Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014
Ran by SYSTEM on MININT-OP609P1 on 23-10-2014 10:14:20
Running from E:\
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-05-15] (Intel Corporation)
HKLM-x32\...\Run: [IntelSBA] => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [4243168 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Norton Ghost 15.0] => C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe [2598760 2010-03-03] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APVXDWIN] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\APVXDWIN.EXE [1062880 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [SCANINICIO] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\Inicio.exe [71648 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153992 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-31] (Apple Inc.)
Winlogon\Notify\avldr: C:\WINDOWS\SYSTEM32\avldr64.dll (On-Access Anti-Malware Scanner Sync)
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_winlogonx64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\SYSTEM32\igfxdev.dll (Intel Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess?
HKU\Alle Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Alle Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kiadmin\...\Policies\system: [LogonHoursAction] 2
HKU\Kiadmin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\kinder.PC-Martha\...\Run: [Facebook Update] => C:\Users\kinder.PC-Martha\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-05-20] (Facebook Inc.)
HKU\kinder.PC-Martha\...\Run: [Softonic for Windows] => C:\Users\kinder.PC-Martha\AppData\Local\Softonic\Softonic.exe [4170224 2014-04-29] (Softonic)
HKU\kinder.PC-Martha\...\RunOnce: [Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\kinder.PC-Martha\...\RunOnce: [Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\kinder.PC-Martha\...\Policies\system: [LogonHoursAction] 2
HKU\kinder.PC-Martha\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Martha Oechslin\...\Run: [Akamai NetSession Interface] => C:\Users\Martha Oechslin\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\Martha Oechslin\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1938112 2014-09-22] (Valve Corporation)
HKU\Martha Oechslin\...\Run: [CLXReader] => C:\Program Files (x86)\CLX.PayPen\CLXReader.exe [4108112 2012-04-24] (CREALOGIX E-Payment AG)
HKU\Martha Oechslin\...\Run: [InetStat] => C:\Users\Martha Oechslin\AppData\Roaming\InetStat\inetstat.exe [702478 2014-10-21] ()
HKU\Martha Oechslin\...\RunOnce: [Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\Martha Oechslin\...\RunOnce: [Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\Martha Oechslin\...\Policies\system: [LogonHoursAction] 2
HKU\Martha Oechslin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Martha Oechslin\...\Winlogon: [Shell] C:\WINDOWS\explorer.exe [2871808 2011-02-24] (Microsoft Corporation) <==== ATTENTION 
HKU\Matthias\...\Run: [ConnectionCenter] => C:\Users\Matthias\AppData\Local\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKU\Matthias\...\Policies\system: [LogonHoursAction] 2
HKU\Matthias\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Neue Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Neue Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Oechslins\...\Policies\system: [LogonHoursAction] 2
HKU\Oechslins\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Oechslinsteiner\...\Policies\system: [LogonHoursAction] 2
HKU\Oechslinsteiner\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Samuel&Thomas\...\Policies\system: [LogonHoursAction] 2
HKU\Samuel&Thomas\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\kinder.PC-Martha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk
ShortcutTarget: Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1013\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1007\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1006\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1000\User: Group Policy restriction detected <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 GenericMount Helper Service; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-11] (Symantec)
S3 GoToAssist Remote Support Customer; C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_service.exe [611400 2013-07-15] (Citrix Online, a division of Citrix Systems, Inc.)
S2 Intel(R) Small Business Advantage; C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [49376 2012-02-27] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-15] (Intel Corporation)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE [2999664 2007-09-26] (Symantec Corporation)
S2 Norton Ghost; C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe [4590432 2010-03-03] (Symantec Corporation)
S2 Panda Software Controller; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsCtrls.exe [177440 2012-11-19] (Panda Security, S.L.)
S2 PAVFNSVR; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PavFnSvr.exe [202016 2012-09-20] (Panda Security, S.L.)
S2 PavPrSrv; C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe [62768 2008-02-04] (Panda Security, S.L.)
S2 PAVSRV; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\pavsrvx86.exe [313664 2011-04-13] (Panda Security, S.L.)
S2 PSIMSVC; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsImSvc.exe [108288 2008-06-19] (Panda Security S.L.)
S2 PskSvcRetail; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PskSvc.exe [28992 2010-08-16] (Panda Security, S.L.)
S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)
S3 Symantec SymSnap VSS Provider; C:\Windows\SysWOW64\dllhost.exe [7168 2009-07-13] (Microsoft Corporation)
S3 SymSnapService; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2963960 2010-02-10] (Symantec)
S2 TPSrv; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\TPSrvWow.exe [173816 2014-02-25] (Panda Security, S.L.)
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ServiceMain

