Windows 7 Sperrbildschirm - BKA Virus

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version:05-07-2014 01
Ran by SYSTEM on MININT-QA83N2E on 08-07-2014 09:44:10
Running from H:\
Platform: Windows 7 Professional (X86) OS Language: English (United States)
Internet Explorer Version 9
Boot Mode: Recovery

The current controlset is ControlSet002
ATTENTION!:=====> If the system is bootable FRST must be run from normal or Safe mode to create a complete log.



==================== Registry (Whitelisted) ==================

HKLM\...\Run: [NvCplDaemon] => C:\windows\system32\NvCpl.dll [13830760 2009-11-04] (NVIDIA Corporation)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [8092192 2009-11-20] (Realtek Semiconductor)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1578280 2009-10-09] (Synaptics Incorporated)
HKLM\...\Run: [UCam_Menu] => C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe [222504 2009-05-19] (CyberLink Corp.)
HKLM\...\Run: [MSC] => C:\Program Files\Microsoft Security Client\msseces.exe [931200 2012-03-26] (Microsoft Corporation)
Winlogon\Notify\PCANotify: C:\Windows\system32\PCANotify.dll (Symantec Corporation)
Startup: C:\Users\deVries\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\autostart.lnk
ShortcutTarget: autostart.lnk -> C:\ProgramData\5F8E19AF73990C599C3E1D1B3F2B8EDD\f2bafh.cpp ()

========================== Services (Whitelisted) =================

S3 awhost32; C:\Program Files\Symantec\pcAnywhere\awhost32.exe [136568 2009-02-10] (Symantec Corporation)
S2 DisplayLinkService; C:\Program Files\DisplayLink Core Software\DisplayLinkManager.exe [5240168 2011-04-10] (DisplayLink Corp.)
S2 MsMpSvc; C:\Program Files\Microsoft Security Client\MsMpEng.exe [11552 2012-03-26] (Microsoft Corporation)
S3 NisSrv; C:\Program Files\Microsoft Security Client\NisSrv.exe [214952 2012-03-26] (Microsoft Corporation)
S2 OberonGameConsoleService; C:\Program Files\Samsung Casual Games\GameConsole\OberonGameConsoleService.exe [44312 2009-08-13] ()
S2 RichVideo; C:\Program Files\CyberLink\Shared files\RichVideo.exe [247152 2009-07-07] ()
S2 Winmgmt; C:\ProgramData\5F8E19AF73990C599C3E1D1B3F2B8EDD\f2bafh.cpp [141824 2014-07-05] ()

==================== Drivers (Whitelisted) ====================

S1 awecho; C:\Windows\System32\drivers\awechomd.sys [13368 2007-03-30] (Symantec Corporation)
S1 awlegacy; C:\Windows\System32\Drivers\awlegacy.sys [17848 2007-03-30] (Symantec Corporation)
S1 AW_HOST; C:\Windows\System32\drivers\aw_host5.sys [18232 2007-03-30] (Symantec Corporation)
S3 DisplayLinkUsbPort; C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_5.6.31854.0.sys [21888 2011-04-10] (hxxp://libusb-win32.sourceforge.net)
S3 dlkmd; C:\Windows\system32\drivers\dlkmd.sys [182896 2011-04-10] (DisplayLink Corp.)
S0 dlkmdldr; C:\Windows\System32\drivers\dlkmdldr.sys [14448 2011-04-10] (DisplayLink Corp.)
S1 Gernuwa; C:\Windows\System32\Drivers\Gernuwa.sys [20536 2007-03-30] (Symantec Corporation)
S3 MOSUMAC; C:\Windows\System32\DRIVERS\MOSUMAC.SYS [44032 2009-12-07] (--)
S0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [171064 2012-03-20] (Microsoft Corporation)
S3 yukonw7; C:\Windows\System32\DRIVERS\yk62x86.sys [315392 2009-09-28] ()

