Zurück   Trojaner-Board > Malware entfernen > Plagegeister aller Art und deren Bekämpfung
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Plagegeister aller Art und deren Bekämpfung: Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.

Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen.

Antwort
Seite 1 von 2 1 2
Alt 23.10.2014, 09:18   #1
lukas.schoen
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Ausrufezeichen

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Habe folgendes Problem mit einem Computer.
Windows 7 Pro 64 Bit

1. Alle Ink Dateien sind weiss

2. Wenn ich den Arbeitsplatz oder Windows Explorer öffnen will kommt folgende Meldung:
"C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Administrative Tools\Computer Management.lnk

"Der Datei ist kein Programm zum Ausführen dieser Aktion zugeordnet. Installieren Sie ein entsprechendes Programm, oder erstellen Sie in der Systemsteuerung unter "Standardprogramme" eine Zuordnung, wenn bereits ein Programm installiert ist."


3. Ich komme nicht in den Registry Editor

4. Ich kann kein Programm, Datei oder sonst was öffnen, auch nicht mit rechtsklick, öffnen.

5. All diese Probleme treten auch im abgesicherten Modus auf.

6. Kaspersky Rescue Disc hat nichts gefunden.

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014
Ran by SYSTEM on MININT-OP609P1 on 23-10-2014 10:14:20
Running from E:\
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-05-15] (Intel Corporation)
HKLM-x32\...\Run: [IntelSBA] => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [4243168 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Norton Ghost 15.0] => C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe [2598760 2010-03-03] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APVXDWIN] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\APVXDWIN.EXE [1062880 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [SCANINICIO] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\Inicio.exe [71648 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153992 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-31] (Apple Inc.)
Winlogon\Notify\avldr: C:\WINDOWS\SYSTEM32\avldr64.dll (On-Access Anti-Malware Scanner Sync)
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_winlogonx64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\SYSTEM32\igfxdev.dll (Intel Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess?
HKU\Alle Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Alle Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kiadmin\...\Policies\system: [LogonHoursAction] 2
HKU\Kiadmin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\kinder.PC-Martha\...\Run: [Facebook Update] => C:\Users\kinder.PC-Martha\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-05-20] (Facebook Inc.)
HKU\kinder.PC-Martha\...\Run: [Softonic for Windows] => C:\Users\kinder.PC-Martha\AppData\Local\Softonic\Softonic.exe [4170224 2014-04-29] (Softonic)
HKU\kinder.PC-Martha\...\RunOnce: [Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\kinder.PC-Martha\...\RunOnce: [Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\kinder.PC-Martha\...\Policies\system: [LogonHoursAction] 2
HKU\kinder.PC-Martha\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Martha Oechslin\...\Run: [Akamai NetSession Interface] => C:\Users\Martha Oechslin\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\Martha Oechslin\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1938112 2014-09-22] (Valve Corporation)
HKU\Martha Oechslin\...\Run: [CLXReader] => C:\Program Files (x86)\CLX.PayPen\CLXReader.exe [4108112 2012-04-24] (CREALOGIX E-Payment AG)
HKU\Martha Oechslin\...\Run: [InetStat] => C:\Users\Martha Oechslin\AppData\Roaming\InetStat\inetstat.exe [702478 2014-10-21] ()
HKU\Martha Oechslin\...\RunOnce: [Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\Martha Oechslin\...\RunOnce: [Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\Martha Oechslin\...\Policies\system: [LogonHoursAction] 2
HKU\Martha Oechslin\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Martha Oechslin\...\Winlogon: [Shell] C:\WINDOWS\explorer.exe [2871808 2011-02-24] (Microsoft Corporation) <==== ATTENTION 
HKU\Matthias\...\Run: [ConnectionCenter] => C:\Users\Matthias\AppData\Local\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKU\Matthias\...\Policies\system: [LogonHoursAction] 2
HKU\Matthias\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Neue Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Neue Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Oechslins\...\Policies\system: [LogonHoursAction] 2
HKU\Oechslins\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Oechslinsteiner\...\Policies\system: [LogonHoursAction] 2
HKU\Oechslinsteiner\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Samuel&Thomas\...\Policies\system: [LogonHoursAction] 2
HKU\Samuel&Thomas\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\kinder.PC-Martha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk
ShortcutTarget: Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1013\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1007\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1006\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1000\User: Group Policy restriction detected <======= ATTENTION

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 GenericMount Helper Service; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-11] (Symantec)
S3 GoToAssist Remote Support Customer; C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_service.exe [611400 2013-07-15] (Citrix Online, a division of Citrix Systems, Inc.)
S2 Intel(R) Small Business Advantage; C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [49376 2012-02-27] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-15] (Intel Corporation)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE [2999664 2007-09-26] (Symantec Corporation)
S2 Norton Ghost; C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe [4590432 2010-03-03] (Symantec Corporation)
S2 Panda Software Controller; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsCtrls.exe [177440 2012-11-19] (Panda Security, S.L.)
S2 PAVFNSVR; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PavFnSvr.exe [202016 2012-09-20] (Panda Security, S.L.)
S2 PavPrSrv; C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe [62768 2008-02-04] (Panda Security, S.L.)
S2 PAVSRV; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\pavsrvx86.exe [313664 2011-04-13] (Panda Security, S.L.)
S2 PSIMSVC; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsImSvc.exe [108288 2008-06-19] (Panda Security S.L.)
S2 PskSvcRetail; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PskSvc.exe [28992 2010-08-16] (Panda Security, S.L.)
S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)
S3 Symantec SymSnap VSS Provider; C:\Windows\SysWOW64\dllhost.exe [7168 2009-07-13] (Microsoft Corporation)
S3 SymSnapService; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2963960 2010-02-10] (Symantec)
S2 TPSrv; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\TPSrvWow.exe [173816 2014-02-25] (Panda Security, S.L.)
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ServiceMain

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AmFSM; C:\Windows\System32\DRIVERS\amm6460.sys [71432 2012-03-26] (Panda Security, S.L.)
S3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-11] (Symantec Corporation)
S2 inpoutx64; C:\Windows\System32\Drivers\inpoutx64.sys [15008 2012-07-17] (Highresolution Enterprises [www.highrez.co.uk])
S0 pavboot; C:\Windows\System32\Drivers\pavboot64.sys [30792 2010-06-22] (Panda Security, S.L.)
S3 PayPen; C:\Windows\System32\Drivers\PayPen.sys [20864 2012-04-24] ()
S1 ShldFlt; C:\Windows\System32\DRIVERS\ShldFlt.sys [48136 2009-10-27] (Panda Security, S.L.)
S0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170032 2010-02-10] (StorageCraft)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
S3 cpuz134; \??\C:\Users\MARTHA~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
S3 cpuz135; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
S3 PavTPK.sys; \??\C:\Windows\system32\PavTPK.sys [X]
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]
S2 V2iMount; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 10:13 - 2014-10-23 10:14 - 00000000 ____D () C:\FRST
2014-10-23 01:14 - 2014-10-23 01:14 - 00000050 _____ () C:\.directory
2014-10-22 22:52 - 2014-10-22 23:00 - 00014318 _____ () C:\Windows\WindowsUpdate.log
2014-10-22 22:49 - 2014-10-22 23:33 - 00000112 _____ () C:\Windows\setupact.log
2014-10-22 22:49 - 2014-10-22 22:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-22 22:48 - 2014-10-22 22:48 - 00173252 _____ () C:\Users\Martha Oechslin\Desktop\cc_20141023_084823.reg
2014-10-21 06:09 - 2014-10-21 10:51 - 00000000 ____D () C:\Program Files (x86)\SmartOnes
2014-10-21 06:09 - 2014-10-21 06:09 - 00001266 _____ () C:\Users\Martha Oechslin\Desktop\Continue installation .lnk
2014-10-21 06:09 - 2014-10-21 06:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Roaming\InetStat
2014-10-21 06:06 - 2014-10-21 06:06 - 01080416 _____ (Unity Technologies ApS) C:\Users\Matthias\Downloads\UnityWebPlayer.exe
2014-10-21 05:56 - 2014-10-21 05:56 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Unity
2014-10-21 05:39 - 2014-10-21 05:39 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (5).ica
2014-10-20 09:53 - 2014-10-20 09:53 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (4).ica
2014-10-15 22:14 - 2014-10-09 18:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-15 22:14 - 2014-10-09 18:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-15 22:14 - 2014-10-09 18:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-15 22:14 - 2014-10-06 18:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-10-15 22:14 - 2014-10-06 18:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 22:14 - 2014-09-28 16:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-10-15 22:14 - 2014-09-25 14:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 22:14 - 2014-09-25 14:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 22:14 - 2014-09-25 14:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 22:14 - 2014-09-25 14:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-10-15 22:14 - 2014-09-18 18:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-10-15 22:14 - 2014-09-18 17:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-10-15 22:14 - 2014-09-18 17:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-10-15 22:14 - 2014-09-18 17:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 22:14 - 2014-09-18 17:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-10-15 22:14 - 2014-09-18 17:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-10-15 22:14 - 2014-09-18 17:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-10-15 22:14 - 2014-09-18 17:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-10-15 22:14 - 2014-09-18 17:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-10-15 22:14 - 2014-09-18 17:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-10-15 22:14 - 2014-09-18 17:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-10-15 22:14 - 2014-09-18 17:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-10-15 22:14 - 2014-09-18 17:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-10-15 22:14 - 2014-09-18 17:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-10-15 22:14 - 2014-09-18 17:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 22:14 - 2014-09-18 17:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-10-15 22:14 - 2014-09-18 17:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-10-15 22:14 - 2014-09-18 17:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-10-15 22:14 - 2014-09-18 17:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-15 22:14 - 2014-09-18 17:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-10-15 22:14 - 2014-09-18 17:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-10-15 22:14 - 2014-09-18 17:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-15 22:14 - 2014-09-18 17:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-10-15 22:14 - 2014-09-18 16:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 22:14 - 2014-09-18 16:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-10-15 22:14 - 2014-09-18 16:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 22:14 - 2014-09-18 16:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-15 22:14 - 2014-09-18 16:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-15 22:14 - 2014-09-18 16:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-15 22:14 - 2014-09-18 16:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-15 22:14 - 2014-09-18 16:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-15 22:14 - 2014-09-18 16:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-10-15 22:14 - 2014-09-18 16:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-10-15 22:14 - 2014-09-18 16:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-10-15 22:14 - 2014-09-18 16:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 22:14 - 2014-09-18 16:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-10-15 22:14 - 2014-09-18 16:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-15 22:14 - 2014-09-18 16:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 22:14 - 2014-09-18 16:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-15 22:14 - 2014-09-18 16:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-10-15 22:14 - 2014-09-18 15:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 22:14 - 2014-09-18 15:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-10-15 22:14 - 2014-09-18 15:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 22:14 - 2014-09-18 15:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDYAK.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDTAT.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU1.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDBASH.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-15 22:14 - 2014-07-08 14:38 - 00419992 _____ () C:\Windows\System32\locale.nls
2014-10-15 22:14 - 2014-07-08 14:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-15 22:14 - 2014-06-18 14:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\System32\mscories.dll
2014-10-15 22:13 - 2014-09-17 18:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-10-15 22:13 - 2014-09-17 17:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 22:13 - 2014-09-03 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\rastls.dll
2014-10-15 22:13 - 2014-09-03 21:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2014-10-15 22:13 - 2014-07-16 18:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-10-15 22:13 - 2014-07-16 18:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\winsta.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-10-15 22:13 - 2014-07-16 17:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 22:13 - 2014-07-16 17:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 22:13 - 2014-07-16 17:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2014-10-15 22:13 - 2014-07-16 17:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2014-10-15 22:12 - 2014-09-12 17:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll
2014-10-15 22:12 - 2014-09-12 17:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-13 07:49 - 2014-10-13 07:49 - 00000000 ____D () C:\Users\Samuel&Thomas\Desktop\Neuer Ordner
2014-09-30 21:02 - 2014-09-24 18:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2014-09-30 21:02 - 2014-09-24 17:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-24 05:04 - 2014-09-09 14:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2014-09-24 05:04 - 2014-09-09 13:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-23 07:11 - 2014-09-23 07:11 - 00000000 ____D () C:\Users\Matthias\DxReport
2014-09-23 07:11 - 2014-09-23 07:11 - 00000000 ____D () C:\Users\Matthias\AppData\Roaming\LaunchPad
2014-09-23 06:53 - 2014-09-23 06:53 - 00002097 _____ () C:\Users\Public\Desktop\RollerCoaster Tycoon 3.lnk
2014-09-23 06:52 - 2014-09-23 06:52 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\RCT3
2014-09-23 06:52 - 2002-02-27 07:50 - 00197120 _____ () C:\Windows\patchw32.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 01:33 - 2014-07-15 00:06 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-10-22 23:33 - 2013-05-23 03:18 - 00001332 __RSH () C:\Users\Kiadmin\ntuser.pol
2014-10-22 23:33 - 2012-08-08 09:04 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-22 23:33 - 2012-07-30 01:19 - 00000000 ____D () C:\users\Kiadmin
2014-10-22 23:33 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-22 22:57 - 2012-07-30 06:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-22 22:57 - 2009-07-13 20:45 - 00031888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-22 22:57 - 2009-07-13 20:45 - 00031888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-22 05:43 - 2011-02-23 04:59 - 30416852 _____ () C:\Windows\System32\perfh007.dat
2014-10-22 05:43 - 2011-02-23 04:59 - 09696350 _____ () C:\Windows\System32\perfc007.dat
2014-10-22 05:43 - 2009-07-13 21:13 - 00006118 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-10-22 05:41 - 2013-05-20 08:36 - 00000952 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006UA.job
2014-10-22 03:16 - 2012-08-08 09:04 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-22 03:13 - 2013-05-02 07:32 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-22 03:13 - 2012-08-23 03:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\CrashDumps
2014-10-22 03:13 - 2012-08-03 08:53 - 00000000 ____D () C:\Windows\Minidump
2014-10-21 08:41 - 2013-05-20 08:36 - 00000930 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006Core.job
2014-10-21 07:10 - 2012-07-31 00:11 - 00008627 _____ () C:\Windows\SysWOW64\PAV_FOG.OPC
2014-10-21 05:56 - 2014-04-25 22:06 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Deployment
2014-10-20 10:30 - 2012-08-02 03:37 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Outlook-Dateien
2014-10-18 23:26 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-10-17 23:28 - 2014-08-01 22:02 - 00000000 ____D () C:\Users\Oechslinsteiner\AppData\Local\CrashDumps
2014-10-16 09:43 - 2009-07-13 20:45 - 00343232 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-10-16 09:41 - 2014-05-06 05:58 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-10-16 09:32 - 2012-07-30 07:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 09:19 - 2013-07-15 00:12 - 00000000 ____D () C:\Windows\System32\MRT
2014-10-16 09:19 - 2012-07-30 01:26 - 103265616 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-10-14 00:23 - 2012-08-08 03:48 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Lohnabrechnungen
2014-10-13 08:47 - 2013-01-08 08:08 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D650C523-4389-4A53-88DB-0AED38A191CB}
2014-10-11 07:35 - 2014-01-03 09:57 - 00000680 __RSH () C:\Users\Oechslinsteiner\ntuser.pol
2014-10-11 07:35 - 2013-06-05 02:03 - 00000000 ____D () C:\users\Oechslinsteiner
2014-10-09 07:13 - 2013-12-19 11:29 - 00001344 __RSH () C:\Users\Samuel&Thomas\ntuser.pol
2014-10-09 07:13 - 2013-12-19 11:29 - 00000000 ____D () C:\users\Samuel&Thomas
2014-10-07 07:13 - 2012-11-09 02:29 - 00001334 __RSH () C:\Users\Matthias\ntuser.pol
2014-10-07 07:13 - 2012-11-09 02:29 - 00000000 ____D () C:\users\Matthias
2014-10-06 10:03 - 2012-11-07 05:42 - 00000680 __RSH () C:\Users\Martha Oechslin\ntuser.pol
2014-10-06 10:03 - 2012-07-30 06:27 - 00000000 ____D () C:\users\Martha Oechslin
2014-10-02 05:53 - 2010-11-20 19:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2014-09-25 06:18 - 2013-06-03 09:18 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-25 05:57 - 2012-07-30 06:59 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-25 05:57 - 2012-07-30 06:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-25 05:57 - 2012-07-30 06:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-24 08:36 - 2012-11-09 02:29 - 00000000 ____D () C:\Users\Matthias\AppData\Local\VirtualStore
2014-09-24 01:56 - 2012-07-15 23:29 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-24 01:43 - 2009-07-13 21:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-09-23 06:50 - 2012-08-08 23:37 - 00000000 ____D () C:\Program Files (x86)\Atari

