| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: GVU Trojaner auf Win7 entfernenWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
27.03.2013, 18:00
| #1 |
 |  GVU Trojaner auf Win7 entfernen Hallo, ich habe mir gestern den GVU-Trojaner eingefangen, der mein Notebook mit Win7 komplett blockierte. Bin ein absoluter Laie, der sich im Vorfeld hier quergelesen hat (und hoffentlich das Gelesene auch verstanden hat?) Meine bisherigen Maßnahmen: - Versuch im abgesicherten Modus zu starten - ohne Erfolg - Versuch einer "Systemwiederherstellung" (Abgesicherter Modus mit Eingabeaufforderung) - erfolgreich und Wiederherstellungszeitpunkt 24.03. - Zusätzlich habe ich auf einem nicht infizierten 2. Rechner eine "OTLPE-CD" gebrannt" - für alle Fälle - auf dem infizierten System habe ich über OTL eine die beiden OTL.txt und Extras.txt erstellt, die ich als Archiv angehängt habe. Bitte helft mir weiter! Wie muss ich weiter vorgehen? und Taucht nach dem Herunterfahren aus dieser "Systemwiederherstellung-Status" wieder die GVU-Sperrseite auf? Und wie soll ich dann starten? Vielen Dank im voraus! |
|
28.03.2013, 15:57
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | GVU Trojaner auf Win7 entfernen Hallo und
__________________ Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner? Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520 Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
28.03.2013, 18:34
| #3 |
| | GVU Trojaner auf Win7 entfernen Hallo Cosinus,
__________________Danke für deine Hilfe. Nein, weitere Logs habe ich nicht. Sorry, jetzt habe ich ohne einen erneuten Scan zu starten in Avira doch noch was gefunden Code:
ATTFilter
Typ: Datei
Quelle: C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\lkickppl.default\Cache\_CACHE_001_
Status: Infiziert
Quarantäne-Objekt: 55fd0ab8.qua
Wiederhergestellt: NEIN
Zu Avira hochgeladen: NEIN
Betriebssystem: Windows XP/VISTA Workstation/Windows 7
Suchengine: 8.02.10.187
Virendefinitionsdatei: 7.11.48.156
Meldung: HTML/Infected.WebPage.Gen2
Datum/Uhrzeit: 02.11.2012, 11:57
|
|
29.03.2013, 00:38
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | GVU Trojaner auf Win7 entfernen Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
Note: Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread. Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards. Rootkitscan mit GMER Bitte lade dir  GMER herunter: (Dateiname zufällig)
Tauchen Probleme auf?
Anschließend bitte MBAR ausführen: Malwarebytes Anti-Rootkit (MBAR) Downloade dir bitte  Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
29.03.2013, 13:48
| #5 |
| | GVU Trojaner auf Win7 entfernen Hallo Cosinus, hier das MBAR-Logfile. Beim 2. Scan wurde nichts mehr gefunden. Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.01.0.1021
www.malwarebytes.org
Database version: v2013.02.15.09
Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
*** :: ***-PC [administrator]
29.03.2013 12:41:34
mbar-log-2013-03-29 (12-41-34).txt
Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 36314
Time elapsed: 27 minute(s), 25 second(s)
Memory Processes Detected: 1
c:\Windows\svchost.exe (Trojan.Agent) -> 3948 -> Delete on reboot.
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 23
HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\TYPELIB\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\INTERFACE\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\INTERFACE\{DB1F5554-582C-4F53-82CC-458D2C04A2F1} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{DB1F5554-582C-4F53-82CC-458D2C04A2F1} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
Registry Values Detected: 5
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: ;áÃzÊ;XA³0öm»Áµ -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: VShareTB -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: -> Delete on reboot.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|svchost (Trojan.Agent) -> Data: C:\Windows\svchost.exe -> Delete on reboot.
Registry Data Items Detected: 1
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page (Hijack.StartPage) -> Bad: (hxxp://startsear.ch/?aff=1) Good: (hxxp://www.google.com) -> Delete on reboot.
Folders Detected: 1
c:\Users\***\AppData\Roaming\loadtbs (PUP.LoadTubes) -> Delete on reboot.
Files Detected: 15
c:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (PUP.VShareRedir) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\ytdl.exe (PUP.LoadTubes) -> Delete on reboot.
c:\Program Files (x86)\Mozilla Firefox\plugins\npmieze.dll (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Local\Temp\12593258.Uninstall\Uninstall.exe (Adware.Agent) -> Delete on reboot.
c:\Users\***\AppData\Local\Temp\ltsilentio\npm.dll (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Local\Temp\ltsilentio\ytdl.exe (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\Pictures\Desktop\Downloads\SoftonicDownloader_fuer_free-video-dub.exe (PUP.OfferBundler.ST) -> Delete on reboot.
c:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\keyHash.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\config.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\domHash.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\evHash.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\uninstall.exe (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\updateHash.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\skype.dat (Trojan.Agent) -> Delete on reboot.
(end)
|
|
30.03.2013, 01:15
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | GVU Trojaner auf Win7 entfernen Was ist mit dem GMER-Log?
__________________ --> GVU Trojaner auf Win7 entfernen |
|
30.03.2013, 09:59
| #7 |
| | GVU Trojaner auf Win7 entfernenCode:
ATTFilter GMER 2.1.19155 - hxxp://www.gmer.net
Rootkit scan 2013-03-29 10:28:40
Windows 6.1.7600 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1 596,17GB
Running: gmer_2.1.19155.exe; Driver: C:\Users\Tewes\AppData\Local\Temp\fwdoipow.sys
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE[476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077601465 2 bytes [60, 77]
.text C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE[476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776014bb 2 bytes [60, 77]
.text ... * 2
.text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077601465 2 bytes [60, 77]
.text C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776014bb 2 bytes [60, 77]
.text ... * 2
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2628] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter 0000000075d8d03c 5 bytes [33, C0, C2, 04, 00]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077601465 2 bytes [60, 77]
.text C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776014bb 2 bytes [60, 77]
.text ... * 2
.text C:\Windows\svchost.exe[7120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077601465 2 bytes [60, 77]
.text C:\Windows\svchost.exe[7120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776014bb 2 bytes [60, 77]
.text ... * 2
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077601465 2 bytes [60, 77]
.text C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776014bb 2 bytes [60, 77]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000077601465 2 bytes [60, 77]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000776014bb 2 bytes [60, 77]
.text ... * 2
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
Geändert von christalex (30.03.2013 um 10:06 Uhr) |
|
30.03.2013, 15:42
| #8 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | GVU Trojaner auf Win7 entfernenZitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
31.03.2013, 10:13
| #9 |
| | GVU Trojaner auf Win7 entfernen Hallo, hätt ich gleich sagen sollen: hab aktuell probleme mit der dsl-verbindung. Konnte daher vor dem ersten mbar-scan nicht updaten. Bin nach dem mbar-log post nochmal mit schlechtem gewissen zu einem bekannten und von dessen verbindung aus nochmal geupdated, gescannt. Hat nichts weiter mehr gefunden |
|
01.04.2013, 13:53
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | GVU Trojaner auf Win7 entfernen aswMBR Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). TDSS-Killer Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.04.2013, 19:01
| #11 |
| | GVU Trojaner auf Win7 entfernen Hallo, aswMBR ist abgebrochen während AVAST Engin Scan bei Verzeichnis C:\Windows\assembly\GAC_MSIL\Microsoft.xxxx Bis dahin keine roten Zeilen. Danach wie beschrieben mit AV Scan = none Code:
ATTFilter aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-04-01 19:52:04
-----------------------------
19:52:04.656 OS Version: Windows x64 6.1.7600
19:52:04.656 Number of processors: 4 586 0x2505
19:52:04.656 ComputerName: ***-PC UserName: ***
19:53:07.147 Initialize success
19:53:18.582 AVAST engine defs: 13040100
19:53:44.930 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:53:44.930 Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3
19:53:45.071 Disk 0 MBR read successfully
19:53:45.071 Disk 0 MBR scan
19:53:45.086 Disk 0 unknown MBR code
19:53:45.102 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048
19:53:45.117 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 559355 MB offset 206848
19:53:45.149 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 50000 MB offset 1145765888
19:53:45.180 Disk 0 Partition 4 00 12 Compaq diag NTFS 1023 MB offset 1248165888
19:53:45.227 Disk 0 scanning C:\Windows\system32\drivers
19:53:58.268 Service scanning
19:54:29.477 Modules scanning
19:54:29.492 Disk 0 trace - called modules:
19:54:29.524 ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
19:54:29.524 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048f8060]