========================== Drivers MD5 =======================

C:\Windows\system32\drivers\1394ohci.sys ==> MD5 is legit
C:\Windows\System32\drivers\ACPI.sys ==> MD5 is legit
C:\Windows\system32\drivers\acpipmi.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adp94xx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpahci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\adpu320.sys ==> MD5 is legit
C:\Windows\system32\drivers\afd.sys 9EBBBA55060F786F0FCAA3893BFA2806
C:\Windows\system32\drivers\agp440.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\djsvs.sys ==> MD5 is legit
C:\Windows\system32\drivers\aliide.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdagp.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdk8.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\amdppm.sys ==> MD5 is legit
C:\Windows\system32\drivers\amdsata.sys D320BF87125326F996D4904FE24300FC
C:\Windows\system32\DRIVERS\amdsbs.sys ==> MD5 is legit
C:\Windows\System32\drivers\amdxata.sys 46387FB17B086D16DEA267D5BE23A2F2
C:\Windows\system32\drivers\appid.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\arcsas.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\asyncmac.sys ==> MD5 is legit
C:\Windows\System32\drivers\atapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\athr.sys DE0FBCCCD6AF0F0E7BF12E8D041CC48F
C:\Windows\System32\drivers\awechomd.sys C7DFD42D1906BB6F3AB7368A638C706A
C:\Windows\System32\Drivers\awlegacy.sys FCD631B75D01FECB673D52BFE87774AC
C:\Windows\System32\drivers\aw_host5.sys BE23B51D1AF7AB948F883F864454393D
C:\Windows\system32\DRIVERS\bxvbdx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\b57nd60x.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Beep.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\blbdrive.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\bowser.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltLo.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\BrFiltUp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Brserid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrSerWdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbMdm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\BrUsbSer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\bthmodem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\cdfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\cdrom.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\circlass.sys ==> MD5 is legit
C:\Windows\System32\CLFS.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\CmBatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\cmdide.sys ==> MD5 is legit
C:\Windows\System32\Drivers\cng.sys 247B4CE2DAB1160CD422D532D5241E1F
C:\Windows\System32\DRIVERS\compbatt.sys ==> MD5 is legit
C:\Windows\system32\drivers\CompositeBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\crcdisk.sys ==> MD5 is legit
C:\Windows\System32\drivers\csc.sys ==> MD5 is legit
C:\Windows\System32\Drivers\dfsc.sys ==> MD5 is legit
C:\Windows\System32\drivers\discache.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\disk.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\DisplayLinkUsbPort_5.6.31854.0.sys ADCCC97AD9AF22D019428B6773F23150
C:\Windows\system32\drivers\dlkmd.sys B19E212EF403999DADD5F337746DD21D
C:\Windows\System32\drivers\dlkmdldr.sys 4B9C06A5A539A46AAAFACE8BDB65218C
C:\Windows\System32\drivers\drmkaud.sys ==> MD5 is legit
C:\Windows\System32\drivers\dxgkrnl.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\evbdx.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\elxstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\errdev.sys ==> MD5 is legit
C:\Windows\System32\Drivers\exfat.sys ==> MD5 is legit
C:\Windows\System32\Drivers\fastfat.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\fdc.sys ==> MD5 is legit
C:\Windows\System32\drivers\fileinfo.sys ==> MD5 is legit
C:\Windows\System32\drivers\filetrace.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\flpydisk.sys ==> MD5 is legitB
