Gesperrter PC wegen BKA, Interpool - Virus

ANDO1

Hallo,

Heute morgen ist mein PC (Windows 7, 32 Bit) von einem BKA bzw. Interpool-Virus gesperrt worden. Ich werde aufgefordert 100€ als Ukash zu begleichen bzw. nach 24h wird der PC endgültig gesperrt!? Nachdem ich den heutigen morgen in Foren usw. nach meinem Problem gesucht habe, und nicht ein Stück weiterkomme, bitte ich nun hier um Hilfe.

Ich habe das übliche probiert ... öffnen im gesichertem Modus geht nicht, fährt herunter und startet dann normal. Booten von CD oder Stick geht nicht (geändert im BIOS) wird nicht akzeptiert. Startet wieder normal....

Vielleicht kann mir dringend jemand helfen, bevor ...?

Ich freue mich auf eure Hilfe.
Gruß, Andreas

Nun habe ich bereits einen Scan mit FARBAR durchgeführt. Hier die Logfiles:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 03-10-2013
Ran by SYSTEM on MININT-CTT49GH on 07-10-2013 11:52:02
Running from F:\
Windows 7 Home Premium (X86) OS Language: German Standard
Internet Explorer Version 10
Boot Mode: Recovery

The current controlset is ControlSet001
ATTENTION!:=====> If the system is bootable FRST could be run from normal or Safe mode to create a complete log.

==================== Registry (Whitelisted) ==================

HKLM\...\Run: [PaperPort PTD] - C:\Program Files\ScanSoft\PaperPort\pptd40nt.exe [29984 2008-07-09] (Nuance Communications, Inc.)
HKLM\...\Run: [IndexSearch] - C:\Program Files\ScanSoft\PaperPort\IndexSearch.exe [46368 2008-07-09] (Nuance Communications, Inc.)
HKLM\...\Run: [BrMfcWnd] - C:\Program Files\Brother\Brmfcmon\BrMfcWnd.exe [1159168 2009-05-26] (Brother Industries, Ltd.)
HKLM\...\Run: [ControlCenter3] - C:\Program Files\Brother\ControlCenter3\brctrcen.exe [114688 2008-12-24] (Brother Industries, Ltd.)
HKLM\...\Run: [vProt] - C:\Program Files\AVG Secure Search\vprot.exe [2404376 2013-10-04] ()
HKLM\...\Run: [GrooveMonitor] - C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [Adobe ARM] - C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [958576 2013-04-04] (Adobe Systems Incorporated)
HKLM\...\Run: [APSDaemon] - C:\Program Files\Common Files\Apple\Apple Application Support\APSDaemon.exe [59720 2013-04-21] (Apple Inc.)
HKLM\...\Run: [AVG_UI] - C:\Program Files\AVG\AVG2013\avgui.exe [4411440 2013-08-15] (AVG Technologies CZ, s.r.o.)
HKLM\...\Run: [iTunesHelper] - C:\Program Files\iTunes\iTunesHelper.exe [152392 2013-09-17] (Apple Inc.)
HKU\Andreas Dombert\...\Run: [swg] - C:\Program Files\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe [ 2012-03-11] (Google Inc.)
HKU\UpdatusUser\...\Run: [AVG-Secure-Search-Update_JUNE2013_TB] - C:\Program Files\AVG Secure Search\AVG-Secure-Search-Update_JUNE2013_TB.exe [ 2013-06-04] (AVG Secure Search)
AppInit_DLLs: C:\PROGRA~1\WIA6EB~1\Datamngr\datamngr.dll C:\PROGRA~1\WIA6EB~1\Datamngr\IEBHO.dll [ 2011-12-12] (Bandoo Media, inc)
Startup: C:\Users\Andreas Dombert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\jw9bnqdr.lnk
ShortcutTarget: jw9bnqdr.lnk -> C:\PROGRA~2\rdqnb9wj.plz ()
Startup: C:\Users\Andreas Dombert\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk
ShortcutTarget: OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files\Microsoft Office\Office12\ONENOTEM.EXE (Microsoft Corporation)