19:54:29.539 3 CLASSPNP.SYS[fffff88001a2f43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004631050]
19:54:29.539 Scan finished successfully
19:54:37.870 Disk 0 MBR has been saved successfully to "C:\Users\***\Pictures\Desktop\MBR.dat"
19:54:37.870 The log file has been saved successfully to "C:\Users\***\Pictures\Desktop\aswMBR.txt"
Beim zweiten Mal ging's Hier das Logfile von TDSSKiller: Code:
ATTFilter 20:05:52.0705 8148 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
20:05:52.0907 8148 ============================================================
20:05:52.0907 8148 Current date / time: 2013/04/01 20:05:52.0907
20:05:52.0907 8148 SystemInfo:
20:05:52.0907 8148
20:05:52.0907 8148 OS Version: 6.1.7600 ServicePack: 0.0
20:05:52.0907 8148 Product type: Workstation
20:05:52.0907 8148 ComputerName: ***-PC
20:05:52.0907 8148 UserName: ***
20:05:52.0907 8148 Windows directory: C:\Windows
20:05:52.0907 8148 System windows directory: C:\Windows
20:05:52.0907 8148 Running under WOW64
20:05:52.0907 8148 Processor architecture: Intel x64
20:05:52.0907 8148 Number of processors: 4
20:05:52.0907 8148 Page size: 0x1000
20:05:52.0907 8148 Boot type: Normal boot
20:05:52.0907 8148 ============================================================
20:05:53.0282 8148 Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:05:53.0282 8148 ============================================================
20:05:53.0282 8148 \Device\Harddisk0\DR0:
20:05:53.0282 8148 MBR partitions:
20:05:53.0282 8148 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
20:05:53.0282 8148 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x4447D800
20:05:53.0282 8148 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x444B0000, BlocksNum 0x61A8000
20:05:53.0282 8148 ============================================================
20:05:53.0313 8148 C: <-> \Device\Harddisk0\DR0\Partition2
20:05:53.0360 8148 D: <-> \Device\Harddisk0\DR0\Partition3
20:05:53.0360 8148 ============================================================
20:05:53.0360 8148 Initialize success
20:05:53.0360 8148 ============================================================
20:06:07.0837 7612 ============================================================
20:06:07.0837 7612 Scan started
20:06:07.0837 7612 Mode: Manual; SigCheck; TDLFS;
20:06:07.0837 7612 ============================================================
20:06:08.0164 7612 ================ Scan system memory ========================
20:06:08.0164 7612 System memory - ok
20:06:08.0164 7612 ================ Scan services =============================
20:06:08.0305 7612 [ 969C91060CBB5D17CB8440B5F78B4C51 ] 1394ohci C:\Windows\system32\DRIVERS\1394ohci.sys
20:06:08.0414 7612 1394ohci - ok
20:06:08.0461 7612 [ 6F11E88748CDEFD2F76AA215F97DDFE5 ] ACPI C:\Windows\system32\DRIVERS\ACPI.sys
20:06:08.0492 7612 ACPI - ok
20:06:08.0539 7612 [ 63B05A0420CE4BF0E4AF6DCC7CADA254 ] AcpiPmi C:\Windows\system32\DRIVERS\acpipmi.sys
20:06:08.0585 7612 AcpiPmi - ok
20:06:08.0726 7612 [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:06:08.0757 7612 AdobeFlashPlayerUpdateSvc - ok
20:06:08.0819 7612 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
20:06:08.0851 7612 adp94xx - ok
20:06:08.0897 7612 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
20:06:08.0929 7612 adpahci - ok
20:06:08.0944 7612 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
20:06:08.0960 7612 adpu320 - ok
20:06:08.0991 7612 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
20:06:09.0053 7612 AeLookupSvc - ok
20:06:09.0100 7612 [ DB9D6C6B2CD95A9CA414D045B627422E ] AFD C:\Windows\system32\drivers\afd.sys
20:06:09.0131 7612 AFD - ok
20:06:09.0178 7612 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\DRIVERS\agp440.sys
20:06:09.0194 7612 agp440 - ok
20:06:09.0209 7612 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
20:06:09.0256 7612 ALG - ok
20:06:09.0303 7612 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\DRIVERS\aliide.sys
20:06:09.0334 7612 aliide - ok
20:06:09.0365 7612 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\DRIVERS\amdide.sys
20:06:09.0381 7612 amdide - ok
20:06:09.0412 7612 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
20:06:09.0475 7612 AmdK8 - ok
20:06:09.0506 7612 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
20:06:09.0553 7612 AmdPPM - ok
20:06:09.0584 7612 [ EC7EBAB00A4D8448BAB68D1E49B4BEB9 ] amdsata C:\Windows\system32\drivers\amdsata.sys
20:06:09.0615 7612 amdsata - ok
20:06:09.0662 7612 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
20:06:09.0693 7612 amdsbs - ok
20:06:09.0693 7612 [ DB27766102C7BF7E95140A2AA81D042E ] amdxata C:\Windows\system32\drivers\amdxata.sys
20:06:09.0709 7612 amdxata - ok
20:06:09.0833 7612 [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
20:06:09.0865 7612 AntiVirSchedulerService - ok
20:06:09.0911 7612 [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
20:06:09.0927 7612 AntiVirService - ok
20:06:09.0958 7612 [ 42FD751B27FA0E9C69BB39F39E409594 ] AppID C:\Windows\system32\drivers\appid.sys
20:06:10.0021 7612 AppID - ok
20:06:10.0052 7612 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
20:06:10.0114 7612 AppIDSvc - ok
20:06:10.0161 7612 [ D065BE66822847B7F127D1F90158376E ] Appinfo C:\Windows\System32\appinfo.dll
20:06:10.0208 7612 Appinfo - ok
20:06:10.0333 7612 [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:06:10.0348 7612 Apple Mobile Device - ok
20:06:10.0379 7612 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys
20:06:10.0395 7612 arc - ok
20:06:10.0426 7612 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
20:06:10.0442 7612 arcsas - ok
20:06:10.0473 7612 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
20:06:10.0567 7612 AsyncMac - ok
20:06:10.0598 7612 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\DRIVERS\atapi.sys
20:06:10.0629 7612 atapi - ok
20:06:10.0676 7612 [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:06:10.0754 7612 AudioEndpointBuilder - ok
20:06:10.0769 7612 [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioSrv C:\Windows\System32\Audiosrv.dll
20:06:10.0801 7612 AudioSrv - ok
20:06:10.0863 7612 [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
20:06:10.0894 7612 avgntflt - ok
20:06:10.0941 7612 [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
20:06:10.0972 7612 avipbb - ok
20:06:11.0003 7612 [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
20:06:11.0019 7612 avkmgr - ok
20:06:11.0081 7612 [ 8DFA2EC772F97ED02B384DB88641B367 ] AVM IGD CTRL Service C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
20:06:11.0128 7612 AVM IGD CTRL Service ( UnsignedFile.Multi.Generic ) - warning
20:06:11.0128 7612 AVM IGD CTRL Service - detected UnsignedFile.Multi.Generic (1)
20:06:11.0175 7612 [ B20B5FA5CA050E9926E4D1DB81501B32 ] AxInstSV C:\Windows\System32\AxInstSV.dll
20:06:11.0237 7612 AxInstSV - ok
20:06:11.0284 7612 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
20:06:11.0347 7612 b06bdrv - ok
20:06:11.0393 7612 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
20:06:11.0440 7612 b57nd60a - ok
20:06:11.0487 7612 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
20:06:11.0534 7612 BDESVC - ok
20:06:11.0565 7612 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
20:06:11.0659 7612 Beep - ok
20:06:11.0721 7612 [ 4992C609A6315671463E30F6512BC022 ] BFE C:\Windows\System32\bfe.dll
20:06:11.0799 7612 BFE - ok
20:06:11.0861 7612 [ 7F0C323FE3DA28AA4AA1BDA3F575707F ] BITS C:\Windows\System32\qmgr.dll
20:06:11.0971 7612 BITS - ok
20:06:12.0002 7612 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
20:06:12.0049 7612 blbdrive - ok
20:06:12.0127 7612 [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:06:12.0158 7612 Bonjour Service - ok
20:06:12.0189 7612 [ 19D20159708E152267E53B66677A4995 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
20:06:12.0236 7612 bowser - ok
20:06:12.0283 7612 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
20:06:12.0361 7612 BrFiltLo - ok
20:06:12.0392 7612 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
20:06:12.0423 7612 BrFiltUp - ok
20:06:12.0470 7612 [ 6B054C67AAA87843504E8E3C09102009 ] Browser C:\Windows\System32\browser.dll
20:06:12.0501 7612 Browser - ok
20:06:12.0532 7612 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
20:06:12.0579 7612 Brserid - ok
20:06:12.0610 7612 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
20:06:12.0657 7612 BrSerWdm - ok
20:06:12.0688 7612 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
20:06:12.0751 7612 BrUsbMdm - ok
20:06:12.0782 7612 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
20:06:12.0829 7612 BrUsbSer - ok
20:06:12.0860 7612 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
20:06:12.0907 7612 BTHMODEM - ok
20:06:12.0953 7612 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
20:06:13.0031 7612 bthserv - ok
20:06:13.0063 7612 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
20:06:13.0156 7612 cdfs - ok
20:06:13.0203 7612 [ 83D2D75E1EFB81B3450C18131443F7DB ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
20:06:13.0250 7612 cdrom - ok
20:06:13.0281 7612 [ 312E2F82AF11E79906898AC3E3D58A1F ] CertPropSvc C:\Windows\System32\certprop.dll
20:06:13.0343 7612 CertPropSvc - ok
20:06:13.0375 7612 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
20:06:13.0437 7612 circlass - ok
20:06:13.0468 7612 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
20:06:13.0499 7612 CLFS - ok
20:06:13.0562 7612 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:06:13.0593 7612 clr_optimization_v2.0.50727_32 - ok
20:06:13.0640 7612 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:06:13.0655 7612 clr_optimization_v2.0.50727_64 - ok