C:\Windows\System32\drivers\fltmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\FsDepends.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\fssfltr.sys B74B0578FD1D3F897E95F2A2B69EA051
C:\Windows\System32\Drivers\Fs_Rec.sys 7DAE5EBCC80E45D3253F4923DC424D05
C:\Windows\System32\DRIVERS\fvevol.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\gagp30kx.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\GEARAspiWDM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Gernuwa.sys B390BC5AA09F333C5D95BE651C073564
C:\Windows\system32\drivers\hcw85cir.sys ==> MD5 is legit
C:\Windows\system32\drivers\HdAudio.sys A5EF29D5315111C80A5C1ABAD14C8972
C:\Windows\system32\drivers\HDAudBus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\HidBatt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidbth.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\hidir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\hidusb.sys ==> MD5 is legit
C:\Windows\system32\drivers\HpSAMD.sys ==> MD5 is legit
C:\Windows\System32\drivers\HTTP.sys ==> MD5 is legit
C:\Windows\System32\drivers\hwpolicy.sys ==> MD5 is legit
C:\Windows\system32\drivers\i8042prt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\iaStor.sys 0BAA4115DFFFD6A6D809A89D65E1281A
C:\Windows\system32\drivers\iaStorV.sys 5CD5F9A5444E6CDCB0AC89BD62D8B76E
C:\Windows\System32\DRIVERS\igdkmd32.sys AD626F6964F4D364D226C39E06872DD3
C:\Windows\system32\DRIVERS\iirsp.sys ==> MD5 is legit
C:\Windows\System32\drivers\RTKVHDA.sys 3202E26501E5E18C35DC2CC74709A704
C:\Windows\system32\drivers\intelide.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\intelppm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ipfltdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\IPMIDrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\ipnat.sys ==> MD5 is legit
C:\Windows\System32\drivers\irenum.sys ==> MD5 is legit
C:\Windows\system32\drivers\isapnp.sys ==> MD5 is legit
C:\Windows\system32\drivers\msiscsi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\kbdhid.sys ==> MD5 is legit
C:\Windows\System32\Drivers\ksecdd.sys B7895B4182C0D16F6EFADEB8081E8D36
C:\Windows\System32\Drivers\ksecpkg.sys D30159AC9237519FBC62C6EC247D2D46
C:\Windows\System32\DRIVERS\lltdio.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_fc.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_sas2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\lsi_scsi.sys ==> MD5 is legit
C:\Windows\system32\drivers\luafv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\megasas.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MegaSR.sys ==> MD5 is legit
C:\Windows\System32\drivers\modem.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\monitor.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MOSUMAC.SYS E66D10E798ADAF4E87D95576B93DB0D2
C:\Windows\System32\DRIVERS\mouclass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mouhid.sys ==> MD5 is legit
C:\Windows\System32\drivers\mountmgr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\MpFilter.sys D993BEA500E7382DC4E760BF4F35EFCB
C:\Windows\system32\drivers\mpio.sys ==> MD5 is legit
C:\Windows\System32\drivers\mpsdrv.sys ==> MD5 is legit
C:\Windows\system32\drivers\mrxdav.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\mrxsmb.sys 5D16C921E3671636C0EBA3BBAAC5FD25
C:\Windows\System32\DRIVERS\mrxsmb10.sys 6D17A4791ACA19328C685D256349FEFC
C:\Windows\System32\DRIVERS\mrxsmb20.sys B81F204D146000BE76651A50670A5E9E
C:\Windows\System32\drivers\msahci.sys ==> MD5 is legit
C:\Windows\system32\drivers\msdsm.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Msfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\mshidkmdf.sys ==> MD5 is legit
C:\Windows\System32\drivers\msisadrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSKSSRV.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPCLOCK.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSPQM.sys ==> MD5 is legit
C:\Windows\System32\Drivers\MsRPC.sys ==> MD5 is legit
C:\Windows\system32\drivers\mssmbios.sys ==> MD5 is legit
C:\Windows\System32\drivers\MSTEE.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\MTConfig.sys ==> MD5 is legit