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AmFSM; C:\Windows\System32\DRIVERS\amm6460.sys [71432 2012-03-26] (Panda Security, S.L.)
S3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-11] (Symantec Corporation)
S2 inpoutx64; C:\Windows\System32\Drivers\inpoutx64.sys [15008 2012-07-17] (Highresolution Enterprises [www.highrez.co.uk])
S0 pavboot; C:\Windows\System32\Drivers\pavboot64.sys [30792 2010-06-22] (Panda Security, S.L.)
S3 PayPen; C:\Windows\System32\Drivers\PayPen.sys [20864 2012-04-24] ()
S1 ShldFlt; C:\Windows\System32\DRIVERS\ShldFlt.sys [48136 2009-10-27] (Panda Security, S.L.)
S0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170032 2010-02-10] (StorageCraft)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
S3 cpuz134; \??\C:\Users\MARTHA~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
S3 cpuz135; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
S3 PavTPK.sys; \??\C:\Windows\system32\PavTPK.sys [X]
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]
S2 V2iMount; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 10:13 - 2014-10-23 10:14 - 00000000 ____D () C:\FRST
2014-10-23 01:14 - 2014-10-23 01:14 - 00000050 _____ () C:\.directory
2014-10-22 22:52 - 2014-10-22 23:00 - 00014318 _____ () C:\Windows\WindowsUpdate.log
2014-10-22 22:49 - 2014-10-22 23:33 - 00000112 _____ () C:\Windows\setupact.log
2014-10-22 22:49 - 2014-10-22 22:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-22 22:48 - 2014-10-22 22:48 - 00173252 _____ () C:\Users\Martha Oechslin\Desktop\cc_20141023_084823.reg
2014-10-21 06:09 - 2014-10-21 10:51 - 00000000 ____D () C:\Program Files (x86)\SmartOnes
2014-10-21 06:09 - 2014-10-21 06:09 - 00001266 _____ () C:\Users\Martha Oechslin\Desktop\Continue installation .lnk
2014-10-21 06:09 - 2014-10-21 06:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Roaming\InetStat
2014-10-21 06:06 - 2014-10-21 06:06 - 01080416 _____ (Unity Technologies ApS) C:\Users\Matthias\Downloads\UnityWebPlayer.exe
2014-10-21 05:56 - 2014-10-21 05:56 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Unity
2014-10-21 05:39 - 2014-10-21 05:39 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (5).ica
2014-10-20 09:53 - 2014-10-20 09:53 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (4).ica
2014-10-15 22:14 - 2014-10-09 18:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-15 22:14 - 2014-10-09 18:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-15 22:14 - 2014-10-09 18:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-15 22:14 - 2014-10-06 18:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-10-15 22:14 - 2014-10-06 18:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 22:14 - 2014-09-28 16:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-10-15 22:14 - 2014-09-25 14:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 22:14 - 2014-09-25 14:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 22:14 - 2014-09-25 14:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 22:14 - 2014-09-25 14:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-10-15 22:14 - 2014-09-18 18:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-10-15 22:14 - 2014-09-18 17:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-10-15 22:14 - 2014-09-18 17:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-10-15 22:14 - 2014-09-18 17:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 22:14 - 2014-09-18 17:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-10-15 22:14 - 2014-09-18 17:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-10-15 22:14 - 2014-09-18 17:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-10-15 22:14 - 2014-09-18 17:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-10-15 22:14 - 2014-09-18 17:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-10-15 22:14 - 2014-09-18 17:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-10-15 22:14 - 2014-09-18 17:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-10-15 22:14 - 2014-09-18 17:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-10-15 22:14 - 2014-09-18 17:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-10-15 22:14 - 2014-09-18 17:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-10-15 22:14 - 2014-09-18 17:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 22:14 - 2014-09-18 17:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-10-15 22:14 - 2014-09-18 17:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-10-15 22:14 - 2014-09-18 17:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-10-15 22:14 - 2014-09-18 17:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-15 22:14 - 2014-09-18 17:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-10-15 22:14 - 2014-09-18 17:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-10-15 22:14 - 2014-09-18 17:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-15 22:14 - 2014-09-18 17:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-10-15 22:14 - 2014-09-18 16:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 22:14 - 2014-09-18 16:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-10-15 22:14 - 2014-09-18 16:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 22:14 - 2014-09-18 16:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-15 22:14 - 2014-09-18 16:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-15 22:14 - 2014-09-18 16:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-15 22:14 - 2014-09-18 16:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-15 22:14 - 2014-09-18 16:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-15 22:14 - 2014-09-18 16:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-10-15 22:14 - 2014-09-18 16:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-10-15 22:14 - 2014-09-18 16:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-10-15 22:14 - 2014-09-18 16:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 22:14 - 2014-09-18 16:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-10-15 22:14 - 2014-09-18 16:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-15 22:14 - 2014-09-18 16:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 22:14 - 2014-09-18 16:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-15 22:14 - 2014-09-18 16:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-10-15 22:14 - 2014-09-18 15:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 22:14 - 2014-09-18 15:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-10-15 22:14 - 2014-09-18 15:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 22:14 - 2014-09-18 15:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDYAK.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDTAT.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU1.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDBASH.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-15 22:14 - 2014-07-08 14:38 - 00419992 _____ () C:\Windows\System32\locale.nls