20:06:13.0718 7612 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:06:13.0733 7612 clr_optimization_v4.0.30319_32 - ok
20:06:13.0765 7612 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:06:13.0780 7612 clr_optimization_v4.0.30319_64 - ok
20:06:13.0811 7612 [ 50F92C943F18B070F166D019DFAB3D9A ] clwvd C:\Windows\system32\DRIVERS\clwvd.sys
20:06:13.0827 7612 clwvd - ok
20:06:13.0843 7612 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
20:06:13.0874 7612 CmBatt - ok
20:06:13.0921 7612 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\DRIVERS\cmdide.sys
20:06:13.0936 7612 cmdide - ok
20:06:13.0967 7612 [ CA7720B73446FDDEC5C69519C1174C98 ] CNG C:\Windows\system32\Drivers\cng.sys
20:06:14.0045 7612 CNG - ok
20:06:14.0077 7612 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
20:06:14.0092 7612 Compbatt - ok
20:06:14.0123 7612 [ F26B3A86F6FA87CA360B879581AB4123 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
20:06:14.0170 7612 CompositeBus - ok
20:06:14.0201 7612 COMSysApp - ok
20:06:14.0217 7612 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
20:06:14.0233 7612 crcdisk - ok
20:06:14.0264 7612 [ BAF19B633933A9FB4883D27D66C39E9A ] CryptSvc C:\Windows\system32\cryptsvc.dll
20:06:14.0326 7612 CryptSvc - ok
20:06:14.0389 7612 [ BA8E5B2291C01EF71CA80E25F0C79D55 ] ctxusbm C:\Windows\system32\DRIVERS\ctxusbm.sys
20:06:14.0404 7612 ctxusbm - ok
20:06:14.0435 7612 [ 7266972E86890E2B30C0C322E906B027 ] DcomLaunch C:\Windows\system32\rpcss.dll
20:06:14.0498 7612 DcomLaunch - ok
20:06:14.0545 7612 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
20:06:14.0654 7612 defragsvc - ok
20:06:14.0716 7612 [ 1523251B9D8A5D84DE0CD23418847824 ] de_serv C:\Program Files (x86)\Common Files\AVM\de_serv.exe
20:06:14.0763 7612 de_serv ( UnsignedFile.Multi.Generic ) - warning
20:06:14.0763 7612 de_serv - detected UnsignedFile.Multi.Generic (1)
20:06:14.0810 7612 [ 9C253CE7311CA60FC11C774692A13208 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
20:06:14.0841 7612 DfsC - ok
20:06:14.0903 7612 [ CE3B9562D997F69B330D181A8875960F ] Dhcp C:\Windows\system32\dhcpcore.dll
20:06:14.0950 7612 Dhcp - ok
20:06:14.0981 7612 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
20:06:15.0044 7612 discache - ok
20:06:15.0075 7612 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys
20:06:15.0091 7612 Disk - ok
20:06:15.0122 7612 [ 85CF424C74A1D5EC33533E1DBFF9920A ] Dnscache C:\Windows\System32\dnsrslvr.dll
20:06:15.0153 7612 Dnscache - ok
20:06:15.0184 7612 [ 14452ACDB09B70964C8C21BF80A13ACB ] dot3svc C:\Windows\System32\dot3svc.dll
20:06:15.0278 7612 dot3svc - ok
20:06:15.0325 7612 [ B42ED0320C6E41102FDE0005154849BB ] Dot4 C:\Windows\system32\DRIVERS\Dot4.sys
20:06:15.0356 7612 Dot4 - ok
20:06:15.0403 7612 [ 85135AD27E79B689335C08167D917CDE ] Dot4Print C:\Windows\system32\DRIVERS\Dot4Prt.sys
20:06:15.0434 7612 Dot4Print - ok
20:06:15.0481 7612 [ FD05A02B0370BC3000F402E543CA5814 ] dot4usb C:\Windows\system32\DRIVERS\dot4usb.sys
20:06:15.0527 7612 dot4usb - ok
20:06:15.0559 7612 [ 8C2BA6BEA949EE6E68385F5692BAFB94 ] DPS C:\Windows\system32\dps.dll
20:06:15.0637 7612 DPS - ok
20:06:15.0683 7612 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
20:06:15.0730 7612 drmkaud - ok
20:06:15.0793 7612 [ 1633B9ABF52784A1331476397A48CBEF ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
20:06:15.0824 7612 DXGKrnl - ok
20:06:15.0855 7612 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
20:06:15.0964 7612 EapHost - ok
20:06:16.0058 7612 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
20:06:16.0151 7612 ebdrv - ok
20:06:16.0183 7612 [ 156F6159457D0AA7E59B62681B56EB90 ] EFS C:\Windows\System32\lsass.exe
20:06:16.0229 7612 EFS - ok
20:06:16.0292 7612 [ 47C071994C3F649F23D9CD075AC9304A ] ehRecvr C:\Windows\ehome\ehRecvr.exe
20:06:16.0339 7612 ehRecvr - ok
20:06:16.0370 7612 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
20:06:16.0432 7612 ehSched - ok
20:06:16.0479 7612 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
20:06:16.0510 7612 elxstor - ok
20:06:16.0541 7612 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\DRIVERS\errdev.sys
20:06:16.0588 7612 ErrDev - ok
20:06:16.0651 7612 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
20:06:16.0713 7612 EventSystem - ok
20:06:16.0760 7612 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
20:06:16.0822 7612 exfat - ok
20:06:16.0853 7612 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
20:06:16.0931 7612 fastfat - ok
20:06:16.0963 7612 [ D607B2F1BEE3992AA6C2C92C0A2F0855 ] Fax C:\Windows\system32\fxssvc.exe
20:06:17.0025 7612 Fax - ok
20:06:17.0072 7612 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys
20:06:17.0119 7612 fdc - ok
20:06:17.0150 7612 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
20:06:17.0243 7612 fdPHost - ok
20:06:17.0259 7612 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
20:06:17.0306 7612 FDResPub - ok
20:06:17.0353 7612 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
20:06:17.0368 7612 FileInfo - ok
20:06:17.0384 7612 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
20:06:17.0431 7612 Filetrace - ok
20:06:17.0462 7612 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
20:06:17.0509 7612 flpydisk - ok
20:06:17.0540 7612 [ F7866AF72ABBAF84B1FA5AA195378C59 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
20:06:17.0540 7612 FltMgr - ok
20:06:17.0587 7612 [ CB5E4B9C319E3C6BB363EB7E58A4A051 ] FontCache C:\Windows\system32\FntCache.dll
20:06:17.0649 7612 FontCache - ok
20:06:17.0727 7612 [ 8D89E3131C27FDD6932189CB785E1B7A ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:06:17.0743 7612 FontCache3.0.0.0 - ok
20:06:17.0774 7612 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
20:06:17.0789 7612 FsDepends - ok
20:06:17.0805 7612 [ D3E3F93D67821A2DB2B3D9FAC2DC2064 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
20:06:17.0821 7612 Fs_Rec - ok
20:06:17.0852 7612 [ AE87BA80D0EC3B57126ED2CDC15B24ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
20:06:17.0867 7612 fvevol - ok
20:06:17.0899 7612 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
20:06:17.0930 7612 gagp30kx - ok
20:06:17.0961 7612 [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:06:17.0977 7612 GEARAspiWDM - ok
20:06:18.0023 7612 [ FE5AB4525BC2EC68B9119A6E5D40128B ] gpsvc C:\Windows\System32\gpsvc.dll
20:06:18.0117 7612 gpsvc - ok
20:06:18.0195 7612 [ F02A533F517EB38333CB12A9E8963773 ] gupdate C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
20:06:18.0211 7612 gupdate - ok
20:06:18.0226 7612 [ F02A533F517EB38333CB12A9E8963773 ] gupdatem C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
20:06:18.0242 7612 gupdatem - ok
20:06:18.0273 7612 [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
20:06:18.0289 7612 gusvc - ok
20:06:18.0304 7612 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
20:06:18.0351 7612 hcw85cir - ok
20:06:18.0382 7612 [ 6410F6F415B2A5A9037224C41DA8BF12 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:06:18.0445 7612 HdAudAddService - ok
20:06:18.0476 7612 [ 0A49913402747A0B67DE940FB42CBDBB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
20:06:18.0491 7612 HDAudBus - ok
20:06:18.0523 7612 [ B6AC71AAA2B10848F57FC49D55A651AF ] HECIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
20:06:18.0538 7612 HECIx64 - ok
20:06:18.0554 7612 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
20:06:18.0585 7612 HidBatt - ok
20:06:18.0601 7612 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
20:06:18.0663 7612 HidBth - ok
20:06:18.0710 7612 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
20:06:18.0757 7612 HidIr - ok
20:06:18.0772 7612 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
20:06:18.0866 7612 hidserv - ok
20:06:18.0913 7612 [ B3BF6B5B50006DEF50B66306D99FCF6F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
20:06:18.0959 7612 HidUsb - ok
20:06:18.0991 7612 [ EFA58EDE58DD74388FFD04CB32681518 ] hkmsvc C:\Windows\system32\kmsvc.dll
20:06:19.0053 7612 hkmsvc - ok
20:06:19.0084 7612 [ 046B2673767CA626E2CFB7FDF735E9E8 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:06:19.0100 7612 HomeGroupListener - ok
20:06:19.0131 7612 [ 06A7422224D9865A5613710A089987DF ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:06:19.0162 7612 HomeGroupProvider - ok
20:06:19.0287 7612 [ 0A3C6AA4A9FC38C20BA4EAC2C3351C05 ] hpqcxs08 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
20:06:19.0318 7612 hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
20:06:19.0318 7612 hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
20:06:19.0365 7612 [ F3F72A2A86C22610BCA5439FA789DD52 ] hpqddsvc C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
20:06:19.0396 7612 hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
20:06:19.0396 7612 hpqddsvc - detected UnsignedFile.Multi.Generic (1)
20:06:19.0427 7612 [ 0886D440058F203EBA0E1825E4355914 ] HpSAMD C:\Windows\system32\DRIVERS\HpSAMD.sys
20:06:19.0443 7612 HpSAMD - ok
20:06:19.0521 7612 [ D972F48D0CE396759B788693CD665926 ] HPSLPSVC C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
20:06:19.0583 7612 HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
20:06:19.0583 7612 HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
20:06:19.0630 7612 [ CEE049CAC4EFA7F4E1E4AD014414A5D4 ] HTTP C:\Windows\system32\drivers\HTTP.sys
20:06:19.0724 7612 HTTP - ok
20:06:19.0739 7612 [ F17766A19145F111856378DF337A5D79 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
20:06:19.0755 7612 hwpolicy - ok
20:06:19.0786 7612 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
20:06:19.0802 7612 i8042prt - ok
20:06:19.0849 7612 [ ABBF174CB394F5C437410A788B7E404A ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
20:06:19.0864 7612 iaStor - ok