C:\Windows\System32\Drivers\mup.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\nwifi.sys ==> MD5 is legit
C:\Windows\System32\drivers\ndis.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiscap.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndistapi.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndisuio.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\ndiswan.sys ==> MD5 is legit
C:\Windows\System32\Drivers\NDProxy.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbios.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\netbt.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\nfrd960.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\NisDrvWFP.sys B52F26BADE7D7E4A79706E3FD91834CD
C:\Windows\System32\drivers\ccdcmb.sys 357DDB51E03CAE598C096D95497373D0
C:\Windows\System32\drivers\ccdcmbo.sys 7CD443F9D36C80E152FADB274089577A
C:\Windows\System32\Drivers\Npfs.sys ==> MD5 is legit
C:\Windows\System32\drivers\nsiproxy.sys ==> MD5 is legit
C:\Windows\System32\Drivers\Ntfs.sys 81189C3D7763838E55C397759D49007A
C:\Windows\System32\Drivers\Null.sys ==> MD5 is legit
C:\Windows\System32\drivers\nvhda32v.sys D2F4C4B22969236382CA853B8DAA2D4E
C:\Windows\System32\DRIVERS\nvlddmkm.sys 104C0FE08DD64965CF788D91CCBB2CC6
C:\Windows\system32\drivers\nvraid.sys B3E25EE28883877076E0E1FF877D02E0
C:\Windows\system32\drivers\nvstor.sys 4380E59A170D88C4F1022EFF6719A8A4
C:\Windows\system32\drivers\nv_agp.sys ==> MD5 is legit
C:\Windows\system32\drivers\ohci1394.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\parport.sys ==> MD5 is legit
C:\Windows\System32\drivers\partmgr.sys 3F34A1B4C5F6475F320C275E63AFCE9B
C:\Windows\system32\DRIVERS\parvdm.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pccsmcfd.sys ==> MD5 is legit
C:\Windows\System32\drivers\pci.sys ==> MD5 is legit
C:\Windows\system32\drivers\pciide.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\pcmcia.sys ==> MD5 is legit
C:\Windows\System32\drivers\pcw.sys ==> MD5 is legit
C:\Windows\System32\drivers\peauth.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspptp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\processr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\pacer.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql2300.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\ql40xx.sys ==> MD5 is legit
C:\Windows\system32\drivers\qwavedrv.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasacd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\AgileVpn.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rasl2tp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\raspppoe.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rassstp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdbss.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rdpbus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\RDPCDD.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpdr.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdpencdd.sys ==> MD5 is legit
C:\Windows\System32\drivers\rdprefmp.sys ==> MD5 is legit
C:\Windows\System32\Drivers\RDPWD.sys F031683E6D1FEA157ABB2FF260B51E61
C:\Windows\System32\drivers\rdyboost.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\rspndr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\Rt86win7.sys 7DFD48E24479B68B258D8770121155A0
C:\windows\system32\Drivers\SABI.sys 6E5FBB7CBAEC47038B945D5E9B144A64
C:\Windows\system32\drivers\sbp2port.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\scfilter.sys ==> MD5 is legit
C:\Windows\System32\Drivers\secdrv.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serenum.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\serial.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sermouse.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffdisk.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_mmc.sys ==> MD5 is legit
C:\Windows\system32\drivers\sffp_sd.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sfloppy.sys ==> MD5 is legit