2014-10-15 22:14 - 2014-07-08 14:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-15 22:14 - 2014-06-18 14:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\System32\mscories.dll
2014-10-15 22:13 - 2014-09-17 18:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-10-15 22:13 - 2014-09-17 17:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 22:13 - 2014-09-03 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\rastls.dll
2014-10-15 22:13 - 2014-09-03 21:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2014-10-15 22:13 - 2014-07-16 18:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-10-15 22:13 - 2014-07-16 18:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\winsta.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-10-15 22:13 - 2014-07-16 17:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 22:13 - 2014-07-16 17:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 22:13 - 2014-07-16 17:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2014-10-15 22:13 - 2014-07-16 17:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2014-10-15 22:12 - 2014-09-12 17:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll
2014-10-15 22:12 - 2014-09-12 17:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-13 07:49 - 2014-10-13 07:49 - 00000000 ____D () C:\Users\Samuel&Thomas\Desktop\Neuer Ordner
2014-09-30 21:02 - 2014-09-24 18:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2014-09-30 21:02 - 2014-09-24 17:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-24 05:04 - 2014-09-09 14:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2014-09-24 05:04 - 2014-09-09 13:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-23 07:11 - 2014-09-23 07:11 - 00000000 ____D () C:\Users\Matthias\DxReport
2014-09-23 07:11 - 2014-09-23 07:11 - 00000000 ____D () C:\Users\Matthias\AppData\Roaming\LaunchPad
2014-09-23 06:53 - 2014-09-23 06:53 - 00002097 _____ () C:\Users\Public\Desktop\RollerCoaster Tycoon 3.lnk
2014-09-23 06:52 - 2014-09-23 06:52 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\RCT3
2014-09-23 06:52 - 2002-02-27 07:50 - 00197120 _____ () C:\Windows\patchw32.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 01:33 - 2014-07-15 00:06 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-10-22 23:33 - 2013-05-23 03:18 - 00001332 __RSH () C:\Users\Kiadmin\ntuser.pol
2014-10-22 23:33 - 2012-08-08 09:04 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-22 23:33 - 2012-07-30 01:19 - 00000000 ____D () C:\users\Kiadmin
2014-10-22 23:33 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-22 22:57 - 2012-07-30 06:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-22 22:57 - 2009-07-13 20:45 - 00031888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-22 22:57 - 2009-07-13 20:45 - 00031888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-22 05:43 - 2011-02-23 04:59 - 30416852 _____ () C:\Windows\System32\perfh007.dat
2014-10-22 05:43 - 2011-02-23 04:59 - 09696350 _____ () C:\Windows\System32\perfc007.dat
2014-10-22 05:43 - 2009-07-13 21:13 - 00006118 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-10-22 05:41 - 2013-05-20 08:36 - 00000952 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006UA.job
2014-10-22 03:16 - 2012-08-08 09:04 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-22 03:13 - 2013-05-02 07:32 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-22 03:13 - 2012-08-23 03:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\CrashDumps
2014-10-22 03:13 - 2012-08-03 08:53 - 00000000 ____D () C:\Windows\Minidump
2014-10-21 08:41 - 2013-05-20 08:36 - 00000930 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006Core.job
2014-10-21 07:10 - 2012-07-31 00:11 - 00008627 _____ () C:\Windows\SysWOW64\PAV_FOG.OPC
2014-10-21 05:56 - 2014-04-25 22:06 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Deployment
2014-10-20 10:30 - 2012-08-02 03:37 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Outlook-Dateien
2014-10-18 23:26 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-10-17 23:28 - 2014-08-01 22:02 - 00000000 ____D () C:\Users\Oechslinsteiner\AppData\Local\CrashDumps
2014-10-16 09:43 - 2009-07-13 20:45 - 00343232 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-10-16 09:41 - 2014-05-06 05:58 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-10-16 09:32 - 2012-07-30 07:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 09:19 - 2013-07-15 00:12 - 00000000 ____D () C:\Windows\System32\MRT
2014-10-16 09:19 - 2012-07-30 01:26 - 103265616 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-10-14 00:23 - 2012-08-08 03:48 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Lohnabrechnungen
2014-10-13 08:47 - 2013-01-08 08:08 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D650C523-4389-4A53-88DB-0AED38A191CB}
2014-10-11 07:35 - 2014-01-03 09:57 - 00000680 __RSH () C:\Users\Oechslinsteiner\ntuser.pol
2014-10-11 07:35 - 2013-06-05 02:03 - 00000000 ____D () C:\users\Oechslinsteiner
2014-10-09 07:13 - 2013-12-19 11:29 - 00001344 __RSH () C:\Users\Samuel&Thomas\ntuser.pol
2014-10-09 07:13 - 2013-12-19 11:29 - 00000000 ____D () C:\users\Samuel&Thomas
2014-10-07 07:13 - 2012-11-09 02:29 - 00001334 __RSH () C:\Users\Matthias\ntuser.pol
2014-10-07 07:13 - 2012-11-09 02:29 - 00000000 ____D () C:\users\Matthias
2014-10-06 10:03 - 2012-11-07 05:42 - 00000680 __RSH () C:\Users\Martha Oechslin\ntuser.pol
2014-10-06 10:03 - 2012-07-30 06:27 - 00000000 ____D () C:\users\Martha Oechslin
2014-10-02 05:53 - 2010-11-20 19:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2014-09-25 06:18 - 2013-06-03 09:18 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-25 05:57 - 2012-07-30 06:59 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-25 05:57 - 2012-07-30 06:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-25 05:57 - 2012-07-30 06:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-24 08:36 - 2012-11-09 02:29 - 00000000 ____D () C:\Users\Matthias\AppData\Local\VirtualStore
2014-09-24 01:56 - 2012-07-15 23:29 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-24 01:43 - 2009-07-13 21:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-23 06:50 - 2012-08-08 23:37 - 00000000 ____D () C:\Program Files (x86)\Atari