20:06:19.0942 7612 [ 31A0E93CDF29007D6C6FFFB632F375ED ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
20:06:19.0958 7612 IAStorDataMgrSvc - ok
20:06:19.0989 7612 [ B75E45C564E944A2657167D197AB29DA ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
20:06:20.0005 7612 iaStorV - ok
20:06:20.0067 7612 [ 6F95324909B502E2651442C1548AB12F ] IDriverT C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
20:06:20.0098 7612 IDriverT ( UnsignedFile.Multi.Generic ) - warning
20:06:20.0098 7612 IDriverT - detected UnsignedFile.Multi.Generic (1)
20:06:20.0176 7612 [ 2F2BE70D3E02B6FA877921AB9516D43C ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:06:20.0207 7612 idsvc - ok
20:06:20.0426 7612 [ 677AA5991026A65ADA128C4B59CF2BAD ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
20:06:20.0691 7612 igfx - ok
20:06:20.0738 7612 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
20:06:20.0753 7612 iirsp - ok
20:06:20.0800 7612 [ C5B4683680DF085B57BC53E5EF34861F ] IKEEXT C:\Windows\System32\ikeext.dll
20:06:20.0894 7612 IKEEXT - ok
20:06:20.0941 7612 [ DD587A55390ED2295BCE6D36AD567DA9 ] Impcd C:\Windows\system32\DRIVERS\Impcd.sys
20:06:20.0987 7612 Impcd - ok
20:06:21.0081 7612 [ 98220284537E9C96561406F99BE48086 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
20:06:21.0143 7612 IntcAzAudAddService - ok
20:06:21.0190 7612 [ 03C74719D48056A1078F3A51CEB76BAA ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys
20:06:21.0190 7612 IntcDAud - ok
20:06:21.0221 7612 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\DRIVERS\intelide.sys
20:06:21.0221 7612 intelide - ok
20:06:21.0253 7612 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
20:06:21.0268 7612 intelppm - ok
20:06:21.0299 7612 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
20:06:21.0362 7612 IPBusEnum - ok
20:06:21.0393 7612 [ 722DD294DF62483CECAAE6E094B4D695 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:06:21.0455 7612 IpFilterDriver - ok
20:06:21.0502 7612 [ F8E058D17363EC580E4B7232778B6CB5 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
20:06:21.0596 7612 iphlpsvc - ok
20:06:21.0611 7612 [ E2B4A4494DB7CB9B89B55CA268C337C5 ] IPMIDRV C:\Windows\system32\DRIVERS\IPMIDrv.sys
20:06:21.0643 7612 IPMIDRV - ok
20:06:21.0658 7612 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
20:06:21.0705 7612 IPNAT - ok
20:06:21.0752 7612 [ 0F261EC4F514926177C70C1832374231 ] iPod Service C:\Program Files\iPod\bin\iPodService.exe
20:06:21.0783 7612 iPod Service - ok
20:06:21.0830 7612 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
20:06:21.0877 7612 IRENUM - ok
20:06:21.0908 7612 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\DRIVERS\isapnp.sys
20:06:21.0923 7612 isapnp - ok
20:06:21.0939 7612 [ FA4D2557DE56D45B0A346F93564BE6E1 ] iScsiPrt C:\Windows\system32\DRIVERS\msiscsi.sys
20:06:21.0955 7612 iScsiPrt - ok
20:06:21.0986 7612 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
20:06:22.0001 7612 kbdclass - ok
20:06:22.0048 7612 [ 6DEF98F8541E1B5DCEB2C822A11F7323 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
20:06:22.0079 7612 kbdhid - ok
20:06:22.0095 7612 [ 156F6159457D0AA7E59B62681B56EB90 ] KeyIso C:\Windows\system32\lsass.exe
20:06:22.0111 7612 KeyIso - ok
20:06:22.0142 7612 [ 4F4B5FDE429416877DE7143044582EB5 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
20:06:22.0157 7612 KSecDD - ok
20:06:22.0173 7612 [ 6F40465A44ECDC1731BEFAFEC5BDD03C ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
20:06:22.0189 7612 KSecPkg - ok
20:06:22.0204 7612 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
20:06:22.0282 7612 ksthunk - ok
20:06:22.0313 7612 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
20:06:22.0407 7612 KtmRm - ok
20:06:22.0454 7612 [ 48686C29856F46443952A831424F8D6F ] L1C C:\Windows\system32\DRIVERS\L1C62x64.sys
20:06:22.0454 7612 L1C - ok
20:06:22.0485 7612 [ 81F1D04D4D0E433099365127375FD501 ] LanmanServer C:\Windows\system32\srvsvc.dll
20:06:22.0547 7612 LanmanServer - ok
20:06:22.0594 7612 [ 27026EAC8818E8A6C00A1CAD2F11D29A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:06:22.0657 7612 LanmanWorkstation - ok
20:06:22.0703 7612 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
20:06:22.0766 7612 lltdio - ok
20:06:22.0813 7612 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
20:06:22.0875 7612 lltdsvc - ok
20:06:22.0906 7612 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
20:06:22.0969 7612 lmhosts - ok
20:06:23.0047 7612 [ 1E2F802846EB944E0333EFEE7C9532A8 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
20:06:23.0062 7612 LMS - ok
20:06:23.0109 7612 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
20:06:23.0125 7612 LSI_FC - ok
20:06:23.0156 7612 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
20:06:23.0156 7612 LSI_SAS - ok
20:06:23.0187 7612 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
20:06:23.0203 7612 LSI_SAS2 - ok
20:06:23.0249 7612 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
20:06:23.0265 7612 LSI_SCSI - ok
20:06:23.0312 7612 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
20:06:23.0390 7612 luafv - ok
20:06:23.0421 7612 [ F84C8F1000BC11E3B7B23CBD3BAFF111 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
20:06:23.0468 7612 Mcx2Svc - ok
20:06:23.0515 7612 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
20:06:23.0530 7612 megasas - ok
20:06:23.0561 7612 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
20:06:23.0577 7612 MegaSR - ok
20:06:23.0624 7612 Microsoft SharePoint Workspace Audit Service - ok
20:06:23.0671 7612 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
20:06:23.0733 7612 MMCSS - ok
20:06:23.0749 7612 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
20:06:23.0795 7612 Modem - ok
20:06:23.0842 7612 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
20:06:23.0905 7612 monitor - ok
20:06:23.0936 7612 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
20:06:23.0951 7612 mouclass - ok
20:06:23.0983 7612 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
20:06:24.0014 7612 mouhid - ok
20:06:24.0029 7612 [ 791AF66C4D0E7C90A3646066386FB571 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
20:06:24.0045 7612 mountmgr - ok
20:06:24.0123 7612 [ 8A7C8F4C713E70D73946833D76B77035 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:06:24.0139 7612 MozillaMaintenance - ok
20:06:24.0170 7612 [ 609D1D87649ECC19796F4D76D4C15CEA ] mpio C:\Windows\system32\DRIVERS\mpio.sys
20:06:24.0185 7612 mpio - ok
20:06:24.0201 7612 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
20:06:24.0263 7612 mpsdrv - ok
20:06:24.0295 7612 [ AECAB449567D1846DAD63ECE49E893E3 ] MpsSvc C:\Windows\system32\mpssvc.dll
20:06:24.0373 7612 MpsSvc - ok
20:06:24.0388 7612 [ 30524261BB51D96D6FCBAC20C810183C ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
20:06:24.0451 7612 MRxDAV - ok
20:06:24.0482 7612 [ 040D62A9D8AD28922632137ACDD984F2 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
20:06:24.0529 7612 mrxsmb - ok
20:06:24.0575 7612 [ F0067552F8F9B33D7C59403AB808A3CB ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:06:24.0622 7612 mrxsmb10 - ok
20:06:24.0653 7612 [ 3C142D31DE9F2F193218A53FE2632051 ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:06:24.0700 7612 mrxsmb20 - ok
20:06:24.0731 7612 [ 5C37497276E3B3A5488B23A326A754B7 ] msahci C:\Windows\system32\DRIVERS\msahci.sys
20:06:24.0763 7612 msahci - ok
20:06:24.0794 7612 [ 8D27B597229AED79430FB9DB3BCBFBD0 ] msdsm C:\Windows\system32\DRIVERS\msdsm.sys
20:06:24.0809 7612 msdsm - ok
20:06:24.0825 7612 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
20:06:24.0856 7612 MSDTC - ok
20:06:24.0903 7612 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
20:06:24.0965 7612 Msfs - ok
20:06:24.0997 7612 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
20:06:25.0075 7612 mshidkmdf - ok
20:06:25.0106 7612 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\DRIVERS\msisadrv.sys
20:06:25.0106 7612 msisadrv - ok
20:06:25.0137 7612 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
20:06:25.0231 7612 MSiSCSI - ok
20:06:25.0231 7612 msiserver - ok
20:06:25.0277 7612 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
20:06:25.0355 7612 MSKSSRV - ok
20:06:25.0371 7612 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
20:06:25.0418 7612 MSPCLOCK - ok
20:06:25.0433 7612 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
20:06:25.0480 7612 MSPQM - ok
20:06:25.0511 7612 [ 89CB141AA8616D8C6A4610FA26C60964 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
20:06:25.0558 7612 MsRPC - ok
20:06:25.0589 7612 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
20:06:25.0589 7612 mssmbios - ok
20:06:25.0621 7612 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
20:06:25.0683 7612 MSTEE - ok
20:06:25.0714 7612 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
20:06:25.0761 7612 MTConfig - ok
20:06:25.0792 7612 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
20:06:25.0808 7612 Mup - ok
20:06:25.0839 7612 [ 4987E079A4530FA737A128BE54B63B12 ] napagent C:\Windows\system32\qagentRT.dll
20:06:25.0917 7612 napagent - ok
20:06:25.0964 7612 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
20:06:26.0011 7612 NativeWifiP - ok
20:06:26.0057 7612 [ CAD515DBD07D082BB317D9928CE8962C ] NDIS C:\Windows\system32\drivers\ndis.sys
20:06:26.0089 7612 NDIS - ok
20:06:26.0104 7612 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
20:06:26.0182 7612 NdisCap - ok
20:06:26.0229 7612 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
20:06:26.0307 7612 NdisTapi - ok
20:06:26.0338 7612 [ F105BA1E22BF1F2EE8F005D4305E4BEC ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
20:06:26.0401 7612 Ndisuio - ok