========================== Services (Whitelisted) =================

S3 AVG Security Toolbar Service; C:\Program Files\AVG\AVG10\Toolbar\ToolbarBroker.exe [167264 2011-11-10] ()
S2 AVGIDSAgent; C:\Program Files\AVG\AVG2013\avgidsagent.exe [4939312 2013-07-04] (AVG Technologies CZ, s.r.o.)
S2 avgwd; C:\Program Files\AVG\AVG2013\avgwdsvc.exe [283136 2013-07-23] (AVG Technologies CZ, s.r.o.)
S2 IGDCTRL; C:\Program Files\FRITZ!DSL\IGDCTRL.EXE [73528 2009-07-28] (AVM Berlin)
S2 VAIO Power Management; C:\Program Files\Sony\VAIO Power Management\SPMService.exe [415584 2008-10-17] (Sony Corporation)
S2 vToolbarUpdater17.0.12; C:\Program Files\Common Files\AVG Secure Search\vToolbarUpdater\17.0.12\ToolbarUpdater.exe [1734680 2013-10-04] (AVG Secure Search)
S2 Winmgmt; C:\PROGRA~2\rdqnb9wj.plz [180224 2013-10-07] ()

==================== Drivers (Whitelisted) ====================

S1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdriverx.sys [208184 2013-07-20] (AVG Technologies CZ, s.r.o.)
S0 AVGIDSHX; C:\Windows\System32\DRIVERS\avgidshx.sys [60216 2013-07-20] (AVG Technologies CZ, s.r.o.)
S1 AVGIDSShim; C:\Windows\System32\DRIVERS\avgidsshimx.sys [22328 2013-09-10] (AVG Technologies CZ, s.r.o.)
S1 Avgldx86; C:\Windows\System32\DRIVERS\avgldx86.sys [171320 2013-07-20] (AVG Technologies CZ, s.r.o.)
S0 Avglogx; C:\Windows\System32\DRIVERS\avglogx.sys [246072 2013-07-20] (AVG Technologies CZ, s.r.o.)
S0 Avgmfx86; C:\Windows\System32\DRIVERS\avgmfx86.sys [96568 2013-07-01] (AVG Technologies CZ, s.r.o.)
S0 Avgrkx86; C:\Windows\System32\DRIVERS\avgrkx86.sys [39224 2013-09-05] (AVG Technologies CZ, s.r.o.)
S1 Avgtdix; C:\Windows\System32\DRIVERS\avgtdix.sys [182072 2013-03-21] (AVG Technologies CZ, s.r.o.)
S1 avgtp; C:\Windows\system32\drivers\avgtpx86.sys [37664 2013-10-04] (AVG Technologies)
S3 avmaudio; C:\Windows\System32\DRIVERS\avmaudio.sys [101248 2011-02-03] (AVM Berlin)
S0 CLFS; C:\Windows\System32\CLFS.sys [249408 2009-07-14] (Microsoft Corporation)
S3 Dot4Scan; C:\Windows\System32\DRIVERS\Dot4Scan.sys [10752 2009-07-14] (Microsoft Corporation)