Files to move or delete:
====================
C:\Users\kinder.PC-Martha\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\Martha Oechslin\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\Martha Oechslin\AppData\Roaming\skype.ini


Some content of TEMP:
====================
C:\Users\Kiadmin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kiadmin\AppData\Local\Temp\msvcp100.dll
C:\Users\Kiadmin\AppData\Local\Temp\msvcr100.dll
C:\Users\Kiadmin\AppData\Local\Temp\uninst1.exe
C:\Users\Kiadmin\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Kinder\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Kinder\AppData\Local\Temp\instloffer.exe
C:\Users\Kinder\AppData\Local\Temp\iupdate.exe
C:\Users\Kinder\AppData\Local\Temp\SIntf16.dll
C:\Users\Kinder\AppData\Local\Temp\SIntf32.dll
C:\Users\Kinder\AppData\Local\Temp\SIntfNT.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\83newxtc.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\ann.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\banner.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\cminpack.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\daisy3.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\eigen.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\fast.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\install_flashplayer13x32ax_chra_awa_aih.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\panosgm.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\Softonic_DE_1-5-1.exe
C:\Users\Martha Oechslin\AppData\Local\Temp\amt_mystartsearch.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession1.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession2.exe
C:\Users\Matthias\AppData\Local\Temp\SIntf16.dll
C:\Users\Matthias\AppData\Local\Temp\SIntf32.dll
C:\Users\Matthias\AppData\Local\Temp\SIntfNT.dll
C:\Users\Matthias\AppData\Local\Temp\_inst1.exe
C:\Users\Oechslins\AppData\Local\Temp\SIntf16.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntf32.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntfNT.dll
C:\Users\Oechslinsteiner\AppData\Local\Temp\OutlookConnector.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_1.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_2.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_3.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe
[2014-10-15 22:13] - [2014-07-16 18:07] - 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-10-02 00:11:09
Restore point made on: 2014-10-03 22:44:35
Restore point made on: 2014-10-07 07:18:19
Restore point made on: 2014-10-13 22:27:13
Restore point made on: 2014-10-16 09:19:07
Restore point made on: 2014-10-21 02:52:21

==================== Memory info =========================== 

Percentage of memory in use: 9%
Total physical RAM: 8070.04 MB
Available physical RAM: 7284.78 MB
Total Pagefile: 8068.23 MB
Available Pagefile: 7280.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:326.78 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (USB STICK) (Removable) (Total:3.72 GB) (Free:3.72 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: EA79D15E)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 3.7 GB) (Disk ID: 004E4A2A)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0B)


LastRegBack: 2014-10-15 22:52

==================== End Of Log ============================