| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: Mor.exe abgewendet?Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
25.06.2012, 03:01
| #1 | ||
 |  Mor.exe abgewendet? Sorry war mir nicht ganz sicher ob ich das in einen Thread zum Thema mor.exe posten soll. Gestern abend war ich auf TV Tropes auf der Seite von Dead Rising 2. Ich benutze Firefox und normaler Weise habe ich immer Cookies deaktiviert, aber weil ich einen kleinen Eintrag by Tv Tropes machen wollte änderte ich die Einstellung zu normalen Cookies (nicht von Drittanbierten) zu erlaube. Als ich dort war klickte ich auf ein Link zu einen Artikel auf der Seite siliconera.com. Wobei ich vergass die Cookies wieder zu deaktivieren. Nachdem ich den Tab mit den Artikel schnell geschlossen hatte, da ich die Seite nicht kannte. Erschien prlötzlich von Anti-Vir die Anfrage ob mor.exe erlaubt werden soll oder zurückgewiesen werden sollte. Ich habe nähmlich die Anti-Vir Einstellung das es immer fragen soll bevor eine .exe datei ausgeführt werden soll. Schnell klickte ich auf Zurückweisen und sah in meinen Ordner AppData/Local/Temp nach, da ich wusse dass dort meistens solche Malware und Viren .exe datein auftreten. Aber die Datei fehlte komplett. Aus Angst suchte ich im Internet nach mor.exe und fand einen Eintrag hier. Ich follgte der ersten Anweisung, installiert Malwarebytes, updatete es zur neusten Version. Ging in den Abgesicherten Modus und ließ einen kompletten Scan machen. Eine Stunde später kahm dieses Ergebniss heraus: Zitat:
Ich scannte noch einmal mein Java order direkt mit Walwarebytes und erneut nicht ein Fund. Ich entschloss mich dann ein paar wichtige Daten auf meine sonst getrennte exteren Festplatte zu koppieren (Text für die Uni und Bilder, keine exe dateien). Aber wo ich nochmal nach informationen zur Malware suchend, auf Microsoft nachgelesen habe das die Gefahr die hinter der Malware mit mor.exe steht als "severe" beschrieben wird, bin ich mir nicht sicher ob ich nicht zu vorschnell war. Also meine Frage ist. Kann ich dem Urteil von Malwarebytes trauen UND ist es möglich das ich durch das zurückweisen per Avira die Malwareattacke im Keim erstickt habe? Oder sollte ich mir nun mehr Sorgen den je machen (da ich vielleicht meine Exterene Festplatte infiziert habe)? Entschuldigt den Doppelpost. Aber ich konnte meinen Eintrag nicht editieren. Nach genaueren erinnern ist mir eingefallen das ich nicht die bloße Ausführung des Programms sonder das Herunter laden der exe Datei verboten habe. Das ist bei mir ebenfalls eingestellt. Ausführung von exe datein und das herunterladen von Ausführungen aus dem Internent brauchen meine Erlaubnis. Jetzt ist die Frage ob mor.exe die Malware installiert oder von ihr herunter geladen wird. Also ob ich das Sympton verhindert habe oder die Infektion? Hier ist nochmal was mein Anvira gemacht hat: Zitat:
|
|
28.06.2012, 11:13
| #2 |
| /// Winkelfunktion /// TB-Süch-Tiger™   | Mor.exe abgewendet? Führ bitte auch ESET aus, danach sehen wir weiter.
__________________Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden. ESET Online Scanner Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
 + R Taste und kopiere folgenden Text in das Ausführen Fenster.Code:
ATTFilter "%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"
Code:
ATTFilter "%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"
__________________ |
|
28.06.2012, 16:13
| #3 | |
| | Mor.exe abgewendet? Okay, erst einmal vielen Dank.
