GUV Trojaner, abgesichterter Modus nicht möglich; Win7

spirit83 · 11.05.2013, 19:47

Hallo zusammen,

ich hoffe mir kann jemand weiterhelfen.

Hab mir heute den GUV Trojaner eingefangen. Weißer Bildschirm, bitte zahlen PaySafeCard, Webcam, etc...das übliche :-(

Komme auch nicht in den abgesicherten Modus; nach LogIn startet Rechner direkt wieder neu...

Was kann ich tun? Bin leider in solchen Dingen absolut unbeholfen..

Win7 64bit

Virenprogramm Microsoft Security Essentials

Vielen Dank vorab für Eure Hilfe...

markusg · 11.05.2013, 19:51

Hi,
Mit einem sauberen 2. Rechner eine OTLPE-CD erstellen und den infizierten Rechner dann von dieser CD booten:

Falls Du kein Brennprogramm installiert hast, lade dir bitte ISOBurner herunter. Das Programm wird Dir erlauben, OTLPE auf eine CD zu brennen und sie bootfähig zu machen. Du brauchst das Tool nur zu installieren, der Rest läuft automatisch => Wie brenne ich eine ISO Datei auf CD/DVD.

Lade

OTLPENet.exe von OldTimer herunter und speichere sie auf Deinem Desktop. Anmerkung: Die Datei ist ca. 120 MB groß und es wird bei langsamer Internet-Verbindung ein wenig dauern, bis Du sie runtergeladen hast.

Wenn der Download fertig ist, mache einen Doppelklick auf die Datei und beantworte die Frage "Do you want to burn the CD?" mit Yes.
Lege eine leere CD in Deinen Brenner.
ImgBurn (oder Dein Brennprogramm) wird das Archiv extrahieren und OTLPE Network auf die CD brennen.
Wenn der Brenn-Vorgang abgeschlossen ist, wirst Du eine Dialogbox sehen => "Operation successfully completed".
Du kannst nun die Fenster des Brennprogramms schließen.

Nun boote von der OTLPE CD. Hinweis: Wie boote ich von CD

Bebilderte Anleitung: OTLpe-Scan

Dein System sollte nach einigen Minuten den REATOGO-X-PE Desktop anzeigen.
Mache einen Doppelklick auf das OTLPE Icon.
Hinweis: Damit OTLPE auch das richtige installierte Windows scant, musst du den Windows-Ordner des auf der Platte installierten Windows auswählen, einfach nur C: auswählen gibt einen Fehler!
Wenn Du gefragt wirst "Do you wish to load the remote registry", dann wähle Yes.
Wenn Du gefragt wirst "Do you wish to load remote user profile(s) for scanning", dann wähle Yes.
Vergewissere Dich, dass die Box "Automatically Load All Remaining Users" gewählt ist und drücke OK.
OTLpe sollte nun starten.
Drücke Run Scan, um den Scan zu starten.
Wenn der Scan fertig ist, werden die Dateien C:\OTL.Txt und C:\Extras.Txt erstellt
Kopiere diese Datei auf Deinen USB-Stick, wenn Du keine Internetverbindung auf diesem System hast.
Bitte poste den Inhalt von C:\OTL.txt und Extras.txt.

spirit83 · 11.05.2013, 20:24

Hi,

soweit komm ich leider nicht. CD brennen funktioniert..

Beim booten kommt zunächst "Starting Reatogo-X-PE" Dann startet WinXP, bricht dann aber sofort ab mit Blue Screen und folgender Meldung:

"A Problem has been detected and Windows has been shut down to prevent damage on your Computer. If this is the first time you`ve seen this Stop error Screen, restart your Computer. If this Screen appears again, follow These steps:

Check for viruses on your Computer. Remove any newly installed hard drives or hard drive Controllers. Check your hard drive to make sure it is properly configured and terminanted. Run CHKDSK /F to check for hard drive corruption, and then restart your Computer.
Technical Information:

*** STOP: 0x0000007B (0xF78DA528,0xC0000034,0x00000000,0x00000000)"

2. Versuch gleiche Meldung...

markusg · 11.05.2013, 20:39

Na, da gibts ne Lösung :-)
gehe ins bios, prüfe ob dort ide bzw AHCI Mode gewählt ist, jeweils das gegenteilige konfigurieren und neustarten mit der CD

spirit83 · 11.05.2013, 20:57

Danke :-)

Beim Start von OTLPE fragt er nach "Browse For Folder"

Wenn ich "My Computer" wähle, sagt er "No Windows installations found"

Alternativen:

RAMDisk (B

SYSTEM RESERVED (C

Acer (D

ReatogoPE (X

Shared Documents

Alle Pfade mit einigen Unterordnern...

Okay einen Schritt weiter bin ich...OTLPE läuft nun..

Wie bekomm ich jetzt den USB-Stick verbunden? Hab kein Laufwerk für den Stick angezeigt..I-Net funktioniert nicht..

markusg · 11.05.2013, 22:34

Hi nimm mal den Stick raus, starte neu mit der CD, stick rein und noch mal scannen

spirit83 · 12.05.2013, 09:26

Konnte über einen anderer Benutzer zwischenspeichern, USB-Stick hat er nicht direkt erkannt. Hoffe so passt es:OTL Logfile:

Code:

ATTFilter

OTL logfile created on: 5/12/2013 1:50:14 PM - Run 
OTLPE by OldTimer - Version 3.1.48.0     Folder = X:\Programs\OTLPE
64bit-Windows 7 Home Premium Service Pack 1 (Version = 6.1.7601) - Type = System
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
2.00 Gb Total Physical Memory | 2.00 Gb Available Physical Memory | 86.00% Memory free
2.00 Gb Paging File | 2.00 Gb Available in Paging File | 97.00% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = D: | %SystemRoot% = D:\Windows | %ProgramFiles% = D:\Program Files (x86)
Drive C: | 100.00 Mb Total Space | 75.83 Mb Free Space | 75.83% Space Free | Partition Type: NTFS
Drive D: | 683.54 Gb Total Space | 555.01 Gb Free Space | 81.20% Space Free | Partition Type: NTFS
Drive X: | 436.59 Mb Total Space | 0.00 Mb Free Space | 0.00% Space Free | Partition Type: CDFS
 
Computer Name: REATOGO | User Name: SYSTEM
Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
Using ControlSet: ControlSet002
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2013/05/11 11:43:46 | 000,109,352 | ---- | M] (SurfRight B.V.) [Auto] -- D:\Program Files\HitmanPro\hmpsched.exe -- (HitmanProScheduler)
SRV:64bit: - [2013/01/27 06:34:32 | 000,379,360 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Microsoft Security Client\NisSrv.exe -- (NisSrv)
SRV:64bit: - [2013/01/27 06:34:32 | 000,022,056 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Program Files\Microsoft Security Client\MsMpEng.exe -- (MsMpSvc)
SRV:64bit: - [2012/03/28 18:50:04 | 000,181,760 | ---- | M] (Oki Data Corporation) [Auto] -- D:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe -- (OpLclSrv)
SRV:64bit: - [2010/10/29 14:22:12 | 000,868,224 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe -- (ePowerSvc)
SRV:64bit: - [2010/10/07 21:24:16 | 000,150,016 | ---- | M] (Intel(R) Corporation) [On_Demand] -- D:\Program Files\Intel\TurboBoost\TurboBoost.exe -- (TurboBoost) Intel(R)
SRV:64bit: - [2010/09/22 13:10:10 | 000,057,184 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Program Files\Windows Live\Mesh\wlcrasvc.exe -- (wlcrasvc)
SRV:64bit: - [2010/01/28 20:27:36 | 000,243,232 | ---- | M] (Acer Group) [Auto] -- D:\Program Files\Acer\Acer Updater\UpdaterService.exe -- (Updater Service)
SRV:64bit: - [2009/07/13 21:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [On_Demand] -- D:\Program Files\Windows Defender\MpSvc.dll -- (WinDefend)
SRV - [2013/03/13 15:56:52 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [On_Demand] -- D:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012/12/18 10:28:08 | 000,065,192 | ---- | M] (Adobe Systems Incorporated) [Auto] -- D:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2011/07/24 20:49:00 | 000,172,640 | ---- | M] (DATEV eG) [On_Demand] -- D:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe -- (DATEV Update-Service)
SRV - [2011/03/03 08:09:45 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand] -- D:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)
SRV - [2011/01/18 08:22:46 | 000,313,424 | ---- | M] (Dritek System Inc.) [Auto] -- D:\Program Files (x86)\Launch Manager\dsiwmis.exe -- (DsiWMIService)
SRV - [2010/12/22 16:25:02 | 002,656,280 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe -- (UNS) Intel(R)
SRV - [2010/12/22 16:24:58 | 000,325,656 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe -- (LMS) Intel(R)
SRV - [2010/12/12 09:58:00 | 001,997,416 | ---- | M] (NVIDIA Corporation) [Auto] -- D:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe -- (nvUpdatusService)
SRV - [2010/11/25 15:29:54 | 000,052,896 | ---- | M] (Atheros Commnucations) [Auto] -- D:\Program Files (x86)\Bluetooth Suite\AdminService.exe -- (AtherosSvc)
SRV - [2010/11/11 21:21:52 | 000,257,344 | ---- | M] (NTI Corporation) [Auto] -- D:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe -- (NTI IScheduleSvc)
SRV - [2010/10/22 08:08:18 | 001,039,360 | ---- | M] (Hewlett-Packard Co.) [Auto] -- D:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL -- (HPSLPSVC)
SRV - [2010/09/27 22:09:54 | 000,172,912 | ---- | M] (Egis Technology Inc. ) [On_Demand] -- D:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe -- (EgisTec Ticket Service)
SRV - [2010/09/13 22:32:32 | 000,013,336 | ---- | M] (Intel Corporation) [Auto] -- D:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe -- (IAStorDataMgrSvc) Intel(R)
SRV - [2010/03/18 08:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto] -- D:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2010/01/08 09:21:22 | 000,023,584 | ---- | M] (Acer Incorporated) [Auto] -- D:\Program Files (x86)\Acer\Registration\GREGsvc.exe -- (GREGService)
SRV - [2009/06/10 17:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled] -- D:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2002/04/11 19:00:00 | 000,057,344 | ---- | M] (brother Industries Ltd) [Auto] -- D:\Windows\SysWOW64\BRSVC01A.EXE -- (Brother XP spl Service)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2013/01/20 10:59:04 | 000,130,008 | ---- | M] (Microsoft Corporation) [Kernel | Auto] -- D:\Windows\System32\drivers\NisDrvWFP.sys -- (NisDrv)
DRV:64bit: - [2011/11/24 17:23:36 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudserd.sys -- (ssudserd) SAMSUNG Mobile USB Diagnostic Serial Port(DEVGURU Ver.)
DRV:64bit: - [2011/11/24 17:23:32 | 000,203,320 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudmdm.sys -- (ssudmdm) SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.)
DRV:64bit: - [2011/11/24 17:23:28 | 000,098,616 | ---- | M] (DEVGURU Co., LTD.(www.devguru.co.kr)) [Kernel | On_Demand] -- D:\Windows\System32\drivers\ssudbus.sys -- (dg_ssudbus) SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.)
DRV:64bit: - [2011/08/31 13:46:00 | 000,088,480 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\atksgt.sys -- (atksgt)
DRV:64bit: - [2011/08/31 13:46:00 | 000,046,400 | ---- | M] () [Kernel | Auto] -- D:\Windows\System32\drivers\lirsgt.sys -- (lirsgt)
DRV:64bit: - [2011/01/27 00:42:19 | 000,062,584 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDVDisk.sys -- (mwlPSDVDisk)
DRV:64bit: - [2011/01/27 00:42:19 | 000,022,912 | ---- | M] (Egis Technology Inc.) [File_System | System] -- D:\Windows\System32\drivers\mwlPSDFilter.sys -- (mwlPSDFilter)
DRV:64bit: - [2011/01/27 00:42:19 | 000,020,328 | ---- | M] (Egis Technology Inc.) [Kernel | System] -- D:\Windows\System32\drivers\mwlPSDNserv.sys -- (mwlPSDNServ)
DRV:64bit: - [2010/12/23 13:44:22 | 012,260,000 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\igdkmd64.sys -- (igfx)
DRV:64bit: - [2010/12/15 23:42:08 | 000,035,368 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bScsiMSa.sys -- (bScsiMSa)
DRV:64bit: - [2010/12/12 09:58:00 | 000,025,576 | ---- | M] (NVIDIA Corporation) [Kernel | Boot] -- D:\Windows\System32\drivers\nvpciflt.sys -- (nvpciflt)
DRV:64bit: - [2010/12/12 00:43:54 | 000,085,544 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\bScsiSDa.sys -- (bScsiSDa)
DRV:64bit: - [2010/12/11 12:12:54 | 000,019,496 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\b57xdmp.sys -- (b57xdmp)
DRV:64bit: - [2010/12/11 12:12:50 | 000,067,112 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\b57xdbd.sys -- (b57xdbd)
DRV:64bit: - [2010/12/02 02:36:04 | 000,411,688 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\k57nd60a.sys -- (k57nd60a) Broadcom NetLink (TM)
DRV:64bit: - [2010/11/25 15:30:12 | 000,275,616 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btfilter.sys -- (BtFilter)
DRV:64bit: - [2010/11/25 15:30:12 | 000,201,376 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_hcrp.sys -- (BTATH_HCRP)
DRV:64bit: - [2010/11/25 15:30:12 | 000,154,272 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_rcp.sys -- (BTATH_RCP)
DRV:64bit: - [2010/11/25 15:30:12 | 000,055,456 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_lwflt.sys -- (BTATH_LWFLT)
DRV:64bit: - [2010/11/25 15:30:12 | 000,036,000 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_flt.sys -- (AthBTPort)
DRV:64bit: - [2010/11/25 15:30:12 | 000,028,832 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_bus.sys -- (BTATH_BUS)
DRV:64bit: - [2010/11/25 15:30:10 | 000,298,144 | ---- | M] (Atheros) [Kernel | On_Demand] -- D:\Windows\System32\drivers\btath_a2dp.sys -- (BTATH_A2DP)
DRV:64bit: - [2010/11/20 07:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2010/11/20 05:37:42 | 000,109,056 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\system32\drivers\sdbus.sys -- (sdbus)
DRV:64bit: - [2010/11/09 06:26:46 | 002,377,216 | ---- | M] (Atheros Communications, Inc.) [Kernel | On_Demand] -- D:\Windows\System32\drivers\athrx.sys -- (athr)
DRV:64bit: - [2010/10/19 20:34:26 | 000,056,344 | ---- | M] (Intel Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\HECIx64.sys -- (MEIx64) Intel(R)
DRV:64bit: - [2010/10/15 04:28:18 | 000,317,440 | ---- | M] (Intel(R) Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\IntcDAud.sys -- (IntcDAud) Intel(R)
DRV:64bit: - [2010/10/07 21:23:38 | 000,019,192 | ---- | M] (Intel(R) Corporation) [Kernel | Auto] -- D:\Windows\System32\drivers\TurboB.sys -- (TurboB)
DRV:64bit: - [2010/09/30 01:00:06 | 000,180,736 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nusb3xhc.sys -- (nusb3xhc)
DRV:64bit: - [2010/09/30 01:00:06 | 000,080,384 | ---- | M] (Renesas Electronics Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\nusb3hub.sys -- (nusb3hub)
DRV:64bit: - [2010/07/30 01:51:52 | 000,020,552 | ---- | M] (Devguru Co., Ltd) [Kernel | On_Demand] -- D:\Windows\System32\drivers\dgderdrv.sys -- (dgderdrv)
DRV:64bit: - [2010/06/24 09:00:14 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand] -- D:\Windows\System32\drivers\TFsExDisk.sys -- (TFsExDisk)
DRV:64bit: - [2009/07/13 20:39:20 | 000,023,040 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\WSDPrint.sys -- (WSDPrintDevice)
DRV:64bit: - [2009/07/13 20:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009/07/13 20:10:47 | 000,011,264 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\rootmdm.sys -- (ROOTMODEM)
DRV:64bit: - [2009/06/10 16:38:56 | 000,000,308 | ---- | M] () [File_System | On_Demand] -- D:\Windows\System32\wbem\ntfs.mof -- (Ntfs)
DRV:64bit: - [2009/06/10 16:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\evbda.sys -- (ebdrv)
DRV:64bit: - [2009/06/10 16:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\system32\DRIVERS\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009/06/10 16:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand] -- D:\Windows\System32\drivers\b57nd60a.sys -- (b57nd60a)
DRV - [2010/06/24 09:00:14 | 000,016,392 | ---- | M] (Teruten Inc) [File_System | On_Demand] -- D:\Windows\SysWOW64\drivers\TFsExDisk.Sys -- (TFsExDisk)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE:64bit: - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://acer.msn.com
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\Böhm_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKU\Böhm_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\Böhm_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\IGB_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKU\IGB_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
IE - HKU\IGB_ON_D\..\URLSearchHook: {40c3cc16-7269-4b32-9531-17f2950fb06f} - Reg Error: Key error. File not found
IE - HKU\IGB_ON_D\..\URLSearchHook: {78e516ef-11de-47a1-8364-a99b917ec5ee} - Reg Error: Key error. File not found
IE - HKU\IGB_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
 
