Hidden Files bei Sophos

Majestic · 30.03.2014, 17:02

Hallo zusammen!

Ich hoffe Ihr könnt mir weiterhelfen.
Ich betreibe einen HTPC mit (legal erworbener!!) Filmbibliothek. Als ich mir gestern einen Film ansehen wollte, hat mir meine Media-Center-Software gemeldet, dass die gewünschte Datei nicht verfügbar sei und siehe da: Sie war tatsächlich weg. Das hat mich natürlich stutzig gemacht, da ich mich nicht erinnern konnte irgendetwas gelöscht zu haben. Ein Scan mit Sophos hat nun diese und auch mehrere andere Dateien (entsprechend des Betriebs als HTPC allesamt Videos bzw. Bilder) als "hidden files" entdeckt.
Scans mit AVG, Malwarebytes und Spybot blieb unauffällig.

Was bedeutet das nun für mich? Wie ist das passiert? Wie bekomme ich die Dateien wieder?

Herzlichen Dank für Eure kurze Antwort und viele Grüße!

schrauber · 30.03.2014, 17:57

hi,

Logfile von Sophos?

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Majestic · 31.03.2014, 18:37

Hallo und schonmal vielen Dank für Deine Hilfe! Die Hosts-Datei erscheint mir bereits sehr merkwürdig... :-(

Vielen, vielen Dank!

Hier die FRST.txt

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 13-03-2014
Ran by Michael (administrator) on DESKTOP-PC on 30-03-2014 20:26:54
Running from C:\Download
Windows 7 Home Premium (X64) OS Language: German Standard
Internet Explorer Version 8
Boot Mode: Normal


==================== Processes (Whitelisted) =================

(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgrsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgcsrva.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
(NVIDIA Corporation) C:\Windows\system32\nvvsvc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Verdiem) C:\Program Files (x86)\Verdiem\Edison\edsvc.exe
(Memeo) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
() C:\Windows\SysWOW64\WinService.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Sphinx Software) C:\Program Files (x86)\Windows7FirewallControl\Windows7FirewallService.exe
(Safer Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgnsa.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgemca.exe
(Logitech, Inc.) C:\Program Files\Logitech\SetPointP\SetPoint.exe
(Safer-Networking Ltd.) C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe
(Petr Laštovička) D:\Mediabrowser\Hotkey\HotkeyP.exe
(Glarysoft Ltd) C:\Program Files (x86)\Glary Utilities\memdefrag.exe
(Michel Krämer) C:\Program Files\Spamihilator\spamihilator.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\APSDaemon.exe
(Logitech, Inc.) C:\Program Files\Common Files\LogiShrd\KHAL3\KHALMNPR.EXE
(Sphinx Software) C:\Program Files (x86)\Windows7FirewallControl\Windows7FirewallControl.exe
() C:\Windows\twain_32\Samsung\CLX3170\Scan2Pc.exe
(Adobe Systems Incorporated) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
(AVG Technologies CZ, s.r.o.) C:\Program Files (x86)\AVG\AVG2014\avgui.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\ApplePhotoStreams.exe
(Memeo Inc.) C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackup.exe
(Memeo Inc.) C:\Program Files (x86)\Memeo\AutoBackup\MemeoUpdater.exe
(Apple Inc.) C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloudServices.exe
(Michel Krämer) C:\Program Files\Spamihilator\bridge\spamihilator_32bit_bridge.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe
(Adobe Systems, Inc.) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerPlugin_12_0_0_77.exe


==================== Registry (Whitelisted) ==================

HKLM\...\Run: [EvtMgr6] - C:\Program Files\Logitech\SetPointP\SetPoint.exe [1744152 2011-10-07] (Logitech, Inc.)
HKLM-x32\...\Run: [Windows7FirewallControl] - C:\Program Files (x86)\Windows7FirewallControl\Windows7FirewallControl.exe [802816 2010-11-01] (Sphinx Software)
HKLM-x32\...\Run: [Memeo Backup] - C:\Program Files (x86)\Memeo\AutoBackup\MemeoLauncher2.exe [136416 2010-07-28] (Memeo Inc.)
HKLM-x32\...\Run: [3170 Scan2PC] - C:\Windows\twain_32\Samsung\CLX3170\Scan2Pc.exe [503808 2009-06-12] ()
HKLM-x32\...\Run: [LexwareInfoService] - C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [339240 2008-11-03] (Lexware GmbH & Co. KG)
HKLM-x32\...\Run: [Adobe Reader Speed Launcher] - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe [40312 2013-09-03] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [Adobe ARM] - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [959904 2013-11-21] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [QuickTime Task] - C:\Program Files (x86)\QuickTime\QTTask.exe [421888 2013-05-01] (Apple Inc.)
HKLM-x32\...\Run: [AVG_UI] - C:\Program Files (x86)\AVG\AVG2014\avgui.exe [4971024 2014-03-19] (AVG Technologies CZ, s.r.o.)
HKLM-x32\...\Run: [TrojanScanner] - C:\Program Files (x86)\Trojan Remover\Trjscan.exe [1704720 2014-01-23] (Simply Super Software)
Winlogon\Notify\LBTWlgn: c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)
HKU\S-1-5-21-3358726306-2800167369-978410916-1000\...\Run: [SpybotSD TeaTimer] - C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe [2260480 2009-03-05] (Safer-Networking Ltd.)
HKU\S-1-5-21-3358726306-2800167369-978410916-1000\...\Run: [HotkeyP] - D:\Mediabrowser\Hotkey\HotkeyP.exe [147456 2011-09-24] (Petr Laštovička)
HKU\S-1-5-21-3358726306-2800167369-978410916-1000\...\Run: [Glary Memory Optimizer] - C:\Program Files (x86)\Glary Utilities\memdefrag.exe [109496 2013-01-05] (Glarysoft Ltd)
HKU\S-1-5-21-3358726306-2800167369-978410916-1000\...\Run: [AVG-Secure-Search-Update_0214c] - C:\Users\Michael\AppData\Roaming\AVG 0214c Campaign\AVG-Secure-Search-Update-0214c.exe /PROMPT /mid=d8af381b975947d28b41d14b34a52f26-ad1491be2ce6c122f6b66faa90e70c2decf7d34c /CMPID=0214c
HKU\S-1-5-21-3358726306-2800167369-978410916-1000\...\RunOnce: [iCloud] - C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe [346440 2013-11-20] (Apple Inc.)
HKU\S-1-5-21-3358726306-2800167369-978410916-1000\...\MountPoints2: J - J:\SETUP.EXE
HKU\S-1-5-21-3358726306-2800167369-978410916-1000\...\MountPoints2: K - K:\LaunchU3.exe -a
Startup: C:\Users\Michael\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Spamihilator.lnk
ShortcutTarget: Spamihilator.lnk -> C:\Program Files\Spamihilator\spamihilator.exe (Michel Krämer)

==================== Internet (Whitelisted) ====================

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKCU\Software\Microsoft\Internet Explorer\Main,ICQ Search = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
StartMenuInternet: IEXPLORE.EXE - iexplore.exe
SearchScopes: HKCU - {6552C7DD-90A4-4387-B795-F8F96747DE19} URL = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
SearchScopes: HKCU - {AD22EBAF-0D18-4fc7-90CC-5EA0ABBE9EB8} URL = hxxp://www.daemon-search.com/search?q={searchTerms}
BHO-x32: DivX Plus Web Player HTML5 <video> - {326E768D-4182-46FD-9C16-1449A49795F4} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Spybot-S&D IE Protection - {53707962-6F74-2D53-2644-206D7942484F} - C:\Program Files (x86)\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
BHO-x32: DivX HiQ - {593DDEC6-7468-4cdd-90E1-42DADAA222E9} - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
BHO-x32: Java(tm) Plug-In 2 SSV Helper - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Java\jre6\bin\jp2ssv.dll (Sun Microsystems, Inc.)
Toolbar: HKLM - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
Toolbar: HKLM-x32 - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar.dll ()
Toolbar: HKCU - DAEMON Tools Toolbar - {32099AAC-C132-4136-9E9A-4E364A424E17} - C:\Program Files (x86)\DAEMON Tools Toolbar\DTToolbar64.dll ()
DPF: HKLM {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
DPF: HKLM-x32 {D27CDB6E-AE6D-11CF-96B8-444553540000} 
Hosts: There are more than one entry in Hosts. See Hosts section of Addition.txt
Tcpip\Parameters: [DhcpNameServer] 192.168.178.1

FireFox:
========
FF ProfilePath: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default
FF user.js: detected! => C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\user.js
FF DefaultSearchEngine: Wikipedia (de)
FF SearchEngineOrder.1: Ask.com
FF SelectedSearchEngine: Wikipedia (de)
FF Homepage: https://www.google.de/
FF Keyword.URL: hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.1.9&q=
FF Plugin: @adobe.com/FlashPlayer - C:\Windows\system32\Macromed\Flash\NPSWF64_12_0_0_77.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer - C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_12_0_0_77.dll ()
FF Plugin-x32: @adobe.com/ShockwavePlayer - C:\Windows\system32\Adobe\Director\np32dsw.dll No File
FF Plugin-x32: @Apple.com/iTunes,version=1.0 - C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll ()
FF Plugin-x32: @divx.com/DivX Browser Plugin,version=1.0.0 - C:\Program Files (x86)\DivX\DivX Plus Web Player\npdivx32.dll (DivX, LLC)
FF Plugin-x32: @divx.com/DivX VOD Helper,version=1.0.0 - C:\Program Files (x86)\DivX\DivX OVS Helper\npovshelper.dll (DivX, LLC.)
FF Plugin-x32: @java.com/JavaPlugin - C:\Program Files (x86)\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 - C:\Program Files (x86)\Microsoft Silverlight\5.1.20513.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: @veetle.com/veetleCorePlugin,version=0.9.19 - C:\Program Files (x86)\Veetle\plugins\npVeetle.dll (Veetle Inc)
FF Plugin-x32: @veetle.com/veetlePlayerPlugin,version=0.9.18 - C:\Program Files (x86)\Veetle\Player\npvlc.dll (Veetle Inc)
FF Plugin-x32: @videolan.org/vlc,version=2.0.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.1 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: @videolan.org/vlc,version=2.1.2 - C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)
FF Plugin-x32: Adobe Reader - C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF Plugin HKCU: @unity3d.com/UnityPlayer,version=1.0 - C:\Users\Michael\AppData\LocalLow\Unity\WebPlayer\loader\npUnity3D32.dll (Unity Technologies ApS)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npdeployJava1.dll (Sun Microsystems, Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\NPOFF12.DLL (Microsoft Corporation)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\nppdf32.dll (Adobe Systems Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin2.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin3.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin4.dll (Apple Inc.)
FF Plugin ProgramFiles/Appdata: C:\Program Files (x86)\mozilla firefox\plugins\npqtplugin5.dll (Apple Inc.)
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\searchplugins\11-suche.xml
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\searchplugins\daemon-search.xml
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\searchplugins\englische-ergebnisse.xml
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\searchplugins\gmx-suche.xml
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\searchplugins\icqplugin.xml
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\searchplugins\lastminute.xml
FF SearchPlugin: C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\searchplugins\webde-suche.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: Camifox - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\camifox@altmusictv.com [2011-01-26]
FF Extension: DAEMON Tools Toolbar - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\DTToolbar@toolbarnet.com [2011-05-10]
FF Extension: Nokia Maps 3D browser plugin - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\maps@ovi.com [2011-10-05]
FF Extension: SocialReviver - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\fbsidebardisabler@vittgam.net.xpi [2013-01-20]
FF Extension: Youtube Downloader - Media Downloader - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\paulsaintuzb@gmail.com.xpi [2014-01-19]
FF Extension: GMX MailCheck - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\toolbar@gmx.net.xpi [2014-03-23]
FF Extension: Best Video Downloader 2 - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\{170503FA-3349-4F17-BC86-001888A5C8E2}.xpi [2014-01-19]
FF Extension: FlashGot - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\{19503e42-ca3c-4c27-b1e2-9cdb2170ee34}.xpi [2011-05-08]
FF Extension: Multirow Bookmarks Toolbar Plus - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\{4c7097f7-08f2-4ef2-9b9f-f95fa4cbb064}.xpi [2011-09-17]
FF Extension: Easy YouTube Video Downloader - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\{c0c9a2c7-2e5c-4447-bc53-97718bc91e1b}.xpi [2011-05-09]
FF Extension: Adblock Plus - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-05-09]
FF Extension: Multirow Bookmarks Toolbar - C:\Users\Michael\AppData\Roaming\Mozilla\Firefox\Profiles\h3ef55cy.default\Extensions\{FBF6D7FB-F305-4445-BB3D-FEF66579A033}.xpi [2011-05-08]
FF HKLM-x32\...\Firefox\Extensions: [{23fcfd51-4958-4f00-80a3-ae97e717ed8b}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video
FF Extension: DivX Plus Web Player HTML5 &lt;video&gt; - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\html5video [2011-04-19]
FF HKLM-x32\...\Firefox\Extensions: [{6904342A-8307-11DF-A508-4AE2DFD72085}] - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa
FF Extension: DivX HiQ - C:\Program Files (x86)\DivX\DivX Plus Web Player\firefox\wpa [2011-04-19]

==================== Services (Whitelisted) =================

R2 AVGIDSAgent; C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe [3782672 2014-02-23] (AVG Technologies CZ, s.r.o.)
R2 avgwd; C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe [348008 2013-09-24] (AVG Technologies CZ, s.r.o.)
R2 edsvc; C:\Program Files (x86)\Verdiem\Edison\edsvc.exe [75008 2008-10-24] (Verdiem)
R2 SBSDWSCService; C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe [1153368 2009-01-26] (Safer Networking Ltd.)
R2 SCM_Service; C:\Windows\SysWOW64\WinService.exe [186848 2010-05-10] ()
R2 Windows7FirewallService; C:\Program Files (x86)\Windows7FirewallControl\Windows7FirewallService.exe [401408 2010-11-01] (Sphinx Software)

==================== Drivers (Whitelisted) ====================

S3 AsrCDDrv; No ImagePath
R1 Avgdiska; C:\Windows\System32\DRIVERS\avgdiska.sys [150808 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 AVGIDSDriver; C:\Windows\System32\DRIVERS\avgidsdrivera.sys [243480 2013-11-25] (AVG Technologies CZ, s.r.o.)
R0 AVGIDSHA; C:\Windows\System32\DRIVERS\avgidsha.sys [196376 2013-11-25] (AVG Technologies CZ, s.r.o.)
R1 Avgldx64; C:\Windows\System32\DRIVERS\avgldx64.sys [212280 2013-11-01] (AVG Technologies CZ, s.r.o.)
R0 Avgloga; C:\Windows\System32\DRIVERS\avgloga.sys [294712 2013-10-31] (AVG Technologies CZ, s.r.o.)
R0 Avgmfx64; C:\Windows\System32\DRIVERS\avgmfx64.sys [123704 2013-10-01] (AVG Technologies CZ, s.r.o.)
R0 Avgrkx64; C:\Windows\System32\DRIVERS\avgrkx64.sys [31544 2013-09-10] (AVG Technologies CZ, s.r.o.)
R1 Avgtdia; C:\Windows\System32\DRIVERS\avgtdia.sys [251192 2013-08-01] (AVG Technologies CZ, s.r.o.)
R3 bautpw64; C:\Windows\System32\drivers\bautpw64.sys [16000 2009-07-10] (BUFFALO INC.)
R1 dtsoftbus01; C:\Windows\System32\DRIVERS\dtsoftbus01.sys [254528 2011-01-29] (DT Soft Ltd)
R3 irsir; C:\Windows\System32\DRIVERS\irsir.sys [27648 2008-01-19] (Microsoft Corporation)
S3 MEMSWEEP2; C:\Windows\system32\F142.tmp [6144 2009-06-18] (Sophos Plc)
S3 RTL8187; C:\Windows\System32\DRIVERS\wg111v2.sys [450048 2010-04-06] (NETGEAR Inc.)
S1 SAVRKBootTasks; C:\Windows\SysWOW64\SAVRKBootTasks.sys [18816 2009-06-18] (Sophos Plc)
S3 vpnva; C:\Windows\System32\DRIVERS\vpnva64-6.sys [52080 2013-10-10] (Cisco Systems, Inc.)
S2 DgiVecp; \??\C:\Windows\system32\Drivers\DgiVecp.sys [X]