20:06:26.0432 7612 [ 557DFAB9CA1FCB036AC77564C010DAD3 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
20:06:26.0463 7612 NdisWan - ok
20:06:26.0479 7612 [ 659B74FB74B86228D6338D643CD3E3CF ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
20:06:26.0541 7612 NDProxy - ok
20:06:26.0588 7612 [ D5AC41AE382738483FAFFBD7E373D49A ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
20:06:26.0619 7612 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
20:06:26.0619 7612 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
20:06:26.0650 7612 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
20:06:26.0713 7612 NetBIOS - ok
20:06:26.0744 7612 [ 9162B273A44AB9DCE5B44362731D062A ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
20:06:26.0791 7612 NetBT - ok
20:06:26.0822 7612 [ 156F6159457D0AA7E59B62681B56EB90 ] Netlogon C:\Windows\system32\lsass.exe
20:06:26.0837 7612 Netlogon - ok
20:06:26.0869 7612 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
20:06:26.0931 7612 Netman - ok
20:06:26.0962 7612 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
20:06:27.0040 7612 netprofm - ok
20:06:27.0071 7612 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:06:27.0103 7612 NetTcpPortSharing - ok
20:06:27.0134 7612 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
20:06:27.0149 7612 nfrd960 - ok
20:06:27.0165 7612 [ D9A0CE66046D6EFA0C61BAA885CBA0A8 ] NlaSvc C:\Windows\System32\nlasvc.dll
20:06:27.0243 7612 NlaSvc - ok
20:06:27.0290 7612 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
20:06:27.0337 7612 Npfs - ok
20:06:27.0383 7612 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
20:06:27.0461 7612 nsi - ok
20:06:27.0461 7612 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
20:06:27.0524 7612 nsiproxy - ok
20:06:27.0602 7612 [ 184C189D4FC416978550FC599BB4EDDA ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
20:06:27.0664 7612 Ntfs - ok
20:06:27.0695 7612 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
20:06:27.0742 7612 Null - ok
20:06:27.0789 7612 [ 786DB821BFD57C0551DBBE4F75384A7D ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
20:06:27.0836 7612 nusb3hub - ok
20:06:27.0883 7612 [ DAA8005CAF745042BB427A1ED7433354 ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
20:06:27.0898 7612 nusb3xhc - ok
20:06:28.0148 7612 [ 589FEBA7A8E3EB0C3DF254ABABA3A257 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:06:28.0335 7612 nvlddmkm - ok
20:06:28.0382 7612 [ 273B73BF8F214154B6C499C9842CA3A2 ] nvpciflt C:\Windows\system32\DRIVERS\nvpciflt.sys
20:06:28.0382 7612 nvpciflt - ok
20:06:28.0413 7612 [ A4D9C9A608A97F59307C2F2600EDC6A4 ] nvraid C:\Windows\system32\drivers\nvraid.sys
20:06:28.0429 7612 nvraid - ok
20:06:28.0460 7612 [ 6C1D5F70E7A6A3FD1C90D840EDC048B9 ] nvstor C:\Windows\system32\drivers\nvstor.sys
20:06:28.0475 7612 nvstor - ok
20:06:28.0507 7612 [ 03055FDFD0F9F17E95E27F6193CE4EB9 ] nvsvc C:\Windows\system32\nvvsvc.exe
20:06:28.0522 7612 nvsvc - ok
20:06:28.0616 7612 [ 9C42974EF3DAB4D3B38E5F26F311645A ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
20:06:28.0663 7612 nvUpdatusService - ok
20:06:28.0709 7612 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\DRIVERS\nv_agp.sys
20:06:28.0741 7612 nv_agp - ok
20:06:28.0756 7612 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\DRIVERS\ohci1394.sys
20:06:28.0787 7612 ohci1394 - ok
20:06:28.0850 7612 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:06:28.0865 7612 ose - ok
20:06:29.0006 7612 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
20:06:29.0177 7612 osppsvc - ok
20:06:29.0193 7612 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
20:06:29.0224 7612 p2pimsvc - ok
20:06:29.0255 7612 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
20:06:29.0287 7612 p2psvc - ok
20:06:29.0318 7612 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys
20:06:29.0365 7612 Parport - ok
20:06:29.0396 7612 [ 90061B1ACFE8CCAA5345750FFE08D8B8 ] partmgr C:\Windows\system32\drivers\partmgr.sys
20:06:29.0411 7612 partmgr - ok
20:06:29.0427 7612 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
20:06:29.0474 7612 PcaSvc - ok
20:06:29.0521 7612 [ 81B5E63131090879AD6EF9F32109B88D ] pccsmcfd C:\Windows\system32\DRIVERS\pccsmcfdx64.sys
20:06:29.0552 7612 pccsmcfd - ok
20:06:29.0583 7612 [ F36F6504009F2FB0DFD1B17A116AD74B ] pci C:\Windows\system32\DRIVERS\pci.sys
20:06:29.0599 7612 pci - ok
20:06:29.0630 7612 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\DRIVERS\pciide.sys
20:06:29.0645 7612 pciide - ok
20:06:29.0677 7612 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
20:06:29.0692 7612 pcmcia - ok
20:06:29.0708 7612 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
20:06:29.0723 7612 pcw - ok
20:06:29.0739 7612 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
20:06:29.0817 7612 PEAUTH - ok
20:06:29.0864 7612 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
20:06:29.0895 7612 PerfHost - ok
20:06:29.0957 7612 [ 557E9A86F65F0DE18C9B6751DFE9D3F1 ] pla C:\Windows\system32\pla.dll
20:06:30.0035 7612 pla - ok
20:06:30.0067 7612 [ 98B1721B8718164293B9701B98C52D77 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
20:06:30.0113 7612 PlugPlay - ok
20:06:30.0160 7612 [ 37F6046CDC630442D7DC087501FF6FC6 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
20:06:30.0191 7612 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
20:06:30.0191 7612 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
20:06:30.0207 7612 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
20:06:30.0254 7612 PNRPAutoReg - ok
20:06:30.0285 7612 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
20:06:30.0301 7612 PNRPsvc - ok
20:06:30.0347 7612 [ 166EB40D1F5B47E615DE3D0FFFE5F243 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
20:06:30.0425 7612 PolicyAgent - ok
20:06:30.0457 7612 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
20:06:30.0535 7612 Power - ok
20:06:30.0566 7612 [ 27CC19E81BA5E3403C48302127BDA717 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
20:06:30.0644 7612 PptpMiniport - ok
20:06:30.0691 7612 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys
20:06:30.0737 7612 Processor - ok
20:06:30.0769 7612 [ 97293447431311C06703368AD0F6C4BE ] ProfSvc C:\Windows\system32\profsvc.dll
20:06:30.0815 7612 ProfSvc - ok
20:06:30.0831 7612 [ 156F6159457D0AA7E59B62681B56EB90 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:06:30.0847 7612 ProtectedStorage - ok
20:06:30.0878 7612 [ EE992183BD8EAEFD9973F352E587A299 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
20:06:30.0909 7612 Psched - ok
20:06:30.0956 7612 [ A6A7AD767BF5141665F5C675F671B3E1 ] PSI_SVC_2 c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
20:06:30.0987 7612 PSI_SVC_2 - ok
20:06:31.0034 7612 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
20:06:31.0081 7612 ql2300 - ok
20:06:31.0112 7612 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
20:06:31.0112 7612 ql40xx - ok
20:06:31.0143 7612 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
20:06:31.0174 7612 QWAVE - ok
20:06:31.0190 7612 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
20:06:31.0221 7612 QWAVEdrv - ok
20:06:31.0252 7612 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
20:06:31.0346 7612 RasAcd - ok
20:06:31.0393 7612 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
20:06:31.0455 7612 RasAgileVpn - ok
20:06:31.0471 7612 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
20:06:31.0533 7612 RasAuto - ok
20:06:31.0549 7612 [ 87A6E852A22991580D6D39ADC4790463 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
20:06:31.0611 7612 Rasl2tp - ok
20:06:31.0642 7612 [ 47394ED3D16D053F5906EFE5AB51CC83 ] RasMan C:\Windows\System32\rasmans.dll
20:06:31.0705 7612 RasMan - ok
20:06:31.0720 7612 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
20:06:31.0783 7612 RasPppoe - ok
20:06:31.0829 7612 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
20:06:31.0892 7612 RasSstp - ok
20:06:31.0923 7612 [ 3BAC8142102C15D59A87757C1D41DCE5 ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
20:06:31.0985 7612 rdbss - ok
20:06:32.0001 7612 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
20:06:32.0048 7612 rdpbus - ok
20:06:32.0079 7612 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
20:06:32.0157 7612 RDPCDD - ok
20:06:32.0188 7612 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
20:06:32.0235 7612 RDPENCDD - ok
20:06:32.0266 7612 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
20:06:32.0313 7612 RDPREFMP - ok
20:06:32.0344 7612 [ 447DE7E3DEA39D422C1504F245B668B1 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
20:06:32.0407 7612 RDPWD - ok
20:06:32.0453 7612 [ 634B9A2181D98F15941236886164EC8B ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
20:06:32.0485 7612 rdyboost - ok
20:06:32.0516 7612 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
20:06:32.0578 7612 RemoteAccess - ok
20:06:32.0609 7612 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
20:06:32.0656 7612 RemoteRegistry - ok
20:06:32.0750 7612 [ F12A68ED55053940CADD59CA5E3468DD ] RichVideo C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
20:06:32.0781 7612 RichVideo ( UnsignedFile.Multi.Generic ) - warning
20:06:32.0781 7612 RichVideo - detected UnsignedFile.Multi.Generic (1)
20:06:32.0828 7612 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
20:06:32.0921 7612 RpcEptMapper - ok
20:06:32.0953 7612 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
20:06:32.0984 7612 RpcLocator - ok
20:06:33.0015 7612 [ 7266972E86890E2B30C0C322E906B027 ] RpcSs C:\Windows\system32\rpcss.dll
20:06:33.0077 7612 RpcSs - ok
20:06:33.0109 7612 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
20:06:33.0171 7612 rspndr - ok