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\UpdatusUser_ON_D\..\URLSearchHook: {B922D405-6D13-4A2B-AE89-08A030DA4402} - Reg Error: Key error. File not found
IE - HKU\UpdatusUser_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\VHL_ON_D\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://acer.msn.com
IE - HKU\VHL_ON_D\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\VHL_ON_D\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.de/"
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\System32\Macromed\Flash\NPSWF64_11_6_602_180.dll ()
FF:64bit: - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF:64bit: - HKLM\Software\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@adobe.com/FlashPlayer: D:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_6_602_180.dll ()
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: D:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: D:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: D:\Program Files (x86)\Microsoft Silverlight\5.1.20125.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/OfficeAuthz,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: D:\Program Files (x86)\Microsoft Office\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: D:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKLM\Software\Wow6432Node\MozillaPlugins\Adobe Reader: D:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 9.0.1\extensions\\Components: C:\Program Files (x86)\Mozilla Firefox\components [2012/01/30 07:34:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\wow6432node\mozilla\Mozilla Firefox 9.0.1\extensions\\Plugins: C:\Program Files (x86)\Mozilla Firefox\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Firefox\Extensions\\smartwebprinting@hp.com: C:\Program Files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
 
[2012/01/30 07:32:34 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Böhm\AppData\Roaming\Mozilla\Extensions
[2012/01/30 07:40:28 | 000,000,000 | ---D | M] (No name found) -- D:\Users\Böhm\AppData\Roaming\Mozilla\Firefox\Profiles\0s5j4w67.default\extensions
[2012/01/30 07:34:20 | 000,000,000 | ---D | M] (No name found) -- D:\Program Files (x86)\Mozilla Firefox\extensions
File not found (No name found) -- 
File not found (No name found) -- D:\USERS\BÃ¶HM\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\0S5J4W67.DEFAULT\EXTENSIONS\ICH@MALTEGOETZ.DE.XPI
[2011/12/21 03:42:29 | 000,121,816 | ---- | M] (Mozilla Foundation) -- D:\Program Files (x86)\mozilla firefox\components\browsercomps.dll
[2011/12/21 01:08:50 | 000,001,392 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\amazondotcom-de.xml
[2011/12/21 01:02:40 | 000,002,252 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\bing.xml
[2011/12/21 01:08:50 | 000,001,153 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\eBay-de.xml
[2011/12/21 01:08:50 | 000,006,805 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\leo_ende_de.xml
[2011/12/21 01:08:50 | 000,001,178 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\wikipedia-de.xml
[2011/12/21 01:08:50 | 000,001,105 | ---- | M] () -- D:\Program Files (x86)\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 17:00:26 | 000,000,824 | ---- | M]) - D:\Windows\System32\drivers\etc\hosts
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - D:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - D:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\IGB_ON_D\..\Toolbar\WebBrowser: (no name) - {40C3CC16-7269-4B32-9531-17F2950FB06F} - No CLSID value found.
O3 - HKU\IGB_ON_D\..\Toolbar\WebBrowser: (no name) - {78E516EF-11DE-47A1-8364-A99B917EC5EE} - No CLSID value found.
O4:64bit: - HKLM..\Run: [Acer ePower Management] D:\Program Files\Acer\Acer ePower Management\ePowerTray.exe (Acer Incorporated)
O4:64bit: - HKLM..\Run: [AthBtTray] D:\Program Files (x86)\Bluetooth Suite\AthBtTray.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [AtherosBtStack] D:\Program Files (x86)\Bluetooth Suite\BtvStack.exe (Atheros Commnucations)
O4:64bit: - HKLM..\Run: [MSC] D:\Program Files\Microsoft Security Client\msseces.exe (Microsoft Corporation)
O4:64bit: - HKLM..\Run: [Network Configuration] D:\Program Files (x86)\Okidata\ActKey\Network Configuration.exe (Oki Data Corporation)
O4:64bit: - HKLM..\Run: [RtHDVBg] D:\Program Files\Realtek\Audio\HDA\RAVBg64.exe (Realtek Semiconductor)
O4:64bit: - HKLM..\Run: [RtHDVCpl] D:\Program Files\Realtek\Audio\HDA\RAVCpl64.exe (Realtek Semiconductor)
O4 - HKLM..\Run: []  File not found
O4 - HKLM..\Run: [ArcadeMovieService] D:\Program Files (x86)\Acer\clear.fi\Movie\clear.fiMovieService.exe (CyberLink Corp.)
O4 - HKLM..\Run: [BackupManagerTray] D:\Program Files (x86)\NTI\Acer Backup Manager\BackupManagerTray.exe (NTI Corporation)
O4 - HKLM..\Run: [BrMfcWnd]  File not found
O4 - HKLM..\Run: [EgisTecPMMUpdate] D:\Program Files (x86)\EgisTec IPS\PmmUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [EgisUpdate] D:\Program Files (x86)\EgisTec IPS\EgisUpdate.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [IAStorIcon] D:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe (Intel Corporation)
O4 - HKLM..\Run: [LManager] D:\Program Files (x86)\Launch Manager\LManager.exe (Dritek System Inc.)
O4 - HKLM..\Run: [MDS_Menu] D:\Program Files (x86)\Acer\clear.fi\MediaEspresso\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
O4 - HKLM..\Run: [NUSB3MON] D:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe (Renesas Electronics Corporation)
O4 - HKLM..\Run: [PDFPrint] D:\Program Files (x86)\PDF24\pdf24.exe (Geek Software GmbH)
O4 - HKLM..\Run: [routcnf]  File not found
O4 - HKLM..\Run: [ScanSoft OmniPage SE 16-reminder] D:\Program Files (x86)\ScanSoft\OmniPage16\Ereg\Ereg.exe (Nuance Communications, Inc.)
O4 - HKLM..\Run: [SuiteTray] D:\Program Files (x86)\EgisTec MyWinLockerSuite\x86\SuiteTray.exe (Egis Technology Inc.)
O4 - HKLM..\Run: [UnlockerAssistant]  File not found
O4 - HKU\Böhm_ON_D..\Run: [KiesHelper] D:\Program Files (x86)\Samsung\Kies\KiesHelper.exe (Samsung)
O4 - HKU\Böhm_ON_D..\Run: [KiesPDLR] D:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe ()
O4 - HKU\Böhm_ON_D..\Run: [KiesTrayAgent] D:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
O4 - HKU\IGB_ON_D..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Users\IGB\Documents\ab26865.exe ()
O4 - HKU\LocalService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\NetworkService_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_D..\Run: [AnyDVD]  File not found
O4 - HKU\UpdatusUser_ON_D..\Run: [LauncherStart]  File not found
O4 - HKU\UpdatusUser_ON_D..\Run: [Sidebar] D:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\UpdatusUser_ON_D..\Run: [Skype]  File not found
O4 - HKU\Böhm_ON_D..\RunOnce: [FlashPlayerUpdate] D:\Windows\SysWOW64\Macromed\Flash\FlashUtil32_11_6_602_180_ActiveX.exe (Adobe Systems Incorporated)
O4 - HKU\LocalService_ON_D..\RunOnce: [mctadmin]  File not found
O4 - HKU\NetworkService_ON_D..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_D..\RunOnce: [mctadmin]  File not found
O4 - HKU\UpdatusUser_ON_D..\RunOnce: [ScrSav] D:\Program Files (x86)\Acer\Screensaver\run_Acer.exe ()
O4 - Startup: D:\Users\IGB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk ()
O4 - Startup: D:\Users\VHL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: EnableLinkedConnections = 1
O7 - HKU\VHL_ON_D\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: LinkResolveIgnoreLinkInfo = 1
O9:64bit: - Extra 'Tools' menuitem : Send by Bluetooth to - {7815BE26-237D-41A8-A98F-F7BD75F71086} - Reg Error: Value error. File not found
O13:64bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1 192.168.2.1
O18:64bit: - Protocol\Handler\livecall {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\ms-help {314111c7-a502-11d2-bbca-00c04f8ec294} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\msnim {828030A1-22C1-4009-854F-8E305202313F} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlmailhtml {03C514A3-1EFB-4856-9F99-10D7BE1653C0} - Reg Error: Key error. File not found
O18:64bit: - Protocol\Handler\wlpg {E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} - Reg Error: Key error. File not found
O20:64bit: - AppInit_DLLs: (C:\Windows\system32\nvinitx.dll) - D:\Windows\System32\nvinitx.dll (NVIDIA Corporation)
O20 - AppInit_DLLs: (C:\Windows\SysWOW64\nvinit.dll) - D:\Windows\SysWOW64\nvinit.dll (NVIDIA Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - D:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKU\IGB_ON_D Winlogon: Shell - (cmd.exe) - D:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
O20 - HKU\VHL_ON_D Winlogon: Shell - (Explorer.exe) - D:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - CLSID or File not found.
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2006/03/24 07:06:41 | 000,000,053 | R--- | M] () - X:\AUTORUN.INF -- [ CDFS ]
O33 - MountPoints2\{127afada-3576-11e1-ab7d-1c7508da12c3}\Shell - "" = AutoRun
O33 - MountPoints2\{127afada-3576-11e1-ab7d-1c7508da12c3}\Shell\AutoRun\command - "" = E:\setup.exe
O33 - MountPoints2\E\Shell - "" = AutoRun
O33 - MountPoints2\E\Shell\AutoRun\command - "" = E:\setup.exe AUTORUN=1
O34 - HKLM BootExecute: (autocheck autochk *) -  File not found
64bit: O35 - HKLM\..comfile [open] -- "%1" %* File not found
64bit: O35 - HKLM\..exefile [open] -- "%1" %* File not found
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
 