==================== NetSvcs (Whitelisted) ===================


==================== One Month Created Files and Folders ========

2014-03-30 20:25 - 2014-03-30 20:26 - 00000000 ____D () C:\FRST
2014-03-30 18:06 - 2009-06-18 12:55 - 00018816 ____N (Sophos Plc) C:\Windows\SysWOW64\SAVRKBootTasks.sys
2014-03-30 16:08 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\F142.tmp
2014-03-30 16:06 - 2014-03-30 12:29 - 00002127 _____ () C:\Users\Michael\Desktop\Sophos Anti-Rootkit.lnk
2014-03-30 14:59 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\CE66.tmp
2014-03-30 14:56 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\18AB.tmp
2014-03-30 13:26 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\6131.tmp
2014-03-30 12:33 - 2009-06-18 12:54 - 00006144 ____N (Sophos Plc) C:\Windows\system32\8C.tmp
2014-03-30 12:29 - 2014-03-30 12:29 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-03-30 12:23 - 2014-03-30 12:23 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-29 23:06 - 2014-03-29 23:04 - 00450876 ____R () C:\Windows\system32\Drivers\etc\hosts.20140329-220641.backup
2014-03-29 23:04 - 2011-10-14 16:28 - 00000980 _____ () C:\Windows\system32\Drivers\etc\hosts.20140329-220443.backup
2014-03-29 22:57 - 2014-03-29 22:57 - 00000000 ____D () C:\Users\Michael\Documents\Simply Super Software
2014-03-29 22:57 - 2014-03-29 22:57 - 00000000 ____D () C:\ProgramData\Licenses
2014-03-29 22:54 - 2014-03-29 22:54 - 00001145 _____ () C:\Users\Public\Desktop\Trojan Remover.lnk
2014-03-29 22:54 - 2014-03-29 22:54 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-03-29 22:54 - 2014-03-29 22:54 - 00000000 ____D () C:\Program Files (x86)\Trojancheck 6
2014-03-29 22:54 - 2014-03-29 22:54 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-03-29 22:52 - 2014-03-30 20:26 - 00000000 ____D () C:\Download
2014-03-29 22:30 - 2014-03-29 22:30 - 00000000 ____D () C:\restauration
2014-03-19 18:41 - 2014-03-19 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-18 19:21 - 2014-03-18 20:42 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-13 10:09 - 2014-03-13 10:09 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2014-03-13 10:09 - 2014-03-13 10:09 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2014-03-01 16:16 - 2014-03-24 20:45 - 00000987 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-03-01 16:16 - 2014-03-01 16:16 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\AVG2014
2014-03-01 16:14 - 2014-03-01 16:16 - 00000000 ____D () C:\ProgramData\AVG2014
2014-03-01 16:14 - 2014-03-01 16:14 - 00000000 ___HD () C:\$AVG
2014-03-01 16:14 - 2014-03-01 16:14 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-03-01 16:07 - 2014-03-01 16:07 - 00222159 _____ () C:\ProgramData\1393682756.bdinstall.bin
2014-03-01 16:05 - 2014-03-30 18:34 - 00000000 ____D () C:\ProgramData\MFAData
2014-03-01 16:05 - 2014-03-03 16:07 - 00000000 ____D () C:\Users\Michael\AppData\Local\Avg2014
2014-03-01 16:05 - 2014-03-01 16:05 - 00000000 ____D () C:\Users\Michael\AppData\Local\MFAData
2014-03-01 16:04 - 2014-03-01 16:04 - 155264904 _____ (AVG Technologies) C:\Users\Michael\Downloads\avg_free_x64_all_2014_4335a7045.exe

==================== One Month Modified Files and Folders =======

2014-03-30 20:26 - 2014-03-30 20:25 - 00000000 ____D () C:\FRST
2014-03-30 20:26 - 2014-03-29 22:52 - 00000000 ____D () C:\Download
2014-03-30 20:24 - 2009-07-14 19:58 - 00696132 _____ () C:\Windows\system32\perfh007.dat
2014-03-30 20:24 - 2009-07-14 19:58 - 00147428 _____ () C:\Windows\system32\perfc007.dat
2014-03-30 20:24 - 2009-07-14 07:13 - 01611160 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-03-30 20:21 - 2011-01-26 21:50 - 01990662 _____ () C:\Windows\WindowsUpdate.log
2014-03-30 20:19 - 2013-01-12 18:39 - 00000330 _____ () C:\Windows\Tasks\GlaryInitialize.job
2014-03-30 20:19 - 2011-01-29 14:56 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\Spamihilator
2014-03-30 20:18 - 2011-02-15 18:11 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-03-30 20:18 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-03-30 20:18 - 2009-07-14 06:51 - 00223770 _____ () C:\Windows\setupact.log
2014-03-30 20:16 - 2013-02-08 12:24 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-03-30 18:38 - 2009-07-14 06:45 - 00013216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-03-30 18:38 - 2009-07-14 06:45 - 00013216 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-03-30 18:34 - 2014-03-01 16:05 - 00000000 ____D () C:\ProgramData\MFAData
2014-03-30 14:25 - 2011-01-27 21:09 - 07625388 _____ () C:\Windows\PFRO.log
2014-03-30 14:24 - 2011-01-26 22:38 - 00000000 ____D () C:\Users\Michael\Downloads\Programme
2014-03-30 13:18 - 2013-03-29 14:41 - 00000000 ____D () C:\Users\Michael\Documents\WISO Mein Geld
2014-03-30 12:36 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-03-30 12:29 - 2014-03-30 16:06 - 00002127 _____ () C:\Users\Michael\Desktop\Sophos Anti-Rootkit.lnk
2014-03-30 12:29 - 2014-03-30 12:29 - 00000000 ____D () C:\Program Files (x86)\Sophos
2014-03-30 12:23 - 2014-03-30 12:23 - 00001115 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2014-03-30 12:23 - 2011-01-26 22:58 - 00000000 ____D () C:\Program Files (x86)\Malwarebytes' Anti-Malware
2014-03-30 01:05 - 2011-01-27 22:11 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\XBMC
2014-03-29 23:04 - 2014-03-29 23:06 - 00450876 ____R () C:\Windows\system32\Drivers\etc\hosts.20140329-220641.backup
2014-03-29 23:03 - 2011-01-26 22:57 - 00000000 ____D () C:\Program Files (x86)\Spybot - Search & Destroy
2014-03-29 23:02 - 2011-02-01 00:16 - 00000000 ____D () C:\Users\Michael\AppData\Local\CrashDumps
2014-03-29 22:57 - 2014-03-29 22:57 - 00000000 ____D () C:\Users\Michael\Documents\Simply Super Software
2014-03-29 22:57 - 2014-03-29 22:57 - 00000000 ____D () C:\ProgramData\Licenses
2014-03-29 22:54 - 2014-03-29 22:54 - 00001145 _____ () C:\Users\Public\Desktop\Trojan Remover.lnk
2014-03-29 22:54 - 2014-03-29 22:54 - 00000000 ____D () C:\ProgramData\Simply Super Software
2014-03-29 22:54 - 2014-03-29 22:54 - 00000000 ____D () C:\Program Files (x86)\Trojancheck 6
2014-03-29 22:54 - 2014-03-29 22:54 - 00000000 ____D () C:\Program Files (x86)\Trojan Remover
2014-03-29 22:30 - 2014-03-29 22:30 - 00000000 ____D () C:\restauration
2014-03-29 15:35 - 2013-02-07 17:55 - 00013132 _____ () C:\Users\Michael\Desktop\Fixkosten.xlsx
2014-03-29 15:34 - 2014-02-16 13:29 - 00000000 ____D () C:\Users\Michael\Desktop\Urlaubsplanungen
2014-03-27 16:50 - 2011-01-31 23:59 - 00000000 ____D () C:\Users\Michael\Documents\Kalkulationen
2014-03-26 17:39 - 2011-02-01 16:01 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\vlc
2014-03-24 20:45 - 2014-03-01 16:16 - 00000987 _____ () C:\Users\Public\Desktop\AVG 2014.lnk
2014-03-20 20:51 - 2011-02-01 00:00 - 00000000 ____D () C:\Users\Michael\Documents\Vorlagen
2014-03-20 20:47 - 2011-01-30 14:44 - 00000099 _____ () C:\Users\Public\LMDebug.log
2014-03-20 20:29 - 2012-05-02 19:27 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-03-19 18:41 - 2014-03-19 18:41 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-03-18 20:56 - 2014-02-04 20:36 - 00010856 _____ () C:\Users\Michael\Desktop\Verteilung.xlsx
2014-03-18 20:42 - 2014-03-18 19:21 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2014-03-16 14:57 - 2013-10-02 17:10 - 00015216 _____ () C:\Users\Michael\Desktop\Gutachtenliquidation.xlsx
2014-03-13 10:16 - 2013-02-08 12:24 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-03-13 10:16 - 2012-10-16 12:32 - 00692616 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-03-13 10:16 - 2011-11-30 17:20 - 00071048 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-03-13 10:09 - 2014-03-13 10:09 - 00000000 ____D () C:\Users\Default\AppData\Roaming\TuneUp Software
2014-03-13 10:09 - 2014-03-13 10:09 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\TuneUp Software
2014-03-04 19:16 - 2012-04-22 20:09 - 00000000 ____D () C:\Users\Michael\Documents\Bewerbungen
2014-03-03 16:07 - 2014-03-01 16:05 - 00000000 ____D () C:\Users\Michael\AppData\Local\Avg2014
2014-03-01 16:16 - 2014-03-01 16:16 - 00000000 ____D () C:\Users\Michael\AppData\Roaming\AVG2014
2014-03-01 16:16 - 2014-03-01 16:14 - 00000000 ____D () C:\ProgramData\AVG2014
2014-03-01 16:14 - 2014-03-01 16:14 - 00000000 ___HD () C:\$AVG
2014-03-01 16:14 - 2014-03-01 16:14 - 00000000 ____D () C:\Program Files (x86)\AVG
2014-03-01 16:09 - 2013-01-12 15:55 - 00000000 ____D () C:\Program Files\Bitdefender
2014-03-01 16:07 - 2014-03-01 16:07 - 00222159 _____ () C:\ProgramData\1393682756.bdinstall.bin
2014-03-01 16:07 - 2013-01-12 15:54 - 00000000 ____D () C:\Program Files\Common Files\Bitdefender
2014-03-01 16:05 - 2014-03-01 16:05 - 00000000 ____D () C:\Users\Michael\AppData\Local\MFAData
2014-03-01 16:04 - 2014-03-01 16:04 - 155264904 _____ (AVG Technologies) C:\Users\Michael\Downloads\avg_free_x64_all_2014_4335a7045.exe
2014-02-28 15:06 - 2009-07-14 07:08 - 00032632 _____ () C:\Windows\Tasks\SCHEDLGU.TXT

==================== Bamital & volsnap Check =================

C:\Windows\System32\winlogon.exe => MD5 is legit
C:\Windows\System32\wininit.exe => MD5 is legit
C:\Windows\SysWOW64\wininit.exe => MD5 is legit
C:\Windows\explorer.exe => MD5 is legit
C:\Windows\SysWOW64\explorer.exe => MD5 is legit
C:\Windows\System32\svchost.exe => MD5 is legit
C:\Windows\SysWOW64\svchost.exe => MD5 is legit
C:\Windows\System32\services.exe => MD5 is legit
C:\Windows\System32\User32.dll => MD5 is legit
C:\Windows\SysWOW64\User32.dll => MD5 is legit
C:\Windows\System32\userinit.exe => MD5 is legit
C:\Windows\SysWOW64\userinit.exe => MD5 is legit
C:\Windows\System32\rpcss.dll => MD5 is legit
C:\Windows\System32\Drivers\volsnap.sys => MD5 is legit


LastRegBack: 2014-03-30 09:58

==================== End Of Log ============================

--- --- ---

Und die Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x64) Version: 13-03-2014
Ran by Michael at 2014-03-30 20:27:11
Running from C:\Download
Boot Mode: Normal
==========================================================


==================== Security Center ========================

AV: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {0E9420C4-06B3-7FA0-3AB1-6E49CB52ECD9}
AS: Windows Defender (Disabled - Out of date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: AVG AntiVirus Free Edition 2014 (Enabled - Up to date) {B5F5C120-2089-702E-0001-553BB0D5A664}

