| |
| |||||||
Log-Analyse und Auswertung: Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunterWindows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.XML |
 |
02.10.2014, 12:59
| #1 |
 |  Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Hallo liebe Helfer, hab eben Iconpacks für mein Handy heruntergeladen und mir eines mit Trojaner unterjubeln lassen. Avira hat gleich Alarm geschlagen und ihn in Quarantäne verschoben, habe dann trotzdem noch einen Suchlauf mit Malwarebytes gemacht. Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 2. Oktober 2014 11:41
Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.
Lizenznehmer : Avira Antivirus Free
Seriennummer : 0000149996-AVHOE-0000001
Plattform : Windows 7 Professional
Windowsversion : (Service Pack 1) [6.1.7601]
Boot Modus : Normal gebootet
Benutzername : Admin
Computername : W520
Versionsinformationen:
BUILD.DAT : 14.0.6.570 92022 Bytes 15.08.2014 10:30:00
AVSCAN.EXE : 14.0.6.548 1046608 Bytes 07.08.2014 08:33:29
AVSCANRC.DLL : 14.0.6.522 62544 Bytes 07.08.2014 08:33:29
LUKE.DLL : 14.0.6.522 57936 Bytes 07.08.2014 08:33:40
AVSCPLR.DLL : 14.0.6.548 92752 Bytes 07.08.2014 08:33:30
AVREG.DLL : 14.0.6.522 262224 Bytes 07.08.2014 08:33:28
avlode.dll : 14.0.6.526 603728 Bytes 07.08.2014 08:33:27
avlode.rdf : 14.0.4.46 64835 Bytes 10.09.2014 10:54:04
XBV00010.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00011.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00012.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00013.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00014.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00015.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00016.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00017.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00018.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00019.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00020.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00021.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00022.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:14
XBV00023.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00024.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00025.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00026.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00027.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00028.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00029.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00030.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00031.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00032.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00033.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00034.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00035.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00036.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00037.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00038.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00039.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00040.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00041.VDF : 8.11.165.190 2048 Bytes 07.08.2014 14:33:15
XBV00058.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00059.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00060.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00061.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00062.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00063.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00064.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00065.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00066.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00067.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00068.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00069.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00070.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00071.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00072.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00073.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:16
XBV00074.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00075.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00076.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00077.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00078.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00079.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00080.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00081.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00082.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00083.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00084.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00085.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00086.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00087.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00088.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00089.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00090.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00091.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00092.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00093.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00094.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00095.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:17
XBV00096.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00097.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00098.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00099.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00100.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00101.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00102.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00103.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00104.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00105.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00106.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00107.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00108.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00109.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00110.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00111.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00112.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00113.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00114.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00115.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00116.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:18
XBV00117.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00118.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00119.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00120.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00121.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00122.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00123.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00124.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00125.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00126.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00127.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00128.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00129.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00130.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00131.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00132.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00133.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00134.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:19
XBV00135.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00136.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00137.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00138.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00139.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00140.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00141.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00142.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00143.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00144.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00145.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00146.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00147.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00148.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00149.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00150.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00151.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00152.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:20
XBV00153.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00154.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00155.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00156.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00157.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00158.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00159.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00160.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00161.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00162.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00163.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00164.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00165.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00166.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00167.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00168.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00169.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00170.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00171.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:21
XBV00172.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00173.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00174.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00175.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00176.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00177.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00178.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00179.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00180.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00181.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00182.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00183.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00184.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00185.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00186.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00187.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00188.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00189.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00190.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00191.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00192.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00193.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00194.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00195.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00196.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00197.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00198.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:22
XBV00199.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00200.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00201.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00202.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00203.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00204.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00205.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00206.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00207.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00208.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00209.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00210.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00211.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00212.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00213.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00214.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00215.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00216.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00217.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00218.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00219.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00220.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00221.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00222.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00223.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00224.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00225.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00226.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00227.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00228.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00229.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:23
XBV00230.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00231.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00232.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00233.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00234.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00235.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00236.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00237.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00238.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00239.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00240.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00241.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00242.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00243.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00244.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00245.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00246.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00247.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00248.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00249.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00250.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00251.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00252.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00253.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:24
XBV00254.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:25
XBV00255.VDF : 8.11.175.172 2048 Bytes 30.09.2014 15:07:25
XBV00000.VDF : 7.11.70.0 66736640 Bytes 04.04.2013 15:20:13
XBV00001.VDF : 7.11.74.226 2201600 Bytes 30.04.2013 15:20:15
XBV00002.VDF : 7.11.80.60 2751488 Bytes 28.05.2013 15:20:16
XBV00003.VDF : 7.11.85.214 2162688 Bytes 21.06.2013 15:20:17
XBV00004.VDF : 7.11.91.176 3903488 Bytes 23.07.2013 15:20:19
XBV00005.VDF : 7.11.98.186 6822912 Bytes 29.08.2013 15:20:22
XBV00006.VDF : 7.11.139.38 15708672 Bytes 27.03.2014 15:20:29
XBV00007.VDF : 7.11.152.100 4193792 Bytes 02.06.2014 15:20:31
XBV00008.VDF : 8.11.165.192 4251136 Bytes 07.08.2014 14:33:14
XBV00009.VDF : 8.11.172.30 2094080 Bytes 15.09.2014 15:07:26
XBV00042.VDF : 8.11.175.172 1208832 Bytes 30.09.2014 15:07:15
XBV00043.VDF : 8.11.175.174 36864 Bytes 30.09.2014 15:07:15
XBV00044.VDF : 8.11.175.178 5632 Bytes 30.09.2014 21:07:11
XBV00045.VDF : 8.11.175.180 11264 Bytes 30.09.2014 21:07:11
XBV00046.VDF : 8.11.175.194 9728 Bytes 30.09.2014 21:07:11
XBV00047.VDF : 8.11.175.206 3072 Bytes 30.09.2014 09:09:56
XBV00048.VDF : 8.11.175.218 2560 Bytes 30.09.2014 09:09:56
XBV00049.VDF : 8.11.175.222 24576 Bytes 01.10.2014 09:09:56
XBV00050.VDF : 8.11.175.224 28160 Bytes 01.10.2014 15:09:53
XBV00051.VDF : 8.11.175.230 3072 Bytes 01.10.2014 15:09:53
XBV00052.VDF : 8.11.175.232 17408 Bytes 01.10.2014 15:09:53
XBV00053.VDF : 8.11.175.234 19456 Bytes 01.10.2014 15:09:53
XBV00054.VDF : 8.11.175.236 11264 Bytes 01.10.2014 21:09:50
XBV00055.VDF : 8.11.175.238 12288 Bytes 01.10.2014 21:09:50
XBV00056.VDF : 8.11.175.254 10240 Bytes 01.10.2014 21:09:50
XBV00057.VDF : 8.11.176.8 5120 Bytes 01.10.2014 21:09:50
LOCAL000.VDF : 8.11.176.8 111426048 Bytes 01.10.2014 21:10:01
Engineversion : 8.3.24.30
AEVDF.DLL : 8.3.1.6 133992 Bytes 20.08.2014 20:34:37
AESCRIPT.DLL : 8.2.0.26 436136 Bytes 26.09.2014 21:54:58
AESCN.DLL : 8.3.2.2 139456 Bytes 04.08.2014 15:17:57
AESBX.DLL : 8.2.20.24 1409224 Bytes 04.08.2014 15:17:58
AERDL.DLL : 8.2.0.138 704888 Bytes 04.08.2014 15:17:57
AEPACK.DLL : 8.4.0.54 788392 Bytes 24.09.2014 16:15:12
AEOFFICE.DLL : 8.3.0.26 223144 Bytes 26.09.2014 21:54:58
AEHEUR.DLL : 8.1.4.1310 7564144 Bytes 26.09.2014 21:54:58
AEHELP.DLL : 8.3.1.0 278728 Bytes 04.08.2014 15:17:55
AEGEN.DLL : 8.1.7.30 453480 Bytes 26.09.2014 21:54:57
AEEXP.DLL : 8.4.2.32 247712 Bytes 03.09.2014 08:45:09
AEEMU.DLL : 8.1.3.4 399264 Bytes 07.08.2014 14:33:10
AEDROID.DLL : 8.4.2.24 442568 Bytes 04.08.2014 15:19:12
AECORE.DLL : 8.3.2.6 243712 Bytes 07.08.2014 14:33:10
AEBB.DLL : 8.1.2.0 60448 Bytes 07.08.2014 14:33:10
AVWINLL.DLL : 14.0.6.522 24144 Bytes 07.08.2014 08:33:25
AVPREF.DLL : 14.0.6.522 50256 Bytes 07.08.2014 08:33:28
AVREP.DLL : 14.0.6.522 219216 Bytes 07.08.2014 08:33:28
AVARKT.DLL : 14.0.5.368 226384 Bytes 04.08.2014 15:19:21
AVEVTLOG.DLL : 14.0.6.522 182352 Bytes 07.08.2014 08:33:26
SQLITE3.DLL : 14.0.6.522 452176 Bytes 07.08.2014 08:33:42
AVSMTP.DLL : 14.0.6.522 76368 Bytes 07.08.2014 08:33:30
NETNT.DLL : 14.0.6.522 13392 Bytes 07.08.2014 08:33:40
RCIMAGE.DLL : 14.0.6.544 4863568 Bytes 07.08.2014 08:33:25
RCTEXT.DLL : 14.0.6.558 76080 Bytes 28.08.2014 10:15:44
Konfiguration für den aktuellen Suchlauf:
Job Name..............................: ShlExt
Konfigurationsdatei...................: C:\Users\y\AppData\Local\Temp\a87b6535.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: aus
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +GAME,+JOKE,+PCK,+PFS,+SPR,
Beginn des Suchlaufs: Donnerstag, 2. Oktober 2014 11:41
Der Suchlauf über die ausgewählten Dateien wird begonnen:
Beginne mit der Suche in 'C:\Users\y\Downloads\darkgrungetheme.rar.exe'
C:\Users\y\Downloads\darkgrungetheme.rar.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen5
Beginne mit der Desinfektion:
C:\Users\y\Downloads\darkgrungetheme.rar.exe
[FUND] Ist das Trojanische Pferd TR/Crypt.XPACK.Gen5
[HINWEIS] Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '514dbfd2.qua' verschoben!
Ende des Suchlaufs: Donnerstag, 2. Oktober 2014 11:41
Benötigte Zeit: 00:00 Minute(n)
Der Suchlauf wurde vollständig durchgeführt.
0 Verzeichnisse wurden überprüft
2 Dateien wurden geprüft
1 Viren bzw. unerwünschte Programme wurden gefunden
0 Dateien wurden als verdächtig eingestuft
0 Dateien wurden gelöscht
0 Viren bzw. unerwünschte Programme wurden repariert
1 Dateien wurden in die Quarantäne verschoben
0 Dateien wurden umbenannt
0 Dateien konnten nicht durchsucht werden
1 Dateien ohne Befall
0 Archive wurden durchsucht
0 Warnungen
1 Hinweise
Mbar1: Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1012
www.malwarebytes.org
Database version: v2014.10.02.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: W520 [administrator]
02.10.2014 11:53:02
mbar-log-2014-10-02 (11-53-02).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 435271
Time elapsed: 16 minute(s), 5 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter Malwarebytes Anti-Rootkit BETA 1.07.0.1012
www.malwarebytes.org
Database version: v2014.10.02.03
Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: W520 [administrator]
02.10.2014 12:15:50
mbar-log-2014-10-02 (12-15-50).txt
Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled:
Objects scanned: 435202
Time elapsed: 14 minute(s), 41 second(s)
Memory Processes Detected: 0
(No malicious items detected)
Memory Modules Detected: 0
(No malicious items detected)
Registry Keys Detected: 0
(No malicious items detected)
Registry Values Detected: 0
(No malicious items detected)
Registry Data Items Detected: 0
(No malicious items detected)
Folders Detected: 0
(No malicious items detected)
Files Detected: 0
(No malicious items detected)
Physical Sectors Detected: 0
(No malicious items detected)
(end)
Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-10-2014 01
Ran by Admin (administrator) on W520 on 02-10-2014 12:33:59
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin & (Available profiles: UpdatusUser & Admin & y & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Ericsson AB) C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SRORest.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
(Avanquest Software ) C:\Program Files (x86)\Digital Line Detect\DLG.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Lenovo.) C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
() C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [380776 2011-03-29] (Lenovo.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [40808 2011-05-31] (Lenovo Group Limited)
HKLM\...\Run: [ALCKRESI.EXE] => C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [281960 2011-07-13] (Lenovo Group Limited)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63832 2014-03-14] (Lenovo)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [X-Rite Legacy Device] => C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe [105984 2010-09-28] (X-Rite Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\S-1-5-21-3141125159-651349833-1633251973-1006\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {83044456-2184-11e4-9c5c-f0def15dfd89} - D:\SETUP.EXE
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {83044456-2184-11e4-9c5c-f0def15dfd89} - D:\SETUP.EXE
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
Lsa: [Notification Packages] scecli ACGina C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibrator Gamma.lnk
ShortcutTarget: Color Calibrator Gamma.lnk -> C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Gamma\CalibrationLoader.exe (LOGO Kommunikations- und Drucktechnik GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibrator Tray.lnk
ShortcutTarget: Color Calibrator Tray.lnk -> C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files (x86)\Digital Line Detect\DLG.exe (Avanquest Software )
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL =
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.179.1
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\user.js
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\searchplugins\zonealarm.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: zonealarm.com - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\Extensions\ffxtlbr@zonealarm.com [2014-06-24]
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [477032 2011-07-04] (Lenovo.)
R2 i1 Display Service; C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [163328 2010-09-28] (X-Rite Inc.) [File not signed]
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-06-26] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-06-26] (pdfforge GmbH)
R2 SROSVC; C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [443240 2011-03-02] (Lenovo Group Limited)
R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440 2008-01-10] (Ulead Systems, Inc.) [File not signed]
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [648744 2011-08-12] (Ericsson AB)
R2 xritedeviced; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [142848 2010-09-28] (X-Rite Inc.) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-08-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-08-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-04] (Avira Operations GmbH & Co. KG)
R3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2010-03-03] (Ericsson AB)
R3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [30248 2010-03-03] (Ericsson AB)
R3 l36wgps; C:\Windows\System32\DRIVERS\l36wgps64.sys [101416 2011-07-01] (Ericsson AB)
R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [92888 2014-10-02] (Malwarebytes Corporation)
R3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [419400 2011-04-13] (MCCI Corporation)
R3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [430664 2011-04-13] (MCCI Corporation)
R3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [19528 2011-04-13] (MCCI Corporation)
R3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [483400 2011-04-13] (MCCI Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-05-24] ()
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [41536 2009-09-24] (Lenovo (United States) Inc.)
S3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [286248 2011-04-06] (Ericsson AB)
S2 smihlp; \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S0 vmci; system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-02 11:52 - 2014-10-02 12:31 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-10-02 11:50 - 2014-10-02 12:31 - 00000000 ____D () C:\Users\Admin\Desktop\mbar
2014-10-02 11:49 - 2014-10-02 11:49 - 14349744 _____ (Malwarebytes Corp.) C:\Users\y\Desktop\mbar-1.07.0.1012.exe
2014-10-02 11:48 - 2014-10-02 11:48 - 00380416 _____ () C:\Users\Admin\Desktop\11d0cftl.exe
2014-10-02 11:47 - 2014-10-02 11:47 - 02108928 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-01 11:13 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 11:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-27 11:27 - 2014-09-27 11:27 - 00000000 ____D () C:\Users\y\AppData\Local\Lenovo
2014-09-25 21:09 - 2014-09-26 09:24 - 00000000 ____D () C:\Users\y\AppData\Local\Mozilla Thunderbird
2014-09-24 23:02 - 2014-09-24 23:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-24 09:50 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 09:50 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-21 17:30 - 2014-09-21 17:30 - 00791895 _____ () C:\Users\y\Downloads\OptiFine_1.7.10_HD_A4.jar
2014-09-21 17:22 - 2014-09-21 17:23 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-09-21 01:07 - 2014-09-21 01:07 - 00001478 _____ () C:\Users\y\AppData\Local\recently-used.xbel
2014-09-21 01:01 - 2014-09-21 01:09 - 00000000 ____D () C:\Users\y\AppData\Local\gtk-2.0
2014-09-21 01:00 - 2014-09-21 01:00 - 00000000 ____D () C:\Users\y\.thumbnails
2014-09-21 00:55 - 2014-09-21 01:09 - 00000000 ____D () C:\Users\y\.gimp-2.8
2014-09-21 00:55 - 2014-09-21 00:55 - 00000000 ____D () C:\Users\y\AppData\Local\gegl-0.2
2014-09-21 00:46 - 2014-09-21 00:46 - 00000905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-09-21 00:45 - 2014-09-21 00:46 - 00000000 ____D () C:\Program Files\GIMP 2
2014-09-21 00:25 - 2014-09-21 00:29 - 91931728 _____ (The GIMP Team ) C:\Users\y\Desktop\gimp-2.8.14-setup-1.exe
2014-09-21 00:17 - 2014-09-21 00:17 - 00001090 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\Users\y\AppData\Local\PDF24
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-09-20 23:59 - 2014-09-20 23:59 - 00000000 ____D () C:\Users\y\Desktop\SpritecraftFull
2014-09-19 22:27 - 2014-10-01 22:23 - 00000000 ____D () C:\Users\y\Desktop\Printables
2014-09-19 14:43 - 2014-09-19 14:43 - 00000000 ____D () C:\Program Files\Common Files\EPSON
2014-09-19 13:51 - 2014-09-19 13:51 - 00000000 ____D () C:\Users\y\AppData\Roaming\Epson
2014-09-19 13:38 - 2014-09-19 14:10 - 00002369 _____ () C:\Users\Public\Desktop\Epson Netzwerkhandbuch WF-3520 Series.lnk
2014-09-19 13:38 - 2014-09-19 14:09 - 00000279 _____ () C:\Users\Public\Desktop\Epson Benutzerhandbuch WF-3520 Series.url
2014-09-19 13:37 - 2014-09-22 15:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
2014-09-19 13:37 - 2014-09-22 15:47 - 00000000 ____D () C:\Program Files (x86)\Epson Software
2014-09-19 13:37 - 2014-09-19 13:37 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Epson
2014-09-19 13:36 - 2014-09-23 12:31 - 00000000 ____D () C:\Program Files (x86)\epson
2014-09-19 13:36 - 2014-09-22 15:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2014-09-19 13:35 - 2014-09-20 14:45 - 00000000 ____D () C:\ProgramData\EPSON
2014-09-19 13:35 - 2011-04-19 03:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMJJE.DLL
2014-09-19 13:35 - 2011-03-14 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BJJE.DLL
2014-09-19 13:35 - 2007-04-10 01:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2014-09-12 23:15 - 2014-09-12 23:15 - 00000000 ____D () C:\Users\y\AppData\Roaming\NVIDIA
2014-09-12 20:21 - 2014-10-02 09:42 - 00000000 ____D () C:\Users\y\AppData\Roaming\.minecraft
2014-09-12 20:12 - 2014-09-12 20:12 - 00675988 _____ () C:\Users\y\Desktop\Minecraft.exe
2014-09-12 16:54 - 2014-08-15 17:48 - 17868288 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 16:54 - 2014-08-15 17:36 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 16:54 - 2014-08-15 17:35 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 16:54 - 2014-08-15 17:31 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 16:54 - 2014-08-15 17:31 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 16:54 - 2014-08-15 17:30 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 16:54 - 2014-08-15 17:30 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-12 16:54 - 2014-08-15 17:30 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 02156032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 16:54 - 2014-08-15 17:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 16:54 - 2014-08-15 17:28 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 16:54 - 2014-08-15 17:28 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 16:54 - 2014-08-15 17:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-12 16:54 - 2014-08-15 17:28 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 16:54 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 16:54 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 16:54 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 16:54 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 16:54 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 16:54 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 16:54 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 16:54 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 16:54 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-09-12 16:54 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-09-12 16:46 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 16:46 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 08:44 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 08:44 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 08:44 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 08:44 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 08:44 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 08:44 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 08:44 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 08:44 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 08:44 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 08:44 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 08:44 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-04 01:02 - 2014-09-04 01:02 - 00012288 ___SH () C:\Users\y\Thumbs.db
2014-09-04 01:00 - 2014-09-04 01:00 - 00001024 _____ () C:\Users\Public\Desktop\PDF Architect 2.lnk
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\Users\Admin\Documents\PDF Architect 2
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\Program Files (x86)\PDF Architect 2
2014-09-04 00:59 - 2014-09-04 01:00 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\pdfforge
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-09-04 00:59 - 2014-04-25 17:44 - 00662288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2014-09-04 00:59 - 2014-04-25 17:44 - 00137000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMAPI32.OCX
2014-09-04 00:59 - 2014-04-25 17:44 - 00110264 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-09-04 00:59 - 2014-04-25 17:44 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPIDE.DLL
2014-09-04 00:59 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6DE.DLL
2014-09-04 00:59 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCDE.DLL
2014-09-04 00:59 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCC2DE.DLL
2014-09-04 00:56 - 2014-09-04 00:56 - 27843432 _____ (pdfforge ) C:\Users\y\Downloads\PDFCreator-1_7_3_setup.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-02 12:34 - 2014-08-07 11:38 - 00021562 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-02 12:34 - 2014-08-07 11:38 - 00000000 ____D () C:\FRST
2014-10-02 12:32 - 2011-06-21 19:59 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2014-10-02 12:29 - 2011-06-21 19:59 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job
2014-10-02 12:13 - 2014-08-07 11:10 - 00128728 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-02 12:10 - 2011-05-24 09:23 - 01509774 _____ () C:\Windows\WindowsUpdate.log
2014-10-02 11:51 - 2014-08-07 11:10 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-02 11:48 - 2014-06-24 12:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-02 11:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-02 10:28 - 2014-08-11 22:40 - 00000000 ____D () C:\Users\y\Desktop\Rezepte
2014-10-02 09:37 - 2009-07-14 06:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-02 09:37 - 2009-07-14 06:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-02 08:56 - 2011-05-24 09:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-02 08:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-02 08:56 - 2009-07-14 06:51 - 00079349 _____ () C:\Windows\setupact.log
2014-10-02 00:32 - 2014-06-17 22:26 - 00310170 _____ () C:\Windows\IE11_main.log
2014-10-01 21:15 - 2014-08-12 00:27 - 00000000 ____D () C:\Users\y\Handykarte Dateien
2014-09-27 13:56 - 2014-06-17 20:59 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-09-27 13:56 - 2011-05-24 18:46 - 00000000 ____D () C:\ProgramData\Lenovo
2014-09-27 13:55 - 2011-05-24 09:43 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-09-27 13:55 - 2011-05-24 09:28 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-09-27 13:55 - 2011-05-24 09:27 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-09-27 12:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-25 11:55 - 2014-06-17 20:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-23 12:31 - 2010-11-21 05:47 - 00093108 _____ () C:\Windows\PFRO.log
2014-09-22 15:53 - 2011-05-24 09:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-21 17:22 - 2014-06-24 12:47 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-21 17:22 - 2014-06-24 12:47 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-21 17:22 - 2011-06-25 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-21 01:00 - 2014-06-24 12:42 - 00000000 ____D () C:\Users\y
2014-09-21 00:16 - 2014-06-17 20:52 - 00122712 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-19 19:29 - 2014-08-14 11:38 - 00000000 ____D () C:\Users\y\Studium
2014-09-19 14:06 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-09-12 16:54 - 2014-08-11 21:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-12 16:54 - 2011-06-22 22:29 - 01594892 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 16:54 - 2011-05-24 19:13 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-09-12 16:54 - 2011-05-24 19:13 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-09-12 16:53 - 2014-06-17 22:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 16:53 - 2009-07-14 07:13 - 01594892 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-12 16:48 - 2014-06-24 13:18 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-12 16:47 - 2014-08-04 17:21 - 00001148 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-12 16:47 - 2011-06-21 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-12 16:47 - 2011-06-21 19:39 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-12 16:46 - 2014-06-17 22:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-12 16:46 - 2011-06-21 20:16 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 13:28 - 2014-08-11 22:40 - 00000000 ____D () C:\Users\y\Desktop\USB Maus
2014-09-05 11:51 - 2014-08-11 22:24 - 00000000 ____D () C:\Users\y\Bewerbungen
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\AskSLib.dll
C:\Users\Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Admin\AppData\Local\Temp\nvStInst.exe
C:\Users\Admin\AppData\Local\Temp\ose00000.exe
C:\Users\y\AppData\Local\Temp\AskSLib.dll
C:\Users\y\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-27 11:55
==================== End Of Log ============================
Nach dem Start steht im Avira-Control-Panel, es sei aktiv, im Windows-Wartungscenter wird es aber immer noch als inaktiv angezeigt. Hab über Letzteres ein paar Mal auf "aktivieren" gedrückt, das ändert aber nichts. Sorry für den Roman  Ich hoffe, ich mache mir mehr Sorgen als nötig und freue mich sehr über eure Hilfe  LG Büromagnet PS: Additions und GMER sind im Anhang, da sonst der Text zu viele Zeichen hat. |
|
02.10.2014, 13:00
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Hi und
__________________ Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten  Lesestoff:Posten in CODE-Tags Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit. Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
__________________ |
|
02.10.2014, 13:25
| #3 |
| | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Ok, sorry, dann war das ein Missverständnis
__________________ Addition: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-08-2014
Ran by Admin at 2014-08-07 11:39:04
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
Adobe Flash Player 10 ActiveX (HKLM-x32\...\{B7B3E9B3-FB14-4927-894B-E9124509AF5A}) (Version: 10.0.32.18 - Adobe Systems, Inc.)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader X (10.1.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.71.00 - )
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Broadcom InConcert Maestro (HKLM\...\{57DD35E9-D9BB-4089-BB05-EF933C586CB3}) (Version: 1.0.1.1500 - Broadcom Corporation)
Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) Hidden
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.23.5 - Conexant)
Corel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)
Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) Hidden
Corel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.828 - Corel Inc.)
Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Direct DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) Hidden
Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7 (HKLM\...\DisableAMTPopup) (Version: 1.00 - )
Integrated Camera Driver Installer Package Ver.1.1.0.1147 (HKLM-x32\...\{B2CA6F37-1602-4823-81B5-0384B6888AA6}) (Version: 1.1.0.1147 - RICOH)
Integrated Camera TWAIN (HKLM-x32\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.)
Intel PROSet Wireless (Version: - ) Hidden
Intel PROSet Wireless (x32 Version: - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Identity Protection Technology 1.0.74.0 (HKLM-x32\...\{C6D4B05A-EA7E-1027-80EF-C925E740E99C}) (Version: 1.0.74.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 18.7 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2538 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{3C41721F-AF0F-4086-AA1C-4C7F29076228}) (Version: 14.01.1000 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
Intel(R) Wireless Display (HKLM-x32\...\{F84906ED-BB54-4889-B131-FED9C9056FC8}) (Version: 2.0.27.0 - Intel Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.00 - )
Lenovo Mobile Broadband Activation (HKLM-x32\...\{A95D9DF7-CF34-421A-A1DC-936A49A4DAEA}) (Version: 4.0.0013.00 - Lenovo Group Limited)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Lenovo Screen Reading Optimizer (HKLM-x32\...\{91A29166-4E1B-4664-B70B-4C4A3B6B3372}) (Version: 1.07 - Lenovo)
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.05.0009 - Lenovo)
Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5849.23 - PC-Doctor, Inc.)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0008.00 - Ihr Firmenname)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0005.00 - Lenovo)
Lenovo Welcome (HKLM-x32\...\Lenovo Welcome_is1) (Version: 2.02.003.0 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Message Center Plus (HKLM-x32\...\{FD331A3B-F7A5-4C31-B8D4-DF413C85AF7A}) (Version: 2.0.0012.00 - Lenovo Group Limited)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Mobile Broadband Drivers (HKLM-x32\...\{EA9640BE-414E-4195-B53B-7905BF1A5A09}) (Version: 6.5.1.5 - Ericsson AB)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA 3D Vision Treiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 312.69 - NVIDIA Corporation)
NVIDIA Grafiktreiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 312.69 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
Oracle VM VirtualBox 4.3.14 (HKLM\...\{8DD94059-60C6-42E3-AB59-8F37445ACC79}) (Version: 4.3.14 - Oracle Corporation)
PANTONE Color Calibrator 1.0 (HKLM-x32\...\PANTONE Color Calibrator_is1) (Version: - X-Rite)
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (HKLM\...\EnablePS) (Version: 1.00 - )
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
RICOH Media Driver v2.10.18.02 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.10.18.02 - RICOH)
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version: - )
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6C9D5F7-630C-4125-8C4E-94AF77C1896E}) (Version: 6.4.0.1500 - Broadcom Corporation)
ThinkPad Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 3.62 - )
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.40 - )
ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 6.21 - Lenovo)
ThinkVantage AutoLock (HKLM\...\{E224B44B-B5EB-4af3-A80A-A255358E241A}_is1) (Version: 1.04 - Lenovo)
ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 2.07 - Lenovo)
ThinkVantage Fingerprint Software (HKLM\...\{F58DA859-016E-492D-A588-317D9BB28002}) (Version: 5.9.9.7282 - Authentec Inc.)
ThinkVantage GPS (HKLM-x32\...\{6DB21B2C-2BEF-44B4-B264-8EC2BC2369C6}) (Version: 2.80 - Lenovo)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Intel (e1cexpress) Net (12/21/2010 11.8.84.0) (HKLM\...\6D23A494E9A245843FB8584D9307D3E328DF8613) (Version: 12/21/2010 11.8.84.0 - Intel)
Windows-Treiberpaket - Intel (MEIx64) System (10/19/2010 7.0.0.1144) (HKLM\...\90FD26A77B849AE03FF5F07A1CDA7F950406A8D8) (Version: 10/19/2010 7.0.0.1144 - Intel)
Windows-Treiberpaket - Intel System (09/10/2010 9.2.0.1011) (HKLM\...\0CDBDD444A1F5FFEA227B4E7DCE195F11F08240A) (Version: 09/10/2010 9.2.0.1011 - Intel)
Windows-Treiberpaket - Intel System (09/10/2010 9.2.0.1011) (HKLM\...\A513FC5E5A08D4EF27F234E91E0E942A0234210B) (Version: 09/10/2010 9.2.0.1011 - Intel)
Windows-Treiberpaket - Intel System (10/04/2010 9.2.0.1015) (HKLM\...\FE1BEBFD475BB832AAF104F5C63348E98A9286DF) (Version: 10/04/2010 9.2.0.1015 - Intel)
Windows-Treiberpaket - Intel USB (09/16/2010 9.2.0.1013) (HKLM\...\D97688B8E3830BF9820E15EB8D9552DCBF988CFD) (Version: 09/16/2010 9.2.0.1013 - Intel)
Windows-Treiberpaket - Lenovo 1.61.00.11 (11/11/2010 1.61.00.11) (HKLM\...\466E9B20D871055D6D3CDA2CDD1D355E978A61AF) (Version: 11/11/2010 1.61.00.11 - Lenovo)
Windows-Treiberpaket - Synaptics (SynTP) Mouse (02/17/2011 15.2.14.0) (HKLM\...\77A943AB876C131591E0EA5DB6AB08D89EE2EA9E) (Version: 02/17/2011 15.2.14.0 - Synaptics)
X-Rite Device i1Display Service (HKLM-x32\...\{D2A53206-6A9E-4241-B21C-D94140EEF1CE}_is1) (Version: 1.0 - X-Rite Inc.)
X-Rite Device Manager (HKLM-x32\...\{9ACEA9CD-63B9-4784-807B-EA295E96A7C3}_is1) (Version: 1.0 - X-Rite Inc.)
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 13.1.211.000 - Check Point)
ZoneAlarm Security Toolbar (HKCU\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
Could not list Restore Points. Check "winmgmt" service or repair WMI.
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1B4ECB35-36E2-436D-9F92-6E77BA54A061} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {1D10F913-F57D-440E-A090-680DBFD9A0CD} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-01-21] (Microsoft)
Task: {2250233B-A91F-453F-9969-928AA4A2F096} - System32\Tasks\PCDoctorBackgroundMonitorTask-Delay => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {228BCBEF-4341-4187-A897-495238E406F7} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {474F18C8-A337-433A-AE5E-44A4DD1545D3} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {69033D1C-86B9-46A6-BCC6-E7364DD84646} - System32\Tasks\MCP => C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe [2009-05-27] ()
Task: {94E4E220-421A-4B2F-9FA5-0C6731235738} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-04] (Adobe Systems Incorporated)
Task: {B40C9D21-6759-4886-B553-CC3BC215678A} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {BF9A603C-8A54-44D3-9E8F-C78BE2749BCE} - System32\Tasks\Lenovo\SROptimizer => %TRPATH%\SRORest.exe
Task: {E11430E8-B24A-4954-9D5E-CE2C5E8ABD90} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-02-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe
==================== Loaded Modules (whitelisted) =============
2011-05-02 13:41 - 2011-05-02 13:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2014-06-17 21:11 - 2013-10-29 02:53 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-05-24 09:36 - 2011-07-04 03:02 - 00055296 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-05-24 09:32 - 2010-10-26 10:40 - 00049056 ____N () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2011-05-02 13:41 - 2011-05-02 13:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-05-24 09:33 - 2011-03-06 13:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2010-12-18 15:50 - 2010-12-18 15:50 - 00173856 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 10383872 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
2009-05-27 22:09 - 2009-05-27 22:09 - 00049976 _____ () C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe
2014-03-14 17:47 - 2014-03-14 17:47 - 00092504 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2014-07-24 11:50 - 2014-07-24 11:50 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-24 11:49 - 2014-07-24 11:49 - 00065104 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2011-05-24 09:32 - 2011-05-26 17:17 - 00065576 ____R () C:\Program Files (x86)\Mobile Broadband drivers\WMCore\MBMDebug.dll
2011-09-23 20:10 - 2011-06-29 18:09 - 02085888 _____ () C:\Program Files\Lenovo\AutoLock\cv210.dll
2011-09-23 20:10 - 2011-06-29 18:09 - 02201088 _____ () C:\Program Files\Lenovo\AutoLock\cxcore210.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 00898560 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\libxml2.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 00073728 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\zlib1.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 03449344 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\CxF2_VC90MD_2.1.dll
2011-05-24 09:38 - 2010-12-15 22:54 - 07390720 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtGui4.dll
2011-05-24 09:38 - 2010-12-15 22:54 - 02012160 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtCore4.dll
2014-08-07 11:01 - 2014-07-24 11:50 - 00049744 _____ () C:\Users\Admin\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
==================== Faulty Device Manager Devices =============
Name: SMI Helper Driver (smihlp)
Description: SMI Helper Driver (smihlp)
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: smihlp
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (08/07/2014 11:39:05 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.
Vorgang:
VSS-Server wird instanziiert
Error: (08/07/2014 11:39:05 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} und dem Namen "IVssCoordinatorEx2" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]
Vorgang:
VSS-Server wird instanziiert
Error: (08/07/2014 10:55:34 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{7896eb25-2403-4b7b-235a-a65b8e850e3e}\VBoxNetFlt.inf" "9" "5f09ff663" "00000000000002B8" "WinSta0\Default" "0000000000000664" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netflt"; Beschreibung = Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkdienst; Fehler = 0x80042302).
Error: (08/07/2014 10:55:34 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.
Error: (08/07/2014 10:55:34 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f} und dem Namen "Coordinator" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]
Error: (08/07/2014 10:55:26 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{3d392bf8-9887-07d9-4f73-570aeef63d73}\VBoxNetAdp.inf" "9" "5dd35f09b" "00000000000006BC" "WinSta0\Default" "0000000000000668" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp"; Beschreibung = Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkadapter; Fehler = 0x80042302).
Error: (08/07/2014 10:55:26 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.
Error: (08/07/2014 10:55:26 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f} und dem Namen "Coordinator" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]
Error: (08/07/2014 10:55:18 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{5bcc7736-37a7-0e37-fdea-2834f8802439}\VBoxUSB.inf" "9" "56237d90b" "000000000000069C" "WinSta0\Default" "00000000000006BC" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"; Beschreibung = Gerätetreiber-Paketinstallation: Oracle Corporation USB-Controller; Fehler = 0x80042302).
Error: (08/07/2014 10:55:18 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.
System errors:
=============
Error: (08/07/2014 10:33:42 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Error: (08/07/2014 10:31:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (08/07/2014 10:31:04 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (08/07/2014 10:28:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1053
Error: (08/07/2014 10:28:48 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.
Error: (08/07/2014 10:27:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SMI Helper Driver (smihlp)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/06/2014 10:48:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (08/06/2014 10:48:29 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (08/06/2014 10:45:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SMI Helper Driver (smihlp)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (08/06/2014 08:24:46 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme
Microsoft Office Sessions:
=========================
Error: (08/07/2014 11:39:05 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Vorgang:
VSS-Server wird instanziiert
Error: (08/07/2014 11:39:05 AM) (Source: VSS) (EventID: 13) (User: )
Description: {e579ab5f-1cc4-44b4-bed9-de0991ff0623}IVssCoordinatorEx20x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Vorgang:
VSS-Server wird instanziiert
Error: (08/07/2014 10:55:34 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{7896eb25-2403-4b7b-235a-a65b8e850e3e}\VBoxNetFlt.inf" "9" "5f09ff663" "00000000000002B8" "WinSta0\Default" "0000000000000664" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netflt"Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkdienst0x80042302
Error: (08/07/2014 10:55:34 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Error: (08/07/2014 10:55:34 AM) (Source: VSS) (EventID: 13) (User: )
Description: {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f}Coordinator0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Error: (08/07/2014 10:55:26 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{3d392bf8-9887-07d9-4f73-570aeef63d73}\VBoxNetAdp.inf" "9" "5dd35f09b" "00000000000006BC" "WinSta0\Default" "0000000000000668" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp"Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkadapter0x80042302
Error: (08/07/2014 10:55:26 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Error: (08/07/2014 10:55:26 AM) (Source: VSS) (EventID: 13) (User: )
Description: {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f}Coordinator0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
Error: (08/07/2014 10:55:18 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{5bcc7736-37a7-0e37-fdea-2834f8802439}\VBoxUSB.inf" "9" "56237d90b" "000000000000069C" "WinSta0\Default" "00000000000006BC" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"Gerätetreiber-Paketinstallation: Oracle Corporation USB-Controller0x80042302
Error: (08/07/2014 10:55:18 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
CodeIntegrity Errors:
===================================
Date: 2011-06-26 13:11:21.363
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:21.303
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:21.243
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:21.063
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.953
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.803
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.713
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.653
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.563
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.283
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Percentage of memory in use: 21%
Total physical RAM: 8075.23 MB
Available physical RAM: 6312.45 MB
Total Pagefile: 16148.65 MB
Available Pagefile: 14157.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB
==================== Drives ================================
Drive c: (Windows7_OS) (Fixed) (Total:674.01 GB) (Free:619.83 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive q: (Lenovo_Recovery) (Fixed) (Total:23.46 GB) (Free:14.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 699 GB) (Disk ID: C42CD616)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=674 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=23 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
02.10.2014, 13:26
| #4 |
| | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter GMER: Code:
ATTFilter GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-02 12:52:46
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD75 rev.01.0 698,64GB
Running: 11d0cftl.exe; Driver: C:\Users\Admin\AppData\Local\Temp\uxtdqpob.sys
---- Kernel code sections - GMER 2.1 ----
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528 fffff80002fab000 76 bytes [B9, FF, FF, FF, FF, 0F, 00, ...]
INITKDBG C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 605 fffff80002fab04d 59 bytes [F0, 41, 0F, BA, 6E, 10, 00, ...]
---- User code sections - GMER 2.1 ----
.text C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe[3744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe[3744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[1336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[1336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007742f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077459a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000774694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077469630 5 bytes JMP 000000016fff0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000774887e0 7 bytes JMP 000000016fff01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007742f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077459a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000774694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077469630 5 bytes JMP 000000016fff0110
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000774887e0 7 bytes JMP 000000016fff01b8
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\dxgi.dll!CreateDXGIFactory 000007fef2c6dc88 5 bytes JMP 000007fff2c400d8
.text C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1 000007fef2c6de10 5 bytes JMP 000007fff2c40110
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007742f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077459a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000774694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077469630 5 bytes JMP 000000016fff0110
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000774887e0 7 bytes JMP 000000016fff01b8
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007742f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077459a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000774694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077469630 5 bytes JMP 000000016fff0110
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000774887e0 7 bytes JMP 000000016fff01b8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW 000000007742f2e0 5 bytes JMP 000000016fff0148
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx 0000000077459a30 7 bytes JMP 000000016fff00d8
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!K32GetModuleInformation 00000000774694c0 5 bytes JMP 000000016fff0180
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW 0000000077469630 5 bytes JMP 000000016fff0110
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!RegSetValueExA 00000000774887e0 7 bytes JMP 000000016fff01b8
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\ole32.dll!CoCreateInstance 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\ole32.dll!CoSetProxyBlanket 000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Windows\SysWOW64\RunDll32.exe[5064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Windows\SysWOW64\RunDll32.exe[5064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\KERNELBASE.dll!FreeLibrary 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW 000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!RegSetValueExA 00000000755f1409 7 bytes JMP 00000001742c12ad
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW 000000007560b21b 5 bytes JMP 00000001742c15be
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx 0000000075688e24 7 bytes JMP 00000001742c1357
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW 00000000756891ff 5 bytes JMP 00000001742c1028
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\USER32.dll!CreateWindowExW 00000000756f8a29 5 bytes JMP 00000001742c1050
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA 0000000075704572 5 bytes JMP 00000001742c10d2
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList 000000007541e96b 5 bytes JMP 00000001742c15d7
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo 000000007541eba5 5 bytes JMP 00000001742c11b8
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket 0000000076a35ea5 5 bytes JMP 00000001742c1609
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\ole32.dll!CoCreateInstance 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69 0000000075881465 2 bytes [88, 75]
.text C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155 00000000758814bb 2 bytes [88, 75]
.text ... * 2
---- Registry - GMER 2.1 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af827b33
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af827b33 (not active ControlSet)
---- Disk sectors - GMER 2.1 ----
Disk \Device\Harddisk0\DR0 unknown MBR code
---- EOF - GMER 2.1 ----
|
|
02.10.2014, 13:44
| #5 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Ist das ein gewerblich genutztes System? Zitat:
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.10.2014, 13:56
| #6 |
| | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Ne, ich bin Studentin und darf mir dank DreamSpark / MSDNAA über die Uni fast alle MS-Software kostenlos herunterladen, deshalb das Windows Professional. Das Geraffel hab ich eben deinstalliert  |
|
02.10.2014, 20:53
| #7 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Dann bitte jetzt Combofix ausführen: Scan mit Combofix
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.10.2014, 21:41
| #8 |
| | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Combofix Code:
ATTFilter ComboFix 14-10-02.01 - Admin 02.10.2014 22:19:01.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.8075.6322 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
C:\root
c:\root\wpfdot.exe
c:\users\Admin\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\SysWow64\SET47EE.tmp
c:\windows\SysWow64\SET52EC.tmp
c:\windows\SysWow64\SET533C.tmp
c:\windows\SysWow64\SET5987.tmp
c:\windows\SysWow64\SET6700.tmp
c:\windows\SysWow64\SET6730.tmp
Q:\Autorun.inf
.
.
((((((((((((((((((((((( Dateien erstellt von 2014-09-02 bis 2014-10-02 ))))))))))))))))))))))))))))))
.
.