C:\Windows\system32\drivers\sisagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\SiSRaid2.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\sisraid4.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\smb.sys ==> MD5 is legit
C:\Windows\System32\Drivers\spldr.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\srv.sys E4C2764065D66EA1D2D3EBC28FE99C46
C:\Windows\System32\DRIVERS\srv2.sys 03F0545BD8D4C77FA0AE1CEEDFCC71AB
C:\Windows\System32\DRIVERS\srvnet.sys BE6BD660CAA6F291AE06A718A4FA8ABC
C:\Windows\system32\DRIVERS\stexstor.sys ==> MD5 is legit
C:\Windows\system32\drivers\swenum.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\SynTP.sys 215A45246C6E2D0A9C263CE1786C8D8A
C:\Windows\System32\drivers\tcpip.sys 7FA2E0F8B072BD04B77B421480B6CC22
C:\Windows\System32\DRIVERS\tcpip.sys 7FA2E0F8B072BD04B77B421480B6CC22
C:\Windows\System32\drivers\tcpipreg.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdpipe.sys ==> MD5 is legit
C:\Windows\System32\drivers\tdtcp.sys 2C2C5AFE7EE4F620D69C23C0617651A8
C:\Windows\System32\DRIVERS\tdx.sys ==> MD5 is legit
C:\Windows\system32\drivers\termdd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tssecsrv.sys ==> MD5 is legit
C:\Windows\System32\drivers\tsusbflt.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\tunnel.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\uagp35.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\udfs.sys ==> MD5 is legit
C:\Windows\system32\drivers\uliagpkx.sys ==> MD5 is legit
C:\Windows\system32\drivers\umbus.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\umpass.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbser_lowerflt.sys 15629E4D65F97AB5432D6D9597CF6A33
C:\Windows\System32\Drivers\usbaapl.sys 83CAFCB53201BBAC04D822F32438E244
C:\Windows\System32\drivers\usbaudio.sys 1D9F2BD026E8E2D45033A4DF3F16B78C
C:\Windows\System32\DRIVERS\usbccgp.sys BD9C55D7023C5DE374507ACC7A14E2AC
C:\Windows\system32\drivers\usbcir.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\usbehci.sys F92DE757E4B7CE9C07C5E65423F3AE3B
C:\Windows\System32\DRIVERS\usbhub.sys 8DC94AEC6A7E644A06135AE7506DC2E9
C:\Windows\system32\DRIVERS\usbohci.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\usbprint.sys ==> MD5 is legit
C:\Windows\System32\drivers\usbser.sys 31181DE6190B39FC8007DFFD1A48FFD6
C:\Windows\System32\DRIVERS\usbser_lowerfltj.sys 5C17E6A11AA8BE53F79FD364BA19F0CE
C:\Windows\System32\DRIVERS\USBSTOR.SYS F991AB9CC6B908DB552166768176896A
C:\Windows\System32\DRIVERS\usbuhci.sys 68DF884CF41CDADA664BEB01DAF67E3D
C:\Windows\System32\Drivers\usbvideo.sys 45F4E7BF43DB40A6C6B4D92C76CBC3F2
C:\Windows\System32\drivers\vdrvroot.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vgapnp.sys ==> MD5 is legit
C:\Windows\System32\drivers\vga.sys ==> MD5 is legit
C:\Windows\system32\drivers\vhdmp.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaagp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\viac7.sys ==> MD5 is legit
C:\Windows\system32\drivers\viaide.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgr.sys ==> MD5 is legit
C:\Windows\System32\drivers\volmgrx.sys ==> MD5 is legit
C:\Windows\System32\drivers\volsnap.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\vsmraid.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwifibus.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\vwififlt.sys 7090D3436EEB4E7DA3373090A23448F7
C:\Windows\system32\DRIVERS\wacompen.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wanarp.sys ==> MD5 is legit
C:\Windows\system32\DRIVERS\wd.sys ==> MD5 is legit
C:\Windows\System32\drivers\Wdf01000.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\wfplwf.sys ==> MD5 is legit
C:\Windows\System32\drivers\wimmount.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WinUsb.sys A67E5F9A400F3BD1BE3D80613B45F708
C:\Windows\system32\drivers\wmiacpi.sys ==> MD5 is legit
C:\Windows\system32\drivers\ws2ifsl.sys ==> MD5 is legit
C:\Windows\System32\drivers\WudfPf.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\WUDFRd.sys ==> MD5 is legit
C:\Windows\System32\DRIVERS\yk62x86.sys 30B73EB97218A16CBC6DE535782A1B35