==================== Installed Programs ======================

Adobe Flash Player 12 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 12.0.0.77 - Adobe Systems Incorporated)
Adobe Flash Player 9 ActiveX (HKLM-x32\...\{58BAA8D0-404E-4585-9FD3-ED1BB72AC2EE}) (Version: 9.0.124.0 - Adobe Systems, Inc.)
Adobe Photoshop Elements 8.0 (HKLM-x32\...\Adobe Photoshop Elements 8.0) (Version: 8.0 - Adobe Systems Incorporated)
Adobe Photoshop Elements 8.0 (x32 Version: 8.0 - Adobe Systems Incorporated) Hidden
Adobe Reader X (10.1.8) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.8 - Adobe Systems Incorporated)
Adobe Shockwave Player 11.5 (HKLM-x32\...\Adobe Shockwave Player) (Version: 11.5.9.620 - Adobe Systems, Inc.)
Apple Application Support (HKLM-x32\...\{46F044A5-CE8B-4196-984E-5BD6525E361D}) (Version: 2.3.6 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{2EF5D87E-B7BD-458F-8428-E4D0B8B4E65C}) (Version: 7.0.0.117 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{789A5B64-9DD9-4BA5-915A-F0FC0A1B7BFE}) (Version: 2.1.3.127 - Apple Inc.)
Ask Toolbar Updater (HKCU\...\{79A765E1-C399-405B-85AF-466F52E918B0}) (Version: 1.2.0.20064 - Ask.com) <==== ATTENTION
ASUS nVidia Driver (x32 Version: 1.00.0000 - ASUSTek) Hidden
AVG 2014 (HKLM\...\AVG) (Version: 2014.0.4354 - AVG Technologies)
AVG 2014 (Version: 14.0.3722 - AVG Technologies) Hidden
AVG 2014 (Version: 14.0.4354 - AVG Technologies) Hidden
Battlefield: Bad Company™ 2 (HKLM-x32\...\{3AC8457C-0385-4BEA-A959-E095F05D6D67}) (Version: 1.0.0.0 - Electronic Arts)
Bonjour (HKLM\...\{6E3610B2-430D-4EB0-81E3-2B57E8B9DE8D}) (Version: 3.0.0.10 - Apple Inc.)
BUFFALO eco Manager for HD (HKLM-x32\...\UN080616) (Version:  - )
Cisco AnyConnect Secure Mobility Client  (HKLM-x32\...\Cisco AnyConnect Secure Mobility Client) (Version: 3.1.04072 - Cisco Systems, Inc.)
Cisco AnyConnect Secure Mobility Client (x32 Version: 3.1.04072 - Cisco Systems, Inc.) Hidden
Counter-Strike (HKLM-x32\...\Steam App 10) (Version:  - Valve)
Counter-Strike: Source (HKLM-x32\...\Steam App 240) (Version:  - Valve)
DAEMON Tools Lite (HKLM-x32\...\DAEMON Tools Lite) (Version: 4.40.2.0131 - DT Soft Ltd)
DAEMON Tools Toolbar (HKLM-x32\...\DAEMON Tools Toolbar) (Version: 1.1.4.0024 - DT Soft Ltd) <==== ATTENTION
DHTML Editing Component (HKLM-x32\...\{2EA870FA-585F-4187-903D-CB9FFD21E2E0}) (Version: 6.02.0001 - Microsoft Corporation)
DivX-Setup (HKLM-x32\...\DivX Setup.divx.com) (Version: 2.4.1.4 - DivX, LLC)
Easy Phone Sync (HKLM-x32\...\{5BBBFC75-8C26-4F4B-A483-B1D5D347D7D2}) (Version: 64 - Media Mushroom Limited)
Edison (HKLM-x32\...\{9542A589-9E34-4D25-BBED-E4AFA039AF56}) (Version: 1.1.3323.0 - Verdiem)
eReg (x32 Version: 1.20.138.34 - Logitech, Inc.) Hidden
FileParade bundle uninstaller (HKLM-x32\...\FileParade bundle uninstaller) (Version: 1.0.0.0 - FileParade) <==== ATTENTION
Film Info! Organizer (HKLM-x32\...\Film Info! Organizer_is1) (Version: 0.3.0.0 - Sebastian Humann)
FreeCommander 2009.02b (HKLM-x32\...\FreeCommander_is1) (Version: 2009.02 - Marek Jasinski)
Full Tilt Poker.Eu (HKLM-x32\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 4.65.0.WIN.FullTilt.EU - )
Glary Utilities 2.52.0.1698 (HKLM-x32\...\Glary Utilities_is1) (Version: 2.52.0.1698 - Glarysoft Ltd)
GoToMeeting 5.3.0.1009 (HKCU\...\GoToMeeting) (Version: 5.3.0.1009 - CitrixOnline)
Homeworld Theme - Windows 7 Media Center (HKLM-x32\...\{1B61E11B-C3C6-4428-BC55-716272B0CA9B}) (Version: 1.0.1 - Hack7MC.com)
iCloud (HKLM\...\{81E20D41-C277-4526-934D-F2380AF91B78}) (Version: 3.1.0.40 - Apple Inc.)
ISI ResearchSoft - Export Helper (HKLM-x32\...\ISI ResearchSoft - Export Helper) (Version:  - )
iTunes (HKLM\...\{D601CEAD-2E4F-4BBB-85CC-C29A4CE6A3C0}) (Version: 11.1.3.8 - Apple Inc.)
iTunes Library Updater (HKLM-x32\...\{38EE230F-F631-451F-8800-E29F5E5C9E7D}) (Version: 1.2.2 - N/A)
Java Auto Updater (x32 Version: 2.0.2.4 - Sun Microsystems, Inc.) Hidden
Java(TM) 6 Update 22 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83216022FF}) (Version: 6.0.220 - Oracle)
JDownloader (HKLM-x32\...\JDownloader) (Version:  - AppWork UG (haftungsbeschränkt))
Jitbit Macro Recorder (HKLM-x32\...\{2D57FB4E-6277-4A6D-8739-304C38051B89}) (Version: 1.0.0 - JitBit)
JJ MP3 Renamer 3.2.6 (HKLM-x32\...\JJ MP3 Renamer) (Version: 3.2.6 - JJ Software)
Lexware Elster (HKLM-x32\...\{DEBC6EBF-FF7A-4E30-9C49-DCFB53B446F0}) (Version: 8.10.00.0017 - Lexware GmbH & Co. KG)
Lexware Info Service (HKLM-x32\...\{59624372-3B85-47f4-9B04-4911E551DF1E}) (Version: 2.61.00.0033 - Lexware GmbH & Co. KG)
Lexware online banking (HKLM-x32\...\{6C35CAC7-27C9-4CB0-BBB8-CBF9994215DA}) (Version: 8.00.00.0067 - Lexware GmbH & Co. KG)
Local Cooling Setup (x32 Version: 1.0 - InstallAware Software Corporation) Hidden
LocalCooling (HKCU\...\LocalCooling) (Version:  - Uniblue Ltd)
LocalCooling (x32 Version: 2.0.0 - Uniblue Ltd) Hidden
LockHunter version 1.0 beta 3, 64 bit edition (HKLM\...\LockHunter_is1) (Version:  - Crystal Rich, Ltd)
Logitech SetPoint 6.32 (HKLM\...\sp6) (Version: 6.32.20 - Logitech)
Macro Recorder (HKCU\...\2a7a433177cfa3a6) (Version: 5.5.2.49 - Jitbit Macro Recorder)
Macro Recorder 4.69.0 (HKLM-x32\...\{16C3C822-052E-4CD7-8CEB-AE5352F1E76E}_is1) (Version: 4.69.0 - Jitbit Software)
Malwarebytes Anti-Malware Version 1.75.0.1300 (HKLM-x32\...\Malwarebytes' Anti-Malware_is1) (Version: 1.75.0.1300 - Malwarebytes Corporation)
Media Center Studio (HKCU\...\f58cbb372ebb2ec8) (Version: 0.0.1.18 - Advent)
mediscript Hammerexamen (HKLM-x32\...\{1231D46E-3174-4F1F-859E-41DCB0D070D2}) (Version: 5.0.0 - Elsevier GmbH)
Memeo Backup (HKLM-x32\...\{82B2DB92-98CA-4a0e-B1BD-18B6E2D320CB}) (Version:  - Memeo Inc.)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Client Profile (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30320 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (Version: 4.0.30320 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Home and Student 2007 (HKLM-x32\...\HOMESTUDENTR) (Version: 12.0.4518.1014 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2007 (Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2007 (x32 Version: 12.0.4518.1014 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.20513.0 - Microsoft Corporation)
Microsoft Sync Framework Runtime v1.0 (x86) (HKLM-x32\...\{A8BD5A60-E843-46DC-8271-ABF20756BE0F}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Sync Framework Services v1.0 (x86) (HKLM-x32\...\{03CAB33F-D1C2-48C6-8766-DAE84DFC25FE}) (Version: 1.0.1215.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Xbox 360 Accessories 1.2 (HKLM\...\{B3B750C0-8C22-439D-B7CE-67F3ED99CC2B}) (Version: 1.20.146.0 - Microsoft)
MobileMe Control Panel (HKLM\...\{6DD01FF3-63CE-436B-96DB-61363EAA4EB8}) (Version: 3.1.8.0 - Apple Inc.)
Mozilla Firefox 28.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 28.0 (x86 de)) (Version: 28.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 28.0 - Mozilla)
Mozilla Thunderbird 24.4.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 24.4.0 (x86 de)) (Version: 24.4.0 - Mozilla)
Mp3tag v2.58 (HKLM-x32\...\Mp3tag) (Version: v2.58 - Florian Heidenreich)
MyFreeCodec (HKCU\...\MyFreeCodec) (Version:  - )
NETGEAR WG111v2 wireless USB 2.0 adapter (HKLM-x32\...\{4102037D-E8E0-48E0-B203-E521D194FB71}) (Version: 1.0.0.133 - NETGEAR)
Network Print Monitor for Windows (HKLM-x32\...\Network Print Monitor) (Version:  - )
NVIDIA Display Control Panel (HKLM\...\NVIDIA Display Control Panel) (Version: 6.14.12.5944 - NVIDIA Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.10.62.40 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.1.13.1 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.1.13.1 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.265.36.0 - NVIDIA Corporation) Hidden
NVIDIA PhysX (HKLM-x32\...\{9530AE42-DAE1-4619-9594-B23487285D17}) (Version: 9.11.1107 - NVIDIA Corporation)
NVIDIA Stereoscopic 3D Driver (HKLM-x32\...\NVIDIAStereo) (Version: 7.17.12.5944 - NVIDIA Corporation)
NVIDIA StereoUSB Driver (HKLM-x32\...\NVIDIA StereoUSB Driver) (Version: 1.00.0000 - NVIDIA Corporation)
PDF24 Creator 4.4.3 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
QuickTime (HKLM-x32\...\{B67BAFBA-4C9F-48FA-9496-933E3B255044}) (Version: 7.74.80.86 - Apple Inc.)
Samsung CLX-3170 Series (HKLM-x32\...\Samsung CLX-3170 Series) (Version:  - Samsung Electronics CO.,LTD)
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.6.1.13105_7 - Samsung Electronics Co., Ltd.) Hidden
Samsung Universal Print Driver (HKLM-x32\...\Samsung Universal Print Driver) (Version: 2.02.05.00:24 - Samsung Electronics Co., Ltd.)
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.29.0 - SAMSUNG Electronics Co., Ltd.)
SopCast 3.3.2 (HKLM-x32\...\SopCast) (Version: 3.3.2 - www.sopcast.com)
Sophos Anti-Rootkit 1.5.0 (HKLM-x32\...\Sophos-AntiRootkit) (Version: 1.5.0 - Sophos Plc)
Spamihilator 0.9.9.53 (64-Bit) (HKLM\...\{9ACA9DD7-9519-4610-A446-2D3D936203D2}) (Version: 0.9.9.53 - Michel Krämer)
Spybot - Search & Destroy (HKLM-x32\...\{B4092C6D-E886-4CB2-BA68-FE5A88D31DE6}_is1) (Version: 1.6.2 - Safer Networking Limited)
Steam (HKLM-x32\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Tag&Rename 3.7 (HKLM-x32\...\Tag&Rename_is1) (Version: 3.7 - Softpointer Inc)
Trojan Remover 6.9.0 (HKLM-x32\...\Trojan Remover_is1) (Version: 6.9.0 - Simply Super Software)
Trojancheck 6 (HKLM-x32\...\Trojancheck_is1) (Version:  - Thomas Löffler)
Turbo Lister 2 (HKLM-x32\...\{8927E07C-97F7-4A54-88FB-D976F50DD46E}) (Version: 2.00.0000 - eBay Inc.)
Unity Web Player (HKCU\...\UnityWebPlayer) (Version:  - Unity Technologies ApS)
VC80CRTRedist - 8.0.50727.4053 (x32 Version: 1.1.0 - DivX, Inc) Hidden
Visual Studio 2012 x64 Redistributables (HKLM\...\{8C775E70-A791-4DA8-BCC3-6AB7136F4484}) (Version: 14.0.0.1 - AVG Technologies)
Visual Studio 2012 x86 Redistributables (HKLM-x32\...\{98EFF19A-30AB-4E4B-B943-F06B1C63EBF8}) (Version: 14.0.0.1 - AVG Technologies CZ, s.r.o.)
VLC media player 2.1.2 (HKLM-x32\...\VLC media player) (Version: 2.1.2 - VideoLAN)
Win7codecs (HKLM-x32\...\{8C0CAA7A-3272-4991-A808-2C7559DE3409}) (Version: 2.7.3 - Shark007)
Windows7FirewallControl (i386) 4.0.144.38 (HKLM-x32\...\Windows7FirewallControl_is1) (Version: 4.0.144.38 - Sphinx Software)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
WISO Mein Geld 2013 Professional (HKLM-x32\...\WISO Mein Geld 2013 Professional) (Version:  - Buhl Data Service GmbH)
WISO Mein Geld 2013 Professional (x32 Version: 15.0.0.1 - Buhl Data Service GmbH) Hidden
x64 Components v2.7.7 (HKLM\...\x64 Components_is1) (Version: 2.7.7 - Shark007)
XBMC (HKCU\...\XBMC) (Version:  - Team XBMC)

==================== Restore Points  =========================

23-03-2014 16:17:10 Geplanter Prüfpunkt
30-03-2014 17:02:48 Geplanter Prüfpunkt

==================== Hosts content: ==========================

2009-07-14 04:34 - 2014-03-29 23:06 - 00450876 ____R C:\Windows\system32\Drivers\etc\hosts
129.187.254.28	asa-cluster.lrz.de
129.187.254.28	asa-cluster.lrz.de
134.176.247.13	vpn.uni-giessen.de
129.187.254.28	asa-cluster.lrz.de
127.0.0.1	www.007guard.com
127.0.0.1	007guard.com
127.0.0.1	008i.com
127.0.0.1	www.008k.com
127.0.0.1	008k.com
127.0.0.1	www.00hq.com
127.0.0.1	00hq.com
127.0.0.1	010402.com
127.0.0.1	www.032439.com
127.0.0.1	032439.com
127.0.0.1	www.0scan.com
127.0.0.1	0scan.com
127.0.0.1	1000gratisproben.com
127.0.0.1	www.1000gratisproben.com
127.0.0.1	1001namen.com
127.0.0.1	www.1001namen.com
127.0.0.1	100888290cs.com
127.0.0.1	www.100888290cs.com
127.0.0.1	www.100sexlinks.com
127.0.0.1	100sexlinks.com
127.0.0.1	10sek.com
127.0.0.1	www.10sek.com
127.0.0.1	www.1-2005-search.com
127.0.0.1	1-2005-search.com
127.0.0.1	123fporn.info

There are 1000 more lines.


==================== Scheduled Tasks (whitelisted) =============

Task: {1D5E6A60-FBCC-4839-ACF8-A8231E62F951} - System32\Tasks\Adobe online update program => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {33625C54-3A8C-4859-8DAA-BBFF21F8CC2E} - System32\Tasks\Adobe-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2013-11-21] (Adobe Systems Incorporated)
Task: {7F1C3A95-BF2A-45D3-A38B-8CD1A3238483} - System32\Tasks\GlaryInitialize => C:\Program Files (x86)\Glary Utilities\initialize.exe [2013-01-05] (Glarysoft Ltd)
Task: {814AD9AD-5A4D-4145-8A74-579DBA81DE97} - System32\Tasks\Java Update Scheduler => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [2010-05-14] (Sun Microsystems, Inc.)
Task: {81DBFA84-0E95-490F-B511-68E6BBF9CFD9} - System32\Tasks\SidebarExecute => C:\Program Files (x86)\Windows Sidebar\sidebar.exe [2009-07-14] (Microsoft Corporation)
Task: {B7AAB477-BC03-4F45-9F7E-A7300DFCC40F} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-03-13] (Adobe Systems Incorporated)
Task: {BA739529-7C1C-4C90-AF5E-B8B86BFB1D86} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2011-06-01] (Apple Inc.)
Task: {C291E16E-0849-4D60-B288-BC15E710020F} - System32\Tasks\Lexware online update program => C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [2008-11-03] (Lexware GmbH & Co. KG)
Task: {F85A6074-492A-4736-9318-1D65F7D951AF} - System32\Tasks\Lexware-Online-Aktualisierungsprogramm => C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe [2008-11-03] (Lexware GmbH & Co. KG)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GlaryInitialize.job => C:\Program Files (x86)\Glary Utilities\initialize.exe

==================== Loaded Modules (whitelisted) =============

2011-01-30 14:42 - 2008-06-04 08:53 - 00027648 _____ () C:\Windows\System32\spd__l.dll
2011-01-26 21:54 - 2010-05-10 13:14 - 00186848 _____ () C:\Windows\SysWOW64\WinService.exe
2011-02-06 23:07 - 2009-05-11 20:00 - 00160768 _____ () C:\Windows\system32\SaMinDrv.dll
2011-01-27 00:20 - 2010-03-15 12:28 - 00166400 _____ () C:\Program Files\WinRAR\rarext.dll
2011-10-07 11:39 - 2011-10-07 11:39 - 01304856 _____ () C:\Program Files\Logitech\SetPointP\Macros\MacroCore.dll
2011-01-29 14:56 - 2011-01-29 14:56 - 00073728 _____ () C:\Program Files\Spamihilator\zlib1.dll
2011-01-29 14:56 - 2011-01-29 14:56 - 00380928 _____ () C:\Program Files\Spamihilator\sqlite3.dll
2011-02-06 23:07 - 2009-06-12 01:10 - 00503808 _____ () C:\Windows\twain_32\Samsung\CLX3170\Scan2Pc.exe
2011-06-24 22:56 - 2011-06-24 22:56 - 00087328 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\zlib1.dll
2011-06-24 22:56 - 2011-06-24 22:56 - 01241888 _____ () C:\Program Files (x86)\Common Files\Apple\Apple Application Support\libxml2.dll
2008-10-24 10:00 - 2008-10-24 10:00 - 00107776 _____ () C:\Program Files (x86)\Verdiem\Edison\Vista\OSPowerUtils.dll
2008-07-15 17:16 - 2008-07-15 17:16 - 00733184 _____ () C:\Program Files (x86)\Verdiem\Edison\Vista\log4cxx.dll
2013-09-14 01:51 - 2013-09-14 01:51 - 00087952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\zlib1.dll
2013-09-14 01:50 - 2013-09-14 01:50 - 01242952 _____ () C:\Program Files (x86)\Common Files\Apple\Internet Services\libxml2.dll
2011-02-06 23:07 - 2008-06-26 21:45 - 00155648 _____ () C:\Windows\twain_32\Samsung\CLX3170\IMFilter.dll
2011-02-06 23:07 - 2008-06-26 21:46 - 01384520 _____ () C:\Windows\twain_32\Samsung\CLX3170\ssole.dll
2011-02-06 23:07 - 2008-06-26 21:45 - 00367104 _____ () C:\Windows\twain_32\Samsung\CLX3170\NetModule.dll
2010-07-28 19:31 - 2010-07-28 19:31 - 02887904 _____ () C:\Program Files (x86)\Memeo\AutoBackup\Memeo.Client.UI.dll
2010-07-28 19:31 - 2010-07-28 19:31 - 00025824 _____ () C:\Program Files (x86)\Memeo\AutoBackup\Memeo.Client.DriveDetection.dll
2010-04-05 20:52 - 2010-04-05 20:52 - 00504293 _____ () C:\Program Files (x86)\Memeo\AutoBackup\sqlite3.DLL
2014-03-19 18:41 - 2014-03-19 18:41 - 03642480 _____ () C:\Program Files (x86)\Mozilla Firefox\mozjs.dll