2014-10-02 20:24 . 2014-10-02 20:24 -------- d-----w- c:\users\y\AppData\Local\temp
2014-10-02 20:24 . 2014-10-02 20:24 -------- d-----w- c:\users\UpdatusUser\AppData\Local\temp
2014-10-02 17:38 . 2014-09-15 00:08 11578928 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{297C58CA-5B5B-441F-8BEC-32EBD1688F23}\mpengine.dll
2014-10-02 11:53 . 2014-10-02 11:53 -------- d-----w- c:\program files (x86)\7-Zip
2014-10-02 09:52 . 2014-10-02 10:31 -------- d-----w- c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-10-01 09:13 . 2014-09-25 02:08 371712 ----a-w- c:\windows\system32\qdvd.dll
2014-10-01 09:13 . 2014-09-25 01:40 519680 ----a-w- c:\windows\SysWow64\qdvd.dll
2014-09-27 09:27 . 2014-09-27 09:27 -------- d-----w- c:\users\y\AppData\Local\Lenovo
2014-09-25 19:09 . 2014-09-26 07:24 -------- d-----w- c:\users\y\AppData\Local\Mozilla Thunderbird
2014-09-24 07:50 . 2014-09-09 22:11 2048 ----a-w- c:\windows\system32\tzres.dll
2014-09-24 07:50 . 2014-09-09 21:47 2048 ----a-w- c:\windows\SysWow64\tzres.dll
2014-09-22 19:13 . 2014-09-22 19:13 -------- d-----w- c:\users\y\AppData\Local\Diagnostics
2014-09-21 15:22 . 2014-09-21 15:23 -------- d-----w- c:\users\Admin\AppData\Local\Adobe
2014-09-20 23:01 . 2014-09-20 23:09 -------- d-----w- c:\users\y\AppData\Local\gtk-2.0
2014-09-20 23:00 . 2014-09-20 23:00 -------- d-----w- c:\users\y\.thumbnails
2014-09-20 22:55 . 2014-09-20 22:55 -------- d-----w- c:\users\y\AppData\Local\fontconfig
2014-09-20 22:55 . 2014-09-20 23:09 -------- d-----w- c:\users\y\.gimp-2.8
2014-09-20 22:55 . 2014-09-20 22:55 -------- d-----w- c:\users\y\AppData\Local\gegl-0.2
2014-09-20 22:45 . 2014-09-20 22:46 -------- d-----w- c:\program files\GIMP 2
2014-09-20 22:17 . 2014-09-20 22:17 -------- d-----w- c:\users\y\AppData\Local\PDF24
2014-09-20 22:17 . 2014-09-20 22:17 -------- d-----w- c:\program files (x86)\PDF24
2014-09-19 12:43 . 2014-09-19 12:43 -------- d-----w- c:\program files\Common Files\EPSON
2014-09-19 11:51 . 2014-09-19 11:51 -------- d-----w- c:\users\y\AppData\Roaming\Epson
2014-09-19 11:37 . 2014-09-19 11:37 -------- d-----w- c:\users\Admin\AppData\Roaming\Epson
2014-09-19 11:37 . 2014-09-22 13:47 -------- d-----w- c:\program files (x86)\Epson Software
2014-09-19 11:36 . 2014-09-23 10:31 -------- d-----w- c:\program files (x86)\epson
2014-09-19 11:35 . 2007-04-09 23:06 10752 ----a-w- c:\windows\system32\E_GCINST.DLL
2014-09-19 11:35 . 2011-04-19 01:03 120320 ----a-w- c:\windows\system32\E_YLMJJE.DLL
2014-09-19 11:35 . 2011-03-14 01:03 83968 ----a-w- c:\windows\system32\E_YD4BJJE.DLL
2014-09-19 11:35 . 2014-09-20 12:45 -------- d-----w- c:\programdata\EPSON
2014-09-12 21:15 . 2014-09-12 21:15 -------- d-----w- c:\users\y\AppData\Roaming\NVIDIA
2014-09-12 18:21 . 2014-10-02 19:30 -------- d-----w- c:\users\y\AppData\Roaming\.minecraft
2014-09-12 14:46 . 2014-06-27 02:08 2777088 ----a-w- c:\windows\system32\msmpeg2vdec.dll
2014-09-12 14:46 . 2014-06-27 01:45 2285056 ----a-w- c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-11 06:44 . 2014-08-01 11:53 1031168 ----a-w- c:\windows\system32\TSWorkspace.dll
2014-09-11 06:44 . 2014-08-01 11:35 793600 ----a-w- c:\windows\SysWow64\TSWorkspace.dll
2014-09-11 06:44 . 2014-06-24 03:29 2565120 ----a-w- c:\windows\system32\d3d10warp.dll
2014-09-11 06:44 . 2014-06-24 02:59 1987584 ----a-w- c:\windows\SysWow64\d3d10warp.dll
2014-09-11 06:44 . 2014-07-07 02:06 728064 ----a-w- c:\windows\system32\kerberos.dll
2014-09-11 06:44 . 2014-07-07 02:06 1460736 ----a-w- c:\windows\system32\lsasrv.dll
2014-09-11 06:44 . 2014-07-07 01:40 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2014-09-11 06:44 . 2014-07-07 01:40 550912 ----a-w- c:\windows\SysWow64\kerberos.dll
2014-09-11 06:44 . 2014-07-07 01:39 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2014-09-11 06:44 . 2014-09-05 02:10 578048 ----a-w- c:\windows\system32\aepdu.dll
2014-09-11 06:44 . 2014-09-05 02:05 424448 ----a-w- c:\windows\system32\aeinv.dll
2014-09-03 23:00 . 2014-09-03 23:00 -------- d-----w- c:\program files (x86)\PDF Architect 2
2014-09-03 22:59 . 2014-09-03 22:59 -------- d-----w- c:\programdata\PDF Architect 2
2014-09-03 22:59 . 2014-09-03 22:59 -------- d-----w- c:\users\Admin\AppData\Roaming\pdfforge
2014-09-03 22:59 . 2014-04-25 15:44 662288 ----a-w- c:\windows\SysWow64\MSCOMCT2.OCX
2014-09-03 22:59 . 2014-04-25 15:44 137000 ----a-w- c:\windows\SysWow64\MSMAPI32.OCX
2014-09-03 22:59 . 2014-04-25 15:44 110264 ----a-w- c:\windows\system32\pdfcmon.dll
2014-09-03 22:59 . 2014-09-03 23:00 -------- d-----w- c:\program files (x86)\PDFCreator
2014-09-03 22:59 . 2014-04-25 15:44 23552 ----a-w- c:\windows\SysWow64\MSMPIDE.DLL
2014-09-03 22:59 . 1998-07-06 16:56 125712 ----a-w- c:\windows\SysWow64\VB6DE.DLL
2014-09-03 22:59 . 1998-07-06 16:55 158208 ----a-w- c:\windows\SysWow64\MSCMCDE.DLL
2014-09-03 22:59 . 1998-07-06 16:55 64512 ----a-w- c:\windows\SysWow64\MSCC2DE.DLL
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-02 10:13 . 2014-08-07 09:10 128728 ----a-w- c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-10-02 09:51 . 2014-08-07 09:10 92888 ----a-w- c:\windows\system32\drivers\mbamchameleon.sys
2014-09-21 15:22 . 2014-06-24 10:47 701104 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-21 15:22 . 2011-06-25 15:11 71344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-15 07:06 . 2010-11-21 03:27 278152 ------w- c:\windows\system32\MpSigStub.exe
2014-09-12 14:46 . 2011-06-21 18:16 101694776 ----a-w- c:\windows\system32\MRT.exe
2014-08-23 02:07 . 2014-08-27 19:57 404480 ----a-w- c:\windows\system32\gdi32.dll
2014-08-23 01:45 . 2014-08-27 19:57 311808 ----a-w- c:\windows\SysWow64\gdi32.dll
2014-08-23 00:59 . 2014-08-27 19:57 3163648 ----a-w- c:\windows\system32\win32k.sys
2014-08-11 20:34 . 2014-08-11 20:34 98216 ----a-w- c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-08-04 15:43 . 2014-08-04 15:43 42040 ----a-w- c:\windows\system32\drivers\avnetflt.sys
2014-08-04 15:19 . 2014-08-04 15:41 28600 ----a-w- c:\windows\system32\drivers\avkmgr.sys
2014-08-04 15:19 . 2014-08-04 15:41 130584 ----a-w- c:\windows\system32\drivers\avipbb.sys
2014-08-04 15:19 . 2014-08-04 15:41 117712 ----a-w- c:\windows\system32\drivers\avgntflt.sys
2014-07-25 00:35 . 2014-07-25 00:35 875688 ----a-w- c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47 869544 ----a-w- c:\windows\system32\msvcr120_clr0400.dll
2014-07-15 14:16 . 2014-08-07 08:55 863528 ----a-w- c:\windows\system32\drivers\VBoxDrv.sys
2014-07-15 14:15 . 2014-08-07 08:53 129168 ----a-w- c:\windows\system32\drivers\VBoxUSBMon.sys
2014-07-15 14:15 . 2014-07-15 14:15 142528 ----a-w- c:\windows\system32\drivers\VBoxNetAdp.sys
2014-07-15 14:13 . 2014-07-15 14:13 205352 ------w- c:\windows\system32\VBoxNetFltNobj.dll
2014-07-14 02:02 . 2014-08-12 17:08 1216000 ----a-w- c:\windows\system32\rpcrt4.dll
2014-07-14 01:40 . 2014-08-12 17:08 664064 ----a-w- c:\windows\SysWow64\rpcrt4.dll
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2011-01-17 112152]
"PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2011-07-04 1605992]
"X-Rite Legacy Device"="c:\program files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe" [2010-09-27 105984]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-09-16 115048]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-07 751184]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-08-27 164656]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2014-07-04 191528]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2010-12-18 1202976]
Color Calibrator Gamma.lnk - c:\program files (x86)\X-Rite\PANTONE Color Calibrator\Gamma\CalibrationLoader.exe [2011-5-24 802816]
Color Calibrator Tray.lnk - c:\program files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe [2011-5-24 10383872]
Digital Line Detect.lnk - c:\program files (x86)\Digital Line Detect\DLG.exe [2011-5-24 50688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
.
R0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys;c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [x]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [x]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 PDF Architect 2;PDF Architect 2;c:\program files (x86)\PDF Architect 2\ws.exe;c:\program files (x86)\PDF Architect 2\ws.exe [x]
R3 pdfforge CrashHandler;pdfforge CrashHandler;c:\program files (x86)\PDF Architect 2\crash-handler-ws.exe;c:\program files (x86)\PDF Architect 2\crash-handler-ws.exe [x]
R3 pmxdrv;pmxdrv;c:\windows\system32\drivers\pmxdrv.sys;c:\windows\SYSNATIVE\drivers\pmxdrv.sys [x]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
R3 WwanUsbServ;Mobile Broadband Driver;c:\windows\system32\DRIVERS\WwanUsbMp64.sys;c:\windows\SYSNATIVE\DRIVERS\WwanUsbMp64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys;c:\windows\SYSNATIVE\DRIVERS\DzHDD64.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys;c:\windows\SYSNATIVE\DRIVERS\smiifx64.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [x]
S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 i1 Display Service;X-Rite Device i1 Display;c:\program files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe;c:\program files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]
S2 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x]
S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys;c:\windows\SYSNATIVE\DRIVERS\risdxc64.sys [x]
S2 SAService;Conexant SmartAudio service;c:\windows\system32\SAsrv.exe;c:\windows\SYSNATIVE\SAsrv.exe [x]
S2 SROSVC;Screen Reading Optimizer Service Program;c:\program files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe;c:\program files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 WMCoreService;Mobile Broadband Service;c:\program files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe servicemode;c:\program files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe servicemode [x]
S2 xritedeviced;X-Rite Device Manager;c:\program files (x86)\X-Rite\Devices\Services\xritedeviced.exe;c:\program files (x86)\X-Rite\Devices\Services\xritedeviced.exe [x]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys;c:\windows\SYSNATIVE\DRIVERS\5U877.sys [x]
S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys;c:\windows\SYSNATIVE\DRIVERS\CAXHWAZL.sys [x]
S3 ecnssndis; Mobile Broadband Driver;c:\windows\system32\Drivers\wwuss64.sys;c:\windows\SYSNATIVE\Drivers\wwuss64.sys [x]
S3 ecnssndisfltr; Mobile Broadband Driver Filter;c:\windows\system32\Drivers\wwussf64.sys;c:\windows\SYSNATIVE\Drivers\wwussf64.sys [x]
S3 l36wgps; Mobile Broadband GPS Port;c:\windows\system32\DRIVERS\l36wgps64.sys;c:\windows\SYSNATIVE\DRIVERS\l36wgps64.sys [x]
S3 Mbm3CBus;F5521gw Mobile Broadband Device (WDM);c:\windows\system32\DRIVERS\Mbm3CBus.sys;c:\windows\SYSNATIVE\DRIVERS\Mbm3CBus.sys [x]
S3 Mbm3DevMt; Mobile Broadband Device Management Driver (WDM);c:\windows\system32\DRIVERS\Mbm3DevMt.sys;c:\windows\SYSNATIVE\DRIVERS\Mbm3DevMt.sys [x]
S3 Mbm3mdfl; Mobile Broadband Modem Port Filter;c:\windows\system32\DRIVERS\Mbm3mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\Mbm3mdfl.sys [x]
S3 Mbm3Mdm; Mobile Broadband Modem Port Driver;c:\windows\system32\DRIVERS\Mbm3Mdm.sys;c:\windows\SYSNATIVE\DRIVERS\Mbm3Mdm.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys;c:\windows\SYSNATIVE\DRIVERS\Tvti2c.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-24 15:22]
.
2011-09-09 c:\windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:06]
.
2014-10-02 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:06]
.
2014-10-02 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:06]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"="TpShocks.exe" [2011-03-29 380776]
"ForteConfig"="c:\program files\Conexant\ForteConfig\fmapp.exe" [2010-10-26 49056]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2011-05-31 40808]
"ALCKRESI.EXE"="c:\program files\Lenovo\AutoLock\ALCKRESI.EXE" [2011-07-13 281960]
"AcWin7Hlpr"="c:\program files (x86)\Lenovo\Access Connections\AcTBenabler.exe" [2014-03-14 63832]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-13 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-10 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-10 418840]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://lenovo.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.179.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?src=tb&tbid=HFA5&Lan={dfltLng}&gu=a053ba6f3eae4da2947e5617e06943c6 [INSTALLTOOLBAR] [SETSEARCH] [SETHOME]&tu=10GXy00EU1D13P0&sku=&tstsId=&ver=&&q=
FF - user.js: extensions.zonealarm.id - 28637ecf0000000000000024d7c74c78
FF - user.js: extensions.zonealarm.appId - {C56C48A0-DA4E-46F6-9859-1553DC865F84}
FF - user.js: extensions.zonealarm.instlDay - 16238
FF - user.js: extensions.zonealarm.vrsn - 1.8.29.17
FF - user.js: extensions.zonealarm.vrsni - 1.8.29.17
FF - user.js: extensions.zonealarm.vrsnTs - 1.8.29.1722:52
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1025
FF - user.js: extensions.zonealarm.smplGrp - NewUSR
FF - user.js: extensions.zonealarm.tlbrId - HFA5
FF - user.js: extensions.zonealarm.instlRef - ZLN22602552235231-1001
FF - user.js: extensions.zonealarm.dfltLng - DE
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.ffxUnstlRst - false
FF - user.js: extensions.zonealarm.admin - false
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm.rvrt - false
FF - user.js: extensions.zonealarm.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
c:\program files (x86)\Lenovo\Access Connections\AcSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\progra~1\Lenovo\Zoom\TPSCREX.EXE
c:\progra~1\Lenovo\HOTKEY\TPONSCR.EXE
c:\progra~1\LENOVO\VIRTSCRL\virtscrl.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
c:\windows\SysWOW64\SAsrv.exe
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
c:\program files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-10-02 22:30:13 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2014-10-02 20:30
.
Vor Suchlauf: 12 Verzeichnis(se), 446.924.357.632 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 449.358.299.136 Bytes frei
.
- - End Of File - - 707E64C4BD48216E28093B4A11E98911
|
|
02.10.2014, 21:44
| #9 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Bitte ein Log mit dem Tool von Kaspersky: Downloade dir bitte  TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.10.2014, 22:01
| #10 |
| | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter TDSSKiller hat nichts gefunden: Code:
ATTFilter 22:56:19.0447 0x1b3c TDSS rootkit removing tool 3.0.0.40 Jul 10 2014 12:37:58
22:57:00.0773 0x1b3c ============================================================
22:57:00.0773 0x1b3c Current date / time: 2014/10/02 22:57:00.0763
22:57:00.0773 0x1b3c SystemInfo:
22:57:00.0773 0x1b3c
22:57:00.0773 0x1b3c OS Version: 6.1.7601 ServicePack: 1.0
22:57:00.0773 0x1b3c Product type: Workstation
22:57:00.0773 0x1b3c ComputerName: W520
22:57:00.0773 0x1b3c UserName: Admin
22:57:00.0773 0x1b3c Windows directory: C:\Windows
22:57:00.0773 0x1b3c System windows directory: C:\Windows
22:57:00.0773 0x1b3c Running under WOW64
22:57:00.0773 0x1b3c Processor architecture: Intel x64
22:57:00.0773 0x1b3c Number of processors: 4
22:57:00.0773 0x1b3c Page size: 0x1000
22:57:00.0773 0x1b3c Boot type: Normal boot
22:57:00.0773 0x1b3c ============================================================
22:57:00.0903 0x1b3c KLMD registered as C:\Windows\system32\drivers\91978147.sys
22:57:01.0303 0x1b3c System UUID: {4A5A2BAE-9B7E-AB9D-1FF3-0009BFD34506}
22:57:01.0633 0x1b3c Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 ( 698.64 Gb ), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
22:57:01.0643 0x1b3c ============================================================
22:57:01.0643 0x1b3c \Device\Harddisk0\DR0:
22:57:01.0643 0x1b3c MBR partitions:
22:57:01.0643 0x1b3c \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x258000
22:57:01.0643 0x1b3c \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x258800, BlocksNum 0x54404000
22:57:01.0643 0x1b3c \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x5465C800, BlocksNum 0x2EE9800
22:57:01.0643 0x1b3c ============================================================
22:57:01.0653 0x1b3c C: <-> \Device\Harddisk0\DR0\Partition2
22:57:01.0703 0x1b3c Q: <-> \Device\Harddisk0\DR0\Partition3
22:57:01.0703 0x1b3c ============================================================
22:57:01.0703 0x1b3c Initialize success
22:57:01.0703 0x1b3c ============================================================
22:58:03.0723 0x1448 ============================================================
22:58:03.0723 0x1448 Scan started
22:58:03.0723 0x1448 Mode: Manual; SigCheck; TDLFS;
22:58:03.0723 0x1448 ============================================================
22:58:03.0723 0x1448 KSN ping started
22:58:23.0933 0x1448 KSN ping finished: true
22:58:24.0643 0x1448 ================ Scan system memory ========================
22:58:24.0643 0x1448 System memory - ok
22:58:24.0643 0x1448 ================ Scan services =============================
22:58:24.0823 0x1448 [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci C:\Windows\system32\DRIVERS\1394ohci.sys
22:58:24.0923 0x1448 1394ohci - ok
22:58:24.0983 0x1448 [ F4AF97702BAD85BFEF64B9A557F11B6F, 8255B2FBE64C60562A7DAAAD575EED49EE0D23DD42E5C76C988B8A3673843EA6 ] 5U877 C:\Windows\system32\DRIVERS\5U877.sys
22:58:25.0033 0x1448 5U877 - ok
22:58:25.0063 0x1448 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI C:\Windows\system32\drivers\ACPI.sys
22:58:25.0083 0x1448 ACPI - ok
22:58:25.0103 0x1448 [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
22:58:25.0123 0x1448 AcpiPmi - ok
22:58:25.0203 0x1448 [ 81FDE4250DA1720657A42C2020B1AA28, 0E35C692347A576B41ADC45D922AF6B9F0A7F857E94A50842873A55D21F4C9D0 ] AcPrfMgrSvc C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
22:58:25.0233 0x1448 AcPrfMgrSvc - ok
22:58:25.0253 0x1448 [ 01A8EAA10F8B827F59CF506A97EC37C0, 44351082300A5B3A90F742F5C39AFF219D5FCF2F94CA7785DB2762AEB854212E ] AcSvc C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
22:58:25.0263 0x1448 AcSvc - ok
22:58:25.0323 0x1448 [ 11A52CF7B265631DEEB24C6149309EFF, CBA25D358185FD4BE261C6C1B518AD60F5D27D5FB418098AB262B10F5A11C178 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
22:58:25.0353 0x1448 AdobeARMservice - ok
22:58:25.0493 0x1448 [ FBB312C9DA3863673EC18F4AE4101778, 4E9AAE7C700E485C17FDFCC9100A79784673B006D00D4D4CE8F1DB617D25C864 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
22:58:25.0513 0x1448 AdobeFlashPlayerUpdateSvc - ok
22:58:25.0563 0x1448 [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
22:58:25.0603 0x1448 adp94xx - ok
22:58:25.0633 0x1448 [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci C:\Windows\system32\drivers\adpahci.sys
22:58:25.0653 0x1448 adpahci - ok
22:58:25.0653 0x1448 [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
22:58:25.0663 0x1448 adpu320 - ok
22:58:25.0683 0x1448 [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
22:58:25.0713 0x1448 AeLookupSvc - ok
22:58:25.0773 0x1448 [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD C:\Windows\system32\drivers\afd.sys
22:58:25.0803 0x1448 AFD - ok
22:58:25.0823 0x1448 [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440 C:\Windows\system32\drivers\agp440.sys
22:58:25.0833 0x1448 agp440 - ok
22:58:25.0843 0x1448 [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG C:\Windows\System32\alg.exe
22:58:25.0863 0x1448 ALG - ok
22:58:25.0903 0x1448 [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide C:\Windows\system32\drivers\aliide.sys
22:58:25.0923 0x1448 aliide - ok
22:58:25.0943 0x1448 [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide C:\Windows\system32\drivers\amdide.sys
22:58:25.0953 0x1448 amdide - ok
22:58:25.0963 0x1448 [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
22:58:25.0973 0x1448 AmdK8 - ok
22:58:25.0993 0x1448 [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
22:58:26.0003 0x1448 AmdPPM - ok
22:58:26.0023 0x1448 [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata C:\Windows\system32\drivers\amdsata.sys
22:58:26.0033 0x1448 amdsata - ok
22:58:26.0053 0x1448 [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
22:58:26.0063 0x1448 amdsbs - ok
22:58:26.0073 0x1448 [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata C:\Windows\system32\drivers\amdxata.sys
22:58:26.0083 0x1448 amdxata - ok
22:58:26.0163 0x1448 [ 0327A6CE0934C324E3E82920E9EC0EE4, B4A1E6A77032F7DF97FED3C01E76E2BD3270A3FFC500C7C9A118C0E2EB675D75 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