Files to move or delete:
====================
C:\Users\kinder.PC-Martha\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\Martha Oechslin\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\Martha Oechslin\AppData\Roaming\skype.ini


Some content of TEMP:
====================
C:\Users\Kiadmin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kiadmin\AppData\Local\Temp\msvcp100.dll
C:\Users\Kiadmin\AppData\Local\Temp\msvcr100.dll
C:\Users\Kiadmin\AppData\Local\Temp\uninst1.exe
C:\Users\Kiadmin\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Kinder\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Kinder\AppData\Local\Temp\instloffer.exe
C:\Users\Kinder\AppData\Local\Temp\iupdate.exe
C:\Users\Kinder\AppData\Local\Temp\SIntf16.dll
C:\Users\Kinder\AppData\Local\Temp\SIntf32.dll
C:\Users\Kinder\AppData\Local\Temp\SIntfNT.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\83newxtc.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\ann.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\banner.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\cminpack.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\daisy3.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\eigen.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\fast.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\install_flashplayer13x32ax_chra_awa_aih.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\panosgm.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\Softonic_DE_1-5-1.exe
C:\Users\Martha Oechslin\AppData\Local\Temp\amt_mystartsearch.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession1.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession2.exe
C:\Users\Matthias\AppData\Local\Temp\SIntf16.dll
C:\Users\Matthias\AppData\Local\Temp\SIntf32.dll
C:\Users\Matthias\AppData\Local\Temp\SIntfNT.dll
C:\Users\Matthias\AppData\Local\Temp\_inst1.exe
C:\Users\Oechslins\AppData\Local\Temp\SIntf16.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntf32.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntfNT.dll
C:\Users\Oechslinsteiner\AppData\Local\Temp\OutlookConnector.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_1.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_2.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_3.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe
[2014-10-15 22:13] - [2014-07-16 18:07] - 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-10-02 00:11:09
Restore point made on: 2014-10-03 22:44:35
Restore point made on: 2014-10-07 07:18:19
Restore point made on: 2014-10-13 22:27:13
Restore point made on: 2014-10-16 09:19:07
Restore point made on: 2014-10-21 02:52:21

==================== Memory info =========================== 

Percentage of memory in use: 9%
Total physical RAM: 8070.04 MB
Available physical RAM: 7284.78 MB
Total Pagefile: 8068.23 MB
Available Pagefile: 7280.45 MB
Total Virtual: 8192 MB
Available Virtual: 8191.88 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:326.78 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (USB STICK) (Removable) (Total:3.72 GB) (Free:3.72 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: EA79D15E)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 3.7 GB) (Disk ID: 004E4A2A)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0B)


LastRegBack: 2014-10-15 22:52

==================== End Of Log ============================

Alt 23.10.2014, 09:34   #2
schrauber
/// the machine
/// TB-Ausbilder
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Hi,

erstmal Daten sichern über ein externes Medium oder so. Das wird spaßig
__________________

__________________
Alt 23.10.2014, 09:43   #3
lukas.schoen
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Ein Backup habe ich bereits erstellt.
__________________
Alt 24.10.2014, 07:37   #4
schrauber
/// the machine
/// TB-Ausbilder
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess?
HKU\kinder.PC-Martha\...\Run: [Facebook Update] => C:\Users\kinder.PC-Martha\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-05-20] (Facebook Inc.)
HKU\kinder.PC-Martha\...\Run: [Softonic for Windows] => C:\Users\kinder.PC-Martha\AppData\Local\Softonic\Softonic.exe [4170224 2014-04-29] (Softonic)
HKU\kinder.PC-Martha\...\RunOnce: [Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\kinder.PC-Martha\...\RunOnce: [Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\Martha Oechslin\...\RunOnce: [Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\Martha Oechslin\...\RunOnce: [Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\Martha Oechslin\...\Winlogon: [Shell] C:\WINDOWS\explorer.exe [2871808 2011-02-24] (Microsoft Corporation) <==== ATTENTION 
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1013\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1007\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1006\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1000\User: Group Policy restriction detected <======= ATTENTION
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ServiceMain
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 24.10.2014, 07:47   #5
lukas.schoen
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Hat leider nicht geholfen


Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-10-2014
Ran by SYSTEM at 2014-10-24 08:42:50 Run:1
Running from E:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess?
HKU\kinder.PC-Martha\...\Run: [Facebook Update] => C:\Users\kinder.PC-Martha\AppData\Local\Facebook\Update\FacebookUpdate.exe [138096 2013-05-20] (Facebook Inc.)
HKU\kinder.PC-Martha\...\Run: [Softonic for Windows] => C:\Users\kinder.PC-Martha\AppData\Local\Softonic\Softonic.exe [4170224 2014-04-29] (Softonic)
HKU\kinder.PC-Martha\...\RunOnce: [Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\kinder.PC-Martha\...\RunOnce: [Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\Martha Oechslin\...\RunOnce: [Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64"
HKU\Martha Oechslin\...\RunOnce: [Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910] => C:\Windows\system32\cmd.exe /q /c rmdir /s /q "C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910"
HKU\Martha Oechslin\...\Winlogon: [Shell] C:\WINDOWS\explorer.exe [2871808 2011-02-24] (Microsoft Corporation) <==== ATTENTION 
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1013\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1007\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1006\User: Group Policy restriction detected <======= ATTENTION
GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1000\User: Group Policy restriction detected <======= ATTENTION
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ServiceMain
         
*****************

HKLM\Software\Classes\CLSID\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InprocServer32\\Default => Value was restored successfully.
HKU\kinder.PC-Martha\Software\Microsoft\Windows\CurrentVersion\Run\\Facebook Update => value deleted successfully.
HKU\kinder.PC-Martha\Software\Microsoft\Windows\CurrentVersion\Run\\Softonic for Windows => value deleted successfully.
HKU\kinder.PC-Martha\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64 => value deleted successfully.
HKU\kinder.PC-Martha\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Uninstall C:\Users\kinder.PC-Martha\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910 => value deleted successfully.
HKU\Martha Oechslin\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910\amd64 => value deleted successfully.
HKU\Martha Oechslin\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Uninstall C:\Users\Martha Oechslin\AppData\Local\Microsoft\SkyDrive\16.4.6013.0910 => value deleted successfully.
HKU\Martha Oechslin\Software\Microsoft\Windows NT\CurrentVersion\Winlogon\\Shell => value deleted successfully.
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1013\User => Moved successfully.
C:\Windows\System32\GroupPolicy\GPT.ini => Moved successfully.
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1007\User => Moved successfully.
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1006\User => Moved successfully.
C:\Windows\System32\GroupPolicyUsers\S-1-5-21-1946937363-566282366-477552738-1000\User => Moved successfully.
70e6ca8c => Service deleted successfully.

==== End of Fixlog ====

Geändert von lukas.schoen (24.10.2014 um 07:52 Uhr)

Alt 24.10.2014, 17:30   #6
schrauber
/// the machine
/// TB-Ausbilder
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


frisches Scanlog bitte.
__________________
--> Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.