==================== Alternate Data Streams (whitelisted) =========

AlternateDataStreams: C:\ProgramData\Temp:CB0AACC9
AlternateDataStreams: C:\Users\Michael\Desktop\SetupEasyPhoneSync.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\avg_free_x64_all_2014_4335a7045.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\CLX-3170_Print.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\Counter-Strike.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\ESP_V3.3.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\FileZilla_3.6.0.2_win32-setup.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\gusetup_slim_2.52.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\KiesSetup.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\MacroRecorderSetup.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\TagRename37.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\UnityWebPlayer.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\WISOMeinGeld2013SP1.exe:BDU
AlternateDataStreams: C:\Users\Michael\Downloads\WISOMeinGeldTrial2013.exe:BDU

==================== Safe Mode (whitelisted) ===================


==================== Disabled items from MSCONFIG ==============

MSCONFIG\startupreg: Adobe ARM => "C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
MSCONFIG\startupreg: Adobe Reader Speed Launcher => "C:\Program Files (x86)\Adobe\Reader 10.0\Reader\Reader_sl.exe"
MSCONFIG\startupreg: AppleSyncNotifier => C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe
MSCONFIG\startupreg: APSDaemon => "C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe"
MSCONFIG\startupreg: Cisco AnyConnect Secure Mobility Agent for Windows => "C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnui.exe" -minimized
MSCONFIG\startupreg: iTunesHelper => "C:\Program Files (x86)\iTunes\iTunesHelper.exe"
MSCONFIG\startupreg: KiesAirMessage => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
MSCONFIG\startupreg: KiesPreload => C:\Program Files (x86)\Samsung\Kies\Kies.exe /preload
MSCONFIG\startupreg: KiesTrayAgent => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
MSCONFIG\startupreg: LexwareInfoService => C:\Program Files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe /autostart
MSCONFIG\startupreg: PDFPrint => C:\Program Files (x86)\PDF24\pdf24.exe
MSCONFIG\startupreg: QuickTime Task => "C:\Program Files (x86)\QuickTime\QTTask.exe" -atboottime
MSCONFIG\startupreg: Steam => "C:\Steam\Steam.exe" -silent
MSCONFIG\startupreg: XboxStat => "C:\Program Files\Microsoft Xbox 360 Accessories\XboxStat.exe" silentrun

==================== Faulty Device Manager Devices =============

Name: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Description: Cisco AnyConnect Secure Mobility Client Virtual Miniport Adapter for Windows x64
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: vpnva
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/30/2014 08:21:31 PM) (Source: Application Hang) (User: )
Description: Programm iCloud.exe, Version 3.1.3.3 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: 97c

Startzeit: 01cf4c449c34ad3e

Endzeit: 15

Anwendungspfad: C:\Program Files (x86)\Common Files\Apple\Internet Services\iCloud.exe

Berichts-ID: 1afe8e57-b838-11e3-ae8d-00027241c6d5

Error: (03/30/2014 08:18:15 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (03/30/2014 06:31:41 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (03/30/2014 04:03:33 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (03/30/2014 04:00:31 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (03/30/2014 03:41:12 PM) (Source: Bonjour Service) (User: )
Description: 476: ERROR: read_msg errno 0 (Der Vorgang wurde erfolgreich beendet.)

Error: (03/30/2014 03:41:12 PM) (Source: Bonjour Service) (User: )
Description: ERROR: mDNSPlatformReadTCP - recv: 10053

Error: (03/30/2014 02:25:52 PM) (Source: MemeoBackgroundService) (User: )
Description: Problem starting Memeo Background Service :Ausnahmefehler "System.Reflection.TargetInvocationException: Ein Aufrufziel hat einen Ausnahmefehler verursacht. ---> System.Security.Principal.IdentityNotMappedException: Manche oder alle Identitätsverweise konnten nicht übersetzt werden.
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel.StartListening(Object data)
   bei System.Runtime.Remoting.Channels.Ipc.IpcServerChannel..ctor(IDictionary properties, IServerChannelSinkProvider sinkProvider, CommonSecurityDescriptor securityDescriptor)
   bei System.Runtime.Remoting.Channels.Ipc.IpcChannel..ctor(IDictionary properties, IClientChannelSinkProvider clientSinkProvider, IServerChannelSinkProvider serverSinkProvider)
   --- Ende der internen Ausnahmestapelüberwachung ---
   bei System.RuntimeMethodHandle._InvokeConstructor(Object[] args, SignatureStruct& signature, IntPtr declaringType)
   bei System.Reflection.RuntimeConstructorInfo.Invoke(BindingFlags invokeAttr, Binder binder, Object[] parameters, CultureInfo culture)
   bei System.RuntimeType.CreateInstanceImpl(BindingFlags bindingAttr, Binder binder, Object[] args, CultureInfo culture, Object[] activationAttributes)
   bei System.Runtime.Remoting.RemotingConfigHandler.CreateChannelFromConfigEntry(ChannelEntry entry)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureChannels(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)" bei der Remotekonfiguration.   bei System.Runtime.Remoting.RemotingConfigHandler.ConfigureRemoting(RemotingXmlConfigFileData configData, Boolean ensureSecurity)
   bei System.Runtime.Remoting.RemotingConfiguration.Configure(String filename, Boolean ensureSecurity)
   bei RemoteServerService.MemeoBackgroundService.OnStart(String[] args)

Error: (03/30/2014 11:18:03 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.

Error: (03/30/2014 11:18:02 AM) (Source: SideBySide) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "assemblyIdentity1". Fehler in Manifest- oder Richtliniendatei "assemblyIdentity2" in Zeile assemblyIdentity3.
Der Wert "*" des "language"-Attributs im assemblyIdentity-Element ist ungültig.


System errors:
=============
Error: (03/30/2014 08:20:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/30/2014 08:20:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/30/2014 08:20:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/30/2014 08:20:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/30/2014 08:20:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535

Error: (03/30/2014 08:20:02 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peer Name Resolution-Protokoll" wurde mit folgendem Fehler beendet: 
%%-2140993535

Error: (03/30/2014 08:20:02 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (03/30/2014 08:20:02 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (03/30/2014 08:20:02 PM) (Source: PNRPSvc) (User: )
Description: 0x80630801

Error: (03/30/2014 08:19:52 PM) (Source: Service Control Manager) (User: )
Description: Der Dienst "Peernetzwerk-Gruppenzuordnung" ist vom Dienst "Peer Name Resolution-Protokoll" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%-2140993535


Microsoft Office Sessions:
=========================
Error: (04/26/2011 00:38:13 PM) (Source: Microsoft Office 12 Sessions)(User: )
Description: ID: 3, Application Name: Microsoft Office PowerPoint, Application Version: 12.0.4518.1014, Microsoft Office Version: 12.0.4518.1014. This session lasted 4212 seconds with 3060 seconds of active time.  This session ended with a crash.


CodeIntegrity Errors:
===================================
  Date: 2014-03-30 16:51:02.010
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:51:02.010
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:49:59.988
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:49:59.988
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:49:59.988
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:49:59.973
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:49:59.973
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:49:59.957
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:48:29.120
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-03-30 16:48:29.105
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\F142.tmp" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.


==================== Memory info =========================== 

Percentage of memory in use: 45%
Total physical RAM: 4087.05 MB
Available physical RAM: 2213.82 MB
Total Pagefile: 8172.25 MB
Available Pagefile: 6064.29 MB
Total Virtual: 8192 MB
Available Virtual: 8191.79 MB

==================== Drives ================================

Drive c: (System) (Fixed) (Total:129.88 GB) (Free:37.6 GB) NTFS
Drive d: (Data 1) (Fixed) (Total:801.53 GB) (Free:56.64 GB) NTFS
Drive e: (Data 2) (Fixed) (Total:1862.89 GB) (Free:171.94 GB) NTFS
Drive f: (Data 3) (Fixed) (Total:1862.89 GB) (Free:206.16 GB) NTFS
Drive i: (USB Data) (Fixed) (Total:931.51 GB) (Free:19.53 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 932 GB) (Disk ID: 4198BEA5)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=130 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=802 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 2 (MBR Code: Windows 7 or 8) (Size: 1863 GB) (Disk ID: 00000000)

Partition: GPT Partition Type.

========================================================
Disk: 7 (Size: 932 GB) (Disk ID: D07A4C4D)

Partition: GPT Partition Type.

==================== End Of Log ============================

DANKE!!!

schrauber · 01.04.2014, 12:31

Logfile von Sophos?

Majestic · 01.04.2014, 19:35

Ich hab' nur Sophos Rootkit und keine Ahnung wo ich die Logfile nach dem Scan finde? Im Installationsverzeichnis ist jeden falls nichts (?)

schrauber · 02.04.2014, 13:40

Mach den Scan nochmal, dann solltest du die Option haben ein Logfile anzeigen zu lassen.

Majestic · 02.04.2014, 20:42

Es gibt keine Möglichkeit eine Logfile zu erstellen. Kann ein alternatives Programm nutzen? Ist auf Grundlage der obigen Logs keine Aussage möglich?

schrauber · 03.04.2014, 11:59

nö, weil das eine nur ein Scanner ist, das andere scannt speziell nach Rootkits, und meldet ein Hidden Files nach deiner Aussage. Ich muss schon wissen was genu der meldet.

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Majestic · 06.04.2014, 14:07

Hallo und nochmals vielen Dank!
Bitt entschuldige die späte Antwort, hat berufsbedingt nicht früher geklappt. Anbei die beiden Logfiles:

mbar (Kein Fund):

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.07.0.1009
www.malwarebytes.org

Database version: v2014.04.06.05

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
Michael :: DESKTOP-PC [administrator]

06.04.2014 14:45:21
mbar-log-2014-04-06 (14-45-21).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 253604
Time elapsed: 8 minute(s), 20 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

TDSSKiller:

Code:

ATTFilter

14:58:36.0142 5840  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
14:58:36.0164 5840  ============================================================
14:58:36.0164 5840  Current date / time: 2014/04/06 14:58:36.0164
14:58:36.0164 5840  SystemInfo:
14:58:36.0164 5840  
14:58:36.0164 5840  OS Version: 6.1.7600 ServicePack: 0.0
14:58:36.0164 5840  Product type: Workstation
14:58:36.0164 5840  ComputerName: DESKTOP-PC
14:58:36.0164 5840  UserName: Michael
14:58:36.0164 5840  Windows directory: C:\Windows
14:58:36.0164 5840  System windows directory: C:\Windows
14:58:36.0164 5840  Running under WOW64
14:58:36.0164 5840  Processor architecture: Intel x64
14:58:36.0164 5840  Number of processors: 4
14:58:36.0164 5840  Page size: 0x1000
14:58:36.0164 5840  Boot type: Normal boot
14:58:36.0164 5840  ============================================================
14:58:37.0092 5840  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
14:58:37.0093 5840  Drive \Device\Harddisk1\DR1 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
14:58:37.0094 5840  Drive \Device\Harddisk2\DR2 - Size: 0x1D1C1116000 (1863.02 Gb), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
14:58:37.0095 5840  Drive \Device\Harddisk3\DR3 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
14:58:43.0754 5840  ============================================================
14:58:43.0754 5840  \Device\Harddisk0\DR0:
14:58:43.0755 5840  MBR partitions:
14:58:43.0755 5840  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
14:58:43.0755 5840  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x103C4000
14:58:43.0755 5840  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x103F6800, BlocksNum 0x6430F800
14:58:43.0755 5840  \Device\Harddisk1\DR1:
14:58:43.0756 5840  GPT partitions:
14:58:43.0757 5840  \Device\Harddisk1\DR1\Partition1: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {D650EB7A-ED52-4502-8BDC-701B7C5EC3FB}, Name: Microsoft reserved partition, StartLBA 0x22, BlocksNum 0x40000
14:58:43.0758 5840  \Device\Harddisk1\DR1\Partition2: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {3A7CCDEF-514D-4FF2-8D01-2D435C832652}, Name: Basic data partition, StartLBA 0x40800, BlocksNum 0xE8DC8000
14:58:43.0758 5840  MBR partitions:
14:58:43.0758 5840  \Device\Harddisk2\DR2:
14:58:43.0758 5840  GPT partitions:
14:58:43.0759 5840  \Device\Harddisk2\DR2\Partition1: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {62A686CA-6002-45A3-9C10-CED4E3B123D1}, Name: Microsoft reserved partition, StartLBA 0x22, BlocksNum 0x40000
14:58:43.0759 5840  \Device\Harddisk2\DR2\Partition2: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {DBF465B7-F30D-494C-BCBC-A8ECFF5029E3}, Name: Basic data partition, StartLBA 0x40800, BlocksNum 0xE8DC8000
14:58:43.0759 5840  MBR partitions:
14:58:43.0759 5840  \Device\Harddisk3\DR3:
14:58:43.0759 5840  MBR partitions:
14:58:43.0759 5840  \Device\Harddisk3\DR3\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x74705982
14:58:43.0759 5840  ============================================================
14:58:43.0794 5840  C: <-> \Device\Harddisk0\DR0\Partition2
14:58:43.0828 5840  D: <-> \Device\Harddisk0\DR0\Partition3
14:58:43.0891 5840  E: <-> \Device\Harddisk1\DR1\Partition2
14:58:43.0928 5840  I: <-> \Device\Harddisk3\DR3\Partition1
14:58:44.0445 5840  F: <-> \Device\Harddisk2\DR2\Partition2
14:58:44.0446 5840  ============================================================
14:58:44.0446 5840  Initialize success
14:58:44.0446 5840  ============================================================
14:59:42.0373 0680  ============================================================
14:59:42.0374 0680  Scan started
14:59:42.0374 0680  Mode: Manual; SigCheck; TDLFS; 
14:59:42.0374 0680  ============================================================
14:59:42.0809 0680  ================ Scan system memory ========================
14:59:42.0809 0680  System memory - ok
14:59:42.0809 0680  ================ Scan services =============================
14:59:42.0932 0680  [ 1B00662092F9F9568B995902F0CC40D5 ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
14:59:43.0017 0680  1394ohci - ok
14:59:43.0047 0680  [ 6F11E88748CDEFD2F76AA215F97DDFE5 ] ACPI            C:\Windows\system32\DRIVERS\ACPI.sys
14:59:43.0061 0680  ACPI - ok
14:59:43.0072 0680  [ 63B05A0420CE4BF0E4AF6DCC7CADA254 ] AcpiPmi         C:\Windows\system32\DRIVERS\acpipmi.sys
14:59:43.0130 0680  AcpiPmi - ok
14:59:43.0183 0680  [ D0B11E40EA74A98A5E133DF1F5276240 ] acsock          C:\Windows\system32\DRIVERS\acsock64.sys
14:59:43.0231 0680  acsock - ok
14:59:43.0334 0680  [ 4451CC2275B04043EC2BCC757AF97291 ] AdobeActiveFileMonitor8.0 C:\Program Files (x86)\Adobe\Elements Organizer 8.0\PhotoshopElementsFileAgent.exe
14:59:43.0350 0680  AdobeActiveFileMonitor8.0 - ok
14:59:43.0442 0680  [ ADDA5E1951B90D3D23C56D3CF0622ADC ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
14:59:43.0457 0680  AdobeARMservice - ok
14:59:43.0542 0680  [ 9D96B0D5855FD1B98023B3EEC9F06786 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
14:59:43.0559 0680  AdobeFlashPlayerUpdateSvc - ok
14:59:43.0600 0680  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
14:59:43.0654 0680  adp94xx - ok
14:59:43.0703 0680  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
14:59:43.0728 0680  adpahci - ok
14:59:43.0736 0680  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
14:59:43.0755 0680  adpu320 - ok
14:59:43.0780 0680  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
14:59:43.0905 0680  AeLookupSvc - ok
14:59:43.0987 0680  [ B9384E03479D2506BC924C16A3DB87BC ] AFD             C:\Windows\system32\drivers\afd.sys
14:59:44.0051 0680  AFD - ok
14:59:44.0064 0680  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\DRIVERS\agp440.sys
14:59:44.0072 0680  agp440 - ok
14:59:44.0077 0680  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe
14:59:44.0119 0680  ALG - ok
14:59:44.0125 0680  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\DRIVERS\aliide.sys
14:59:44.0141 0680  aliide - ok
14:59:44.0144 0680  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\DRIVERS\amdide.sys
14:59:44.0153 0680  amdide - ok
14:59:44.0157 0680  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
14:59:44.0183 0680  AmdK8 - ok
14:59:44.0186 0680  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
14:59:44.0203 0680  AmdPPM - ok
14:59:44.0207 0680  [ 7A4B413614C055935567CF88A9734D38 ] amdsata         C:\Windows\system32\DRIVERS\amdsata.sys
14:59:44.0217 0680  amdsata - ok
14:59:44.0228 0680  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
14:59:44.0239 0680  amdsbs - ok
14:59:44.0249 0680  [ B4AD0CACBAB298671DD6F6EF7E20679D ] amdxata         C:\Windows\system32\DRIVERS\amdxata.sys
14:59:44.0257 0680  amdxata - ok
14:59:44.0260 0680  [ 42FD751B27FA0E9C69BB39F39E409594 ] AppID           C:\Windows\system32\drivers\appid.sys
14:59:44.0333 0680  AppID - ok
14:59:44.0343 0680  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
14:59:44.0391 0680  AppIDSvc - ok
14:59:44.0404 0680  [ D065BE66822847B7F127D1F90158376E ] Appinfo         C:\Windows\System32\appinfo.dll
14:59:44.0436 0680  Appinfo - ok
14:59:44.0532 0680  [ 30E3850F303EAE5C364782EA78579CC9 ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
14:59:44.0545 0680  Apple Mobile Device - ok
14:59:44.0550 0680  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\DRIVERS\arc.sys
14:59:44.0565 0680  arc - ok
14:59:44.0569 0680  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
14:59:44.0578 0680  arcsas - ok
14:59:44.0669 0680  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
14:59:44.0694 0680  aspnet_state - ok
14:59:44.0722 0680  AsrCDDrv - ok
14:59:44.0739 0680  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
14:59:44.0797 0680  AsyncMac - ok
14:59:44.0805 0680  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\DRIVERS\atapi.sys
14:59:44.0813 0680  atapi - ok
14:59:44.0903 0680  [ 3EFD964D52221360AF0673CD61C2F4F5 ] atikmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
14:59:44.0999 0680  atikmdag - ok
14:59:45.0030 0680  [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
14:59:45.0085 0680  AudioEndpointBuilder - ok
14:59:45.0093 0680  [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioSrv        C:\Windows\System32\Audiosrv.dll
14:59:45.0132 0680  AudioSrv - ok
14:59:45.0187 0680  [ BE5047191368D2C014202AB2775768B7 ] Avgdiska        C:\Windows\system32\DRIVERS\avgdiska.sys
14:59:45.0203 0680  Avgdiska - ok
14:59:45.0312 0680  [ 9D5EA7BD5E29F404CD158AED17B40A15 ] AVGIDSAgent     C:\Program Files (x86)\AVG\AVG2014\avgidsagent.exe
14:59:45.0368 0680  AVGIDSAgent - ok
14:59:45.0410 0680  [ EE48CA8AB25E2B0EE3D3E5A463C5A37E ] AVGIDSDriver    C:\Windows\system32\DRIVERS\avgidsdrivera.sys
14:59:45.0428 0680  AVGIDSDriver - ok
14:59:45.0442 0680  [ 494D668B4CB866A1D6835E5F01B13EF1 ] AVGIDSHA        C:\Windows\system32\DRIVERS\avgidsha.sys
14:59:45.0453 0680  AVGIDSHA - ok
14:59:45.0488 0680  [ 4BE8BB177B4C2BC3564845EF6D1073F1 ] Avgldx64        C:\Windows\system32\DRIVERS\avgldx64.sys
14:59:45.0500 0680  Avgldx64 - ok
14:59:45.0547 0680  [ D3772CC086FB81F76B5A82C85E1C7C8E ] Avgloga         C:\Windows\system32\DRIVERS\avgloga.sys
14:59:45.0559 0680  Avgloga - ok
14:59:45.0586 0680  [ A0BCE5DC2C1F1EE5C1CA19A33375AC23 ] Avgmfx64        C:\Windows\system32\DRIVERS\avgmfx64.sys
14:59:45.0594 0680  Avgmfx64 - ok
14:59:45.0630 0680  [ 12FAAF366975B2BF2E93F1866C0E480D ] Avgrkx64        C:\Windows\system32\DRIVERS\avgrkx64.sys
14:59:45.0637 0680  Avgrkx64 - ok
14:59:45.0649 0680  [ 4E364FABBD147F59E5D524C9EA86D772 ] Avgtdia         C:\Windows\system32\DRIVERS\avgtdia.sys
14:59:45.0663 0680  Avgtdia - ok
14:59:45.0690 0680  [ B747B6BB015E552F49C634BB19540F3D ] avgwd           C:\Program Files (x86)\AVG\AVG2014\avgwdsvc.exe
14:59:45.0705 0680  avgwd - ok
14:59:45.0714 0680  [ B20B5FA5CA050E9926E4D1DB81501B32 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
14:59:45.0761 0680  AxInstSV - ok
14:59:45.0780 0680  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
14:59:45.0820 0680  b06bdrv - ok
14:59:45.0846 0680  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
14:59:45.0874 0680  b57nd60a - ok
14:59:45.0933 0680  [ 8833727E08F3172FEE10079D3ED96F22 ] bautpw64        C:\Windows\system32\drivers\bautpw64.sys
14:59:45.0942 0680  bautpw64 - ok
14:59:45.0953 0680  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
14:59:45.0990 0680  BDESVC - ok
14:59:46.0032 0680  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
14:59:46.0111 0680  Beep - ok
14:59:46.0139 0680  [ 4992C609A6315671463E30F6512BC022 ] BFE             C:\Windows\System32\bfe.dll
14:59:46.0198 0680  BFE - ok
14:59:46.0248 0680  [ 7F0C323FE3DA28AA4AA1BDA3F575707F ] BITS            C:\Windows\System32\qmgr.dll
14:59:46.0306 0680  BITS - ok
14:59:46.0342 0680  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
14:59:46.0364 0680  blbdrive - ok
14:59:46.0445 0680  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
14:59:46.0467 0680  Bonjour Service - ok
14:59:46.0508 0680  [ 91CE0D3DC57DD377E690A2D324022B08 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
14:59:46.0555 0680  bowser - ok
14:59:46.0558 0680  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
14:59:46.0578 0680  BrFiltLo - ok
14:59:46.0587 0680  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
14:59:46.0606 0680  BrFiltUp - ok
14:59:46.0625 0680  [ 94FBC06F294D58D02361918418F996E3 ] Browser         C:\Windows\System32\browser.dll
14:59:46.0671 0680  Browser - ok
14:59:46.0676 0680  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
14:59:46.0697 0680  Brserid - ok
14:59:46.0700 0680  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
14:59:46.0719 0680  BrSerWdm - ok
14:59:46.0730 0680  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
14:59:46.0750 0680  BrUsbMdm - ok
14:59:46.0753 0680  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
14:59:46.0762 0680  BrUsbSer - ok
14:59:46.0802 0680  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum         C:\Windows\system32\DRIVERS\BthEnum.sys
14:59:46.0840 0680  BthEnum - ok
14:59:46.0844 0680  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
14:59:46.0867 0680  BTHMODEM - ok
14:59:46.0906 0680  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
14:59:46.0931 0680  BthPan - ok
14:59:46.0960 0680  [ A51FA9D0E85D5ADABEF72E67F386309C ] BTHPORT         C:\Windows\system32\Drivers\BTHport.sys
14:59:46.0995 0680  BTHPORT - ok
14:59:47.0007 0680  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll
14:59:47.0042 0680  bthserv - ok
14:59:47.0083 0680  [ F740B9A16B2C06700F2130E19986BF3B ] BTHUSB          C:\Windows\system32\Drivers\BTHUSB.sys
14:59:47.0116 0680  BTHUSB - ok
14:59:47.0129 0680  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
14:59:47.0168 0680  cdfs - ok
14:59:47.0201 0680  [ 83D2D75E1EFB81B3450C18131443F7DB ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
14:59:47.0226 0680  cdrom - ok
14:59:47.0238 0680  [ 312E2F82AF11E79906898AC3E3D58A1F ] CertPropSvc     C:\Windows\System32\certprop.dll
14:59:47.0307 0680  CertPropSvc - ok
14:59:47.0311 0680  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
14:59:47.0334 0680  circlass - ok
14:59:47.0360 0680  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
14:59:47.0375 0680  CLFS - ok
14:59:47.0417 0680  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
14:59:47.0432 0680  clr_optimization_v2.0.50727_32 - ok
14:59:47.0490 0680  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
14:59:47.0505 0680  clr_optimization_v2.0.50727_64 - ok
14:59:47.0573 0680  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
14:59:47.0589 0680  clr_optimization_v4.0.30319_32 - ok
14:59:47.0599 0680  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
14:59:47.0621 0680  clr_optimization_v4.0.30319_64 - ok
14:59:47.0625 0680  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
14:59:47.0638 0680  CmBatt - ok
14:59:47.0649 0680  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\DRIVERS\cmdide.sys
14:59:47.0657 0680  cmdide - ok
14:59:47.0675 0680  [ F95FD4CB7DA00BA2A63CE9F6B5C053E1 ] CNG             C:\Windows\system32\Drivers\cng.sys
14:59:47.0739 0680  CNG - ok
14:59:47.0742 0680  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
14:59:47.0751 0680  Compbatt - ok
14:59:47.0762 0680  [ F26B3A86F6FA87CA360B879581AB4123 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
14:59:47.0786 0680  CompositeBus - ok
14:59:47.0789 0680  COMSysApp - ok
14:59:47.0793 0680  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
14:59:47.0802 0680  crcdisk - ok
14:59:47.0823 0680  [ 8C57411B66282C01533CB776F98AD384 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
14:59:47.0870 0680  CryptSvc - ok
14:59:47.0901 0680  [ 7266972E86890E2B30C0C322E906B027 ] DcomLaunch      C:\Windows\system32\rpcss.dll
14:59:47.0941 0680  DcomLaunch - ok
14:59:47.0970 0680  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll
14:59:48.0021 0680  defragsvc - ok
14:59:48.0025 0680  [ 3F1DC527070ACB87E40AFE46EF6DA749 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
14:59:48.0063 0680  DfsC - ok
14:59:48.0073 0680  DgiVecp - ok
14:59:48.0106 0680  [ 73BDD44A6088916964945886F9025409 ] dg_ssudbus      C:\Windows\system32\DRIVERS\ssudbus.sys
14:59:48.0114 0680  dg_ssudbus - ok
14:59:48.0129 0680  [ CE3B9562D997F69B330D181A8875960F ] Dhcp            C:\Windows\system32\dhcpcore.dll
14:59:48.0175 0680  Dhcp - ok
14:59:48.0183 0680  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
14:59:48.0234 0680  discache - ok
14:59:48.0252 0680  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
14:59:48.0260 0680  Disk - ok
14:59:48.0286 0680  [ 676108C4E3AA6F6B34633748BD0BEBD9 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
14:59:48.0341 0680  Dnscache - ok
14:59:48.0357 0680  [ 14452ACDB09B70964C8C21BF80A13ACB ] dot3svc         C:\Windows\System32\dot3svc.dll
14:59:48.0404 0680  dot3svc - ok
14:59:48.0417 0680  [ 8C2BA6BEA949EE6E68385F5692BAFB94 ] DPS             C:\Windows\system32\dps.dll
14:59:48.0450 0680  DPS - ok
14:59:48.0476 0680  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
14:59:48.0488 0680  drmkaud - ok
14:59:48.0528 0680  [ FB9BEF3401EE5ECC2603311B9C64F44A ] dtsoftbus01     C:\Windows\system32\DRIVERS\dtsoftbus01.sys
14:59:48.0538 0680  dtsoftbus01 - ok
14:59:48.0581 0680  [ EBCE0B0924835F635F620D19F0529DCE ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
14:59:48.0607 0680  DXGKrnl - ok
14:59:48.0654 0680  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll
14:59:48.0717 0680  EapHost - ok
14:59:48.0763 0680  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
14:59:48.0829 0680  ebdrv - ok
14:59:48.0894 0680  [ 94D48989DE698B45077D8B6FB25D2CC7 ] edsvc           C:\Program Files (x86)\Verdiem\Edison\edsvc.exe
14:59:48.0901 0680  edsvc - ok
14:59:48.0924 0680  [ 0793F40B9B8A1BDD266296409DBD91EA ] EFS             C:\Windows\System32\lsass.exe
14:59:48.0944 0680  EFS - ok
14:59:48.0988 0680  [ B91D81B3B54A54CCAFC03733DBC2E29E ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
14:59:49.0032 0680  ehRecvr - ok
14:59:49.0058 0680  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe
14:59:49.0085 0680  ehSched - ok
14:59:49.0105 0680  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
14:59:49.0128 0680  elxstor - ok
14:59:49.0135 0680  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\DRIVERS\errdev.sys
14:59:49.0157 0680  ErrDev - ok
14:59:49.0206 0680  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll
14:59:49.0253 0680  EventSystem - ok
14:59:49.0270 0680  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys
14:59:49.0305 0680  exfat - ok
14:59:49.0339 0680  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys
14:59:49.0376 0680  fastfat - ok
14:59:49.0408 0680  [ D607B2F1BEE3992AA6C2C92C0A2F0855 ] Fax             C:\Windows\system32\fxssvc.exe
14:59:49.0441 0680  Fax - ok
14:59:49.0444 0680  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
14:59:49.0464 0680  fdc - ok
14:59:49.0492 0680  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll
14:59:49.0539 0680  fdPHost - ok
14:59:49.0549 0680  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
14:59:49.0581 0680  FDResPub - ok
14:59:49.0620 0680  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
14:59:49.0629 0680  FileInfo - ok
14:59:49.0638 0680  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
14:59:49.0672 0680  Filetrace - ok
14:59:49.0714 0680  [ ABEDFD48AC042C6AAAD32452E77217A1 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe
14:59:49.0734 0680  FLEXnet Licensing Service - ok
14:59:49.0737 0680  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
14:59:49.0747 0680  flpydisk - ok
14:59:49.0764 0680  [ F7866AF72ABBAF84B1FA5AA195378C59 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
14:59:49.0778 0680  FltMgr - ok
14:59:49.0802 0680  [ 8AC4CB4EA61E41009FAE9AE7B2B5DA3A ] FontCache       C:\Windows\system32\FntCache.dll
14:59:49.0852 0680  FontCache - ok
14:59:49.0910 0680  [ 8D89E3131C27FDD6932189CB785E1B7A ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
14:59:49.0923 0680  FontCache3.0.0.0 - ok
14:59:49.0938 0680  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
14:59:49.0954 0680  FsDepends - ok
14:59:49.0985 0680  [ E95EF8547DE20CF0603557C0CF7A9462 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
14:59:49.0995 0680  Fs_Rec - ok
14:59:50.0009 0680  [ B8B2A6E1558F8F5DE5CE431C5B2C7B09 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
14:59:50.0023 0680  fvevol - ok
14:59:50.0032 0680  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
14:59:50.0041 0680  gagp30kx - ok
14:59:50.0076 0680  [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM     C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
14:59:50.0082 0680  GEARAspiWDM - ok
14:59:50.0102 0680  [ FE5AB4525BC2EC68B9119A6E5D40128B ] gpsvc           C:\Windows\System32\gpsvc.dll
14:59:50.0138 0680  gpsvc - ok
14:59:50.0141 0680  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
14:59:50.0160 0680  hcw85cir - ok
14:59:50.0199 0680  [ 6410F6F415B2A5A9037224C41DA8BF12 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
14:59:50.0236 0680  HdAudAddService - ok
14:59:50.0253 0680  [ 0A49913402747A0B67DE940FB42CBDBB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
14:59:50.0281 0680  HDAudBus - ok
14:59:50.0285 0680  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
14:59:50.0297 0680  HidBatt - ok
14:59:50.0314 0680  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
14:59:50.0342 0680  HidBth - ok
14:59:50.0346 0680  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
14:59:50.0371 0680  HidIr - ok
14:59:50.0382 0680  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll
14:59:50.0418 0680  hidserv - ok