20:06:33.0233 7612 [ 44ED82612403021E36998E1ECB1198F1 ] RSUSBSTOR C:\Windows\System32\Drivers\RtsUStor.sys
20:06:33.0265 7612 RSUSBSTOR - ok
20:06:33.0296 7612 [ BAEFEE35D27A5440D35092CE10267BEC ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys
20:06:33.0327 7612 RTL8167 - ok
20:06:33.0405 7612 [ A5986B46C4348CB35EBB98F220948DF7 ] rtl8192se C:\Windows\system32\DRIVERS\rtl8192se.sys
20:06:33.0452 7612 rtl8192se - ok
20:06:33.0467 7612 [ 156F6159457D0AA7E59B62681B56EB90 ] SamSs C:\Windows\system32\lsass.exe
20:06:33.0483 7612 SamSs - ok
20:06:33.0514 7612 [ E3BBB89983DAF5622C1D50CF49F28227 ] sbp2port C:\Windows\system32\DRIVERS\sbp2port.sys
20:06:33.0530 7612 sbp2port - ok
20:06:33.0577 7612 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
20:06:33.0639 7612 SCardSvr - ok
20:06:33.0655 7612 [ C94DA20C7E3BA1DCA269BC8460D98387 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
20:06:33.0748 7612 scfilter - ok
20:06:33.0795 7612 [ 624D0F5FF99428BB90A5B8A4123E918E ] Schedule C:\Windows\system32\schedsvc.dll
20:06:33.0857 7612 Schedule - ok
20:06:33.0873 7612 [ 312E2F82AF11E79906898AC3E3D58A1F ] SCPolicySvc C:\Windows\System32\certprop.dll
20:06:33.0920 7612 SCPolicySvc - ok
20:06:33.0935 7612 [ 765A27C3279CE11D14CB9E4F5869FCA5 ] SDRSVC C:\Windows\System32\SDRSVC.dll
20:06:33.0982 7612 SDRSVC - ok
20:06:34.0013 7612 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
20:06:34.0060 7612 secdrv - ok
20:06:34.0091 7612 [ 463B386EBC70F98DA5DFF85F7E654346 ] seclogon C:\Windows\system32\seclogon.dll
20:06:34.0138 7612 seclogon - ok
20:06:34.0169 7612 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
20:06:34.0216 7612 SENS - ok
20:06:34.0247 7612 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
20:06:34.0294 7612 SensrSvc - ok
20:06:34.0325 7612 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
20:06:34.0357 7612 Serenum - ok
20:06:34.0403 7612 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
20:06:34.0450 7612 Serial - ok
20:06:34.0481 7612 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
20:06:34.0544 7612 sermouse - ok
20:06:34.0606 7612 [ 9D38320BB32230349379DF5DDBBF7FCE ] ServiceLayer C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
20:06:34.0622 7612 ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
20:06:34.0622 7612 ServiceLayer - detected UnsignedFile.Multi.Generic (1)
20:06:34.0669 7612 [ C3BC61CE47FF6F4E88AB8A3B429A36AF ] SessionEnv C:\Windows\system32\sessenv.dll
20:06:34.0731 7612 SessionEnv - ok
20:06:34.0778 7612 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\DRIVERS\sffdisk.sys
20:06:34.0809 7612 sffdisk - ok
20:06:34.0856 7612 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\DRIVERS\sffp_mmc.sys
20:06:34.0887 7612 sffp_mmc - ok
20:06:34.0918 7612 [ 178298F767FE638C9FEDCBDEF58BB5E4 ] sffp_sd C:\Windows\system32\DRIVERS\sffp_sd.sys
20:06:34.0934 7612 sffp_sd - ok
20:06:34.0981 7612 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
20:06:34.0996 7612 sfloppy - ok
20:06:35.0043 7612 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
20:06:35.0137 7612 SharedAccess - ok
20:06:35.0168 7612 [ 0298AC45D0EFFFB2DB4BAA7DD186E7BF ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:06:35.0215 7612 ShellHWDetection - ok
20:06:35.0246 7612 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
20:06:35.0261 7612 SiSRaid2 - ok
20:06:35.0277 7612 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
20:06:35.0293 7612 SiSRaid4 - ok
20:06:35.0355 7612 [ 17EAB7852FF9F15FBAAB4E95EFC0B812 ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe
20:06:35.0371 7612 SkypeUpdate - ok
20:06:35.0402 7612 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
20:06:35.0495 7612 Smb - ok
20:06:35.0542 7612 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
20:06:35.0573 7612 SNMPTRAP - ok
20:06:35.0589 7612 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
20:06:35.0620 7612 spldr - ok
20:06:35.0651 7612 [ 567977DC43CC13C4C35ED7084C0B84D5 ] Spooler C:\Windows\System32\spoolsv.exe
20:06:35.0698 7612 Spooler - ok
20:06:35.0761 7612 [ 913D843498553A1BC8F8DBAD6358E49F ] sppsvc C:\Windows\system32\sppsvc.exe
20:06:35.0839 7612 sppsvc - ok
20:06:35.0870 7612 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
20:06:35.0917 7612 sppuinotify - ok
20:06:35.0948 7612 [ 2408C0366D96BCDF63E8F1C78E4A29C5 ] srv C:\Windows\system32\DRIVERS\srv.sys
20:06:35.0979 7612 srv - ok
20:06:36.0026 7612 [ 76548F7B818881B47D8D1AE1BE9C11F8 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
20:06:36.0073 7612 srv2 - ok
20:06:36.0104 7612 [ 0AF6E19D39C70844C5CAA8FB0183C36E ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
20:06:36.0135 7612 srvnet - ok
20:06:36.0166 7612 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
20:06:36.0275 7612 SSDPSRV - ok
20:06:36.0275 7612 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
20:06:36.0322 7612 SstpSvc - ok
20:06:36.0385 7612 [ 47A0A473AD1822E9E6C76E519BD0A023 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
20:06:36.0400 7612 Stereo Service - ok
20:06:36.0431 7612 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
20:06:36.0447 7612 stexstor - ok
20:06:36.0509 7612 [ 52D0E33B681BD0F33FDC08812FEE4F7D ] stisvc C:\Windows\System32\wiaservc.dll
20:06:36.0572 7612 stisvc - ok
20:06:36.0587 7612 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
20:06:36.0603 7612 swenum - ok
20:06:36.0650 7612 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
20:06:36.0712 7612 swprv - ok
20:06:36.0759 7612 [ 064A2530A4A7C7CEC1BE6A1945645BE4 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
20:06:36.0775 7612 SynTP - ok
20:06:36.0806 7612 [ 3C1284516A62078FB68F768DE4F1A7BE ] SysMain C:\Windows\system32\sysmain.dll
20:06:36.0868 7612 SysMain - ok
20:06:36.0899 7612 [ 238935C3CF2854886DC7CBB2A0E2CC66 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:06:36.0962 7612 TabletInputService - ok
20:06:36.0977 7612 [ 884264AC597B690C5707C89723BB8E7B ] TapiSrv C:\Windows\System32\tapisrv.dll
20:06:37.0055 7612 TapiSrv - ok
20:06:37.0087 7612 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
20:06:37.0133 7612 TBS - ok
20:06:37.0211 7612 [ 624C5B3AA4C99B3184BB922D9ECE3FF0 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
20:06:37.0258 7612 Tcpip - ok
20:06:37.0289 7612 [ 624C5B3AA4C99B3184BB922D9ECE3FF0 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
20:06:37.0336 7612 TCPIP6 - ok
20:06:37.0352 7612 [ 76D078AF6F587B162D50210F761EB9ED ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
20:06:37.0399 7612 tcpipreg - ok
20:06:37.0430 7612 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
20:06:37.0461 7612 TDPIPE - ok
20:06:37.0492 7612 [ 7518F7BCFD4B308ABC9192BACAF6C970 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
20:06:37.0523 7612 TDTCP - ok
20:06:37.0555 7612 [ 079125C4B17B01FCAEEBCE0BCB290C0F ] tdx C:\Windows\system32\DRIVERS\tdx.sys
20:06:37.0617 7612 tdx - ok
20:06:37.0648 7612 [ C448651339196C0E869A355171875522 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
20:06:37.0664 7612 TermDD - ok
20:06:37.0695 7612 [ 0F05EC2887BFE197AD82A13287D2F404 ] TermService C:\Windows\System32\termsrv.dll
20:06:37.0804 7612 TermService - ok
20:06:37.0804 7612 TFsExDisk - ok
20:06:37.0835 7612 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
20:06:37.0851 7612 Themes - ok
20:06:37.0882 7612 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
20:06:37.0913 7612 THREADORDER - ok
20:06:37.0945 7612 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
20:06:38.0007 7612 TrkWks - ok
20:06:38.0069 7612 [ 840F7FB849F5887A49BA18C13B2DA920 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:06:38.0116 7612 TrustedInstaller - ok
20:06:38.0147 7612 [ 61B96C26131E37B24E93327A0BD1FB95 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
20:06:38.0225 7612 tssecsrv - ok
20:06:38.0272 7612 [ 3836171A2CDF3AF8EF10856DB9835A70 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
20:06:38.0319 7612 tunnel - ok
20:06:38.0350 7612 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
20:06:38.0350 7612 uagp35 - ok
20:06:38.0381 7612 [ D47BAEAD86C65D4F4069D7CE0A4EDCEB ] udfs C:\Windows\system32\DRIVERS\udfs.sys
20:06:38.0444 7612 udfs - ok
20:06:38.0491 7612 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
20:06:38.0522 7612 UI0Detect - ok
20:06:38.0569 7612 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\DRIVERS\uliagpkx.sys
20:06:38.0584 7612 uliagpkx - ok
20:06:38.0615 7612 [ EAB6C35E62B1B0DB0D1B48B671D3A117 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
20:06:38.0631 7612 umbus - ok
20:06:38.0662 7612 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
20:06:38.0709 7612 UmPass - ok
20:06:38.0849 7612 [ AF905F4966CFC8B973623AB150CD4B2B ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
20:06:38.0896 7612 UNS - ok
20:06:38.0927 7612 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
20:06:38.0990 7612 upnphost - ok
20:06:39.0068 7612 [ 43228F8EDD1B0BCDD3145AD246E63D39 ] USBAAPL64 C:\Windows\system32\Drivers\usbaapl64.sys
20:06:39.0099 7612 USBAAPL64 - ok
20:06:39.0146 7612 [ 7B6A127C93EE590E4D79A5F2A76FE46F ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
20:06:39.0177 7612 usbccgp - ok
20:06:39.0209 7612 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\DRIVERS\usbcir.sys
20:06:39.0272 7612 usbcir - ok
20:06:39.0303 7612 [ 92969BA5AC44E229C55A332864F79677 ] usbehci C:\Windows\system32\drivers\usbehci.sys
20:06:39.0318 7612 usbehci - ok
20:06:39.0334 7612 [ E7DF1CFD28CA86B35EF5ADD0735CEEF3 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
20:06:39.0381 7612 usbhub - ok
20:06:39.0396 7612 [ F1BB1E55F1E7A65C5839CCC7B36D773E ] usbohci C:\Windows\system32\drivers\usbohci.sys
20:06:39.0443 7612 usbohci - ok