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-07-08 09:40 - 2014-07-08 09:44 - 00000000 ____D () C:\FRST
2014-07-07 01:45 - 2014-07-07 01:46 - 00000117 _____ () C:\ProgramData\RUNDLL32.EXE-3688-F.txt
2014-07-06 23:42 - 2014-07-06 23:57 - 00000740 _____ () C:\ProgramData\RUNDLL32.EXE-2768-F.txt
2014-07-06 23:42 - 2014-07-06 23:42 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-07-06 23:37 - 2014-07-07 01:51 - 00000517 _____ () C:\ProgramData\RUNDLL32.EXE-3764-F.txt
2014-07-06 23:32 - 2014-07-06 23:33 - 00000173 _____ () C:\ProgramData\RUNDLL32.EXE-2912-F.txt
2014-07-06 12:17 - 2014-07-06 12:18 - 00000117 _____ () C:\ProgramData\RUNDLL32.EXE-1016-F.txt
2014-07-06 12:16 - 2014-07-06 12:16 - 00000173 _____ () C:\ProgramData\RUNDLL32.EXE-3696-F.txt
2014-07-06 09:56 - 2014-07-06 09:56 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2316-F.txt
2014-07-06 09:14 - 2014-07-07 01:58 - 00000666 _____ () C:\ProgramData\RUNDLL32.EXE-3544-F.txt
2014-07-05 22:56 - 2014-07-05 22:56 - 00000735 _____ () C:\ProgramData\RUNDLL32.EXE-2956-F.txt
2014-07-05 15:35 - 2014-07-05 15:35 - 00000057 _____ () C:\ProgramData\RUNDLL32.EXE-928-F.txt
2014-07-05 14:37 - 2014-07-05 14:40 - 00003005 _____ () C:\ProgramData\RUNDLL32.EXE-308-F.txt
2014-07-05 14:24 - 2014-07-05 14:28 - 00003759 _____ () C:\ProgramData\RUNDLL32.EXE-2584-F.txt
2014-07-05 14:16 - 2014-07-05 14:17 - 00000810 _____ () C:\ProgramData\RUNDLL32.EXE-2700-F.txt
2014-07-05 13:50 - 2014-07-05 13:52 - 00001885 _____ () C:\ProgramData\RUNDLL32.EXE-3148-F.txt
2014-07-05 13:41 - 2014-07-05 13:44 - 00003010 _____ () C:\ProgramData\RUNDLL32.EXE-3500-F.txt
2014-07-05 13:39 - 2014-07-05 13:39 - 00000378 _____ () C:\ProgramData\RUNDLL32.EXE-2460-F.txt
2014-07-05 13:35 - 2014-07-05 13:36 - 00003315 _____ () C:\ProgramData\RUNDLL32.EXE-4836-F.txt
2014-07-05 13:33 - 2014-07-05 13:33 - 00000000 ____D () C:\ProgramData\5F8E19AF73990C599C3E1D1B3F2B8EDD
2014-06-15 12:12 - 2014-06-15 12:09 - 00000404 _____ () C:\Users\deVries\Desktop\Lieblingsstauden - Pflanzenversand Gaissmayer.url