22:58:26.0183 0x1448 AntiVirSchedulerService - ok
22:58:26.0203 0x1448 [ 0327A6CE0934C324E3E82920E9EC0EE4, B4A1E6A77032F7DF97FED3C01E76E2BD3270A3FFC500C7C9A118C0E2EB675D75 ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
22:58:26.0213 0x1448 AntiVirService - ok
22:58:26.0253 0x1448 [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID C:\Windows\system32\drivers\appid.sys
22:58:26.0323 0x1448 AppID - ok
22:58:26.0333 0x1448 [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc C:\Windows\System32\appidsvc.dll
22:58:26.0383 0x1448 AppIDSvc - ok
22:58:26.0403 0x1448 [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo C:\Windows\System32\appinfo.dll
22:58:26.0443 0x1448 Appinfo - ok
22:58:26.0483 0x1448 [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt C:\Windows\System32\appmgmts.dll
22:58:26.0533 0x1448 AppMgmt - ok
22:58:26.0563 0x1448 [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc C:\Windows\system32\drivers\arc.sys
22:58:26.0583 0x1448 arc - ok
22:58:26.0603 0x1448 [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas C:\Windows\system32\drivers\arcsas.sys
22:58:26.0613 0x1448 arcsas - ok
22:58:26.0723 0x1448 [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
22:58:26.0743 0x1448 aspnet_state - ok
22:58:26.0763 0x1448 [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
22:58:26.0793 0x1448 AsyncMac - ok
22:58:26.0843 0x1448 [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi C:\Windows\system32\drivers\atapi.sys
22:58:26.0853 0x1448 atapi - ok
22:58:26.0913 0x1448 [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
22:58:26.0963 0x1448 AudioEndpointBuilder - ok
22:58:26.0993 0x1448 [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv C:\Windows\System32\Audiosrv.dll
22:58:27.0023 0x1448 AudioSrv - ok
22:58:27.0063 0x1448 [ 4663C5AD76FE8E19592DE808156FA07D, 605827B4A9D6930BC752D124BF75D55D4927B0ABEF881CDE66F3C5CC1DB215FE ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
22:58:27.0093 0x1448 avgntflt - ok
22:58:27.0103 0x1448 [ 8902AEC2382A37E9E99A4E0D52DBD42B, 138F2D7E7430132B2C527D413BC845CC467F084F39C232EC3A17DD2A74EE401E ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
22:58:27.0113 0x1448 avipbb - ok
22:58:27.0203 0x1448 [ 05ABC09DC0DFA5DF79A0BB39F60636B7, FEDE900D991F1FB40BA0A44E05181A6A506DC8B5F365E78E523CB6DF2CDACC15 ] Avira.OE.ServiceHost C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
22:58:27.0223 0x1448 Avira.OE.ServiceHost - ok
22:58:27.0233 0x1448 [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
22:58:27.0243 0x1448 avkmgr - ok
22:58:27.0293 0x1448 [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV C:\Windows\System32\AxInstSV.dll
22:58:27.0323 0x1448 AxInstSV - ok
22:58:27.0383 0x1448 [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
22:58:27.0443 0x1448 b06bdrv - ok
22:58:27.0473 0x1448 [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
22:58:27.0503 0x1448 b57nd60a - ok
22:58:27.0533 0x1448 [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC C:\Windows\System32\bdesvc.dll
22:58:27.0563 0x1448 BDESVC - ok
22:58:27.0573 0x1448 [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep C:\Windows\system32\drivers\Beep.sys
22:58:27.0603 0x1448 Beep - ok
22:58:27.0643 0x1448 [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE C:\Windows\System32\bfe.dll
22:58:27.0683 0x1448 BFE - ok
22:58:27.0723 0x1448 [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS C:\Windows\system32\qmgr.dll
22:58:27.0763 0x1448 BITS - ok
22:58:27.0793 0x1448 [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
22:58:27.0803 0x1448 blbdrive - ok
22:58:27.0823 0x1448 [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
22:58:27.0843 0x1448 bowser - ok
22:58:27.0873 0x1448 [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
22:58:27.0903 0x1448 BrFiltLo - ok
22:58:27.0903 0x1448 [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
22:58:27.0913 0x1448 BrFiltUp - ok
22:58:27.0943 0x1448 [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP C:\Windows\system32\DRIVERS\bridge.sys
22:58:27.0963 0x1448 BridgeMP - ok
22:58:27.0993 0x1448 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser C:\Windows\System32\browser.dll
22:58:28.0003 0x1448 Browser - ok
22:58:28.0013 0x1448 [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid C:\Windows\System32\Drivers\Brserid.sys
22:58:28.0053 0x1448 Brserid - ok
22:58:28.0073 0x1448 [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
22:58:28.0083 0x1448 BrSerWdm - ok
22:58:28.0103 0x1448 [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
22:58:28.0113 0x1448 BrUsbMdm - ok
22:58:28.0123 0x1448 [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
22:58:28.0123 0x1448 BrUsbSer - ok
22:58:28.0163 0x1448 [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
22:58:28.0213 0x1448 BthEnum - ok
22:58:28.0243 0x1448 [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
22:58:28.0263 0x1448 BTHMODEM - ok
22:58:28.0283 0x1448 [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
22:58:28.0313 0x1448 BthPan - ok
22:58:28.0383 0x1448 [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
22:58:28.0463 0x1448 BTHPORT - ok
22:58:28.0493 0x1448 [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv C:\Windows\system32\bthserv.dll
22:58:28.0553 0x1448 bthserv - ok
22:58:28.0573 0x1448 [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
22:58:28.0583 0x1448 BTHUSB - ok
22:58:28.0653 0x1448 [ 8834F87A6A745872894DF8223201A6C3, B8C26E11EAAB4A93E4241B4B6F00C1CA05501011E28D6A06D4B009BA4E3AB7CD ] BTWAMPFL C:\Windows\system32\DRIVERS\btwampfl.sys
22:58:28.0683 0x1448 BTWAMPFL - ok
22:58:28.0703 0x1448 [ 9863D82ECBEC6106D377ED73680D99D8, 27DA7335BB14BBF9DC627C8F97ED59BA3479E5E084704AE4C16B1A3E67CB184C ] btwaudio C:\Windows\system32\drivers\btwaudio.sys
22:58:28.0723 0x1448 btwaudio - ok
22:58:28.0733 0x1448 [ 3432DD66AE75AB2DE6D0527AD78DBFC7, C2DEB409CDA3621E33E429E592A81E09095C52CDCE36732C9BEA00B92994E44D ] btwavdt C:\Windows\system32\DRIVERS\btwavdt.sys
22:58:28.0743 0x1448 btwavdt - ok
22:58:28.0833 0x1448 [ EB4AFE08FB39BB444F221D7D501E0915, 2AF8ECEEAB5A0E972660C1553B555E49C49F19500ABD67DFEB9BEBA7E577A700 ] btwdins C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
22:58:28.0863 0x1448 btwdins - ok
22:58:28.0883 0x1448 [ 382DC5A631CED0462EA09B7EB898BDBF, 7457145E194310F4EB9273471EA41100D3A1448BC2A366064B25A212B389AACB ] btwl2cap C:\Windows\system32\DRIVERS\btwl2cap.sys
22:58:28.0883 0x1448 btwl2cap - ok
22:58:28.0903 0x1448 [ 13A9C2CEDD44C175E6CA39A536795CA6, 13D6D24C2127E6A5E9AB2DFAA9729D57AA6CFCC72DFACF78E4DE7E63ABA122DF ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys
22:58:28.0903 0x1448 btwrchid - ok
22:58:28.0933 0x1448 catchme - ok
22:58:28.0983 0x1448 [ 48360B88C4BF45850653BB7C86888ED4, 454C2DD81BFCC7FF4819CDFE3C5506E31A3FE86B06FB18009783CD2FEA74B0BF ] CAXHWAZL C:\Windows\system32\DRIVERS\CAXHWAZL.sys
22:58:29.0023 0x1448 CAXHWAZL - ok
22:58:29.0043 0x1448 [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
22:58:29.0083 0x1448 cdfs - ok
22:58:29.0113 0x1448 [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
22:58:29.0133 0x1448 cdrom - ok
22:58:29.0173 0x1448 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc C:\Windows\System32\certprop.dll
22:58:29.0233 0x1448 CertPropSvc - ok
22:58:29.0253 0x1448 [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass C:\Windows\system32\drivers\circlass.sys
22:58:29.0273 0x1448 circlass - ok
22:58:29.0283 0x1448 [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS C:\Windows\system32\CLFS.sys
22:58:29.0303 0x1448 CLFS - ok
22:58:29.0373 0x1448 [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:58:29.0403 0x1448 clr_optimization_v2.0.50727_32 - ok
22:58:29.0433 0x1448 [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
22:58:29.0463 0x1448 clr_optimization_v2.0.50727_64 - ok
22:58:29.0513 0x1448 [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:58:29.0523 0x1448 clr_optimization_v4.0.30319_32 - ok
22:58:29.0553 0x1448 [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
22:58:29.0563 0x1448 clr_optimization_v4.0.30319_64 - ok
22:58:29.0583 0x1448 [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
22:58:29.0593 0x1448 CmBatt - ok
22:58:29.0603 0x1448 [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide C:\Windows\system32\drivers\cmdide.sys
22:58:29.0613 0x1448 cmdide - ok
22:58:29.0673 0x1448 [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG C:\Windows\system32\Drivers\cng.sys
22:58:29.0703 0x1448 CNG - ok
22:58:29.0793 0x1448 [ 5BEC441B6B91E874C987C06F98176D90, FA4B523271947AE908C41BA2ABB1E4871359C8DE21E0ECC2B4CD49F734EF8FB4 ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT64.sys
22:58:29.0833 0x1448 CnxtHdAudService - ok
22:58:29.0863 0x1448 [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
22:58:29.0873 0x1448 Compbatt - ok
22:58:29.0893 0x1448 [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
22:58:29.0923 0x1448 CompositeBus - ok
22:58:29.0933 0x1448 COMSysApp - ok
22:58:29.0943 0x1448 [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
22:58:29.0953 0x1448 crcdisk - ok
22:58:30.0013 0x1448 [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc C:\Windows\system32\cryptsvc.dll
22:58:30.0033 0x1448 CryptSvc - ok
22:58:30.0053 0x1448 [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC C:\Windows\system32\drivers\csc.sys
22:58:30.0083 0x1448 CSC - ok
22:58:30.0153 0x1448 [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService C:\Windows\System32\cscsvc.dll
22:58:30.0193 0x1448 CscService - ok
22:58:30.0223 0x1448 [ 9D0D050170D47E778B624A28C90F23DE, 48528AA9EB0C9FB5086D992EF1F9556C8249D267C2E3D4E681D5C8B6BC316C71 ] CxAudMsg C:\Windows\system32\CxAudMsg64.exe
22:58:30.0233 0x1448 CxAudMsg - ok
22:58:30.0263 0x1448 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch C:\Windows\system32\rpcss.dll
22:58:30.0293 0x1448 DcomLaunch - ok
22:58:30.0313 0x1448 [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc C:\Windows\System32\defragsvc.dll
22:58:30.0343 0x1448 defragsvc - ok
22:58:30.0343 0x1448 [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC C:\Windows\system32\Drivers\dfsc.sys
22:58:30.0383 0x1448 DfsC - ok
22:58:30.0443 0x1448 [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp C:\Windows\system32\dhcpcore.dll
22:58:30.0503 0x1448 Dhcp - ok
22:58:30.0513 0x1448 [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache C:\Windows\system32\drivers\discache.sys
22:58:30.0533 0x1448 discache - ok
22:58:30.0563 0x1448 [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk C:\Windows\system32\drivers\disk.sys
22:58:30.0563 0x1448 Disk - ok
22:58:30.0573 0x1448 [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc C:\Windows\system32\drivers\dmvsc.sys
22:58:30.0593 0x1448 dmvsc - ok
22:58:30.0623 0x1448 [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache C:\Windows\System32\dnsrslvr.dll
22:58:30.0653 0x1448 Dnscache - ok
22:58:30.0673 0x1448 [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc C:\Windows\System32\dot3svc.dll
22:58:30.0703 0x1448 dot3svc - ok
22:58:30.0783 0x1448 [ 7719FB1A82B2972B1F326AD2F80C2606, CF63DB41327D8531C5D808F885BD55F58C3619395EA69F0C29EE72B870D960DD ] DozeSvc C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
22:58:30.0813 0x1448 DozeSvc - ok
22:58:30.0853 0x1448 [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS C:\Windows\system32\dps.dll
22:58:30.0893 0x1448 DPS - ok
22:58:30.0923 0x1448 [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
22:58:30.0943 0x1448 drmkaud - ok
22:58:31.0013 0x1448 [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
22:58:31.0043 0x1448 DXGKrnl - ok
22:58:31.0083 0x1448 [ CE4CFFD9F64B86BCEB1C343FC9924D72, A7E03531661C808F34560765136E1912A1389C459BA996880761539F4967056E ] DzHDD64 C:\Windows\system32\DRIVERS\DzHDD64.sys
22:58:31.0103 0x1448 DzHDD64 - ok
22:58:31.0173 0x1448 [ 23B6F8081F5C7AF1343810641EE0DD58, 571EF6BC76C062AF0FC696213638831EBC90B056B353AD440B01CA17E0D5B1B7 ] e1cexpress C:\Windows\system32\DRIVERS\e1c62x64.sys
22:58:31.0193 0x1448 e1cexpress - ok
22:58:31.0203 0x1448 [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost C:\Windows\System32\eapsvc.dll
22:58:31.0243 0x1448 EapHost - ok
22:58:31.0363 0x1448 [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv C:\Windows\system32\drivers\evbda.sys
22:58:31.0523 0x1448 ebdrv - ok
22:58:31.0543 0x1448 [ F88F2E5806FC405B0FA94B7947A5875E, 292DA82C308C9F9775DF4E2C8FDE726D4BA6B224049C113809422EDE07919248 ] ecnssndis C:\Windows\system32\Drivers\wwuss64.sys
22:58:31.0553 0x1448 ecnssndis - ok
22:58:31.0563 0x1448 [ C8CD88218EFC28F7E44A9892B3E97F4D, 3C84997B657808BBE1A9B9AD5EB8E1900ED703D67C3CE66F85BA0BADDA616CD8 ] ecnssndisfltr C:\Windows\system32\Drivers\wwussf64.sys
22:58:31.0573 0x1448 ecnssndisfltr - ok
22:58:31.0613 0x1448 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS C:\Windows\System32\lsass.exe
22:58:31.0633 0x1448 EFS - ok
22:58:31.0683 0x1448 [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
22:58:31.0763 0x1448 ehRecvr - ok
22:58:31.0773 0x1448 [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched C:\Windows\ehome\ehsched.exe
22:58:31.0793 0x1448 ehSched - ok
22:58:31.0833 0x1448 [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor C:\Windows\system32\drivers\elxstor.sys
22:58:31.0853 0x1448 elxstor - ok
22:58:31.0913 0x1448 [ A7E8186E04F38E836C19AC147F8B2ED0, 329639595F02060C215A6334FCE1651FB9B9B5679BA9052A487B57265608D162 ] EPSON_PM_RPCV4_05 C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
22:58:31.0943 0x1448 EPSON_PM_RPCV4_05 - ok
22:58:31.0963 0x1448 [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev C:\Windows\system32\drivers\errdev.sys
22:58:31.0983 0x1448 ErrDev - ok
22:58:32.0033 0x1448 [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem C:\Windows\system32\es.dll
22:58:32.0073 0x1448 EventSystem - ok
22:58:32.0203 0x1448 [ 54FC81B0162478A72A93DBBEAFB35671, 1C0FA242E81105E2BB839ED32119DAF012FA4A3DB5D0E079350449CBB0CBF033 ] EvtEng C:\Program Files\Intel\WiFi\bin\EvtEng.exe
22:58:32.0243 0x1448 EvtEng - ok
22:58:32.0293 0x1448 [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat C:\Windows\system32\drivers\exfat.sys
22:58:32.0363 0x1448 exfat - ok
22:58:32.0383 0x1448 [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat C:\Windows\system32\drivers\fastfat.sys
22:58:32.0413 0x1448 fastfat - ok
22:58:32.0463 0x1448 [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax C:\Windows\system32\fxssvc.exe
22:58:32.0523 0x1448 Fax - ok
22:58:32.0533 0x1448 [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc C:\Windows\system32\drivers\fdc.sys
22:58:32.0563 0x1448 fdc - ok
22:58:32.0573 0x1448 [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost C:\Windows\system32\fdPHost.dll
22:58:32.0593 0x1448 fdPHost - ok
22:58:32.0603 0x1448 [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub C:\Windows\system32\fdrespub.dll
22:58:32.0633 0x1448 FDResPub - ok
22:58:32.0643 0x1448 [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
22:58:32.0653 0x1448 FileInfo - ok
22:58:32.0653 0x1448 [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
22:58:32.0753 0x1448 Filetrace - ok
22:58:32.0773 0x1448 [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
22:58:32.0783 0x1448 flpydisk - ok
22:58:32.0793 0x1448 [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
22:58:32.0813 0x1448 FltMgr - ok
22:58:32.0923 0x1448 [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache C:\Windows\system32\FntCache.dll
22:58:33.0003 0x1448 FontCache - ok
22:58:33.0053 0x1448 [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
22:58:33.0073 0x1448 FontCache3.0.0.0 - ok
22:58:33.0083 0x1448 [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
22:58:33.0103 0x1448 FsDepends - ok
22:58:33.0103 0x1448 [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
22:58:33.0123 0x1448 Fs_Rec - ok
22:58:33.0143 0x1448 [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
22:58:33.0153 0x1448 fvevol - ok
22:58:33.0183 0x1448 [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
22:58:33.0183 0x1448 gagp30kx - ok
22:58:33.0213 0x1448 [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc C:\Windows\System32\gpsvc.dll
22:58:33.0263 0x1448 gpsvc - ok
22:58:33.0283 0x1448 [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
22:58:33.0303 0x1448 hcw85cir - ok
22:58:33.0333 0x1448 [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
22:58:33.0363 0x1448 HdAudAddService - ok
22:58:33.0373 0x1448 [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
22:58:33.0403 0x1448 HDAudBus - ok
22:58:33.0413 0x1448 [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
22:58:33.0433 0x1448 HidBatt - ok
22:58:33.0433 0x1448 [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth C:\Windows\system32\drivers\hidbth.sys
22:58:33.0453 0x1448 HidBth - ok
22:58:33.0463 0x1448 [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr C:\Windows\system32\drivers\hidir.sys
22:58:33.0473 0x1448 HidIr - ok
22:58:33.0493 0x1448 [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv C:\Windows\System32\hidserv.dll
22:58:33.0513 0x1448 hidserv - ok
22:58:33.0543 0x1448 [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys
22:58:33.0553 0x1448 HidUsb - ok
22:58:33.0573 0x1448 [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc C:\Windows\system32\kmsvc.dll
22:58:33.0603 0x1448 hkmsvc - ok
22:58:33.0613 0x1448 [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
22:58:33.0633 0x1448 HomeGroupListener - ok
22:58:33.0663 0x1448 [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
22:58:33.0683 0x1448 HomeGroupProvider - ok
22:58:33.0713 0x1448 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
22:58:33.0723 0x1448 HpSAMD - ok
22:58:33.0843 0x1448 [ 447256D1C026654C5CD3CC17E7B20631, F89589AC17BC50483E6687963370937E6CD19D6030F30D70577A7DA266116919 ] HsfXAudioService C:\Windows\SysWOW64\XAudio64.dll
22:58:33.0893 0x1448 HsfXAudioService - ok
22:58:33.0943 0x1448 [ F6AC1087A131FBB385400667BEA64FBE, 131661287953708893FE564602E8ED6832B96CCA523C205EDE0C9E82DD930178 ] HSF_DPV C:\Windows\system32\DRIVERS\CAX_DPV.sys
22:58:34.0003 0x1448 HSF_DPV - ok
22:58:34.0043 0x1448 [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP C:\Windows\system32\drivers\HTTP.sys
22:58:34.0103 0x1448 HTTP - ok
22:58:34.0103 0x1448 [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
22:58:34.0113 0x1448 hwpolicy - ok
22:58:34.0213 0x1448 [ BB82D8E54C68154E3A0677541617DE6D, C58FE396FA66446A725820FE167EDE86B3616C7D9530DF4E1CD70A0B2293069D ] i1 Display Service C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe
22:58:34.0233 0x1448 i1 Display Service - detected UnsignedFile.Multi.Generic ( 1 )
22:58:36.0593 0x1448 Detect skipped due to KSN trusted
22:58:36.0593 0x1448 i1 Display Service - ok
22:58:36.0663 0x1448 [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
22:58:36.0693 0x1448 i8042prt - ok
22:58:36.0743 0x1448 [ CCFA835960E35F30D28A868E0B3B8722, 47D95E75685F9D40229902A92426FBCB358EA929202EAFBBF79C72873B8B9032 ] iaStor C:\Windows\system32\drivers\iaStor.sys
22:58:36.0773 0x1448 iaStor - ok
22:58:36.0833 0x1448 [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
22:58:36.0873 0x1448 iaStorV - ok
22:58:36.0903 0x1448 [ A9BD44426A69079240767FE4AEE0EA71, 5B1DE9ACFEADEDE92F2FA1531DE78A0C6D4057F2501FF7D72FC1F1BBD7400B58 ] IBMPMDRV C:\Windows\system32\DRIVERS\ibmpmdrv.sys
22:58:36.0923 0x1448 IBMPMDRV - ok
22:58:36.0943 0x1448 [ 57D4A3ED5497DB0C5A53E680A9BDD1C6, 55C94A0DAC11A4C13DE7DD924DEC1232EA31193F5650E2A55BC31DC0BC2F657F ] IBMPMSVC C:\Windows\system32\ibmpmsvc.exe
22:58:36.0943 0x1448 IBMPMSVC - ok
22:58:37.0003 0x1448 [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
22:58:37.0043 0x1448 idsvc - ok
22:58:37.0373 0x1448 [ 978D876A581D57E0DE6437674EB0014D, CDE6F41D75177F9A1F3AF6B576320B93906E33133FF8568FCB1148568FE78BF3 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
22:58:37.0773 0x1448 igfx - ok
22:58:37.0803 0x1448 [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp C:\Windows\system32\drivers\iirsp.sys
22:58:37.0813 0x1448 iirsp - ok
22:58:37.0863 0x1448 [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT C:\Windows\System32\ikeext.dll
22:58:37.0913 0x1448 IKEEXT - ok
22:58:37.0933 0x1448 [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide C:\Windows\system32\drivers\intelide.sys
22:58:37.0933 0x1448 intelide - ok
