Hallo Arne,

habe eben den Upload durchgeführt.

Grüße Bebbo

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten, Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

Hallo Arne,

hier das TDSS Logfile:

12:44:25.0150 3128	TDSS rootkit removing tool 2.7.35.0 May 16 2012 07:37:57
12:44:25.0169 3128	============================================================
12:44:25.0169 3128	Current date / time: 2012/05/21 12:44:25.0169
12:44:25.0169 3128	SystemInfo:
12:44:25.0169 3128
12:44:25.0169 3128	OS Version: 6.1.7601 ServicePack: 1.0
12:44:25.0169 3128	Product type: Workstation
12:44:25.0169 3128	ComputerName: ***-PC
12:44:25.0169 3128	UserName: ***
12:44:25.0170 3128	Windows directory: C:\Windows
12:44:25.0170 3128	System windows directory: C:\Windows
12:44:25.0170 3128	Running under WOW64
12:44:25.0170 3128	Processor architecture: Intel x64
12:44:25.0170 3128	Number of processors: 2
12:44:25.0170 3128	Page size: 0x1000
12:44:25.0170 3128	Boot type: Normal boot
12:44:25.0170 3128	============================================================
12:44:26.0868 3128	Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
12:44:26.0879 3128	Drive \Device\Harddisk1\DR1 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
12:44:29.0929 3128	============================================================
12:44:29.0929 3128	\Device\Harddisk0\DR0:
12:44:29.0992 3128	MBR partitions:
12:44:29.0992 3128	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x139C5, BlocksNum 0x1D4C000
12:44:29.0992 3128	\Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1D5F9C5, BlocksNum 0x38625E6B
12:44:29.0992 3128	\Device\Harddisk1\DR1:
12:44:29.0993 3128	MBR partitions:
12:44:29.0993 3128	\Device\Harddisk1\DR1\Partition0: MBR, Type 0x7, StartLBA 0x40, BlocksNum 0x4A856E81
12:44:29.0993 3128	============================================================
12:44:30.0017 3128	C: <-> \Device\Harddisk0\DR0\Partition1
12:44:30.0049 3128	D: <-> \Device\Harddisk0\DR0\Partition0
12:44:30.0089 3128	G: <-> \Device\Harddisk1\DR1\Partition0
12:44:30.0089 3128	============================================================
12:44:30.0089 3128	Initialize success
12:44:30.0089 3128	============================================================
12:45:04.0109 5472	============================================================
12:45:04.0109 5472	Scan started
12:45:04.0109 5472	Mode: Manual; SigCheck; TDLFS;
12:45:04.0109 5472	============================================================
12:45:04.0914 5472	!SASCORE        (7d9d615201a483d6fa99491c2e655a5a) C:\Program Files\SUPERAntiSpyware\SASCORE64.EXE
12:45:04.0999 5472	!SASCORE - ok
12:45:05.0559 5472	1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
12:45:05.0657 5472	1394ohci - ok
12:45:05.0800 5472	AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) C:\Program Files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
12:45:05.0822 5472	AAV UpdateService - ok
12:45:05.0899 5472	ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
12:45:05.0931 5472	ACPI - ok
12:45:05.0976 5472	AcpiPmi         (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
12:45:06.0075 5472	AcpiPmi - ok
12:45:06.0197 5472	AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
12:45:06.0214 5472	AdobeARMservice - ok
12:45:06.0388 5472	AdobeFlashPlayerUpdateSvc (76d5a3d2a50402a0b9b6ed13c4371e79) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
12:45:06.0420 5472	AdobeFlashPlayerUpdateSvc - ok
12:45:06.0501 5472	adp94xx         (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
12:45:06.0540 5472	adp94xx - ok
12:45:06.0600 5472	adpahci         (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
12:45:06.0634 5472	adpahci - ok
12:45:06.0711 5472	adpu320         (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
12:45:06.0740 5472	adpu320 - ok
12:45:06.0795 5472	AeLookupSvc     (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
12:45:06.0893 5472	AeLookupSvc - ok
12:45:07.0049 5472	AESTFilters     (a6fb9db8f1a86861d955fd6975977ae0) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe
12:45:07.0140 5472	AESTFilters - ok
12:45:07.0243 5472	AFD             (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
12:45:07.0318 5472	AFD - ok
12:45:07.0359 5472	agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
12:45:07.0391 5472	agp440 - ok
12:45:07.0454 5472	ALG             (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
12:45:07.0539 5472	ALG - ok
12:45:07.0569 5472	aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
12:45:07.0593 5472	aliide - ok
12:45:07.0660 5472	AMD External Events Utility (f238be4fa4e55eb67f17281fadf69851) C:\Windows\system32\atiesrxx.exe
12:45:07.0769 5472	AMD External Events Utility - ok
12:45:07.0796 5472	amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
12:45:07.0820 5472	amdide - ok
12:45:07.0875 5472	AmdK8           (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
12:45:07.0926 5472	AmdK8 - ok
12:45:07.0963 5472	AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
12:45:08.0028 5472	AmdPPM - ok
12:45:08.0076 5472	amdsata         (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
12:45:08.0102 5472	amdsata - ok
12:45:08.0129 5472	amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
12:45:08.0160 5472	amdsbs - ok
12:45:08.0191 5472	amdxata         (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
12:45:08.0214 5472	amdxata - ok
12:45:08.0274 5472	AppID           (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
12:45:08.0367 5472	AppID - ok
12:45:08.0417 5472	AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
12:45:08.0511 5472	AppIDSvc - ok
12:45:08.0600 5472	Appinfo         (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
12:45:08.0702 5472	Appinfo - ok
12:45:08.0852 5472	Apple Mobile Device (20f6f19fe9e753f2780dc2fa083ad597) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
12:45:08.0870 5472	Apple Mobile Device - ok
12:45:08.0942 5472	arc             (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
12:45:08.0967 5472	arc - ok
12:45:09.0147 5472	arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
12:45:09.0252 5472	arcsas - ok
12:45:09.0295 5472	AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
12:45:09.0385 5472	AsyncMac - ok
12:45:09.0439 5472	atapi           (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
12:45:09.0462 5472	atapi - ok
12:45:09.0524 5472	AtiHdmiService  (3b9014fb7ce9e20fd726321c7db7d8b0) C:\Windows\system32\drivers\AtiHdmi.sys
12:45:09.0568 5472	AtiHdmiService - ok
12:45:09.0987 5472	atikmdag        (2db9047aac9d981f59ce06d04d70c4d8) C:\Windows\system32\DRIVERS\atikmdag.sys
12:45:10.0177 5472	atikmdag - ok
12:45:10.0457 5472	AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
12:45:10.0564 5472	AudioEndpointBuilder - ok
12:45:10.0576 5472	AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
12:45:10.0667 5472	AudioSrv - ok
12:45:10.0746 5472	AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
12:45:10.0857 5472	AxInstSV - ok
12:45:11.0010 5472	b06bdrv         (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
12:45:11.0081 5472	b06bdrv - ok
12:45:11.0158 5472	b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
12:45:11.0214 5472	b57nd60a - ok
12:45:11.0390 5472	BBSvc           (01a24b415926bb5f772dbe12459d97de) C:\Program Files (x86)\Microsoft\BingBar\BBSvc.EXE
12:45:11.0421 5472	BBSvc - ok
12:45:11.0512 5472	BBUpdate        (785de7abda13309d6065305542829e76) C:\Program Files (x86)\Microsoft\BingBar\SeaPort.EXE
12:45:11.0542 5472	BBUpdate - ok
12:45:11.0616 5472	BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
12:45:11.0691 5472	BDESVC - ok
12:45:11.0753 5472	Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
12:45:11.0857 5472	Beep - ok
12:45:11.0978 5472	BFE             (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
12:45:12.0056 5472	BFE - ok
12:45:12.0337 5472	BHDrvx64        (5b1fe9d351c284701c8051da2aa81df6) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\BASHDefs\20120507.001\BHDrvx64.sys
12:45:12.0408 5472	BHDrvx64 - ok
12:45:12.0635 5472	BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
12:45:12.0741 5472	BITS - ok
12:45:12.0872 5472	blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
12:45:12.0934 5472	blbdrive - ok
12:45:13.0123 5472	Bonjour Service (f2060a34c8a75bc24a9222eb4f8c07bd) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
12:45:13.0147 5472	Bonjour Service - ok
12:45:13.0187 5472	bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
12:45:13.0244 5472	bowser - ok
12:45:13.0298 5472	BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
12:45:13.0363 5472	BrFiltLo - ok
12:45:13.0383 5472	BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
12:45:13.0413 5472	BrFiltUp - ok
12:45:13.0477 5472	Browser         (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
12:45:13.0560 5472	Browser - ok
12:45:13.0603 5472	Brserid         (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
12:45:13.0697 5472	Brserid - ok
12:45:13.0738 5472	BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
12:45:13.0797 5472	BrSerWdm - ok
12:45:13.0830 5472	BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
12:45:13.0885 5472	BrUsbMdm - ok
12:45:13.0905 5472	BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
12:45:13.0956 5472	BrUsbSer - ok
12:45:14.0015 5472	BthEnum         (cf98190a94f62e405c8cb255018b2315) C:\Windows\system32\drivers\BthEnum.sys
12:45:14.0147 5472	BthEnum - ok
12:45:14.0169 5472	BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
12:45:14.0221 5472	BTHMODEM - ok
12:45:14.0456 5472	BthPan          (02dd601b708dd0667e1331fa8518e9ff) C:\Windows\system32\DRIVERS\bthpan.sys
12:45:14.0513 5472	BthPan - ok
12:45:14.0613 5472	BTHPORT         (64c198198501f7560ee41d8d1efa7952) C:\Windows\system32\Drivers\BTHport.sys
12:45:14.0668 5472	BTHPORT - ok
12:45:14.0718 5472	bthserv         (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
12:45:14.0801 5472	bthserv - ok
12:45:14.0827 5472	BTHUSB          (f188b7394d81010767b6df3178519a37) C:\Windows\system32\Drivers\BTHUSB.sys
12:45:14.0887 5472	BTHUSB - ok
12:45:14.0943 5472	btwaudio        (e2677b9234e4c31055b940b70536d377) C:\Windows\system32\drivers\btwaudio.sys
12:45:14.0964 5472	btwaudio - ok
12:45:15.0003 5472	btwavdt         (e59a0c091ae64063b53b9ac1294a3679) C:\Windows\system32\drivers\btwavdt.sys
12:45:15.0026 5472	btwavdt - ok
12:45:15.0227 5472	btwdins         (51342b4a550b8d6d2fcafa5bc198e8c1) C:\Program Files\WIDCOMM\Bluetooth Software\bin\btwdins.exe
12:45:15.0277 5472	btwdins - ok
12:45:15.0349 5472	btwl2cap        (d33875ca5940f2e0ed06fb74d556e2db) C:\Windows\system32\DRIVERS\btwl2cap.sys
12:45:15.0368 5472	btwl2cap - ok
12:45:15.0391 5472	btwrchid        (a465b855cef659655de80d012c2de761) C:\Windows\system32\DRIVERS\btwrchid.sys
12:45:15.0409 5472	btwrchid - ok
12:45:15.0472 5472	BVRPMPR5a64     (9887ca12f407d7fbc7f48f3678f5f0b6) C:\Windows\system32\drivers\BVRPMPR5a64.SYS
12:45:15.0498 5472	BVRPMPR5a64 - ok
12:45:15.0606 5472	ccSet_NAV       (0e1737a63aec0f6de231bb59836c0a11) C:\Windows\system32\drivers\NAVx64\1307000.009\ccSetx64.sys
12:45:15.0630 5472	ccSet_NAV - ok
12:45:15.0714 5472	cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
12:45:15.0804 5472	cdfs - ok
12:45:15.0872 5472	cdrom           (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\drivers\cdrom.sys
12:45:15.0917 5472	cdrom - ok
12:45:15.0971 5472	CertPropSvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
12:45:16.0101 5472	CertPropSvc - ok