==================== One Month Modified Files and Folders =======

2014-07-08 09:44 - 2014-07-08 09:40 - 00000000 ____D () C:\FRST
2014-07-07 01:58 - 2014-07-06 09:14 - 00000666 _____ () C:\ProgramData\RUNDLL32.EXE-3544-F.txt
2014-07-07 01:57 - 2010-10-27 12:22 - 00094713 _____ () C:\Windows\setupact.log
2014-07-07 01:52 - 2009-12-04 15:54 - 01980811 _____ () C:\Windows\WindowsUpdate.log
2014-07-07 01:52 - 2009-07-13 20:34 - 00022288 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-07-07 01:52 - 2009-07-13 20:34 - 00022288 ____H () C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-07-07 01:51 - 2014-07-06 23:37 - 00000517 _____ () C:\ProgramData\RUNDLL32.EXE-3764-F.txt
2014-07-07 01:46 - 2014-07-07 01:45 - 00000117 _____ () C:\ProgramData\RUNDLL32.EXE-3688-F.txt
2014-07-06 23:57 - 2014-07-06 23:42 - 00000740 _____ () C:\ProgramData\RUNDLL32.EXE-2768-F.txt
2014-07-06 23:42 - 2014-07-06 23:42 - 00000000 ____D () C:\ProgramData\HitmanPro
2014-07-06 23:33 - 2014-07-06 23:32 - 00000173 _____ () C:\ProgramData\RUNDLL32.EXE-2912-F.txt
2014-07-06 12:18 - 2014-07-06 12:17 - 00000117 _____ () C:\ProgramData\RUNDLL32.EXE-1016-F.txt
2014-07-06 12:16 - 2014-07-06 12:16 - 00000173 _____ () C:\ProgramData\RUNDLL32.EXE-3696-F.txt
2014-07-06 09:56 - 2014-07-06 09:56 - 00000114 _____ () C:\ProgramData\RUNDLL32.EXE-2316-F.txt
2014-07-05 22:56 - 2014-07-05 22:56 - 00000735 _____ () C:\ProgramData\RUNDLL32.EXE-2956-F.txt
2014-07-05 15:35 - 2014-07-05 15:35 - 00000057 _____ () C:\ProgramData\RUNDLL32.EXE-928-F.txt
2014-07-05 14:40 - 2014-07-05 14:37 - 00003005 _____ () C:\ProgramData\RUNDLL32.EXE-308-F.txt
2014-07-05 14:28 - 2014-07-05 14:24 - 00003759 _____ () C:\ProgramData\RUNDLL32.EXE-2584-F.txt
2014-07-05 14:17 - 2014-07-05 14:16 - 00000810 _____ () C:\ProgramData\RUNDLL32.EXE-2700-F.txt
2014-07-05 13:52 - 2014-07-05 13:50 - 00001885 _____ () C:\ProgramData\RUNDLL32.EXE-3148-F.txt
2014-07-05 13:44 - 2014-07-05 13:41 - 00003010 _____ () C:\ProgramData\RUNDLL32.EXE-3500-F.txt
2014-07-05 13:39 - 2014-07-05 13:39 - 00000378 _____ () C:\ProgramData\RUNDLL32.EXE-2460-F.txt
2014-07-05 13:36 - 2014-07-05 13:35 - 00003315 _____ () C:\ProgramData\RUNDLL32.EXE-4836-F.txt
2014-07-05 13:33 - 2014-07-05 13:33 - 00000000 ____D () C:\ProgramData\5F8E19AF73990C599C3E1D1B3F2B8EDD
2014-07-05 12:43 - 2009-07-26 12:06 - 01529084 _____ () C:\Windows\System32\PerfStringBackup.INI
2014-06-16 00:59 - 2009-07-13 18:37 - 00000000 ____D () C:\Windows\System32\NDF
2014-06-15 12:09 - 2014-06-15 12:12 - 00000404 _____ () C:\Users\deVries\Desktop\Lieblingsstauden - Pflanzenversand Gaissmayer.url
2014-06-13 10:16 - 2013-09-13 11:38 - 00002121 _____ () C:\Users\Public\Desktop\Google Chrome.lnk

==================== Known DLLs (Whitelisted) ============


==================== Bamital & volsnap Check =================

C:\Windows\explorer.exe => MD5 is legit
C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit

==================== Restore Points  =========================

Restore point made on: 2014-05-15 05:55:08
Restore point made on: 2014-05-19 09:42:24
Restore point made on: 2014-05-23 05:41:04
Restore point made on: 2014-05-27 03:50:09
Restore point made on: 2014-05-30 12:19:45
Restore point made on: 2014-06-03 11:28:40
Restore point made on: 2014-06-06 13:39:10
Restore point made on: 2014-06-10 12:26:49
Restore point made on: 2014-06-13 13:20:54
Restore point made on: 2014-06-18 11:39:26
Restore point made on: 2014-06-22 05:06:34
Restore point made on: 2014-06-26 01:47:13
Restore point made on: 2014-06-29 05:18:10
Restore point made on: 2014-07-03 12:00:25

==================== BCD ================================

Windows Boot Manager
--------------------
identifier              {bootmgr}
device                  partition=Y:
description             Windows Boot Manager
locale                  de-DE
inherit                 {globalsettings}
default                 {default}
resumeobject            {484df4a6-e1c3-11de-9229-0024543ab607}
displayorder            {default}
toolsdisplayorder       {memdiag}
timeout                 30