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2013-10-07 11:51 - 2013-10-07 11:51 - 00000000 ____D C:\FRST
2013-10-07 10:13 - 2013-10-07 10:13 - 291072790 _____ C:\Windows\MEMORY.DMP
2013-10-07 10:13 - 2013-10-07 10:13 - 00150456 _____ C:\Windows\Minidump\100713-46659-01.dmp
2013-10-07 07:49 - 2013-10-07 07:49 - 00002043 _____ C:\Windows\WindowsUpdate.log
2013-10-07 07:47 - 2013-10-07 10:23 - 95025368 ____T C:\ProgramData\jw9bnqdr.pff
2013-10-07 07:46 - 2013-10-07 10:22 - 00001301 _____ C:\Windows\setupact.log
2013-10-07 07:46 - 2013-10-07 07:46 - 00000000 _____ C:\Windows\setuperr.log
2013-10-07 07:20 - 2013-10-07 07:44 - 00010312 _____ C:\Users\Andreas Dombert\Desktop\avgrep.txt
2013-10-07 06:59 - 2013-10-07 10:23 - 00000000 _____ C:\ProgramData\jw9bnqdr.ctrl
2013-10-07 06:59 - 2013-10-07 06:59 - 00180224 _____ C:\ProgramData\rdqnb9wj.plz
2013-09-23 17:51 - 2013-09-23 17:51 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-23 17:50 - 2013-09-23 17:50 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-09-23 17:50 - 2013-09-23 17:50 - 00000000 ____D C:\Program Files\iTunes
2013-09-23 17:50 - 2013-09-23 17:50 - 00000000 ____D C:\Program Files\iPod
2013-09-15 08:40 - 2013-08-10 04:59 - 01767936 _____ (Microsoft Corporation) C:\Windows\System32\wininet.dll
2013-09-15 08:40 - 2013-08-10 04:59 - 01141248 _____ (Microsoft Corporation) C:\Windows\System32\urlmon.dll
2013-09-15 08:40 - 2013-08-10 04:59 - 00042496 _____ (Microsoft Corporation) C:\Windows\System32\ie4uinit.exe
2013-09-15 08:40 - 2013-08-10 04:58 - 14332928 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 13761024 _____ (Microsoft Corporation) C:\Windows\System32\ieframe.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 02876928 _____ (Microsoft Corporation) C:\Windows\System32\jscript9.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 02048000 _____ (Microsoft Corporation) C:\Windows\System32\iertutil.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 00690688 _____ (Microsoft Corporation) C:\Windows\System32\jscript.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 00493056 _____ (Microsoft Corporation) C:\Windows\System32\msfeeds.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 00391168 _____ (Microsoft Corporation) C:\Windows\System32\ieui.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 00109056 _____ (Microsoft Corporation) C:\Windows\System32\iesysprep.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 00061440 _____ (Microsoft Corporation) C:\Windows\System32\iesetup.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 00039424 _____ (Microsoft Corporation) C:\Windows\System32\jsproxy.dll
2013-09-15 08:40 - 2013-08-10 04:58 - 00033280 _____ (Microsoft Corporation) C:\Windows\System32\iernonce.dll
2013-09-15 08:40 - 2013-08-10 04:07 - 02706432 _____ (Microsoft Corporation) C:\Windows\System32\mshtml.tlb
2013-09-15 08:40 - 2013-08-10 03:17 - 00071680 _____ (Microsoft Corporation) C:\Windows\System32\RegisterIEPKEYs.exe
2013-09-15 08:39 - 2013-07-26 02:55 - 12872704 _____ (Microsoft Corporation) C:\Windows\System32\shell32.dll
2013-09-15 08:39 - 2013-07-26 02:55 - 00180224 _____ (Microsoft Corporation) C:\Windows\System32\shdocvw.dll
2013-09-15 08:31 - 2013-08-08 02:03 - 02348544 _____ (Microsoft Corporation) C:\Windows\System32\win32k.sys
2013-09-15 08:31 - 2013-08-05 02:56 - 00133056 _____ (Microsoft Corporation) C:\Windows\System32\Drivers\ataport.sys
2013-09-15 08:31 - 2013-08-02 02:50 - 00169984 _____ (Microsoft Corporation) C:\Windows\System32\winsrv.dll
2013-09-15 08:31 - 2013-08-02 02:49 - 00868352 _____ (Microsoft Corporation) C:\Windows\System32\kernel32.dll
2013-09-15 08:31 - 2013-08-02 02:49 - 00293376 _____ (Microsoft Corporation) C:\Windows\System32\KernelBase.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00005120 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-file-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processthreads-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-sysinfo-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-synch-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-misc-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localregistry-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00004096 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-localization-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-processenvironment-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-namedpipe-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-memory-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-libraryloader-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-interlocked-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-heap-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-string-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-rtlsupport-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-profile-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-io-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-handle-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-fibers-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-errorhandling-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-delayload-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-debug-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-datetime-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 02:48 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-console-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 01:52 - 00271360 _____ (Microsoft Corporation) C:\Windows\System32\conhost.exe
2013-09-15 08:31 - 2013-08-02 01:43 - 00006144 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-security-base-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 01:43 - 00004608 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-threadpool-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 01:43 - 00003584 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-xstate-l1-1-0.dll
2013-09-15 08:31 - 2013-08-02 01:43 - 00003072 ____H (Microsoft Corporation) C:\Windows\System32\api-ms-win-core-util-l1-1-0.dll
2013-09-10 00:34 - 2013-09-10 00:34 - 00022328 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgidsshimx.sys