14:59:50.0427 0680  [ B3BF6B5B50006DEF50B66306D99FCF6F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
14:59:50.0448 0680  HidUsb - ok
14:59:50.0475 0680  [ EFA58EDE58DD74388FFD04CB32681518 ] hkmsvc          C:\Windows\system32\kmsvc.dll
14:59:50.0517 0680  hkmsvc - ok
14:59:50.0531 0680  [ 046B2673767CA626E2CFB7FDF735E9E8 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
14:59:50.0559 0680  HomeGroupListener - ok
14:59:50.0580 0680  [ 06A7422224D9865A5613710A089987DF ] HomeGroupProvider C:\Windows\system32\provsvc.dll
14:59:50.0599 0680  HomeGroupProvider - ok
14:59:50.0603 0680  [ 0886D440058F203EBA0E1825E4355914 ] HpSAMD          C:\Windows\system32\DRIVERS\HpSAMD.sys
14:59:50.0612 0680  HpSAMD - ok
14:59:50.0634 0680  [ CEE049CAC4EFA7F4E1E4AD014414A5D4 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
14:59:50.0686 0680  HTTP - ok
14:59:50.0711 0680  [ F17766A19145F111856378DF337A5D79 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
14:59:50.0719 0680  hwpolicy - ok
14:59:50.0723 0680  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
14:59:50.0735 0680  i8042prt - ok
14:59:50.0750 0680  [ D83EFB6FD45DF9D55E9A1AFC63640D50 ] iaStorV         C:\Windows\system32\DRIVERS\iaStorV.sys
14:59:50.0765 0680  iaStorV - ok
14:59:50.0806 0680  [ 1CF03C69B49ACB70C722DF92755C0C8C ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
14:59:50.0814 0680  IDriverT ( UnsignedFile.Multi.Generic ) - warning
14:59:50.0814 0680  IDriverT - detected UnsignedFile.Multi.Generic (1)
14:59:50.0844 0680  [ 2F2BE70D3E02B6FA877921AB9516D43C ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
14:59:50.0886 0680  idsvc - ok
14:59:50.0891 0680  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
14:59:50.0898 0680  iirsp - ok
14:59:50.0924 0680  [ C5B4683680DF085B57BC53E5EF34861F ] IKEEXT          C:\Windows\System32\ikeext.dll
14:59:50.0967 0680  IKEEXT - ok
14:59:50.0971 0680  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\DRIVERS\intelide.sys
14:59:50.0979 0680  intelide - ok
14:59:51.0005 0680  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
14:59:51.0024 0680  intelppm - ok
14:59:51.0040 0680  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
14:59:51.0087 0680  IPBusEnum - ok
14:59:51.0091 0680  [ 722DD294DF62483CECAAE6E094B4D695 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
14:59:51.0125 0680  IpFilterDriver - ok
14:59:51.0154 0680  [ F8E058D17363EC580E4B7232778B6CB5 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
14:59:51.0198 0680  iphlpsvc - ok
14:59:51.0202 0680  [ E2B4A4494DB7CB9B89B55CA268C337C5 ] IPMIDRV         C:\Windows\system32\DRIVERS\IPMIDrv.sys
14:59:51.0216 0680  IPMIDRV - ok
14:59:51.0219 0680  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
14:59:51.0262 0680  IPNAT - ok
14:59:51.0331 0680  [ 33B286326BD2B1A7748C43391058FB19 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
14:59:51.0353 0680  iPod Service - ok
14:59:51.0401 0680  [ 05360B1EA5A2ABF620D1D96EBD8BD8F1 ] irda            C:\Windows\system32\DRIVERS\irda.sys
14:59:51.0433 0680  irda - ok
14:59:51.0460 0680  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
14:59:51.0475 0680  IRENUM - ok
14:59:51.0483 0680  [ 3848384AB383F0A8F506C4370635C1F9 ] Irmon           C:\Windows\System32\irmon.dll
14:59:51.0504 0680  Irmon - ok
14:59:51.0539 0680  [ D2CA12736624BA636F8357DC3EF0757E ] irsir           C:\Windows\system32\DRIVERS\irsir.sys
14:59:51.0561 0680  irsir - ok
14:59:51.0574 0680  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\DRIVERS\isapnp.sys
14:59:51.0583 0680  isapnp - ok
14:59:51.0598 0680  [ FA4D2557DE56D45B0A346F93564BE6E1 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
14:59:51.0611 0680  iScsiPrt - ok
14:59:51.0626 0680  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
14:59:51.0642 0680  kbdclass - ok
14:59:51.0657 0680  [ 6DEF98F8541E1B5DCEB2C822A11F7323 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
14:59:51.0680 0680  kbdhid - ok
14:59:51.0697 0680  [ 0793F40B9B8A1BDD266296409DBD91EA ] KeyIso          C:\Windows\system32\lsass.exe
14:59:51.0709 0680  KeyIso - ok
14:59:51.0716 0680  [ E8B6FCC9C83535C67F835D407620BD27 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
14:59:51.0725 0680  KSecDD - ok
14:59:51.0749 0680  [ A8C63880EF6F4D3FEC7B616B9C060215 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
14:59:51.0759 0680  KSecPkg - ok
14:59:51.0794 0680  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
14:59:51.0861 0680  ksthunk - ok
14:59:51.0881 0680  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll
14:59:51.0929 0680  KtmRm - ok
14:59:51.0950 0680  [ 81F1D04D4D0E433099365127375FD501 ] LanmanServer    C:\Windows\system32\srvsvc.dll
14:59:51.0984 0680  LanmanServer - ok
14:59:52.0009 0680  [ 27026EAC8818E8A6C00A1CAD2F11D29A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
14:59:52.0044 0680  LanmanWorkstation - ok
14:59:52.0124 0680  [ 7772DFAB22611050B79504E671B06E6E ] LBTServ         C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
14:59:52.0148 0680  LBTServ - ok
14:59:52.0188 0680  [ 241F2648ADF090E2A10095BD6D6F5DCB ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys
14:59:52.0201 0680  LHidFilt - ok
14:59:52.0235 0680  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
14:59:52.0285 0680  lltdio - ok
14:59:52.0300 0680  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll
14:59:52.0347 0680  lltdsvc - ok
14:59:52.0369 0680  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll
14:59:52.0400 0680  lmhosts - ok
14:59:52.0417 0680  [ 342ED5A4B3326014438F36D22D803737 ] LMouFilt        C:\Windows\system32\DRIVERS\LMouFilt.Sys
14:59:52.0424 0680  LMouFilt - ok
14:59:52.0441 0680  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
14:59:52.0451 0680  LSI_FC - ok
14:59:52.0455 0680  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
14:59:52.0464 0680  LSI_SAS - ok
14:59:52.0467 0680  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
14:59:52.0475 0680  LSI_SAS2 - ok
14:59:52.0479 0680  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
14:59:52.0488 0680  LSI_SCSI - ok
14:59:52.0492 0680  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys
14:59:52.0531 0680  luafv - ok
14:59:52.0565 0680  [ B8BE35421B9E8DC1AB4B0CB7B9B0328B ] LUsbFilt        C:\Windows\system32\Drivers\LUsbFilt.Sys
14:59:52.0571 0680  LUsbFilt - ok
14:59:52.0590 0680  [ F84C8F1000BC11E3B7B23CBD3BAFF111 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
14:59:52.0600 0680  Mcx2Svc - ok
14:59:52.0604 0680  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
14:59:52.0612 0680  megasas - ok
14:59:52.0621 0680  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
14:59:52.0634 0680  MegaSR - ok
14:59:52.0657 0680  [ 10B012345F08D4D82A8EC41736E3D5BA ] MemeoBackgroundService C:\Program Files (x86)\Memeo\AutoBackup\MemeoBackgroundService.exe
14:59:52.0663 0680  MemeoBackgroundService - ok
14:59:52.0737 0680  [ 1595FECFFBE9EA2417E06D5FD0BFA4C4 ] MEMSWEEP2       C:\Windows\system32\D455.tmp
14:59:52.0744 0680  MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - warning
14:59:52.0744 0680  MEMSWEEP2 - detected UnsignedFile.Multi.Generic (1)
14:59:52.0759 0680  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll
14:59:52.0821 0680  MMCSS - ok
14:59:52.0832 0680  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys
14:59:52.0873 0680  Modem - ok
14:59:52.0898 0680  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
14:59:52.0921 0680  monitor - ok
14:59:52.0936 0680  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
14:59:52.0945 0680  mouclass - ok
14:59:52.0956 0680  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
14:59:52.0966 0680  mouhid - ok
14:59:52.0969 0680  [ 791AF66C4D0E7C90A3646066386FB571 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
14:59:52.0978 0680  mountmgr - ok
14:59:53.0050 0680  [ AEE4E9CC59CDEB55B1ECB0E596E796BE ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
14:59:53.0069 0680  MozillaMaintenance - ok
14:59:53.0076 0680  [ 609D1D87649ECC19796F4D76D4C15CEA ] mpio            C:\Windows\system32\DRIVERS\mpio.sys
14:59:53.0089 0680  mpio - ok
14:59:53.0110 0680  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
14:59:53.0143 0680  mpsdrv - ok
14:59:53.0166 0680  [ AECAB449567D1846DAD63ECE49E893E3 ] MpsSvc          C:\Windows\system32\mpssvc.dll
14:59:53.0217 0680  MpsSvc - ok
14:59:53.0220 0680  [ 30524261BB51D96D6FCBAC20C810183C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
14:59:53.0248 0680  MRxDAV - ok
14:59:53.0266 0680  [ 767A4C3BCF9410C286CED15A2DB17108 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
14:59:53.0305 0680  mrxsmb - ok
14:59:53.0322 0680  [ 920EE0FF995FCFDEB08C41605A959E1C ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
14:59:53.0339 0680  mrxsmb10 - ok
14:59:53.0343 0680  [ 740D7EA9D72C981510A5292CF6ADC941 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
14:59:53.0355 0680  mrxsmb20 - ok
14:59:53.0359 0680  [ 5C37497276E3B3A5488B23A326A754B7 ] msahci          C:\Windows\system32\DRIVERS\msahci.sys
14:59:53.0372 0680  msahci - ok
14:59:53.0385 0680  [ 8D27B597229AED79430FB9DB3BCBFBD0 ] msdsm           C:\Windows\system32\DRIVERS\msdsm.sys
14:59:53.0394 0680  msdsm - ok
14:59:53.0411 0680  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe
14:59:53.0423 0680  MSDTC - ok
14:59:53.0460 0680  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
14:59:53.0490 0680  Msfs - ok
14:59:53.0500 0680  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
14:59:53.0542 0680  mshidkmdf - ok
14:59:53.0556 0680  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\DRIVERS\msisadrv.sys
14:59:53.0563 0680  msisadrv - ok
14:59:53.0584 0680  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
14:59:53.0621 0680  MSiSCSI - ok
14:59:53.0624 0680  msiserver - ok
14:59:53.0634 0680  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
14:59:53.0675 0680  MSKSSRV - ok
14:59:53.0685 0680  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
14:59:53.0716 0680  MSPCLOCK - ok
14:59:53.0731 0680  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
14:59:53.0771 0680  MSPQM - ok
14:59:53.0789 0680  [ 89CB141AA8616D8C6A4610FA26C60964 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
14:59:53.0801 0680  MsRPC - ok
14:59:53.0835 0680  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
14:59:53.0843 0680  mssmbios - ok
14:59:53.0854 0680  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
14:59:53.0891 0680  MSTEE - ok
14:59:53.0894 0680  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
14:59:53.0914 0680  MTConfig - ok
14:59:53.0946 0680  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys
14:59:53.0955 0680  Mup - ok
14:59:53.0981 0680  [ 4987E079A4530FA737A128BE54B63B12 ] napagent        C:\Windows\system32\qagentRT.dll
14:59:54.0023 0680  napagent - ok
14:59:54.0045 0680  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
14:59:54.0076 0680  NativeWifiP - ok
14:59:54.0100 0680  [ CAD515DBD07D082BB317D9928CE8962C ] NDIS            C:\Windows\system32\drivers\ndis.sys
14:59:54.0126 0680  NDIS - ok
14:59:54.0129 0680  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
14:59:54.0160 0680  NdisCap - ok
14:59:54.0183 0680  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
14:59:54.0215 0680  NdisTapi - ok
14:59:54.0243 0680  [ F105BA1E22BF1F2EE8F005D4305E4BEC ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
14:59:54.0287 0680  Ndisuio - ok
14:59:54.0302 0680  [ 557DFAB9CA1FCB036AC77564C010DAD3 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
14:59:54.0336 0680  NdisWan - ok
14:59:54.0346 0680  [ 659B74FB74B86228D6338D643CD3E3CF ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
14:59:54.0378 0680  NDProxy - ok
14:59:54.0417 0680  [ EE00C544C025958AF50C7B199F3C8595 ] Netaapl         C:\Windows\system32\DRIVERS\netaapl64.sys
14:59:54.0438 0680  Netaapl - ok
14:59:54.0471 0680  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
14:59:54.0508 0680  NetBIOS - ok
14:59:54.0543 0680  [ 9162B273A44AB9DCE5B44362731D062A ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
14:59:54.0590 0680  NetBT - ok
14:59:54.0603 0680  [ 0793F40B9B8A1BDD266296409DBD91EA ] Netlogon        C:\Windows\system32\lsass.exe
14:59:54.0614 0680  Netlogon - ok
14:59:54.0643 0680  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
14:59:54.0687 0680  Netman - ok
14:59:54.0724 0680  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:59:54.0755 0680  NetMsmqActivator - ok
14:59:54.0760 0680  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:59:54.0768 0680  NetPipeActivator - ok
14:59:54.0809 0680  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
14:59:54.0857 0680  netprofm - ok
14:59:54.0861 0680  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:59:54.0868 0680  NetTcpActivator - ok
14:59:54.0871 0680  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
14:59:54.0879 0680  NetTcpPortSharing - ok
14:59:54.0893 0680  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
14:59:54.0901 0680  nfrd960 - ok
14:59:54.0919 0680  [ D9A0CE66046D6EFA0C61BAA885CBA0A8 ] NlaSvc          C:\Windows\System32\nlasvc.dll
14:59:54.0965 0680  NlaSvc - ok
14:59:54.0979 0680  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
14:59:55.0010 0680  Npfs - ok
14:59:55.0027 0680  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll
14:59:55.0058 0680  nsi - ok
14:59:55.0100 0680  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
14:59:55.0154 0680  nsiproxy - ok
14:59:55.0187 0680  [ 356698A13C4630D5B31C37378D469196 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
14:59:55.0224 0680  Ntfs - ok
14:59:55.0236 0680  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
14:59:55.0277 0680  Null - ok
14:59:55.0300 0680  [ E20ABD5B229760158F753CA90B97E090 ] NVHDA           C:\Windows\system32\drivers\nvhda64v.sys
14:59:55.0307 0680  NVHDA - ok
14:59:55.0502 0680  [ E39A912C643665672C5CE335F9C9BF2A ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
14:59:55.0750 0680  nvlddmkm - ok
14:59:55.0765 0680  [ 3E38712941E9BB4DDBEE00AFFE3FED3D ] nvraid          C:\Windows\system32\DRIVERS\nvraid.sys
14:59:55.0775 0680  nvraid - ok
14:59:55.0779 0680  [ 477DC4D6DEB99BE37084C9AC6D013DA1 ] nvstor          C:\Windows\system32\DRIVERS\nvstor.sys
14:59:55.0789 0680  nvstor - ok
14:59:55.0821 0680  [ 388718AF1B0809C90EF0CF57B567B18E ] nvsvc           C:\Windows\system32\nvvsvc.exe
14:59:55.0828 0680  nvsvc - ok
14:59:55.0832 0680  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\DRIVERS\nv_agp.sys
14:59:55.0840 0680  nv_agp - ok
14:59:55.0914 0680  [ 84DE1DD996B48B05ACE31AD015FA108A ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
14:59:55.0938 0680  odserv - ok
14:59:55.0964 0680  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
14:59:55.0992 0680  ohci1394 - ok
14:59:56.0019 0680  [ 5A432A042DAE460ABE7199B758E8606C ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
14:59:56.0029 0680  ose - ok
14:59:56.0056 0680  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
14:59:56.0095 0680  p2pimsvc - ok
14:59:56.0120 0680  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
14:59:56.0141 0680  p2psvc - ok
14:59:56.0154 0680  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
14:59:56.0165 0680  Parport - ok
14:59:56.0175 0680  [ 7DAA117143316C4A1537E074A5A9EAF0 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
14:59:56.0182 0680  partmgr - ok
14:59:56.0193 0680  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
14:59:56.0219 0680  PcaSvc - ok
14:59:56.0235 0680  [ F36F6504009F2FB0DFD1B17A116AD74B ] pci             C:\Windows\system32\DRIVERS\pci.sys
14:59:56.0246 0680  pci - ok
14:59:56.0258 0680  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\DRIVERS\pciide.sys
14:59:56.0265 0680  pciide - ok
14:59:56.0275 0680  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
14:59:56.0287 0680  pcmcia - ok
14:59:56.0298 0680  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys
14:59:56.0305 0680  pcw - ok
14:59:56.0322 0680  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
14:59:56.0379 0680  PEAUTH - ok
14:59:56.0427 0680  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
14:59:56.0452 0680  PerfHost - ok
14:59:56.0492 0680  [ 557E9A86F65F0DE18C9B6751DFE9D3F1 ] pla             C:\Windows\system32\pla.dll
14:59:56.0556 0680  pla - ok
14:59:56.0581 0680  [ 23157D583244400E1D7FBAEE2E4B31B7 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
14:59:56.0619 0680  PlugPlay - ok
14:59:56.0638 0680  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
14:59:56.0649 0680  PNRPAutoReg - ok
14:59:56.0655 0680  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
14:59:56.0668 0680  PNRPsvc - ok
14:59:56.0693 0680  [ 166EB40D1F5B47E615DE3D0FFFE5F243 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
14:59:56.0739 0680  PolicyAgent - ok
14:59:56.0756 0680  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll
14:59:56.0803 0680  Power - ok
14:59:56.0824 0680  [ 27CC19E81BA5E3403C48302127BDA717 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
14:59:56.0856 0680  PptpMiniport - ok
14:59:56.0859 0680  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\DRIVERS\processr.sys
14:59:56.0878 0680  Processor - ok
14:59:56.0896 0680  [ F381975E1F4346DE875CB07339CE8D3A ] ProfSvc         C:\Windows\system32\profsvc.dll
14:59:56.0930 0680  ProfSvc - ok
14:59:56.0938 0680  [ 0793F40B9B8A1BDD266296409DBD91EA ] ProtectedStorage C:\Windows\system32\lsass.exe
14:59:56.0948 0680  ProtectedStorage - ok
14:59:56.0957 0680  [ EE992183BD8EAEFD9973F352E587A299 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
14:59:56.0989 0680  Psched - ok
14:59:57.0029 0680  [ 87B04878A6D59D6C79251DC960C674C1 ] PxHlpa64        C:\Windows\system32\Drivers\PxHlpa64.sys
14:59:57.0034 0680  PxHlpa64 - ok
14:59:57.0061 0680  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
14:59:57.0097 0680  ql2300 - ok
14:59:57.0101 0680  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
14:59:57.0110 0680  ql40xx - ok
14:59:57.0121 0680  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll
14:59:57.0137 0680  QWAVE - ok
14:59:57.0145 0680  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
14:59:57.0171 0680  QWAVEdrv - ok
14:59:57.0180 0680  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
14:59:57.0217 0680  RasAcd - ok
14:59:57.0258 0680  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
14:59:57.0306 0680  RasAgileVpn - ok
14:59:57.0310 0680  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll
14:59:57.0343 0680  RasAuto - ok
14:59:57.0373 0680  [ 87A6E852A22991580D6D39ADC4790463 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
14:59:57.0407 0680  Rasl2tp - ok
14:59:57.0419 0680  [ 47394ED3D16D053F5906EFE5AB51CC83 ] RasMan          C:\Windows\System32\rasmans.dll
14:59:57.0454 0680  RasMan - ok
14:59:57.0461 0680  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
14:59:57.0505 0680  RasPppoe - ok
14:59:57.0519 0680  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
14:59:57.0564 0680  RasSstp - ok
14:59:57.0583 0680  [ 3BAC8142102C15D59A87757C1D41DCE5 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
14:59:57.0620 0680  rdbss - ok
14:59:57.0623 0680  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
14:59:57.0635 0680  rdpbus - ok
14:59:57.0643 0680  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
14:59:57.0674 0680  RDPCDD - ok
14:59:57.0685 0680  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
14:59:57.0727 0680  RDPENCDD - ok
14:59:57.0745 0680  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
14:59:57.0775 0680  RDPREFMP - ok
14:59:57.0794 0680  [ 8A3E6BEA1C53EA6177FE2B6EBA2C80D7 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
14:59:57.0841 0680  RDPWD - ok
14:59:57.0877 0680  [ 634B9A2181D98F15941236886164EC8B ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
14:59:57.0889 0680  rdyboost - ok
14:59:57.0908 0680  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
14:59:57.0950 0680  RemoteAccess - ok
14:59:57.0963 0680  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
14:59:57.0996 0680  RemoteRegistry - ok
14:59:58.0030 0680  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
14:59:58.0065 0680  RFCOMM - ok
14:59:58.0078 0680  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
14:59:58.0115 0680  RpcEptMapper - ok
14:59:58.0126 0680  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
14:59:58.0136 0680  RpcLocator - ok
14:59:58.0150 0680  [ 7266972E86890E2B30C0C322E906B027 ] RpcSs           C:\Windows\system32\rpcss.dll
14:59:58.0187 0680  RpcSs - ok
14:59:58.0190 0680  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
14:59:58.0234 0680  rspndr - ok
14:59:58.0306 0680  [ BAEFEE35D27A5440D35092CE10267BEC ] RTL8167         C:\Windows\system32\DRIVERS\Rt64win7.sys