 
========== Files/Folders - Created Within 30 Days ==========
 
[2013/05/11 12:30:19 | 000,000,000 | ---D | C] -- D:\Users\Böhm\Desktop\Neuer Ordner
[2013/05/11 11:43:45 | 000,000,000 | ---D | C] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
[2013/05/11 11:43:45 | 000,000,000 | ---D | C] -- D:\Program Files\HitmanPro
[2013/05/11 11:43:19 | 000,000,000 | ---D | C] -- D:\ProgramData\HitmanPro
[2013/05/11 11:15:22 | 000,000,000 | ---D | C] -- D:\Users\VHL\AppData\Roaming\OkiData
[2013/04/13 04:44:12 | 000,000,000 | ---D | C] -- D:\Users\Böhm\AppData\Roaming\OkiData
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2013/05/11 17:42:37 | 000,067,584 | --S- | M] () -- D:\Windows\bootstat.dat
[2013/05/11 17:42:04 | 3104,722,944 | -HS- | M] () -- D:\hiberfil.sys
[2013/05/11 12:18:02 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2013/05/11 12:18:02 | 000,009,696 | -H-- | M] () -- D:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2013/05/11 12:13:11 | 000,000,035 | ---- | M] () -- D:\Users\Public\Documents\AtherosServiceConfig.ini
[2013/05/11 12:01:29 | 000,032,000 | ---- | M] () -- D:\Windows\System32\drivers\hitmanpro37.sys
[2013/05/11 11:57:47 | 000,002,358 | ---- | M] () -- D:\Windows\System32\.crusader
[2013/05/11 11:56:00 | 000,000,884 | ---- | M] () -- D:\Windows\tasks\Adobe Flash Player Updater.job
[2013/05/11 11:43:46 | 000,001,909 | ---- | M] () -- D:\Users\Public\Desktop\HitmanPro.lnk
[2013/05/11 11:43:46 | 000,000,000 | ---D | M] -- D:\ProgramData\Microsoft\Windows\Start Menu\Programs\HitmanPro
[2013/05/11 11:18:38 | 000,000,360 | ---- | M] () -- D:\Windows\wininit.ini
[2013/05/11 11:18:37 | 000,001,136 | ---- | M] () -- D:\Users\VHL\Desktop\Mediencenter.lnk
[2013/05/11 11:18:37 | 000,001,128 | ---- | M] () -- D:\Users\VHL\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk
[2013/05/11 11:14:19 | 001,084,755 | ---- | M] () -- D:\Users\IGB\AppData\Roaming\2433f433
[2013/05/11 11:14:19 | 001,084,685 | ---- | M] () -- D:\ProgramData\2433f433
[2013/05/11 11:14:19 | 001,084,673 | ---- | M] () -- D:\Users\IGB\AppData\Local\2433f433
[2013/05/11 11:14:05 | 000,030,208 | ---- | M] () -- D:\Users\IGB\Documents\ab26865.exe
[2013/05/10 17:10:27 | 001,592,502 | ---- | M] () -- D:\Windows\SysWow64\PerfStringBackup.INI
[2013/05/10 17:10:27 | 000,697,598 | ---- | M] () -- D:\Windows\System32\perfh007.dat
[2013/05/10 17:10:27 | 000,652,876 | ---- | M] () -- D:\Windows\System32\perfh009.dat
[2013/05/10 17:10:27 | 000,148,862 | ---- | M] () -- D:\Windows\System32\perfc007.dat
[2013/05/10 17:10:27 | 000,121,808 | ---- | M] () -- D:\Windows\System32\perfc009.dat
[2013/05/10 15:53:32 | 000,000,929 | ---- | M] () -- D:\Windows\wiso.ini
[2013/05/09 16:02:41 | 000,000,207 | ---- | M] () -- D:\Windows\odbc_merge.INI
[2013/04/27 16:24:17 | 001,527,369 | ---- | M] () -- D:\Users\IGB\Desktop\Mietspiegel2011.pdf
[2013/04/22 16:08:54 | 000,001,136 | ---- | M] () -- D:\Users\IGB\Desktop\Mediencenter.lnk
[2013/04/22 16:08:54 | 000,001,128 | ---- | M] () -- D:\Users\IGB\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Mediencenter.lnk
[2013/04/16 15:29:11 | 000,231,523 | ---- | M] () -- D:\Users\IGB\Desktop\Anzeige im Steigerwald-Kurier.zip
[2013/04/12 14:21:13 | 000,439,528 | ---- | M] () -- D:\Windows\System32\FNTCACHE.DAT
[1 D:\Windows\*.tmp files -> D:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2013/05/11 12:01:29 | 000,032,000 | ---- | C] () -- D:\Windows\System32\drivers\hitmanpro37.sys
[2013/05/11 11:57:47 | 000,002,358 | ---- | C] () -- D:\Windows\System32\.crusader
[2013/05/11 11:43:46 | 000,001,909 | ---- | C] () -- D:\Users\Public\Desktop\HitmanPro.lnk
[2013/05/11 11:14:19 | 001,084,755 | ---- | C] () -- D:\Users\IGB\AppData\Roaming\2433f433
[2013/05/11 11:14:19 | 001,084,685 | ---- | C] () -- D:\ProgramData\2433f433
[2013/05/11 11:14:19 | 001,084,673 | ---- | C] () -- D:\Users\IGB\AppData\Local\2433f433
[2013/05/11 11:14:05 | 000,030,208 | ---- | C] () -- D:\Users\IGB\Documents\ab26865.exe
[2013/04/27 16:24:17 | 001,527,369 | ---- | C] () -- D:\Users\IGB\Desktop\Mietspiegel2011.pdf
[2013/04/16 15:29:10 | 000,231,523 | ---- | C] () -- D:\Users\IGB\Desktop\Anzeige im Steigerwald-Kurier.zip
[2013/03/30 07:50:26 | 000,000,407 | ---- | C] () -- D:\Windows\MAXLINK.INI
[2013/03/21 04:12:47 | 000,000,153 | ---- | C] () -- D:\ProgramData\6733936.reg
[2013/03/21 04:12:47 | 000,000,058 | ---- | C] () -- D:\ProgramData\6733936.bat
[2013/03/21 04:12:45 | 095,023,320 | ---- | C] () -- D:\ProgramData\6733936.pad
[2013/02/13 16:22:15 | 000,000,159 | ---- | C] () -- D:\ProgramData\dsgsdgdsgdsgw.reg
[2013/02/13 16:22:15 | 000,000,064 | ---- | C] () -- D:\ProgramData\dsgsdgdsgdsgw.bat
[2013/01/28 15:51:04 | 000,182,874 | ---- | C] () -- D:\Windows\hpoins52.dat
[2013/01/28 15:51:04 | 000,001,333 | ---- | C] () -- D:\Windows\hpomdl52.dat
[2013/01/28 15:44:58 | 000,238,402 | ---- | C] () -- D:\Windows\hpoins52.dat.temp
[2013/01/28 15:44:58 | 000,001,333 | ---- | C] () -- D:\Windows\hpomdl52.dat.temp
[2013/01/26 17:23:14 | 000,000,004 | ---- | C] () -- D:\Users\IGB\AppData\Roaming\skype.ini
[2012/12/16 12:53:38 | 000,000,360 | ---- | C] () -- D:\Windows\wininit.ini
[2012/11/23 11:01:21 | 000,000,047 | ---- | C] () -- D:\Users\VHL\AppData\Roaming\msconfig.ini
[2012/11/15 16:00:45 | 000,000,030 | ---- | C] () -- D:\Windows\SysWow64\brss01a.ini
[2012/11/15 15:58:27 | 000,000,060 | R--- | C] () -- D:\Program Files (x86)\BRINST.INI
[2012/09/17 15:01:36 | 000,000,034 | ---- | C] () -- D:\Windows\SysWow64\BD8065DN.DAT
[2012/09/17 14:59:38 | 000,045,056 | ---- | C] () -- D:\Windows\SysWow64\BRTCPCON.DLL
[2012/09/17 14:59:30 | 000,000,114 | ---- | C] () -- D:\Windows\SysWow64\BRLMW03A.INI
[2012/05/08 14:16:28 | 000,000,111 | ---- | C] () -- D:\Windows\KurusDeinstall.INI
[2012/04/16 15:52:53 | 000,004,853 | ---- | C] () -- D:\Users\VHL\AppData\Local\EmptySettings.xml
[2012/04/15 15:27:55 | 000,000,021 | ---- | C] () -- D:\Windows\DvInesKurusOleServer003.INI
[2012/04/15 15:19:59 | 000,000,095 | ---- | C] () -- D:\Windows\dvinesinstalllocation001.INI
[2012/04/15 15:15:30 | 000,000,096 | ---- | C] () -- D:\Windows\Startup.INI
[2012/03/20 15:45:55 | 000,000,929 | ---- | C] () -- D:\Windows\wiso.ini
[2012/03/07 16:51:16 | 000,000,364 | ---- | C] () -- D:\Windows\ODBC.INI
[2012/02/28 17:09:02 | 000,000,207 | ---- | C] () -- D:\Windows\odbc_merge.INI
[2012/02/01 11:11:30 | 000,000,487 | ---- | C] () -- D:\Windows\Capictrl.INI
[2012/02/01 10:25:57 | 000,000,059 | ---- | C] () -- D:\Windows\WINPHONE.INI
[2012/01/30 08:27:26 | 000,000,040 | -HS- | C] () -- D:\ProgramData\.zreglib
[2012/01/30 08:01:59 | 000,017,408 | ---- | C] () -- D:\Users\Böhm\AppData\Local\WebpageIcons.db
[2012/01/30 07:32:31 | 000,000,000 | ---- | C] () -- D:\Windows\nsreg.dat
[2012/01/14 15:28:58 | 000,000,254 | ---- | C] () -- D:\Windows\Brpfx04a.ini
[2012/01/14 15:28:58 | 000,000,093 | ---- | C] () -- D:\Windows\brpcfx.ini
[2012/01/14 15:28:04 | 000,000,432 | ---- | C] () -- D:\Windows\BRWMARK.INI
[2012/01/14 15:28:04 | 000,000,027 | ---- | C] () -- D:\Windows\BRPP2KA.INI
[2012/01/14 15:26:51 | 000,106,496 | ---- | C] () -- D:\Windows\SysWow64\BrMuSNMP.dll
[2011/10/04 06:06:54 | 000,000,600 | ---- | C] () -- D:\Users\Böhm\AppData\Local\PUTTY.RND
[2011/08/28 15:21:37 | 000,252,928 | ---- | C] () -- D:\Windows\SysWow64\DShowRdpFilter.dll
[2011/08/27 16:25:19 | 000,004,096 | ---- | C] () -- D:\Windows\d3dx.dat
[2011/08/27 16:07:55 | 000,007,597 | ---- | C] () -- D:\Users\Böhm\AppData\Local\Resmon.ResmonCfg
[2011/08/27 15:34:40 | 001,592,502 | ---- | C] () -- D:\Windows\SysWow64\PerfStringBackup.INI
[2011/06/07 06:13:38 | 000,974,848 | ---- | C] () -- D:\Windows\SysWow64\cis-2.4.dll
[2011/06/07 06:13:38 | 000,081,920 | ---- | C] () -- D:\Windows\SysWow64\issacapi_bs-2.3.dll
[2011/06/07 06:13:38 | 000,065,536 | ---- | C] () -- D:\Windows\SysWow64\issacapi_pe-2.3.dll
[2011/06/07 06:13:38 | 000,057,344 | ---- | C] () -- D:\Windows\SysWow64\issacapi_se-2.3.dll
[2011/06/07 06:13:38 | 000,030,568 | ---- | C] () -- D:\Windows\MusiccityDownload.exe
[2011/01/27 00:29:59 | 000,131,984 | ---- | C] () -- D:\ProgramData\FullRemove.exe
[2011/01/26 23:44:48 | 000,960,940 | ---- | C] () -- D:\Windows\SysWow64\igkrng600.bin
[2011/01/26 23:44:48 | 000,207,376 | ---- | C] () -- D:\Windows\SysWow64\igfcg600m.bin
[2011/01/26 23:44:45 | 000,145,804 | ---- | C] () -- D:\Windows\SysWow64\igcompkrng600.bin
[2009/07/14 01:38:36 | 000,067,584 | --S- | C] () -- D:\Windows\bootstat.dat
[2009/07/13 22:35:51 | 000,000,741 | ---- | C] () -- D:\Windows\SysWow64\NOISE.DAT
[2009/07/13 22:34:42 | 000,215,943 | ---- | C] () -- D:\Windows\SysWow64\dssec.dat
[2009/07/13 20:10:29 | 000,043,131 | ---- | C] () -- D:\Windows\mib.bin
[2009/07/13 19:42:10 | 000,064,000 | ---- | C] () -- D:\Windows\SysWow64\BWContextHandler.dll
[2009/07/13 18:25:04 | 000,197,632 | ---- | C] () -- D:\Windows\SysWow64\ir32_32.dll
[2009/07/13 17:03:59 | 000,364,544 | ---- | C] () -- D:\Windows\SysWow64\msjetoledb40.dll
[2009/06/10 17:26:10 | 000,673,088 | ---- | C] () -- D:\Windows\SysWow64\mlang.dat
 
========== LOP Check ==========
 
[2011/01/27 00:40:17 | 000,000,000 | ---D | M] -- D:\ProgramData\Acer
[2011/08/27 16:43:33 | 000,000,000 | ---D | M] -- D:\ProgramData\AirportMania
[2012/02/08 15:57:37 | 000,000,000 | ---D | M] -- D:\ProgramData\AlawarWrapper
[2011/08/27 14:48:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Anwendungsdaten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Application Data
[2011/08/31 13:48:27 | 000,000,000 | ---D | M] -- D:\ProgramData\Arcade Lab
[2011/01/27 00:48:51 | 000,000,000 | ---D | M] -- D:\ProgramData\BackupManager
[2013/05/11 12:11:21 | 000,000,000 | ---D | M] -- D:\ProgramData\boost_interprocess
[2013/04/20 15:01:26 | 000,000,000 | ---D | M] -- D:\ProgramData\Buhl Data Service GmbH
[2012/01/28 07:08:58 | 000,000,000 | ---D | M] -- D:\ProgramData\Caphyon
[2013/05/11 12:11:30 | 000,000,000 | ---D | M] -- D:\ProgramData\clear.fi
[2011/03/03 08:16:01 | 000,000,000 | ---D | M] -- D:\ProgramData\CLSK
[2012/01/28 07:09:15 | 000,000,000 | ---D | M] -- D:\ProgramData\ConeXware
[2012/04/15 15:57:04 | 000,000,000 | ---D | M] -- D:\ProgramData\DATEV
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Desktop
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Documents
[2011/08/27 14:48:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Dokumente
[2011/03/03 07:52:20 | 000,000,000 | ---D | M] -- D:\ProgramData\EgisTec
[2011/03/03 07:52:14 | 000,000,000 | ---D | M] -- D:\ProgramData\EgisTec IPS
[2012/09/23 14:54:39 | 000,000,000 | ---D | M] -- D:\ProgramData\elsterformular
[2011/01/27 00:28:12 | 000,000,000 | ---D | M] -- D:\ProgramData\eSobi
[2011/08/27 14:48:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favoriten
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Favorites
[2013/05/11 11:57:59 | 000,000,000 | ---D | M] -- D:\ProgramData\HitmanPro
[2011/08/27 15:04:59 | 000,000,000 | ---D | M] -- D:\ProgramData\NTI Launcher
[2011/01/27 00:36:46 | 000,000,000 | ---D | M] -- D:\ProgramData\OberonGameConsole
[2011/08/27 14:50:51 | 000,000,000 | ---D | M] -- D:\ProgramData\oem
[2013/03/30 06:35:55 | 000,000,000 | ---D | M] -- D:\ProgramData\OKFP
[2013/03/30 07:12:16 | 000,000,000 | ---D | M] -- D:\ProgramData\Okidata
[2012/02/28 16:01:42 | 000,000,000 | ---D | M] -- D:\ProgramData\Samsung
[2011/08/30 15:48:03 | 000,000,000 | ---D | M] -- D:\ProgramData\Sandlot Games
[2013/03/30 07:50:24 | 000,000,000 | ---D | M] -- D:\ProgramData\ScanSoft
[2012/01/30 07:38:13 | 000,000,000 | ---D | M] -- D:\ProgramData\SlySoft
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Start Menu
[2011/08/27 14:48:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Startmenü
[2012/02/21 05:17:32 | 000,000,000 | ---D | M] -- D:\ProgramData\Steuersoft
[2012/02/08 15:56:34 | 000,000,000 | ---D | M] -- D:\ProgramData\Temp
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\ProgramData\Templates
[2012/02/14 16:01:52 | 000,000,000 | ---D | M] -- D:\ProgramData\TZ-EasyBuch
[2011/08/30 15:25:10 | 000,000,000 | ---D | M] -- D:\ProgramData\VirtualizedApplications
[2011/08/27 14:48:21 | 000,000,000 | -HSD | M] -- D:\ProgramData\Vorlagen
[2013/01/09 16:04:27 | 000,032,640 | ---- | M] () -- D:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
 