22:58:37.0963 0x1448 [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
22:58:37.0973 0x1448 intelppm - ok
22:58:37.0993 0x1448 [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum C:\Windows\system32\ipbusenum.dll
22:58:38.0023 0x1448 IPBusEnum - ok
22:58:38.0023 0x1448 [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:58:38.0063 0x1448 IpFilterDriver - ok
22:58:38.0153 0x1448 [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
22:58:38.0193 0x1448 iphlpsvc - ok
22:58:38.0213 0x1448 [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
22:58:38.0223 0x1448 IPMIDRV - ok
22:58:38.0223 0x1448 [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT C:\Windows\system32\drivers\ipnat.sys
22:58:38.0253 0x1448 IPNAT - ok
22:58:38.0273 0x1448 [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM C:\Windows\system32\drivers\irenum.sys
22:58:38.0293 0x1448 IRENUM - ok
22:58:38.0313 0x1448 [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp C:\Windows\system32\drivers\isapnp.sys
22:58:38.0313 0x1448 isapnp - ok
22:58:38.0343 0x1448 [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
22:58:38.0353 0x1448 iScsiPrt - ok
22:58:38.0443 0x1448 [ 6FAF199FDFFDD2376973143C3E012765, 0CDEAC0F8DEC5BDF1226ADBA665B37671D3FB4D6A5226B1526FDD5B5026F887F ] jhi_service C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
22:58:38.0473 0x1448 jhi_service - ok
22:58:38.0473 0x1448 [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
22:58:38.0483 0x1448 kbdclass - ok
22:58:38.0513 0x1448 [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
22:58:38.0553 0x1448 kbdhid - ok
22:58:38.0573 0x1448 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso C:\Windows\system32\lsass.exe
22:58:38.0583 0x1448 KeyIso - ok
22:58:38.0613 0x1448 [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
22:58:38.0633 0x1448 KSecDD - ok
22:58:38.0653 0x1448 [ 1C2D8E18AA8FD50CD04C15CC27F7F5AB, 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
22:58:38.0653 0x1448 KSecPkg - ok
22:58:38.0663 0x1448 [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
22:58:38.0683 0x1448 ksthunk - ok
22:58:38.0723 0x1448 [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm C:\Windows\system32\msdtckrm.dll
22:58:38.0763 0x1448 KtmRm - ok
22:58:38.0783 0x1448 [ F761A831C9DC8D0204B7FB43E3A896B7, 9739FC721C774C0C754D0E558D39A77FF8B976CC98C044CB4D16446A9AF3E0A1 ] l36wgps C:\Windows\system32\DRIVERS\l36wgps64.sys
22:58:38.0793 0x1448 l36wgps - ok
22:58:38.0813 0x1448 [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer C:\Windows\System32\srvsvc.dll
22:58:38.0843 0x1448 LanmanServer - ok
22:58:38.0863 0x1448 [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
22:58:38.0903 0x1448 LanmanWorkstation - ok
22:58:38.0963 0x1448 [ 56B74943929BC575914631EDC0E72220, 47AC85C1837FB412AD08EB9E81411E3560826F978910A89354CF689B0BCDF78B ] LENOVO.CAMMUTE C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
22:58:38.0983 0x1448 LENOVO.CAMMUTE - ok
22:58:39.0043 0x1448 [ 128158D8B1DF639BF3E3FDBCBB64CDAC, F55DA8F202A8E81D4E8ABECCC1B7CE5162D6891A23278A8C664AA1EE9AE3C7CF ] LENOVO.MICMUTE C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
22:58:39.0063 0x1448 LENOVO.MICMUTE - ok
22:58:39.0093 0x1448 [ 2B9D8555DC004E240082D18E7725CE20, 9DEF9463CB099C0BC8782C1E5FCE62F038B971ABC12966774D1F83569B081A42 ] lenovo.smi C:\Windows\system32\DRIVERS\smiifx64.sys
22:58:39.0103 0x1448 lenovo.smi - ok
22:58:39.0123 0x1448 [ F9B51B2A5DA1222A910021C71E9EA559, 4B7040808828991B2C075B91E41E6AB03A50FADDCC477444A673B08FE77BE96A ] LENOVO.TPKNRSVC C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
22:58:39.0133 0x1448 LENOVO.TPKNRSVC - ok
22:58:39.0153 0x1448 [ 6F2CC57EB5836D2AC9BD37F3554D55F8, C877F63AACA68AD3505EC4A8B8916FA2E07C2CB29E74FA368A103F612E18499E ] Lenovo.VIRTSCRLSVC C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
22:58:39.0163 0x1448 Lenovo.VIRTSCRLSVC - ok
22:58:39.0183 0x1448 [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
22:58:39.0243 0x1448 lltdio - ok
22:58:39.0263 0x1448 [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc C:\Windows\System32\lltdsvc.dll
22:58:39.0303 0x1448 lltdsvc - ok
22:58:39.0333 0x1448 [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts C:\Windows\System32\lmhsvc.dll
22:58:39.0373 0x1448 lmhosts - ok
22:58:39.0413 0x1448 [ 97F9EAAC985A663394CD8F54DCD3E73A, D5BA3E7ED36BA361B1941F12D83568C30F7E49A8B9D54D3EBBBD05767E1F3B0A ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
22:58:39.0433 0x1448 LMS - ok
22:58:39.0453 0x1448 [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
22:58:39.0463 0x1448 LSI_FC - ok
22:58:39.0503 0x1448 [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
22:58:39.0513 0x1448 LSI_SAS - ok
22:58:39.0523 0x1448 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
22:58:39.0533 0x1448 LSI_SAS2 - ok
22:58:39.0543 0x1448 [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
22:58:39.0553 0x1448 LSI_SCSI - ok
22:58:39.0553 0x1448 [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv C:\Windows\system32\drivers\luafv.sys
22:58:39.0593 0x1448 luafv - ok
22:58:39.0643 0x1448 [ 1A243DAD23BB639D47F25AB9EC51FCAD, 596A9676F38730B520F36BDA964C555F31FD9CD1A45CD5280A534C6336E344AF ] mbamchameleon C:\Windows\system32\drivers\mbamchameleon.sys
22:58:39.0673 0x1448 mbamchameleon - ok
22:58:39.0713 0x1448 [ D8BA1ECBF0B9A4B4E1F3B7EB517D6C20, 9A72B2FAE2E39D1F7E73DD55888D30AAE46BDC5294A5EA558AF00CABF1C20D5B ] Mbm3CBus C:\Windows\system32\DRIVERS\Mbm3CBus.sys
22:58:39.0743 0x1448 Mbm3CBus - ok
22:58:39.0763 0x1448 [ 01E60917101B309E15F30DA26ACF64F6, 141BBBCA6A2E20A1AF242483F98E03401A956C691177EBCC1946D87736B42D59 ] Mbm3DevMt C:\Windows\system32\DRIVERS\Mbm3DevMt.sys
22:58:39.0783 0x1448 Mbm3DevMt - ok
22:58:39.0793 0x1448 [ 6350A2CA21FB7B14432EFFDC61863AED, C2C051E155455AD57219C1E8689B51D736FB50876BE10F3770B0560BF27C538B ] Mbm3mdfl C:\Windows\system32\DRIVERS\Mbm3mdfl.sys
22:58:39.0793 0x1448 Mbm3mdfl - ok
22:58:39.0823 0x1448 [ 9FC3A8713D148E15D0472E1C44DD0FDA, A36FF9787477E7D1F9C202B7D87A701114B76B6A796A89D6D199D351CC040622 ] Mbm3Mdm C:\Windows\system32\DRIVERS\Mbm3Mdm.sys
22:58:39.0833 0x1448 Mbm3Mdm - ok
22:58:39.0853 0x1448 [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
22:58:39.0873 0x1448 Mcx2Svc - ok
22:58:39.0893 0x1448 [ E4F44EC214B3E381E1FC844A02926666, 6EE8C87EFCEFFBEA08B9B9DA036B37564542EE4D31942115CDBF895295DD5FE2 ] mdmxsdk C:\Windows\system32\DRIVERS\mdmxsdk.sys
22:58:39.0903 0x1448 mdmxsdk - ok
22:58:39.0903 0x1448 [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas C:\Windows\system32\drivers\megasas.sys
22:58:39.0913 0x1448 megasas - ok
22:58:39.0933 0x1448 [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
22:58:39.0943 0x1448 MegaSR - ok
22:58:39.0963 0x1448 [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
22:58:39.0973 0x1448 MEIx64 - ok
22:58:40.0033 0x1448 Microsoft SharePoint Workspace Audit Service - ok
22:58:40.0073 0x1448 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS C:\Windows\system32\mmcss.dll
22:58:40.0123 0x1448 MMCSS - ok
22:58:40.0133 0x1448 [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem C:\Windows\system32\drivers\modem.sys
22:58:40.0163 0x1448 Modem - ok
22:58:40.0183 0x1448 [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor C:\Windows\system32\DRIVERS\monitor.sys
22:58:40.0193 0x1448 monitor - ok
22:58:40.0213 0x1448 [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
22:58:40.0223 0x1448 mouclass - ok
22:58:40.0233 0x1448 [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys
22:58:40.0253 0x1448 mouhid - ok
22:58:40.0263 0x1448 [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
22:58:40.0273 0x1448 mountmgr - ok
22:58:40.0323 0x1448 [ 707E98CC15C2224C078C9E71FF1889BC, 958416FE081436FDBF7F2BEBBB2795C54CC4F3F349D6DF463296A7BBA3404F13 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
22:58:40.0353 0x1448 MozillaMaintenance - ok
22:58:40.0363 0x1448 [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio C:\Windows\system32\drivers\mpio.sys
22:58:40.0383 0x1448 mpio - ok
22:58:40.0393 0x1448 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
22:58:40.0423 0x1448 mpsdrv - ok
22:58:40.0443 0x1448 [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc C:\Windows\system32\mpssvc.dll
22:58:40.0493 0x1448 MpsSvc - ok
22:58:40.0533 0x1448 [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
22:58:40.0573 0x1448 MRxDAV - ok
22:58:40.0633 0x1448 [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
22:58:40.0653 0x1448 mrxsmb - ok
22:58:40.0683 0x1448 [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:58:40.0723 0x1448 mrxsmb10 - ok
22:58:40.0753 0x1448 [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:58:40.0763 0x1448 mrxsmb20 - ok
22:58:40.0793 0x1448 [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci C:\Windows\system32\drivers\msahci.sys
22:58:40.0803 0x1448 msahci - ok
22:58:40.0813 0x1448 [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm C:\Windows\system32\drivers\msdsm.sys
22:58:40.0833 0x1448 msdsm - ok
22:58:40.0863 0x1448 [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC C:\Windows\System32\msdtc.exe
22:58:40.0893 0x1448 MSDTC - ok
22:58:40.0913 0x1448 [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs C:\Windows\system32\drivers\Msfs.sys
22:58:40.0943 0x1448 Msfs - ok
22:58:40.0963 0x1448 [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
22:58:40.0993 0x1448 mshidkmdf - ok
22:58:40.0993 0x1448 [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
22:58:41.0003 0x1448 msisadrv - ok
22:58:41.0023 0x1448 [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
22:58:41.0053 0x1448 MSiSCSI - ok
22:58:41.0053 0x1448 msiserver - ok
22:58:41.0073 0x1448 [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
22:58:41.0103 0x1448 MSKSSRV - ok
22:58:41.0143 0x1448 [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
22:58:41.0173 0x1448 MSPCLOCK - ok
22:58:41.0183 0x1448 [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
22:58:41.0203 0x1448 MSPQM - ok
22:58:41.0213 0x1448 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
22:58:41.0223 0x1448 MsRPC - ok
22:58:41.0233 0x1448 [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
22:58:41.0243 0x1448 mssmbios - ok
22:58:41.0253 0x1448 [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
22:58:41.0273 0x1448 MSTEE - ok
22:58:41.0283 0x1448 [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
22:58:41.0293 0x1448 MTConfig - ok
22:58:41.0293 0x1448 [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup C:\Windows\system32\Drivers\mup.sys
22:58:41.0303 0x1448 Mup - ok
22:58:41.0383 0x1448 [ 4BBB9D9C4DF259FAE2D172C5BB25DDD0, 165EE2AB6F989E8D48AA52121B608510E932106835DA43071CC6476630C012FE ] MyWiFiDHCPDNS C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
22:58:41.0433 0x1448 MyWiFiDHCPDNS - ok
22:58:41.0463 0x1448 [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent C:\Windows\system32\qagentRT.dll
22:58:41.0503 0x1448 napagent - ok
22:58:41.0543 0x1448 [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
22:58:41.0573 0x1448 NativeWifiP - ok
22:58:41.0673 0x1448 [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS C:\Windows\system32\drivers\ndis.sys
22:58:41.0703 0x1448 NDIS - ok
22:58:41.0733 0x1448 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
22:58:41.0753 0x1448 NdisCap - ok
22:58:41.0783 0x1448 [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
22:58:41.0803 0x1448 NdisTapi - ok
22:58:41.0813 0x1448 [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
22:58:41.0833 0x1448 Ndisuio - ok
22:58:41.0833 0x1448 [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
22:58:41.0873 0x1448 NdisWan - ok
22:58:41.0873 0x1448 [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
22:58:41.0913 0x1448 NDProxy - ok
22:58:41.0923 0x1448 [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
22:58:41.0953 0x1448 NetBIOS - ok
22:58:41.0963 0x1448 [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
22:58:41.0993 0x1448 NetBT - ok
22:58:42.0003 0x1448 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon C:\Windows\system32\lsass.exe
22:58:42.0013 0x1448 Netlogon - ok
22:58:42.0043 0x1448 [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman C:\Windows\System32\netman.dll
22:58:42.0073 0x1448 Netman - ok
22:58:42.0123 0x1448 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:58:42.0153 0x1448 NetMsmqActivator - ok
22:58:42.0183 0x1448 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:58:42.0203 0x1448 NetPipeActivator - ok
22:58:42.0233 0x1448 [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm C:\Windows\System32\netprofm.dll
22:58:42.0283 0x1448 netprofm - ok
22:58:42.0293 0x1448 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:58:42.0303 0x1448 NetTcpActivator - ok
22:58:42.0313 0x1448 [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:58:42.0323 0x1448 NetTcpPortSharing - ok
22:58:42.0563 0x1448 [ AC69618DE5BCCE8747C9AB0AAE1003C1, D975963FA338AB58684BE0556633F3A846D5360FAD1A5E11BB7A273474DFB64D ] NETwNs64 C:\Windows\system32\DRIVERS\NETwNs64.sys
22:58:42.0863 0x1448 NETwNs64 - ok
22:58:42.0893 0x1448 [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
22:58:42.0903 0x1448 nfrd960 - ok
22:58:42.0933 0x1448 [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc C:\Windows\System32\nlasvc.dll
22:58:42.0953 0x1448 NlaSvc - ok
22:58:42.0953 0x1448 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs C:\Windows\system32\drivers\Npfs.sys
22:58:42.0983 0x1448 Npfs - ok
22:58:42.0993 0x1448 [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi C:\Windows\system32\nsisvc.dll
22:58:43.0013 0x1448 nsi - ok
22:58:43.0023 0x1448 [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
22:58:43.0053 0x1448 nsiproxy - ok
22:58:43.0113 0x1448 [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
22:58:43.0153 0x1448 Ntfs - ok
22:58:43.0163 0x1448 [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null C:\Windows\system32\drivers\Null.sys
22:58:43.0183 0x1448 Null - ok
22:58:43.0203 0x1448 [ 69FCDECD0215195261EC5362AB4A1520, B1B1DBACC4641AC4A4520CDE736074468BC9B5605BD5DFB140D946A0DF810F08 ] nusb3hub C:\Windows\system32\DRIVERS\nusb3hub.sys
22:58:43.0213 0x1448 nusb3hub - ok
22:58:43.0243 0x1448 [ F813EA99DA158FB4079622D882873D63, 243DE756315C8652718871AB499DC3AEBA2A48438706CA37B3C46B02ED6DFF63 ] nusb3xhc C:\Windows\system32\DRIVERS\nusb3xhc.sys
22:58:43.0263 0x1448 nusb3xhc - ok
22:58:43.0323 0x1448 [ DC933C28D5A1595B042863F6A61ED86E, F71D9C24F9FF617ECC861419C077353D9464F17B3524582F4FA989951F51747F ] nvkflt C:\Windows\system32\DRIVERS\nvkflt.sys
22:58:43.0353 0x1448 nvkflt - ok
22:58:43.0683 0x1448 [ A51F78816F7F4B5862D9F6E0E0E588C4, 7634A83B60E7496651299690D766EA7AFF185437D3173D10D093ED71D2C13270 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys
22:58:43.0883 0x1448 nvlddmkm - ok
22:58:43.0943 0x1448 [ 88EE7DDE10562A71D995C37F88220281, 4C53B770C153AAD6C1BB27F5D738E94DCB6E1D3CB81615BECE30401B44BAD9E8 ] nvpciflt C:\Windows\system32\DRIVERS\nvpciflt.sys
22:58:43.0973 0x1448 nvpciflt - ok
22:58:44.0023 0x1448 [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid C:\Windows\system32\drivers\nvraid.sys
22:58:44.0053 0x1448 nvraid - ok
22:58:44.0103 0x1448 [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor C:\Windows\system32\drivers\nvstor.sys
22:58:44.0133 0x1448 nvstor - ok
22:58:44.0163 0x1448 [ 5DCB3AE42B3430EDAC80A42BB9BADEB6, FA57B03D10B6BB50D878F4720E30D3753622A711A6DF990FFA8875E409C4678A ] NVSvc C:\Windows\system32\nvvsvc.exe
22:58:44.0193 0x1448 NVSvc - ok
22:58:44.0293 0x1448 [ 05E0B6C24F94EBEB17958385B8C2F316, CCED36F94A6EB74A8FF0BA3A8E47D16530072000ECEE33FB0A5927B8ACEA464C ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
22:58:44.0343 0x1448 nvUpdatusService - ok
22:58:44.0363 0x1448 [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
22:58:44.0363 0x1448 nv_agp - ok
22:58:44.0373 0x1448 [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
22:58:44.0393 0x1448 ohci1394 - ok
22:58:44.0463 0x1448 [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
22:58:44.0483 0x1448 ose - ok
22:58:44.0693 0x1448 [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
22:58:44.0883 0x1448 osppsvc - ok
22:58:44.0913 0x1448 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
22:58:44.0963 0x1448 p2pimsvc - ok
22:58:44.0983 0x1448 [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc C:\Windows\system32\p2psvc.dll
22:58:45.0003 0x1448 p2psvc - ok
22:58:45.0013 0x1448 [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport C:\Windows\system32\drivers\parport.sys
22:58:45.0023 0x1448 Parport - ok
22:58:45.0053 0x1448 [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr C:\Windows\system32\drivers\partmgr.sys
22:58:45.0063 0x1448 partmgr - ok
22:58:45.0073 0x1448 [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc C:\Windows\System32\pcasvc.dll
22:58:45.0103 0x1448 PcaSvc - ok
22:58:45.0113 0x1448 [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci C:\Windows\system32\drivers\pci.sys
22:58:45.0123 0x1448 pci - ok
22:58:45.0163 0x1448 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide C:\Windows\system32\drivers\pciide.sys
22:58:45.0183 0x1448 pciide - ok
22:58:45.0213 0x1448 [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
22:58:45.0223 0x1448 pcmcia - ok
22:58:45.0223 0x1448 [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw C:\Windows\system32\drivers\pcw.sys
22:58:45.0233 0x1448 pcw - ok
22:58:45.0373 0x1448 [ F97DC1A5244469D367B1334D47118E34, A36B6C402F92BEBE14082296CBF5F69656ED87AB700789028799768FA1FE2A72 ] PDF Architect 2 C:\Program Files (x86)\PDF Architect 2\ws.exe
22:58:45.0423 0x1448 PDF Architect 2 - ok
22:58:45.0463 0x1448 [ E81F7D5371C95904D4105B06405D5EDA, A6A41793AC241801D37A95C25B2DA0C3CDDC804B4F2BD087ECBD30C562F3517B ] pdfforge CrashHandler C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe
22:58:45.0493 0x1448 pdfforge CrashHandler - ok
22:58:45.0513 0x1448 [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH C:\Windows\system32\drivers\peauth.sys
22:58:45.0563 0x1448 PEAUTH - ok
22:58:45.0603 0x1448 [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
22:58:45.0673 0x1448 PeerDistSvc - ok
22:58:45.0763 0x1448 [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost C:\Windows\SysWow64\perfhost.exe
22:58:45.0803 0x1448 PerfHost - ok
22:58:45.0893 0x1448 [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla C:\Windows\system32\pla.dll
22:58:45.0973 0x1448 pla - ok
22:58:46.0043 0x1448 [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
22:58:46.0103 0x1448 PlugPlay - ok
22:58:46.0153 0x1448 [ F485770EEC8959684CC4C4786B63C06C, 34ECC6D83782A2F8E9E32456F3C6C527999283775626C772D0354D232A10604A ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
22:58:46.0193 0x1448 Pml Driver HPZ12 - ok
22:58:46.0223 0x1448 [ 0BEE791C7C7ACE453C134E73633C497D, 82B30461DBF40AC15FCE6A83B9BAD2EBD05B27DEA1B784EAA096422FE8927B7B ] pmxdrv C:\Windows\system32\drivers\pmxdrv.sys
22:58:46.0233 0x1448 pmxdrv - ok
22:58:46.0243 0x1448 [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
22:58:46.0273 0x1448 PNRPAutoReg - ok
22:58:46.0303 0x1448 [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
22:58:46.0323 0x1448 PNRPsvc - ok
22:58:46.0353 0x1448 [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
22:58:46.0403 0x1448 PolicyAgent - ok
22:58:46.0413 0x1448 [ A2CCA4FB273E6050F17A0A416CFF2FCD, C42BA18DF0C8E3F7358669A784E51E4DC7A4112096345EA699EDC95F561E0255 ] Power C:\Windows\system32\umpo.dll
22:58:46.0443 0x1448 Power - ok
22:58:46.0513 0x1448 [ 7A1E6CF32EDFF1F13186997FCA086FC7, BD9BF58557046B535C59EE2DBFB887C317542A9EDB33BA07D5A151BC2CFA63C1 ] Power Manager DBC Service C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
22:58:46.0533 0x1448 Power Manager DBC Service - ok
22:58:46.0583 0x1448 [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
22:58:46.0643 0x1448 PptpMiniport - ok
22:58:46.0663 0x1448 [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor C:\Windows\system32\drivers\processr.sys
22:58:46.0703 0x1448 Processor - ok
22:58:46.0733 0x1448 [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc C:\Windows\system32\profsvc.dll
22:58:46.0773 0x1448 ProfSvc - ok
22:58:46.0783 0x1448 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
22:58:46.0793 0x1448 ProtectedStorage - ok
22:58:46.0823 0x1448 [ A70AD30223866947E39BC221DF4C2306, E1714080D6DDF966413311D8D2F7AFF57195BB681B1BE194DE2237DA7B05D7A6 ] psadd C:\Windows\system32\DRIVERS\psadd.sys
22:58:46.0833 0x1448 psadd - ok