Alt 24.10.2014, 17:46   #7
lukas.schoen
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014
Ran by SYSTEM on MININT-DKB581T on 24-10-2014 18:44:47
Running from E:\
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-05-15] (Intel Corporation)
HKLM-x32\...\Run: [IntelSBA] => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [4243168 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Norton Ghost 15.0] => C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe [2598760 2010-03-03] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APVXDWIN] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\APVXDWIN.EXE [1062880 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [SCANINICIO] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\Inicio.exe [71648 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153992 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-31] (Apple Inc.)
Winlogon\Notify\avldr: C:\WINDOWS\SYSTEM32\avldr64.dll (On-Access Anti-Malware Scanner Sync)
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_winlogonx64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\SYSTEM32\igfxdev.dll (Intel Corporation)
HKU\Alle Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Alle Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\kinder.PC-Martha\...\Policies\system: [LogonHoursAction] 2
HKU\kinder.PC-Martha\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Martha Oechslin\...\Run: [Akamai NetSession Interface] => C:\Users\Martha Oechslin\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\Martha Oechslin\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1938112 2014-09-22] (Valve Corporation)
HKU\Martha Oechslin\...\Run: [CLXReader] => C:\Program Files (x86)\CLX.PayPen\CLXReader.exe [4108112 2012-04-24] (CREALOGIX E-Payment AG)
HKU\Martha Oechslin\...\Run: [InetStat] => C:\Users\Martha Oechslin\AppData\Roaming\InetStat\inetstat.exe [702478 2014-10-21] ()
HKU\Matthias\...\Run: [ConnectionCenter] => C:\Users\Matthias\AppData\Local\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKU\Matthias\...\Policies\system: [LogonHoursAction] 2
HKU\Matthias\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Neue Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Neue Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Oechslins\...\Policies\system: [LogonHoursAction] 2
HKU\Oechslins\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Oechslinsteiner\...\Policies\system: [LogonHoursAction] 2
HKU\Oechslinsteiner\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Samuel&Thomas\...\Policies\system: [LogonHoursAction] 2
HKU\Samuel&Thomas\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\kinder.PC-Martha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk
ShortcutTarget: Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 GenericMount Helper Service; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-11] (Symantec)
S3 GoToAssist Remote Support Customer; C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_service.exe [611400 2013-07-15] (Citrix Online, a division of Citrix Systems, Inc.)
S2 Intel(R) Small Business Advantage; C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [49376 2012-02-27] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-15] (Intel Corporation)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE [2999664 2007-09-26] (Symantec Corporation)
S2 Norton Ghost; C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe [4590432 2010-03-03] (Symantec Corporation)
S2 Panda Software Controller; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsCtrls.exe [177440 2012-11-19] (Panda Security, S.L.)
S2 PAVFNSVR; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PavFnSvr.exe [202016 2012-09-20] (Panda Security, S.L.)
S2 PavPrSrv; C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe [62768 2008-02-04] (Panda Security, S.L.)
S2 PAVSRV; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\pavsrvx86.exe [313664 2011-04-13] (Panda Security, S.L.)
S2 PSIMSVC; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsImSvc.exe [108288 2008-06-19] (Panda Security S.L.)
S2 PskSvcRetail; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PskSvc.exe [28992 2010-08-16] (Panda Security, S.L.)
S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)
S3 Symantec SymSnap VSS Provider; C:\Windows\SysWOW64\dllhost.exe [7168 2009-07-13] (Microsoft Corporation)
S3 SymSnapService; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2963960 2010-02-10] (Symantec)
S2 TPSrv; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\TPSrvWow.exe [173816 2014-02-25] (Panda Security, S.L.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AmFSM; C:\Windows\System32\DRIVERS\amm6460.sys [71432 2012-03-26] (Panda Security, S.L.)
S3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-11] (Symantec Corporation)
S2 inpoutx64; C:\Windows\System32\Drivers\inpoutx64.sys [15008 2012-07-17] (Highresolution Enterprises [www.highrez.co.uk])
S0 pavboot; C:\Windows\System32\Drivers\pavboot64.sys [30792 2010-06-22] (Panda Security, S.L.)
S3 PayPen; C:\Windows\System32\Drivers\PayPen.sys [20864 2012-04-24] ()
S1 ShldFlt; C:\Windows\System32\DRIVERS\ShldFlt.sys [48136 2009-10-27] (Panda Security, S.L.)
S0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170032 2010-02-10] (StorageCraft)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
S3 cpuz134; \??\C:\Users\MARTHA~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
S3 cpuz135; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
S3 PavTPK.sys; \??\C:\Windows\system32\PavTPK.sys [X]
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]
S2 V2iMount; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 10:13 - 2014-10-24 18:44 - 00000000 ____D () C:\FRST
2014-10-23 01:14 - 2014-10-23 01:14 - 00000050 _____ () C:\.directory
2014-10-22 22:52 - 2014-10-24 07:24 - 00065732 _____ () C:\Windows\WindowsUpdate.log
2014-10-22 22:49 - 2014-10-24 02:25 - 00001357 _____ () C:\Windows\setupact.log
2014-10-22 22:49 - 2014-10-22 22:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-22 22:48 - 2014-10-22 22:48 - 00173252 _____ () C:\Users\Martha Oechslin\Desktop\cc_20141023_084823.reg
2014-10-21 06:09 - 2014-10-21 10:51 - 00000000 ____D () C:\Program Files (x86)\SmartOnes
2014-10-21 06:09 - 2014-10-21 06:09 - 00001266 _____ () C:\Users\Martha Oechslin\Desktop\Continue installation .lnk
2014-10-21 06:09 - 2014-10-21 06:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Roaming\InetStat
2014-10-21 06:06 - 2014-10-21 06:06 - 01080416 _____ (Unity Technologies ApS) C:\Users\Matthias\Downloads\UnityWebPlayer.exe
2014-10-21 05:56 - 2014-10-21 05:56 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Unity
2014-10-21 05:39 - 2014-10-21 05:39 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (5).ica
2014-10-20 09:53 - 2014-10-20 09:53 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (4).ica
2014-10-15 22:14 - 2014-10-09 18:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-15 22:14 - 2014-10-09 18:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-15 22:14 - 2014-10-09 18:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-15 22:14 - 2014-10-06 18:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-10-15 22:14 - 2014-10-06 18:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 22:14 - 2014-09-28 16:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-10-15 22:14 - 2014-09-25 14:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 22:14 - 2014-09-25 14:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 22:14 - 2014-09-25 14:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 22:14 - 2014-09-25 14:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-10-15 22:14 - 2014-09-18 18:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-10-15 22:14 - 2014-09-18 17:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-10-15 22:14 - 2014-09-18 17:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-10-15 22:14 - 2014-09-18 17:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 22:14 - 2014-09-18 17:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-10-15 22:14 - 2014-09-18 17:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-10-15 22:14 - 2014-09-18 17:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-10-15 22:14 - 2014-09-18 17:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-10-15 22:14 - 2014-09-18 17:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-10-15 22:14 - 2014-09-18 17:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-10-15 22:14 - 2014-09-18 17:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-10-15 22:14 - 2014-09-18 17:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-10-15 22:14 - 2014-09-18 17:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-10-15 22:14 - 2014-09-18 17:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-10-15 22:14 - 2014-09-18 17:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 22:14 - 2014-09-18 17:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-10-15 22:14 - 2014-09-18 17:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-10-15 22:14 - 2014-09-18 17:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-10-15 22:14 - 2014-09-18 17:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-15 22:14 - 2014-09-18 17:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-10-15 22:14 - 2014-09-18 17:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-10-15 22:14 - 2014-09-18 17:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-15 22:14 - 2014-09-18 17:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-10-15 22:14 - 2014-09-18 16:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 22:14 - 2014-09-18 16:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-10-15 22:14 - 2014-09-18 16:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 22:14 - 2014-09-18 16:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-15 22:14 - 2014-09-18 16:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-15 22:14 - 2014-09-18 16:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-15 22:14 - 2014-09-18 16:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-15 22:14 - 2014-09-18 16:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-15 22:14 - 2014-09-18 16:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-10-15 22:14 - 2014-09-18 16:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-10-15 22:14 - 2014-09-18 16:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-10-15 22:14 - 2014-09-18 16:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 22:14 - 2014-09-18 16:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-10-15 22:14 - 2014-09-18 16:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-15 22:14 - 2014-09-18 16:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 22:14 - 2014-09-18 16:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-15 22:14 - 2014-09-18 16:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-10-15 22:14 - 2014-09-18 15:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 22:14 - 2014-09-18 15:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-10-15 22:14 - 2014-09-18 15:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 22:14 - 2014-09-18 15:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDYAK.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDTAT.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU1.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDBASH.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-15 22:14 - 2014-07-08 14:38 - 00419992 _____ () C:\Windows\System32\locale.nls
2014-10-15 22:14 - 2014-07-08 14:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-15 22:14 - 2014-06-18 14:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\System32\mscories.dll
2014-10-15 22:13 - 2014-09-17 18:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-10-15 22:13 - 2014-09-17 17:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 22:13 - 2014-09-03 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\rastls.dll
2014-10-15 22:13 - 2014-09-03 21:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2014-10-15 22:13 - 2014-07-16 18:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-10-15 22:13 - 2014-07-16 18:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\winsta.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-10-15 22:13 - 2014-07-16 17:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 22:13 - 2014-07-16 17:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 22:13 - 2014-07-16 17:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2014-10-15 22:13 - 2014-07-16 17:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2014-10-15 22:12 - 2014-09-12 17:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll
2014-10-15 22:12 - 2014-09-12 17:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-13 07:49 - 2014-10-13 07:49 - 00000000 ____D () C:\Users\Samuel&Thomas\Desktop\Neuer Ordner
2014-09-30 21:02 - 2014-09-24 18:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2014-09-30 21:02 - 2014-09-24 17:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-24 05:04 - 2014-09-09 14:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\System32\tzres.dll
2014-09-24 05:04 - 2014-09-09 13:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-24 08:42 - 2009-07-13 19:20 - 00000000 ___HD () C:\Windows\System32\GroupPolicy
2014-10-24 07:16 - 2012-08-08 09:04 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-24 06:57 - 2012-07-30 06:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-24 05:41 - 2013-05-20 08:36 - 00000952 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006UA.job
2014-10-24 02:32 - 2009-07-13 20:45 - 00031888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-24 02:32 - 2009-07-13 20:45 - 00031888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-24 02:25 - 2012-08-08 09:04 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-24 02:25 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-24 01:48 - 2011-02-23 04:59 - 30433476 _____ () C:\Windows\System32\perfh007.dat
2014-10-24 01:48 - 2011-02-23 04:59 - 09701710 _____ () C:\Windows\System32\perfc007.dat
2014-10-24 01:48 - 2009-07-13 21:13 - 00006118 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-10-23 22:44 - 2013-05-23 03:18 - 00000332 __RSH () C:\Users\Kiadmin\ntuser.pol
2014-10-23 22:44 - 2012-11-07 05:42 - 00000008 __RSH () C:\Users\Martha Oechslin\ntuser.pol
2014-10-23 22:44 - 2012-07-30 06:27 - 00000000 ____D () C:\users\Martha Oechslin
2014-10-23 22:44 - 2012-07-30 01:19 - 00000000 ____D () C:\users\Kiadmin
2014-10-23 01:33 - 2014-07-15 00:06 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-10-22 03:13 - 2013-05-02 07:32 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-22 03:13 - 2012-08-23 03:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\CrashDumps
2014-10-22 03:13 - 2012-08-03 08:53 - 00000000 ____D () C:\Windows\Minidump
2014-10-21 08:41 - 2013-05-20 08:36 - 00000930 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006Core.job
2014-10-21 07:10 - 2012-07-31 00:11 - 00008627 _____ () C:\Windows\SysWOW64\PAV_FOG.OPC
2014-10-21 05:56 - 2014-04-25 22:06 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Deployment
2014-10-20 10:30 - 2012-08-02 03:37 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Outlook-Dateien
2014-10-18 23:26 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-10-17 23:28 - 2014-08-01 22:02 - 00000000 ____D () C:\Users\Oechslinsteiner\AppData\Local\CrashDumps
2014-10-16 09:43 - 2009-07-13 20:45 - 00343232 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-10-16 09:41 - 2014-05-06 05:58 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-10-16 09:32 - 2012-07-30 07:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 09:19 - 2013-07-15 00:12 - 00000000 ____D () C:\Windows\System32\MRT
2014-10-16 09:19 - 2012-07-30 01:26 - 103265616 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-10-14 00:23 - 2012-08-08 03:48 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Lohnabrechnungen
2014-10-13 08:47 - 2013-01-08 08:08 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D650C523-4389-4A53-88DB-0AED38A191CB}
2014-10-11 07:35 - 2014-01-03 09:57 - 00000680 __RSH () C:\Users\Oechslinsteiner\ntuser.pol
2014-10-11 07:35 - 2013-06-05 02:03 - 00000000 ____D () C:\users\Oechslinsteiner
2014-10-09 07:13 - 2013-12-19 11:29 - 00001344 __RSH () C:\Users\Samuel&Thomas\ntuser.pol
2014-10-09 07:13 - 2013-12-19 11:29 - 00000000 ____D () C:\users\Samuel&Thomas
2014-10-07 07:13 - 2012-11-09 02:29 - 00001334 __RSH () C:\Users\Matthias\ntuser.pol
2014-10-07 07:13 - 2012-11-09 02:29 - 00000000 ____D () C:\users\Matthias
2014-10-02 05:53 - 2010-11-20 19:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe
2014-09-25 06:18 - 2013-06-03 09:18 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-09-25 05:57 - 2012-07-30 06:59 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-25 05:57 - 2012-07-30 06:59 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-25 05:57 - 2012-07-30 06:59 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-24 08:36 - 2012-11-09 02:29 - 00000000 ____D () C:\Users\Matthias\AppData\Local\VirtualStore
2014-09-24 01:56 - 2012-07-15 23:29 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-24 01:43 - 2009-07-13 21:08 - 00032640 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

Files to move or delete:
====================
C:\Users\kinder.PC-Martha\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\Martha Oechslin\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\Martha Oechslin\AppData\Roaming\skype.ini


Some content of TEMP:
====================
C:\Users\Kiadmin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kiadmin\AppData\Local\Temp\msvcp100.dll
C:\Users\Kiadmin\AppData\Local\Temp\msvcr100.dll
C:\Users\Kiadmin\AppData\Local\Temp\uninst1.exe
C:\Users\Kiadmin\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Kinder\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Kinder\AppData\Local\Temp\instloffer.exe
C:\Users\Kinder\AppData\Local\Temp\iupdate.exe
C:\Users\Kinder\AppData\Local\Temp\SIntf16.dll
C:\Users\Kinder\AppData\Local\Temp\SIntf32.dll
C:\Users\Kinder\AppData\Local\Temp\SIntfNT.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\83newxtc.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\ann.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\banner.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\cminpack.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\daisy3.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\eigen.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\fast.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\install_flashplayer13x32ax_chra_awa_aih.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\panosgm.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\Softonic_DE_1-5-1.exe
C:\Users\Martha Oechslin\AppData\Local\Temp\amt_mystartsearch.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession1.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession2.exe
C:\Users\Matthias\AppData\Local\Temp\SIntf16.dll
C:\Users\Matthias\AppData\Local\Temp\SIntf32.dll
C:\Users\Matthias\AppData\Local\Temp\SIntfNT.dll
C:\Users\Matthias\AppData\Local\Temp\_inst1.exe
C:\Users\Oechslins\AppData\Local\Temp\SIntf16.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntf32.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntfNT.dll
C:\Users\Oechslinsteiner\AppData\Local\Temp\OutlookConnector.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_1.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_2.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_3.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe
[2014-10-15 22:13] - [2014-07-16 18:07] - 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-10-02 00:11:09
Restore point made on: 2014-10-03 22:44:35
Restore point made on: 2014-10-07 07:18:19
Restore point made on: 2014-10-13 22:27:13
Restore point made on: 2014-10-16 09:19:07
Restore point made on: 2014-10-21 02:52:21

==================== Memory info =========================== 

Percentage of memory in use: 9%
Total physical RAM: 8070.04 MB
Available physical RAM: 7298.13 MB
Total Pagefile: 8068.23 MB
Available Pagefile: 7289.96 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:326.76 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (USB STICK) (Removable) (Total:3.72 GB) (Free:3.72 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: EA79D15E)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 3.7 GB) (Disk ID: 004E4A2A)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0B)


LastRegBack: 2014-10-15 22:52

==================== End Of Log ============================
--- --- ---
Alt 25.10.2014, 14:19   #8
schrauber
/// the machine
/// TB-Ausbilder
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
C:\Users\Martha Oechslin\AppData\Roaming\skype.ini
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.


Bis wohin genau bootet der Rechner wenn Du versuchst normal zu starten?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 27.10.2014, 08:48   #9
lukas.schoen
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Der Computer startet ganz normal, nur kann ich keine Programme und Ordner öffnen.
Das einzige was ich machen kann ist, herunterfahren oder Neustarten.

Code:
ATTFilter
Fix result of Farbar Recovery Tool (FRST written by Farbar) (x64) Version: 22-10-2014
Ran by SYSTEM at 2014-10-27 09:40:15 Run:2
Running from e:\
Boot Mode: Recovery
==============================================

Content of fixlist:
*****************
C:\Users\Martha Oechslin\AppData\Roaming\skype.ini
         
*****************

C:\Users\Martha Oechslin\AppData\Roaming\skype.ini => Moved successfully.

==== End of Fixlog ====



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 22-10-2014
Ran by SYSTEM on MININT-HI5P2G1 on 27-10-2014 09:40:31
Running from e:\
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: English (United States)
Internet Explorer Version 11
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.

Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-05-15] (Intel Corporation)
HKLM-x32\...\Run: [IntelSBA] => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [4243168 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Norton Ghost 15.0] => C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe [2598760 2010-03-03] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [254336 2013-07-02] (Oracle Corporation)
HKLM-x32\...\Run: [APVXDWIN] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\APVXDWIN.EXE [1062880 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [SCANINICIO] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\Inicio.exe [71648 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153992 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-08-31] (Apple Inc.)
Winlogon\Notify\avldr: C:\WINDOWS\SYSTEM32\avldr64.dll (On-Access Anti-Malware Scanner Sync)
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_winlogonx64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\SYSTEM32\igfxdev.dll (Intel Corporation)
HKU\Alle Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Alle Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\kinder.PC-Martha\...\Policies\system: [LogonHoursAction] 2
HKU\kinder.PC-Martha\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Martha Oechslin\...\Run: [Akamai NetSession Interface] => C:\Users\Martha Oechslin\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\Martha Oechslin\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1938112 2014-09-22] (Valve Corporation)
HKU\Martha Oechslin\...\Run: [CLXReader] => C:\Program Files (x86)\CLX.PayPen\CLXReader.exe [4108112 2012-04-24] (CREALOGIX E-Payment AG)
HKU\Martha Oechslin\...\Run: [InetStat] => C:\Users\Martha Oechslin\AppData\Roaming\InetStat\inetstat.exe [702478 2014-10-21] ()
HKU\Matthias\...\Run: [ConnectionCenter] => C:\Users\Matthias\AppData\Local\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKU\Matthias\...\Policies\system: [LogonHoursAction] 2
HKU\Matthias\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Neue Kinder\...\Policies\system: [LogonHoursAction] 2
HKU\Neue Kinder\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Oechslins\...\Policies\system: [LogonHoursAction] 2
HKU\Oechslins\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Oechslinsteiner\...\Policies\system: [LogonHoursAction] 2
HKU\Oechslinsteiner\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
HKU\Samuel&Thomas\...\Policies\system: [LogonHoursAction] 2
HKU\Samuel&Thomas\...\Policies\system: [DontDisplayLogonHoursWarnings] 1
Startup: C:\Users\kinder.PC-Martha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk
ShortcutTarget: Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 GenericMount Helper Service; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-11] (Symantec)
S3 GoToAssist Remote Support Customer; C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_service.exe [611400 2013-07-15] (Citrix Online, a division of Citrix Systems, Inc.)
S2 Intel(R) Small Business Advantage; C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [49376 2012-02-27] (Intel Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-15] (Intel Corporation)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE [2999664 2007-09-26] (Symantec Corporation)
S2 Norton Ghost; C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe [4590432 2010-03-03] (Symantec Corporation)
S2 Panda Software Controller; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsCtrls.exe [177440 2012-11-19] (Panda Security, S.L.)
S2 PAVFNSVR; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PavFnSvr.exe [202016 2012-09-20] (Panda Security, S.L.)
S2 PavPrSrv; C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe [62768 2008-02-04] (Panda Security, S.L.)
S2 PAVSRV; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\pavsrvx86.exe [313664 2011-04-13] (Panda Security, S.L.)
S2 PSIMSVC; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsImSvc.exe [108288 2008-06-19] (Panda Security S.L.)
S2 PskSvcRetail; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PskSvc.exe [28992 2010-08-16] (Panda Security, S.L.)
S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-13] (Microsoft Corporation)
S3 Symantec SymSnap VSS Provider; C:\Windows\SysWOW64\dllhost.exe [7168 2009-07-13] (Microsoft Corporation)
S3 SymSnapService; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2963960 2010-02-10] (Symantec)
S2 TPSrv; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\TPSrvWow.exe [173816 2014-02-25] (Panda Security, S.L.)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AmFSM; C:\Windows\System32\DRIVERS\amm6460.sys [71432 2012-03-26] (Panda Security, S.L.)
S3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-11] (Symantec Corporation)
S2 inpoutx64; C:\Windows\System32\Drivers\inpoutx64.sys [15008 2012-07-17] (Highresolution Enterprises [www.highrez.co.uk])
S0 pavboot; C:\Windows\System32\Drivers\pavboot64.sys [30792 2010-06-22] (Panda Security, S.L.)
S3 PayPen; C:\Windows\System32\Drivers\PayPen.sys [20864 2012-04-24] ()
S1 ShldFlt; C:\Windows\System32\DRIVERS\ShldFlt.sys [48136 2009-10-27] (Panda Security, S.L.)
S0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170032 2010-02-10] (StorageCraft)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
S3 cpuz134; \??\C:\Users\MARTHA~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
S3 cpuz135; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
S3 PavTPK.sys; \??\C:\Windows\system32\PavTPK.sys [X]
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]
S2 V2iMount; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-23 10:13 - 2014-10-27 09:40 - 00000000 ____D () C:\FRST
2014-10-23 01:14 - 2014-10-23 01:14 - 00000050 _____ () C:\.directory
2014-10-22 22:52 - 2014-10-24 07:24 - 00065732 _____ () C:\Windows\WindowsUpdate.log
2014-10-22 22:49 - 2014-10-24 02:25 - 00001357 _____ () C:\Windows\setupact.log
2014-10-22 22:49 - 2014-10-22 22:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-22 22:48 - 2014-10-22 22:48 - 00173252 _____ () C:\Users\Martha Oechslin\Desktop\cc_20141023_084823.reg
2014-10-21 06:09 - 2014-10-21 10:51 - 00000000 ____D () C:\Program Files (x86)\SmartOnes
2014-10-21 06:09 - 2014-10-21 06:09 - 00001266 _____ () C:\Users\Martha Oechslin\Desktop\Continue installation .lnk
2014-10-21 06:09 - 2014-10-21 06:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Roaming\InetStat
2014-10-21 06:06 - 2014-10-21 06:06 - 01080416 _____ (Unity Technologies ApS) C:\Users\Matthias\Downloads\UnityWebPlayer.exe
2014-10-21 05:56 - 2014-10-21 05:56 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Unity
2014-10-21 05:39 - 2014-10-21 05:39 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (5).ica
2014-10-20 09:53 - 2014-10-20 09:53 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (4).ica
2014-10-15 22:14 - 2014-10-09 18:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\System32\aepdu.dll
2014-10-15 22:14 - 2014-10-09 18:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\System32\generaltel.dll
2014-10-15 22:14 - 2014-10-09 18:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\aeinv.dll
2014-10-15 22:14 - 2014-10-06 18:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\System32\iedkcs32.dll
2014-10-15 22:14 - 2014-10-06 18:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-15 22:14 - 2014-09-28 16:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2014-10-15 22:14 - 2014-09-25 14:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-15 22:14 - 2014-09-25 14:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-15 22:14 - 2014-09-25 14:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-15 22:14 - 2014-09-25 14:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-15 22:14 - 2014-09-25 14:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\System32\inetcpl.cpl
2014-10-15 22:14 - 2014-09-18 18:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2014-10-15 22:14 - 2014-09-18 17:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2014-10-15 22:14 - 2014-09-18 17:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollectorres.dll
2014-10-15 22:14 - 2014-09-18 17:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-15 22:14 - 2014-09-18 17:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2014-10-15 22:14 - 2014-09-18 17:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\System32\vbscript.dll
2014-10-15 22:14 - 2014-09-18 17:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2014-10-15 22:14 - 2014-09-18 17:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\System32\ieetwproxystub.dll
2014-10-15 22:14 - 2014-09-18 17:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\System32\MshtmlDac.dll
2014-10-15 22:14 - 2014-09-18 17:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2014-10-15 22:14 - 2014-09-18 17:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2014-10-15 22:14 - 2014-09-18 17:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2014-10-15 22:14 - 2014-09-18 17:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2014-10-15 22:14 - 2014-09-18 17:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\System32\ieUnatt.exe
2014-10-15 22:14 - 2014-09-18 17:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-15 22:14 - 2014-09-18 17:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\System32\jscript9diag.dll
2014-10-15 22:14 - 2014-09-18 17:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\System32\ieetwcollector.exe
2014-10-15 22:14 - 2014-09-18 17:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\System32\MsSpellCheckingFacility.exe
2014-10-15 22:14 - 2014-09-18 17:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-15 22:14 - 2014-09-18 17:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\System32\dxtmsft.dll
2014-10-15 22:14 - 2014-09-18 17:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\System32\JavaScriptCollectionAgent.dll
2014-10-15 22:14 - 2014-09-18 17:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\System32\msrating.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-15 22:14 - 2014-09-18 17:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-15 22:14 - 2014-09-18 17:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\System32\mshtmled.dll
2014-10-15 22:14 - 2014-09-18 16:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-15 22:14 - 2014-09-18 16:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\System32\dxtrans.dll
2014-10-15 22:14 - 2014-09-18 16:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-15 22:14 - 2014-09-18 16:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-15 22:14 - 2014-09-18 16:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-15 22:14 - 2014-09-18 16:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-15 22:14 - 2014-09-18 16:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-15 22:14 - 2014-09-18 16:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-15 22:14 - 2014-09-18 16:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2014-10-15 22:14 - 2014-09-18 16:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2014-10-15 22:14 - 2014-09-18 16:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\System32\mshtmlmedia.dll
2014-10-15 22:14 - 2014-09-18 16:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-15 22:14 - 2014-09-18 16:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2014-10-15 22:14 - 2014-09-18 16:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-15 22:14 - 2014-09-18 16:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-15 22:14 - 2014-09-18 16:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-15 22:14 - 2014-09-18 16:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2014-10-15 22:14 - 2014-09-18 15:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-15 22:14 - 2014-09-18 15:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\System32\ieapfltr.dll
2014-10-15 22:14 - 2014-09-18 15:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-15 22:14 - 2014-09-18 15:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDYAK.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDTAT.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU1.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\System32\KBDBASH.DLL
2014-10-15 22:14 - 2014-07-08 18:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\System32\KBDRU.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-15 22:14 - 2014-07-08 17:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-15 22:14 - 2014-07-08 14:38 - 00419992 _____ () C:\Windows\System32\locale.nls
2014-10-15 22:14 - 2014-07-08 14:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-15 22:14 - 2014-06-18 14:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\System32\dfshim.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\System32\mscorier.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-15 22:14 - 2014-06-18 14:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\System32\mscories.dll
2014-10-15 22:13 - 2014-09-17 18:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\System32\msi.dll
2014-10-15 22:13 - 2014-09-17 17:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-15 22:13 - 2014-09-03 21:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\System32\rastls.dll
2014-10-15 22:13 - 2014-09-03 21:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 03722240 _____ (Microsoft Corporation) C:\Windows\System32\mstscax.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 01118720 _____ (Microsoft Corporation) C:\Windows\System32\mstsc.exe
2014-10-15 22:13 - 2014-07-16 18:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\System32\termsrv.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\System32\winlogon.exe
2014-10-15 22:13 - 2014-07-16 18:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\System32\winsta.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\System32\rdpcorekmts.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\System32\TSpkg.dll
2014-10-15 22:13 - 2014-07-16 18:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\System32\credssp.dll
2014-10-15 22:13 - 2014-07-16 17:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 01051136 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-15 22:13 - 2014-07-16 17:39 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-15 22:13 - 2014-07-16 17:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-15 22:13 - 2014-07-16 17:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\rdpwd.sys
2014-10-15 22:13 - 2014-07-16 17:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\tssecsrv.sys
2014-10-15 22:12 - 2014-09-12 17:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\System32\packager.dll
2014-10-15 22:12 - 2014-09-12 17:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-13 07:49 - 2014-10-13 07:49 - 00000000 ____D () C:\Users\Samuel&Thomas\Desktop\Neuer Ordner
2014-09-30 21:02 - 2014-09-24 18:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\System32\qdvd.dll
2014-09-30 21:02 - 2014-09-24 17:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-24 08:42 - 2009-07-13 19:20 - 00000000 ___HD () C:\Windows\System32\GroupPolicy
2014-10-24 07:16 - 2012-08-08 09:04 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-10-24 06:57 - 2012-07-30 06:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-24 05:41 - 2013-05-20 08:36 - 00000952 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006UA.job
2014-10-24 02:32 - 2009-07-13 20:45 - 00031888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-24 02:32 - 2009-07-13 20:45 - 00031888 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-24 02:25 - 2012-08-08 09:04 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-10-24 02:25 - 2009-07-13 21:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-24 01:48 - 2011-02-23 04:59 - 30433476 _____ () C:\Windows\System32\perfh007.dat
2014-10-24 01:48 - 2011-02-23 04:59 - 09701710 _____ () C:\Windows\System32\perfc007.dat
2014-10-24 01:48 - 2009-07-13 21:13 - 00006118 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-10-23 22:44 - 2013-05-23 03:18 - 00000332 __RSH () C:\Users\Kiadmin\ntuser.pol
2014-10-23 22:44 - 2012-11-07 05:42 - 00000008 __RSH () C:\Users\Martha Oechslin\ntuser.pol
2014-10-23 22:44 - 2012-07-30 06:27 - 00000000 ____D () C:\users\Martha Oechslin
2014-10-23 22:44 - 2012-07-30 01:19 - 00000000 ____D () C:\users\Kiadmin
2014-10-23 01:33 - 2014-07-15 00:06 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-10-22 03:13 - 2013-05-02 07:32 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-10-22 03:13 - 2012-08-23 03:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\CrashDumps
2014-10-22 03:13 - 2012-08-03 08:53 - 00000000 ____D () C:\Windows\Minidump
2014-10-21 08:41 - 2013-05-20 08:36 - 00000930 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006Core.job
2014-10-21 07:10 - 2012-07-31 00:11 - 00008627 _____ () C:\Windows\SysWOW64\PAV_FOG.OPC
2014-10-21 05:56 - 2014-04-25 22:06 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Deployment
2014-10-20 10:30 - 2012-08-02 03:37 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Outlook-Dateien
2014-10-18 23:26 - 2009-07-13 19:20 - 00000000 ____D () C:\Windows\rescache
2014-10-17 23:28 - 2014-08-01 22:02 - 00000000 ____D () C:\Users\Oechslinsteiner\AppData\Local\CrashDumps
2014-10-16 09:43 - 2009-07-13 20:45 - 00343232 _____ () C:\Windows\System32\FNTCACHE.DAT
2014-10-16 09:41 - 2014-05-06 05:58 - 00000000 ___SD () C:\Windows\System32\CompatTel
2014-10-16 09:32 - 2012-07-30 07:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-16 09:19 - 2013-07-15 00:12 - 00000000 ____D () C:\Windows\System32\MRT
2014-10-16 09:19 - 2012-07-30 01:26 - 103265616 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2014-10-14 00:23 - 2012-08-08 03:48 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Lohnabrechnungen
2014-10-13 08:47 - 2013-01-08 08:08 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D650C523-4389-4A53-88DB-0AED38A191CB}
2014-10-11 07:35 - 2014-01-03 09:57 - 00000680 __RSH () C:\Users\Oechslinsteiner\ntuser.pol
2014-10-11 07:35 - 2013-06-05 02:03 - 00000000 ____D () C:\users\Oechslinsteiner
2014-10-09 07:13 - 2013-12-19 11:29 - 00001344 __RSH () C:\Users\Samuel&Thomas\ntuser.pol
2014-10-09 07:13 - 2013-12-19 11:29 - 00000000 ____D () C:\users\Samuel&Thomas
2014-10-07 07:13 - 2012-11-09 02:29 - 00001334 __RSH () C:\Users\Matthias\ntuser.pol
2014-10-07 07:13 - 2012-11-09 02:29 - 00000000 ____D () C:\users\Matthias
2014-10-02 05:53 - 2010-11-20 19:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\System32\MpSigStub.exe

Files to move or delete:
====================
C:\Users\kinder.PC-Martha\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\Martha Oechslin\g2ax_customer_downloadhelper_win32_x86.exe


Some content of TEMP:
====================
C:\Users\Kiadmin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kiadmin\AppData\Local\Temp\msvcp100.dll
C:\Users\Kiadmin\AppData\Local\Temp\msvcr100.dll
C:\Users\Kiadmin\AppData\Local\Temp\uninst1.exe
C:\Users\Kiadmin\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Kinder\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Kinder\AppData\Local\Temp\instloffer.exe
C:\Users\Kinder\AppData\Local\Temp\iupdate.exe
C:\Users\Kinder\AppData\Local\Temp\SIntf16.dll
C:\Users\Kinder\AppData\Local\Temp\SIntf32.dll
C:\Users\Kinder\AppData\Local\Temp\SIntfNT.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\83newxtc.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\ann.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\banner.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\cminpack.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\daisy3.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\eigen.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\fast.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\install_flashplayer13x32ax_chra_awa_aih.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\panosgm.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\Softonic_DE_1-5-1.exe
C:\Users\Martha Oechslin\AppData\Local\Temp\amt_mystartsearch.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession1.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession2.exe
C:\Users\Matthias\AppData\Local\Temp\SIntf16.dll
C:\Users\Matthias\AppData\Local\Temp\SIntf32.dll
C:\Users\Matthias\AppData\Local\Temp\SIntfNT.dll
C:\Users\Matthias\AppData\Local\Temp\_inst1.exe
C:\Users\Oechslins\AppData\Local\Temp\SIntf16.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntf32.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntfNT.dll
C:\Users\Oechslinsteiner\AppData\Local\Temp\OutlookConnector.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_1.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_2.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_3.exe


==================== Known DLLs (Whitelisted) ================


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe
[2014-10-15 22:13] - [2014-07-16 18:07] - 0455168 ____A (Microsoft Corporation) 8CEBD9D0A0A879CDE9F36F4383B7CAEA

C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-10-02 00:11:09
Restore point made on: 2014-10-03 22:44:35
Restore point made on: 2014-10-07 07:18:19
Restore point made on: 2014-10-13 22:27:13
Restore point made on: 2014-10-16 09:19:07
Restore point made on: 2014-10-21 02:52:21

==================== Memory info =========================== 

Percentage of memory in use: 9%
Total physical RAM: 8070.04 MB
Available physical RAM: 7298.7 MB
Total Pagefile: 8068.23 MB
Available Pagefile: 7291.29 MB
Total Virtual: 8192 MB
Available Virtual: 8191.89 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:326.76 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive e: (USB STICK) (Removable) (Total:3.72 GB) (Free:3.72 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: EA79D15E)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 3.7 GB) (Disk ID: 004E4A2A)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0B)


LastRegBack: 2014-10-15 22:52

==================== End Of Log ============================
--- --- ---
Alt 27.10.2014, 19:21   #10
schrauber
/// the machine
/// TB-Ausbilder
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Zitat:
nur kann ich keine Programme und Ordner öffnen.
Mehr Info bitte. Was passiert wenn du es versuchst? Fehlermeldung? Kannste Taskmanager mit Strg+Alt+Entf starten?
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 28.10.2014, 19:21   #11
lukas.schoen
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Wenn ich den Taskmanager versuche zu starten kommt die Meldung:

C:\Windows\system32\taskmgr.exe
Schnittstelle nicht unterstützt

Das selbe Problem tritt auch bei regedit und cmd auf.

Wenn ich den Arbeitsplatz, Explorer oder einen Ordner versuche zu öffnen kommt folgende Meldung:

"Der Datei ist kein Programm zum Ausführen dieser Aktion zugeordnet. Installieren Sie ein entsprechendes Programm, oder erstellen Sie in der Systemsteuerung unter "Standardprogramme" eine Zuordnung, wenn bereits ein Programm installiert ist."