< %SYSTEMDRIVE%\*. >
[2013/01/23 16:01:19 | 000,000,000 | -HSD | M] -- D:\$Recycle.Bin
[2012/09/12 16:38:33 | 000,000,000 | ---D | M] -- D:\2eda47b5ebd61d0f0b909a919c52c7
[2012/12/02 12:21:11 | 000,000,000 | ---D | M] -- D:\5e5add3bccf7704558484ab9f57c66
[2011/03/03 07:52:25 | 000,000,000 | ---D | M] -- D:\book
[2013/05/10 17:10:38 | 000,000,000 | ---D | M] -- D:\Config.Msi
[2012/04/15 15:27:53 | 000,000,000 | ---D | M] -- D:\DATEV
[2012/04/15 16:06:23 | 000,000,000 | ---D | M] -- D:\DDS
[2009/07/14 01:08:56 | 000,000,000 | -HSD | M] -- D:\Documents and Settings
[2011/08/27 14:48:21 | 000,000,000 | -HSD | M] -- D:\Dokumente und Einstellungen
[2011/03/03 07:48:24 | 000,000,000 | ---D | M] -- D:\Intel
[2012/01/30 07:49:13 | 000,000,000 | RH-D | M] -- D:\MSOCache
[2011/08/27 14:50:17 | 000,000,000 | -H-D | M] -- D:\OEM
[2009/07/13 23:20:08 | 000,000,000 | ---D | M] -- D:\PerfLogs
[2013/05/11 11:43:45 | 000,000,000 | R--D | M] -- D:\Program Files
[2013/03/30 08:24:28 | 000,000,000 | R--D | M] -- D:\Program Files (x86)
[2013/05/11 11:57:47 | 000,000,000 | ---D | M] -- D:\ProgramData
[2011/08/27 14:48:21 | 000,000,000 | -HSD | M] -- D:\Programme
[2011/08/27 14:48:22 | 000,000,000 | -HSD | M] -- D:\Recovery
[2013/05/10 17:01:38 | 000,000,000 | -HSD | M] -- D:\System Volume Information
[2013/05/09 14:31:50 | 000,000,000 | ---D | M] -- D:\Taxpool
[2012/11/15 15:19:25 | 000,000,000 | ---D | M] -- D:\Temp
[2012/03/22 15:39:52 | 000,000,000 | R--D | M] -- D:\Users
[2012/02/21 04:47:51 | 000,000,000 | ---D | M] -- D:\VLH
[2013/01/17 15:53:35 | 000,000,000 | ---D | M] -- D:\VueScan
[2013/03/30 07:50:26 | 000,000,000 | ---D | M] -- D:\Windows
 
< %PROGRAMFILES%\*.exe >
 
Invalid Environment Variable: %LOCALAPPDATA%\*.exe
 
< %systemroot%\*. /mp /s >
 
 
< MD5 for: AGP440.SYS  >
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- D:\Windows\System32\drivers\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- D:\Windows\System32\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- D:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009/07/13 21:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- D:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- D:\Windows\System32\drivers\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- D:\Windows\System32\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- D:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009/07/13 21:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- D:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- D:\Windows\SysWOW64\cngaudit.dll
[2009/07/13 21:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- D:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- D:\Windows\System32\cngaudit.dll
[2009/07/13 21:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- D:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: EXPLORER.EXE  >
[2011/02/26 02:23:14 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=0862495E0C825893DB75EF44FAEA8E93 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_adc24107935a7e25\explorer.exe
[2011/02/26 01:19:21 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=0FB9C74046656D1579A64660AD67B746 -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_ba87e574ddfe652d\explorer.exe
[2009/07/13 21:14:20 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=15BC38A7492BEFE831966ADB477CF76F -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_b7fe430bc7ce3761\explorer.exe
[2011/02/26 01:51:13 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=255CF508D7CFB10E0794D6AC93280BD8 -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_b8ce9756e0b786a4\explorer.exe
[2010/07/17 15:26:04 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=2626FC9755BE22F805D3CFA0CE3EE727 -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_b819b343c7ba6202\explorer.exe
[2011/02/26 01:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) MD5=2AF58D15EDC06EC6FDACCE1F19482BBF -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16768_none_b816eb59c7bb4020\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- D:\Windows\explorer.exe
[2011/02/25 02:19:30 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=332FEAB1435662FC6C672E25BEB37BE3 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_afa79dc39081d0ba\explorer.exe
[2011/02/26 02:14:34 | 002,871,808 | ---- | M] (Microsoft Corporation) MD5=3B69712041F3D63605529BD66DC00C48 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.21669_none_b0333b22a99da332\explorer.exe
[2010/11/20 08:17:09 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=40D777B7A95E00593EB1568C68514493 -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_ba2f56d3c4bcbafb\explorer.exe
[2010/02/04 06:49:48 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=700073016DAC1C3D2E7E2CE4223334B6 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_ae84b558ac4eb41c\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- D:\Windows\SysWOW64\explorer.exe
[2011/02/25 01:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) MD5=8B88EBBB05A0E56B7DCC708498C02B3E -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17567_none_b9fc4815c4e292b5\explorer.exe
[2010/07/17 15:26:04 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=9AAAEC8DAC27AA17B053E6352AD233AE -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16450_none_adc508f19359a007\explorer.exe
[2010/02/04 06:49:48 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=9FF6C4C91A3711C0A3B18F87B08B518D -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20500_none_b8d95faae0af7617\explorer.exe
[2010/11/20 09:24:45 | 002,872,320 | ---- | M] (Microsoft Corporation) MD5=AC4C51EB24AA95B77F705AB159189E24 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7601.17514_none_afdaac81905bf900\explorer.exe
[2010/07/17 15:26:04 | 002,870,272 | ---- | M] (Microsoft Corporation) MD5=B8EC4BD49CE8F6FC457721BFC210B67F -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_ae46d6aeac7ca7c7\explorer.exe
[2010/02/04 06:49:48 | 002,613,248 | ---- | M] (Microsoft Corporation) MD5=B95EEB0F4E5EFBF1038A35B3351CF047 -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_b853c407c78e3ba9\explorer.exe
[2009/07/13 21:39:10 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=C235A51CB740E45FFA0EBFB9BAFCDA64 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16385_none_ada998b9936d7566\explorer.exe
[2010/07/17 15:26:04 | 002,614,272 | ---- | M] (Microsoft Corporation) MD5=C76153C7ECA00FA852BB0C193378F917 -- D:\Windows\winsxs\wow64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20563_none_b89b8100e0dd69c2\explorer.exe
[2011/02/26 02:26:45 | 002,870,784 | ---- | M] (Microsoft Corporation) MD5=E38899074D4951D31B4040E994DD7C8D -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.20910_none_ae79ed04ac56c4a9\explorer.exe
[2010/02/04 06:49:48 | 002,868,224 | ---- | M] (Microsoft Corporation) MD5=F170B4A061C9E026437B193B4D571799 -- D:\Windows\winsxs\amd64_microsoft-windows-explorer_31bf3856ad364e35_6.1.7600.16404_none_adff19b5932d79ae\explorer.exe
 
< MD5 for: IASTOR.SYS  >
[2010/09/13 21:18:16 | 000,353,304 | ---- | M] (Intel Corporation) MD5=F4F4CBC7F6C7CB940AA9F0AAF3EF1104 -- D:\OEM\Preload\Autorun\DRV\Intel AHCI\f6flpy-x86\iaStor.sys
[2010/09/13 21:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- D:\OEM\Preload\Autorun\DRV\Intel AHCI\f6flpy-x64\iaStor.sys
[2010/09/13 22:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- D:\Windows\System32\drivers\iaStor.sys
[2010/09/13 22:24:26 | 000,437,272 | ---- | M] (Intel Corporation) MD5=F7CE9BE72EDAC499B713ECA6DAE5D26F -- D:\Windows\System32\DriverStore\FileRepository\iaahci.inf_amd64_neutral_2b0c50dc63f09dae\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- D:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 09:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- D:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011/03/11 02:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- D:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- D:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- D:\Windows\System32\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 02:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- D:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011/03/11 02:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- D:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011/03/11 02:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- D:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009/07/13 21:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- D:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009/07/13 21:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- D:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- D:\Windows\System32\netlogon.dll
[2010/11/20 09:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- D:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- D:\Windows\SysWOW64\netlogon.dll
[2010/11/20 08:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- D:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009/07/13 21:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- D:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009/07/13 21:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- D:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011/03/11 02:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- D:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011/03/11 02:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- D:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011/03/11 02:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- D:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- D:\Windows\System32\drivers\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- D:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 02:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- D:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- D:\Windows\System32\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 09:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- D:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/13 21:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- D:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009/07/13 21:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- D:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- D:\Windows\SysWOW64\scecli.dll
[2010/11/20 08:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- D:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- D:\Windows\System32\scecli.dll
[2010/11/20 09:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- D:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- D:\Windows\SysWOW64\user32.dll
[2010/11/20 08:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- D:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009/07/13 21:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- D:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009/07/13 21:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- D:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- D:\Windows\System32\user32.dll
[2010/11/20 09:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- D:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- D:\Windows\SysWOW64\userinit.exe
[2010/11/20 08:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- D:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/13 21:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- D:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009/07/13 21:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- D:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- D:\Windows\System32\userinit.exe
[2010/11/20 09:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- D:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- D:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/13 20:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- D:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\system32\config\*.sav >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
Invalid Environment Variable: %USERPROFILE%\*.*
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.exe
 
Invalid Environment Variable: %USERPROFILE%\Local Settings\Temp\*.dll
 
Invalid Environment Variable: %USERPROFILE%\Application Data\*.exe
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 149 bytes -> D:\ProgramData\Temp:CDFF58FE
@Alternate Data Stream - 143 bytes -> D:\ProgramData\Temp:93EB7685
@Alternate Data Stream - 141 bytes -> D:\ProgramData\Temp:E36F5B57
@Alternate Data Stream - 140 bytes -> D:\ProgramData\Temp:1A60DE96
@Alternate Data Stream - 135 bytes -> D:\ProgramData\Temp:E1F04E8D
@Alternate Data Stream - 119 bytes -> D:\ProgramData\Temp:4D066AD2
@Alternate Data Stream - 118 bytes -> D:\ProgramData\Temp:798A3728
< End of report >

--- --- ---

markusg · 13.05.2013, 12:35

hi,
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

ATTFilter

:OTL
O4 - HKU\IGB_ON_D..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Users\IGB\Documents\ab26865.exe ()
O20 - HKU\IGB_ON_D Winlogon: Shell - (cmd.exe) - D:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
[2013/05/11 11:14:19 | 001,084,755 | ---- | M] () -- D:\Users\IGB\AppData\Roaming\2433f433
[2013/05/11 11:14:19 | 001,084,685 | ---- | M] () -- D:\ProgramData\2433f433
:Files
:Commands
[EMPTYFLASH] 
[emptytemp]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.
Hi,
auf deinem zweiten pc gehe auf start, programme zubehör editor, kopiere dort
rein:

Code:

ATTFilter

:OTL
O4 - HKU\IGB_ON_D..\Run: [qcgce2mrvjq91kk1e7pnbb19m52fx] D:\Users\IGB\Documents\ab26865.exe ()
O20 - HKU\IGB_ON_D Winlogon: Shell - (cmd.exe) - D:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
[2013/05/11 11:14:19 | 001,084,755 | ---- | M] () -- D:\Users\IGB\AppData\Roaming\2433f433
[2013/05/11 11:14:19 | 001,084,685 | ---- | M] () -- D:\ProgramData\2433f433
:Files
:Commands
[EMPTYFLASH] 
[emptytemp]

dieses speicherst du auf nem usb stick als fix.txt
nutze nun wieder OTLPENet.exe (starte also von der erstellten cd) und hake alles an, wie es bereits im post zu OTLPENet.exe beschrieben ist.
• Klicke nun bitte auf den Fix Button.
es sollte nun eine meldung ähnlich dieser: "load fix from file" erscheinen, lade also die fix.txt von deinem stick.
wenn dies nicht funktioniert, bitte den fix manuell eintragen.
dann klicke erneut den fix buton. pc startet evtl. neu. wenn ja, nimm die cd aus dem laufwerk, windows sollte nun normal starten und die otl.txt öffnen,
log posten bitte.
starte in den normalen modus.

falls du keine symbole hast, dann rechtsklick, ansicht, desktop symbole einblenden

Hinweis: Die Datei bitte wie in der Anleitung zum UpChannel angegeben auch da hochladen. Bitte NICHT die ZIP-Datei hier als Anhang
in den Thread posten!

Drücke bitte die

+ E Taste.

Öffne dein Systemlaufwerk ( meistens C: )
Suche nun
folgenden Ordner: _OTL und öffne diesen.
Mache einen Rechtsklick auf den Ordner Movedfiles --> Senden an --> Zip-Komprimierter Ordner
Dies wird eine Movedfiles.zip Datei in _OTL erstellen
Lade diese bitte in unseren Uploadchannel
hoch. ( Durchsuchen --> C:\_OTL\Movedfiles.zip )

Teile mir mit ob der Upload problemlos geklappt hat. Danke im voraus

spirit83 · 13.05.2013, 20:56

Hi,

soweit komme ich leider nicht. OTL funktioniert soweit, muss zwar die fix manuell eingeben, aber dann läuft es und die OTL.txt wird erstellt. Neustart kommt dabei nicht..

Beim Neustart ím normalen Modus kommt nach LogIn eine Maske Eingabeaufforderung:

"Der Befehl ""C:\Users\IGB\Documents\ab26865.exe"" ist entweder falsch geschrieben oder konnte nicht gefunden werden."

Danach geht nix weiter...Hab den fix aber definitiv richtig übernommen, hab es zweimal probiert --> keine Änderung

markusg · 14.05.2013, 12:18

:noch mal neues otl script.
:OTL
O20 - HKU\IGB_ON_D Winlogon: Shell - (cmd.exe) - D:\Windows\SysWow64\cmd.exe (Microsoft Corporation)
:Commands
[EMPTYFLASH]
[emptytemp]

und dann neustarten und testen bitte

spirit83 · 14.05.2013, 20:02

Jetzt hat es geklappt...Neustart normaler Modus funktioniert.

