - 2014-03-14 10:54 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{E15AD0AC-75B0-41B5-90D2-A6C82A198DC6}
2014-03-12 10:41 - 2014-03-12 10:41 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{B08C1510-65E5-47F4-8B9C-2606FB075AD2}
2014-03-11 12:03 - 2014-03-11 12:03 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{EC8AC669-15EE-4551-BA72-261BC9469A80}
2014-03-10 04:28 - 2014-03-10 04:28 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{E828E4D0-6EC1-4D5E-BE5B-774A3B67ADDC}
2014-03-09 10:12 - 2014-03-09 10:12 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{BAECFCC3-B577-4753-BE79-543D245A8088}
2014-03-08 11:17 - 2014-03-08 11:16 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{4F4FBA74-1FC2-4F6A-B113-EA5B992030A2}
2014-03-07 11:46 - 2014-03-07 11:46 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{D61356FB-CD35-48ED-AAB5-FCE37425B414}
2014-03-07 11:43 - 2012-04-18 07:26 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-07 11:43 - 2011-06-12 22:44 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-05 22:14 - 2014-03-05 22:14 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{4B22296A-F030-445A-A92A-3EADDA03AEE7}
2014-03-02 06:44 - 2014-03-02 06:44 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{06BE3F98-A923-4B66-B397-E0E157416F85}
2014-03-01 00:58 - 2014-03-01 00:58 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{76A7AAA8-620B-498C-A90B-FB517EED4767}
2014-02-28 03:39 - 2014-02-28 03:39 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{E00665C4-A9C3-44D5-A9A6-96317F1C46AC}
2014-02-28 03:38 - 2011-03-20 04:19 - 00030112 _____ () C:\Windows\PFRO.log
2014-02-25 03:43 - 2014-02-25 03:42 - 00000000 ____D () C:\Users\Klaunzer Florian\AppData\Local\{67CF1A5C-DFBC-4A43-A421-D2DEB81690CC}

Files to move or delete:
====================
C:\Users\Klaunzer Florian\AppData\Roaming\cache.dat
C:\Users\Klaunzer Florian\AppData\Roaming\cache.ini
C:\Users\Klaunzer Florian\AppData\Roaming\skype.ini
C:\Users\Klaunzer Florian\AppData\Roaming\skype.dat


Some content of TEMP:
====================
C:\Users\Klaunzer Florian\AppData\Local\Temp\AMPing.exe
C:\Users\Klaunzer Florian\AppData\Local\Temp\Extract.exe
C:\Users\Klaunzer Florian\AppData\Local\Temp\InstallManager_BAB_BAB.exe
C:\Users\Klaunzer Florian\AppData\Local\Temp\ose00000.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points  =========================

Restore point made on: 2014-02-12 12:53:55
Restore point made on: 2014-02-13 18:52:47
Restore point made on: 2014-02-16 18:52:44
Restore point made on: 2014-02-17 14:33:56
Restore point made on: 2014-02-17 14:44:38
Restore point made on: 2014-02-17 14:51:07
Restore point made on: 2014-02-17 14:51:57
Restore point made on: 2014-02-17 14:52:16
Restore point made on: 2014-02-17 14:52:38
Restore point made on: 2014-02-17 14:56:12
Restore point made on: 2014-02-20 13:15:16
Restore point made on: 2014-02-20 19:41:29
Restore point made on: 2014-03-02 06:47:28
Restore point made on: 2014-03-10 05:14:14
Restore point made on: 2014-03-10 20:53:03
Restore point made on: 2014-03-11 20:52:55
Restore point made on: 2014-03-19 09:33:28
Restore point made on: 2014-03-20 13:15:12
Restore point made on: 2014-03-20 20:37:12
Restore point made on: 2014-03-21 20:37:09

==================== Memory info =========================== 

Percentage of memory in use: 18%
Total physical RAM: 3834.9 MB
Available physical RAM: 3112.99 MB
Total Pagefile: 3833.05 MB
Available Pagefile: 3101.41 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:443.84 GB) (Free:387.54 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: () (Removable) (Total:3.74 GB) (Free:3.73 GB) FAT32
Drive f: (RECOVERY) (Fixed) (Total:21.63 GB) (Free:3.15 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive g: (HP_TOOLS) (Fixed) (Total:0.1 GB) (Free:0.09 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.19 GB) (Free:0.16 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 466 GB) (Disk ID: 0E28EF92)

Partition: GPT Partition Type.

========================================================
Disk: 1 (MBR Code: Windows XP) (Size: 4 GB) (Disk ID: C3072E18)

Partition: GPT Partition Type.


LastRegBack: 2014-03-19 15:21

==================== End Of Log ============================