22:58:46.0863 0x1448 [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched C:\Windows\system32\DRIVERS\pacer.sys
22:58:46.0923 0x1448 Psched - ok
22:58:46.0943 0x1448 [ F036CFB275D0C55F4E45FBBF5F98B3C8, D8D1CA9F65B34A93AB9F7FD9BB6C453B2BF4E8320E620F56055B743DF1D56DE8 ] PSI_SVC_2 C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
22:58:46.0953 0x1448 PSI_SVC_2 - ok
22:58:46.0963 0x1448 [ 20EFF1CA8922F6A834261B985550A51D, 20EC7A845CF3D6DEE6F208E782D12E091CC69D2944D28527A76C3DE7CDAB2502 ] PwmEWSvc C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE
22:58:46.0973 0x1448 PwmEWSvc - ok
22:58:47.0063 0x1448 [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
22:58:47.0113 0x1448 ql2300 - ok
22:58:47.0133 0x1448 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
22:58:47.0143 0x1448 ql40xx - ok
22:58:47.0173 0x1448 [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE C:\Windows\system32\qwave.dll
22:58:47.0183 0x1448 QWAVE - ok
22:58:47.0193 0x1448 [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
22:58:47.0213 0x1448 QWAVEdrv - ok
22:58:47.0223 0x1448 [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
22:58:47.0243 0x1448 RasAcd - ok
22:58:47.0273 0x1448 [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
22:58:47.0303 0x1448 RasAgileVpn - ok
22:58:47.0313 0x1448 [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto C:\Windows\System32\rasauto.dll
22:58:47.0353 0x1448 RasAuto - ok
22:58:47.0353 0x1448 [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
22:58:47.0383 0x1448 Rasl2tp - ok
22:58:47.0403 0x1448 [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan C:\Windows\System32\rasmans.dll
22:58:47.0433 0x1448 RasMan - ok
22:58:47.0433 0x1448 [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
22:58:47.0463 0x1448 RasPppoe - ok
22:58:47.0473 0x1448 [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
22:58:47.0493 0x1448 RasSstp - ok
22:58:47.0503 0x1448 [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
22:58:47.0533 0x1448 rdbss - ok
22:58:47.0553 0x1448 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
22:58:47.0563 0x1448 rdpbus - ok
22:58:47.0593 0x1448 [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
22:58:47.0613 0x1448 RDPCDD - ok
22:58:47.0613 0x1448 [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
22:58:47.0633 0x1448 RDPDR - ok
22:58:47.0643 0x1448 [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
22:58:47.0663 0x1448 RDPENCDD - ok
22:58:47.0693 0x1448 [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
22:58:47.0713 0x1448 RDPREFMP - ok
22:58:47.0753 0x1448 [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
22:58:47.0783 0x1448 RdpVideoMiniport - ok
22:58:47.0823 0x1448 [ E61608AA35E98999AF9AAEEEA6114B0A, F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6 ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
22:58:47.0913 0x1448 RDPWD - ok
22:58:47.0943 0x1448 [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
22:58:47.0973 0x1448 rdyboost - ok
22:58:48.0043 0x1448 [ A436F5E7D80BBDBB0826D0F176D5BEA8, 7862CE61F182C7613E34415C01AC1C228F79A45470CFD1D316DF2BD24EE09E3C ] RegSrvc C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
22:58:48.0063 0x1448 RegSrvc - ok
22:58:48.0083 0x1448 [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess C:\Windows\System32\mprdim.dll
22:58:48.0103 0x1448 RemoteAccess - ok
22:58:48.0133 0x1448 [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry C:\Windows\system32\regsvc.dll
22:58:48.0153 0x1448 RemoteRegistry - ok
22:58:48.0193 0x1448 [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
22:58:48.0213 0x1448 RFCOMM - ok
22:58:48.0253 0x1448 [ FF501F212E5D5A97F8339928320F269E, E148AD940FD274C8C5775F835C5E1FC61943BA648445C32432965B7B4AA5EA7E ] risdxc C:\Windows\system32\DRIVERS\risdxc64.sys
22:58:48.0273 0x1448 risdxc - ok
22:58:48.0273 0x1448 [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
22:58:48.0293 0x1448 RpcEptMapper - ok
22:58:48.0313 0x1448 [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator C:\Windows\system32\locator.exe
22:58:48.0323 0x1448 RpcLocator - ok
22:58:48.0333 0x1448 [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs C:\Windows\system32\rpcss.dll
22:58:48.0373 0x1448 RpcSs - ok
22:58:48.0383 0x1448 [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
22:58:48.0403 0x1448 rspndr - ok
22:58:48.0413 0x1448 [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap C:\Windows\system32\drivers\vms3cap.sys
22:58:48.0433 0x1448 s3cap - ok
22:58:48.0443 0x1448 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs C:\Windows\system32\lsass.exe
22:58:48.0453 0x1448 SamSs - ok
22:58:48.0453 0x1448 SAService - ok
22:58:48.0463 0x1448 [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
22:58:48.0473 0x1448 sbp2port - ok
22:58:48.0483 0x1448 [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr C:\Windows\System32\SCardSvr.dll
22:58:48.0523 0x1448 SCardSvr - ok
22:58:48.0523 0x1448 [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
22:58:48.0553 0x1448 scfilter - ok
22:58:48.0583 0x1448 [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule C:\Windows\system32\schedsvc.dll
22:58:48.0633 0x1448 Schedule - ok
22:58:48.0653 0x1448 [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc C:\Windows\System32\certprop.dll
22:58:48.0683 0x1448 SCPolicySvc - ok
22:58:48.0693 0x1448 [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC C:\Windows\System32\SDRSVC.dll
22:58:48.0713 0x1448 SDRSVC - ok
22:58:48.0723 0x1448 [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv C:\Windows\system32\drivers\secdrv.sys
22:58:48.0753 0x1448 secdrv - ok
22:58:48.0753 0x1448 [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon C:\Windows\system32\seclogon.dll
22:58:48.0783 0x1448 seclogon - ok
22:58:48.0793 0x1448 [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS C:\Windows\system32\sens.dll
22:58:48.0813 0x1448 SENS - ok
22:58:48.0833 0x1448 [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc C:\Windows\system32\sensrsvc.dll
22:58:48.0863 0x1448 SensrSvc - ok
22:58:48.0873 0x1448 [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum C:\Windows\system32\DRIVERS\serenum.sys
22:58:48.0883 0x1448 Serenum - ok
22:58:48.0893 0x1448 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial C:\Windows\system32\DRIVERS\serial.sys
22:58:48.0923 0x1448 Serial - ok
22:58:48.0963 0x1448 [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse C:\Windows\system32\drivers\sermouse.sys
22:58:49.0003 0x1448 sermouse - ok
22:58:49.0023 0x1448 [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv C:\Windows\system32\sessenv.dll
22:58:49.0083 0x1448 SessionEnv - ok
22:58:49.0093 0x1448 [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
22:58:49.0103 0x1448 sffdisk - ok
22:58:49.0113 0x1448 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
22:58:49.0123 0x1448 sffp_mmc - ok
22:58:49.0143 0x1448 [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
22:58:49.0153 0x1448 sffp_sd - ok
22:58:49.0163 0x1448 [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
22:58:49.0173 0x1448 sfloppy - ok
22:58:49.0213 0x1448 [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess C:\Windows\System32\ipnathlp.dll
22:58:49.0263 0x1448 SharedAccess - ok
22:58:49.0283 0x1448 [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
22:58:49.0313 0x1448 ShellHWDetection - ok
22:58:49.0333 0x1448 [ C3F190562FE82EFDA7CCEF305EBAD3E3, BE809035A9B11945B3BB630F73A7651BBD4D1EA2091060378BCF7AD20003BBE4 ] Shockprf C:\Windows\system32\DRIVERS\Apsx64.sys
22:58:49.0343 0x1448 Shockprf - ok
22:58:49.0353 0x1448 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
22:58:49.0363 0x1448 SiSRaid2 - ok
22:58:49.0373 0x1448 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
22:58:49.0373 0x1448 SiSRaid4 - ok
22:58:49.0393 0x1448 [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb C:\Windows\system32\DRIVERS\smb.sys
22:58:49.0423 0x1448 Smb - ok
22:58:49.0483 0x1448 smihlp - ok
22:58:49.0503 0x1448 [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP C:\Windows\System32\snmptrap.exe
22:58:49.0533 0x1448 SNMPTRAP - ok
22:58:49.0533 0x1448 [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr C:\Windows\system32\drivers\spldr.sys
22:58:49.0543 0x1448 spldr - ok
22:58:49.0573 0x1448 [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler C:\Windows\System32\spoolsv.exe
22:58:49.0593 0x1448 Spooler - ok
22:58:49.0683 0x1448 [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc C:\Windows\system32\sppsvc.exe
22:58:49.0843 0x1448 sppsvc - ok
22:58:49.0853 0x1448 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify C:\Windows\system32\sppuinotify.dll
22:58:49.0873 0x1448 sppuinotify - ok
22:58:49.0973 0x1448 [ 47118A04B1D4DCCCE3A1CDA3C10095B9, 797E6E575BBCD413B3ADBA1FAD0183EBAC994A482118D423EC885BF7920254D0 ] SROSVC C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
22:58:49.0993 0x1448 SROSVC - ok
22:58:50.0013 0x1448 [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv C:\Windows\system32\DRIVERS\srv.sys
22:58:50.0043 0x1448 srv - ok
22:58:50.0063 0x1448 [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
22:58:50.0093 0x1448 srv2 - ok
22:58:50.0133 0x1448 [ 0C4540311E11664B245A263E1154CEF8, 63376322BFFAFF2F166AF3FDD3F1A346C21FAE21F406F659F8630779D1D6525D ] SrvHsfHDA C:\Windows\system32\DRIVERS\VSTAZL6.SYS
22:58:50.0143 0x1448 SrvHsfHDA - ok
22:58:50.0183 0x1448 [ 02071D207A9858FBE3A48CBFD59C4A04, FEA4DEBAEC3465E0C7C1E8B721805922F6BBCB96A60A193B11688F4252F4B89E ] SrvHsfV92 C:\Windows\system32\DRIVERS\VSTDPV6.SYS
22:58:50.0253 0x1448 SrvHsfV92 - ok
22:58:50.0273 0x1448 [ 18E40C245DBFAF36FD0134A7EF2DF396, 0138A68958112101A5D3BD94114F320CE80B0C9A93E009AC78DE7415FCCC7DE7 ] SrvHsfWinac C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
22:58:50.0313 0x1448 SrvHsfWinac - ok
22:58:50.0333 0x1448 [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
22:58:50.0343 0x1448 srvnet - ok
22:58:50.0353 0x1448 [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
22:58:50.0383 0x1448 SSDPSRV - ok
22:58:50.0383 0x1448 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc C:\Windows\system32\sstpsvc.dll
22:58:50.0413 0x1448 SstpSvc - ok
22:58:50.0473 0x1448 [ 845305743E0F7DB9B3A9AC1F49C635F1, 042B1667DF7A09F0845024C878D60272078BC4F1781D98A3C9E01653FE06BB03 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
22:58:50.0493 0x1448 Stereo Service - ok
22:58:50.0523 0x1448 [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor C:\Windows\system32\drivers\stexstor.sys
22:58:50.0523 0x1448 stexstor - ok
22:58:50.0573 0x1448 [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc C:\Windows\System32\wiaservc.dll
22:58:50.0603 0x1448 stisvc - ok
22:58:50.0633 0x1448 [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt C:\Windows\system32\drivers\vmstorfl.sys
22:58:50.0643 0x1448 storflt - ok
22:58:50.0643 0x1448 [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc C:\Windows\system32\storsvc.dll
22:58:50.0663 0x1448 StorSvc - ok
22:58:50.0693 0x1448 [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc C:\Windows\system32\drivers\storvsc.sys
22:58:50.0723 0x1448 storvsc - ok
22:58:50.0733 0x1448 [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
22:58:50.0733 0x1448 swenum - ok
22:58:50.0763 0x1448 [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv C:\Windows\System32\swprv.dll
22:58:50.0803 0x1448 swprv - ok
22:58:50.0873 0x1448 [ AEAE48AF681BAF5904608FF5D84E3C9C, 39B362E9E64A43B9AF5CCE2E704CCAE5E10B5BA0B45E535098BC0E40A4F772A8 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
22:58:50.0903 0x1448 SynTP - ok
22:58:50.0993 0x1448 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain C:\Windows\system32\sysmain.dll
22:58:51.0083 0x1448 SysMain - ok
22:58:51.0093 0x1448 [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
22:58:51.0103 0x1448 TabletInputService - ok
22:58:51.0113 0x1448 [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv C:\Windows\System32\tapisrv.dll
22:58:51.0143 0x1448 TapiSrv - ok
22:58:51.0163 0x1448 [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS C:\Windows\System32\tbssvc.dll
22:58:51.0183 0x1448 TBS - ok
22:58:51.0243 0x1448 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
22:58:51.0283 0x1448 Tcpip - ok
22:58:51.0383 0x1448 [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
22:58:51.0423 0x1448 TCPIP6 - ok
22:58:51.0443 0x1448 [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
22:58:51.0453 0x1448 tcpipreg - ok
22:58:51.0473 0x1448 [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
22:58:51.0503 0x1448 TDPIPE - ok
22:58:51.0523 0x1448 [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
22:58:51.0543 0x1448 TDTCP - ok
22:58:51.0583 0x1448 [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
22:58:51.0623 0x1448 tdx - ok
22:58:51.0623 0x1448 [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
22:58:51.0633 0x1448 TermDD - ok
22:58:51.0653 0x1448 [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService C:\Windows\System32\termsrv.dll
22:58:51.0693 0x1448 TermService - ok
22:58:51.0693 0x1448 [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes C:\Windows\system32\themeservice.dll
22:58:51.0703 0x1448 Themes - ok
22:58:51.0723 0x1448 [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER C:\Windows\system32\mmcss.dll
22:58:51.0743 0x1448 THREADORDER - ok
22:58:51.0773 0x1448 [ 1BB77ECCBFA3675B1EE8D6D6D37A1E1E, 6C22ED2FC9FF1EDFAFFA9C5F89A65D348B45F0087885401D056D6448F56F97AF ] TPDIGIMN C:\Windows\system32\DRIVERS\ApsHM64.sys
22:58:51.0773 0x1448 TPDIGIMN - ok
22:58:51.0793 0x1448 [ 88F81D810FF16AC65B02643DAF308D4F, FDD4AFD1836D2CB528F92A788CEEC0D7800CC18B861E7D7601DA69543F0AD315 ] TPHDEXLGSVC C:\Windows\system32\TPHDEXLG64.exe
22:58:51.0803 0x1448 TPHDEXLGSVC - ok
22:58:51.0863 0x1448 [ 2670D23A61CD706004C24A83D4D48294, 4A7740E8D6E00AD7C27FFB1BD2AD33F7880F35BF4AA29B186A60983AE78DEB6F ] TPHKLOAD C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
22:58:51.0883 0x1448 TPHKLOAD - ok
22:58:51.0903 0x1448 [ CB0625C2F5B7C72C50C5AE34F8E8F7D0, 301BA79C4CA350EB9CFC083B69D830C27B3298DD23ADC986D002B4C58BD6DBAD ] TPHKSVC C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
22:58:51.0913 0x1448 TPHKSVC - ok
22:58:51.0923 0x1448 [ DBCC20C02E8A3E43B03C304A4E40A84F, BF5F3ACCB0342304A6870E94D2576644B08DBF307C853C7DBA4B82B0C7309DA4 ] TPM C:\Windows\system32\drivers\tpm.sys
22:58:51.0953 0x1448 TPM - ok
22:58:51.0993 0x1448 [ 7165B5A9B4867F64A6D6935F57D4196B, 716BF044005E11A84D2B114E4DBCDA390C7842EBD4B6E8FA710D2D002BAE09DC ] TPPWRIF C:\Windows\system32\drivers\Tppwr64v.sys
22:58:52.0013 0x1448 TPPWRIF - ok
22:58:52.0023 0x1448 [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks C:\Windows\System32\trkwks.dll
22:58:52.0083 0x1448 TrkWks - ok
22:58:52.0133 0x1448 [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
22:58:52.0173 0x1448 TrustedInstaller - ok
22:58:52.0203 0x1448 [ 4CE278FC9671BA81A138D70823FCAA09, CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
22:58:52.0233 0x1448 tssecsrv - ok
22:58:52.0253 0x1448 [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
22:58:52.0283 0x1448 TsUsbFlt - ok
22:58:52.0313 0x1448 [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
22:58:52.0343 0x1448 TsUsbGD - ok
22:58:52.0373 0x1448 [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
22:58:52.0403 0x1448 tunnel - ok
22:58:52.0433 0x1448 [ 4DAAE0413CD4E816258838E2FAFB3147, 7D45621A0148C2EEA4302A5852D9407DCEF1947936E9E840788F01625E869CDD ] TVTI2C C:\Windows\system32\DRIVERS\Tvti2c.sys
22:58:52.0443 0x1448 TVTI2C - ok
22:58:52.0453 0x1448 [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
22:58:52.0463 0x1448 uagp35 - ok
22:58:52.0473 0x1448 [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
22:58:52.0513 0x1448 udfs - ok
22:58:52.0513 0x1448 [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect C:\Windows\system32\UI0Detect.exe
22:58:52.0533 0x1448 UI0Detect - ok
22:58:52.0593 0x1448 [ BE788A747457E6916586C410EC0111E7, 525F9065270AF40FED854C5B3C7E690783F5169C2F9286EE225F6C817ED1E237 ] UleadBurningHelper C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
22:58:52.0613 0x1448 UleadBurningHelper - detected UnsignedFile.Multi.Generic ( 1 )
22:58:55.0043 0x1448 Detect skipped due to KSN trusted
22:58:55.0043 0x1448 UleadBurningHelper - ok
22:58:55.0053 0x1448 [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
22:58:55.0083 0x1448 uliagpkx - ok
22:58:55.0103 0x1448 [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus C:\Windows\system32\DRIVERS\umbus.sys
22:58:55.0123 0x1448 umbus - ok
22:58:55.0153 0x1448 [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass C:\Windows\system32\drivers\umpass.sys
22:58:55.0173 0x1448 UmPass - ok
22:58:55.0193 0x1448 [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService C:\Windows\System32\umrdp.dll
22:58:55.0213 0x1448 UmRdpService - ok
22:58:55.0363 0x1448 [ A69CD6BDB82872999D2E46F9324ADA83, 1F06D5B716D48E693A082C1FC49D80405F50D60C78FDF5829FF51F1CC11CF011 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
22:58:55.0433 0x1448 UNS - ok
22:58:55.0453 0x1448 [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost C:\Windows\System32\upnphost.dll
22:58:55.0503 0x1448 upnphost - ok
22:58:55.0543 0x1448 [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
22:58:55.0573 0x1448 usbccgp - ok
22:58:55.0593 0x1448 [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir C:\Windows\system32\drivers\usbcir.sys
22:58:55.0643 0x1448 usbcir - ok
22:58:55.0673 0x1448 [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci C:\Windows\system32\drivers\usbehci.sys
22:58:55.0703 0x1448 usbehci - ok
22:58:55.0753 0x1448 [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
22:58:55.0813 0x1448 usbhub - ok
22:58:55.0833 0x1448 [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci C:\Windows\system32\drivers\usbohci.sys
22:58:55.0843 0x1448 usbohci - ok
22:58:55.0853 0x1448 [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint C:\Windows\system32\drivers\usbprint.sys
22:58:55.0883 0x1448 usbprint - ok
22:58:55.0893 0x1448 [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:58:55.0933 0x1448 USBSTOR - ok
22:58:55.0943 0x1448 [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
22:58:55.0953 0x1448 usbuhci - ok
22:58:55.0983 0x1448 [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo C:\Windows\System32\Drivers\usbvideo.sys
22:58:56.0023 0x1448 usbvideo - ok
22:58:56.0073 0x1448 [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms C:\Windows\System32\uxsms.dll
22:58:56.0153 0x1448 UxSms - ok
22:58:56.0193 0x1448 [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc C:\Windows\system32\lsass.exe
22:58:56.0223 0x1448 VaultSvc - ok
22:58:56.0253 0x1448 [ E45073C03C0B2D837DFFF110C728E852, B9BEE85ABD26829A0E21746B4F42C2EF97BFD82977229A22966C40A83FFA009E ] VBoxNetAdp C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
22:58:56.0273 0x1448 VBoxNetAdp - ok
22:58:56.0273 0x1448 VBoxNetFlt - ok
22:58:56.0303 0x1448 [ 3C8E2C591345F38149C69FE8E5DF8C90, 9F4BB9BDA09CB2E99A6A888B288F322AE5C460B5D124CD714C6F00FF5029144B ] VClone C:\Windows\system32\DRIVERS\VClone.sys
22:58:56.0333 0x1448 VClone - ok
22:58:56.0353 0x1448 [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
22:58:56.0373 0x1448 vdrvroot - ok
22:58:56.0403 0x1448 [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds C:\Windows\System32\vds.exe
22:58:56.0493 0x1448 vds - ok
22:58:56.0503 0x1448 [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
22:58:56.0513 0x1448 vga - ok
22:58:56.0523 0x1448 [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave C:\Windows\System32\drivers\vga.sys
22:58:56.0563 0x1448 VgaSave - ok
22:58:56.0573 0x1448 [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
22:58:56.0583 0x1448 vhdmp - ok
22:58:56.0603 0x1448 [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide C:\Windows\system32\drivers\viaide.sys
22:58:56.0603 0x1448 viaide - ok
22:58:56.0633 0x1448 [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus C:\Windows\system32\drivers\vmbus.sys
22:58:56.0643 0x1448 vmbus - ok
22:58:56.0643 0x1448 [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
22:58:56.0653 0x1448 VMBusHID - ok
22:58:56.0683 0x1448 vmci - ok
22:58:56.0693 0x1448 VMnetAdapter - ok
22:58:56.0703 0x1448 [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr C:\Windows\system32\drivers\volmgr.sys
22:58:56.0713 0x1448 volmgr - ok
22:58:56.0723 0x1448 [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
22:58:56.0733 0x1448 volmgrx - ok