==================== One Month Modified Files and Folders =======

2013-10-07 11:51 - 2013-10-07 11:51 - 00000000 ____D C:\FRST
2013-10-07 10:23 - 2013-10-07 07:47 - 95025368 ____T C:\ProgramData\jw9bnqdr.pff
2013-10-07 10:23 - 2013-10-07 06:59 - 00000000 _____ C:\ProgramData\jw9bnqdr.ctrl
2013-10-07 10:23 - 2009-10-28 22:28 - 01650250 _____ C:\Users\Andreas Dombert\DesktopStCenter.txt
2013-10-07 10:22 - 2013-10-07 07:46 - 00001301 _____ C:\Windows\setupact.log
2013-10-07 10:22 - 2009-10-29 00:27 - 00000000 ____D C:\ProgramData\NVIDIA
2013-10-07 10:13 - 2013-10-07 10:13 - 291072790 _____ C:\Windows\MEMORY.DMP
2013-10-07 10:13 - 2013-10-07 10:13 - 00150456 _____ C:\Windows\Minidump\100713-46659-01.dmp
2013-10-07 10:13 - 2009-12-01 14:29 - 00000000 ____D C:\Windows\Minidump
2013-10-07 07:50 - 2009-07-14 05:34 - 00013536 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2013-10-07 07:50 - 2009-07-14 05:34 - 00013536 ____H C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2013-10-07 07:49 - 2013-10-07 07:49 - 00002043 _____ C:\Windows\WindowsUpdate.log
2013-10-07 07:46 - 2013-10-07 07:46 - 00000000 _____ C:\Windows\setuperr.log
2013-10-07 07:44 - 2013-10-07 07:20 - 00010312 _____ C:\Users\Andreas Dombert\Desktop\avgrep.txt
2013-10-07 07:35 - 2009-10-28 20:53 - 00000000 ____D C:\Windows\Panther
2013-10-07 06:59 - 2013-10-07 06:59 - 00180224 _____ C:\ProgramData\rdqnb9wj.plz
2013-10-06 20:01 - 2011-02-03 16:05 - 00000474 _____ C:\Windows\BRWMARK.INI
2013-10-06 19:09 - 2009-10-28 21:24 - 01507342 _____ C:\Windows\System32\PerfStringBackup.INI
2013-10-06 18:37 - 2010-12-19 18:27 - 00000000 ____D C:\ProgramData\MFAData
2013-10-04 09:14 - 2009-10-29 15:17 - 00000000 ____D C:\Users\Andreas Dombert\Documents\Ortrander Str
2013-10-04 08:29 - 2012-09-30 09:12 - 00000000 ____D C:\Program Files\AVG Secure Search
2013-10-04 08:29 - 2012-09-04 18:59 - 00037664 _____ (AVG Technologies) C:\Windows\System32\Drivers\avgtpx86.sys
2013-09-24 19:31 - 2010-11-03 15:22 - 00000000 ____D C:\Users\Andreas Dombert\Documents\Solaranlage Friedhofsgasse
2013-09-23 17:51 - 2013-09-23 17:51 - 00001753 _____ C:\Users\Public\Desktop\iTunes.lnk
2013-09-23 17:50 - 2013-09-23 17:50 - 00000000 ____D C:\ProgramData\188F1432-103A-4ffb-80F1-36B633C5C9E1
2013-09-23 17:50 - 2013-09-23 17:50 - 00000000 ____D C:\Program Files\iTunes
2013-09-23 17:50 - 2013-09-23 17:50 - 00000000 ____D C:\Program Files\iPod
2013-09-23 17:50 - 2013-02-17 16:22 - 00000000 ____D C:\Program Files\Common Files\Apple
2013-09-20 12:32 - 2012-07-23 19:24 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerApp.exe
2013-09-20 12:32 - 2012-07-23 19:23 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\System32\FlashPlayerCPLApp.cpl
2013-09-17 17:59 - 2010-01-04 14:47 - 00000000 ____D C:\Users\Andreas Dombert\Documents\Kind Lina
2013-09-17 17:59 - 2009-10-29 15:18 - 00000000 ____D C:\Users\Andreas Dombert\Documents\Kind Saskia
2013-09-17 13:34 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\rescache
2013-09-17 12:50 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\Microsoft.NET
2013-09-16 13:25 - 2009-07-14 05:33 - 00416440 _____ C:\Windows\System32\FNTCACHE.DAT
2013-09-15 08:56 - 2009-07-14 03:37 - 00000000 ____D C:\Windows\System32\de-DE
2013-09-15 08:55 - 2012-03-21 09:50 - 00000000 ____D C:\ProgramData\Microsoft Help
2013-09-13 16:44 - 2013-07-30 09:19 - 00000000 ____D C:\Windows\System32\MRT
2013-09-13 16:43 - 2012-09-30 09:12 - 00000951 _____ C:\Users\Public\Desktop\AVG 2013.lnk
2013-09-13 16:37 - 2009-10-28 22:50 - 76725432 _____ (Microsoft Corporation) C:\Windows\System32\MRT.exe
2013-09-10 00:34 - 2013-09-10 00:34 - 00022328 _____ (AVG Technologies CZ, s.r.o.) C:\Windows\System32\Drivers\avgidsshimx.sys