12:45:16.0180 5472	circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
12:45:16.0280 5472	circlass - ok
12:45:16.0359 5472	CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
12:45:16.0393 5472	CLFS - ok
12:45:16.0503 5472	clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:45:16.0525 5472	clr_optimization_v2.0.50727_32 - ok
12:45:16.0644 5472	clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
12:45:16.0666 5472	clr_optimization_v2.0.50727_64 - ok
12:45:16.0758 5472	clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:45:16.0783 5472	clr_optimization_v4.0.30319_32 - ok
12:45:16.0845 5472	clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
12:45:16.0868 5472	clr_optimization_v4.0.30319_64 - ok
12:45:16.0922 5472	CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
12:45:16.0967 5472	CmBatt - ok
12:45:17.0012 5472	cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
12:45:17.0035 5472	cmdide - ok
12:45:17.0094 5472	CNG             (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
12:45:17.0143 5472	CNG - ok
12:45:17.0222 5472	Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
12:45:17.0245 5472	Compbatt - ok
12:45:17.0290 5472	CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
12:45:17.0329 5472	CompositeBus - ok
12:45:17.0341 5472	COMSysApp - ok
12:45:17.0365 5472	crcdisk         (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
12:45:17.0388 5472	crcdisk - ok
12:45:17.0457 5472	CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
12:45:17.0544 5472	CryptSvc - ok
12:45:17.0600 5472	CtClsFlt        (ed5cf92396a62f4c15110dcdb5e854d9) C:\Windows\system32\DRIVERS\CtClsFlt.sys
12:45:17.0651 5472	CtClsFlt - ok
12:45:17.0756 5472	DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
12:45:17.0851 5472	DcomLaunch - ok
12:45:17.0945 5472	defragsvc       (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
12:45:18.0033 5472	defragsvc - ok
12:45:18.0084 5472	DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
12:45:18.0192 5472	DfsC - ok
12:45:18.0266 5472	dg_ssudbus      (388039f99ce8769024ee0438352aca99) C:\Windows\system32\DRIVERS\ssudbus.sys
12:45:18.0290 5472	dg_ssudbus - ok
12:45:18.0387 5472	Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
12:45:18.0475 5472	Dhcp - ok
12:45:18.0516 5472	discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
12:45:18.0615 5472	discache - ok
12:45:18.0670 5472	Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
12:45:18.0695 5472	Disk - ok
12:45:18.0732 5472	Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
12:45:18.0816 5472	Dnscache - ok
12:45:18.0936 5472	DockLoginService (0840abbbdf438691ee65a20040635cbe) C:\Program Files\Dell\DellDock\DockLogin.exe
12:45:19.0013 5472	DockLoginService ( UnsignedFile.Multi.Generic ) - warning
12:45:19.0013 5472	DockLoginService - detected UnsignedFile.Multi.Generic (1)
12:45:19.0075 5472	dot3svc         (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
12:45:19.0163 5472	dot3svc - ok
12:45:19.0207 5472	DPS             (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
12:45:19.0295 5472	DPS - ok
12:45:19.0356 5472	drmkaud         (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
12:45:19.0386 5472	drmkaud - ok
12:45:19.0443 5472	DSI_SiUSBXp_3_1 (50aad2a07bd8b90a8cfb4f6d7a4d165a) C:\Windows\system32\drivers\DSI_SiUSBXp_3_1.sys
12:45:19.0472 5472	DSI_SiUSBXp_3_1 - ok
12:45:19.0613 5472	DXGKrnl         (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
12:45:19.0665 5472	DXGKrnl - ok
12:45:19.0721 5472	EapHost         (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
12:45:19.0808 5472	EapHost - ok
12:45:20.0093 5472	ebdrv           (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
12:45:20.0219 5472	ebdrv - ok
12:45:20.0367 5472	eeCtrl          (0c3f9eff8ddd9f9eb56d754b4620155f) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
12:45:20.0410 5472	eeCtrl - ok
12:45:20.0573 5472	EFS             (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
12:45:20.0681 5472	EFS - ok
12:45:20.0820 5472	ehRecvr         (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
12:45:20.0926 5472	ehRecvr - ok
12:45:20.0981 5472	ehSched         (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
12:45:21.0054 5472	ehSched - ok
12:45:21.0211 5472	elxstor         (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
12:45:21.0251 5472	elxstor - ok
12:45:21.0390 5472	EraserUtilRebootDrv (8c0f9b877bc0b7ffd327ef55f9efb642) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
12:45:21.0412 5472	EraserUtilRebootDrv - ok
12:45:21.0438 5472	ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
12:45:21.0489 5472	ErrDev - ok
12:45:21.0592 5472	EventSystem     (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
12:45:21.0701 5472	EventSystem - ok
12:45:21.0763 5472	exfat           (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
12:45:21.0850 5472	exfat - ok
12:45:21.0890 5472	fastfat         (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
12:45:21.0983 5472	fastfat - ok
12:45:22.0110 5472	Fax             (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
12:45:22.0167 5472	Fax - ok
12:45:22.0222 5472	fdc             (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
12:45:22.0249 5472	fdc - ok
12:45:22.0293 5472	fdPHost         (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
12:45:22.0391 5472	fdPHost - ok
12:45:22.0415 5472	FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
12:45:22.0504 5472	FDResPub - ok
12:45:22.0532 5472	FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
12:45:22.0557 5472	FileInfo - ok
12:45:22.0575 5472	Filetrace       (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
12:45:22.0673 5472	Filetrace - ok
12:45:22.0717 5472	flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
12:45:22.0741 5472	flpydisk - ok
12:45:22.0824 5472	FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
12:45:22.0856 5472	FltMgr - ok
12:45:22.0975 5472	FontCache       (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
12:45:23.0102 5472	FontCache - ok
12:45:23.0272 5472	FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
12:45:23.0291 5472	FontCache3.0.0.0 - ok
12:45:23.0393 5472	FsDepends       (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
12:45:23.0418 5472	FsDepends - ok
12:45:23.0447 5472	Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
12:45:23.0471 5472	Fs_Rec - ok
12:45:23.0542 5472	fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
12:45:23.0578 5472	fvevol - ok
12:45:23.0603 5472	gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
12:45:23.0628 5472	gagp30kx - ok
12:45:23.0658 5472	GEARAspiWDM     (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
12:45:23.0676 5472	GEARAspiWDM - ok
12:45:23.0773 5472	gpsvc           (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
12:45:23.0887 5472	gpsvc - ok
12:45:23.0915 5472	grmnusb         (2ed7ff3e1ada4092632393781518b3a7) C:\Windows\system32\drivers\grmnusb.sys
12:45:23.0935 5472	grmnusb - ok
12:45:24.0066 5472	gupdate         (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
12:45:24.0088 5472	gupdate - ok
12:45:24.0105 5472	gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
12:45:24.0124 5472	gupdatem - ok
12:45:24.0168 5472	hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
12:45:24.0220 5472	hcw85cir - ok
12:45:24.0290 5472	HdAudAddService (6410f6f415b2a5a9037224c41da8bf12) C:\Windows\system32\drivers\HdAudio.sys
12:45:24.0353 5472	HdAudAddService - ok
12:45:24.0407 5472	HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
12:45:24.0460 5472	HDAudBus - ok
12:45:24.0511 5472	HidBatt         (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
12:45:24.0548 5472	HidBatt - ok
12:45:24.0587 5472	HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
12:45:24.0657 5472	HidBth - ok
12:45:24.0696 5472	HidIr           (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
12:45:24.0726 5472	HidIr - ok
12:45:24.0770 5472	hidserv         (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
12:45:24.0845 5472	hidserv - ok
12:45:24.0890 5472	HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
12:45:24.0915 5472	HidUsb - ok
12:45:24.0966 5472	hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
12:45:25.0075 5472	hkmsvc - ok
12:45:25.0139 5472	HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
12:45:25.0193 5472	HomeGroupListener - ok
12:45:25.0260 5472	HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
12:45:25.0314 5472	HomeGroupProvider - ok
12:45:25.0364 5472	HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
12:45:25.0392 5472	HpSAMD - ok
12:45:25.0499 5472	HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
12:45:25.0600 5472	HTTP - ok
12:45:25.0646 5472	hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
12:45:25.0669 5472	hwpolicy - ok
12:45:25.0731 5472	i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
12:45:25.0757 5472	i8042prt - ok
12:45:25.0823 5472	iaStorV         (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
12:45:25.0858 5472	iaStorV - ok
12:45:26.0014 5472	IDriverT        (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
12:45:26.0039 5472	IDriverT ( UnsignedFile.Multi.Generic ) - warning
12:45:26.0039 5472	IDriverT - detected UnsignedFile.Multi.Generic (1)
12:45:26.0269 5472	idsvc           (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
12:45:26.0313 5472	idsvc - ok
12:45:26.0561 5472	IDSVia64        (4e9e0e5a3b0efeb27491c26be1d97fda) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\IPSDefs\20120518.001\IDSvia64.sys
12:45:26.0591 5472	IDSVia64 - ok
12:45:26.0767 5472	iirsp           (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
12:45:26.0792 5472	iirsp - ok
12:45:26.0935 5472	IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
12:45:27.0042 5472	IKEEXT - ok
12:45:27.0078 5472	intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
12:45:27.0102 5472	intelide - ok
12:45:27.0174 5472	intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
12:45:27.0218 5472	intelppm - ok
12:45:27.0303 5472	IPBusEnum       (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
12:45:27.0415 5472	IPBusEnum - ok
12:45:27.0511 5472	IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:45:27.0621 5472	IpFilterDriver - ok
12:45:27.0712 5472	iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
12:45:27.0825 5472	iphlpsvc - ok
12:45:27.0862 5472	IPMIDRV         (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
12:45:27.0927 5472	IPMIDRV - ok
12:45:27.0985 5472	IPNAT           (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
12:45:28.0075 5472	IPNAT - ok
12:45:28.0149 5472	IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
12:45:28.0210 5472	IRENUM - ok
12:45:28.0286 5472	isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
12:45:28.0311 5472	isapnp - ok
12:45:28.0383 5472	iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
12:45:28.0414 5472	iScsiPrt - ok
12:45:28.0503 5472	k57nd60a        (7dbafe10c1b777305c80bea42fbda710) C:\Windows\system32\DRIVERS\k57nd60a.sys
12:45:28.0579 5472	k57nd60a - ok
12:45:28.0641 5472	kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
12:45:28.0687 5472	kbdclass - ok
12:45:28.0737 5472	kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
12:45:28.0797 5472	kbdhid - ok
12:45:28.0848 5472	KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:45:28.0873 5472	KeyIso - ok
12:45:28.0925 5472	KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
12:45:28.0950 5472	KSecDD - ok