14:59:58.0334 0680  RTL8167 - ok
14:59:58.0374 0680  [ D4AF0298E0031AEED81B241FF56E95D1 ] RTL8187         C:\Windows\system32\DRIVERS\wg111v2.sys
14:59:58.0417 0680  RTL8187 - ok
14:59:58.0445 0680  [ 0793F40B9B8A1BDD266296409DBD91EA ] SamSs           C:\Windows\system32\lsass.exe
14:59:58.0463 0680  SamSs - ok
14:59:58.0487 0680  [ D641337B75B9A9D5AE10687AA1097755 ] Samsung UPD Service C:\Windows\System32\SUPDSvc.exe
14:59:58.0500 0680  Samsung UPD Service - ok
14:59:58.0524 0680  [ E3BBB89983DAF5622C1D50CF49F28227 ] sbp2port        C:\Windows\system32\DRIVERS\sbp2port.sys
14:59:58.0538 0680  sbp2port - ok
14:59:58.0592 0680  [ 794D4B48DFB6E999537C7C3947863463 ] SBSDWSCService  C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
14:59:58.0625 0680  SBSDWSCService - ok
14:59:58.0641 0680  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
14:59:58.0675 0680  SCardSvr - ok
14:59:58.0684 0680  [ C94DA20C7E3BA1DCA269BC8460D98387 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
14:59:58.0727 0680  scfilter - ok
14:59:58.0754 0680  [ 624D0F5FF99428BB90A5B8A4123E918E ] Schedule        C:\Windows\system32\schedsvc.dll
14:59:58.0806 0680  Schedule - ok
14:59:58.0827 0680  [ 6011CDF54BB6F4C69F38FACCDAD73D7E ] SCMNdisP        C:\Windows\system32\DRIVERS\scmndisp.sys
14:59:58.0833 0680  SCMNdisP - ok
14:59:58.0859 0680  [ E2858D45D57E13EB142CCA3B83FB39B3 ] SCM_Service     C:\Windows\SysWOW64\WinService.exe
14:59:58.0869 0680  SCM_Service - ok
14:59:58.0895 0680  [ 312E2F82AF11E79906898AC3E3D58A1F ] SCPolicySvc     C:\Windows\System32\certprop.dll
14:59:58.0934 0680  SCPolicySvc - ok
14:59:58.0946 0680  [ 765A27C3279CE11D14CB9E4F5869FCA5 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
14:59:58.0977 0680  SDRSVC - ok
14:59:59.0003 0680  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
14:59:59.0046 0680  secdrv - ok
14:59:59.0056 0680  [ 463B386EBC70F98DA5DFF85F7E654346 ] seclogon        C:\Windows\system32\seclogon.dll
14:59:59.0096 0680  seclogon - ok
14:59:59.0112 0680  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
14:59:59.0158 0680  SENS - ok
14:59:59.0163 0680  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
14:59:59.0189 0680  SensrSvc - ok
14:59:59.0193 0680  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
14:59:59.0202 0680  Serenum - ok
14:59:59.0218 0680  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
14:59:59.0241 0680  Serial - ok
14:59:59.0244 0680  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
14:59:59.0255 0680  sermouse - ok
14:59:59.0275 0680  [ C3BC61CE47FF6F4E88AB8A3B429A36AF ] SessionEnv      C:\Windows\system32\sessenv.dll
14:59:59.0314 0680  SessionEnv - ok
14:59:59.0317 0680  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\DRIVERS\sffdisk.sys
14:59:59.0333 0680  sffdisk - ok
14:59:59.0336 0680  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\DRIVERS\sffp_mmc.sys
14:59:59.0353 0680  sffp_mmc - ok
14:59:59.0356 0680  [ 5588B8C6193EB1522490C122EB94DFFA ] sffp_sd         C:\Windows\system32\DRIVERS\sffp_sd.sys
14:59:59.0369 0680  sffp_sd - ok
14:59:59.0372 0680  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
14:59:59.0385 0680  sfloppy - ok
14:59:59.0425 0680  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
14:59:59.0462 0680  SharedAccess - ok
14:59:59.0504 0680  [ 0298AC45D0EFFFB2DB4BAA7DD186E7BF ] ShellHWDetection C:\Windows\System32\shsvcs.dll
14:59:59.0545 0680  ShellHWDetection - ok
14:59:59.0548 0680  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
14:59:59.0557 0680  SiSRaid2 - ok
14:59:59.0561 0680  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
14:59:59.0570 0680  SiSRaid4 - ok
14:59:59.0573 0680  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
14:59:59.0609 0680  Smb - ok
14:59:59.0626 0680  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
14:59:59.0636 0680  SNMPTRAP - ok
14:59:59.0664 0680  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys
14:59:59.0671 0680  spldr - ok
14:59:59.0694 0680  [ F8E1FA03CB70D54A9892AC88B91D1E7B ] Spooler         C:\Windows\System32\spoolsv.exe
14:59:59.0734 0680  Spooler - ok
14:59:59.0799 0680  [ 913D843498553A1BC8F8DBAD6358E49F ] sppsvc          C:\Windows\system32\sppsvc.exe
14:59:59.0849 0680  sppsvc - ok
14:59:59.0862 0680  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
14:59:59.0895 0680  sppuinotify - ok
14:59:59.0917 0680  [ DE6F5658DA951C4BC8E498570B5B0D5F ] srv             C:\Windows\system32\DRIVERS\srv.sys
14:59:59.0943 0680  srv - ok
14:59:59.0950 0680  [ 4D33D59C0B930C523D29F9BD40CDA9D2 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
14:59:59.0966 0680  srv2 - ok
14:59:59.0970 0680  [ 5A663FD67049267BC5C3F3279E631FFB ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
14:59:59.0988 0680  srvnet - ok
15:00:00.0038 0680  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
15:00:00.0092 0680  SSDPSRV - ok
15:00:00.0137 0680  [ 0211AB46B73A2623B86C1CFCB30579AB ] SSPORT          C:\Windows\system32\Drivers\SSPORT.sys
15:00:00.0145 0680  SSPORT - ok
15:00:00.0162 0680  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll
15:00:00.0209 0680  SstpSvc - ok
15:00:00.0248 0680  [ 5252D7BC56E5E0ED715AEA8FE173A455 ] ssudmdm         C:\Windows\system32\DRIVERS\ssudmdm.sys
15:00:00.0259 0680  ssudmdm - ok
15:00:00.0338 0680  [ A87A39F9B42D82F5D60D36BB1D3CC9D3 ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
15:00:00.0367 0680  Steam Client Service - ok
15:00:00.0431 0680  [ C61452E8FE9C8FF8877464960D2991C3 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
15:00:00.0448 0680  Stereo Service - ok
15:00:00.0464 0680  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
15:00:00.0471 0680  stexstor - ok
15:00:00.0496 0680  [ 52D0E33B681BD0F33FDC08812FEE4F7D ] stisvc          C:\Windows\System32\wiaservc.dll
15:00:00.0521 0680  stisvc - ok
15:00:00.0536 0680  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
15:00:00.0545 0680  swenum - ok
15:00:00.0571 0680  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll
15:00:00.0611 0680  swprv - ok
15:00:00.0637 0680  [ 3C1284516A62078FB68F768DE4F1A7BE ] SysMain         C:\Windows\system32\sysmain.dll
15:00:00.0690 0680  SysMain - ok
15:00:00.0713 0680  [ 238935C3CF2854886DC7CBB2A0E2CC66 ] TabletInputService C:\Windows\System32\TabSvc.dll
15:00:00.0742 0680  TabletInputService - ok
15:00:00.0756 0680  [ 884264AC597B690C5707C89723BB8E7B ] TapiSrv         C:\Windows\System32\tapisrv.dll
15:00:00.0804 0680  TapiSrv - ok
15:00:00.0817 0680  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll
15:00:00.0850 0680  TBS - ok
15:00:00.0909 0680  [ 90A2D722CF64D911879D6C4A4F802A4D ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
15:00:00.0951 0680  Tcpip - ok
15:00:00.0970 0680  [ 90A2D722CF64D911879D6C4A4F802A4D ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
15:00:01.0002 0680  TCPIP6 - ok
15:00:01.0037 0680  [ 76D078AF6F587B162D50210F761EB9ED ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
15:00:01.0069 0680  tcpipreg - ok
15:00:01.0073 0680  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
15:00:01.0119 0680  TDPIPE - ok
15:00:01.0122 0680  [ E4245BDA3190A582D55ED09E137401A9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
15:00:01.0153 0680  TDTCP - ok
15:00:01.0175 0680  [ 079125C4B17B01FCAEEBCE0BCB290C0F ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
15:00:01.0217 0680  tdx - ok
15:00:01.0233 0680  [ C448651339196C0E869A355171875522 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
15:00:01.0241 0680  TermDD - ok
15:00:01.0263 0680  [ 0F05EC2887BFE197AD82A13287D2F404 ] TermService     C:\Windows\System32\termsrv.dll
15:00:01.0309 0680  TermService - ok
15:00:01.0335 0680  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
15:00:01.0359 0680  Themes - ok
15:00:01.0378 0680  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll
15:00:01.0409 0680  THREADORDER - ok
15:00:01.0424 0680  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
15:00:01.0466 0680  TrkWks - ok
15:00:01.0506 0680  [ 840F7FB849F5887A49BA18C13B2DA920 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
15:00:01.0519 0680  TrustedInstaller - ok
15:00:01.0531 0680  [ 61B96C26131E37B24E93327A0BD1FB95 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
15:00:01.0572 0680  tssecsrv - ok
15:00:01.0588 0680  [ 3836171A2CDF3AF8EF10856DB9835A70 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
15:00:01.0632 0680  tunnel - ok
15:00:01.0634 0680  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
15:00:01.0642 0680  uagp35 - ok
15:00:01.0657 0680  [ D47BAEAD86C65D4F4069D7CE0A4EDCEB ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
15:00:01.0692 0680  udfs - ok
15:00:01.0706 0680  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
15:00:01.0727 0680  UI0Detect - ok
15:00:01.0739 0680  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\DRIVERS\uliagpkx.sys
15:00:01.0748 0680  uliagpkx - ok
15:00:01.0785 0680  [ EAB6C35E62B1B0DB0D1B48B671D3A117 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
15:00:01.0812 0680  umbus - ok
15:00:01.0827 0680  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
15:00:01.0838 0680  UmPass - ok
15:00:01.0879 0680  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
15:00:01.0931 0680  upnphost - ok
15:00:01.0947 0680  [ C9E9D59C0099A9FF51697E9306A44240 ] USBAAPL64       C:\Windows\system32\Drivers\usbaapl64.sys
15:00:01.0963 0680  USBAAPL64 - ok
15:00:01.0976 0680  [ B26AFB54A534D634523C4FB66765B026 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
15:00:01.0996 0680  usbccgp - ok
15:00:02.0000 0680  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\DRIVERS\usbcir.sys
15:00:02.0019 0680  usbcir - ok
15:00:02.0029 0680  [ 2EA4AFF7BE7EB4632E3AA8595B0803B5 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
15:00:02.0044 0680  usbehci - ok
15:00:02.0060 0680  [ 4C9042B8DF86C1E8E6240C218B99B39B ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
15:00:02.0090 0680  usbhub - ok
15:00:02.0093 0680  [ 58E546BBAF87664FC57E0F6081E4F609 ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys
15:00:02.0105 0680  usbohci - ok
15:00:02.0119 0680  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
15:00:02.0139 0680  usbprint - ok
15:00:02.0163 0680  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan         C:\Windows\system32\DRIVERS\usbscan.sys
15:00:02.0176 0680  usbscan - ok
15:00:02.0190 0680  [ 080D3820DA6C046BE82FC8B45A893E83 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
15:00:02.0204 0680  USBSTOR - ok
15:00:02.0207 0680  [ 81FB2216D3A60D1284455D511797DB3D ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys
15:00:02.0217 0680  usbuhci - ok
15:00:02.0227 0680  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll
15:00:02.0259 0680  UxSms - ok
15:00:02.0270 0680  [ 0793F40B9B8A1BDD266296409DBD91EA ] VaultSvc        C:\Windows\system32\lsass.exe
15:00:02.0281 0680  VaultSvc - ok
15:00:02.0286 0680  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\DRIVERS\vdrvroot.sys
15:00:02.0293 0680  vdrvroot - ok
15:00:02.0308 0680  [ 44D73E0BBC1D3C8981304BA15135C2F2 ] vds             C:\Windows\System32\vds.exe
15:00:02.0327 0680  vds - ok
15:00:02.0330 0680  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
15:00:02.0342 0680  vga - ok
15:00:02.0367 0680  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys
15:00:02.0409 0680  VgaSave - ok
15:00:02.0413 0680  [ C82E748660F62A242B2DFAC1442F22A4 ] vhdmp           C:\Windows\system32\DRIVERS\vhdmp.sys
15:00:02.0424 0680  vhdmp - ok
15:00:02.0430 0680  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\DRIVERS\viaide.sys
15:00:02.0438 0680  viaide - ok
15:00:02.0455 0680  [ 2B1A3DAE2B4E70DBBA822B7A03FBD4A3 ] volmgr          C:\Windows\system32\DRIVERS\volmgr.sys
15:00:02.0463 0680  volmgr - ok
15:00:02.0484 0680  [ 99B0CBB569CA79ACAED8C91461D765FB ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
15:00:02.0497 0680  volmgrx - ok
15:00:02.0503 0680  [ 58F82EED8CA24B461441F9C3E4F0BF5C ] volsnap         C:\Windows\system32\DRIVERS\volsnap.sys
15:00:02.0514 0680  volsnap - ok
15:00:02.0587 0680  [ 86C96C079293E2E06708E146A011F4C4 ] vpnagent        C:\Program Files (x86)\Cisco\Cisco AnyConnect Secure Mobility Client\vpnagent.exe
15:00:02.0614 0680  vpnagent - ok
15:00:02.0670 0680  [ 5932B2999AEF21C4599A792599F28D89 ] vpnva           C:\Windows\system32\DRIVERS\vpnva64-6.sys
15:00:02.0677 0680  vpnva - ok
15:00:02.0681 0680  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
15:00:02.0694 0680  vsmraid - ok
15:00:02.0721 0680  [ 787898BF9FB6D7BD87A36E2D95C899BA ] VSS             C:\Windows\system32\vssvc.exe
15:00:02.0765 0680  VSS - ok
15:00:02.0799 0680  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
15:00:02.0814 0680  vwifibus - ok
15:00:02.0846 0680  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
15:00:02.0870 0680  vwififlt - ok
15:00:02.0885 0680  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
15:00:02.0900 0680  vwifimp - ok
15:00:02.0923 0680  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll
15:00:02.0959 0680  W32Time - ok
15:00:02.0963 0680  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
15:00:02.0979 0680  WacomPen - ok
15:00:02.0982 0680  [ 47CA49400643EFFD3F1C9A27E1D69324 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
15:00:03.0021 0680  WANARP - ok
15:00:03.0034 0680  [ 47CA49400643EFFD3F1C9A27E1D69324 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
15:00:03.0065 0680  Wanarpv6 - ok
15:00:03.0097 0680  [ 5AB1BB85BD8B5089CC5D64200DEDAE68 ] wbengine        C:\Windows\system32\wbengine.exe
15:00:03.0142 0680  wbengine - ok
15:00:03.0153 0680  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
15:00:03.0173 0680  WbioSrvc - ok
15:00:03.0193 0680  [ 8321C2CA3B62B61B293CDA3451984468 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
15:00:03.0217 0680  wcncsvc - ok
15:00:03.0231 0680  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
15:00:03.0250 0680  WcsPlugInService - ok
15:00:03.0253 0680  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
15:00:03.0259 0680  Wd - ok
15:00:03.0279 0680  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
15:00:03.0298 0680  Wdf01000 - ok
15:00:03.0305 0680  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
15:00:03.0332 0680  WdiServiceHost - ok
15:00:03.0335 0680  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll
15:00:03.0350 0680  WdiSystemHost - ok
15:00:03.0364 0680  [ 8A438CBB8C032A0C798B0C642FFBE572 ] WebClient       C:\Windows\System32\webclnt.dll
15:00:03.0387 0680  WebClient - ok
15:00:03.0405 0680  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
15:00:03.0450 0680  Wecsvc - ok
15:00:03.0463 0680  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
15:00:03.0506 0680  wercplsupport - ok
15:00:03.0521 0680  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
15:00:03.0553 0680  WerSvc - ok
15:00:03.0585 0680  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
15:00:03.0615 0680  WfpLwf - ok
15:00:03.0625 0680  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
15:00:03.0632 0680  WIMMount - ok
15:00:03.0686 0680  WinDefend - ok
15:00:03.0744 0680  [ EC9FFCD405C576F27B2385E3C580D3FF ] Windows7FirewallService C:\Program Files (x86)\Windows7FirewallControl\Windows7FirewallService.exe
15:00:03.0766 0680  Windows7FirewallService ( UnsignedFile.Multi.Generic ) - warning
15:00:03.0767 0680  Windows7FirewallService - detected UnsignedFile.Multi.Generic (1)
15:00:03.0769 0680  WinHttpAutoProxySvc - ok
15:00:03.0811 0680  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
15:00:03.0850 0680  Winmgmt - ok
15:00:03.0900 0680  [ 41FBB751936B387F9179E7F03A74FE29 ] WinRM           C:\Windows\system32\WsmSvc.dll
15:00:03.0967 0680  WinRM - ok
15:00:04.0010 0680  [ 817EAFF5D38674EDD7713B9DFB8E9791 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
15:00:04.0035 0680  WinUsb - ok
15:00:04.0064 0680  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll
15:00:04.0097 0680  Wlansvc - ok
15:00:04.0100 0680  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
15:00:04.0109 0680  WmiAcpi - ok
15:00:04.0128 0680  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
15:00:04.0152 0680  wmiApSrv - ok
15:00:04.0182 0680  WMPNetworkSvc - ok
15:00:04.0195 0680  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
15:00:04.0227 0680  WPCSvc - ok
15:00:04.0242 0680  [ 2E57DDF2880A7E52E76F41C7E96D327B ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
15:00:04.0278 0680  WPDBusEnum - ok
15:00:04.0293 0680  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
15:00:04.0332 0680  ws2ifsl - ok
15:00:04.0358 0680  [ E8B1FE6669397D1772D8196DF0E57A9E ] WscSvc          C:\Windows\System32\wscsvc.dll
15:00:04.0375 0680  WscSvc - ok
15:00:04.0379 0680  WSearch - ok
15:00:04.0418 0680  [ 38340204A2D0228F1E87740FC5E554A7 ] wuauserv        C:\Windows\system32\wuaueng.dll
15:00:04.0484 0680  wuauserv - ok
15:00:04.0497 0680  [ 7CADC74271DD6461C452C271B30BD378 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
15:00:04.0529 0680  WudfPf - ok
15:00:04.0565 0680  [ 3B197AF0FFF08AA66B6B2241CA538D64 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
15:00:04.0607 0680  WUDFRd - ok
15:00:04.0618 0680  [ B551D6637AA0E132C18AC6E504F7B79B ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
15:00:04.0659 0680  wudfsvc - ok
15:00:04.0672 0680  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc         C:\Windows\System32\wwansvc.dll
15:00:04.0702 0680  WwanSvc - ok
15:00:04.0746 0680  [ 2C6BC21B2D5B58D8B1D638C1704CB494 ] xusb21          C:\Windows\system32\DRIVERS\xusb21.sys
15:00:04.0753 0680  xusb21 - ok
15:00:04.0794 0680  ================ Scan global ===============================
15:00:04.0826 0680  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
15:00:04.0852 0680  [ 457B44AB6D502E55F64A867D4F35C76C ] C:\Windows\system32\winsrv.dll
15:00:04.0859 0680  [ 457B44AB6D502E55F64A867D4F35C76C ] C:\Windows\system32\winsrv.dll
15:00:04.0877 0680  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
15:00:04.0901 0680  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
15:00:04.0905 0680  [Global] - ok
15:00:04.0906 0680  ================ Scan MBR ==================================
15:00:04.0912 0680  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
15:00:05.0240 0680  \Device\Harddisk0\DR0 - ok
15:00:05.0245 0680  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
15:00:05.0409 0680  \Device\Harddisk1\DR1 - ok
15:00:05.0413 0680  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk2\DR2
15:00:06.0000 0680  \Device\Harddisk2\DR2 - ok
15:00:06.0004 0680  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk3\DR3
15:00:06.0102 0680  \Device\Harddisk3\DR3 - ok
15:00:06.0102 0680  ================ Scan VBR ==================================
15:00:06.0106 0680  [ F1529AED75A68CBF0AE3078753DADF13 ] \Device\Harddisk0\DR0\Partition1
15:00:06.0108 0680  \Device\Harddisk0\DR0\Partition1 - ok
15:00:06.0126 0680  [ 5419A086FA5FAD35A4B734C0E778AAB9 ] \Device\Harddisk0\DR0\Partition2
15:00:06.0128 0680  \Device\Harddisk0\DR0\Partition2 - ok
15:00:06.0148 0680  [ 9475D34069B4C2419CBA4D130BEA18A9 ] \Device\Harddisk0\DR0\Partition3
15:00:06.0150 0680  \Device\Harddisk0\DR0\Partition3 - ok
15:00:06.0153 0680  [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk1\DR1\Partition1
15:00:06.0154 0680  \Device\Harddisk1\DR1\Partition1 - ok
15:00:06.0156 0680  [ DB0005747F6263699B4DF8FD2A3BBAB9 ] \Device\Harddisk1\DR1\Partition2
15:00:06.0159 0680  \Device\Harddisk1\DR1\Partition2 - ok
15:00:06.0162 0680  [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk2\DR2\Partition1
15:00:06.0163 0680  \Device\Harddisk2\DR2\Partition1 - ok
15:00:06.0165 0680  [ 95B1F9928957E869A9A2F3E9A281431A ] \Device\Harddisk2\DR2\Partition2
15:00:06.0168 0680  \Device\Harddisk2\DR2\Partition2 - ok
15:00:06.0171 0680  [ 6B73D1A99F29A9FB910435C10E2D21C7 ] \Device\Harddisk3\DR3\Partition1
15:00:06.0174 0680  \Device\Harddisk3\DR3\Partition1 - ok
15:00:06.0174 0680  ============================================================
15:00:06.0174 0680  Scan finished
15:00:06.0174 0680  ============================================================
15:00:06.0182 4600  Detected object count: 3
15:00:06.0182 4600  Actual detected object count: 3
15:01:18.0538 4600  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
15:01:18.0538 4600  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:01:18.0539 4600  MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - skipped by user
15:01:18.0539 4600  MEMSWEEP2 ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:01:18.0541 4600  Windows7FirewallService ( UnsignedFile.Multi.Generic ) - skipped by user
15:01:18.0541 4600  Windows7FirewallService ( UnsignedFile.Multi.Generic ) - User select action: Skip 
15:01:34.0273 4584  Deinitialize success