Ich kann im Windows nichts machen wenn es gestartet ist.
Die Systemwiederherstellung auf einen früheren zustand funktioniert ebenfalls nicht.

Alt 29.10.2014, 18:27   #12
schrauber
/// the machine
/// TB-Ausbilder
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Drücke bitte die + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
LastRegBack: 2014-10-15 22:52
Speichere diese bitte als Fixlist.txt auf deinem USB Stick.
  • Starte deinen Rechner erneut in die Reparaturoptionen
  • Starte nun die FRST.exe erneut und klicke den Entfernen Button.

Das Tool erstellt eine Fixlog.txt auf deinem USB Stick. Poste den Inhalt bitte hier.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 30.10.2014, 18:51   #13
lukas.schoen
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Danke vielmal, funktioniert alles wieder.

Alt 31.10.2014, 10:06   #14
schrauber
/// the machine
/// TB-Ausbilder
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


Dann jetz aus dem normalen Modus:

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 03.11.2014, 14:18   #15
lukas.schoen
 
Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Standard

Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


PC startet wieder normal, Taskmanager lässt sich wieder öffnen, Registry lässt sich auch öffnen.

Internet Explorer funktioniert nicht mehr.
Wenn ich den Internet Explorer starte öffnet er sich für den Bruchteil einer Sekunde, anschliessend ist er weg.



FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 02-11-2014
Ran by Martha Oechslin (administrator) on PC-MARTHA on 03-11-2014 14:10:18
Running from C:\Users\Martha Oechslin\Downloads
Loaded Profile: Martha Oechslin (Available profiles: Kiadmin & Martha Oechslin & kinder & Matthias & Oechslinsteiner & Samuel&Thomas & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\psksvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\TPSrvWow.exe
(Panda Security) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\WebProxy.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.25.5\GoogleCrashHandler64.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe
(Intel Corporation) C:\Windows\System32\igfxtray.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Akamai Technologies, Inc.) C:\Users\Martha Oechslin\AppData\Local\Akamai\netsession_win.exe
(Akamai Technologies, Inc.) C:\Users\Martha Oechslin\AppData\Local\Akamai\netsession_win.exe
() C:\Users\Martha Oechslin\AppData\Roaming\InetStat\inetstat.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\ApVxdWin.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\concentr.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\redirector.exe
(Apple Inc.) C:\Program Files (x86)\iTunes\iTunesHelper.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\Receiver\Receiver.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\SelfServicePlugin\SelfServicePlugin.exe
(Citrix Systems, Inc.) C:\Program Files (x86)\Citrix\ICA Client\wfcrun32.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\Jhi_service.exe
(Symantec Corporation) C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsCtrlS.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PavFnSvr.exe
(Panda Security, S.L.) C:\Program Files (x86)\Common Files\Panda Security\PavShld\PavPrSrv.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\pavsrvx86.exe
(Panda Security, S.L.) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\AVENGINE.EXE
(Panda Security S.L.) C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsImSvc.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Symantec) C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Google Inc.) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe [12503184 2012-06-11] (Realtek Semiconductor)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291648 2012-05-20] (Intel Corporation)
HKLM-x32\...\Run: [IAStorIcon] => C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe [284480 2012-05-30] (Intel Corporation)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [133400 2012-05-15] (Intel Corporation)
HKLM-x32\...\Run: [IntelSBA] => C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\UI\IntelSmallBusinessAdvantage.exe [4243168 2012-02-27] (Intel Corporation)
HKLM-x32\...\Run: [Norton Ghost 15.0] => C:\Program Files (x86)\Norton Ghost\Agent\VProTray.exe [2598760 2010-03-03] (Symantec Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959176 2014-08-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APVXDWIN] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\APVXDWIN.EXE [1062880 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [SCANINICIO] => C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\Inicio.exe [71648 2013-09-30] (Panda Security, S.L.)
HKLM-x32\...\Run: [QuickTime Task] => C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2014-01-17] (Apple Inc.)
HKLM-x32\...\Run: [ConnectionCenter] => C:\Program Files (x86)\Citrix\ICA Client\concentr.exe [395656 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [Redirector] => C:\Program Files (x86)\Citrix\ICA Client\redirector.exe [153992 2013-10-01] (Citrix Systems, Inc.)
HKLM-x32\...\Run: [iTunesHelper] => C:\Program Files (x86)\iTunes\iTunesHelper.exe [152392 2014-09-01] (Apple Inc.)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [271744 2014-09-26] (Oracle Corporation)
Winlogon\Notify\avldr: C:\WINDOWS\SYSTEM32\avldr64.dll (On-Access Anti-Malware Scanner Sync)
Winlogon\Notify\GoToAssist Express Customer: C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_winlogonx64.dll (Citrix Online, a division of Citrix Systems, Inc.)
Winlogon\Notify\igfxcui: C:\WINDOWS\SYSTEM32\igfxdev.dll (Intel Corporation)
HKLM\...D6A79037F57F\InprocServer32: [Default-fastprox]  ATTENTION! ====> ZeroAccess?
HKU\S-1-5-21-1946937363-566282366-477552738-1003\...\Run: [Akamai NetSession Interface] => C:\Users\Martha Oechslin\AppData\Local\Akamai\netsession_win.exe [4672920 2014-04-17] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1946937363-566282366-477552738-1003\...\Run: [Steam] => C:\Program Files (x86)\Steam\Steam.exe [1938112 2014-09-23] (Valve Corporation)
HKU\S-1-5-21-1946937363-566282366-477552738-1003\...\Run: [CLXReader] => C:\Program Files (x86)\CLX.PayPen\CLXReader.exe [4108112 2012-04-24] (CREALOGIX E-Payment AG)
HKU\S-1-5-21-1946937363-566282366-477552738-1003\...\Run: [InetStat] => C:\Users\Martha Oechslin\AppData\Roaming\InetStat\inetstat.exe [702478 2014-10-21] ()
HKU\S-1-5-21-1946937363-566282366-477552738-1003\...\MountPoints2: Z - Z:\autorun.exe
HKU\S-1-5-21-1946937363-566282366-477552738-1003\...\MountPoints2: {e19ea797-1ada-11e2-830c-902b3460219e} - D:\Startme.exe
Startup: C:\Users\kinder.PC-Martha\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Steam.lnk
ShortcutTarget: Steam.lnk -> C:\Program Files (x86)\Steam\Steam.exe (Valve Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} =>  No File
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} =>  No File

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://ch.msn.com/
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-CH
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://google.ch/
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM - {46708238-4A5C-4B2C-8A99-2995714952F7} URL = hxxp://www.bing.com/search?q={searchTerms}&form=IE9TR&src=IE9TR&pc=MASBJS
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {cf6e4b1c-dbde-457e-9cef-ab8ecac8a5e8} URL = hxxp://search.mywebsearch.com/mywebsearch/GGmain.jhtml?p2=^HJ^xdm255^YY^ch&si=CJi2jYasorUCFUNb3goduwoAWg&ptb=0DFAC304-6772-470C-B34F-015085FC282C&ind=2013060602&n=77fcddfa&psa=&st=sb&searchfor={searchTerms}
SearchScopes: HKCU - {46708238-4A5C-4B2C-8A99-2995714952F7} URL = 
SearchScopes: HKCU - ÛŸÆîZ§’2¹Þpv¨IÍá*X(Ž2s(ÛÎÀJºÔÓµ± vË°!×—(ä¼48иpatm6êo^Mp`Ëõ÷_i£w˜¾!„Áû†x¢8€ÙjÀÿþ*´Ñ;áa´[¦†8*º~RÙxœòÜ8'£-)x*ä* URL = 
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO: Hotspot Shield Class -> {F9E4A054-E9B1-4BC3-83A3-76A1AE736170} -> C:\Program Files (x86)\Hotspot Shield\HssIE\HssIE_64.dll No File
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Microsoft-Konto-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Google Toolbar Helper -> {AA58ED58-01DD-4d91-8333-CF10577473F7} -> C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
Toolbar: HKLM - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKLM-x32 - No Name - {ae07101b-46d4-4a98-af68-0333ea26e113} -  No File
Toolbar: HKLM-x32 - Google Toolbar - {2318C2B1-4965-11d4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_32.dll (Google Inc.)
Toolbar: HKCU - Google Toolbar - {2318C2B1-4965-11D4-9B18-009027A5CD4F} - C:\Program Files (x86)\Google\Google Toolbar\GoogleToolbar_64.dll (Google Inc.)
Toolbar: HKCU - No Name - {EEE6C35B-6118-11DC-9C72-001320C79847} -  No File
Toolbar: HKCU - No Name - {4F524A2D-5637-006A-76A7-7A786E7484D7} -  No File
DPF: HKLM-x32 {233C1507-6A77-46A4-9443-F871F945D258} hxxp://download.macromedia.com/pub/shockwave/cabs/director/sw.cab
Handler: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} -  No File
Handler-x32: inbox - {37540F19-DD4C-478B-B2DF-C19281BCAF27} -  No File
Filter: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} -  No File
Filter-x32: application/x-ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica; charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=euc-jp - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=ISO-8859-1 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS936 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS949 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=MS950 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF-8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: application/x-ica;charset=UTF8 - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Filter-x32: ica - {CFB6322E-CC85-4d1b-82C7-893888A236BC} - C:\Program Files (x86)\Citrix\ICA Client\IcaMimeFilter.dll (Citrix Systems, Inc.)
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 172.23.1.254 62.2.24.162 62.2.17.61

FireFox:
========
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @java.com/DTPlugin,version=10.7.2 -> C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> disabled No File
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer -> C:\Windows\SysWOW64\Adobe\Director\np32dsw_1202122.dll (Adobe Systems, Inc.)
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @Citrix.com/npican -> C:\Program Files (x86)\Citrix\ICA Client\npicaN.dll (Citrix Systems, Inc.)
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=2.0.59 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.71.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @microsoft.com/GENUINE -> disabled No File
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=16.4.3505.0912 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.25.5\npGoogleUpdate3.dll (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @onlive.com/OnLiveGameClientDetector,version=1.0.0 -> C:\Program Files (x86)\OnLive\Plugin\npolgdet.dll No File
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 -> C:\Users\Martha Oechslin\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF HKLM-x32\...\Firefox\Extensions: [SpecialSavings@SpecialSavings.com] - C:\Users\Martha Oechslin\AppData\Roaming\Mozilla\Extensions\SpecialSavings@SpecialSavings.com
FF Extension: SpecialSavings - C:\Users\Martha Oechslin\AppData\Roaming\Mozilla\Extensions\SpecialSavings@SpecialSavings.com [2013-06-02]
FF HKLM-x32\...\Firefox\Extensions: [seesimilar02@SeeSimilar.com] - C:\Users\Martha Oechslin\AppData\Roaming\Mozilla\Extensions\seesimilar02@SeeSimilar.com
FF Extension: SeeSimilar02 - C:\Users\Martha Oechslin\AppData\Roaming\Mozilla\Extensions\seesimilar02@SeeSimilar.com [2013-06-22]
FF HKCU\...\Firefox\Extensions: [SpecialSavings@SpecialSavings.com] - C:\Users\Martha Oechslin\AppData\Roaming\Mozilla\Extensions\SpecialSavings@SpecialSavings.com
FF HKCU\...\Firefox\Extensions: [seesimilar02@SeeSimilar.com] - C:\Users\Martha Oechslin\AppData\Roaming\Mozilla\Extensions\seesimilar02@SeeSimilar.com

Chrome: 
=======
CHR Profile: C:\Users\Martha Oechslin\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Martha Oechslin\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2014-11-03]
CHR Extension: (Google Wallet) - C:\Users\Martha Oechslin\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2013-11-06]
CHR Extension: (SweetPacks Chrome Extension) - C:\Users\Martha Oechslin\AppData\Local\Google\Chrome\User Data\Default\Extensions\ogccgbmabaphcakpiclgcnmcnimhokcj [2014-07-18]
CHR HKCU\...\Chrome\Extension: [nikpibnbobmbdbheedjfogjlikpgpnhp] - C:\Program Files (x86)\Common Files\DVDVideoSoft\plugins\DVDVideoSoftBrowserExtension.crx []
CHR HKLM-x32\...\Chrome\Extension: [ogccgbmabaphcakpiclgcnmcnimhokcj] - C:\Users\Martha Oechslin\AppData\Local\Google\Chrome\User Data\Default\External Extensions\{EEE6C373-6118-11DC-9C72-001320C79847}\SweetNT.crx [2013-01-10]

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 GenericMount Helper Service; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\GenericMountHelperx64.exe [2227216 2010-02-12] (Symantec)
S3 GoToAssist Remote Support Customer; C:\Program Files (x86)\Citrix\GoToAssist Remote Support Customer\498\g2ax_service.exe [611400 2013-07-15] (Citrix Online, a division of Citrix Systems, Inc.)
R2 Intel(R) Small Business Advantage; C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Intel.SmallBusinessAdvantage.WindowsService.exe [49376 2012-02-27] (Intel Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [165144 2012-05-15] (Intel Corporation)
S3 LiveUpdate; C:\Program Files (x86)\Symantec\LiveUpdate\LuComServer_3_2.EXE [2999664 2007-09-26] (Symantec Corporation)
R2 Norton Ghost; C:\Program Files (x86)\Norton Ghost\Agent\VProSvc.exe [4590432 2010-03-03] (Symantec Corporation)
R2 Panda Software Controller; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsCtrls.exe [177440 2012-11-19] (Panda Security, S.L.)
R2 PAVFNSVR; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PavFnSvr.exe [202016 2012-09-21] (Panda Security, S.L.)
R2 PavPrSrv; C:\Program Files (x86)\Common Files\Panda Security\PavShld\pavprsrv.exe [62768 2008-02-04] (Panda Security, S.L.)
R2 PAVSRV; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\pavsrvx86.exe [313664 2011-04-13] (Panda Security, S.L.)
R2 PSIMSVC; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PsImSvc.exe [108288 2008-06-19] (Panda Security S.L.)
R2 PskSvcRetail; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\PskSvc.exe [28992 2010-08-16] (Panda Security, S.L.)
S3 Symantec SymSnap VSS Provider; C:\Windows\system32\dllhost.exe [9728 2009-07-14] (Microsoft Corporation)
S3 Symantec SymSnap VSS Provider; C:\Windows\SysWOW64\dllhost.exe [7168 2009-07-14] (Microsoft Corporation)
R3 SymSnapService; C:\Program Files (x86)\Norton Ghost\Shared\Drivers\SymSnapServicex64.exe [2963960 2010-02-11] (Symantec)
R2 TPSrv; C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\TPSrvWow.exe [173816 2014-02-25] (Panda Security, S.L.)
S2 70e6ca8c; "C:\Windows\system32\rundll32.exe" "c:\Program Files (x86)\Optimizer Pro\OptProCrash.dll",ServiceMain