12:45:29.0001 5472	KSecPkg         (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
12:45:29.0028 5472	KSecPkg - ok
12:45:29.0086 5472	ksthunk         (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
12:45:29.0189 5472	ksthunk - ok
12:45:29.0252 5472	KtmRm           (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
12:45:29.0373 5472	KtmRm - ok
12:45:29.0771 5472	LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
12:45:29.0886 5472	LanmanServer - ok
12:45:29.0938 5472	LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
12:45:30.0033 5472	LanmanWorkstation - ok
12:45:30.0173 5472	LBTServ         (88e52495b47c67126b510af53fdb0bc7) C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
12:45:30.0217 5472	LBTServ - ok
12:45:30.0281 5472	LHidFilt        (b6552d382ff070b4ed34cbd6737277c0) C:\Windows\system32\DRIVERS\LHidFilt.Sys
12:45:30.0321 5472	LHidFilt - ok
12:45:30.0379 5472	lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
12:45:30.0467 5472	lltdio - ok
12:45:30.0551 5472	lltdsvc         (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
12:45:30.0672 5472	lltdsvc - ok
12:45:30.0716 5472	lmhosts         (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
12:45:30.0809 5472	lmhosts - ok
12:45:30.0885 5472	LMouFilt        (73c1f563ab73d459dffe682d66476558) C:\Windows\system32\DRIVERS\LMouFilt.Sys
12:45:30.0904 5472	LMouFilt - ok
12:45:30.0949 5472	LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
12:45:30.0997 5472	LSI_FC - ok
12:45:31.0079 5472	LSI_SAS         (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
12:45:31.0104 5472	LSI_SAS - ok
12:45:31.0125 5472	LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
12:45:31.0151 5472	LSI_SAS2 - ok
12:45:31.0208 5472	LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
12:45:31.0235 5472	LSI_SCSI - ok
12:45:31.0265 5472	luafv           (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
12:45:31.0353 5472	luafv - ok
12:45:31.0424 5472	LUsbFilt        (9d9714e78eac9e5368208649489c920e) C:\Windows\system32\Drivers\LUsbFilt.Sys
12:45:31.0444 5472	LUsbFilt - ok
12:45:31.0551 5472	MBAMProtector   (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
12:45:31.0575 5472	MBAMProtector - ok
12:45:31.0685 5472	MBAMService     (ba400ed640bca1eae5c727ae17c10207) C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
12:45:31.0722 5472	MBAMService - ok
12:45:31.0779 5472	Mcx2Svc         (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
12:45:31.0831 5472	Mcx2Svc - ok
12:45:31.0894 5472	megasas         (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
12:45:31.0918 5472	megasas - ok
12:45:31.0949 5472	MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
12:45:31.0980 5472	MegaSR - ok
12:45:32.0050 5472	MMCSS           (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
12:45:32.0135 5472	MMCSS - ok
12:45:32.0187 5472	Modem           (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
12:45:32.0285 5472	Modem - ok
12:45:32.0324 5472	monitor         (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
12:45:32.0375 5472	monitor - ok
12:45:32.0430 5472	mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
12:45:32.0455 5472	mouclass - ok
12:45:32.0483 5472	mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
12:45:32.0540 5472	mouhid - ok
12:45:32.0591 5472	mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
12:45:32.0618 5472	mountmgr - ok
12:45:32.0730 5472	MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
12:45:32.0754 5472	MozillaMaintenance - ok
12:45:32.0798 5472	mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
12:45:32.0827 5472	mpio - ok
12:45:32.0876 5472	mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
12:45:32.0943 5472	mpsdrv - ok
12:45:33.0049 5472	MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
12:45:33.0130 5472	MpsSvc - ok
12:45:33.0191 5472	MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
12:45:33.0250 5472	MRxDAV - ok
12:45:33.0295 5472	mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
12:45:33.0345 5472	mrxsmb - ok
12:45:33.0380 5472	mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:45:33.0425 5472	mrxsmb10 - ok
12:45:33.0449 5472	mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:45:33.0476 5472	mrxsmb20 - ok
12:45:33.0508 5472	msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
12:45:33.0531 5472	msahci - ok
12:45:33.0576 5472	msdsm           (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
12:45:33.0604 5472	msdsm - ok
12:45:33.0659 5472	MSDTC           (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
12:45:33.0716 5472	MSDTC - ok
12:45:33.0798 5472	Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
12:45:33.0863 5472	Msfs - ok
12:45:33.0879 5472	mshidkmdf       (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
12:45:33.0971 5472	mshidkmdf - ok
12:45:34.0010 5472	msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
12:45:34.0034 5472	msisadrv - ok
12:45:34.0111 5472	MSiSCSI         (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
12:45:34.0212 5472	MSiSCSI - ok
12:45:34.0218 5472	msiserver - ok
12:45:34.0264 5472	MSKSSRV         (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
12:45:34.0363 5472	MSKSSRV - ok
12:45:34.0402 5472	MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
12:45:34.0494 5472	MSPCLOCK - ok
12:45:34.0517 5472	MSPQM           (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
12:45:34.0606 5472	MSPQM - ok
12:45:34.0679 5472	MsRPC           (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
12:45:34.0723 5472	MsRPC - ok
12:45:34.0756 5472	mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
12:45:34.0780 5472	mssmbios - ok
12:45:34.0806 5472	MSTEE           (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
12:45:34.0898 5472	MSTEE - ok
12:45:34.0958 5472	MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
12:45:34.0983 5472	MTConfig - ok
12:45:35.0001 5472	Mup             (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
12:45:35.0026 5472	Mup - ok
12:45:35.0110 5472	napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
12:45:35.0211 5472	napagent - ok
12:45:35.0329 5472	NativeWifiP     (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
12:45:35.0397 5472	NativeWifiP - ok
12:45:35.0536 5472	NAV             (c6948f034d7edabcfa2234d399fc78bc) C:\Program Files (x86)\Norton AntiVirus\Engine\19.7.0.9\ccSvcHst.exe
12:45:35.0559 5472	NAV - ok
12:45:35.0785 5472	NAVENG          (8043d41f881d6ace40b854ad6e32217f) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\VirusDefs\20120520.009\ENG64.SYS
12:45:35.0804 5472	NAVENG - ok
12:45:35.0985 5472	NAVEX15         (9a9ab2fc45d701daed465d14980f1305) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\VirusDefs\20120520.009\EX64.SYS
12:45:36.0054 5472	NAVEX15 - ok
12:45:37.0191 5472	NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
12:45:37.0242 5472	NDIS - ok
12:45:37.0298 5472	NdisCap         (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
12:45:37.0390 5472	NdisCap - ok
12:45:37.0426 5472	NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
12:45:37.0517 5472	NdisTapi - ok
12:45:37.0566 5472	Ndisuio         (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
12:45:37.0655 5472	Ndisuio - ok
12:45:37.0711 5472	NdisWan         (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
12:45:37.0805 5472	NdisWan - ok
12:45:37.0885 5472	NDProxy         (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
12:45:37.0963 5472	NDProxy - ok
12:45:38.0037 5472	NetBIOS         (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
12:45:38.0141 5472	NetBIOS - ok
12:45:38.0465 5472	NetBT           (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
12:45:38.0545 5472	NetBT - ok
12:45:38.0618 5472	Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:45:38.0642 5472	Netlogon - ok
12:45:38.0849 5472	Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
12:45:38.0960 5472	Netman - ok
12:45:39.0089 5472	netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
12:45:39.0212 5472	netprofm - ok
12:45:39.0358 5472	NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:45:39.0380 5472	NetTcpPortSharing - ok
12:45:39.0801 5472	netw5v64        (64428dfdaf6e88366cb51f45a79c5f69) C:\Windows\system32\DRIVERS\netw5v64.sys
12:45:39.0949 5472	netw5v64 - ok
12:45:40.0183 5472	nfrd960         (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
12:45:40.0207 5472	nfrd960 - ok
12:45:40.0292 5472	NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
12:45:40.0383 5472	NlaSvc - ok
12:45:40.0405 5472	Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
12:45:40.0471 5472	Npfs - ok
12:45:40.0529 5472	nsi             (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
12:45:40.0626 5472	nsi - ok
12:45:40.0685 5472	nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
12:45:40.0776 5472	nsiproxy - ok
12:45:40.0956 5472	Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
12:45:41.0030 5472	Ntfs - ok
12:45:41.0264 5472	Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
12:45:41.0354 5472	Null - ok
12:45:41.0391 5472	nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
12:45:41.0418 5472	nvraid - ok
12:45:41.0444 5472	nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
12:45:41.0472 5472	nvstor - ok
12:45:41.0507 5472	nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
12:45:41.0533 5472	nv_agp - ok
12:45:41.0596 5472	OA008Ufd        (d09cc91e92fd1ff81af3a14be2cbb20d) C:\Windows\system32\DRIVERS\OA008Ufd.sys
12:45:41.0619 5472	OA008Ufd - ok
12:45:41.0664 5472	OA008Vid        (60fd277cfd34f680a1668ac123b324ae) C:\Windows\system32\DRIVERS\OA008Vid.sys
12:45:41.0720 5472	OA008Vid - ok
12:45:41.0796 5472	ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
12:45:41.0842 5472	ohci1394 - ok
12:45:41.0939 5472	ose             (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
12:45:41.0965 5472	ose - ok
12:45:42.0407 5472	osppsvc         (61bffb5f57ad12f83ab64b7181829b34) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
12:45:42.0609 5472	osppsvc - ok
12:45:42.0845 5472	p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
12:45:42.0955 5472	p2pimsvc - ok
12:45:43.0054 5472	p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
12:45:43.0119 5472	p2psvc - ok
12:45:43.0237 5472	Parport         (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
12:45:43.0264 5472	Parport - ok
12:45:43.0333 5472	partmgr         (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
12:45:43.0359 5472	partmgr - ok
12:45:43.0458 5472	PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
12:45:43.0545 5472	PcaSvc - ok
12:45:43.0854 5472	PCDSRVC{1E208CE0-FB7451FF-06020101}_0 (7317a0b550f7ac0223b7070897670476) c:\program files\dell support center\pcdsrvc_x64.pkms
12:45:43.0874 5472	PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - ok
12:45:43.0939 5472	pci             (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
12:45:43.0968 5472	pci - ok
12:45:44.0040 5472	pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
12:45:44.0063 5472	pciide - ok
12:45:44.0128 5472	pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
12:45:44.0158 5472	pcmcia - ok
12:45:44.0190 5472	pcw             (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
12:45:44.0215 5472	pcw - ok
12:45:44.0282 5472	PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
12:45:44.0387 5472	PEAUTH - ok
12:45:44.0524 5472	PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
12:45:44.0569 5472	PerfHost - ok