Files to move or delete:
====================
C:\ProgramData\jw9bnqdr.ctrl
C:\ProgramData\jw9bnqdr.pff
C:\ProgramData\rdqnb9wj.plz


Some content of TEMP:
====================
C:\Users\Andreas Dombert\AppData\Local\Temp\~tmf8098808937518248125.dll


==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== EXE ASSOCIATION =====================

HKLM\...\.exe: exefile => OK
HKLM\...\exefile\DefaultIcon: %1 => OK
HKLM\...\exefile\open\command: "%1" %* => OK

==================== Restore Points =========================

9
Restore point made on: 2013-07-11 17:38:37
Restore point made on: 2013-07-12 06:44:04
Restore point made on: 2013-07-30 09:18:26
Restore point made on: 2013-08-15 17:21:58
Restore point made on: 2013-08-31 06:39:36
Restore point made on: 2013-09-13 16:36:26
Restore point made on: 2013-09-15 08:35:19
Restore point made on: 2013-09-15 08:53:02
Restore point made on: 2013-09-23 17:48:09

==================== Memory info ===========================

Percentage of memory in use: 14%
Total physical RAM: 3055.18 MB
Available physical RAM: 2618.04 MB
Total Pagefile: 3053.46 MB
Available Pagefile: 2616.75 MB
Total Virtual: 2047.88 MB
Available Virtual: 1944.08 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:453.11 GB) (Free:377.72 GB) NTFS ==>[Drive with boot components (obtained from BCD)]
Drive d: (Recovery) (Fixed) (Total:12.65 GB) (Free:0.81 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive e: (07 Okt 2013) (CDROM) (Total:0.01 GB) (Free:0 GB) UDF
Drive f: (Lexar) (Removable) (Total:29.81 GB) (Free:29.81 GB) FAT32
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 466 GB) (Disk ID: 4958BB6C)
Partition 1: (Not Active) - (Size=13 GB) - (Type=27)
Partition 2: (Active) - (Size=453 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 30 GB) (Disk ID: 00000000)
Partition 1: (Active) - (Size=30 GB) - (Type=0C)


LastRegBack: 2013-09-24 17:52

==================== End Of Log ============================