Upload hab ich ebenfalls gemacht. Sind jetzt natürlich mehrere Dateien, da mehrere Versuche. Hoffe passt so...

VG spirit83

Danke für Support!!!

markusg · 14.05.2013, 20:09

thx fürs hochladen
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

spirit83 · 14.05.2013, 20:28

Hier der Logfile vom TDDS

21:23:59.0977 0888 TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
21:24:00.0133 0888 ============================================================
21:24:00.0133 0888 Current date / time: 2013/05/14 21:24:00.0133
21:24:00.0133 0888 SystemInfo:
21:24:00.0133 0888
21:24:00.0133 0888 OS Version: 6.1.7601 ServicePack: 1.0
21:24:00.0133 0888 Product type: Workstation
21:24:00.0133 0888 ComputerName: HNPC4
21:24:00.0133 0888 UserName: IGB
21:24:00.0133 0888 Windows directory: C:\Windows
21:24:00.0133 0888 System windows directory: C:\Windows
21:24:00.0133 0888 Running under WOW64
21:24:00.0133 0888 Processor architecture: Intel x64
21:24:00.0133 0888 Number of processors: 4
21:24:00.0133 0888 Page size: 0x1000
21:24:00.0133 0888 Boot type: Normal boot
21:24:00.0133 0888 ============================================================
21:24:00.0835 0888 Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:24:00.0898 0888 ============================================================
21:24:00.0898 0888 \Device\Harddisk0\DR0:
21:24:00.0898 0888 MBR partitions:
21:24:00.0898 0888 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1E00800, BlocksNum 0x32000
21:24:00.0898 0888 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1E32800, BlocksNum 0x55713000
21:24:00.0898 0888 ============================================================
21:24:00.0913 0888 C: <-> \Device\Harddisk0\DR0\Partition2
21:24:00.0913 0888 ============================================================
21:24:00.0913 0888 Initialize success
21:24:00.0913 0888 ============================================================
21:25:01.0207 1196 ============================================================
21:25:01.0207 1196 Scan started
21:25:01.0207 1196 Mode: Manual; SigCheck; TDLFS;
21:25:01.0207 1196 ============================================================
21:25:01.0379 1196 ================ Scan system memory ========================
21:25:01.0379 1196 System memory - ok
21:25:01.0379 1196 ================ Scan services =============================
21:25:01.0550 1196 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys
21:25:01.0644 1196 1394ohci - ok
21:25:01.0691 1196 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
21:25:01.0706 1196 ACPI - ok
21:25:01.0738 1196 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
21:25:01.0816 1196 AcpiPmi - ok
21:25:01.0925 1196 [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:25:01.0925 1196 AdobeARMservice - ok
21:25:02.0081 1196 [ F040037B149FD0F5A5044AE563390FA7 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
21:25:02.0112 1196 AdobeFlashPlayerUpdateSvc - ok
21:25:02.0143 1196 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\DRIVERS\adp94xx.sys
21:25:02.0174 1196 adp94xx - ok
21:25:02.0190 1196 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\DRIVERS\adpahci.sys
21:25:02.0206 1196 adpahci - ok
21:25:02.0221 1196 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\DRIVERS\adpu320.sys
21:25:02.0237 1196 adpu320 - ok
21:25:02.0268 1196 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
21:25:02.0440 1196 AeLookupSvc - ok
21:25:02.0533 1196 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
21:25:02.0596 1196 AFD - ok
21:25:02.0627 1196 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
21:25:02.0642 1196 agp440 - ok
21:25:02.0658 1196 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
21:25:02.0689 1196 ALG - ok
21:25:02.0705 1196 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
21:25:02.0720 1196 aliide - ok
21:25:02.0752 1196 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
21:25:02.0767 1196 amdide - ok
21:25:02.0783 1196 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\DRIVERS\amdk8.sys
21:25:02.0814 1196 AmdK8 - ok
21:25:02.0814 1196 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\DRIVERS\amdppm.sys
21:25:02.0830 1196 AmdPPM - ok
21:25:02.0876 1196 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
21:25:02.0908 1196 amdsata - ok
21:25:02.0923 1196 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\DRIVERS\amdsbs.sys
21:25:02.0939 1196 amdsbs - ok
21:25:02.0954 1196 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
21:25:02.0954 1196 amdxata - ok
21:25:02.0986 1196 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
21:25:03.0157 1196 AppID - ok
21:25:03.0188 1196 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
21:25:03.0220 1196 AppIDSvc - ok
21:25:03.0251 1196 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
21:25:03.0282 1196 Appinfo - ok
21:25:03.0298 1196 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\DRIVERS\arc.sys
21:25:03.0313 1196 arc - ok
21:25:03.0313 1196 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\DRIVERS\arcsas.sys
21:25:03.0329 1196 arcsas - ok
21:25:03.0438 1196 [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:25:03.0469 1196 aspnet_state - ok
21:25:03.0532 1196 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
21:25:03.0610 1196 AsyncMac - ok
21:25:03.0656 1196 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
21:25:03.0672 1196 atapi - ok
21:25:03.0703 1196 [ CBE61B4494165F458BD87E37181EE934 ] AthBTPort C:\Windows\system32\DRIVERS\btath_flt.sys
21:25:03.0766 1196 AthBTPort - ok
21:25:03.0812 1196 [ 749FF240DEDAFAFF94288E0307104DF3 ] AtherosSvc C:\Program Files (x86)\Bluetooth Suite\adminservice.exe
21:25:03.0828 1196 AtherosSvc ( UnsignedFile.Multi.Generic ) - warning
21:25:03.0828 1196 AtherosSvc - detected UnsignedFile.Multi.Generic (1)
21:25:03.0922 1196 [ C8679A07267F030704168E45E27C3D43 ] athr C:\Windows\system32\DRIVERS\athrx.sys
21:25:03.0968 1196 athr - ok
21:25:04.0015 1196 [ B4BDE3F758A34658A37DFED3D9783CD8 ] atksgt C:\Windows\system32\DRIVERS\atksgt.sys
21:25:04.0078 1196 atksgt - ok
21:25:04.0124 1196 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
21:25:04.0202 1196 AudioEndpointBuilder - ok
21:25:04.0218 1196 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
21:25:04.0249 1196 AudioSrv - ok
21:25:04.0280 1196 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
21:25:04.0405 1196 AxInstSV - ok
21:25:04.0421 1196 azigehhn - ok
21:25:04.0436 1196 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\DRIVERS\bxvbda.sys
21:25:04.0499 1196 b06bdrv - ok
21:25:04.0514 1196 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
21:25:04.0561 1196 b57nd60a - ok
21:25:04.0608 1196 [ 2618E15514736FB469B105CE729B6D9D ] b57xdbd C:\Windows\system32\DRIVERS\b57xdbd.sys
21:25:04.0624 1196 b57xdbd - ok
21:25:04.0624 1196 [ BABA4F0E2978B69B4E0B260EF7150DD6 ] b57xdmp C:\Windows\system32\DRIVERS\b57xdmp.sys
21:25:04.0639 1196 b57xdmp - ok
21:25:04.0655 1196 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
21:25:04.0717 1196 BDESVC - ok
21:25:04.0748 1196 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
21:25:04.0795 1196 Beep - ok
21:25:04.0826 1196 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
21:25:04.0889 1196 BFE - ok
21:25:04.0904 1196 bgycesua - ok
21:25:04.0920 1196 bhiifzyn - ok
21:25:04.0967 1196 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
21:25:05.0076 1196 BITS - ok
21:25:05.0092 1196 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
21:25:05.0138 1196 blbdrive - ok
21:25:05.0216 1196 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
21:25:05.0263 1196 bowser - ok
21:25:05.0279 1196 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\DRIVERS\BrFiltLo.sys
21:25:05.0326 1196 BrFiltLo - ok
21:25:05.0326 1196 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\DRIVERS\BrFiltUp.sys
21:25:05.0357 1196 BrFiltUp - ok
21:25:05.0419 1196 Brother XP spl Service - ok
21:25:05.0466 1196 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
21:25:05.0528 1196 Browser - ok
21:25:05.0560 1196 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
21:25:05.0606 1196 Brserid - ok
21:25:05.0606 1196 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
21:25:05.0653 1196 BrSerWdm - ok
21:25:05.0653 1196 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
21:25:05.0669 1196 BrUsbMdm - ok
21:25:05.0669 1196 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
21:25:05.0684 1196 BrUsbSer - ok
21:25:05.0747 1196 [ 65349B60F2F5325759525199E26DA1A6 ] bScsiMSa C:\Windows\system32\DRIVERS\bScsiMSa.sys
21:25:05.0762 1196 bScsiMSa - ok
21:25:05.0762 1196 [ E6CC56662F6C6B787A1FBEA4CD247AE0 ] bScsiSDa C:\Windows\system32\DRIVERS\bScsiSDa.sys
21:25:05.0778 1196 bScsiSDa - ok
21:25:05.0825 1196 [ 227C8F308DE4AF4808E587465CEAB838 ] BTATH_A2DP C:\Windows\system32\drivers\btath_a2dp.sys
21:25:05.0856 1196 BTATH_A2DP - ok
21:25:05.0903 1196 [ A83A91D07D1FE6BBE7A9DB46CA00434B ] BTATH_BUS C:\Windows\system32\DRIVERS\btath_bus.sys
21:25:05.0965 1196 BTATH_BUS - ok
21:25:05.0996 1196 [ C864FF85EE16D61C2BDD5EF76824625F ] BTATH_HCRP C:\Windows\system32\DRIVERS\btath_hcrp.sys
21:25:06.0074 1196 BTATH_HCRP - ok
21:25:06.0106 1196 [ 0DEA505EFB5D771826D177EF8B8A208F ] BTATH_LWFLT C:\Windows\system32\DRIVERS\btath_lwflt.sys
21:25:06.0152 1196 BTATH_LWFLT - ok
21:25:06.0168 1196 [ 724C8088C96EFE7A3E63FEC21D4681C0 ] BTATH_RCP C:\Windows\system32\DRIVERS\btath_rcp.sys
21:25:06.0215 1196 BTATH_RCP - ok
21:25:06.0246 1196 [ 486720DA2B3BB13D1080C83140C18B56 ] BtFilter C:\Windows\system32\DRIVERS\btfilter.sys
21:25:06.0308 1196 BtFilter - ok
21:25:06.0340 1196 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
21:25:06.0433 1196 BthEnum - ok
21:25:06.0449 1196 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\DRIVERS\bthmodem.sys
21:25:06.0464 1196 BTHMODEM - ok
21:25:06.0511 1196 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
21:25:06.0511 1196 BthPan - ok
21:25:06.0574 1196 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
21:25:06.0636 1196 BTHPORT - ok
21:25:06.0667 1196 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
21:25:06.0745 1196 bthserv - ok
21:25:06.0761 1196 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
21:25:06.0792 1196 BTHUSB - ok
21:25:06.0839 1196 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
21:25:06.0917 1196 cdfs - ok
21:25:06.0948 1196 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
21:25:06.0995 1196 cdrom - ok
21:25:07.0026 1196 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
21:25:07.0073 1196 CertPropSvc - ok
21:25:07.0104 1196 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\DRIVERS\circlass.sys
21:25:07.0135 1196 circlass - ok
21:25:07.0166 1196 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
21:25:07.0182 1196 CLFS - ok
21:25:07.0244 1196 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:25:07.0276 1196 clr_optimization_v2.0.50727_32 - ok
21:25:07.0307 1196 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:25:07.0307 1196 clr_optimization_v2.0.50727_64 - ok
21:25:07.0385 1196 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:25:07.0416 1196 clr_optimization_v4.0.30319_32 - ok
21:25:07.0432 1196 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:25:07.0447 1196 clr_optimization_v4.0.30319_64 - ok
21:25:07.0463 1196 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
21:25:07.0494 1196 CmBatt - ok
21:25:07.0510 1196 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
21:25:07.0510 1196 cmdide - ok
21:25:07.0572 1196 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys
21:25:07.0619 1196 CNG - ok
21:25:07.0634 1196 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\DRIVERS\compbatt.sys
21:25:07.0650 1196 Compbatt - ok
21:25:07.0666 1196 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\drivers\CompositeBus.sys
21:25:07.0697 1196 CompositeBus - ok
21:25:07.0697 1196 COMSysApp - ok
21:25:07.0712 1196 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\DRIVERS\crcdisk.sys
21:25:07.0728 1196 crcdisk - ok
21:25:07.0744 1196 [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc C:\Windows\system32\cryptsvc.dll
21:25:07.0790 1196 CryptSvc - ok
21:25:07.0822 1196 ctkgctei - ok
21:25:07.0837 1196 cxliquey - ok
21:25:07.0931 1196 [ 7C57F1944D9C45601541D248E1C1A80D ] DATEV Update-Service C:\DATEV\PROGRAMM\INSTALL\DvInesASDSvc.Exe
21:25:07.0993 1196 DATEV Update-Service - ok
21:25:08.0024 1196 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
21:25:08.0087 1196 DcomLaunch - ok
21:25:08.0118 1196 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
21:25:08.0149 1196 defragsvc - ok
21:25:08.0196 1196 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
21:25:08.0258 1196 DfsC - ok
21:25:08.0290 1196 [ DEF365F0F6E017888C4B869D3BA4B8E0 ] dgderdrv C:\Windows\system32\drivers\dgderdrv.sys
21:25:08.0336 1196 dgderdrv - ok
21:25:08.0383 1196 [ 388039F99CE8769024EE0438352ACA99 ] dg_ssudbus C:\Windows\system32\DRIVERS\ssudbus.sys
21:25:08.0383 1196 dg_ssudbus - ok
21:25:08.0414 1196 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
21:25:08.0477 1196 Dhcp - ok
21:25:08.0508 1196 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
21:25:08.0570 1196 discache - ok
21:25:08.0586 1196 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\DRIVERS\disk.sys
21:25:08.0602 1196 Disk - ok
21:25:08.0602 1196 dksbcxgj - ok
21:25:08.0633 1196 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
21:25:08.0664 1196 Dnscache - ok
21:25:08.0695 1196 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
21:25:08.0726 1196 dot3svc - ok
21:25:08.0773 1196 [ B42ED0320C6E41102FDE0005154849BB ] Dot4 C:\Windows\system32\DRIVERS\Dot4.sys
21:25:08.0789 1196 Dot4 - ok
21:25:08.0820 1196 [ E9F5969233C5D89F3C35E3A66A52A361 ] Dot4Print C:\Windows\system32\DRIVERS\Dot4Prt.sys
21:25:08.0820 1196 Dot4Print - ok
21:25:08.0851 1196 [ FD05A02B0370BC3000F402E543CA5814 ] dot4usb C:\Windows\system32\DRIVERS\dot4usb.sys
21:25:08.0882 1196 dot4usb - ok
21:25:08.0914 1196 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
21:25:08.0945 1196 DPS - ok
21:25:08.0976 1196 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
21:25:09.0023 1196 drmkaud - ok
21:25:09.0101 1196 [ 4B2344F6A2257509C96758E4AD2FE391 ] DsiWMIService C:\Program Files (x86)\Launch Manager\dsiwmis.exe
21:25:09.0132 1196 DsiWMIService - ok
21:25:09.0210 1196 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
21:25:09.0241 1196 DXGKrnl - ok
21:25:09.0288 1196 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
21:25:09.0350 1196 EapHost - ok
21:25:09.0460 1196 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\DRIVERS\evbda.sys
21:25:09.0522 1196 ebdrv - ok
21:25:09.0553 1196 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
21:25:09.0600 1196 EFS - ok