12:45:44.0722 5472	pla             (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
12:45:44.0897 5472	pla - ok
12:45:44.0957 5472	PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
12:45:45.0003 5472	PlugPlay - ok
12:45:45.0049 5472	PNRPAutoReg     (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
12:45:45.0086 5472	PNRPAutoReg - ok
12:45:45.0130 5472	PNRPsvc         (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
12:45:45.0165 5472	PNRPsvc - ok
12:45:45.0255 5472	PolicyAgent     (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
12:45:45.0349 5472	PolicyAgent - ok
12:45:45.0421 5472	Power           (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
12:45:45.0516 5472	Power - ok
12:45:45.0631 5472	PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
12:45:45.0727 5472	PptpMiniport - ok
12:45:45.0809 5472	Processor       (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
12:45:45.0857 5472	Processor - ok
12:45:45.0943 5472	ProfSvc         (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
12:45:46.0036 5472	ProfSvc - ok
12:45:46.0080 5472	ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:45:46.0104 5472	ProtectedStorage - ok
12:45:46.0175 5472	Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
12:45:46.0240 5472	Psched - ok
12:45:46.0350 5472	PSI_SVC_2       (543a4ef0923bf70d126625b034ef25af) c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
12:45:46.0371 5472	PSI_SVC_2 - ok
12:45:46.0406 5472	PxHlpa64        (87b04878a6d59d6c79251dc960c674c1) C:\Windows\system32\Drivers\PxHlpa64.sys
12:45:46.0428 5472	PxHlpa64 - ok
12:45:46.0568 5472	ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
12:45:46.0650 5472	ql2300 - ok
12:45:46.0913 5472	ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
12:45:46.0941 5472	ql40xx - ok
12:45:47.0044 5472	QWAVE           (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
12:45:47.0082 5472	QWAVE - ok
12:45:47.0145 5472	QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
12:45:47.0194 5472	QWAVEdrv - ok
12:45:47.0217 5472	RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
12:45:47.0283 5472	RasAcd - ok
12:45:47.0340 5472	RasAgileVpn     (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
12:45:47.0408 5472	RasAgileVpn - ok
12:45:47.0473 5472	RasAuto         (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
12:45:47.0560 5472	RasAuto - ok
12:45:47.0606 5472	Rasl2tp         (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
12:45:47.0699 5472	Rasl2tp - ok
12:45:47.0776 5472	RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
12:45:47.0848 5472	RasMan - ok
12:45:47.0919 5472	RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
12:45:48.0004 5472	RasPppoe - ok
12:45:48.0035 5472	RasSstp         (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
12:45:48.0122 5472	RasSstp - ok
12:45:48.0191 5472	rdbss           (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
12:45:48.0285 5472	rdbss - ok
12:45:48.0319 5472	rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
12:45:48.0367 5472	rdpbus - ok
12:45:48.0399 5472	RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
12:45:48.0487 5472	RDPCDD - ok
12:45:48.0524 5472	RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
12:45:48.0619 5472	RDPENCDD - ok
12:45:48.0658 5472	RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
12:45:48.0724 5472	RDPREFMP - ok
12:45:48.0824 5472	RDPWD           (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
12:45:48.0919 5472	RDPWD - ok
12:45:48.0993 5472	rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
12:45:49.0022 5472	rdyboost - ok
12:45:49.0081 5472	RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
12:45:49.0185 5472	RemoteAccess - ok
12:45:49.0251 5472	RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
12:45:49.0345 5472	RemoteRegistry - ok
12:45:49.0412 5472	RFCOMM          (3dd798846e2c28102b922c56e71b7932) C:\Windows\system32\DRIVERS\rfcomm.sys
12:45:49.0468 5472	RFCOMM - ok
12:45:49.0554 5472	rimmptsk        (d13d70fac45fc1df69f88559b1f72f0a) C:\Windows\system32\DRIVERS\rimmpx64.sys
12:45:49.0593 5472	rimmptsk - ok
12:45:49.0623 5472	rimsptsk        (bb9edc55b0b8cb4fcd713428820e0776) C:\Windows\system32\DRIVERS\rimspx64.sys
12:45:49.0643 5472	rimsptsk - ok
12:45:49.0666 5472	rismxdp         (481c3fdeacaae04b74c58288dbc91df9) C:\Windows\system32\DRIVERS\rixdpx64.sys
12:45:49.0707 5472	rismxdp - ok
12:45:49.0781 5472	RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
12:45:49.0865 5472	RpcEptMapper - ok
12:45:49.0924 5472	RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
12:45:49.0973 5472	RpcLocator - ok
12:45:50.0064 5472	RpcSs           (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
12:45:50.0137 5472	RpcSs - ok
12:45:50.0181 5472	rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
12:45:50.0249 5472	rspndr - ok
12:45:50.0279 5472	SamSs           (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:45:50.0304 5472	SamSs - ok
12:45:50.0426 5472	SASDIFSV        (3289766038db2cb14d07dc84392138d5) C:\Program Files\SUPERAntiSpyware\SASDIFSV64.SYS
12:45:50.0444 5472	SASDIFSV - ok
12:45:50.0469 5472	SASKUTIL        (58a38e75f3316a83c23df6173d41f2b5) C:\Program Files\SUPERAntiSpyware\SASKUTIL64.SYS
12:45:50.0488 5472	SASKUTIL - ok
12:45:50.0528 5472	sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
12:45:50.0554 5472	sbp2port - ok
12:45:50.0779 5472	SBSDWSCService  (794d4b48dfb6e999537c7c3947863463) C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
12:45:50.0826 5472	SBSDWSCService - ok
12:45:50.0899 5472	SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
12:45:50.0998 5472	SCardSvr - ok
12:45:51.0089 5472	scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
12:45:51.0183 5472	scfilter - ok
12:45:51.0348 5472	Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
12:45:51.0462 5472	Schedule - ok
12:45:51.0522 5472	SCPolicySvc     (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
12:45:51.0585 5472	SCPolicySvc - ok
12:45:51.0637 5472	sdbus           (111e0ebc0ad79cb0fa014b907b231cf0) C:\Windows\system32\drivers\sdbus.sys
12:45:51.0677 5472	sdbus - ok
12:45:51.0707 5472	SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
12:45:51.0753 5472	SDRSVC - ok
12:45:51.0849 5472	secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
12:45:51.0938 5472	secdrv - ok
12:45:52.0001 5472	seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
12:45:52.0079 5472	seclogon - ok
12:45:52.0137 5472	SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
12:45:52.0234 5472	SENS - ok
12:45:52.0264 5472	SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
12:45:52.0352 5472	SensrSvc - ok
12:45:52.0379 5472	Serenum         (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
12:45:52.0431 5472	Serenum - ok
12:45:52.0498 5472	Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
12:45:52.0525 5472	Serial - ok
12:45:52.0563 5472	sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
12:45:52.0612 5472	sermouse - ok
12:45:52.0671 5472	SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
12:45:52.0738 5472	SessionEnv - ok
12:45:52.0851 5472	sffdisk         (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\DRIVERS\sffdisk.sys
12:45:52.0920 5472	sffdisk - ok
12:45:52.0940 5472	sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
12:45:52.0988 5472	sffp_mmc - ok
12:45:52.0996 5472	sffp_sd         (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\DRIVERS\sffp_sd.sys
12:45:53.0034 5472	sffp_sd - ok
12:45:53.0086 5472	sfloppy         (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
12:45:53.0110 5472	sfloppy - ok
12:45:53.0192 5472	SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
12:45:53.0288 5472	SharedAccess - ok
12:45:53.0359 5472	ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
12:45:53.0430 5472	ShellHWDetection - ok
12:45:53.0485 5472	SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
12:45:53.0509 5472	SiSRaid2 - ok
12:45:53.0532 5472	SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
12:45:53.0558 5472	SiSRaid4 - ok
12:45:53.0599 5472	Smb             (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
12:45:53.0688 5472	Smb - ok
12:45:53.0759 5472	SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
12:45:53.0816 5472	SNMPTRAP - ok
12:45:53.0844 5472	spldr           (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
12:45:53.0868 5472	spldr - ok
12:45:53.0963 5472	Spooler         (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
12:45:54.0044 5472	Spooler - ok
12:45:54.0342 5472	sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
12:45:54.0508 5472	sppsvc - ok
12:45:54.0690 5472	sppuinotify     (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
12:45:54.0783 5472	sppuinotify - ok
12:45:54.0971 5472	SRTSP           (06b9a7ba94356ec5207c5ddb59540378) C:\Windows\System32\Drivers\NAVx64\1307000.009\SRTSP64.SYS
12:45:55.0011 5472	SRTSP - ok
12:45:55.0034 5472	SRTSPX          (fbb8945a61e55a2345d12487c74a9d76) C:\Windows\system32\drivers\NAVx64\1307000.009\SRTSPX64.SYS
12:45:55.0053 5472	SRTSPX - ok
12:45:55.0117 5472	srv             (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
12:45:55.0196 5472	srv - ok
12:45:55.0248 5472	srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
12:45:55.0311 5472	srv2 - ok
12:45:55.0380 5472	srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
12:45:55.0442 5472	srvnet - ok
12:45:55.0531 5472	SSDPSRV         (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
12:45:55.0630 5472	SSDPSRV - ok
12:45:55.0672 5472	SstpSvc         (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
12:45:55.0742 5472	SstpSvc - ok
12:45:55.0800 5472	ssudmdm         (ad42ca614e086bcadbd53fffc404ac24) C:\Windows\system32\DRIVERS\ssudmdm.sys
12:45:55.0825 5472	ssudmdm - ok
12:45:55.0994 5472	STacSV          (444109453a2b87e6c16bcda5953e81a9) C:\Windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\STacSV64.exe
12:45:56.0032 5472	STacSV - ok
12:45:56.0085 5472	stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
12:45:56.0109 5472	stexstor - ok
12:45:56.0185 5472	STHDA           (02e784fa49032f84964db90a3ed81890) C:\Windows\system32\DRIVERS\stwrt64.sys
12:45:56.0217 5472	STHDA - ok
12:45:56.0317 5472	stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
12:45:56.0365 5472	stisvc - ok
12:45:56.0500 5472	stllssvr        (1d0063597c3666404fcf97698abeb019) C:\Program Files (x86)\Common Files\SureThing Shared\stllssvr.exe
12:45:56.0520 5472	stllssvr - ok
12:45:56.0558 5472	swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
12:45:56.0581 5472	swenum - ok
12:45:56.0665 5472	swprv           (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
12:45:56.0764 5472	swprv - ok
12:45:56.0870 5472	SymDS           (8b2430762099598da40686f754632efd) C:\Windows\system32\drivers\NAVx64\1307000.009\SYMDS64.SYS
12:45:56.0901 5472	SymDS - ok
12:45:57.0007 5472	SymEFA          (f90c7a190399165d3ab2245048d34786) C:\Windows\system32\drivers\NAVx64\1307000.009\SYMEFA64.SYS
12:45:57.0058 5472	SymEFA - ok
12:45:57.0104 5472	SymEvent        (894579207e39c465737e850a252ce4f2) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
12:45:57.0128 5472	SymEvent - ok
12:45:57.0167 5472	SymIRON         (5013a76caaa1d7cf1c55214b490b4e35) C:\Windows\system32\drivers\NAVx64\1307000.009\Ironx64.SYS
12:45:57.0190 5472	SymIRON - ok
12:45:57.0274 5472	SymNetS         (3911bd0e68c010e5438a87706abbe9ab) C:\Windows\System32\Drivers\NAVx64\1307000.009\SYMNETS.SYS