20:06:39.0474 7612 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
20:06:39.0537 7612 usbprint - ok
20:06:39.0584 7612 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
20:06:39.0630 7612 usbscan - ok
20:06:39.0662 7612 [ F39983647BC1F3E6100778DDFE9DCE29 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:06:39.0693 7612 USBSTOR - ok
20:06:39.0708 7612 [ BC3070350A491D84B518D7CCA9ABD36F ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
20:06:39.0755 7612 usbuhci - ok
20:06:39.0786 7612 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
20:06:39.0849 7612 UxSms - ok
20:06:39.0880 7612 [ 156F6159457D0AA7E59B62681B56EB90 ] VaultSvc C:\Windows\system32\lsass.exe
20:06:39.0911 7612 VaultSvc - ok
20:06:39.0942 7612 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\DRIVERS\vdrvroot.sys
20:06:39.0974 7612 vdrvroot - ok
20:06:39.0989 7612 [ 44D73E0BBC1D3C8981304BA15135C2F2 ] vds C:\Windows\System32\vds.exe
20:06:40.0036 7612 vds - ok
20:06:40.0067 7612 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
20:06:40.0114 7612 vga - ok
20:06:40.0130 7612 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
20:06:40.0208 7612 VgaSave - ok
20:06:40.0239 7612 [ C82E748660F62A242B2DFAC1442F22A4 ] vhdmp C:\Windows\system32\DRIVERS\vhdmp.sys
20:06:40.0254 7612 vhdmp - ok
20:06:40.0286 7612 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\DRIVERS\viaide.sys
20:06:40.0301 7612 viaide - ok
20:06:40.0332 7612 [ 2B1A3DAE2B4E70DBBA822B7A03FBD4A3 ] volmgr C:\Windows\system32\DRIVERS\volmgr.sys
20:06:40.0332 7612 volmgr - ok
20:06:40.0364 7612 [ 99B0CBB569CA79ACAED8C91461D765FB ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
20:06:40.0379 7612 volmgrx - ok
20:06:40.0395 7612 [ 58F82EED8CA24B461441F9C3E4F0BF5C ] volsnap C:\Windows\system32\DRIVERS\volsnap.sys
20:06:40.0426 7612 volsnap - ok
20:06:40.0457 7612 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
20:06:40.0473 7612 vsmraid - ok
20:06:40.0535 7612 [ 787898BF9FB6D7BD87A36E2D95C899BA ] VSS C:\Windows\system32\vssvc.exe
20:06:40.0598 7612 VSS - ok
20:06:40.0629 7612 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
20:06:40.0644 7612 vwifibus - ok
20:06:40.0676 7612 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
20:06:40.0707 7612 vwififlt - ok
20:06:40.0738 7612 [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
20:06:40.0785 7612 vwifimp - ok
20:06:40.0832 7612 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
20:06:40.0894 7612 W32Time - ok
20:06:40.0941 7612 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
20:06:40.0956 7612 WacomPen - ok
20:06:41.0003 7612 [ 47CA49400643EFFD3F1C9A27E1D69324 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
20:06:41.0081 7612 WANARP - ok
20:06:41.0097 7612 [ 47CA49400643EFFD3F1C9A27E1D69324 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
20:06:41.0144 7612 Wanarpv6 - ok
20:06:41.0190 7612 [ 878C947C69EE89E4DBFF9DBD6155C15D ] watchmi C:\Program Files (x86)\watchmi\TvdService.exe
20:06:41.0222 7612 watchmi ( UnsignedFile.Multi.Generic ) - warning
20:06:41.0222 7612 watchmi - detected UnsignedFile.Multi.Generic (1)
20:06:41.0268 7612 [ 5AB1BB85BD8B5089CC5D64200DEDAE68 ] wbengine C:\Windows\system32\wbengine.exe
20:06:41.0331 7612 wbengine - ok
20:06:41.0378 7612 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
20:06:41.0424 7612 WbioSrvc - ok
20:06:41.0471 7612 [ DD1BAE8EBFC653824D29CCF8C9054D68 ] wcncsvc C:\Windows\System32\wcncsvc.dll
20:06:41.0502 7612 wcncsvc - ok
20:06:41.0534 7612 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:06:41.0565 7612 WcsPlugInService - ok
20:06:41.0596 7612 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys
20:06:41.0612 7612 Wd - ok
20:06:41.0658 7612 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
20:06:41.0690 7612 Wdf01000 - ok
20:06:41.0705 7612 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
20:06:41.0768 7612 WdiServiceHost - ok
20:06:41.0768 7612 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
20:06:41.0783 7612 WdiSystemHost - ok
20:06:41.0830 7612 [ 733006127F235BE7C35354EBEE7B9A7B ] WebClient C:\Windows\System32\webclnt.dll
20:06:41.0861 7612 WebClient - ok
20:06:41.0892 7612 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
20:06:41.0924 7612 Wecsvc - ok
20:06:41.0939 7612 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
20:06:41.0986 7612 wercplsupport - ok
20:06:42.0017 7612 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
20:06:42.0095 7612 WerSvc - ok
20:06:42.0142 7612 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
20:06:42.0204 7612 WfpLwf - ok
20:06:42.0220 7612 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
20:06:42.0220 7612 WIMMount - ok
20:06:42.0251 7612 WinDefend - ok
20:06:42.0251 7612 WinHttpAutoProxySvc - ok
20:06:42.0298 7612 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
20:06:42.0376 7612 Winmgmt - ok
20:06:42.0438 7612 [ 41FBB751936B387F9179E7F03A74FE29 ] WinRM C:\Windows\system32\WsmSvc.dll
20:06:42.0501 7612 WinRM - ok
20:06:42.0563 7612 [ 817EAFF5D38674EDD7713B9DFB8E9791 ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
20:06:42.0579 7612 WinUsb - ok
20:06:42.0626 7612 [ 4C69A8E2E159C1C59BC4B688E9DD7F8C ] WisLMSvc C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
20:06:42.0657 7612 WisLMSvc - ok
20:06:42.0688 7612 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
20:06:42.0735 7612 Wlansvc - ok
20:06:42.0828 7612 [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
20:06:42.0844 7612 wlcrasvc - ok
20:06:42.0906 7612 [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:06:42.0953 7612 wlidsvc - ok
20:06:43.0000 7612 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
20:06:43.0031 7612 WmiAcpi - ok
20:06:43.0078 7612 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
20:06:43.0109 7612 wmiApSrv - ok
20:06:43.0156 7612 WMPNetworkSvc - ok
20:06:43.0187 7612 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
20:06:43.0203 7612 WPCSvc - ok
20:06:43.0218 7612 [ 2E57DDF2880A7E52E76F41C7E96D327B ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
20:06:43.0265 7612 WPDBusEnum - ok
20:06:43.0281 7612 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
20:06:43.0359 7612 ws2ifsl - ok
20:06:43.0406 7612 [ 8F9F3969933C02DA96EB0F84576DB43E ] wscsvc C:\Windows\System32\wscsvc.dll
20:06:43.0437 7612 wscsvc - ok
20:06:43.0452 7612 WSearch - ok
20:06:43.0530 7612 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
20:06:43.0593 7612 wuauserv - ok
20:06:43.0608 7612 [ 7CADC74271DD6461C452C271B30BD378 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
20:06:43.0671 7612 WudfPf - ok
20:06:43.0686 7612 [ 3B197AF0FFF08AA66B6B2241CA538D64 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
20:06:43.0764 7612 WUDFRd - ok
20:06:43.0796 7612 [ B551D6637AA0E132C18AC6E504F7B79B ] wudfsvc C:\Windows\System32\WUDFSvc.dll
20:06:43.0874 7612 wudfsvc - ok
20:06:43.0905 7612 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
20:06:43.0952 7612 WwanSvc - ok
20:06:43.0983 7612 ================ Scan global ===============================
20:06:44.0014 7612 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
20:06:44.0045 7612 [ 79CDA06F75AD5373DD447F57575C4400 ] C:\Windows\system32\winsrv.dll
20:06:44.0045 7612 [ 79CDA06F75AD5373DD447F57575C4400 ] C:\Windows\system32\winsrv.dll
20:06:44.0092 7612 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
20:06:44.0123 7612 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
20:06:44.0123 7612 [Global] - ok
20:06:44.0123 7612 ================ Scan MBR ==================================
20:06:44.0139 7612 [ 8B790A79784018D2B00DC944072570F8 ] \Device\Harddisk0\DR0
20:06:46.0385 7612 \Device\Harddisk0\DR0 - ok
20:06:46.0385 7612 ================ Scan VBR ==================================
20:06:46.0385 7612 [ 378F052D5D58AFD217EDB9FDB50FCF80 ] \Device\Harddisk0\DR0\Partition1
20:06:46.0385 7612 \Device\Harddisk0\DR0\Partition1 - ok
20:06:46.0416 7612 [ 7AD2168EF754372BEDB27DE016F9039D ] \Device\Harddisk0\DR0\Partition2
20:06:46.0416 7612 \Device\Harddisk0\DR0\Partition2 - ok
20:06:46.0448 7612 [ 1468261406A3B7F63BE7E920F56B5AA6 ] \Device\Harddisk0\DR0\Partition3
20:06:46.0448 7612 \Device\Harddisk0\DR0\Partition3 - ok
20:06:46.0448 7612 ============================================================
20:06:46.0448 7612 Scan finished
20:06:46.0448 7612 ============================================================
20:06:46.0448 7736 Detected object count: 11
20:06:46.0448 7736 Actual detected object count: 11
20:07:32.0421 7736 AVM IGD CTRL Service ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0421 7736 AVM IGD CTRL Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 de_serv ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 de_serv ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736 ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736 ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0452 7736 watchmi ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0452 7736 watchmi ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:43.0497 6712 Deinitialize success
Geändert von christalex (01.04.2013 um 19:10 Uhr) |
|
01.04.2013, 23:17
| #12 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | GVU Trojaner auf Win7 entfernen Dann bitte jetzt Combofix ausführen: Scan mit Combofix
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.04.2013, 07:18
| #13 |
| | GVU Trojaner auf Win7 entfernen hier das Combofix-Log Code:
ATTFilter ComboFix 13-04-01.01 - *** 02.04.2013 8:02.1.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3893.2236 [GMT 2:00]
ausgeführt von:: c:\users\***\Pictures\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-03-02 bis 2013-04-02 ))))))))))))))))))))))))))))))
.
.