__________________Ich hoffe nur das temporäre abschalten meiner Firewall und Aviras hat mit nicht in den hinter gebissen. Übrigens Avira hatte zwischen durch ein update gemacht da ich nur die Abwehrprogramme und Firewall abgeschaltet habe Avira selbst aber noch an war. Hoffe das macht keinen großen Unterschied Auf jedenfall hier ist der Inhalt der Log datei. Es sind zwei Suchdurchläufe weil ich beim ersten vergessen hatte den esetsmartinstaller als Administrator auszuführen: Zitat:
Ich hoffe du kannst mir jetzt die letzte Gewissheit geben. Ich warte dann auf deine Antwort. Nochmal vielen Dank. |
|
29.06.2012, 11:03
| #4 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Mor.exe abgewendet? Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten. Wird so gemacht: [code] hier steht das Log [/code] Und das ganze sieht dann so aus: Code:
ATTFilter hier steht das Log
Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
ATTFilter netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
29.06.2012, 11:38
| #5 |
| | Mor.exe abgewendet? Du hattest nur all Programme abschalten gesagt, ich war mir nicht sicher ob das auch Avira beinhaltete oder nur die normal Programme. Wenn ja, sag es dann mach ich den Suchlauf nochmal. Ach ja, ich hoffe es macht keine zu große Änderung aber ich habe die Angaben meines Namens als User durch *Name* ersetzt in da ich den nicht einfach groß im Internent sichtbar haben wollte. Ich habe zur sicherheit aber auch noch die orginal OTL.txt datai mit dem drin falls das so wichtig ist. So mal sehen was du mir aus diesen Daten noch sagen kannst. OTL Logfile: Code:
ATTFilter OTL logfile created on: 6/29/2012 12:18:49 PM - Run 1 OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\*Name*\Desktop Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.25 Gb Total Physical Memory | 2.37 Gb Available Physical Memory | 72.91% Memory free 6.50 Gb Paging File | 5.40 Gb Available in Paging File | 83.16% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 900.41 Gb Total Space | 732.34 Gb Free Space | 81.33% Space Free | Partition Type: NTFS Drive D: | 30.00 Gb Total Space | 12.52 Gb Free Space | 41.72% Space Free | Partition Type: NTFS Computer Name: *Name* | User Name: *Name* | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/06/29 12:16:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\*Name*\Desktop\OTL.exe PRC - [2012/05/14 18:24:38 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe PRC - [2012/05/14 18:24:38 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE PRC - [2012/05/14 18:24:38 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe PRC - [2012/05/14 18:24:38 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2012/05/14 18:24:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2012/05/14 18:24:38 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2012/05/14 18:24:38 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011/07/16 06:31:12 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010/09/29 03:51:26 | 000,380,928 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2010/09/29 03:50:58 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2009/11/02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe ========== Modules (No Company Name) ========== MOD - [2012/06/14 11:22:23 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll MOD - [2012/06/14 11:22:01 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll MOD - [2012/06/14 11:21:56 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll MOD - [2012/05/13 03:27:21 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll MOD - [2012/05/13 03:26:17 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll MOD - [2012/05/13 03:26:14 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll MOD - [2012/05/13 03:26:12 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll MOD - [2012/05/13 03:26:05 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll MOD - [2010/10/01 08:36:20 | 000,270,336 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll MOD - [2010/05/12 15:12:53 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2010/05/12 15:12:50 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009/11/02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll MOD - [2009/11/02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll ========== Win32 Services (SafeList) ========== SRV - [2012/05/19 02:04:55 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012/05/14 18:24:38 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService) SRV - [2012/05/14 18:24:38 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2012/05/14 18:24:38 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2012/05/14 18:24:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012/05/14 18:24:38 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2010/10/11 22:30:15 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2010/09/29 03:50:58 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\BENJAM~1\AppData\Local\Temp\mdxgthkn.sys -- (mdxgthkn) DRV - [2012/05/14 18:24:38 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012/05/14 18:24:38 | 000,112,032 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avfwot.sys -- (avfwot) DRV - [2012/05/14 18:24:38 | 000,091,968 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avfwim.sys -- (avfwim) DRV - [2012/05/14 18:24:38 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012/02/07 21:30:57 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ACEDRV05.sys -- (ACEDRV05) DRV - [2012/01/07 20:16:56 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2012/01/07 20:16:55 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2011/10/11 15:05:48 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011/10/11 15:05:48 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010/09/29 04:25:14 | 006,472,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2010/09/29 03:14:30 | 000,228,352 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2010/09/24 14:46:24 | 000,102,416 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService) DRV - [2010/06/14 11:41:10 | 000,030,464 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter) DRV - [2010/05/15 00:04:14 | 000,062,592 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\amd_sata.sys -- (amd_sata) DRV - [2010/05/15 00:04:14 | 000,024,192 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\amd_xata.sys -- (amd_xata) DRV - [2010/05/06 11:21:42 | 000,108,560 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2010/03/10 04:03:50 | 000,014,392 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO) DRV - [2010/02/06 16:49:00 | 000,597,536 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su) DRV - [2009/06/10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\..\SearchScopes,DefaultScope = {C7FD346B-CF18-44A6-8A58-713C6A7DE869} IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\..\SearchScopes\{C7FD346B-CF18-44A6-8A58-713C6A7DE869}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNA_enDE393 IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.update: false FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Eigene Programme\Mozilla Firefox\components [2012/06/16 22:16:16 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Eigene Programme\Mozilla Firefox\components [2012/06/16 22:16:16 | 000,000,000 | ---D | M] [2011/04/22 12:30:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*Name*\AppData\Roaming\mozilla\Extensions [2012/06/25 22:21:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\*Name*\AppData\Roaming\mozilla\Firefox\Profiles\o042joyq.default\extensions [2012/06/25 22:21:23 | 000,000,000 | ---D | M] (WOT) -- C:\Users\*Name*\AppData\Roaming\mozilla\Firefox\Profiles\o042joyq.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2012/05/31 14:32:55 | 000,505,801 | ---- | M] () (No name found) -- C:\USERS\*NAME*\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O042JOYQ.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI [2012/01/06 12:08:02 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\*Name*\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O042JOYQ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O13 - gopher Prefix: missing O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab (Office Genuine Advantage Validation Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.10 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5426975B-F785-4627-B2B1-8176017CD259}: DhcpNameServer = 192.168.0.10 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B684A91E-4B96-4D09-AAC1-C3EC08A4A5ED}: DhcpNameServer = 192.168.0.10 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012/06/29 12:16:51 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\*Name*\Desktop\OTL.exe [2012/06/28 21:40:09 | 002,322,184 | ---- | C] (ESET) -- C:\Users\*Name*\Desktop\esetsmartinstaller_enu.exe [2012/06/25 20:24:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview [2012/06/25 17:08:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012/06/25 17:08:01 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012/06/22 13:40:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012/06/22 12:29:24 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2012 [2012/06/16 19:11:10 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Local\capcom [2012/06/11 02:09:17 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Roaming\dvdcss [2012/06/10 14:02:21 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Local\PunkBuster [2012/06/09 12:48:42 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Roaming\TuneUp Software [2012/06/09 12:47:31 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2012/06/09 12:47:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2012/06/09 12:47:25 | 000,000,000 | ---D | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} [2012/06/03 20:18:07 | 000,000,000 | ---D | C] -- C:\Users\*Name*\AppData\Local\Microsoft Games [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/06/29 