12:45:57.0305 5472	SymNetS - ok
12:45:57.0376 5472	SynTP           (1657b7442d5ce30533f5c4317716b468) C:\Windows\system32\DRIVERS\SynTP.sys
12:45:57.0404 5472	SynTP - ok
12:45:57.0585 5472	SysMain         (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
12:45:57.0693 5472	SysMain - ok
12:45:57.0875 5472	TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
12:45:57.0933 5472	TabletInputService - ok
12:45:57.0994 5472	TapiSrv         (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
12:45:58.0091 5472	TapiSrv - ok
12:45:58.0135 5472	TBS             (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
12:45:58.0203 5472	TBS - ok
12:45:58.0426 5472	Tcpip           (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
12:45:58.0506 5472	Tcpip - ok
12:45:58.0855 5472	TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
12:45:58.0941 5472	TCPIP6 - ok
12:45:59.0163 5472	tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
12:45:59.0237 5472	tcpipreg - ok
12:45:59.0304 5472	TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
12:45:59.0345 5472	TDPIPE - ok
12:45:59.0384 5472	TDTCP           (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
12:45:59.0431 5472	TDTCP - ok
12:45:59.0505 5472	tdx             (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
12:45:59.0575 5472	tdx - ok
12:45:59.0839 5472	TeamViewer6     (01a402d34732ca3da91786adcc765069) C:\Program Files (x86)\TeamViewer\Version6\TeamViewer_Service.exe
12:45:59.0935 5472	TeamViewer6 - ok
12:46:00.0148 5472	TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
12:46:00.0172 5472	TermDD - ok
12:46:00.0281 5472	TermService     (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
12:46:00.0377 5472	TermService - ok
12:46:00.0427 5472	Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
12:46:00.0485 5472	Themes - ok
12:46:00.0536 5472	THREADORDER     (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
12:46:00.0605 5472	THREADORDER - ok
12:46:00.0627 5472	TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
12:46:00.0729 5472	TrkWks - ok
12:46:00.0841 5472	TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
12:46:00.0928 5472	TrustedInstaller - ok
12:46:00.0988 5472	tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
12:46:01.0052 5472	tssecsrv - ok
12:46:01.0140 5472	TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
12:46:01.0207 5472	TsUsbFlt - ok
12:46:01.0289 5472	tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
12:46:01.0378 5472	tunnel - ok
12:46:01.0422 5472	uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
12:46:01.0450 5472	uagp35 - ok
12:46:01.0524 5472	udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
12:46:01.0594 5472	udfs - ok
12:46:01.0656 5472	UI0Detect       (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
12:46:01.0713 5472	UI0Detect - ok
12:46:01.0776 5472	uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
12:46:01.0800 5472	uliagpkx - ok
12:46:01.0839 5472	umbus           (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
12:46:01.0892 5472	umbus - ok
12:46:01.0931 5472	UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
12:46:01.0956 5472	UmPass - ok
12:46:02.0042 5472	upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
12:46:02.0117 5472	upnphost - ok
12:46:02.0157 5472	USBAAPL64       (54d4b48d443e7228bf64cf7cdc3118ac) C:\Windows\system32\Drivers\usbaapl64.sys
12:46:02.0232 5472	USBAAPL64 - ok
12:46:02.0270 5472	usbccgp         (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
12:46:02.0318 5472	usbccgp - ok
12:46:02.0383 5472	usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
12:46:02.0438 5472	usbcir - ok
12:46:02.0502 5472	usbehci         (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\drivers\usbehci.sys
12:46:02.0547 5472	usbehci - ok
12:46:02.0615 5472	usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
12:46:02.0677 5472	usbhub - ok
12:46:02.0723 5472	usbohci         (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
12:46:02.0784 5472	usbohci - ok
12:46:02.0832 5472	usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
12:46:02.0863 5472	usbprint - ok
12:46:02.0893 5472	USBSTOR         (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:46:02.0930 5472	USBSTOR - ok
12:46:02.0975 5472	usbuhci         (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
12:46:03.0025 5472	usbuhci - ok
12:46:03.0068 5472	UxSms           (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
12:46:03.0136 5472	UxSms - ok
12:46:03.0166 5472	VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:46:03.0191 5472	VaultSvc - ok
12:46:03.0221 5472	vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
12:46:03.0244 5472	vdrvroot - ok
12:46:03.0328 5472	vds             (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
12:46:03.0408 5472	vds - ok
12:46:03.0473 5472	vga             (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
12:46:03.0502 5472	vga - ok
12:46:03.0526 5472	VgaSave         (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
12:46:03.0619 5472	VgaSave - ok
12:46:03.0680 5472	vhdmp           (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
12:46:03.0709 5472	vhdmp - ok
12:46:03.0745 5472	viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
12:46:03.0769 5472	viaide - ok
12:46:03.0790 5472	volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
12:46:03.0815 5472	volmgr - ok
12:46:03.0889 5472	volmgrx         (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
12:46:03.0923 5472	volmgrx - ok
12:46:03.0971 5472	volsnap         (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
12:46:04.0003 5472	volsnap - ok
12:46:04.0051 5472	vsmraid         (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
12:46:04.0079 5472	vsmraid - ok
12:46:04.0249 5472	VSS             (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
12:46:04.0377 5472	VSS - ok
12:46:04.0589 5472	vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
12:46:04.0647 5472	vwifibus - ok
12:46:04.0718 5472	W32Time         (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
12:46:04.0793 5472	W32Time - ok
12:46:04.0844 5472	WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
12:46:04.0901 5472	WacomPen - ok
12:46:04.0990 5472	WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
12:46:05.0066 5472	WANARP - ok
12:46:05.0072 5472	Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
12:46:05.0135 5472	Wanarpv6 - ok
12:46:05.0302 5472	wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
12:46:05.0402 5472	wbengine - ok
12:46:05.0619 5472	WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
12:46:05.0659 5472	WbioSrvc - ok
12:46:05.0747 5472	wcncsvc         (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
12:46:05.0791 5472	wcncsvc - ok
12:46:05.0851 5472	WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
12:46:05.0891 5472	WcsPlugInService - ok
12:46:05.0990 5472	Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
12:46:06.0014 5472	Wd - ok
12:46:06.0091 5472	Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
12:46:06.0134 5472	Wdf01000 - ok
12:46:06.0160 5472	WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
12:46:06.0261 5472	WdiServiceHost - ok
12:46:06.0267 5472	WdiSystemHost   (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
12:46:06.0302 5472	WdiSystemHost - ok
12:46:06.0358 5472	WebClient       (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
12:46:06.0423 5472	WebClient - ok
12:46:06.0495 5472	Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
12:46:06.0576 5472	Wecsvc - ok
12:46:06.0606 5472	wercplsupport   (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
12:46:06.0680 5472	wercplsupport - ok
12:46:06.0713 5472	WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
12:46:06.0803 5472	WerSvc - ok
12:46:06.0894 5472	WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
12:46:06.0959 5472	WfpLwf - ok
12:46:06.0974 5472	WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
12:46:06.0999 5472	WIMMount - ok
12:46:07.0073 5472	WinDefend - ok
12:46:07.0084 5472	WinHttpAutoProxySvc - ok
12:46:07.0188 5472	Winmgmt         (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
12:46:07.0279 5472	Winmgmt - ok
12:46:07.0474 5472	WinRM           (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
12:46:07.0584 5472	WinRM - ok
12:46:07.0820 5472	WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
12:46:07.0877 5472	WinUsb - ok
12:46:07.0982 5472	Wlansvc         (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
12:46:08.0041 5472	Wlansvc - ok
12:46:08.0081 5472	WmiAcpi         (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
12:46:08.0132 5472	WmiAcpi - ok
12:46:08.0252 5472	wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
12:46:08.0300 5472	wmiApSrv - ok
12:46:08.0395 5472	WMPNetworkSvc - ok
12:46:08.0442 5472	WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
12:46:08.0474 5472	WPCSvc - ok
12:46:08.0526 5472	WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
12:46:08.0580 5472	WPDBusEnum - ok
12:46:08.0751 5472	WPFFontCache_v0400 - ok
12:46:08.0808 5472	ws2ifsl         (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
12:46:08.0874 5472	ws2ifsl - ok
12:46:08.0929 5472	wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
12:46:08.0992 5472	wscsvc - ok
12:46:08.0998 5472	WSearch - ok
12:46:09.0211 5472	wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
12:46:09.0341 5472	wuauserv - ok
12:46:09.0584 5472	WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
12:46:09.0649 5472	WudfPf - ok
12:46:09.0698 5472	WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
12:46:09.0795 5472	WUDFRd - ok
12:46:09.0849 5472	wudfsvc         (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
12:46:09.0914 5472	wudfsvc - ok
12:46:09.0994 5472	WwanSvc         (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
12:46:10.0033 5472	WwanSvc - ok
12:46:10.0151 5472	{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7} (1cacfef9e5dd866c5b79a135ee729e18) C:\Program Files (x86)\CyberLink\PowerDVD DX\000.fcl
12:46:10.0175 5472	{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7} - ok
12:46:10.0197 5472	MBR (0x1B8)     (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
12:46:10.0665 5472	\Device\Harddisk0\DR0 - ok
12:46:10.0672 5472	MBR (0x1B8)     (5fb38429d5d77768867c76dcbdb35194) \Device\Harddisk1\DR1
12:46:11.0162 5472	\Device\Harddisk1\DR1 - ok
12:46:11.0198 5472	Boot (0x1200)   (699f28e2b509ca731fb222c61422522b) \Device\Harddisk0\DR0\Partition0
12:46:11.0200 5472	\Device\Harddisk0\DR0\Partition0 - ok
12:46:11.0252 5472	Boot (0x1200)   (dcb6f73aad02d042208e1217c330639d) \Device\Harddisk0\DR0\Partition1
12:46:11.0254 5472	\Device\Harddisk0\DR0\Partition1 - ok
12:46:11.0266 5472	Boot (0x1200)   (bec0b541cff9114c5f3fff374edbfb77) \Device\Harddisk1\DR1\Partition0
12:46:11.0269 5472	\Device\Harddisk1\DR1\Partition0 - ok
12:46:11.0270 5472	============================================================
12:46:11.0270 5472	Scan finished
12:46:11.0270 5472	============================================================
12:46:11.0288 3408	Detected object count: 2
12:46:11.0288 3408	Actual detected object count: 2
12:46:31.0648 3408	DockLoginService ( UnsignedFile.Multi.Generic ) - skipped by user
12:46:31.0648 3408	DockLoginService ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:46:31.0649 3408	IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
12:46:31.0649 3408	IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
         