22:58:56.0743 0x1448 [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap C:\Windows\system32\drivers\volsnap.sys
22:58:56.0753 0x1448 volsnap - ok
22:58:56.0773 0x1448 [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
22:58:56.0783 0x1448 vsmraid - ok
22:58:56.0823 0x1448 [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS C:\Windows\system32\vssvc.exe
22:58:56.0913 0x1448 VSS - ok
22:58:56.0913 0x1448 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
22:58:56.0933 0x1448 vwifibus - ok
22:58:56.0933 0x1448 [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
22:58:56.0943 0x1448 vwififlt - ok
22:58:56.0943 0x1448 [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp C:\Windows\system32\DRIVERS\vwifimp.sys
22:58:56.0963 0x1448 vwifimp - ok
22:58:56.0993 0x1448 [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time C:\Windows\system32\w32time.dll
22:58:57.0023 0x1448 W32Time - ok
22:58:57.0043 0x1448 [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen C:\Windows\system32\drivers\wacompen.sys
22:58:57.0053 0x1448 WacomPen - ok
22:58:57.0073 0x1448 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
22:58:57.0093 0x1448 WANARP - ok
22:58:57.0093 0x1448 [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
22:58:57.0123 0x1448 Wanarpv6 - ok
22:58:57.0163 0x1448 [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine C:\Windows\system32\wbengine.exe
22:58:57.0213 0x1448 wbengine - ok
22:58:57.0243 0x1448 [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
22:58:57.0253 0x1448 WbioSrvc - ok
22:58:57.0283 0x1448 [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc C:\Windows\System32\wcncsvc.dll
22:58:57.0303 0x1448 wcncsvc - ok
22:58:57.0313 0x1448 [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
22:58:57.0343 0x1448 WcsPlugInService - ok
22:58:57.0343 0x1448 [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd C:\Windows\system32\drivers\wd.sys
22:58:57.0353 0x1448 Wd - ok
22:58:57.0393 0x1448 [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
22:58:57.0423 0x1448 Wdf01000 - ok
22:58:57.0423 0x1448 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost C:\Windows\system32\wdi.dll
22:58:57.0473 0x1448 WdiServiceHost - ok
22:58:57.0473 0x1448 [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost C:\Windows\system32\wdi.dll
22:58:57.0483 0x1448 WdiSystemHost - ok
22:58:57.0523 0x1448 [ 94DC2BF6CBAAA95E369C3756D3115A76, 3DF44939ADBB4E30896993A85470BE5E16B1A3EDADFDD8F113D9615A6E431C12 ] wdkmd C:\Windows\system32\DRIVERS\WDKMD.sys
22:58:57.0533 0x1448 wdkmd - ok
22:58:57.0563 0x1448 [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient C:\Windows\System32\webclnt.dll
22:58:57.0583 0x1448 WebClient - ok
22:58:57.0603 0x1448 [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc C:\Windows\system32\wecsvc.dll
22:58:57.0643 0x1448 Wecsvc - ok
22:58:57.0653 0x1448 [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport C:\Windows\System32\wercplsupport.dll
22:58:57.0683 0x1448 wercplsupport - ok
22:58:57.0683 0x1448 [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc C:\Windows\System32\WerSvc.dll
22:58:57.0713 0x1448 WerSvc - ok
22:58:57.0733 0x1448 [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
22:58:57.0753 0x1448 WfpLwf - ok
22:58:57.0763 0x1448 [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount C:\Windows\system32\drivers\wimmount.sys
22:58:57.0763 0x1448 WIMMount - ok
22:58:57.0793 0x1448 [ 1EDBBF412A382550AF6EB35F5E46928E, 23FC32929913CF784A78C334D0B0E9D812EA6BDF70BB5C993DDE492CBEE8265E ] winachsf C:\Windows\system32\DRIVERS\CAX_CNXT.sys
22:58:57.0843 0x1448 winachsf - ok
22:58:57.0853 0x1448 WinDefend - ok
22:58:57.0853 0x1448 WinHttpAutoProxySvc - ok
22:58:57.0913 0x1448 [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
22:58:57.0963 0x1448 Winmgmt - ok
22:58:58.0043 0x1448 [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM C:\Windows\system32\WsmSvc.dll
22:58:58.0123 0x1448 WinRM - ok
22:58:58.0183 0x1448 [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb C:\Windows\system32\DRIVERS\WinUSB.sys
22:58:58.0203 0x1448 WinUsb - ok
22:58:58.0263 0x1448 [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc C:\Windows\System32\wlansvc.dll
22:58:58.0303 0x1448 Wlansvc - ok
22:58:58.0333 0x1448 [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
22:58:58.0333 0x1448 wlcrasvc - ok
22:58:58.0443 0x1448 [ 7E47C328FC4768CB8BEAFBCFAFA70362, C98BD6A0C2F70E069D5FD3BAB31BD028DFEAC0490D180BBC28A14BE375897D8C ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
22:58:58.0513 0x1448 wlidsvc - ok
22:58:58.0563 0x1448 WMCoreService - ok
22:58:58.0593 0x1448 [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
22:58:58.0633 0x1448 WmiAcpi - ok
22:58:58.0663 0x1448 [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
22:58:58.0723 0x1448 wmiApSrv - ok
22:58:58.0743 0x1448 WMPNetworkSvc - ok
22:58:58.0773 0x1448 [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc C:\Windows\System32\wpcsvc.dll
22:58:58.0793 0x1448 WPCSvc - ok
22:58:58.0813 0x1448 [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
22:58:58.0843 0x1448 WPDBusEnum - ok
22:58:58.0843 0x1448 [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
22:58:58.0883 0x1448 ws2ifsl - ok
22:58:58.0893 0x1448 [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc C:\Windows\system32\wscsvc.dll
22:58:58.0923 0x1448 wscsvc - ok
22:58:58.0923 0x1448 WSearch - ok
22:58:59.0003 0x1448 [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv C:\Windows\system32\wuaueng.dll
22:58:59.0073 0x1448 wuauserv - ok
22:58:59.0103 0x1448 [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
22:58:59.0113 0x1448 WudfPf - ok
22:58:59.0143 0x1448 [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
22:58:59.0163 0x1448 WUDFRd - ok
22:58:59.0193 0x1448 [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
22:58:59.0213 0x1448 wudfsvc - ok
22:58:59.0233 0x1448 [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc C:\Windows\System32\wwansvc.dll
22:58:59.0263 0x1448 WwanSvc - ok
22:58:59.0303 0x1448 [ AA0A3A08A501237CD5BC4CFBFB64B3D6, BA0250A3FA5DC3FD9D72AF5B48E0F6610E6C0CDE7DE0D544A27F5E9EFC6343DA ] WwanUsbServ C:\Windows\system32\DRIVERS\WwanUsbMp64.sys
22:58:59.0333 0x1448 WwanUsbServ - ok
22:58:59.0383 0x1448 [ E8F3FA126A06F8E7088F63757112A186, FC742ECA6DD823C5B17A514EC4473F65EE290FA6501370675B3628FD881A1C4B ] XAudio C:\Windows\system32\DRIVERS\XAudio64.sys
22:58:59.0413 0x1448 XAudio - ok
22:58:59.0493 0x1448 [ 595B5F1FB9DFAD3DB2A02AE833665495, 9B12CC3CD7A4D723102851D07798F5BC92CA0D39E982BDC8699BAE01A5882FF6 ] xritedeviced C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
22:58:59.0493 0x1448 xritedeviced - detected UnsignedFile.Multi.Generic ( 1 )
22:59:02.0003 0x1448 Detect skipped due to KSN trusted
22:59:02.0003 0x1448 xritedeviced - ok
22:59:02.0073 0x1448 ================ Scan global ===============================
22:59:02.0103 0x1448 [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
22:59:02.0143 0x1448 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
22:59:02.0173 0x1448 [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
22:59:02.0203 0x1448 [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
22:59:02.0233 0x1448 [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
22:59:02.0243 0x1448 [ Global ] - ok
22:59:02.0243 0x1448 ================ Scan MBR ==================================
22:59:02.0253 0x1448 [ 1EC07DA70A194E3D3CA6F9A368C1BC7C ] \Device\Harddisk0\DR0
22:59:02.0603 0x1448 \Device\Harddisk0\DR0 - ok
22:59:02.0603 0x1448 ================ Scan VBR ==================================
22:59:02.0613 0x1448 [ 75B8CFE4C4158908A0A9C7F3E7B57E24 ] \Device\Harddisk0\DR0\Partition1
22:59:02.0613 0x1448 \Device\Harddisk0\DR0\Partition1 - ok
22:59:02.0613 0x1448 [ 95315048B07F98162ED55B546C7554CE ] \Device\Harddisk0\DR0\Partition2
22:59:02.0623 0x1448 \Device\Harddisk0\DR0\Partition2 - ok
22:59:02.0623 0x1448 [ 1E65B7A0D0DAC39166C798FFE69BF43D ] \Device\Harddisk0\DR0\Partition3
22:59:02.0633 0x1448 \Device\Harddisk0\DR0\Partition3 - ok
22:59:02.0633 0x1448 ================ Scan generic autorun ======================
22:59:02.0693 0x1448 [ 2508FA41A1B58C97D94FFF044111492F, 656AC5EC110C5F8CE68CE1962D6B2CBD47EE6CE20A181C88BB1E5481793F0578 ] C:\Windows\system32\TpShocks.exe
22:59:02.0713 0x1448 TpShocks - ok
22:59:02.0753 0x1448 [ 42361B4BD80768E82B80285851037665, A555A6BF8016645B838FEA993AD273D1F472586F3600619DC243B1C33438FA07 ] C:\Program Files\Conexant\ForteConfig\fmapp.exe
22:59:02.0753 0x1448 ForteConfig - ok
22:59:02.0783 0x1448 [ EC80D4878D3824C289868E007B9C43EF, 8076D0F6C3D3EC60D3C638C60625F8063D2FA93FEAD00A3E6551812996087FFB ] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
22:59:02.0803 0x1448 LENOVO.TPKNRRES - ok
22:59:02.0853 0x1448 [ 788D7964EDFCF639850B18CE01B287D2, ED8164370F1DD53DB987427A48E6C5E6C50F561C1F9A2D117D526755E8665F59 ] C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE
22:59:02.0883 0x1448 ALCKRESI.EXE - ok
22:59:02.0923 0x1448 [ B0C52A038B318257412437F99406D39F, 6ABCEB2AC7883CE97C24394A4F113DE13F717ED80B94FAEBCE8BE1A5FE3BD7D2 ] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe
22:59:02.0943 0x1448 AcWin7Hlpr - ok
22:59:03.0013 0x1448 [ 6A94CD69E9C2BD1864096AB0B16660E6, E22F3C432F104AD25512D1F97526D772D50BE0FC7910FFF12335F4ECC0EEE184 ] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
22:59:03.0063 0x1448 IntelPAN - ok
22:59:03.0093 0x1448 [ 609617A22E765492C54D8BB438D61B23, 3C28D4B2929D88CB4D3595049F4F740A33E1A92215AC8DF0E481CCB558F0617F ] C:\Windows\system32\igfxtray.exe
22:59:03.0103 0x1448 IgfxTray - ok
22:59:03.0143 0x1448 [ 5D4069AEF369F011205CD71EACB5BBF7, 41769086CE903D4AA6572FB5DF6BCAE9647412E309537365AC31A89083B72FED ] C:\Windows\system32\hkcmd.exe
22:59:03.0153 0x1448 HotKeysCmds - ok
22:59:03.0173 0x1448 [ F0F898B89FD490AB77CC9D072B62004B, D0EAF4C0C993AA9ABB194AEADBBC09CF97FE3818ED22429CDBC60DF72423069A ] C:\Windows\system32\igfxpers.exe
22:59:03.0193 0x1448 Persistence - ok
22:59:03.0213 0x1448 [ 4F12EAD0B4C8BDAED5A11CC11F394B0A, EF769C2C2564D42979746B8BFD1D6E6532BFAB3BFCE2D09A0A17D0E64498B9B3 ] C:\Program Files\CONEXANT\SAII\SAIICpl.exe
22:59:03.0233 0x1448 SmartAudio - ok
22:59:03.0233 0x1448 SynTPEnh - ok
22:59:03.0263 0x1448 [ 49FBD026C73B6EFBFD3F58E641E39411, A2B80515D5107AD9817036B118D141F7A7306C372D54211A0B9687DB12D715FA ] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
22:59:03.0273 0x1448 IMSS - ok
22:59:03.0273 0x1448 PWMTRV - ok
22:59:03.0283 0x1448 [ 5BF0F8B139C9654B969D4FBB78760D8D, 138F13FCF9F84938A6929AD2731FFE0B5F82BB1EE347078E2E9DD4B617DF7190 ] C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe
22:59:03.0283 0x1448 X-Rite Legacy Device - detected UnsignedFile.Multi.Generic ( 1 )
22:59:05.0883 0x1448 Detect skipped due to KSN trusted
22:59:05.0883 0x1448 X-Rite Legacy Device - ok
22:59:06.0003 0x1448 [ 47C1DE0A890613FFCFF1D67648EEDF90, 5821567D7DD99623257AEA794023EF4200E6E17FD09656B40D97C44A35C701BB ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
22:59:06.0063 0x1448 Adobe ARM - ok
22:59:06.0113 0x1448 [ 0307536FD43CC7BFB92F9DAC8DB913F1, 6C8BEDA4ADFBEF28E647B39B3EEA37A20BFE5C93C7EDA79471EFB46156197843 ] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
22:59:06.0133 0x1448 RotateImage - detected UnsignedFile.Multi.Generic ( 1 )
22:59:08.0853 0x1448 Detect skipped due to KSN trusted
22:59:08.0853 0x1448 RotateImage - ok
22:59:08.0923 0x1448 [ 8943465BEFA91044227D42E84ECB8280, 76D19CE3EB7E6C6573F250543CDC10B3601604535BFB756805AE246FA55AC265 ] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
22:59:08.0943 0x1448 NUSB3MON - ok
22:59:09.0013 0x1448 [ 2AA5DD75EA1281432C40D22B5FD87D3A, 9868D4176C8F08EB72B0B992D3E2A480C587930CA025B4FDF3212F99B79C3017 ] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
22:59:09.0043 0x1448 avgnt - ok
22:59:09.0083 0x1448 [ 308F2EE28005510DE616409148CF077B, A2126CB185B0053086BDD6F0A16A503F6CA629AC677E4B7AE6D43C770061D087 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
22:59:09.0093 0x1448 SunJavaUpdateSched - ok
22:59:09.0183 0x1448 [ 187F4C75A89E3F412322C94526320074, D78FA7EF93C8C7B4326A5B6DB04A92ADD091DF00658FA8731D07C5D3BE29ED04 ] C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
22:59:09.0193 0x1448 BCSSync - ok
22:59:09.0243 0x1448 [ 845EB283583BD3C89F09636A10114EF3, BCB3002B867052FB381B1E44D31E381200751E1AD3F991EB4233B73E3E034A0E ] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
22:59:09.0273 0x1448 Avira Systray - ok
22:59:09.0323 0x1448 [ 16D4D2AB28EDD90AEE06826B3ADF50AB, EE8E54702B22E7F1DB8DE7296132C3473DD9D18B9E9C47414F315173E0A26E16 ] C:\Program Files (x86)\PDF24\pdf24.exe
22:59:09.0353 0x1448 PDFPrint - ok
22:59:09.0453 0x1448 [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
22:59:09.0503 0x1448 Sidebar - ok
22:59:09.0533 0x1448 [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
22:59:09.0553 0x1448 mctadmin - ok
22:59:09.0633 0x1448 [ 6ECE746BB283927604DA192CA0D1403D, 327E1E908B6DB1C8414B31DB277EF5EABA340B2EE7FEE19349860B3C8F7778FE ] C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE
22:59:09.0653 0x1448 EPLTarget\P0000000000000000 - ok
22:59:09.0653 0x1448 Waiting for KSN requests completion. In queue: 94
22:59:10.0653 0x1448 Waiting for KSN requests completion. In queue: 94
22:59:11.0653 0x1448 Waiting for KSN requests completion. In queue: 94
22:59:12.0673 0x1448 AV detected via SS2: Avira Desktop, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 14.0.6.548 ), 0x40000 ( disabled : updated )
22:59:12.0683 0x1448 Win FW state via NFP2: enabled
22:59:15.0163 0x1448 ============================================================
22:59:15.0163 0x1448 Scan finished
22:59:15.0163 0x1448 ============================================================
22:59:15.0173 0x12f0 Detected object count: 0
22:59:15.0173 0x12f0 Actual detected object count: 0
|
|
02.10.2014, 22:50
| #11 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Adware/Junkware/Toolbars entfernen (alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!) 1. Schritt: adwCleaner Downloade Dir bitte  AdwCleaner auf deinen Desktop.
2. Schritt: JRT - Junkware Removal Tool Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
3. Schritt: Frisches Log mit FRST Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:  FRST 32-Bit | FRST 64-Bit(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
__________________ Logfiles bitte immer in CODE-Tags posten |
|
03.10.2014, 21:27
| #12 |
| | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter adwCleaner: Code:
ATTFilter # AdwCleaner v3.311 - Bericht erstellt am 03/10/2014 um 22:05:35
# Aktualisiert 30/09/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Admin - W520
# Gestartet von : C:\Users\Admin\Desktop\AdwCleaner_3.311.exe
# Option : Löschen
***** [ Dienste ] *****
***** [ Dateien / Ordner ] *****
Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Users\y\AppData\Roaming\Mozilla\Firefox\Profiles\4bxl55bg.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\searchplugins\zonealarm.xml
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\user.js
***** [ Tasks ] *****
***** [ Verknüpfungen ] *****
***** [ Registrierungsdatenbank ] *****
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKCU\Software\OCS
***** [ Browser ] *****
-\\ Internet Explorer v9.0.8112.16575
-\\ Mozilla Firefox v32.0.3 (x86 de)
[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\prefs.js ]
[ Datei : C:\Users\y\AppData\Roaming\Mozilla\Firefox\Profiles\4bxl55bg.default\prefs.js ]
*************************
AdwCleaner[R0].txt - [3754 octets] - [03/10/2014 22:03:39]
AdwCleaner[S0].txt - [3625 octets] - [03/10/2014 22:05:35]
########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3685 octets] ##########
Code:
ATTFilter ~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.7 (10.03.2014:1)
OS: Windows 7 Professional x64
Ran by Admin on 03.10.2014 at 22:13:16,42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
~~~ Services
~~~ Registry Values
~~~ Registry Keys
~~~ Files
~~~ Folders
~~~ FireFox
Emptied folder: C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\bnq9dguw.default\minidumps [1 files]
~~~ Event Viewer Logs were cleared
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.10.2014 at 22:16:06,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
FRST Logfile: Code:
ATTFilter Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-10-2014 01
Ran by Admin (administrator) on W520 on 03-10-2014 22:19:56
Running from C:\Users\Admin\Desktop
Loaded Profile: Admin (Available profiles: UpdatusUser & Admin & y & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/
==================== Processes (Whitelisted) =================
(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)
(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Ericsson AB) C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SRORest.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
(Avanquest Software ) C:\Program Files (x86)\Digital Line Detect\DLG.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Lenovo.) C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
() C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
==================== Registry (Whitelisted) ==================
(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)
HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [380776 2011-03-29] (Lenovo.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [40808 2011-05-31] (Lenovo Group Limited)
HKLM\...\Run: [ALCKRESI.EXE] => C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [281960 2011-07-13] (Lenovo Group Limited)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63832 2014-03-14] (Lenovo)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [X-Rite Legacy Device] => C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe [105984 2010-09-28] (X-Rite Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibrator Gamma.lnk
ShortcutTarget: Color Calibrator Gamma.lnk -> C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Gamma\CalibrationLoader.exe (LOGO Kommunikations- und Drucktechnik GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibrator Tray.lnk
ShortcutTarget: Color Calibrator Tray.lnk -> C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files (x86)\Digital Line Detect\DLG.exe (Avanquest Software )
==================== Internet (Whitelisted) ====================
(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)
HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
Chrome:
=======
==================== Services (Whitelisted) =================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [477032 2011-07-04] (Lenovo.)
R2 i1 Display Service; C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [163328 2010-09-28] (X-Rite Inc.) [File not signed]
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-06-26] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-06-26] (pdfforge GmbH)
R2 SROSVC; C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [443240 2011-03-02] (Lenovo Group Limited)
R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440 2008-01-10] (Ulead Systems, Inc.) [File not signed]
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [648744 2011-08-12] (Ericsson AB)
R2 xritedeviced; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [142848 2010-09-28] (X-Rite Inc.) [File not signed]
==================== Drivers (Whitelisted) ====================
(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-08-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-08-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-04] (Avira Operations GmbH & Co. KG)
R3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2010-03-03] (Ericsson AB)
R3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [30248 2010-03-03] (Ericsson AB)
R3 l36wgps; C:\Windows\System32\DRIVERS\l36wgps64.sys [101416 2011-07-01] (Ericsson AB)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [92888 2014-10-02] (Malwarebytes Corporation)
R3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [419400 2011-04-13] (MCCI Corporation)
R3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [430664 2011-04-13] (MCCI Corporation)
R3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [19528 2011-04-13] (MCCI Corporation)
R3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [483400 2011-04-13] (MCCI Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-05-24] ()
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [41536 2009-09-24] (Lenovo (United States) Inc.)