Windows Boot Loader
-------------------
identifier              {default}
device                  partition=C:
path                    \windows\system32\winload.exe
description             Windows 7
locale                  de-DE
inherit                 {bootloadersettings}
recoverysequence        {current}
recoveryenabled         Yes
osdevice                partition=C:
systemroot              \windows
resumeobject            {484df4a6-e1c3-11de-9229-0024543ab607}
nx                      OptIn

Windows Boot Loader
-------------------
identifier              {current}
device                  ramdisk=[C:]\Recovery\484df4a8-e1c3-11de-9229-0024543ab607\Winre.wim,{484df4a9-e1c3-11de-9229-0024543ab607}
path                    \windows\system32\winload.exe
description             Windows Recovery Environment
inherit                 {bootloadersettings}
osdevice                ramdisk=[C:]\Recovery\484df4a8-e1c3-11de-9229-0024543ab607\Winre.wim,{484df4a9-e1c3-11de-9229-0024543ab607}
systemroot              \windows
nx                      OptIn
winpe                   Yes

Resume from Hibernate
---------------------
identifier              {484df4a6-e1c3-11de-9229-0024543ab607}
device                  partition=C:
path                    \windows\system32\winresume.exe
description             Windows Resume Application
locale                  de-DE
inherit                 {resumeloadersettings}
filedevice              partition=C:
filepath                \hiberfil.sys
pae                     No
debugoptionenabled      No

Windows Memory Tester
---------------------
identifier              {memdiag}
device                  partition=Y:
path                    \boot\memtest.exe
description             Windows Memory Diagnostic
locale                  de-DE
inherit                 {globalsettings}
badmemoryaccess         Yes

EMS Settings
------------
identifier              {emssettings}
bootems                 Yes

Debugger Settings
-----------------
identifier              {dbgsettings}
debugtype               Serial
debugport               1
baudrate                115200

RAM Defects
-----------
identifier              {badmemory}

Global Settings
---------------
identifier              {globalsettings}
inherit                 {dbgsettings}
                        {emssettings}
                        {badmemory}

Boot Loader Settings
--------------------
identifier              {bootloadersettings}
inherit                 {globalsettings}
                        {hypervisorsettings}

Hypervisor Settings
-------------------
identifier              {hypervisorsettings}
hypervisordebugtype     Serial
hypervisordebugport     1
hypervisorbaudrate      115200

Resume Loader Settings
----------------------
identifier              {resumeloadersettings}
inherit                 {globalsettings}

Device options
--------------
identifier              {484df4a9-e1c3-11de-9229-0024543ab607}
description             Ramdisk Options
ramdisksdidevice        partition=C:
ramdisksdipath          \Recovery\484df4a8-e1c3-11de-9229-0024543ab607\boot.sdi


==================== Memory info =========================== 

Percentage of memory in use: 15%
Total physical RAM: 3036.61 MB
Available physical RAM: 2558.04 MB
Total Pagefile: 3032.83 MB
Available Pagefile: 2566.07 MB
Total Virtual: 2047.88 MB
Available Virtual: 1947.64 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:141.49 GB) (Free:101.18 GB) NTFS
Drive e: () (Fixed) (Total:141.5 GB) (Free:132.18 GB) NTFS
Drive f: (RECOVERY) (Fixed) (Total:15 GB) (Free:3.06 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive h: () (Removable) (Total:1.85 GB) (Free:1.82 GB) NTFS
Drive x: (Boot) (Fixed) (Total:0.03 GB) (Free:0.03 GB) NTFS
Drive y: (SYSTEM) (Fixed) (Total:0.1 GB) (Free:0.07 GB) NTFS ==>[System with boot components (obtained from reading drive)]

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 298 GB) (Disk ID: 711561A4)
Partition 1: (Not Active) - (Size=15 GB) - (Type=27)
Partition 2: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=141 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=141 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (Size: 2 GB) (Disk ID: C4C52B90)
Partition 1: (Not Active) - (Size=2 GB) - (Type=07 NTFS)


LastRegBack: 2014-07-01 12:11

==================== End Of Log ============================