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AmFSM; C:\Windows\System32\DRIVERS\amm6460.sys [71432 2012-03-26] (Panda Security, S.L.)
R3 GenericMount; C:\Windows\System32\DRIVERS\GenericMount.sys [66608 2010-02-12] (Symantec Corporation)
R2 inpoutx64; C:\Windows\System32\Drivers\inpoutx64.sys [15008 2012-07-18] (Highresolution Enterprises [www.highrez.co.uk])
R0 pavboot; C:\Windows\System32\Drivers\pavboot64.sys [30792 2010-06-22] (Panda Security, S.L.)
S3 PayPen; C:\Windows\System32\Drivers\PayPen.sys [20864 2012-04-24] ()
R1 ShldFlt; C:\Windows\System32\DRIVERS\ShldFlt.sys [48136 2009-10-27] (Panda Security, S.L.)
R0 symsnap; C:\Windows\System32\DRIVERS\symsnap.sys [170032 2010-02-11] (StorageCraft)
S3 taphss6; C:\Windows\System32\DRIVERS\taphss6.sys [42184 2013-04-24] (Anchorfree Inc.)
S3 USBAAPL64; C:\Windows\System32\Drivers\usbaapl64.sys [54784 2013-03-18] (Apple, Inc.) [File not signed]
S3 VProEventMonitor; C:\Windows\System32\DRIVERS\vproeventmonitor.sys [20528 2009-09-21] (Symantec Corporation)
S3 cpuz134; \??\C:\Users\MARTHA~1\AppData\Local\Temp\cpuz134\cpuz134_x64.sys [X]
S3 cpuz135; \??\C:\Users\ADMINI~1\AppData\Local\Temp\cpuz135\cpuz135_x64.sys [X]
R3 PavTPK.sys; \??\C:\Windows\system32\PavTPK.sys [X]
S3 Prot6Flt; system32\DRIVERS\Prot6Flt.sys [X]
U2 V2iMount; No ImagePath

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-03 14:10 - 2014-11-03 14:10 - 02114560 _____ (Farbar) C:\Users\Martha Oechslin\Downloads\FRST64.exe
2014-11-03 14:10 - 2014-11-03 14:10 - 00026983 _____ () C:\Users\Martha Oechslin\Downloads\FRST.txt
2014-11-01 13:47 - 2014-11-01 13:47 - 00001111 _____ () C:\Users\Matthias\Desktop\Dokumente - Verknüpfung.lnk
2014-11-01 13:46 - 2014-11-01 13:46 - 00000000 ____D () C:\Users\Matthias\Documents\Traktoren
2014-10-31 16:04 - 2014-09-05 03:11 - 06584320 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2014-10-31 16:04 - 2014-09-05 02:52 - 05703168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2014-10-31 16:04 - 2014-08-29 03:07 - 03179520 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2014-10-31 16:04 - 2014-05-08 10:32 - 00016384 _____ (Microsoft Corporation) C:\Windows\system32\RdpGroupPolicyExtension.dll
2014-10-31 07:41 - 2013-10-02 03:22 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbFlt.sys
2014-10-31 07:41 - 2013-10-02 03:11 - 00013824 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyControl.exe
2014-10-31 07:41 - 2013-10-02 03:08 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbRedirectionGroupPolicyExtension.dll
2014-10-31 07:41 - 2013-10-02 02:10 - 00044544 _____ (Microsoft Corporation) C:\Windows\system32\TsUsbGDCoInstaller.dll
2014-10-31 07:40 - 2013-10-02 02:48 - 00056832 _____ (Microsoft Corporation) C:\Windows\system32\MsRdpWebAccess.dll
2014-10-31 07:40 - 2013-10-02 02:48 - 00018944 _____ (Microsoft Corporation) C:\Windows\system32\wksprtPS.dll
2014-10-31 07:40 - 2013-10-02 02:29 - 00062976 _____ (Microsoft Corporation) C:\Windows\system32\tsgqec.dll
2014-10-31 07:40 - 2013-10-02 01:15 - 01057280 _____ (Microsoft Corporation) C:\Windows\system32\rdvidcrl.dll
2014-10-31 07:40 - 2013-10-02 01:14 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MsRdpWebAccess.dll
2014-10-31 07:40 - 2013-10-02 01:14 - 00017920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wksprtPS.dll
2014-10-31 07:40 - 2013-10-02 01:08 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\TSWbPrxy.exe
2014-10-31 07:40 - 2013-10-02 01:01 - 00420864 _____ (Microsoft Corporation) C:\Windows\system32\wksprt.exe
2014-10-31 07:40 - 2013-10-02 00:58 - 00053248 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tsgqec.dll
2014-10-31 07:40 - 2013-10-02 00:31 - 01147392 _____ (Microsoft Corporation) C:\Windows\system32\mstsc.exe
2014-10-31 07:40 - 2013-10-02 00:08 - 00855552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdvidcrl.dll
2014-10-31 07:40 - 2013-10-01 23:34 - 01068544 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstsc.exe
2014-10-31 07:40 - 2012-08-23 15:13 - 00243200 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2014-10-31 07:40 - 2012-08-23 15:10 - 00019456 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2014-10-31 07:40 - 2012-08-23 15:08 - 00030208 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\TsUsbGD.sys
2014-10-31 07:40 - 2012-08-23 12:12 - 00192000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rdpendp_winip.dll
2014-10-31 07:40 - 2012-08-23 11:51 - 00228864 _____ (Microsoft Corporation) C:\Windows\system32\rdpendp_winip.dll
2014-10-31 03:48 - 2014-10-31 03:48 - 00000000 ____D () C:\Windows\system32\config\HiveBackup
2014-10-30 18:06 - 2014-10-30 18:06 - 00005849 _____ () C:\Windows\SysWOW64\jupdate-1.7.0_71-b14.log
2014-10-30 18:06 - 2014-10-30 18:06 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Java
2014-10-30 18:06 - 2014-09-26 18:42 - 00098216 _____ (Oracle Corporation) C:\Windows\SysWOW64\WindowsAccessBridge-32.dll
2014-10-30 18:06 - 2014-09-26 18:36 - 00272808 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaws.exe
2014-10-30 18:06 - 2014-09-26 18:36 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\javaw.exe
2014-10-30 18:06 - 2014-09-26 18:35 - 00175528 _____ (Oracle Corporation) C:\Windows\SysWOW64\java.exe
2014-10-23 19:13 - 2014-11-03 14:10 - 00000000 ____D () C:\FRST
2014-10-23 10:14 - 2014-10-23 10:14 - 00000050 _____ () C:\.directory
2014-10-23 07:52 - 2014-11-03 13:05 - 00724667 _____ () C:\Windows\WindowsUpdate.log
2014-10-23 07:49 - 2014-11-03 13:07 - 00008729 _____ () C:\Windows\setupact.log
2014-10-23 07:49 - 2014-10-23 07:49 - 00000000 _____ () C:\Windows\setuperr.log
2014-10-21 15:09 - 2014-10-21 19:51 - 00000000 ____D () C:\Program Files (x86)\SmartOnes
2014-10-21 15:09 - 2014-10-21 15:09 - 00001266 _____ () C:\Users\Martha Oechslin\Desktop\Continue installation .lnk
2014-10-21 15:09 - 2014-10-21 15:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\InetStat
2014-10-21 15:09 - 2014-10-21 15:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Roaming\InetStat
2014-10-21 15:06 - 2014-10-21 15:06 - 01080416 _____ (Unity Technologies ApS) C:\Users\Matthias\Downloads\UnityWebPlayer.exe
2014-10-21 14:56 - 2014-10-21 14:56 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Unity
2014-10-21 14:39 - 2014-10-21 14:39 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (5).ica
2014-10-20 18:53 - 2014-10-20 18:53 - 00001628 _____ () C:\Users\Martha Oechslin\Downloads\launch (4).ica
2014-10-16 07:14 - 2014-10-10 03:05 - 00507392 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-10-16 07:14 - 2014-10-10 03:05 - 00276480 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2014-10-16 07:14 - 2014-10-10 03:00 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-10-16 07:14 - 2014-10-07 03:54 - 00378552 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2014-10-16 07:14 - 2014-10-07 03:04 - 00331448 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2014-10-16 07:14 - 2014-09-29 01:58 - 03198976 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2014-10-16 07:14 - 2014-09-25 23:50 - 13619200 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-10-16 07:14 - 2014-09-25 23:46 - 00365056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-10-16 07:14 - 2014-09-25 23:46 - 00243200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-10-16 07:14 - 2014-09-25 23:46 - 00069632 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-10-16 07:14 - 2014-09-25 23:43 - 11807232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-10-16 07:14 - 2014-09-25 23:32 - 02017280 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-10-16 07:14 - 2014-09-25 23:31 - 02108416 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-10-16 07:14 - 2014-09-19 03:25 - 23631360 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-10-16 07:14 - 2014-09-19 02:56 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-10-16 07:14 - 2014-09-19 02:55 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2014-10-16 07:14 - 2014-09-19 02:44 - 17484800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-10-16 07:14 - 2014-09-19 02:41 - 02796032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-10-16 07:14 - 2014-09-19 02:40 - 00547328 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-10-16 07:14 - 2014-09-19 02:40 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2014-10-16 07:14 - 2014-09-19 02:39 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2014-10-16 07:14 - 2014-09-19 02:38 - 00083968 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2014-10-16 07:14 - 2014-09-19 02:36 - 05829632 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-10-16 07:14 - 2014-09-19 02:31 - 00051200 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-10-16 07:14 - 2014-09-19 02:30 - 00033792 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2014-10-16 07:14 - 2014-09-19 02:27 - 00595968 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-10-16 07:14 - 2014-09-19 02:26 - 00139264 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-10-16 07:14 - 2014-09-19 02:25 - 04201472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-10-16 07:14 - 2014-09-19 02:25 - 00758272 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2014-10-16 07:14 - 2014-09-19 02:25 - 00111616 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2014-10-16 07:14 - 2014-09-19 02:18 - 00940032 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2014-10-16 07:14 - 2014-09-19 02:14 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-10-16 07:14 - 2014-09-19 02:14 - 00446464 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-10-16 07:14 - 2014-09-19 02:06 - 00072704 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2014-10-16 07:14 - 2014-09-19 02:02 - 00454656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-10-16 07:14 - 2014-09-19 02:01 - 00195584 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2014-10-16 07:14 - 2014-09-19 02:01 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2014-10-16 07:14 - 2014-09-19 02:01 - 00051200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2014-10-16 07:14 - 2014-09-19 02:00 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-10-16 07:14 - 2014-09-19 01:59 - 00061952 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2014-10-16 07:14 - 2014-09-19 01:58 - 00289280 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-10-16 07:14 - 2014-09-19 01:55 - 02187264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-10-16 07:14 - 2014-09-19 01:54 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-10-16 07:14 - 2014-09-19 01:53 - 00032768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2014-10-16 07:14 - 2014-09-19 01:51 - 00440320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-10-16 07:14 - 2014-09-19 01:50 - 00112128 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-10-16 07:14 - 2014-09-19 01:49 - 00597504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2014-10-16 07:14 - 2014-09-19 01:42 - 00731136 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-10-16 07:14 - 2014-09-19 01:42 - 00710656 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2014-10-16 07:14 - 2014-09-19 01:40 - 01249280 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2014-10-16 07:14 - 2014-09-19 01:36 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2014-10-16 07:14 - 2014-09-19 01:33 - 02309632 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-10-16 07:14 - 2014-09-19 01:32 - 00164864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2014-10-16 07:14 - 2014-09-19 01:20 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-10-16 07:14 - 2014-09-19 01:18 - 01068032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2014-10-16 07:14 - 2014-09-19 01:14 - 01447936 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-10-16 07:14 - 2014-09-19 00:59 - 01810944 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-10-16 07:14 - 2014-09-19 00:59 - 00775168 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2014-10-16 07:14 - 2014-09-19 00:53 - 01190400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-10-16 07:14 - 2014-09-19 00:52 - 00678400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2014-10-16 07:14 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDYAK.DLL
2014-10-16 07:14 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDTAT.DLL
2014-10-16 07:14 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU1.DLL
2014-10-16 07:14 - 2014-07-09 03:03 - 00007168 _____ (Microsoft Corporation) C:\Windows\system32\KBDBASH.DLL
2014-10-16 07:14 - 2014-07-09 03:03 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\KBDRU.DLL
2014-10-16 07:14 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDYAK.DLL
2014-10-16 07:14 - 2014-07-09 02:31 - 00007168 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDTAT.DLL
2014-10-16 07:14 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU1.DLL
2014-10-16 07:14 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDRU.DLL
2014-10-16 07:14 - 2014-07-09 02:31 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\KBDBASH.DLL
2014-10-16 07:14 - 2014-07-08 23:38 - 00419992 _____ () C:\Windows\system32\locale.nls
2014-10-16 07:14 - 2014-07-08 23:30 - 00419992 _____ () C:\Windows\SysWOW64\locale.nls
2014-10-16 07:14 - 2014-06-18 23:23 - 01943696 _____ (Microsoft Corporation) C:\Windows\system32\dfshim.dll
2014-10-16 07:14 - 2014-06-18 23:23 - 01131664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dfshim.dll
2014-10-16 07:14 - 2014-06-18 23:23 - 00156824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscorier.dll
2014-10-16 07:14 - 2014-06-18 23:23 - 00156312 _____ (Microsoft Corporation) C:\Windows\system32\mscorier.dll
2014-10-16 07:14 - 2014-06-18 23:23 - 00081560 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mscories.dll
2014-10-16 07:14 - 2014-06-18 23:23 - 00073880 _____ (Microsoft Corporation) C:\Windows\system32\mscories.dll
2014-10-16 07:13 - 2014-09-18 03:00 - 03241472 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2014-10-16 07:13 - 2014-09-18 02:32 - 02363904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msi.dll
2014-10-16 07:13 - 2014-09-04 06:23 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\rastls.dll
2014-10-16 07:13 - 2014-09-04 06:04 - 00372736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rastls.dll
2014-10-16 07:13 - 2014-07-17 03:07 - 00681984 _____ (Microsoft Corporation) C:\Windows\system32\termsrv.dll
2014-10-16 07:13 - 2014-07-17 03:07 - 00455168 _____ (Microsoft Corporation) C:\Windows\system32\winlogon.exe
2014-10-16 07:13 - 2014-07-17 03:07 - 00235520 _____ (Microsoft Corporation) C:\Windows\system32\winsta.dll
2014-10-16 07:13 - 2014-07-17 03:07 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorekmts.dll
2014-10-16 07:13 - 2014-07-17 03:07 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2014-10-16 07:13 - 2014-07-17 03:07 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2014-10-16 07:13 - 2014-07-17 02:40 - 00157696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\winsta.dll
2014-10-16 07:13 - 2014-07-17 02:39 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2014-10-16 07:13 - 2014-07-17 02:39 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2014-10-16 07:13 - 2014-07-17 02:21 - 00212480 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpwd.sys
2014-10-16 07:13 - 2014-07-17 02:21 - 00039936 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\tssecsrv.sys
2014-10-16 07:12 - 2014-09-13 02:58 - 00077312 _____ (Microsoft Corporation) C:\Windows\system32\packager.dll
2014-10-16 07:12 - 2014-09-13 02:40 - 00067072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\packager.dll
2014-10-13 16:49 - 2014-10-13 16:49 - 00000000 ____D () C:\Users\Samuel&Thomas\Desktop\Neuer Ordner