Scannen die Programme alle vorhanden Festplatten?
Ich habe eine interne Festplatte, die auf 2 Partitionen aufgeteilt ist. Dazu kommen 3 externe Laufwerke in einer IcyBox

Die Funde die Sophos anzeigt befinden sich alle auf den externen Festplatten. Zwei davon beinhalten ausschließlich Multimediainhalte für den Gebrauch als HTPC und eben solche Datein werden als HiddenFiles angezeigt und sich auch im System für mich "nicht mehr erreichbar".

Viele Grüße und nochmals herzlichen Dank.

schrauber · 07.04.2014, 12:40

Zitat:

Die Funde die Sophos anzeigt befinden sich alle auf den externen Festplatten. Zwei davon beinhalten ausschließlich Multimediainhalte für den Gebrauch als HTPC und eben solche Datein werden als HiddenFiles angezeigt und sich auch im System für mich "nicht mehr erreichbar".

Rechner ist sauber. Zu allem andren gibt es von mir nur ein "Fehlalarm von Sophos" solange ich kein logfile davon sehe, oder nen Screenshot, order irgendwas mit dem ich arbeiten kann.

01.04.2014, 12:31	#4
schrauber /// the machine /// TB-Ausbilder	Hidden Files bei Sophos Logfile von Sophos? __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

02.04.2014, 13:40	#6
schrauber /// the machine /// TB-Ausbilder	Hidden Files bei Sophos Mach den Scan nochmal, dann solltest du die Option haben ein Logfile anzeigen zu lassen. __________________ --> Hidden Files bei Sophos

Hidden Files bei Sophos

Plagegeister aller Art und deren Bekämpfung: Hidden Files bei Sophos