12:16:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\*Name*\Desktop\OTL.exe [2012/06/29 11:59:05 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/06/29 11:09:06 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/06/29 11:09:06 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/06/29 11:08:35 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012/06/29 11:08:35 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012/06/29 11:08:35 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012/06/29 11:08:35 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012/06/29 11:03:21 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/06/29 11:01:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/06/29 11:01:38 | 2616,684,544 | -HS- | M] () -- C:\hiberfil.sys [2012/06/28 22:13:39 | 000,138,992 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2012/06/28 22:13:28 | 000,281,288 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr [2012/06/28 21:40:10 | 002,322,184 | ---- | M] (ESET) -- C:\Users\*Name*\Desktop\esetsmartinstaller_enu.exe [2012/06/28 10:55:46 | 000,000,018 | ---- | M] () -- C:\Users\*Name*\AppData\Roaming\mbam.context.scan [2012/06/28 02:22:41 | 000,007,597 | ---- | M] () -- C:\Users\*Name*\AppData\Local\Resmon.ResmonCfg [2012/06/28 01:05:36 | 000,281,288 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0 [2012/06/25 17:09:06 | 000,000,899 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/06/23 03:12:44 | 000,000,000 | ---- | M] () -- C:\Windows\System32\GetInitReference() [2012/06/14 11:20:53 | 000,304,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012/06/10 13:44:48 | 000,138,904 | ---- | M] () -- C:\Users\*Name*\AppData\Roaming\PnkBstrK.sys [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/06/28 10:55:19 | 000,000,018 | ---- | C] () -- C:\Users\*Name*\AppData\Roaming\mbam.context.scan [2012/06/25 17:08:51 | 000,000,899 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/06/23 03:12:44 | 000,000,000 | ---- | C] () -- C:\Windows\System32\GetInitReference() [2012/06/10 13:44:48 | 000,138,992 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2012/06/10 13:44:32 | 000,281,288 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2012/06/10 13:44:32 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe [2012/01/07 20:16:56 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2012/01/07 20:16:55 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2011/12/09 03:18:24 | 000,138,904 | ---- | C] () -- C:\Users\*Name*\AppData\Roaming\PnkBstrK.sys [2011/07/30 20:19:36 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll [2011/07/30 17:21:46 | 000,007,597 | ---- | C] () -- C:\Users\*Name*\AppData\Local\Resmon.ResmonCfg [2011/07/24 00:48:53 | 000,000,196 | ---- | C] () -- C:\Windows\System32\swkotor.ini [2010/09/15 15:24:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010/09/15 15:01:00 | 000,000,018 | ---- | C] () -- C:\Windows\System32\drivers\VERSION.DAT [2010/09/15 13:12:24 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll [2010/08/11 15:24:20 | 000,224,342 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat ========== LOP Check ========== [2011/04/22 12:43:52 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\GHISLER [2011/08/16 12:19:34 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\LEGO Company [2011/09/08 15:36:13 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\OpenOffice.org [2011/08/12 14:04:14 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\ScummVM [2012/06/09 12:48:42 | 000,000,000 | ---D | M] -- C:\Users\*Name*\AppData\Roaming\TuneUp Software [2012/06/28 12:41:58 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < sceclt.dll > < ntelogon.dll > < winlogon.exe > < logevent.dll > < user32.DLL > < iaStor.sys > < nvstor.sys > < atapi.sys > < IdeChnDr.sys > < viasraid.sys > < AGP440.sys > < vaxscsi.sys > < nvatabus.sys > < viamraid.sys > < nvata.sys > < nvgts.sys > < iastorv.sys > < ViPrt.sys > < eNetHook.dll > < ahcix86.sys > < KR10N.sys > < nvstor32.sys > < ahcix86s.sys > < /md5stop > Invalid Switch: md5stop < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < End of report > |
|
29.06.2012, 12:39
| #6 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Mor.exe abgewendet? Beim CustomScan ist irgenwas schiefegegangen. Hast du den Text da richtig 1:1 kopiert und eingefügt?
__________________ --> Mor.exe abgewendet? |
|
29.06.2012, 14:09
| #7 |
| | Mor.exe abgewendet? Also das was ich da gepostet habe war der Inhalt der log.txt datei. Ich habe aber zwei Text Datein erhalten. Einmal Log.txt und extra.txt. Ist es vielleicht der Inhalt von der Anderen die du brauchst oder war es vielleicht der Avira der noch aktive war? Soll ich den Test nochmal machen? Vielleicht hatte ich einen Fehler gemacht? Was genau ist den schief gelaufen? Edit: Okay, ich habe einen zweiten Lauf gemacht diesmal ist dieß der Inhalt und es gibt dort nun eindeutig mehr Informationen aus dem Custom Scan: OTL Logfile: Code:
ATTFilter OTL logfile created on: 6/29/2012 3:41:11 PM - Run 2 OTL by OldTimer - Version 3.2.53.0 Folder = C:\Users\Name\Desktop Home Premium Edition (Version = 6.1.7600) - Type = NTWorkstation Internet Explorer (Version = 8.0.7600.16385) Locale: 00000409 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 3.25 Gb Total Physical Memory | 1.96 Gb Available Physical Memory | 60.37% Memory free 6.50 Gb Paging File | 5.09 Gb Available in Paging File | 78.29% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 900.41 Gb Total Space | 731.99 Gb Free Space | 81.30% Space Free | Partition Type: NTFS Drive D: | 30.00 Gb Total Space | 12.52 Gb Free Space | 41.72% Space Free | Partition Type: NTFS Computer Name: NamesPC | User Name: Name | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Quick Scan Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - [2012/06/29 12:16:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe PRC - [2012/06/16 22:16:16 | 000,913,888 | ---- | M] (Mozilla Corporation) -- C:\Eigene Programme\Mozilla Firefox\firefox.exe PRC - [2012/05/14 18:24:38 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe PRC - [2012/05/14 18:24:38 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE PRC - [2012/05/14 18:24:38 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe PRC - [2012/05/14 18:24:38 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe PRC - [2012/05/14 18:24:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe PRC - [2012/05/14 18:24:38 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe PRC - [2012/05/14 18:24:38 | 000,080,336 | ---- | M] (Avira Operations GmbH & Co. KG) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe PRC - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe PRC - [2011/07/16 06:31:12 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe PRC - [2011/02/26 07:33:07 | 002,614,784 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe PRC - [2010/09/29 03:51:26 | 000,380,928 | ---- | M] (AMD) -- C:\Windows\System32\atieclxx.exe PRC - [2010/09/29 03:50:58 | 000,176,128 | ---- | M] (AMD) -- C:\Windows\System32\atiesrxx.exe PRC - [2009/11/02 23:21:26 | 000,103,720 | ---- | M] (CyberLink) -- C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe PRC - [2009/07/14 03:14:42 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe PRC - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe ========== Modules (No Company Name) ========== MOD - [2012/06/16 22:16:15 | 002,042,848 | ---- | M] () -- C:\Eigene Programme\Mozilla Firefox\mozjs.dll MOD - [2012/06/14 11:22:23 | 011,824,128 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\84fbf353f91385690a3e4e982aa6930e\System.Web.ni.dll MOD - [2012/06/14 11:22:01 | 012,433,920 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\009c50fb69919b90fb233cb4c35d0ad7\System.Windows.Forms.ni.dll MOD - [2012/06/14 11:21:56 | 001,591,808 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\ebefde27b0ef7f39bb49c493b34a602c\System.Drawing.ni.dll MOD - [2012/05/13 03:27:21 | 000,771,584 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Remo#\0c00b1a8336dd4c1bd1ebce7780f20b4\System.Runtime.Remoting.ni.dll MOD - [2012/05/13 03:26:17 | 005,453,312 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\5c85c9c42e1b8a8760de82ecb4c7d582\System.Xml.ni.dll MOD - [2012/05/13 03:26:14 | 000,971,264 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\cb079eab134fd1a752ad91db13274110\System.Configuration.ni.dll MOD - [2012/05/13 03:26:12 | 007,952,384 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\System\2ebb3c259eab50af565e3a8dba6ad20e\System.ni.dll MOD - [2012/05/13 03:26:05 | 011,490,816 | ---- | M] () -- C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\5858678a79aae31262b0214424245d06\mscorlib.ni.dll MOD - [2010/10/01 08:36:20 | 000,270,336 | ---- | M] () -- C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll MOD - [2010/05/12 15:12:53 | 000,434,176 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\System.Windows.Forms.resources\2.0.0.0_de_b77a5c561934e089\System.Windows.Forms.resources.dll MOD - [2010/05/12 15:12:50 | 000,315,392 | ---- | M] () -- C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll MOD - [2009/11/02 23:23:36 | 000,013,096 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll MOD - [2009/11/02 23:20:10 | 000,619,816 | ---- | M] () -- C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll ========== Win32 Services (SafeList) ========== SRV - [2012/05/19 02:04:55 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files\Common Files\Steam\SteamService.exe -- (Steam Client Service) SRV - [2012/05/14 18:24:38 | 000,619,472 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe -- (AntiVirFirewallService) SRV - [2012/05/14 18:24:38 | 000,465,360 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE -- (AntiVirWebService) SRV - [2012/05/14 18:24:38 | 000,375,760 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avmailc.exe -- (AntiVirMailService) SRV - [2012/05/14 18:24:38 