21:25:09.0662 1196 [ 03E6888DA1A85ACF14AC2A3C328A9E62 ] EgisTec Ticket Service C:\Program Files (x86)\Common Files\EgisTec\Services\EgisTicketService.exe
21:25:09.0678 1196 EgisTec Ticket Service - ok
21:25:09.0756 1196 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
21:25:09.0818 1196 ehRecvr - ok
21:25:09.0850 1196 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
21:25:09.0881 1196 ehSched - ok
21:25:09.0896 1196 eirqkprh - ok
21:25:09.0928 1196 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\DRIVERS\elxstor.sys
21:25:09.0959 1196 elxstor - ok
21:25:09.0974 1196 eorbwejf - ok
21:25:10.0052 1196 [ 8E12D885D17EC5FA4F52D2C6E953E285 ] ePowerSvc C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
21:25:10.0099 1196 ePowerSvc - ok
21:25:10.0115 1196 eqoenegs - ok
21:25:10.0130 1196 erjaaxgn - ok
21:25:10.0162 1196 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
21:25:10.0208 1196 ErrDev - ok
21:25:10.0302 1196 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
21:25:10.0380 1196 EventSystem - ok
21:25:10.0396 1196 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
21:25:10.0442 1196 exfat - ok
21:25:10.0505 1196 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
21:25:10.0567 1196 fastfat - ok
21:25:10.0614 1196 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
21:25:10.0676 1196 Fax - ok
21:25:10.0708 1196 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\DRIVERS\fdc.sys
21:25:10.0723 1196 fdc - ok
21:25:10.0754 1196 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
21:25:10.0817 1196 fdPHost - ok
21:25:10.0817 1196 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
21:25:10.0864 1196 FDResPub - ok
21:25:10.0895 1196 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
21:25:10.0926 1196 FileInfo - ok
21:25:10.0942 1196 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
21:25:10.0988 1196 Filetrace - ok
21:25:11.0035 1196 [ BB0667B0171B632B97EA759515476F07 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
21:25:11.0082 1196 FLEXnet Licensing Service - ok
21:25:11.0113 1196 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\DRIVERS\flpydisk.sys
21:25:11.0160 1196 flpydisk - ok
21:25:11.0176 1196 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
21:25:11.0191 1196 FltMgr - ok
21:25:11.0238 1196 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll
21:25:11.0269 1196 FontCache - ok
21:25:11.0332 1196 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
21:25:11.0347 1196 FontCache3.0.0.0 - ok
21:25:11.0378 1196 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
21:25:11.0378 1196 FsDepends - ok
21:25:11.0410 1196 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
21:25:11.0425 1196 Fs_Rec - ok
21:25:11.0488 1196 [ 8F6322049018354F45F05A2FD2D4E5E0 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
21:25:11.0519 1196 fvevol - ok
21:25:11.0519 1196 fyjuxdfh - ok
21:25:11.0550 1196 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\DRIVERS\gagp30kx.sys
21:25:11.0550 1196 gagp30kx - ok
21:25:11.0581 1196 giwvdumb - ok
21:25:11.0612 1196 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
21:25:11.0659 1196 gpsvc - ok
21:25:11.0722 1196 [ 0191DEE9B9EB7902AF2CF4F67301095D ] GREGService C:\Program Files (x86)\Acer\Registration\GREGsvc.exe
21:25:11.0737 1196 GREGService - ok
21:25:11.0768 1196 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
21:25:11.0800 1196 hcw85cir - ok
21:25:11.0831 1196 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
21:25:11.0862 1196 HdAudAddService - ok
21:25:11.0909 1196 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\drivers\HDAudBus.sys
21:25:11.0940 1196 HDAudBus - ok
21:25:11.0940 1196 hgfhfnmq - ok
21:25:11.0987 1196 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\DRIVERS\HidBatt.sys
21:25:12.0002 1196 HidBatt - ok
21:25:12.0002 1196 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\DRIVERS\hidbth.sys
21:25:12.0034 1196 HidBth - ok
21:25:12.0049 1196 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\DRIVERS\hidir.sys
21:25:12.0080 1196 HidIr - ok
21:25:12.0096 1196 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
21:25:12.0127 1196 hidserv - ok
21:25:12.0158 1196 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
21:25:12.0190 1196 HidUsb - ok
21:25:12.0205 1196 hihwksuk - ok
21:25:12.0268 1196 [ BE3B1DD6B8F89BD38B5C9ADF9C937B75 ] HitmanProScheduler C:\Program Files\HitmanPro\hmpsched.exe
21:25:12.0283 1196 HitmanProScheduler - ok
21:25:12.0314 1196 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
21:25:12.0361 1196 hkmsvc - ok
21:25:12.0361 1196 hohcxutk - ok
21:25:12.0392 1196 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
21:25:12.0424 1196 HomeGroupListener - ok
21:25:12.0470 1196 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
21:25:12.0502 1196 HomeGroupProvider - ok
21:25:12.0517 1196 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
21:25:12.0533 1196 HpSAMD - ok
21:25:12.0689 1196 [ F37882F128EFACEFE353E0BAE2766909 ] HPSLPSVC C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
21:25:12.0751 1196 HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
21:25:12.0751 1196 HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
21:25:12.0751 1196 hpvrgmua - ok
21:25:12.0798 1196 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
21:25:12.0876 1196 HTTP - ok
21:25:12.0907 1196 hutfgwdl - ok
21:25:12.0938 1196 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
21:25:12.0954 1196 hwpolicy - ok
21:25:12.0985 1196 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys
21:25:13.0016 1196 i8042prt - ok
21:25:13.0048 1196 [ F7CE9BE72EDAC499B713ECA6DAE5D26F ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys
21:25:13.0063 1196 iaStor - ok
21:25:13.0094 1196 [ B25F192EA1F84A316EB7C19EFCCCF33D ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
21:25:13.0110 1196 IAStorDataMgrSvc - ok
21:25:13.0126 1196 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
21:25:13.0141 1196 iaStorV - ok
21:25:13.0172 1196 icwpgjvj - ok
21:25:13.0204 1196 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
21:25:13.0219 1196 idsvc - ok
21:25:13.0438 1196 [ 553228E67639F52C9BD86362C0C64F85 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
21:25:13.0703 1196 igfx - ok
21:25:13.0750 1196 igsuxons - ok
21:25:13.0765 1196 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\DRIVERS\iirsp.sys
21:25:13.0796 1196 iirsp - ok
21:25:13.0828 1196 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
21:25:13.0906 1196 IKEEXT - ok
21:25:13.0999 1196 [ DD1FC331286A33F396945115AE4E5E8A ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
21:25:14.0077 1196 IntcAzAudAddService - ok
21:25:14.0108 1196 [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys
21:25:14.0155 1196 IntcDAud - ok
21:25:14.0186 1196 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
21:25:14.0202 1196 intelide - ok
21:25:14.0233 1196 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
21:25:14.0249 1196 intelppm - ok
21:25:14.0296 1196 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
21:25:14.0374 1196 IPBusEnum - ok
21:25:14.0389 1196 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
21:25:14.0483 1196 IpFilterDriver - ok
21:25:14.0514 1196 [ 08C2957BB30058E663720C5606885653 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
21:25:14.0561 1196 iphlpsvc - ok
21:25:14.0576 1196 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
21:25:14.0592 1196 IPMIDRV - ok
21:25:14.0623 1196 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
21:25:14.0717 1196 IPNAT - ok
21:25:14.0732 1196 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
21:25:14.0795 1196 IRENUM - ok
21:25:14.0810 1196 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
21:25:14.0810 1196 isapnp - ok
21:25:14.0842 1196 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
21:25:14.0857 1196 iScsiPrt - ok
21:25:14.0873 1196 jfkhlpac - ok
21:25:14.0873 1196 jqdrmeic - ok
21:25:14.0873 1196 jxgbsxvg - ok
21:25:14.0920 1196 [ 81458A917F8CC7A5171759218D64FA3A ] k57nd60a C:\Windows\system32\DRIVERS\k57nd60a.sys
21:25:14.0966 1196 k57nd60a - ok
21:25:14.0982 1196 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
21:25:14.0998 1196 kbdclass - ok
21:25:14.0998 1196 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys
21:25:15.0029 1196 kbdhid - ok
21:25:15.0044 1196 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
21:25:15.0044 1196 KeyIso - ok
21:25:15.0091 1196 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
21:25:15.0122 1196 KSecDD - ok
21:25:15.0154 1196 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
21:25:15.0185 1196 KSecPkg - ok
21:25:15.0216 1196 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
21:25:15.0263 1196 ksthunk - ok
21:25:15.0294 1196 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
21:25:15.0341 1196 KtmRm - ok
21:25:15.0372 1196 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
21:25:15.0419 1196 LanmanServer - ok
21:25:15.0450 1196 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
21:25:15.0481 1196 LanmanWorkstation - ok
21:25:15.0481 1196 ldgwtuno - ok
21:25:15.0497 1196 leuybgyc - ok
21:25:15.0512 1196 [ 955982BF4421B77722196552B62E8DC2 ] lirsgt C:\Windows\system32\DRIVERS\lirsgt.sys
21:25:15.0528 1196 lirsgt - ok
21:25:15.0544 1196 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
21:25:15.0590 1196 lltdio - ok
21:25:15.0606 1196 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
21:25:15.0653 1196 lltdsvc - ok
21:25:15.0684 1196 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
21:25:15.0715 1196 lmhosts - ok
21:25:15.0746 1196 [ D7E0BED3EA21D7BDDD410ADE51708D90 ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:25:15.0746 1196 LMS - ok
21:25:15.0778 1196 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\DRIVERS\lsi_fc.sys
21:25:15.0778 1196 LSI_FC - ok
21:25:15.0793 1196 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\DRIVERS\lsi_sas.sys
21:25:15.0809 1196 LSI_SAS - ok
21:25:15.0809 1196 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\DRIVERS\lsi_sas2.sys
21:25:15.0809 1196 LSI_SAS2 - ok
21:25:15.0824 1196 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\DRIVERS\lsi_scsi.sys
21:25:15.0840 1196 LSI_SCSI - ok
21:25:15.0871 1196 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
21:25:15.0918 1196 luafv - ok
21:25:15.0918 1196 lurkwoea - ok
21:25:15.0918 1196 lusilunm - ok
21:25:15.0934 1196 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
21:25:15.0949 1196 Mcx2Svc - ok
21:25:15.0965 1196 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\DRIVERS\megasas.sys
21:25:15.0980 1196 megasas - ok
21:25:15.0980 1196 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\DRIVERS\MegaSR.sys
21:25:15.0996 1196 MegaSR - ok
21:25:16.0027 1196 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
21:25:16.0027 1196 MEIx64 - ok
21:25:16.0074 1196 Microsoft SharePoint Workspace Audit Service - ok
21:25:16.0090 1196 mijyeeuh - ok
21:25:16.0105 1196 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
21:25:16.0168 1196 MMCSS - ok
21:25:16.0199 1196 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
21:25:16.0230 1196 Modem - ok
21:25:16.0261 1196 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
21:25:16.0292 1196 monitor - ok
21:25:16.0324 1196 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
21:25:16.0339 1196 mouclass - ok
21:25:16.0370 1196 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
21:25:16.0417 1196 mouhid - ok
21:25:16.0448 1196 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
21:25:16.0464 1196 mountmgr - ok
21:25:16.0495 1196 [ F8A10560B35C66F9DE212F03DAD5BFA7 ] MpFilter C:\Windows\system32\DRIVERS\MpFilter.sys
21:25:16.0511 1196 MpFilter - ok
21:25:16.0542 1196 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
21:25:16.0558 1196 mpio - ok
21:25:16.0589 1196 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
21:25:16.0620 1196 mpsdrv - ok
21:25:16.0651 1196 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
21:25:16.0698 1196 MpsSvc - ok
21:25:16.0698 1196 mpurjyup - ok
21:25:16.0729 1196 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
21:25:16.0745 1196 MRxDAV - ok
21:25:16.0776 1196 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
21:25:16.0807 1196 mrxsmb - ok
21:25:16.0838 1196 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
21:25:16.0838 1196 mrxsmb10 - ok
21:25:16.0870 1196 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
21:25:16.0885 1196 mrxsmb20 - ok
21:25:16.0901 1196 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
21:25:16.0901 1196 msahci - ok
21:25:16.0932 1196 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
21:25:16.0932 1196 msdsm - ok
21:25:16.0948 1196 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
21:25:16.0979 1196 MSDTC - ok
21:25:17.0041 1196 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
21:25:17.0057 1196 Msfs - ok
21:25:17.0072 1196 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
21:25:17.0119 1196 mshidkmdf - ok
21:25:17.0135 1196 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
21:25:17.0150 1196 msisadrv - ok
21:25:17.0166 1196 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
21:25:17.0197 1196 MSiSCSI - ok
21:25:17.0197 1196 msiserver - ok
21:25:17.0213 1196 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
21:25:17.0244 1196 MSKSSRV - ok
21:25:17.0306 1196 [ E07DEC52FF801841BA9B6878A60304FB ] MsMpSvc c:\Program Files\Microsoft Security Client\MsMpEng.exe
21:25:17.0338 1196 MsMpSvc - ok
21:25:17.0338 1196 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
21:25:17.0384 1196 MSPCLOCK - ok
21:25:17.0400 1196 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
21:25:17.0478 1196 MSPQM - ok
21:25:17.0509 1196 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
21:25:17.0540 1196 MsRPC - ok
21:25:17.0587 1196 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\drivers\mssmbios.sys
21:25:17.0587 1196 mssmbios - ok
21:25:17.0618 1196 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
21:25:17.0696 1196 MSTEE - ok
21:25:17.0696 1196 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\DRIVERS\MTConfig.sys
21:25:17.0712 1196 MTConfig - ok
21:25:17.0743 1196 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
21:25:17.0774 1196 Mup - ok
21:25:17.0806 1196 [ 9B1EAC6FAF6F37305E822F5588DC8056 ] mwlPSDFilter C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
21:25:17.0821 1196 mwlPSDFilter - ok
21:25:17.0837 1196 [ AD55C1524B296280ED9C6E0D730D35DA ] mwlPSDNServ C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
21:25:17.0837 1196 mwlPSDNServ - ok
21:25:17.0852 1196 [ 2B599E6EC8843637BDD62E7F8F3BA201 ] mwlPSDVDisk C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
21:25:17.0852 1196 mwlPSDVDisk - ok
21:25:17.0884 1196 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
21:25:17.0930 1196 napagent - ok