Grüße Bebbo

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

• Lade dir ComboFix hier herunter auf deinen Desktop.

• Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

• Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
  Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

• Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hallo Arne,
nachfolgend das CF-Logfile:
[code]
Combofix Logfile:

ComboFix 12-05-20.10 - xxx 21.05.2012  16:18:21.1.2 - x64
Microsoft Windows 7 Home Premium   6.1.7601.1.1252.49.1031.18.4061.2700 [GMT 2:00]
ausgeführt von:: c:\users\xxx\Desktop\ComboFix.exe
AV: Norton AntiVirus *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
SP: Norton AntiVirus *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\NkbMonitor.exe.lnk
c:\windows\SysWow64\system32
c:\windows\SysWow64\system32\3DAudio.ax
c:\windows\SysWow64\system32\avrt.dll
c:\windows\SysWow64\system32\cis-2.4.dll
c:\windows\SysWow64\system32\issacapi_bs-2.3.dll
c:\windows\SysWow64\system32\issacapi_pe-2.3.dll
c:\windows\SysWow64\system32\issacapi_se-2.3.dll
c:\windows\SysWow64\system32\MACXMLProto.dll
c:\windows\SysWow64\system32\MaDRM.dll
c:\windows\SysWow64\system32\MaJGUILib.dll
c:\windows\SysWow64\system32\MAMACExtract.dll
c:\windows\SysWow64\system32\MASetupCleaner.exe
c:\windows\SysWow64\system32\MaXMLProto.dll
c:\windows\SysWow64\system32\mfplat.dll
c:\windows\SysWow64\system32\MK_Lyric.dll
c:\windows\SysWow64\system32\MSCLib.dll
c:\windows\SysWow64\system32\MSFLib.dll
c:\windows\SysWow64\system32\MSLUR71.dll
c:\windows\SysWow64\system32\msvcp60.dll
c:\windows\SysWow64\system32\MTTELECHIP.dll
c:\windows\SysWow64\system32\MTXSYNCICON.dll
c:\windows\SysWow64\system32\muzaf1.dll
c:\windows\SysWow64\system32\muzapp.dll
c:\windows\SysWow64\system32\muzapp.exe
c:\windows\SysWow64\system32\muzdecode.ax
c:\windows\SysWow64\system32\muzeffect.ax
c:\windows\SysWow64\system32\muzmp4sp.ax
c:\windows\SysWow64\system32\muzmpgsp.ax
c:\windows\SysWow64\system32\muzoggsp.ax
c:\windows\SysWow64\system32\muzwmts.dll
c:\windows\SysWow64\system32\psapi.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-04-21 bis 2012-05-21  ))))))))))))))))))))))))))))))
.
.
2012-05-21 14:30 . 2012-05-21 14:30	--------	d-----w-	c:\users\Default\AppData\Local\temp
2012-05-21 14:30 . 2012-05-21 14:30	--------	d-----w-	c:\users\xxx_std\AppData\Local\temp
2012-05-20 19:49 . 2012-05-21 10:12	--------	d-----w-	C:\_OTL
2012-05-20 19:04 . 2012-05-20 19:04	--------	d-----w-	c:\users\xxx\AppData\Local\Diagnostics
2012-05-18 06:26 . 2012-05-18 06:26	--------	d-----w-	c:\program files (x86)\ESET
2012-05-18 06:22 . 2012-05-18 06:22	--------	d-----w-	c:\windows\system32\drivers\NAVx64\1307010.005
2012-05-17 20:31 . 2012-05-17 20:31	--------	d-----w-	c:\users\xxx\AppData\Roaming\Malwarebytes
2012-05-17 20:31 . 2012-05-17 20:31	--------	d-----w-	c:\programdata\Malwarebytes
2012-05-17 20:31 . 2012-04-04 13:56	24904	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-05-17 20:31 . 2012-05-17 20:31	--------	d-----w-	c:\program files (x86)\Malwarebytes' Anti-Malware
2012-05-17 12:37 . 2012-05-17 12:37	--------	d-----w-	c:\users\xxx\AppData\Local\NPE
2012-05-17 09:36 . 2012-05-17 09:36	--------	d-----w-	c:\users\xxx\AppData\Roaming\SUPERAntiSpyware.com
2012-05-17 09:35 . 2012-05-17 09:36	--------	d-----w-	c:\program files\SUPERAntiSpyware
2012-05-17 09:35 . 2012-05-17 09:35	--------	d-----w-	c:\programdata\SUPERAntiSpyware.com
2012-05-14 20:13 . 2012-05-14 20:13	--------	d-----w-	c:\program files\Microsoft Silverlight
2012-05-14 20:13 . 2012-05-14 20:13	--------	d-----w-	c:\program files (x86)\Microsoft Silverlight
2012-05-14 18:56 . 2012-05-14 18:57	--------	d-----w-	c:\users\xxx\AppData\Roaming\TCXConverter
2012-05-14 18:56 . 2012-05-14 18:56	--------	d-----w-	c:\program files (x86)\TCX Converter
2012-05-14 18:33 . 2012-05-14 18:33	--------	d-----w-	c:\users\xxx\AppData\Local\ZoneFiveSoftware
2012-05-14 18:28 . 2012-05-14 18:28	--------	d-----w-	c:\program files (x86)\Zone Five Software
2012-05-14 18:28 . 2012-05-14 18:28	--------	d-----w-	c:\programdata\ZoneFiveSoftware
2012-05-10 14:05 . 2012-03-03 06:35	1544704	----a-w-	c:\windows\system32\DWrite.dll
2012-05-10 14:05 . 2012-03-03 05:31	1077248	----a-w-	c:\windows\SysWow64\DWrite.dll
2012-05-10 14:05 . 2012-03-31 06:05	5559664	----a-w-	c:\windows\system32\ntoskrnl.exe
2012-05-10 14:04 . 2012-03-31 03:10	3146240	----a-w-	c:\windows\system32\win32k.sys
2012-05-10 14:04 . 2012-03-31 04:39	3968368	----a-w-	c:\windows\SysWow64\ntkrnlpa.exe
2012-05-10 14:04 . 2012-03-31 04:39	3913072	----a-w-	c:\windows\SysWow64\ntoskrnl.exe
2012-05-10 14:04 . 2012-03-17 07:58	75120	----a-w-	c:\windows\system32\drivers\partmgr.sys
2012-05-10 14:04 . 2012-03-31 05:42	1732096	----a-w-	c:\program files\Windows Journal\NBDoc.DLL
2012-05-10 14:04 . 2012-03-31 05:40	1402880	----a-w-	c:\program files\Windows Journal\JNWDRV.dll
2012-05-10 14:04 . 2012-03-31 05:40	1367552	----a-w-	c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-10 14:04 . 2012-03-31 05:40	1393664	----a-w-	c:\program files\Windows Journal\JNTFiltr.dll
2012-05-10 14:04 . 2012-03-31 04:29	936960	----a-w-	c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-10 14:04 . 2012-03-30 11:35	1918320	----a-w-	c:\windows\system32\drivers\tcpip.sys
2012-05-08 18:46 . 2012-05-08 18:46	--------	d-----w-	c:\program files (x86)\Mozilla Maintenance Service
2012-05-08 18:45 . 2012-05-08 18:45	157352	----a-w-	c:\program files (x86)\Mozilla Firefox\maintenanceservice_installer.exe
2012-05-08 18:45 . 2012-05-08 18:45	129976	----a-w-	c:\program files (x86)\Mozilla Firefox\maintenanceservice.exe
2012-04-25 16:07 . 2012-04-25 16:07	--------	d-----w-	c:\users\xxx\AppData\Roaming\Reallusion
2012-04-24 15:18 . 2012-05-09 17:06	--------	d-----w-	c:\windows\system32\drivers\NAVx64\1307000.009
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-17 20:27 . 2012-04-18 16:56	419488	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-17 20:27 . 2011-12-12 18:59	70304	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-03-27 15:03 . 2009-09-13 13:42	175736	----a-w-	c:\windows\system32\drivers\SYMEVENT64x86.SYS
2012-03-01 06:46 . 2012-04-11 18:20	23408	----a-w-	c:\windows\system32\drivers\fs_rec.sys
2012-03-01 06:38 . 2012-04-11 18:20	220672	----a-w-	c:\windows\system32\wintrust.dll
2012-03-01 06:33 . 2012-04-11 18:20	81408	----a-w-	c:\windows\system32\imagehlp.dll
2012-03-01 06:28 . 2012-04-11 18:20	5120	----a-w-	c:\windows\system32\wmi.dll
2012-03-01 05:37 . 2012-04-11 18:20	172544	----a-w-	c:\windows\SysWow64\wintrust.dll
2012-03-01 05:33 . 2012-04-11 18:20	159232	----a-w-	c:\windows\SysWow64\imagehlp.dll
2012-03-01 05:29 . 2012-04-11 18:20	5120	----a-w-	c:\windows\SysWow64\wmi.dll
2012-02-28 06:56 . 2012-04-11 18:28	2311168	----a-w-	c:\windows\system32\jscript9.dll
2012-02-28 06:49 . 2012-04-11 18:28	1390080	----a-w-	c:\windows\system32\wininet.dll
2012-02-28 06:48 . 2012-04-11 18:28	1493504	----a-w-	c:\windows\system32\inetcpl.cpl
2012-02-28 06:42 . 2012-04-11 18:28	2382848	----a-w-	c:\windows\system32\mshtml.tlb
2012-02-28 01:18 . 2012-04-11 18:28	1799168	----a-w-	c:\windows\SysWow64\jscript9.dll
2012-02-28 01:11 . 2012-04-11 18:28	1427456	----a-w-	c:\windows\SysWow64\inetcpl.cpl
2012-02-28 01:11 . 2012-04-11 18:28	1127424	----a-w-	c:\windows\SysWow64\wininet.dll
2012-02-28 01:03 . 2012-04-11 18:28	2382848	----a-w-	c:\windows\SysWow64\mshtml.tlb
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2010-11-20 163328]
"KiesHelper"="c:\program files (x86)\Samsung\Kies\KiesHelper.exe" [2012-02-22 943504]
"KiesPDLR"="c:\program files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe" [2012-03-26 21416]
"SpybotSD TeaTimer"="c:\program files (x86)\Spybot - Search & Destroy\TeaTimer.exe" [2009-03-05 2260480]
"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]
"gStart"="c:\program files (x86)\Garmin\Training Center\gStart.exe" [2008-08-13 1891416]
"ANT Agent"="c:\program files (x86)\Garmin\ANT Agent\ANT Agent.exe" [2011-11-07 14767976]
"SUPERAntiSpyware"="c:\program files\SUPERAntiSpyware\SUPERAntiSpyware.exe" [2012-04-20 4786048]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Dell DataSafe Online"="c:\program files (x86)\Dell DataSafe Online\DataSafeOnline.exe" [2009-04-09 1762032]
"DivXUpdate"="c:\program files (x86)\DivX\DivX Update\DivXUpdate.exe" [2011-03-21 1230704]
"FreePDF Assistant"="c:\program files (x86)\FreePDF_XP\fpassist.exe" [2009-07-15 371712]
"KiesTrayAgent"="c:\program files (x86)\Samsung\Kies\KiesTrayAgent.exe" [2012-02-22 3508624]
"LockStatusTray"="c:\windows\LockStatusTray.exe" [2008-02-19 192512]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2010-11-29 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"PDVDDXSrv"="c:\program files (x86)\CyberLink\PowerDVD DX\PDVDDXSrv.exe" [2009-06-24 140520]
"Dell Webcam Central"="c:\program files (x86)\Dell Webcam\Dell Webcam Central\WebcamDell2.exe" [2009-06-24 409744]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-29 98304]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"Malwarebytes' Anti-Malware"="c:\program files (x86)\Malwarebytes' Anti-Malware\mbamgui.exe" [2012-04-04 462408]
.
c:\users\xxx_std\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-6 1312096]
.
c:\users\xxx\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dell Dock.lnk - c:\program files\Dell\DellDock\DellDock.exe [2009-2-6 1312096]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\WIDCOMM\Bluetooth Software\BTTray.exe [2008-11-18 1066536]
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2009-8-14 1207312]
Nikon Monitor.lnk - c:\program files (x86)\Common Files\Nikon\Monitor\NkMonitor.exe [2008-6-5 479232]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\!SASCORE]
@=""
.
R2 BBSvc;Bing Bar Update Service;c:\program files (x86)\Microsoft\BingBar\BBSvc.EXE [2011-10-21 196176]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-21 136176]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-05-17 257696]
R3 BVRPMPR5a64;BVRPMPR5a64 NDIS Protocol Driver;c:\windows\system32\drivers\BVRPMPR5a64.SYS [x]
R3 dg_ssudbus;SAMSUNG Mobile USB Composite Device Driver (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudbus.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-21 136176]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-08 129976]
R3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
R3 ssudmdm;SAMSUNG  Mobile USB Modem Drivers (DEVGURU Ver.);c:\windows\system32\DRIVERS\ssudmdm.sys [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WPFFontCache_v0400;Windows Presentation Foundation Font Cache 4.0.0.0;c:\windows\Microsoft.NET\Framework64\v4.0.30319\WPF\WPFFontCache_v0400.exe [x]
S0 PxHlpa64;PxHlpa64;c:\windows\System32\Drivers\PxHlpa64.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NAVx64\1307000.009\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NAVx64\1307000.009\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\BASHDefs\20120507.001\BHDrvx64.sys [2012-04-02 1160824]
S1 ccSet_NAV;Norton AntiVirus Settings Manager;c:\windows\system32\drivers\NAVx64\1307000.009\ccSetx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NAV_19.5.0.145\Definitions\IPSDefs\20120518.001\IDSvia64.sys [2012-04-28 488568]
S1 SASDIFSV;SASDIFSV;c:\program files\SUPERAntiSpyware\SASDIFSV64.SYS [2011-07-22 14928]
S1 SASKUTIL;SASKUTIL;c:\program files\SUPERAntiSpyware\SASKUTIL64.SYS [2011-07-12 12368]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NAVx64\1307000.009\Ironx64.SYS [x]
S1 SymNetS;Symantec Network Security WFP Driver;c:\windows\System32\Drivers\NAVx64\1307000.009\SYMNETS.SYS [x]
S2 !SASCORE;SAS Core Service;c:\program files\SUPERAntiSpyware\SASCORE64.EXE [2011-08-11 140672]
S2 {1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7};Power Control [2011/12/25 16:00];c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl [2009-06-24 19:19 146928]
S2 AAV UpdateService;AAV UpdateService;c:\program files (x86)\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
S2 AESTFilters;Andrea ST Filters Service;c:\windows\System32\DriverStore\FileRepository\stwrt64.inf_amd64_neutral_afc3018f8cfedd20\AESTSr64.exe [2009-03-02 89600]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 BBUpdate;BBUpdate;c:\program files (x86)\Microsoft\BingBar\SeaPort.EXE [2011-10-13 249648]
S2 DockLoginService;Dock Login Service;c:\program files\Dell\DellDock\DockLogin.exe [2008-12-18 155648]