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-11-03 14:08 - 2009-07-14 05:45 - 00031888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-11-03 14:08 - 2009-07-14 05:45 - 00031888 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-11-03 14:07 - 2011-02-23 13:59 - 30616340 _____ () C:\Windows\system32\perfh007.dat
2014-11-03 14:07 - 2011-02-23 13:59 - 09760670 _____ () C:\Windows\system32\perfc007.dat
2014-11-03 14:07 - 2009-07-14 06:13 - 00006118 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-11-03 13:01 - 2013-05-02 16:32 - 00000000 ____D () C:\Program Files (x86)\Steam
2014-11-03 13:01 - 2012-08-08 18:04 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2014-11-03 13:00 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-11-01 17:24 - 2012-08-03 18:08 - 00004096 ___SH () C:\VSNAP.IDX
2014-11-01 16:58 - 2012-08-08 18:04 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2014-11-01 16:57 - 2012-07-30 15:59 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-11-01 14:18 - 2012-07-31 09:11 - 00008627 _____ () C:\Windows\SysWOW64\PAV_FOG.OPC
2014-11-01 13:41 - 2013-01-08 17:08 - 00003946 _____ () C:\Windows\System32\Tasks\User_Feed_Synchronization-{D650C523-4389-4A53-88DB-0AED38A191CB}
2014-11-01 13:34 - 2012-11-09 11:29 - 00000334 __RSH () C:\Users\Matthias\ntuser.pol
2014-11-01 13:34 - 2012-11-09 11:29 - 00000000 ____D () C:\Users\Matthias
2014-11-01 11:27 - 2013-12-19 20:29 - 00000344 __RSH () C:\Users\Samuel&Thomas\ntuser.pol
2014-11-01 11:27 - 2013-12-19 20:29 - 00000000 ____D () C:\Users\Samuel&Thomas
2014-11-01 09:41 - 2013-05-20 17:36 - 00000952 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006UA.job
2014-11-01 06:21 - 2012-08-02 12:37 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Outlook-Dateien
2014-10-31 15:39 - 2014-01-03 18:57 - 00000008 __RSH () C:\Users\Oechslinsteiner\ntuser.pol
2014-10-31 15:39 - 2013-06-05 11:03 - 00000000 ____D () C:\Users\Oechslinsteiner
2014-10-31 08:24 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2014-10-31 07:48 - 2009-07-14 04:20 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Accessories
2014-10-31 07:46 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2014-10-31 07:41 - 2012-07-30 16:21 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-10-30 19:13 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\registration
2014-10-30 18:41 - 2013-05-20 17:36 - 00000930 _____ () C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006Core.job
2014-10-30 18:10 - 2013-06-03 18:18 - 00002175 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2014-10-30 18:07 - 2013-11-11 12:15 - 00000000 ____D () C:\ProgramData\Oracle
2014-10-30 18:06 - 2013-07-08 09:06 - 00000000 ____D () C:\Program Files (x86)\Java
2014-10-30 17:53 - 2012-08-08 18:04 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2014-10-30 17:53 - 2012-08-08 18:04 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2014-10-28 06:34 - 2010-11-21 04:27 - 00275080 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-10-24 17:42 - 2009-07-14 04:20 - 00000000 ___HD () C:\Windows\system32\GroupPolicy
2014-10-24 07:44 - 2013-05-23 12:18 - 00000332 __RSH () C:\Users\Kiadmin\ntuser.pol
2014-10-24 07:44 - 2012-11-07 14:42 - 00000008 __RSH () C:\Users\Martha Oechslin\ntuser.pol
2014-10-24 07:44 - 2012-07-30 15:27 - 00000000 ____D () C:\Users\Martha Oechslin
2014-10-24 07:44 - 2012-07-30 10:19 - 00000000 ____D () C:\Users\Kiadmin
2014-10-23 10:33 - 2014-07-15 09:06 - 00000000 ____D () C:\Kaspersky Rescue Disk 10.0
2014-10-22 12:13 - 2012-08-23 12:09 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\CrashDumps
2014-10-22 12:13 - 2012-08-03 17:53 - 00000000 ____D () C:\Windows\Minidump
2014-10-21 14:56 - 2014-04-26 07:06 - 00000000 ____D () C:\Users\Martha Oechslin\AppData\Local\Deployment
2014-10-18 08:28 - 2014-08-02 07:02 - 00000000 ____D () C:\Users\Oechslinsteiner\AppData\Local\CrashDumps
2014-10-16 18:43 - 2009-07-14 05:45 - 00343232 _____ () C:\Windows\system32\FNTCACHE.DAT
2014-10-16 18:41 - 2014-05-06 14:58 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-10-16 18:19 - 2013-07-15 09:12 - 00000000 ____D () C:\Windows\system32\MRT
2014-10-16 18:19 - 2012-07-30 10:26 - 103265616 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-10-14 09:23 - 2012-08-08 12:48 - 00000000 ____D () C:\Users\Martha Oechslin\Documents\Lohnabrechnungen

Files to move or delete:
====================
C:\Users\kinder.PC-Martha\g2ax_customer_downloadhelper_win32_x86.exe
C:\Users\Martha Oechslin\g2ax_customer_downloadhelper_win32_x86.exe


Some content of TEMP:
====================
C:\Users\Kiadmin\AppData\Local\Temp\jre-7u45-windows-i586-iftw.exe
C:\Users\Kiadmin\AppData\Local\Temp\msvcp100.dll
C:\Users\Kiadmin\AppData\Local\Temp\msvcr100.dll
C:\Users\Kiadmin\AppData\Local\Temp\uninst1.exe
C:\Users\Kiadmin\AppData\Local\Temp\UNINSTALL.EXE
C:\Users\Kinder\AppData\Local\Temp\InstallFlashPlayer.exe
C:\Users\Kinder\AppData\Local\Temp\instloffer.exe
C:\Users\Kinder\AppData\Local\Temp\iupdate.exe
C:\Users\Kinder\AppData\Local\Temp\SIntf16.dll
C:\Users\Kinder\AppData\Local\Temp\SIntf32.dll
C:\Users\Kinder\AppData\Local\Temp\SIntfNT.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\83newxtc.dll
C:\Users\kinder.PC-Martha\AppData\Local\Temp\ann.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\banner.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\cminpack.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\daisy3.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\eigen.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\fast.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\install_flashplayer13x32ax_chra_awa_aih.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\panosgm.exe
C:\Users\kinder.PC-Martha\AppData\Local\Temp\Softonic_DE_1-5-1.exe
C:\Users\Martha Oechslin\AppData\Local\Temp\amt_mystartsearch.exe
C:\Users\Martha Oechslin\AppData\Local\Temp\jre-7u71-windows-i586-iftw.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession1.exe
C:\Users\Matthias\AppData\Local\Temp\ARCompanionForSession2.exe
C:\Users\Matthias\AppData\Local\Temp\SIntf16.dll
C:\Users\Matthias\AppData\Local\Temp\SIntf32.dll
C:\Users\Matthias\AppData\Local\Temp\SIntfNT.dll
C:\Users\Matthias\AppData\Local\Temp\_inst1.exe
C:\Users\Oechslins\AppData\Local\Temp\SIntf16.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntf32.dll
C:\Users\Oechslins\AppData\Local\Temp\SIntfNT.dll
C:\Users\Oechslinsteiner\AppData\Local\Temp\OutlookConnector.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_1.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_2.exe
C:\Users\Samuel&Thomas\AppData\Local\Temp\install_flashplayer12x32ax_chra_awa_aih_3.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-10-30 19:25

==================== End Of Log ============================
--- --- ---



Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 02-11-2014
Ran by Martha Oechslin at 2014-11-03 14:11:08
Running from C:\Users\Martha Oechslin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Panda Antivirus Pro 2014 (Enabled - Up to date) {86971480-9989-6750-B122-681A86518D59}
AS: Panda Antivirus Pro 2014 (Enabled - Up to date) {3DF6F564-BFB3-68DE-8B92-5368FDD6C7E4}
AS: Windows Defender (Enabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 15 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 15.0.0.167 - Adobe Systems Incorporated)
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.09) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.09 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.0 (HKLM-x32\...\Adobe Shockwave Player) (Version: 12.0.2.122 - Adobe Systems, Inc.)
Akamai NetSession Interface (HKCU\...\Akamai) (Version:  - Akamai Technologies, Inc)
Apple Application Support (HKLM-x32\...\{78002155-F025-4070-85B3-7C0453561701}) (Version: 3.0.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{B678797F-DF38-4556-8A31-8B818E261868}) (Version: 8.0.0.23 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
CCleaner (HKLM\...\CCleaner) (Version: 4.02 - Piriform)
Citrix Receiver (HKLM-x32\...\CitrixOnlinePluginPackWeb) (Version: 14.1.0.0 - Citrix Systems, Inc.)
CLX.PayPen - CLX.PayPen Wireless (HKLM-x32\...\{9D7024A3-518B-4F7E-A346-D64C597FA531}) (Version: 2.0.5.0 - CREALOGIX)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Facebook Video Calling 3.1.0.521 (HKLM-x32\...\{2091F234-EB58-4B80-8C96-8EB78C808CF7}) (Version: 3.1.521 - Skype Limited)
Fotogalerie (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
GameSpy Arcade (HKLM-x32\...\GameSpy Arcade) (Version:  - )
Google Chrome (HKLM-x32\...\Google Chrome) (Version: 38.0.2125.111 - Google Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Toolbar for Internet Explorer (HKLM-x32\...\{2318C2B1-4965-11d4-9B18-009027A5CD4F}) (Version: 7.5.5111.1712 - Google Inc.)
Google Toolbar for Internet Explorer (x32 Version: 1.0.0 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.25.5 - Google Inc.) Hidden
GoToAssist Customer 1.6.0.498 (HKLM-x32\...\GoToAssist Express Customer) (Version: 1.6.0.498 - Citrix Online)
HP Officejet 6500 E710a-f - Grundlegende Software für das Gerät (HKLM\...\{8F4884F1-488D-4738-8F71-65A378BB484C}) (Version: 22.50.231.0 - Hewlett-Packard Co.)
HP Officejet 6500 E710a-f Hilfe (HKLM-x32\...\{037CD593-D760-4A00-B030-7BBAFA1123FE}) (Version: 140.0.2.2 - Hewlett Packard)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
Inbox Toolbar (HKLM-x32\...\{612AD33D-9824-4E87-8396-92374E91C4BB}_is1) (Version: 2.0.0.46 - Inbox.com, Inc.)
InetStat (HKCU\...\InetStat) (Version: 0.5b - InetStat)
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1008 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.12.1498 - Intel Corporation)
Intel(R) OpenCL CPU Runtime (HKLM-x32\...\{FCB3772C-B7D0-4933-B1A9-3707EBACC573}) (Version:  - Intel Corporation)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 9.17.10.2932 - Intel Corporation)
Intel(R) Rapid Storage Technology (HKLM-x32\...\{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}) (Version: 11.2.0.1006 - Intel Corporation)
Intel(R) Small Business Advantage (HKLM-x32\...\{6A6D86CD-B004-46b7-8951-7BB75A776F8C}) (Version:  - Intel(R) Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.5.235 - Intel Corporation)
iTunes (HKLM\...\{F46AA0F1-E284-4878-A462-5F11B9166C0E}) (Version: 11.4.0.18 - Apple Inc.)
Java 7 Update 71 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83217025FF}) (Version: 7.0.710 - Oracle)
JavaFX 2.1.1 (HKLM-x32\...\{1111706F-666A-4037-7777-211328764D10}) (Version: 2.1.1 - Oracle Corporation)
Junk Mail filter update (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Kastor - Tube To Mp3 V 2.9 (HKLM-x32\...\{87C334CF-063A-4AEA-B523-1DE04014BA19}_is1) (Version: 2.9.0.0 - KastorSoft)
Landwirtschafts Simulator 2013 (HKLM-x32\...\FarmingSimulator2013DE_is1) (Version: 1.0 - GIANTS Software)
LiveUpdate 3.2 (Symantec Corporation) (HKLM-x32\...\LiveUpdate) (Version: 3.2.0.68 - Symantec Corporation)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Office Home and Business 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Outlook Connector (HKLM-x32\...\{95140000-0081-0407-0000-0000000FF1CE}) (Version: 14.0.6123.5001 - Microsoft Corporation)
Microsoft Outlook Social Connector Provider for Windows Live Messenger 32-bit (HKLM-x32\...\{95140000-007D-0409-0000-0000000FF1CE}) (Version: 14.0.5120.5000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SkyDrive (HKCU\...\SkyDriveSetup.exe) (Version: 17.0.2006.0314 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Windows Media Video 9 VCM (HKLM-x32\...\WMV9_VCM) (Version:  - )
Movie Maker (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
MSVCRT110_amd64 (Version: 16.4.1109.0912 - Microsoft) Hidden
Muziic Player & Encoder (HKCU\...\Muziic Player & Encoder) (Version:  - )
MX vs ATV Reflex (HKLM-x32\...\Steam App 55140) (Version:  - Rainbow\Double Helix)
Norton Ghost (HKLM-x32\...\{B0255743-165B-4BD5-8DA8-37DFB9930015}) (Version: 15.0.1.36526 - Symantec Corporation)
NVIDIA PhysX (HKLM-x32\...\{1C4551A6-4743-4093-91E4-1477CD655043}) (Version: 9.09.0203 - NVIDIA Corporation)
Online Plug-in (x32 Version: 14.1.0.0 - Citrix Systems, Inc.) Hidden
Panda Antivirus Pro 2014 (HKLM-x32\...\{E55FB276-73C9-4776-AB53-BC028C0509ED}) (Version: 13.01.02 - Panda Security)
Panda Antivirus Pro 2014 (x32 Version: 13.01.02 - Panda Security) Hidden
Password Depot 7 - Panda Secure Vault Edition (HKLM-x32\...\{A6144BFB-45FB-4DDB-BC4F-AB10E9FF0395}_is1) (Version: 7.1.0 - AceBIT GmbH)
PDF Speed Converter (HKLM\...\{EC38DB84-B902-4F2D-92D7-297E4E3A0A2A}_is1) (Version: 1.0 - )
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.4.3 - Frank Heindörfer, Philip Chinery)
Photo Common (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
Photo Gallery (x32 Version: 16.4.3505.0912 - Microsoft Corporation) Hidden
QuickTime 7 (HKLM-x32\...\{111EE7DF-FC45-40C7-98A7-753AC46B12FB}) (Version: 7.75.80.95 - Apple Inc.)
RCT3 Soaked (HKLM-x32\...\{EA926717-CE5A-4CB4-AB21-9E6E9565A458}) (Version: 1.00.000 - )
Realtek Ethernet Controller Driver (HKLM-x32\...\{8833FFB6-5B0C-4764-81AA-06DFEED9A476}) (Version: 7.58.411.2012 - Realtek)
Realtek High Definition Audio Driver (HKLM-x32\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6662 - Realtek Semiconductor Corp.)
RollerCoaster Tycoon 3 (HKLM-x32\...\{907B4640-266B-4A21-92FB-CD1A86CD0F63}) (Version: 1.00.000 - )
Self-Service Plug-in (x32 Version: 4.1.0.41738 - Citrix Systems, Inc.) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Skiregion Simulator 2012 (HKLM-x32\...\SkiRegionSimulator2012DE_is1) (Version: 1.0 - GIANTS Software)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
swMSM (x32 Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Unity Web Player (HKCU\...\UnityWebPlayer) (Version: 4.5.5f1 - Unity Technologies ApS)
Video Download Converter version 1.0.0.0 (HKLM-x32\...\VDC_is1) (Version: 1.0.0.0 - ) <==== ATTENTION
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 16.4.3505.0912 - Microsoft Corporation)
Windows-Treiberpaket - C Technologies AB (PayPen) Input Pen  (09/28/2007 2.0.0.0) (HKLM\...\FF0C660232778E730A83A02DA620652B3CF36C07) (Version: 09/28/2007 2.0.0.0 - C Technologies AB)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

30-10-2014 18:32:22 Geplanter Prüfpunkt
31-10-2014 02:00:12 Windows Update
31-10-2014 06:39:23 Windows Update
31-10-2014 17:38:12 Windows Update
01-11-2014 11:10:48 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2012-09-22 12:12 - 00001386 _RASH C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
72.29.93.243 www.google-analytics.com.
72.29.93.243 ad-emea.doubleclick.net.
72.29.93.243 www.statcounter.com.
64.27.10.42 www.google-analytics.com.
64.27.10.42 ad-emea.doubleclick.net.
64.27.10.42 www.statcounter.com.