21:25:17.0946 1196 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
21:25:17.0977 1196 NativeWifiP - ok
21:25:18.0024 1196 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys
21:25:18.0071 1196 NDIS - ok
21:25:18.0118 1196 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
21:25:18.0180 1196 NdisCap - ok
21:25:18.0211 1196 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
21:25:18.0258 1196 NdisTapi - ok
21:25:18.0289 1196 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
21:25:18.0320 1196 Ndisuio - ok
21:25:18.0352 1196 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
21:25:18.0398 1196 NdisWan - ok
21:25:18.0414 1196 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
21:25:18.0445 1196 NDProxy - ok
21:25:18.0523 1196 [ 2334DC48997BA203B794DF3EE70521DB ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
21:25:18.0539 1196 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
21:25:18.0539 1196 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
21:25:18.0586 1196 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
21:25:18.0648 1196 NetBIOS - ok
21:25:18.0679 1196 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
21:25:18.0710 1196 NetBT - ok
21:25:18.0726 1196 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
21:25:18.0726 1196 Netlogon - ok
21:25:18.0757 1196 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
21:25:18.0804 1196 Netman - ok
21:25:18.0835 1196 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:25:18.0835 1196 NetMsmqActivator - ok
21:25:18.0851 1196 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:25:18.0866 1196 NetPipeActivator - ok
21:25:18.0866 1196 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
21:25:18.0913 1196 netprofm - ok
21:25:18.0913 1196 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:25:18.0913 1196 NetTcpActivator - ok
21:25:18.0929 1196 [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:25:18.0929 1196 NetTcpPortSharing - ok
21:25:18.0960 1196 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\DRIVERS\nfrd960.sys
21:25:18.0976 1196 nfrd960 - ok
21:25:18.0976 1196 ngulqxic - ok
21:25:19.0022 1196 [ 162100E0BC8377710F9D170631921C03 ] NisDrv C:\Windows\system32\DRIVERS\NisDrvWFP.sys
21:25:19.0022 1196 NisDrv - ok
21:25:19.0069 1196 [ C6E15F2F95F9C0A6098D43510B604E52 ] NisSrv c:\Program Files\Microsoft Security Client\NisSrv.exe
21:25:19.0100 1196 NisSrv - ok
21:25:19.0132 1196 [ 8AD77806D336673F270DB31645267293 ] NlaSvc C:\Windows\System32\nlasvc.dll
21:25:19.0163 1196 NlaSvc - ok
21:25:19.0194 1196 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
21:25:19.0256 1196 Npfs - ok
21:25:19.0272 1196 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
21:25:19.0303 1196 nsi - ok
21:25:19.0303 1196 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
21:25:19.0350 1196 nsiproxy - ok
21:25:19.0412 1196 [ B98F8C6E31CD07B2E6F71F7F648E38C0 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
21:25:19.0444 1196 Ntfs - ok
21:25:19.0522 1196 [ 8F59A2506AF43F96F5397B3C79938AE9 ] NTI IScheduleSvc C:\Program Files (x86)\NTI\Acer Backup Manager\IScheduleSvc.exe
21:25:19.0615 1196 NTI IScheduleSvc - ok
21:25:19.0631 1196 [ EE3BA1024594D5D09E314F206B94069E ] NTIDrvr C:\Windows\system32\drivers\NTIDrvr.sys
21:25:19.0662 1196 NTIDrvr - ok
21:25:19.0678 1196 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
21:25:19.0724 1196 Null - ok
21:25:19.0724 1196 numsbafs - ok
21:25:19.0740 1196 [ 786DB821BFD57C0551DBBE4F75384A7D ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
21:25:19.0756 1196 nusb3hub - ok
21:25:19.0771 1196 [ DAA8005CAF745042BB427A1ED7433354 ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
21:25:19.0818 1196 nusb3xhc - ok
21:25:20.0068 1196 [ 3F3B01E39736E2E9E044B169AAEFB485 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
21:25:20.0411 1196 nvlddmkm - ok
21:25:20.0489 1196 [ 714B50444D72E26739ED624F848FF36B ] nvpciflt C:\Windows\system32\DRIVERS\nvpciflt.sys
21:25:20.0504 1196 nvpciflt - ok
21:25:20.0536 1196 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
21:25:20.0567 1196 nvraid - ok
21:25:20.0598 1196 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
21:25:20.0598 1196 nvstor - ok
21:25:20.0660 1196 [ A15CC332556C231C492E941BC476C5AE ] NVSvc C:\Windows\system32\nvvsvc.exe
21:25:20.0676 1196 NVSvc - ok
21:25:20.0770 1196 [ D908D6DA3C2EB864CD6DBA0A52FA4DE5 ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
21:25:20.0816 1196 nvUpdatusService - ok
21:25:20.0848 1196 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
21:25:20.0863 1196 nv_agp - ok
21:25:20.0863 1196 nxdxcmsq - ok
21:25:20.0863 1196 nzprwrha - ok
21:25:20.0879 1196 oegnyzbk - ok
21:25:20.0895 1196 ofjibnnv - ok
21:25:20.0910 1196 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
21:25:20.0926 1196 ohci1394 - ok
21:25:20.0941 1196 okfhbtzw - ok
21:25:20.0941 1196 ongfomma - ok
21:25:21.0035 1196 [ 52E61A5670E182CB0C7227E73124FB69 ] OpLclSrv C:\Program Files\Okidata\Common\Extend3\portmgrsrv.exe
21:25:21.0113 1196 OpLclSrv ( UnsignedFile.Multi.Generic ) - warning
21:25:21.0113 1196 OpLclSrv - detected UnsignedFile.Multi.Generic (1)
21:25:21.0175 1196 [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:25:21.0191 1196 ose - ok
21:25:21.0363 1196 [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:25:21.0503 1196 osppsvc - ok
21:25:21.0503 1196 ovwapzmm - ok
21:25:21.0534 1196 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
21:25:21.0550 1196 p2pimsvc - ok
21:25:21.0565 1196 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
21:25:21.0597 1196 p2psvc - ok
21:25:21.0628 1196 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys
21:25:21.0628 1196 Parport - ok
21:25:21.0659 1196 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
21:25:21.0659 1196 partmgr - ok
21:25:21.0690 1196 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
21:25:21.0706 1196 PcaSvc - ok
21:25:21.0737 1196 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
21:25:21.0753 1196 pci - ok
21:25:21.0753 1196 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
21:25:21.0768 1196 pciide - ok
21:25:21.0784 1196 pciyewhg - ok
21:25:21.0815 1196 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\DRIVERS\pcmcia.sys
21:25:21.0815 1196 pcmcia - ok
21:25:21.0846 1196 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
21:25:21.0862 1196 pcw - ok
21:25:21.0909 1196 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
21:25:21.0987 1196 PEAUTH - ok
21:25:22.0049 1196 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
21:25:22.0065 1196 PerfHost - ok
21:25:22.0127 1196 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
21:25:22.0205 1196 pla - ok
21:25:22.0236 1196 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
21:25:22.0267 1196 PlugPlay - ok
21:25:22.0345 1196 [ AC78DF349F0E4CFB8B667C0CFFF83CCE ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
21:25:22.0361 1196 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
21:25:22.0361 1196 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
21:25:22.0377 1196 pmrpbzwk - ok
21:25:22.0408 1196 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
21:25:22.0439 1196 PNRPAutoReg - ok
21:25:22.0455 1196 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
21:25:22.0486 1196 PNRPsvc - ok
21:25:22.0517 1196 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
21:25:22.0564 1196 PolicyAgent - ok
21:25:22.0579 1196 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll
21:25:22.0642 1196 Power - ok
21:25:22.0673 1196 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
21:25:22.0704 1196 PptpMiniport - ok
21:25:22.0735 1196 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\DRIVERS\processr.sys
21:25:22.0751 1196 Processor - ok
21:25:22.0782 1196 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
21:25:22.0813 1196 ProfSvc - ok
21:25:22.0829 1196 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
21:25:22.0845 1196 ProtectedStorage - ok
21:25:22.0876 1196 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
21:25:22.0954 1196 Psched - ok
21:25:22.0954 1196 pvhwhrrd - ok
21:25:23.0001 1196 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\DRIVERS\ql2300.sys
21:25:23.0032 1196 ql2300 - ok
21:25:23.0032 1196 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\DRIVERS\ql40xx.sys
21:25:23.0047 1196 ql40xx - ok
21:25:23.0063 1196 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
21:25:23.0079 1196 QWAVE - ok
21:25:23.0094 1196 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
21:25:23.0125 1196 QWAVEdrv - ok
21:25:23.0125 1196 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
21:25:23.0172 1196 RasAcd - ok
21:25:23.0203 1196 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
21:25:23.0250 1196 RasAgileVpn - ok
21:25:23.0281 1196 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
21:25:23.0313 1196 RasAuto - ok
21:25:23.0344 1196 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
21:25:23.0406 1196 Rasl2tp - ok
21:25:23.0437 1196 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
21:25:23.0515 1196 RasMan - ok
21:25:23.0547 1196 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
21:25:23.0593 1196 RasPppoe - ok
21:25:23.0609 1196 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
21:25:23.0656 1196 RasSstp - ok
21:25:23.0687 1196 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
21:25:23.0718 1196 rdbss - ok
21:25:23.0734 1196 rdciaunx - ok
21:25:23.0749 1196 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
21:25:23.0765 1196 rdpbus - ok
21:25:23.0781 1196 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
21:25:23.0812 1196 RDPCDD - ok
21:25:23.0812 1196 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
21:25:23.0859 1196 RDPENCDD - ok
21:25:23.0859 1196 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
21:25:23.0905 1196 RDPREFMP - ok
21:25:23.0937 1196 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
21:25:23.0999 1196 RDPWD - ok
21:25:24.0030 1196 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
21:25:24.0046 1196 rdyboost - ok
21:25:24.0077 1196 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
21:25:24.0124 1196 RemoteAccess - ok
21:25:24.0139 1196 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
21:25:24.0186 1196 RemoteRegistry - ok
21:25:24.0217 1196 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
21:25:24.0249 1196 RFCOMM - ok
21:25:24.0311 1196 [ 388D3DD1A6457280F3BADBA9F3ACD6B1 ] ROOTMODEM C:\Windows\system32\Drivers\RootMdm.sys
21:25:24.0373 1196 ROOTMODEM - ok
21:25:24.0405 1196 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
21:25:24.0483 1196 RpcEptMapper - ok
21:25:24.0498 1196 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
21:25:24.0545 1196 RpcLocator - ok
21:25:24.0592 1196 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
21:25:24.0623 1196 RpcSs - ok
21:25:24.0670 1196 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
21:25:24.0717 1196 rspndr - ok
21:25:24.0732 1196 ryevcmck - ok
21:25:24.0748 1196 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
21:25:24.0748 1196 SamSs - ok
21:25:24.0779 1196 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
21:25:24.0795 1196 sbp2port - ok
21:25:24.0826 1196 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
21:25:24.0919 1196 SCardSvr - ok
21:25:24.0951 1196 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
21:25:24.0982 1196 scfilter - ok
21:25:25.0013 1196 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
21:25:25.0075 1196 Schedule - ok
21:25:25.0107 1196 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
21:25:25.0153 1196 SCPolicySvc - ok
21:25:25.0185 1196 [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus C:\Windows\system32\drivers\sdbus.sys
21:25:25.0185 1196 sdbus - ok
21:25:25.0200 1196 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
21:25:25.0231 1196 SDRSVC - ok
21:25:25.0247 1196 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
21:25:25.0278 1196 secdrv - ok
21:25:25.0309 1196 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
21:25:25.0356 1196 seclogon - ok
21:25:25.0387 1196 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
21:25:25.0419 1196 SENS - ok
21:25:25.0434 1196 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
21:25:25.0481 1196 SensrSvc - ok
21:25:25.0497 1196 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
21:25:25.0528 1196 Serenum - ok
21:25:25.0543 1196 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys
21:25:25.0575 1196 Serial - ok
21:25:25.0621 1196 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\DRIVERS\sermouse.sys
21:25:25.0637 1196 sermouse - ok
21:25:25.0668 1196 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
21:25:25.0731 1196 SessionEnv - ok
21:25:25.0762 1196 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
21:25:25.0777 1196 sffdisk - ok
21:25:25.0793 1196 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
21:25:25.0809 1196 sffp_mmc - ok
21:25:25.0824 1196 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
21:25:25.0887 1196 sffp_sd - ok
21:25:25.0918 1196 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\DRIVERS\sfloppy.sys
21:25:25.0949 1196 sfloppy - ok
21:25:25.0980 1196 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
21:25:26.0043 1196 SharedAccess - ok
21:25:26.0089 1196 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
21:25:26.0152 1196 ShellHWDetection - ok
21:25:26.0183 1196 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\DRIVERS\SiSRaid2.sys
21:25:26.0199 1196 SiSRaid2 - ok
21:25:26.0199 1196 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\DRIVERS\sisraid4.sys
21:25:26.0214 1196 SiSRaid4 - ok
21:25:26.0214 1196 slzahzkt - ok
21:25:26.0214 1196 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
21:25:26.0245 1196 Smb - ok
21:25:26.0277 1196 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
21:25:26.0277 1196 SNMPTRAP - ok
21:25:26.0308 1196 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
21:25:26.0308 1196 spldr - ok
21:25:26.0355 1196 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
21:25:26.0401 1196 Spooler - ok
21:25:26.0464 1196 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
21:25:26.0542 1196 sppsvc - ok
21:25:26.0589 1196 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
21:25:26.0635 1196 sppuinotify - ok
21:25:26.0635 1196 sqomdyrd - ok
21:25:26.0667 1196 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
21:25:26.0713 1196 srv - ok
21:25:26.0745 1196 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
21:25:26.0791 1196 srv2 - ok
21:25:26.0823 1196 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
21:25:26.0854 1196 srvnet - ok
21:25:26.0885 1196 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
21:25:26.0979 1196 SSDPSRV - ok