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService) SRV - [2012/05/14 18:24:38 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService) SRV - [2012/04/04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService) SRV - [2010/10/11 22:30:15 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc) SRV - [2010/09/29 03:50:58 | 000,176,128 | ---- | M] (AMD) [Auto | Running] -- C:\Windows\System32\atiesrxx.exe -- (AMD External Events Utility) SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc) SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend) SRV - [2007/07/24 11:15:14 | 000,185,632 | ---- | M] (Protexis Inc.) [Auto | Running] -- c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe -- (PSI_SVC_2) ========== Driver Services (SafeList) ========== DRV - File not found [Kernel | On_Demand | Stopped] -- C:\Users\Name\AppData\Local\Temp\mdxgthkn.sys -- (mdxgthkn) DRV - [2012/05/14 18:24:38 | 000,137,928 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb) DRV - [2012/05/14 18:24:38 | 000,112,032 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avfwot.sys -- (avfwot) DRV - [2012/05/14 18:24:38 | 000,091,968 | ---- | M] (Avira GmbH) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\avfwim.sys -- (avfwim) DRV - [2012/05/14 18:24:38 | 000,083,392 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt) DRV - [2012/04/04 15:56:40 | 000,022,344 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\mbam.sys -- (MBAMProtector) DRV - [2012/02/07 21:30:57 | 000,097,792 | ---- | M] (Protect Software GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ACEDRV05.sys -- (ACEDRV05) DRV - [2012/01/07 20:16:56 | 000,281,760 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\atksgt.sys -- (atksgt) DRV - [2012/01/07 20:16:55 | 000,025,888 | ---- | M] () [Kernel | Auto | Running] -- C:\Windows\System32\drivers\lirsgt.sys -- (lirsgt) DRV - [2011/10/11 15:05:48 | 000,036,000 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avkmgr.sys -- (avkmgr) DRV - [2011/10/11 15:05:48 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv) DRV - [2010/09/29 04:25:14 | 006,472,192 | ---- | M] (ATI Technologies Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmdag.sys -- (amdkmdag) DRV - [2010/09/29 03:14:30 | 000,228,352 | ---- | M] (Advanced Micro Devices, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\atikmpag.sys -- (amdkmdap) DRV - [2010/09/24 14:46:24 | 000,102,416 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\AtihdW73.sys -- (AtiHDAudioService) DRV - [2010/06/14 11:41:10 | 000,030,464 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\usbfilter.sys -- (usbfilter) DRV - [2010/05/15 00:04:14 | 000,062,592 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\amd_sata.sys -- (amd_sata) DRV - [2010/05/15 00:04:14 | 000,024,192 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\amd_xata.sys -- (amd_xata) DRV - [2010/05/06 11:21:42 | 000,108,560 | ---- | M] (ATI Technologies, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\AtiHdmi.sys -- (AtiHdmiService) DRV - [2010/03/10 04:03:50 | 000,014,392 | ---- | M] (Advanced Micro Devices Inc.) [Kernel | Boot | Running] -- C:\Windows\System32\drivers\AtiPcie.sys -- (AtiPcie) AMD PCI Express (3GIO) DRV - [2010/02/06 16:49:00 | 000,597,536 | ---- | M] (Realtek Semiconductor Corporation ) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\RTL8192su.sys -- (RTL8192su) DRV - [2009/06/10 23:19:48 | 009,853,248 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,SearchDefaultBranded = 1 IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\..\SearchScopes,DefaultScope = {C7FD346B-CF18-44A6-8A58-713C6A7DE869} IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\..\SearchScopes\{C7FD346B-CF18-44A6-8A58-713C6A7DE869}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7&rlz=1I7MDNA_enDE393 IE - HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.update: false FF - prefs.js..network.proxy.type: 0 FF - user.js - File not found FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@adobe.com/ShockwavePlayer: C:\Windows\system32\Adobe\Director\np32dsw.dll (Adobe Systems, Inc.) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: C:\Windows\system32\Wat\npWatWeb.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=15.4.3502.0922: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.) FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 4.0\extensions\\Components: C:\Eigene Programme\Mozilla Firefox\components [2012/06/16 22:16:16 | 000,000,000 | ---D | M] FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Eigene Programme\Mozilla Firefox\components [2012/06/16 22:16:16 | 000,000,000 | ---D | M] [2011/04/22 12:30:39 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Name\AppData\Roaming\mozilla\Extensions [2012/06/25 22:21:23 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Name\AppData\Roaming\mozilla\Firefox\Profiles\o042joyq.default\extensions [2012/06/25 22:21:23 | 000,000,000 | ---D | M] (WOT) -- C:\Users\Name\AppData\Roaming\mozilla\Firefox\Profiles\o042joyq.default\extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2012/05/31 14:32:55 | 000,505,801 | ---- | M] () (No name found) -- C:\USERS\Name\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O042JOYQ.DEFAULT\EXTENSIONS\{1280606B-2510-4FE0-97EF-9B5A22EAFE30}.XPI [2012/01/06 12:08:02 | 000,634,964 | ---- | M] () (No name found) -- C:\USERS\Name\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\O042JOYQ.