S2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-04-04 654408]
S2 NAV;Norton AntiVirus;c:\program files (x86)\Norton AntiVirus\Engine\19.7.0.9\ccSvcHst.exe [2012-03-27 138232]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 TeamViewer6;TeamViewer 6;c:\program files (x86)\TeamViewer\Version6\TeamViewer_Service.exe [2011-11-03 2358656]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [x]
S3 CtClsFlt;Creative Camera Class Upper Filter Driver;c:\windows\system32\DRIVERS\CtClsFlt.sys [x]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-02-05 138360]
S3 k57nd60a;Broadcom NetLink (TM)-Gigabit-Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [x]
S3 netw5v64;Intel(R) Wireless WiFi Link 5000 Series - Adaptertreiber für Windows Vista 64 Bit;c:\windows\system32\DRIVERS\netw5v64.sys [x]
S3 OA008Ufd;Creative Camera OA008 Upper Filter Driver;c:\windows\system32\DRIVERS\OA008Ufd.sys [x]
S3 OA008Vid;Creative Camera OA008 Function Driver;c:\windows\system32\DRIVERS\OA008Vid.sys [x]
S3 PCDSRVC{1E208CE0-FB7451FF-06020101}_0;PCDSRVC{1E208CE0-FB7451FF-06020101}_0 - PCDR Kernel Mode Service Helper Driver;c:\program files\dell support center\pcdsrvc_x64.pkms [2011-12-14 25072]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 13888393
*Deregistered* - 13888393
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-18 20:27]
.
2012-05-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-21 11:41]
.
2012-05-21 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2010-09-21 11:41]
.
2012-05-20 c:\windows\Tasks\Norton Security Scan for xxx.job
- c:\program files (x86)\Norton Security Scan\Engine\2.7.3.34\Nss.exe [2010-09-16 07:48]
.
2012-05-09 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-12-14 04:09]
.
2012-05-21 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\Dell Support Center\uaclauncher.exe [2011-12-14 04:09]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2009-06-17 130576]
"SysTrayApp"="c:\program files\IDT\WDM\sttray64.exe" [2009-06-29 444416]
"QuickSet"="c:\program files\Dell\QuickSet\QuickSet.exe" [2009-08-07 3179088]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~2\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
TCP: DhcpNameServer = 192.168.1.1
FF - ProfilePath - c:\users\xxx\AppData\Roaming\Mozilla\Firefox\Profiles\194ydjbi.default\
FF - prefs.js: browser.search.selectedEngine - Yahoo
FF - prefs.js: browser.startup.homepage - hxxp://www.google.de/
FF - prefs.js: keyword.URL - hxxp://de.search.yahoo.com/search?fr=greentree_ff1&ei=utf-8&type=827316&p=
FF - user.js: yahoo.homepage.dontask - true);user_pref(yahoo.ytff.general.dontshowhpoffer, true
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Wow6432Node-HKLM-Run-DellSupportCenter - c:\program files (x86)\Dell Support Center\bin\sprtcmd.exe
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-{7B63B2922B174135AFC0E1377DD81EC2} - c:\program files (x86)\DivX\DivXCodecUninstall.exe
AddRemove-{8ADFC4160D694100B5B8A22DE9DCABD9} - c:\program files (x86)\DivX\DivXPlayerUninstall.exe
.
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\NAV]
"ImagePath"="\"c:\program files (x86)\Norton AntiVirus\Engine\19.7.0.9\ccSvcHst.exe\" /s \"NAV\" /m \"c:\program files (x86)\Norton AntiVirus\Engine\19.7.0.9\diMaster.dll\" /prefetch:1"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\PCDSRVC{1E208CE0-FB7451FF-06020101}_0]
"ImagePath"="\??\c:\program files\dell support center\pcdsrvc_x64.pkms"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\{1E444BE9-B8EC-4ce6-8C2B-6536FB7F4FB7}]
"ImagePath"="\??\c:\program files (x86)\CyberLink\PowerDVD DX\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10b.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10b.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{0BE09CC1-42E0-11DD-AE16-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10b.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}]
@Denied: (A 2) (Everyone)
@="IFlashBroker2"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{DDF4CE26-4BDA-42BC-B0F0-0E75243AD285}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\ccIPC]
@Denied: (C D) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\ccIPC\Channels]
@Denied: (C D) (Everyone)
"ccSvcHst_UserSession_3204"="{35374657-E11B-4AC6-A0BC-3E92348FB54B}"
"ccSvcHst_UserSession_3516"="{B18740F0-C773-4280-BB3B-70FBD9418B2F}"
"ccSvcHst_UserSession_1908"="{E69B2C01-8AFF-4377-84C2-6823E89D3788}"
"ccSettingsService"="{7C1C56A6-9B37-43C5-A91F-9A773E028040}"
"{A1B48937-0778-4e7c-885B-271F65B485D2}"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ccSvcHst_UserSession_2088"="{3101D372-6131-44AA-A7C0-769BD028072A}"
"ccSvcHst_UserSession_3060"="{E2F0955D-2D12-4EA3-BC53-132F91064023}"
"ccSvcHst_UserSession2_2800"="{80E39866-2E9B-46BE-901B-F2AD2AB7B1D1}"
"ccSvcHst_NAV"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ccSvcHst_UserSession_1116"="{122E218E-76E1-40B4-B396-33B1907F9657}"
"ccSvcHst_UserSession_1208"="{4D177A91-D1A2-4A0E-A9B6-21ACA6FB8299}"
"ncw_reputation_scan_server_IPC"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ccSvcHst_UserSession_1160"="{1E7FEEA0-CDB6-42B2-A76B-8F6DCED8A552}"
"DING_{4467AB8F-68C8-4ab5-9B48-B3E6EB65F6A1}"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ccSvcHst_UserSession2_3040"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"{B44E7D73-F081-414B-ADD2-CD66675A190D}1"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"ccGenericEvent_Global_EM"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ccGenericEvent_Global_LM"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ccGenericLog_Manager"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ccJobMgr_general_{ABD582DE-8F75-412d-81CF-6A180F1203DD}"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ccJobMgr_session_{ABD582DE-8F75-412d-81CF-6A180F1203DD}"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"{3F11C6A7-CEA8-40c9-88EE-E5461341AE97}_ccSubmissionEngineIPC"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"{A2DE0E79-877C-485b-B604-78B170313E9E}_IronIPC"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"SNDServiceRequestChannel"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"SNDLocationChannel"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"SymRedirSvcRequestChannel"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"NortonNetServiceIPC"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"NetMapServiceIPC"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"_isDataPrComm_"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"ncw_performance_IPC"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"_NCWSvcComm_NortonCommunityWatchConfiguration"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"_ProcessDetection_"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"_AvProdSvcComm_"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"isError_Service_IPC"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"BashIPCChannel"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"_ISPOCClient_"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"_IDataStoreMgr_"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"_NortonOnlineCommFeatureRequest_"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"_HSPlayerCommand_"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"{C4A09495-F6BC-4166-B717-F3F3250462BB}"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"FWAlert"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"IPS_COMMAND_CHANNEL"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
"AvProdSession_01"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"AvProdSession_Options_01"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"AvProdSession_MessageCenter_01"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"AvProdSession_Scanless_01"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"AvProdSession_IPUA_01"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"AvProdSession_CanIRun_01"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"clt::AlertChannel2_01"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"{436E95FE-192E-469f-8F34-5038FBA89BF4}1"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"TRUSTCHANNEL"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"SDKCHANNEL1"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"ToasterNotify\\SessionID_1"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"_IPCChannel_PerformAutoLogin_1_"="{085B2E16-D5F2-4589-A54E-D62B827391EC}"
"_ReputationSvcComm_ReputationPublisher"="{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\Common Client\ccIPC\Endpoints]
@Denied: (C D) (Everyone)
"{35374657-E11B-4AC6-A0BC-3E92348FB54B}"=""
"{5B5F3B84-6741-49AC-B42B-B9BBB601DF46}"=""
"{68F07B18-72A6-4978-91BB-40BE5246F2EA}"=""
"{5EF2DC3F-EC5B-468C-9118-FF3B38E2CE6A}"=""
"{91BF2672-DB94-49AD-8E8A-80EB84901AD7}"=""
"{F32561C5-758E-430B-9B20-0D117D8BDBFA}"=""
"{1B0A93F1-C9F6-476D-AF44-C10E021A5F98}"=""
"{8CDEA324-5620-48F0-8CF0-51AB71D32CD8}"=""
"{F744D882-281A-46D1-8963-E80FC7E074B5}"=""
"{CA61550B-E365-4745-BE3E-5FFBD3A63ADB}"=""
"{F668C66D-8041-493E-9E9E-CB0D47147948}"=""
"{23AB479F-26DB-4D49-80FD-CD907875C8C7}"=""
"{087D6561-5797-4223-9671-0901FB046BA2}"=""
"{7BBEF819-A4C8-4CB7-A6CE-E2624096FA55}"=""
"{CACB1135-5603-464C-ADDF-4ACFAE5B3232}"=""
"{38007E84-48EE-4287-AC0D-9CEA517867AA}"=""
"{A170FA72-6F25-4B06-902F-E43AB08E1689}"=""
"{B18740F0-C773-4280-BB3B-70FBD9418B2F}"=""
"{32032CB3-CA39-4D33-BA01-99218F9D7A77}"=""
"{1466B0C0-58A6-43CD-94CF-3FCCC5A87964}"=""
"{4C84671D-CD0D-446D-9CBC-B945B323DE26}"=""
"{0F25E736-DF9F-4997-A0F2-FC5FADEEE447}"=""
"{08308DB6-D4AB-4131-949A-39FB2F6F85AC}"=""
"{D1199BA5-4497-45AD-834C-C88FE379FDF6}"=""
"{F20F8813-51A5-43F8-9E9D-C7D110668C80}"=""
"{88972957-CB13-458A-A65D-B84ECD0F030E}"=""
"{3590C1D3-520A-4308-8A34-72CC842E0200}"=""
"{37925E2D-A90B-4FA7-924F-FA7F54B884D1}"=""
"{250C0E34-AB0B-40D5-913F-77E3191D70A2}"=""
"{176ECA38-574D-4698-A306-D93BC425DE69}"=""
"{F18F94D7-DE2F-4A80-8D49-BCD2FA5D496A}"=""
"{674BE74D-C496-48C4-A6DB-07AA05920B78}"=""
"{E69B2C01-8AFF-4377-84C2-6823E89D3788}"=""
"{D9375991-A484-40CE-AB10-5D6338E9FDFC}"=""
"{5872F5B2-E9FB-4907-8DC5-FCD01570E467}"=""
"{AE712614-67F1-41F8-A49B-F8699637FFCB}"=""
"{212DCA8E-7B73-4778-A2F8-61C6B45D63EE}"=""
"{94E9EEB6-F395-42E1-A876-4E090A086A20}"=""
"{09D21B13-DCF7-4222-B6F8-5B652E84E797}"=""
"{B073C7C4-8634-429E-B38C-494813F8D01A}"=""
"{B0E3FCA9-EF7D-4838-9721-ED24DD681AB5}"=""
"{15755ED1-ADCE-4708-AEF4-E5B24F44A715}"=""
"{87E2F4AE-1FB3-4AF4-A6C8-5560C17CA033}"=""
"{3456A020-1397-4279-BC52-CCEBC7B7AE17}"=""
"{7C1C56A6-9B37-43C5-A91F-9A773E028040}"=""
"{4B9C4208-23CC-4D0B-BF35-636592CF73C6}"=""
"{64B84BD4-C69E-4334-A091-EE401899ADBB}"=""
"{8F9EF6D3-FDA4-4362-8F21-AF3E5BFCFE7E}"=""
"{37B67E04-1F8A-4691-B243-E1BB390E7FC2}"=""
"{3101D372-6131-44AA-A7C0-769BD028072A}"=""
"{6DA7CB91-7F16-402B-B1A9-F588D59C1B11}"=""
"{153E7208-8F74-41BD-8F6B-849B6C231FF7}"=""
"{2894C6DA-F386-4631-BFAB-A059DB5B653A}"=""
"{E2F0955D-2D12-4EA3-BC53-132F91064023}"=""
"{9BCE49FF-F8E3-4DE4-9DA6-2065AFD22F91}"=""
"{2D86D01B-4BA1-41A1-8230-224DE6067351}"=""
"{F0CE4347-A8B0-4948-970D-FC4FB407A6D9}"=""
"{56D0DD33-FBE0-47B4-B988-B07C6616D846}"=""
"{F47E6536-9B5A-41DE-B277-8E170821D327}"=""
"{80E39866-2E9B-46BE-901B-F2AD2AB7B1D1}"=""
"{6B2E6FA0-8539-4F67-A81B-15AF695D15E2}"=""
"{CCB1B607-288A-4487-890D-F35FA386A198}"=""
"{9255A47A-CDB9-4397-99FF-9A733CBB210B}"=""
"{1FE5121D-0B75-427B-946F-410EAF496416}"=""
"{B4A9F953-4C25-4A4A-B47B-EBEDBAB6DDAF}"=""
"{97199924-5A19-44D8-BFB8-B8D76013440D}"=""
"{A2932602-F3A1-4452-B09E-E199C45607ED}"=""
"{389F6518-5FB7-428A-A5D0-3BA77EE17F0E}"=""
"{122E218E-76E1-40B4-B396-33B1907F9657}"=""
"{622DC36E-486D-4FE8-8341-0C94897818E4}"=""
"{4D177A91-D1A2-4A0E-A9B6-21ACA6FB8299}"=""
"{968202EC-EDBB-460A-AB50-2D3CB2C331E0}"=""
"{92AA8DFD-6DAC-4490-AC27-5532BB39610E}"=""
"{52B71C37-1869-4ED0-8D58-F6D6EB961033}"=""
"{1E7FEEA0-CDB6-42B2-A76B-8F6DCED8A552}"=""
"{8B98234C-C938-4C45-BB66-D39B6BDBB067}"=""
"{5399C205-B3FD-4DD5-A704-6007F128AE48}"=""
"{E2C58487-5BA9-46DE-B668-121C85C1BEFD}"=""
"{085B2E16-D5F2-4589-A54E-D62B827391EC}"=""
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-05-21  16:35:15
ComboFix-quarantined-files.txt  2012-05-21 14:35
.
Vor Suchlauf: 14 Verzeichnis(se), 210.135.871.488 Bytes frei
Nach Suchlauf: 22 Verzeichnis(se), 210.167.934.976 Bytes frei
.
- - End Of File - - 5FDFBAEEA482AE16FEAFEDE3F8C650C9
         