21:25:26.0994 1196 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
21:25:27.0025 1196 SstpSvc - ok
21:25:27.0057 1196 [ AD42CA614E086BCADBD53FFFC404AC24 ] ssudmdm C:\Windows\system32\DRIVERS\ssudmdm.sys
21:25:27.0072 1196 ssudmdm - ok
21:25:27.0135 1196 [ F7747CF40AF99AF3B5807C8E9F337F58 ] ssudserd C:\Windows\system32\DRIVERS\ssudserd.sys
21:25:27.0166 1196 ssudserd - ok
21:25:27.0197 1196 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\DRIVERS\stexstor.sys
21:25:27.0213 1196 stexstor - ok
21:25:27.0259 1196 [ DECACB6921DED1A38642642685D77DAC ] StillCam C:\Windows\system32\DRIVERS\serscan.sys
21:25:27.0291 1196 StillCam - ok
21:25:27.0353 1196 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
21:25:27.0400 1196 stisvc - ok
21:25:27.0415 1196 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\drivers\swenum.sys
21:25:27.0431 1196 swenum - ok
21:25:27.0462 1196 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
21:25:27.0509 1196 swprv - ok
21:25:27.0571 1196 [ EF51B22706DB03F0857FADE127C804EC ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
21:25:27.0603 1196 SynTP - ok
21:25:27.0649 1196 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
21:25:27.0681 1196 SysMain - ok
21:25:27.0696 1196 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
21:25:27.0727 1196 TabletInputService - ok
21:25:27.0759 1196 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
21:25:27.0805 1196 TapiSrv - ok
21:25:27.0837 1196 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
21:25:27.0883 1196 TBS - ok
21:25:27.0961 1196 [ B62A953F2BF3922C8764A29C34A22899 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
21:25:28.0008 1196 Tcpip - ok
21:25:28.0039 1196 [ B62A953F2BF3922C8764A29C34A22899 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
21:25:28.0055 1196 TCPIP6 - ok
21:25:28.0102 1196 [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
21:25:28.0102 1196 tcpipreg - ok
21:25:28.0149 1196 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
21:25:28.0180 1196 TDPIPE - ok
21:25:28.0211 1196 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
21:25:28.0227 1196 TDTCP - ok
21:25:28.0273 1196 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
21:25:28.0336 1196 tdx - ok
21:25:28.0367 1196 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\drivers\termdd.sys
21:25:28.0383 1196 TermDD - ok
21:25:28.0414 1196 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
21:25:28.0445 1196 TermService - ok
21:25:28.0492 1196 [ CE4B6956E4E12492715A53076E58761F ] TFsExDisk C:\Windows\System32\Drivers\TFsExDisk.sys
21:25:28.0523 1196 TFsExDisk - ok
21:25:28.0570 1196 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
21:25:28.0585 1196 Themes - ok
21:25:28.0601 1196 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
21:25:28.0648 1196 THREADORDER - ok
21:25:28.0663 1196 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
21:25:28.0710 1196 TrkWks - ok
21:25:28.0773 1196 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
21:25:28.0835 1196 TrustedInstaller - ok
21:25:28.0851 1196 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
21:25:28.0882 1196 tssecsrv - ok
21:25:28.0929 1196 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
21:25:28.0975 1196 TsUsbFlt - ok
21:25:29.0038 1196 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
21:25:29.0085 1196 tunnel - ok
21:25:29.0116 1196 [ 48743B69EA47C020A792D8649F753F44 ] TurboB C:\Windows\system32\DRIVERS\TurboB.sys
21:25:29.0131 1196 TurboB - ok
21:25:29.0163 1196 [ 759F59E3EA3802FF23F93DCDB6FE9171 ] TurboBoost C:\Program Files\Intel\TurboBoost\TurboBoost.exe
21:25:29.0178 1196 TurboBoost - ok
21:25:29.0209 1196 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\DRIVERS\uagp35.sys
21:25:29.0209 1196 uagp35 - ok
21:25:29.0241 1196 [ A17D5E1A6DF4EAB0A480F2C490DE4C9D ] UBHelper C:\Windows\system32\drivers\UBHelper.sys
21:25:29.0241 1196 UBHelper - ok
21:25:29.0272 1196 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
21:25:29.0303 1196 udfs - ok
21:25:29.0350 1196 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
21:25:29.0350 1196 UI0Detect - ok
21:25:29.0381 1196 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
21:25:29.0381 1196 uliagpkx - ok
21:25:29.0397 1196 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
21:25:29.0412 1196 umbus - ok
21:25:29.0428 1196 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\DRIVERS\umpass.sys
21:25:29.0428 1196 UmPass - ok
21:25:29.0568 1196 [ A678E5DDD974903DD71F503BDCACA218 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
21:25:29.0631 1196 UNS - ok
21:25:29.0677 1196 [ F9EC9ACD504D823D9B9CA98A4F8D3CA2 ] Updater Service C:\Program Files\Acer\Acer Updater\UpdaterService.exe
21:25:29.0709 1196 Updater Service - ok
21:25:29.0740 1196 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
21:25:29.0787 1196 upnphost - ok
21:25:29.0818 1196 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
21:25:29.0849 1196 usbccgp - ok
21:25:29.0865 1196 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
21:25:29.0880 1196 usbcir - ok
21:25:29.0896 1196 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys
21:25:29.0911 1196 usbehci - ok
21:25:29.0943 1196 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
21:25:29.0943 1196 usbhub - ok
21:25:29.0958 1196 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
21:25:29.0974 1196 usbohci - ok
21:25:30.0005 1196 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
21:25:30.0036 1196 usbprint - ok
21:25:30.0083 1196 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
21:25:30.0130 1196 usbscan - ok
21:25:30.0161 1196 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
21:25:30.0208 1196 USBSTOR - ok
21:25:30.0239 1196 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
21:25:30.0255 1196 usbuhci - ok
21:25:30.0301 1196 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
21:25:30.0317 1196 usbvideo - ok
21:25:30.0333 1196 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
21:25:30.0411 1196 UxSms - ok
21:25:30.0426 1196 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
21:25:30.0426 1196 VaultSvc - ok
21:25:30.0426 1196 vddzqcyl - ok
21:25:30.0442 1196 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
21:25:30.0442 1196 vdrvroot - ok
21:25:30.0489 1196 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
21:25:30.0520 1196 vds - ok
21:25:30.0535 1196 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
21:25:30.0551 1196 vga - ok
21:25:30.0582 1196 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
21:25:30.0629 1196 VgaSave - ok
21:25:30.0645 1196 vgoiqhqm - ok
21:25:30.0676 1196 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
21:25:30.0707 1196 vhdmp - ok
21:25:30.0723 1196 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
21:25:30.0738 1196 viaide - ok
21:25:30.0754 1196 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
21:25:30.0769 1196 volmgr - ok
21:25:30.0801 1196 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
21:25:30.0816 1196 volmgrx - ok
21:25:30.0847 1196 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
21:25:30.0863 1196 volsnap - ok
21:25:30.0879 1196 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\DRIVERS\vsmraid.sys
21:25:30.0894 1196 vsmraid - ok
21:25:30.0941 1196 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
21:25:30.0988 1196 VSS - ok
21:25:31.0003 1196 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
21:25:31.0035 1196 vwifibus - ok
21:25:31.0066 1196 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
21:25:31.0097 1196 vwififlt - ok
21:25:31.0113 1196 [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
21:25:31.0144 1196 vwifimp - ok
21:25:31.0191 1196 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
21:25:31.0253 1196 W32Time - ok
21:25:31.0269 1196 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\DRIVERS\wacompen.sys
21:25:31.0284 1196 WacomPen - ok
21:25:31.0315 1196 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
21:25:31.0347 1196 WANARP - ok
21:25:31.0362 1196 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
21:25:31.0378 1196 Wanarpv6 - ok
21:25:31.0440 1196 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
21:25:31.0503 1196 wbengine - ok
21:25:31.0534 1196 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
21:25:31.0549 1196 WbioSrvc - ok
21:25:31.0565 1196 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
21:25:31.0596 1196 wcncsvc - ok
21:25:31.0612 1196 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
21:25:31.0659 1196 WcsPlugInService - ok
21:25:31.0690 1196 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\DRIVERS\wd.sys
21:25:31.0690 1196 Wd - ok
21:25:31.0737 1196 [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
21:25:31.0783 1196 Wdf01000 - ok
21:25:31.0799 1196 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
21:25:31.0877 1196 WdiServiceHost - ok
21:25:31.0877 1196 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
21:25:31.0908 1196 WdiSystemHost - ok
21:25:31.0924 1196 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
21:25:31.0955 1196 WebClient - ok
21:25:31.0986 1196 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
21:25:32.0049 1196 Wecsvc - ok
21:25:32.0064 1196 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
21:25:32.0111 1196 wercplsupport - ok
21:25:32.0111 1196 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
21:25:32.0142 1196 WerSvc - ok
21:25:32.0173 1196 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
21:25:32.0236 1196 WfpLwf - ok
21:25:32.0251 1196 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
21:25:32.0267 1196 WIMMount - ok
21:25:32.0283 1196 WinDefend - ok
21:25:32.0298 1196 WinHttpAutoProxySvc - ok
21:25:32.0361 1196 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
21:25:32.0392 1196 Winmgmt - ok
21:25:32.0439 1196 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
21:25:32.0501 1196 WinRM - ok
21:25:32.0548 1196 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUsb.sys
21:25:32.0563 1196 WinUsb - ok
21:25:32.0595 1196 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
21:25:32.0626 1196 Wlansvc - ok
21:25:32.0673 1196 [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
21:25:32.0673 1196 wlcrasvc - ok
21:25:32.0782 1196 [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:25:32.0829 1196 wlidsvc - ok
21:25:32.0860 1196 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys
21:25:32.0860 1196 WmiAcpi - ok
21:25:32.0907 1196 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
21:25:32.0969 1196 wmiApSrv - ok
21:25:32.0985 1196 WMPNetworkSvc - ok
21:25:33.0031 1196 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
21:25:33.0047 1196 WPCSvc - ok
21:25:33.0078 1196 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
21:25:33.0109 1196 WPDBusEnum - ok
21:25:33.0141 1196 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
21:25:33.0187 1196 ws2ifsl - ok
21:25:33.0219 1196 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll
21:25:33.0281 1196 wscsvc - ok
21:25:33.0312 1196 [ 8D918B1DB190A4D9B1753A66FA8C96E8 ] WSDPrintDevice C:\Windows\system32\DRIVERS\WSDPrint.sys
21:25:33.0328 1196 WSDPrintDevice - ok
21:25:33.0343 1196 WSearch - ok
21:25:33.0421 1196 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
21:25:33.0468 1196 wuauserv - ok
21:25:33.0515 1196 [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
21:25:33.0562 1196 WudfPf - ok
21:25:33.0562 1196 [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
21:25:33.0577 1196 WUDFRd - ok
21:25:33.0609 1196 [ B20F051B03A966392364C83F009F7D17 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
21:25:33.0640 1196 wudfsvc - ok
21:25:33.0671 1196 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
21:25:33.0749 1196 WwanSvc - ok
21:25:33.0765 1196 xvhzplis - ok
21:25:33.0780 1196 xyfwaqic - ok
21:25:33.0780 1196 zfcfsnnl - ok
21:25:33.0811 1196 ================ Scan global ===============================
21:25:33.0843 1196 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
21:25:33.0874 1196 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
21:25:33.0889 1196 [ 0C27239FEA4DB8A2AAC9E502186B7264 ] C:\Windows\system32\winsrv.dll
21:25:33.0905 1196 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
21:25:33.0936 1196 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
21:25:33.0936 1196 [Global] - ok
21:25:33.0936 1196 ================ Scan MBR ==================================
21:25:33.0952 1196 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
21:25:34.0857 1196 \Device\Harddisk0\DR0 - ok
21:25:34.0857 1196 ================ Scan VBR ==================================
21:25:34.0888 1196 [ D6C4863BC0B9517E68C462069518C71B ] \Device\Harddisk0\DR0\Partition1
21:25:34.0888 1196 \Device\Harddisk0\DR0\Partition1 - ok
21:25:34.0903 1196 [ D63ECFFE4E1C0F9753AA8A069A2A7574 ] \Device\Harddisk0\DR0\Partition2
21:25:34.0903 1196 \Device\Harddisk0\DR0\Partition2 - ok
21:25:34.0903 1196 ============================================================
21:25:34.0903 1196 Scan finished
21:25:34.0903 1196 ============================================================
21:25:34.0935 3984 Detected object count: 5
21:25:34.0935 3984 Actual detected object count: 5
21:26:53.0106 3984 AtherosSvc ( UnsignedFile.Multi.Generic ) - skipped by user
21:26:53.0106 3984 AtherosSvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:26:53.0106 3984 HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
21:26:53.0106 3984 HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:26:53.0122 3984 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
21:26:53.0122 3984 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:26:53.0122 3984 OpLclSrv ( UnsignedFile.Multi.Generic ) - skipped by user
21:26:53.0122 3984 OpLclSrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:26:53.0122 3984 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
21:26:53.0122 3984 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
21:26:59.0143 5708 Deinitialize success

markusg · 14.05.2013, 20:46

Hi,
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

spirit83 · 16.05.2013, 20:55

Hi,

irgendwie funktioniert das mit dem Combofix nicht richtig.

Beim starten der Datei vom Desktop installiert er sich zunächst, hört jedoch kurz vorm Ende auf und es tut sich nix weiter...hab jetzt fast ne Stunde gewartet, aber geht nix weiter...

Stimmt was nicht oder dauert das wirklich solange?

11.05.2013, 22:34	#6
markusg /// Malware-holic	GUV Trojaner, abgesichterter Modus nicht möglich; Win7 Hi nimm mal den Stick raus, starte neu mit der CD, stick rein und noch mal scannen __________________ --> GUV Trojaner, abgesichterter Modus nicht möglich; Win7

GUV Trojaner, abgesichterter Modus nicht möglich; Win7

Plagegeister aller Art und deren Bekämpfung: GUV Trojaner, abgesichterter Modus nicht möglich; Win7