==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {02C1C9A2-D2E8-47DD-A1C4-F10D5A8C0EDD} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-25] (Adobe Systems Incorporated)
Task: {25A2937A-4659-48AD-AA2A-AD935E4AC7A5} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-08-21] (Adobe Systems Incorporated)
Task: {38AF9B5D-C355-40B3-B844-633ABAAAE3BF} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006Core => C:\Users\kinder.PC-Martha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-05-20] (Facebook Inc.)
Task: {4D3E8585-3A03-4F9A-9241-2C11964E7BED} - System32\Tasks\LaunchApp => C:\Program Files (x86)\MyPC Backup\MyPC Backup.exe <==== ATTENTION
Task: {52AC7887-074D-4698-81E2-29033ED1464F} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2014-09-26] (Oracle Corporation)
Task: {66F9DE25-307F-4866-8FE0-49A0DF40219E} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-08] (Google Inc.)
Task: {7E07C13D-4BCC-44A9-8C09-0ABFFCD5808D} - System32\Tasks\CCleanerSkipUAC => C:\Program Files\CCleaner\CCleaner.exe [2013-05-24] (Piriform Ltd)
Task: {90FAB7B0-B47E-4DCE-BE76-73121D359E97} - System32\Tasks\Yahoo! Search => C:\Users\Martha Oechslin\AppData\Local\Pay-By-Ads\Yahoo! Search\1.3.8.2\dsrlte.exe <==== ATTENTION
Task: {95BDB571-4E7A-450E-9AF7-2EDD50AB9254} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2012-08-08] (Google Inc.)
Task: {B07D5C02-9C0D-4788-AC3F-D57716A444E9} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {B6563806-FFA6-44D7-89BD-23D5323516EE} - System32\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006UA => C:\Users\kinder.PC-Martha\AppData\Local\Facebook\Update\FacebookUpdate.exe [2013-05-20] (Facebook Inc.)
Task: {B7A08E9C-7B92-4EC4-B498-23FB7B942C79} - System32\Tasks\Microsoft\Windows\WindowsBackup\AutomaticBackup => Rundll32.exe /d sdengin2.dll,ExecuteScheduledBackup
Task: {C4976094-5B3A-4715-94AB-6A9E02C660A6} - System32\Tasks\task8543706 => C:\Users\Kinder\AppData\Local\Temp\0.28981120887095857.exe <==== ATTENTION
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006Core.job => C:\Users\kinder.PC-Martha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\FacebookUpdateTaskUserS-1-5-21-1946937363-566282366-477552738-1006UA.job => C:\Users\kinder.PC-Martha\AppData\Local\Facebook\Update\FacebookUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) =============

2012-04-03 12:16 - 2012-03-26 16:33 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2014-10-21 15:09 - 2014-10-21 15:09 - 00702478 _____ () C:\Users\Martha Oechslin\AppData\Roaming\InetStat\inetstat.exe
2014-07-15 12:23 - 2007-02-14 11:55 - 00165424 _____ () C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\MiniCrypto.dll
2014-07-15 12:23 - 2004-05-19 09:33 - 00507904 _____ () C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\libxml2.dll
2014-02-06 00:52 - 2014-02-06 00:52 - 00073544 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2014-02-06 00:52 - 2014-02-06 00:52 - 01044808 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2014-07-15 12:23 - 2007-02-14 11:55 - 00099888 _____ () C:\Program Files (x86)\Panda Security\Panda Antivirus Pro 2014\APIcr.dll
2012-07-16 08:30 - 2012-05-30 12:55 - 00059904 _____ () C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IsdiInterop.dll
2012-07-16 08:34 - 2012-05-10 14:03 - 01198872 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\ACE.dll
2012-07-16 09:44 - 2012-02-27 12:00 - 00030432 _____ () C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\ProcessPrivileges.dll
2012-07-16 09:44 - 2012-02-27 12:00 - 00215264 _____ () C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\System.ComponentModel.Composition.dll
2012-07-16 09:44 - 2012-02-27 12:00 - 00051424 _____ () C:\Program Files (x86)\Intel\Intel(R) Small Business Advantage\Service\Interop.TaskScheduler.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\Martha Oechslin\Downloads\launch (1).ica:icasource
AlternateDataStreams: C:\Users\Martha Oechslin\Downloads\launch (2).ica:icasource
AlternateDataStreams: C:\Users\Martha Oechslin\Downloads\launch (3).ica:icasource
AlternateDataStreams: C:\Users\Martha Oechslin\Downloads\launch (4).ica:icasource
AlternateDataStreams: C:\Users\Martha Oechslin\Downloads\launch (5).ica:icasource
AlternateDataStreams: C:\Users\Martha Oechslin\Downloads\launch.ica:icasource

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\PskSvcRetail => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\GoToAssist Remote Support Customer => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Administrator (S-1-5-21-1946937363-566282366-477552738-500 - Administrator - Disabled)
Gast (S-1-5-21-1946937363-566282366-477552738-501 - Limited - Disabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-1946937363-566282366-477552738-1002 - Limited - Enabled)
Kiadmin (S-1-5-21-1946937363-566282366-477552738-1000 - Administrator - Enabled) => C:\Users\Kiadmin
kinder (S-1-5-21-1946937363-566282366-477552738-1006 - Limited - Enabled) => C:\Users\kinder.PC-Martha
Martha Oechslin (S-1-5-21-1946937363-566282366-477552738-1003 - Administrator - Enabled) => C:\Users\Martha Oechslin
Matthias (S-1-5-21-1946937363-566282366-477552738-1007 - Limited - Enabled) => C:\Users\Matthias
Oechslinsteiner (S-1-5-21-1946937363-566282366-477552738-1012 - Limited - Enabled) => C:\Users\Oechslinsteiner
Samuel&Thomas (S-1-5-21-1946937363-566282366-477552738-1013 - Limited - Enabled) => C:\Users\Samuel&Thomas

==================== Faulty Device Manager Devices =============

Name: Teredo Tunneling Pseudo-Interface
Description: Microsoft-Teredo-Tunneling-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (11/03/2014 02:09:10 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (11/03/2014 02:09:10 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (11/03/2014 02:09:01 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (11/03/2014 02:07:45 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (11/03/2014 02:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (11/03/2014 02:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/03/2014 02:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.

Error: (11/03/2014 02:07:39 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "1". Fehler in Manifest- oder Richtliniendatei "2" in Zeile 3.
Ungültige XML-Syntax.

Error: (11/01/2014 05:00:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: Fehler beim Herunterladen der Zeichenfolgen der Leistungsindikatoren für Dienst "WmiApRpl" (WmiApRpl). Der Fehlercode ist das erste DWORD im Datenbereich.

Error: (11/01/2014 05:00:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Die Zeichenfolgen der Leistungsindikatoren in der Leistungsindikatorenregistrierung werden beschädigt wenn der Prozess "Performance" auf dem Erweiterungsleistungsindikator-Anbieter ausgeführt wird. Der Wert "BaseIndex" aus der Leistungsregistrierung ist das erste DWORD im Datenbereich, der Wert "LastCounter" ist das zweite DWORD im Datenbereich und der Werte "LastHelp" ist das dritte DWORD im Datenbereich.


System errors:
=============
Error: (11/03/2014 01:01:55 PM) (Source: bowser) (EventID: 8003) (User: )
Description: Der Hauptsuchdienst erhielt eine Serverankündigung vom Computer "NB-W8-01",
der der Hauptsuchdienst der Domäne für den NetBT_Tcpip_{686B56A6-3D54-438E-9D08-3B03476D64EB}-Transport zu sein scheint.
Der Hauptsuchdienst wurde beendet oder es wird eine Auswahl erzwungen.

Error: (11/03/2014 01:01:29 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (11/01/2014 05:28:46 PM) (Source: Service Control Manager) (EventID: 7023) (User: )
Description: Der Dienst "Panda On-Access Anti-Malware Service" wurde mit folgendem Fehler beendet: 
%%1

Error: (11/01/2014 05:25:44 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (11/01/2014 04:54:18 PM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Optimizer Pro Crash Monitor erreicht.

Error: (11/01/2014 01:49:59 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Error: (11/01/2014 01:46:02 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Error: (11/01/2014 01:46:02 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Error: (11/01/2014 01:44:15 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004

Error: (11/01/2014 01:44:15 PM) (Source: VDS Basic Provider) (EventID: 1) (User: )
Description: Unerwarteter Fehler. Fehlercode: D@01010004


Microsoft Office Sessions:
=========================
Error: (11/03/2014 02:09:10 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: D:\FRST64.exeD:\FRST64.exe0

Error: (11/03/2014 02:09:10 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: D:\FRST64.exeD:\FRST64.exe0

Error: (11/03/2014 02:09:01 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: D:\FRST64.exeD:\FRST64.exe0

Error: (11/03/2014 02:07:45 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: D:\FRST64.exeD:\FRST64.exe0

Error: (11/03/2014 02:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (11/03/2014 02:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/03/2014 02:07:44 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000

Error: (11/03/2014 02:07:39 PM) (Source: SideBySide) (EventID: 59) (User: )
Description: D:\FRST64.exeD:\FRST64.exe0

Error: (11/01/2014 05:00:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3011) (User: NT-AUTORITÄT)
Description: WmiApRplWmiApRpl8F20300004D070000

Error: (11/01/2014 05:00:39 PM) (Source: Microsoft-Windows-LoadPerf) (EventID: 3012) (User: NT-AUTORITÄT)
Description: Performance1637070000000000000000000009030000


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 27%
Total physical RAM: 8071.27 MB
Available physical RAM: 5862.64 MB
Total Pagefile: 16140.72 MB
Available Pagefile: 13729.89 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:465.76 GB) (Free:328.78 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (USB STICK) (Removable) (Total:3.72 GB) (Free:3.72 GB) FAT32

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 465.8 GB) (Disk ID: EA79D15E)
Partition 1: (Active) - (Size=465.8 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 3.7 GB) (Disk ID: 004E4A2A)
Partition 1: (Active) - (Size=3.7 GB) - (Type=0B)

==================== End Of Log ============================

Antwort
Seite 1 von 2 1 2

Themen zu Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.
.dll, adobe, akamai, antivirus, desktop, dllhost.exe, explorer, file, flash player, installation, kaspersky, launch, monitor, problem, programm, realtek, registry, rundll, scan, security, services.exe, software, stick, svchost.exe, symantec, temp, usb


« Optimizer Pro v3.2 incl. Crash Monitor enfernen | Arbeitspeicherauslastung ungewöhnlich Hoch »


Ähnliche Themen: Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung.


  1. Kein Zugriff auf Anwendungen
    Plagegeister aller Art und deren Bekämpfung - 19.10.2015 (59)
  2. Windows 7: Kein Zugriff auf Computer, Anwendungen oder Systemsteuerung.
    Plagegeister aller Art und deren Bekämpfung - 14.10.2013 (1)
  3. kein Zugriff auf Systemsteuerung, Netzwerkumgebung, Updateshield mehrfach in Taskleiste
    Plagegeister aller Art und deren Bekämpfung - 06.05.2013 (1)
  4. BOO/TDss.O - Kein Zugriff auf Dateien mehr
    Plagegeister aller Art und deren Bekämpfung - 14.07.2012 (25)
  5. Schwarze Symbolleisten (Kein Zugriff auf Eigene Dateien oder Eigene Bilder)
    Plagegeister aller Art und deren Bekämpfung - 15.04.2012 (1)
  6. externe festplatte, kein zugriff auf dateien möglich
    Log-Analyse und Auswertung - 29.12.2011 (38)
  7. Virus dank Malwarebytes weg - alle Dateien noch da, aber kein Zugriff möglich
    Plagegeister aller Art und deren Bekämpfung - 02.11.2011 (10)
  8. Kein Zugriff auf Dateien auf externen Karten, u.a. Probleme
    Log-Analyse und Auswertung - 26.10.2011 (37)
  9. Nach Virusmeldung kein Zugriff mehr auf Dateien/Dateien nicht angezeigt
    Plagegeister aller Art und deren Bekämpfung - 12.08.2011 (1)
  10. Desktop schwarz, kein Zugriff auf Dateien von Festplatte
    Log-Analyse und Auswertung - 06.07.2011 (29)
  11. Desktop schwarz, Dateien nicht sichtbar und kein Zugriff auf Programme z.B. MS Office
    Plagegeister aller Art und deren Bekämpfung - 13.05.2011 (38)
  12. HDD Diagnostic entfernt,Desktop ist fast leer u. kein Zugriff auf Programme u. Dateien
    Plagegeister aller Art und deren Bekämpfung - 17.04.2011 (36)
  13. Kein Zugriff auf Programme und Dateien
    Alles rund um Windows - 07.03.2010 (8)
  14. Antivirus 2009 - kein Zugriff mehr auf Systemsteuerung!
    Antiviren-, Firewall- und andere Schutzprogramme - 10.10.2008 (3)
  15. Explorer.exe schliesst sich sofort wenn ich Arbeitsplatz, Systemsteuerung öffne
    Log-Analyse und Auswertung - 11.03.2008 (1)
  16. Kein Zugriff auf Dateien nach I-Net Klick
    Plagegeister aller Art und deren Bekämpfung - 18.08.2007 (2)
  17. Kein Zugriff auf Arbeitsplatz, Internet, alles langsam... Virus???
    Log-Analyse und Auswertung - 12.11.2006 (8)
Anleitungen und Tipps

- Für alle Hilfesuchenden! Was beachten?

- Anleitung: MyStartSearch.com entfernen

- Anleitung: WebSearches löschen

- Hilfe: iStartSurf entfernen – so gehts!

- Anleitung: Omiga Plus richtig entfernen

- Browser Viren entfernen


Zum Thema Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. - Habe folgendes Problem mit einem Computer. Windows 7 Pro 64 Bit 1. Alle Ink Dateien sind weiss 2. Wenn ich den Arbeitsplatz oder Windows Explorer öffnen will kommt folgende Meldung: - Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung....
Archiv
Du betrachtest: Kein Zugriff auf Arbeitsplatz Anwendungen, Ink Dateien oder Systemsteuerung. auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55