--- --- ---


Grüße Bebbo

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

• Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
• Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
• Klicke auf Scan.
• Warte bitte bis Scan finished successfully im DOS Fenster steht.
• Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr", dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Hallo Arne,
ich schon wieder ;-). aswMBR ist gelaufen:

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-05-21 18:33:33
-----------------------------
18:33:33.456    OS Version: Windows x64 6.1.7601 Service Pack 1
18:33:33.456    Number of processors: 2 586 0x170A
18:33:33.456    ComputerName: xxx-PC  UserName: xxx
18:33:35.266    Initialize success
18:33:42.286    AVAST engine defs: 12052100
18:33:47.918    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
18:33:47.918    Disk 0 Vendor: SAMSUNG_HM500JI 2AC101C4 Size: 476940MB BusType: 11
18:33:47.980    Disk 0 MBR read successfully
18:33:47.980    Disk 0 MBR scan
18:33:47.980    Disk 0 Windows 7 default MBR code
18:33:47.996    Disk 0 Partition 1 00     DE Dell Utility Dell 8.0       39 MB offset 63
18:33:48.011    Disk 0 Partition 2 00     07    HPFS/NTFS NTFS        15000 MB offset 80325
18:33:48.058    Disk 0 Partition 3 80 (A) 07    HPFS/NTFS NTFS       461899 MB offset 30800325
18:33:48.089    Disk 0 scanning C:\Windows\system32\drivers
18:34:07.605    Service scanning
18:34:40.958    Modules scanning
18:34:40.973    Disk 0 trace - called modules:
18:34:41.004    ntoskrnl.exe CLASSPNP.SYS disk.sys ataport.SYS PCIIDEX.SYS hal.dll msahci.sys 
18:34:41.004    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004c422e0]
18:34:41.020    3 CLASSPNP.SYS[fffff88001b7a43f] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0xfffffa80046e4060]
18:34:41.036    Scan finished successfully
18:34:59.303    Disk 0 MBR has been saved successfully to "C:\Users\xxx\Desktop\malware\MBR.dat"
18:34:59.319    The log file has been saved successfully to "C:\Users\xxx\Desktop\malware\aswMBR.txt"
         

Grüße Bebbo

Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Hallo Arne,

hier die Scans:

SuperAntispyware:

SUPERAntiSpyware Scann-Protokoll
hxxp://www.superantispyware.com

Generiert 05/22/2012 bei 05:08 AM

Version der Applikation : 5.0.1148

Version der Kern-Datenbank : 8626
Version der Spur-Datenbank : 6438

Scan Art       : kompletter Scann
Totale Scann-Zeit : 09:10:52

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Gescannte Speicherelemente  : 730
Erfasste Speicher-Bedrohungen  : 0
Gescannte Register-Elemente  : 68971
Erfasste Register-Bedrohungen  : 0
Gescannte Datei-Elemente     : 277867
Erfasste Datei-Elemente   : 0
         

Malwarebytes:

 Malwarebytes Anti-Malware  (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.05.21.06

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
xxx :: xxx-PC [Administrator]

Schutz: Aktiviert

22.05.2012 06:18:11
mbam-log-2012-05-22 (06-18-11).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 520260
Laufzeit: 2 Stunde(n), 17 Minute(n), 53 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
         

Grüße Bebbo

Sieht ok aus, das Tool SUPERAntiSpyware hast du ja schon am Anfang ausgeführt und da wurden nur Cookies gefunden.

Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Hallo Arne,
das System läuft wie gewohnt. Es hat auch vor dem "Hack" keine Probleme gemacht. War was auf Grund der LOGs festzustellen? Die Unsicherheit, wie das Passwort gehackt wurde, bleibt. Wenn dieses System nun sauber ist, kann ich von diesem Rechner aus wenigstens meine Passwörter ändern. Grüße Bebbo

Dann wären wir durch!

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Hallo Arne,

vielen Dank für die Hilfe. Ich hoffe das wars mit dem Hacker.

Grüße Bebbo