2013-04-02 06:11 . 2013-04-02 06:11 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-04-02 06:11 . 2013-04-02 06:11 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-02 06:05 . 2013-04-02 06:05 76232 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{91F013F4-0AB9-4B0D-BE05-EE7877DA5028}\offreg.dll
2013-04-01 18:05 . 2013-04-01 18:05 208216 ----a-w- c:\windows\system32\drivers\36876970.sys
2013-03-29 11:12 . 2013-03-29 11:12 -------- d-----w- c:\programdata\Malwarebytes
2013-03-27 18:53 . 2013-03-27 18:53 -------- d-----w- C:\GVU
2013-03-26 18:31 . 2013-03-26 18:31 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-03-26 18:31 . 2013-03-26 18:31 -------- d-----w- c:\windows\SysWow64\Extensions
2013-03-25 20:16 . 2013-03-25 20:16 -------- d-----w- c:\programdata\BrowserProtect
2013-03-25 20:16 . 2013-03-27 14:32 -------- d-----w- c:\users\***\AppData\Roaming\BabSolution
2013-03-05 05:45 . 2013-02-19 02:57 9162192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{91F013F4-0AB9-4B0D-BE05-EE7877DA5028}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-15 17:07 . 2012-04-02 17:56 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-15 17:07 . 2011-12-02 22:12 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-20 719672]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2011-05-22 102400]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-02-17 39408]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-01-31 17147528]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2012-11-11 3093624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HotkeyApp"="c:\program files (x86)\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]
"LMgrVolOSD"="c:\program files (x86)\Launch Manager\OSD.exe" [2009-12-11 348960]
"Wbutton"="c:\program files (x86)\Launch Manager\Wbutton.exe" [2010-06-21 436264]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2010-10-29 136488]
"LexwareInfoService"="c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"iWareV3"="c:\program files (x86)\MouseDriver\OfficeMouse.exe" [2009-03-27 507904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2011-04-25 305088]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Startcenter.lnk - c:\program files (x86)\FRITZ!DSL\StCenter.exe [2011-2-21 679936]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-05-24 246304]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-10-27 24680]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-15 27760]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2010-07-14 87600]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-27 236136]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-10 2320920]
S2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe [2010-12-06 62464]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-10-29 31088]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-18 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-03-04 75816]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-03-02 1098784]
S3 WisLMSvc;WisLMSvc;c:\program files (x86)\Launch Manager\WisLMSvc.exe [2009-10-23 118560]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 17:07]
.
2013-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 16:53]
.
2013-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 16:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-02 11465320]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-09-02 2120808]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://webaccess.krones.com/vpn/index.html
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
Trusted Zone: krones.com\webaccess
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\lkickppl.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFOB6&ctid=CT2319825&SearchSource=2&q=
FF - ExtSQL: 2013-03-27 15:32; ffxtlbr@delta.com; c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\lkickppl.default\extensions\ffxtlbr@delta.com
FF - ExtSQL: !HIDDEN! 2011-03-06 16:53; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{40c3cc16-7269-4b32-9531-17f2950fb06f} - (no file)
Toolbar-{DFEFCDEE-CF1A-4FC8-88AD-129872198372} - (no file)
Wow6432Node-HKLM-Run-NPSStartup - (no file)
SafeBoot-BsScanner
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-FRITZ!DSL - c:\windows\IsUn0407.exe
AddRemove-LEGO Creator - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-04-02 08:15:24
ComboFix-quarantined-files.txt 2013-04-02 06:15
.
Vor Suchlauf: 10 Verzeichnis(se), 484.585.611.264 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 489.593.651.200 Bytes frei
.
- - End Of File - - F6B58420424FE1BA98D5B94A1E05FB69
|
|
02.04.2013, 10:54
| #14 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | GVU Trojaner auf Win7 entfernen Combofix-Skript
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.04.2013, 20:07
| #15 |
| | GVU Trojaner auf Win7 entfernen Hallo, hier das 2. Combofix-Log. Ich habe das CF-Script erst wieder personalisiert (letzte Zeile) und das Log hier wieder entpersonalisiert. Richtig so? Code:
ATTFilter ComboFix 13-04-02.01 - *** 02.04.2013 20:48:35.2.4 - x64
Microsoft Windows 7 Home Premium 6.1.7600.0.1252.49.1031.18.3893.2437 [GMT 2:00]
ausgeführt von:: c:\users\***\Pictures\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\***\Pictures\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((( Dateien erstellt von 2013-03-02 bis 2013-04-02 ))))))))))))))))))))))))))))))
.
.
2013-04-02 18:56 . 2013-04-02 18:56 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2013-04-02 18:56 . 2013-04-02 18:56 -------- d-----w- c:\users\Default\AppData\Local\temp
2013-04-01 18:05 . 2013-04-01 18:05 208216 ----a-w- c:\windows\system32\drivers\36876970.sys
2013-03-29 11:12 . 2013-03-29 11:12 -------- d-----w- c:\programdata\Malwarebytes
2013-03-27 18:53 . 2013-03-27 18:53 -------- d-----w- C:\GVU
2013-03-26 18:31 . 2013-03-26 18:31 -------- d-----w- c:\windows\SysWow64\searchplugins
2013-03-26 18:31 . 2013-03-26 18:31 -------- d-----w- c:\windows\SysWow64\Extensions
2013-03-25 20:16 . 2013-03-25 20:16 -------- d-----w- c:\programdata\BrowserProtect
2013-03-25 20:16 . 2013-03-27 14:32 -------- d-----w- c:\users\***\AppData\Roaming\BabSolution
2013-03-05 05:45 . 2013-02-19 02:57 9162192 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{91F013F4-0AB9-4B0D-BE05-EE7877DA5028}\mpengine.dll
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-15 17:07 . 2012-04-02 17:56 693976 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-15 17:07 . 2011-12-02 22:12 73432 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
(((((((((((((((((((((((((((((((((((((((((((( Look )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--- c:\windows\system32\drivers\36876970.sys ---
Company: Kaspersky Lab, GERT
File Description: Kaspersky Lab Mini Driver
File Version: 2.8.4.0 built by: WinDDK
Product Name: Kaspersky Lab Mini Driver
Copyright: Copyright (c) Kaspersky Lab, GERT
Original Filename: klmd.sys
File size: 208216
Created time: 2013-04-01 18:05
Modified time: 2013-04-01 18:05
MD5: F146E2BA475893DD77B2370DC1211FC6
SHA1: B34C5CDBC9597694131FD20562DB201F62E6D1FE
.
---- Directory of C:\GVU ----
.
2013-03-27 18:53 . 2013-03-27 16:35 124382 ----a-w- c:\gvu\Extras.Txt
2013-03-27 18:53 . 2013-03-27 16:34 115766 ----a-w- c:\gvu\OTL.Txt
.
---- Directory of c:\programdata\BrowserProtect ----
.
2013-03-25 20:17 . 2013-03-04 12:32 36290 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.crx
2013-03-25 20:16 . 2013-03-26 16:45 4033 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl
2013-03-25 20:16 . 2013-03-27 14:27 42520 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.settings
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13
2013-03-25 20:16 . 2013-03-27 14:27 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00
2013-03-25 20:16 . 2013-03-27 14:27 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01
2013-03-25 20:16 . 2013-03-27 14:25 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02
2013-03-25 20:16 . 2013-03-27 14:27 8 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03
2013-03-06 01:50 . 2013-03-06 01:50 120 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\BrowserProtect-3.6.xpt
2013-03-06 01:45 . 2013-03-25 20:17 925 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\install.rdf
2013-02-19 04:59 . 2013-03-25 20:17 228 ----a-w- c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content\overlay.xul
.
---- Directory of c:\users\***\AppData\Roaming\BabSolution ----
.
2013-03-25 20:16 . 2013-02-25 12:51 376427 ----a-w- c:\users\***\AppData\Roaming\BabSolution\CR\Delta.crx
.
---- Directory of c:\windows\SysWow64\Extensions ----
.
.
---- Directory of c:\windows\SysWow64\searchplugins ----
.
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-20 719672]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2011-05-22 102400]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-02-17 39408]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-01-31 17147528]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2012-11-11 3093624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HotkeyApp"="c:\program files (x86)\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]
"LMgrVolOSD"="c:\program files (x86)\Launch Manager\OSD.exe" [2009-12-11 348960]
"Wbutton"="c:\program files (x86)\Launch Manager\Wbutton.exe" [2010-06-21 436264]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2010-10-29 136488]
"LexwareInfoService"="c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"iWareV3"="c:\program files (x86)\MouseDriver\OfficeMouse.exe" [2009-03-27 507904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2011-04-25 305088]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Startcenter.lnk - c:\program files (x86)\FRITZ!DSL\StCenter.exe [2011-2-21 679936]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe [2010-12-06 62464]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-05-24 246304]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-10-27 24680]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-15 27760]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2010-07-14 87600]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-27 236136]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-10 2320920]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-10-29 31088]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-18 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-03-04 75816]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-03-02 1098784]
S3 WisLMSvc;WisLMSvc;c:\program files (x86)\Launch Manager\WisLMSvc.exe [2009-10-23 118560]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 17:07]
.
2013-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 16:53]
.
2013-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 16:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-02 11465320]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-09-02 2120808]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://webaccess.krones.com/vpn/index.html
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
Trusted Zone: krones.com\webaccess
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\lkickppl.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFOB6&ctid=CT2319825&SearchSource=2&q=
FF - ExtSQL: 2013-03-27 15:32; ffxtlbr@delta.com; c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\lkickppl.default\extensions\ffxtlbr@delta.com
FF - ExtSQL: !HIDDEN! 2011-03-06 16:53; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{DFEFCDEE-CF1A-4FC8-88AD-129872198372} - (no file)
AddRemove-FRITZ!DSL - c:\windows\IsUn0407.exe
AddRemove-LEGO Creator - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-04-02 20:59:01
ComboFix-quarantined-files.txt 2013-04-02 18:59
ComboFix2.txt 2013-04-02 06:15
.
Vor Suchlauf: 14 Verzeichnis(se), 489.621.315.584 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 489.322.672.128 Bytes frei
.
- - End Of File - - D93515D6BACA48055F9E8218E9EBDA2F
|
|
| Themen zu GVU Trojaner auf Win7 entfernen |
| abgesicherten, abgesicherter, archiv, eingabeaufforderung, eingefangen, entfernen, erfolgreich, erstellt, gen, gestern, helft, herunterfahren, hoffe, infizierte, komplett, modus, notebook, rechner, starte, starten, systemwiederherstellung, trojaner, win, win7, zusätzlich |
Linear-Darstellung