S3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [286248 2011-04-06] (Ericsson AB)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S2 smihlp; \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S0 vmci; system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]
==================== NetSvcs (Whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)
==================== One Month Created Files and Folders ========
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-03 22:19 - 2014-10-03 22:19 - 00018587 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-03 22:16 - 2014-10-03 22:16 - 00000756 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-10-03 22:13 - 2014-10-03 22:13 - 00000000 ____D () C:\Windows\ERUNT
2014-10-03 22:11 - 2014-10-03 22:11 - 00003769 _____ () C:\Users\Admin\Desktop\AdwCleaner[S0].txt
2014-10-03 22:03 - 2014-10-03 22:05 - 00000000 ____D () C:\AdwCleaner
2014-10-03 22:02 - 2014-10-03 22:02 - 01702068 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2014-10-03 22:01 - 2014-10-03 22:01 - 01375089 _____ () C:\Users\Admin\Desktop\AdwCleaner_3.311.exe
2014-10-02 22:55 - 2014-10-02 22:55 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe
2014-10-02 22:30 - 2014-10-02 22:30 - 00025239 _____ () C:\ComboFix.txt
2014-10-02 22:17 - 2014-10-02 22:30 - 00000000 ____D () C:\Qoobox
2014-10-02 22:17 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-02 22:17 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-02 22:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-02 22:16 - 2014-10-02 22:29 - 00000000 ____D () C:\Windows\erdnt
2014-10-02 22:03 - 2014-10-02 22:03 - 05582981 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-10-02 13:55 - 2014-10-02 13:55 - 00011790 _____ () C:\Users\Admin\Desktop\Logfiles.7z
2014-10-02 13:53 - 2014-10-02 13:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-10-02 13:53 - 2014-10-02 13:53 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-10-02 13:52 - 2014-10-02 13:52 - 01110476 _____ () C:\Users\Admin\Downloads\7z920.exe
2014-10-02 13:12 - 2014-10-02 13:12 - 00044202 _____ () C:\Users\Admin\Desktop\AVSCAN-20141002-114128-2D47BB75.LOG
2014-10-02 12:52 - 2014-10-02 12:52 - 00087021 _____ () C:\Users\Admin\Desktop\gmer.txt
2014-10-02 11:52 - 2014-10-02 12:31 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-10-02 11:50 - 2014-10-02 12:31 - 00000000 ____D () C:\Users\Admin\Desktop\mbar
2014-10-02 11:49 - 2014-10-02 11:49 - 14349744 _____ (Malwarebytes Corp.) C:\Users\y\Desktop\mbar-1.07.0.1012.exe
2014-10-02 11:48 - 2014-10-02 11:48 - 00380416 _____ () C:\Users\Admin\Desktop\11d0cftl.exe
2014-10-02 11:47 - 2014-10-02 11:47 - 02108928 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-01 11:13 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 11:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-27 11:27 - 2014-09-27 11:27 - 00000000 ____D () C:\Users\y\AppData\Local\Lenovo
2014-09-25 21:09 - 2014-09-26 09:24 - 00000000 ____D () C:\Users\y\AppData\Local\Mozilla Thunderbird
2014-09-24 23:02 - 2014-09-24 23:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-24 09:50 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 09:50 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-21 17:30 - 2014-09-21 17:30 - 00791895 _____ () C:\Users\y\Downloads\OptiFine_1.7.10_HD_A4.jar
2014-09-21 17:22 - 2014-09-21 17:23 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-09-21 01:07 - 2014-09-21 01:07 - 00001478 _____ () C:\Users\y\AppData\Local\recently-used.xbel
2014-09-21 01:01 - 2014-09-21 01:09 - 00000000 ____D () C:\Users\y\AppData\Local\gtk-2.0
2014-09-21 01:00 - 2014-09-21 01:00 - 00000000 ____D () C:\Users\y\.thumbnails
2014-09-21 00:55 - 2014-09-21 01:09 - 00000000 ____D () C:\Users\y\.gimp-2.8
2014-09-21 00:55 - 2014-09-21 00:55 - 00000000 ____D () C:\Users\y\AppData\Local\gegl-0.2
2014-09-21 00:46 - 2014-09-21 00:46 - 00000905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-09-21 00:45 - 2014-09-21 00:46 - 00000000 ____D () C:\Program Files\GIMP 2
2014-09-21 00:25 - 2014-09-21 00:29 - 91931728 _____ (The GIMP Team ) C:\Users\y\Desktop\gimp-2.8.14-setup-1.exe
2014-09-21 00:17 - 2014-09-21 00:17 - 00001090 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\Users\y\AppData\Local\PDF24
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-09-20 23:59 - 2014-09-20 23:59 - 00000000 ____D () C:\Users\y\Desktop\SpritecraftFull
2014-09-19 22:27 - 2014-10-01 22:23 - 00000000 ____D () C:\Users\y\Desktop\Printables
2014-09-19 14:43 - 2014-09-19 14:43 - 00000000 ____D () C:\Program Files\Common Files\EPSON
2014-09-19 13:51 - 2014-09-19 13:51 - 00000000 ____D () C:\Users\y\AppData\Roaming\Epson
2014-09-19 13:38 - 2014-09-19 14:10 - 00002369 _____ () C:\Users\Public\Desktop\Epson Netzwerkhandbuch WF-3520 Series.lnk
2014-09-19 13:38 - 2014-09-19 14:09 - 00000279 _____ () C:\Users\Public\Desktop\Epson Benutzerhandbuch WF-3520 Series.url
2014-09-19 13:37 - 2014-09-22 15:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
2014-09-19 13:37 - 2014-09-22 15:47 - 00000000 ____D () C:\Program Files (x86)\Epson Software
2014-09-19 13:37 - 2014-09-19 13:37 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Epson
2014-09-19 13:36 - 2014-09-23 12:31 - 00000000 ____D () C:\Program Files (x86)\epson
2014-09-19 13:36 - 2014-09-22 15:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2014-09-19 13:35 - 2014-09-20 14:45 - 00000000 ____D () C:\ProgramData\EPSON
2014-09-19 13:35 - 2011-04-19 03:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMJJE.DLL
2014-09-19 13:35 - 2011-03-14 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BJJE.DLL
2014-09-19 13:35 - 2007-04-10 01:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2014-09-12 23:15 - 2014-09-12 23:15 - 00000000 ____D () C:\Users\y\AppData\Roaming\NVIDIA
2014-09-12 20:21 - 2014-10-03 00:09 - 00000000 ____D () C:\Users\y\AppData\Roaming\.minecraft
2014-09-12 20:12 - 2014-09-12 20:12 - 00675988 _____ () C:\Users\y\Desktop\Minecraft.exe
2014-09-12 16:54 - 2014-08-15 17:48 - 17868288 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 16:54 - 2014-08-15 17:36 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 16:54 - 2014-08-15 17:35 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 16:54 - 2014-08-15 17:31 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 16:54 - 2014-08-15 17:31 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 16:54 - 2014-08-15 17:30 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 16:54 - 2014-08-15 17:30 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-12 16:54 - 2014-08-15 17:30 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 02156032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 16:54 - 2014-08-15 17:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 16:54 - 2014-08-15 17:28 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 16:54 - 2014-08-15 17:28 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 16:54 - 2014-08-15 17:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-12 16:54 - 2014-08-15 17:28 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 16:54 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 16:54 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 16:54 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 16:54 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 16:54 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 16:54 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 16:54 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 16:54 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 16:54 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-09-12 16:54 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-09-12 16:46 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 16:46 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 08:44 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 08:44 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 08:44 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 08:44 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 08:44 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 08:44 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 08:44 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 08:44 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 08:44 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 08:44 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 08:44 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-04 01:02 - 2014-09-04 01:02 - 00012288 ___SH () C:\Users\y\Thumbs.db
2014-09-04 01:00 - 2014-09-04 01:00 - 00001024 _____ () C:\Users\Public\Desktop\PDF Architect 2.lnk
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\Users\Admin\Documents\PDF Architect 2
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\Program Files (x86)\PDF Architect 2
2014-09-04 00:59 - 2014-09-04 01:00 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-09-04 00:59 - 2014-04-25 17:44 - 00662288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2014-09-04 00:59 - 2014-04-25 17:44 - 00137000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMAPI32.OCX
2014-09-04 00:59 - 2014-04-25 17:44 - 00110264 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-09-04 00:59 - 2014-04-25 17:44 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPIDE.DLL
2014-09-04 00:59 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6DE.DLL
2014-09-04 00:59 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCDE.DLL
2014-09-04 00:59 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCC2DE.DLL
2014-09-04 00:56 - 2014-09-04 00:56 - 27843432 _____ (pdfforge ) C:\Users\y\Downloads\PDFCreator-1_7_3_setup.exe
==================== One Month Modified Files and Folders =======
(If an entry is included in the fixlist, the file\folder will be moved.)
2014-10-03 22:19 - 2014-08-07 11:38 - 00000000 ____D () C:\FRST
2014-10-03 22:16 - 2011-06-21 19:59 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2014-10-03 22:15 - 2009-07-14 06:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-03 22:15 - 2009-07-14 06:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-03 22:14 - 2011-06-21 19:59 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job
2014-10-03 22:06 - 2011-05-24 09:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-03 22:06 - 2010-11-21 05:47 - 00102902 _____ () C:\Windows\PFRO.log
2014-10-03 22:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-03 22:06 - 2009-07-14 06:51 - 00079685 _____ () C:\Windows\setupact.log
2014-10-03 22:05 - 2011-05-24 09:23 - 01677645 _____ () C:\Windows\WindowsUpdate.log
2014-10-03 22:00 - 2014-06-17 22:26 - 00323165 _____ () C:\Windows\IE11_main.log
2014-10-03 00:48 - 2014-06-24 12:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-02 22:30 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-10-02 22:26 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-02 22:24 - 2009-07-14 04:34 - 76808192 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-10-02 22:24 - 2009-07-14 04:34 - 17563648 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-10-02 22:24 - 2009-07-14 04:34 - 00524288 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-10-02 22:24 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-10-02 22:24 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-10-02 20:30 - 2009-07-14 07:08 - 00032624 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-02 13:11 - 2011-05-24 19:13 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-10-02 13:11 - 2011-05-24 19:13 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-10-02 13:11 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-02 12:35 - 2014-08-07 11:38 - 00040003 _____ () C:\Users\Admin\Desktop\FRST1.txt
2014-10-02 12:13 - 2014-08-07 11:10 - 00128728 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-02 11:51 - 2014-08-07 11:10 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-02 11:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-02 10:28 - 2014-08-11 22:40 - 00000000 ____D () C:\Users\y\Desktop\Rezepte
2014-10-01 21:15 - 2014-08-12 00:27 - 00000000 ____D () C:\Users\y\Handykarte Dateien
2014-09-27 13:56 - 2014-06-17 20:59 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-09-27 13:56 - 2011-05-24 18:46 - 00000000 ____D () C:\ProgramData\Lenovo
2014-09-27 13:55 - 2011-05-24 09:43 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-09-27 13:55 - 2011-05-24 09:28 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-09-27 13:55 - 2011-05-24 09:27 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-09-27 12:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-25 11:55 - 2014-06-17 20:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-22 15:53 - 2011-05-24 09:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-21 17:22 - 2014-06-24 12:47 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-21 17:22 - 2014-06-24 12:47 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-21 17:22 - 2011-06-25 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-21 01:00 - 2014-06-24 12:42 - 00000000 ____D () C:\Users\y
2014-09-21 00:16 - 2014-06-17 20:52 - 00122712 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-19 19:29 - 2014-08-14 11:38 - 00000000 ____D () C:\Users\y\Studium
2014-09-19 14:06 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-09-15 09:06 - 2010-11-21 05:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-12 16:54 - 2014-08-11 21:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-12 16:54 - 2011-06-22 22:29 - 01594892 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 16:53 - 2014-06-17 22:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 16:48 - 2014-06-24 13:18 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-12 16:47 - 2014-08-04 17:21 - 00001148 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-12 16:47 - 2011-06-21 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-12 16:47 - 2011-06-21 19:39 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-12 16:46 - 2014-06-17 22:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-12 16:46 - 2011-06-21 20:16 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 13:28 - 2014-08-11 22:40 - 00000000 ____D () C:\Users\y\Desktop\USB Maus
2014-09-05 11:51 - 2014-08-11 22:24 - 00000000 ____D () C:\Users\y\Bewerbungen
Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\y\AppData\Local\Temp\avgnt.exe
==================== Bamital & volsnap Check =================
(There is no automatic fix for files that do not pass verification.)
C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed
LastRegBack: 2014-09-27 11:55
==================== End Of Log ============================
|
|
03.10.2014, 23:26
| #13 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken. 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.10.2014, 02:51
| #14 |
| | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Ok, dann hier noch die neue Additions: Code:
ATTFilter Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-10-2014 01
Ran by Admin at 2014-10-04 03:44:17
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==========================================================
==================== Security Center ========================
(If an entry is included in the fixlist, it will be removed.)
AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
==================== Installed Programs ======================
(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)
7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version: - )
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.71.00 - )
Avira (HKLM-x32\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
Broadcom InConcert Maestro (HKLM\...\{57DD35E9-D9BB-4089-BB05-EF933C586CB3}) (Version: 1.0.1.1500 - Broadcom Corporation)
Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) Hidden
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.23.5 - Conexant)
Corel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)
Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) Hidden
Corel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.828 - Corel Inc.)
Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{650DE870-ECA3-4E63-8D77-778512BE5D4C}) (Version: - Microsoft)
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Direct DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) Hidden
Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7 (HKLM\...\DisableAMTPopup) (Version: 1.00 - )
Epson Benutzerhandbuch WF-3520 Series (HKLM-x32\...\WF-3520 Series Useg) (Version: - )
Epson Netzwerkhandbuch WF-3520 Series (HKLM-x32\...\WF-3520 Series Netg) (Version: - )
EPSON WF-3520 Series Printer Uninstall (HKLM\...\EPSON WF-3520 Series) (Version: - SEIKO EPSON Corporation)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Integrated Camera Driver Installer Package Ver.1.1.0.1147 (HKLM-x32\...\{B2CA6F37-1602-4823-81B5-0384B6888AA6}) (Version: 1.1.0.1147 - RICOH)
Integrated Camera TWAIN (HKLM-x32\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.)
Intel PROSet Wireless (Version: - ) Hidden
Intel PROSet Wireless (x32 Version: - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Identity Protection Technology 1.0.74.0 (HKLM-x32\...\{C6D4B05A-EA7E-1027-80EF-C925E740E99C}) (Version: 1.0.74.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 18.7 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2538 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{3C41721F-AF0F-4086-AA1C-4C7F29076228}) (Version: 14.01.1000 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version: - )
Intel(R) Wireless Display (HKLM-x32\...\{F84906ED-BB54-4889-B131-FED9C9056FC8}) (Version: 2.0.27.0 - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.00 - )
Lenovo Mobile Broadband Activation (HKLM-x32\...\{A95D9DF7-CF34-421A-A1DC-936A49A4DAEA}) (Version: 4.0.0013.00 - Lenovo Group Limited)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Lenovo Screen Reading Optimizer (HKLM-x32\...\{91A29166-4E1B-4664-B70B-4C4A3B6B3372}) (Version: 1.07 - Lenovo)
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5849.23 - PC-Doctor, Inc.)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0008.00 - Ihr Firmenname)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0005.00 - Lenovo)
Lenovo Welcome (HKLM-x32\...\Lenovo Welcome_is1) (Version: 2.02.003.0 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Message Center Plus (HKLM-x32\...\{FD331A3B-F7A5-4C31-B8D4-DF413C85AF7A}) (Version: 2.0.0012.00 - Lenovo Group Limited)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Mobile Broadband Drivers (HKLM-x32\...\{EA9640BE-414E-4195-B53B-7905BF1A5A09}) (Version: 6.5.1.5 - Ericsson AB)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA 3D Vision Treiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 312.69 - NVIDIA Corporation)
NVIDIA Grafiktreiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 312.69 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
PANTONE Color Calibrator 1.0 (HKLM-x32\...\PANTONE Color Calibrator_is1) (Version: - X-Rite)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{C960FF38-431D-429D-AD1F-FBD12A45B7C5}) (Version: 2.0.17.17583 - pdfforge GmbH)
PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version: - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (HKLM\...\EnablePS) (Version: 1.00 - )
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
RICOH Media Driver v2.10.18.02 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.10.18.02 - RICOH)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version: - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version: - Microsoft) Hidden
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version: - )
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6C9D5F7-630C-4125-8C4E-94AF77C1896E}) (Version: 6.4.0.1500 - Broadcom Corporation)
ThinkPad Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 3.62 - )
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.40 - )
ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 6.21 - Lenovo)
ThinkVantage AutoLock (HKLM\...\{E224B44B-B5EB-4af3-A80A-A255358E241A}_is1) (Version: 1.04 - Lenovo)
ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 2.07 - Lenovo)
ThinkVantage Fingerprint Software (HKLM\...\{F58DA859-016E-492D-A588-317D9BB28002}) (Version: 5.9.9.7282 - Authentec Inc.)
ThinkVantage GPS (HKLM-x32\...\{6DB21B2C-2BEF-44B4-B264-8EC2BC2369C6}) (Version: 2.80 - Lenovo)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version: - Microsoft)
Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9179FC17-97A8-4D98-9E09-05720AF5D44E}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version: - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version: - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version: - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version: - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version: - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version: - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version: - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version: - Microsoft)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Intel (e1cexpress) Net (12/21/2010 11.8.84.0) (HKLM\...\6D23A494E9A245843FB8584D9307D3E328DF8613) (Version: 12/21/2010 11.8.84.0 - Intel)
Windows-Treiberpaket - Intel (MEIx64) System (10/19/2010 7.0.0.1144) (HKLM\...\90FD26A77B849AE03FF5F07A1CDA7F950406A8D8) (Version: 10/19/2010 7.0.0.1144 - Intel)
Windows-Treiberpaket - Intel System (09/10/2010 9.2.0.1011) (HKLM\...\0CDBDD444A1F5FFEA227B4E7DCE195F11F08240A) (Version: 09/10/2010 9.2.0.1011 - Intel)
Windows-Treiberpaket - Intel System (09/10/2010 9.2.0.1011) (HKLM\...\A513FC5E5A08D4EF27F234E91E0E942A0234210B) (Version: 09/10/2010 9.2.0.1011 - Intel)
Windows-Treiberpaket - Intel System (10/04/2010 9.2.0.1015) (HKLM\...\FE1BEBFD475BB832AAF104F5C63348E98A9286DF) (Version: 10/04/2010 9.2.0.1015 - Intel)
Windows-Treiberpaket - Intel USB (09/16/2010 9.2.0.1013) (HKLM\...\D97688B8E3830BF9820E15EB8D9552DCBF988CFD) (Version: 09/16/2010 9.2.0.1013 - Intel)
Windows-Treiberpaket - Lenovo 1.61.00.11 (11/11/2010 1.61.00.11) (HKLM\...\466E9B20D871055D6D3CDA2CDD1D355E978A61AF) (Version: 11/11/2010 1.61.00.11 - Lenovo)
Windows-Treiberpaket - Synaptics (SynTP) Mouse (02/17/2011 15.2.14.0) (HKLM\...\77A943AB876C131591E0EA5DB6AB08D89EE2EA9E) (Version: 02/17/2011 15.2.14.0 - Synaptics)
X-Rite Device i1Display Service (HKLM-x32\...\{D2A53206-6A9E-4241-B21C-D94140EEF1CE}_is1) (Version: 1.0 - X-Rite Inc.)
X-Rite Device Manager (HKLM-x32\...\{9ACEA9CD-63B9-4784-807B-EA295E96A7C3}_is1) (Version: 1.0 - X-Rite Inc.)
==================== Custom CLSID (selected items): ==========================
(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)
==================== Restore Points =========================
03-10-2014 19:57:50 Windows Update
==================== Hosts content: ==========================
(If needed Hosts: directive could be included in the fixlist to reset Hosts.)
2009-07-14 04:34 - 2014-10-02 22:24 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1 localhost
==================== Scheduled Tasks (whitelisted) =============
(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)
Task: {1B4ECB35-36E2-436D-9F92-6E77BA54A061} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {2250233B-A91F-453F-9969-928AA4A2F096} - System32\Tasks\PCDoctorBackgroundMonitorTask-Delay => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {228BCBEF-4341-4187-A897-495238E406F7} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {474F18C8-A337-433A-AE5E-44A4DD1545D3} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {578223BE-BB63-4563-8BFD-5D5108542391} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-05-27] (Lenovo)
Task: {69033D1C-86B9-46A6-BCC6-E7364DD84646} - System32\Tasks\MCP => C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe [2009-05-27] ()
Task: {94E4E220-421A-4B2F-9FA5-0C6731235738} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-21] (Adobe Systems Incorporated)
Task: {B40C9D21-6759-4886-B553-CC3BC215678A} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {BF9A603C-8A54-44D3-9E8F-C78BE2749BCE} - System32\Tasks\Lenovo\SROptimizer => %TRPATH%\SRORest.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe
==================== Loaded Modules (whitelisted) =============
2014-06-17 21:11 - 2013-10-29 02:53 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-05-02 13:41 - 2011-05-02 13:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2011-05-24 09:36 - 2011-07-04 03:02 - 00055296 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-05-24 09:32 - 2010-10-26 10:40 - 00049056 ____N () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2011-05-02 13:41 - 2011-05-02 13:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-05-24 09:33 - 2011-03-06 13:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2010-12-18 15:50 - 2010-12-18 15:50 - 00173856 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 10383872 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
2014-03-14 17:47 - 2014-03-14 17:47 - 00092504 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2011-09-23 20:10 - 2011-06-29 18:09 - 02085888 _____ () C:\Program Files\Lenovo\AutoLock\cv210.dll
2011-09-23 20:10 - 2011-06-29 18:09 - 02201088 _____ () C:\Program Files\Lenovo\AutoLock\cxcore210.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 00898560 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\libxml2.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 00073728 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\zlib1.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 03449344 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\CxF2_VC90MD_2.1.dll
2011-05-24 09:38 - 2010-12-15 22:54 - 07390720 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtGui4.dll
2011-05-24 09:38 - 2010-12-15 22:54 - 02012160 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtCore4.dll
2014-10-02 22:53 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\Admin\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2011-05-24 09:32 - 2011-05-26 17:17 - 00065576 ____R () C:\Program Files (x86)\Mobile Broadband drivers\WMCore\MBMDebug.dll
==================== Alternate Data Streams (whitelisted) =========
(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)
AlternateDataStreams: C:\Users\y\Desktop\MagicLauncher_1.2.5.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\audacity-win-2.0.5.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\blender-2.69-windows64.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\ChromeSetup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\Citavi4Setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\install_flashplayer13x32au_mssd_aaa_aih.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\jdk-8u5-windows-x64.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\jre-8u5-windows-i586-iftw.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\KiesSetup_2.6.1.13105_7.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\liteloader-installer-1.7.2-04.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\MP3SkypeRecorder31Setup(1).exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\MP3SkypeRecorder31Setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\NCInst64_7.4.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\nitro_pdf_reader3565_64_dlm.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\PDFCreator-1_7_2_setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\povwin-3.7-agpl3-setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\PSI9015Setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\Thunderbird Setup 24.3.0.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\v3dSetup.exe:BDU
==================== Safe Mode (whitelisted) ===================
(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)
==================== EXE Association (whitelisted) =============
(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)
==================== MSCONFIG/TASK MANAGER disabled items =========
(Currently there is no automatic fix for this section.)
========================= Accounts: ==========================
Admin (S-1-5-21-3141125159-651349833-1633251973-1006 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-3141125159-651349833-1633251973-500 - Administrator - Disabled)
Gast (S-1-5-21-3141125159-651349833-1633251973-501 - Limited - Enabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-3141125159-651349833-1633251973-1008 - Limited - Enabled)
tvsu_tmp_onjimBYVYD (S-1-5-21-3141125159-651349833-1633251973-1010 - Administrator - Enabled)
UpdatusUser (S-1-5-21-3141125159-651349833-1633251973-1000 - Limited - Enabled) => C:\Users\UpdatusUser
y (S-1-5-21-3141125159-651349833-1633251973-1009 - Limited - Enabled) => C:\Users\y
==================== Faulty Device Manager Devices =============
Name: SMI Helper Driver (smihlp)
Description: SMI Helper Driver (smihlp)
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer:
Service: smihlp
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.
==================== Event log errors: =========================
Application errors:
==================
Error: (10/04/2014 03:39:35 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
System errors:
=============
Error: (10/04/2014 03:42:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet:
%%1069
Error: (10/04/2014 03:42:48 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden:
%%1330
Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).
Error: (10/04/2014 03:39:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SMI Helper Driver (smihlp)" wurde aufgrund folgenden Fehlers nicht gestartet:
%%2
Error: (10/04/2014 00:14:02 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}
Microsoft Office Sessions:
=========================
Error: (10/04/2014 03:39:35 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003
CodeIntegrity Errors:
===================================
Date: 2014-10-02 22:23:38.801
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2014-10-02 22:23:38.754
Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.
Date: 2011-06-26 13:11:21.363
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:21.303
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:21.243
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:21.063
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.953
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.803
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.713
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
Date: 2011-06-26 13:11:20.653
Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.
==================== Memory info ===========================
Processor: Intel(R) Core(TM) i7-2820QM CPU @ 2.30GHz
Percentage of memory in use: 24%
Total physical RAM: 8075.23 MB
Available physical RAM: 6114.91 MB
Total Pagefile: 16148.65 MB
Available Pagefile: 14071.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB
==================== Drives ================================
Drive c: (Windows7_OS) (Fixed) (Total:674.01 GB) (Free:417.69 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive q: (Lenovo_Recovery) (Fixed) (Total:23.46 GB) (Free:14.01 GB) NTFS
==================== MBR & Partition Table ==================
========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: C42CD616)
Partition 1: (Active) - (Size=1.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=674 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=23.5 GB) - (Type=07 NTFS)
==================== End Of Log ============================
|
|
04.10.2014, 12:10
| #15 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter Okay, dann Kontrollscans mit MBAM und ESET bitte: Downloade Dir bitte  Malwarebytes Anti-Malware
ESET Online Scanner
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter |
| browser, explorer, fehlercode 0x5, fehlercode 24, firewall, flash player, herunterfahren, hängen, iexplore.exe, keine rückmeldung, programm, pwmtr64v.dll, services.exe, software, svchost.exe, tr/crypt.xpack.gen, tr/crypt.xpack.gen5, trojaner, win32/installmonetizer.aq, win32/softonicdownloader.a, win32/toolbar.conduit, win32/toolbar.conduit.ai, windows 7, winlogon.exe |
Linear-Darstellung