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [CLMLServer] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [StartCCC] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe (Advanced Micro Devices, Inc.) O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation) O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5 O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3 O8 - Extra context menu item: Google Sidewiki... - res://C:\Program Files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html File not found O9 - Extra 'Tools' menuitem : Sun Java Konsole - {08B0E5C0-4FCB-11CF-AAA5-00401C608501} - C:\Program Files\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.) O9 - Extra Button: eBay - Der weltweite Online-Marktplatz - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O9 - Extra 'Tools' menuitem : eBay - {0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4 File not found O10 - Protocol_Catalog9\Catalog_Entries\000000000001 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000002 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000003 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000004 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O10 - Protocol_Catalog9\Catalog_Entries\000000000029 - C:\Program Files\Avira\AntiVir Desktop\avsda.dll (Avira Operations GmbH & Co. KG) O13 - gopher Prefix: missing O16 - DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab (Office Genuine Advantage Validation Tool) O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.0.10 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{5426975B-F785-4627-B2B1-8176017CD259}: DhcpNameServer = 192.168.0.10 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{B684A91E-4B96-4D09-AAC1-C3EC08A4A5ED}: DhcpNameServer = 192.168.0.10 O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation) O20 - HKLM Winlogon: VMApplet - (/pagefile) - File not found O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found. O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3) O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2) O38 - SubSystems\\Windows: (ServerDll=sxssrv,4) NetSvcs: FastUserSwitchingCompatibility - File not found NetSvcs: Ias - C:\Windows\System32\ias.dll (Microsoft Corporation) NetSvcs: Nla - File not found NetSvcs: Ntmssvc - File not found NetSvcs: NWCWorkstation - File not found NetSvcs: Nwsapagent - File not found NetSvcs: SRService - File not found NetSvcs: WmdmPmSp - File not found NetSvcs: LogonHours - File not found NetSvcs: PCAudit - File not found NetSvcs: helpsvc - File not found NetSvcs: uploadmgr - File not found SafeBootMin: AppMgmt - Service SafeBootMin: Base - Driver Group SafeBootMin: Boot Bus Extender - Driver Group SafeBootMin: Boot file system - Driver Group SafeBootMin: BsScanner - Service SafeBootMin: File system - Driver Group SafeBootMin: Filter - Driver Group SafeBootMin: HelpSvc - Service SafeBootMin: NTDS - File not found SafeBootMin: PCI Configuration - Driver Group SafeBootMin: PNP Filter - Driver Group SafeBootMin: Primary disk - Driver Group SafeBootMin: sacsvr - Service SafeBootMin: SCSI Class - Driver Group SafeBootMin: System Bus Extender - Driver Group SafeBootMin: vmms - Service SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices SafeBootNet: AppMgmt - Service SafeBootNet: Base - Driver Group SafeBootNet: Boot Bus Extender - Driver Group SafeBootNet: Boot file system - Driver Group SafeBootNet: BsScanner - Service SafeBootNet: File system - Driver Group SafeBootNet: Filter - Driver Group SafeBootNet: HelpSvc - Service SafeBootNet: Messenger - Service SafeBootNet: NDIS Wrapper - Driver Group SafeBootNet: NetBIOSGroup - Driver Group SafeBootNet: NetDDEGroup - Driver Group SafeBootNet: Network - Driver Group SafeBootNet: NetworkProvider - Driver Group SafeBootNet: NTDS - File not found SafeBootNet: PCI Configuration - Driver Group SafeBootNet: PNP Filter - Driver Group SafeBootNet: PNP_TDI - Driver Group SafeBootNet: Primary disk - Driver Group SafeBootNet: rdsessmgr - Service SafeBootNet: sacsvr - Service SafeBootNet: SCSI Class - Driver Group SafeBootNet: Streams Drivers - Driver Group SafeBootNet: System Bus Extender - Driver Group SafeBootNet: TDI - Driver Group SafeBootNet: vmms - Service SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation) SafeBootNet: WudfUsbccidDriver - Driver SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun) ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0 ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6 ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7 ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS) Drivers32: vidc.cvid - C:\Windows\System32\iccvid.dll (Radius Inc.) CREATERESTOREPOINT Restore point Set: OTL Restore Point ========== Files/Folders - Created Within 30 Days ========== [2012/06/29 12:16:51 | 000,596,992 | ---- | C] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe [2012/06/28 21:40:09 | 002,322,184 | ---- | C] (ESET) -- C:\Users\Name\Desktop\esetsmartinstaller_enu.exe [2012/06/25 20:24:50 | 000,000,000 | ---D | C] -- C:\Windows\System32\SPReview [2012/06/25 17:08:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2012/06/25 17:08:01 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2012/06/22 13:40:54 | 000,000,000 | -HSD | C] -- C:\Config.Msi [2012/06/22 12:29:24 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2012 [2012/06/16 19:11:10 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\capcom [2012/06/11 02:09:17 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\dvdcss [2012/06/10 14:02:21 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\PunkBuster [2012/06/09 12:48:42 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Roaming\TuneUp Software [2012/06/09 12:47:31 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2012/06/09 12:47:25 | 000,000,000 | -H-D | C] -- C:\ProgramData\Common Files [2012/06/09 12:47:25 | 000,000,000 | ---D | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} [2012/06/03 20:18:07 | 000,000,000 | ---D | C] -- C:\Users\Name\AppData\Local\Microsoft Games [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2012/06/29 14:59:00 | 000,001,098 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineUA.job [2012/06/29 12:16:51 | 000,596,992 | ---- | M] (OldTimer Tools) -- C:\Users\Name\Desktop\OTL.exe [2012/06/29 11:09:06 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0 [2012/06/29 11:09:06 | 000,010,096 | -H-- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0 [2012/06/29 11:08:35 | 000,653,928 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2012/06/29 11:08:35 | 000,615,810 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2012/06/29 11:08:35 | 000,129,800 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2012/06/29 11:08:35 | 000,106,190 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2012/06/29 11:03:21 | 000,001,094 | ---- | M] () -- C:\Windows\tasks\GoogleUpdateTaskMachineCore.job [2012/06/29 11:01:49 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2012/06/29 11:01:38 | 2616,684,544 | -HS- | M] () -- C:\hiberfil.sys [2012/06/28 22:13:39 | 000,138,992 | ---- | M] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2012/06/28 22:13:28 | 000,281,288 | ---- | M] () -- C:\Windows\System32\PnkBstrB.xtr [2012/06/28 21:40:10 | 002,322,184 | ---- | M] (ESET) -- C:\Users\Name\Desktop\esetsmartinstaller_enu.exe [2012/06/28 10:55:46 | 000,000,018 | ---- | M] () -- C:\Users\Name\AppData\Roaming\mbam.context.scan [2012/06/28 02:22:41 | 000,007,597 | ---- | M] () -- C:\Users\Name\AppData\Local\Resmon.ResmonCfg [2012/06/28 01:05:36 | 000,281,288 | ---- | M] () -- C:\Windows\System32\PnkBstrB.ex0 [2012/06/25 17:09:06 | 000,000,899 | ---- | M] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/06/23 03:12:44 | 000,000,000 | ---- | M] () -- C:\Windows\System32\GetInitReference() [2012/06/14 11:20:53 | 000,304,400 | ---- | M] () -- C:\Windows\System32\FNTCACHE.DAT [2012/06/10 13:44:48 | 000,138,904 | ---- | M] () -- C:\Users\Name\AppData\Roaming\PnkBstrK.sys [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] ========== Files Created - No Company Name ========== [2012/06/28 10:55:19 | 000,000,018 | ---- | C] () -- C:\Users\Name\AppData\Roaming\mbam.context.scan [2012/06/25 17:08:51 | 000,000,899 | ---- | C] () -- C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk [2012/06/23 03:12:44 | 000,000,000 | ---- | C] () -- C:\Windows\System32\GetInitReference() [2012/06/10 13:44:48 | 000,138,992 | ---- | C] () -- C:\Windows\System32\drivers\PnkBstrK.sys [2012/06/10 13:44:32 | 000,281,288 | ---- | C] () -- C:\Windows\System32\PnkBstrB.exe [2012/06/10 13:44:32 | 000,076,888 | ---- | C] () -- C:\Windows\System32\PnkBstrA.exe [2012/01/07 20:16:56 | 000,281,760 | ---- | C] () -- C:\Windows\System32\drivers\atksgt.sys [2012/01/07 20:16:55 | 000,025,888 | ---- | C] () -- C:\Windows\System32\drivers\lirsgt.sys [2011/12/09 03:18:24 | 000,138,904 | ---- | C] () -- C:\Users\Name\AppData\Roaming\PnkBstrK.sys [2011/07/30 20:19:36 | 000,043,520 | ---- | C] () -- C:\Windows\System32\CmdLineExt03.dll [2011/07/30 17:21:46 | 000,007,597 | ---- | C] () -- C:\Users\Name\AppData\Local\Resmon.ResmonCfg [2011/07/24 00:48:53 | 000,000,196 | ---- | C] () -- C:\Windows\System32\swkotor.ini [2010/09/15 15:24:00 | 000,000,000 | ---- | C] () -- C:\Windows\ativpsrm.bin [2010/09/15 15:01:00 | 000,000,018 | ---- | C] () -- C:\Windows\System32\drivers\VERSION.DAT [2010/09/15 13:12:24 | 000,080,416 | ---- | C] () -- C:\Windows\System32\RtNicProp32.dll [2010/08/11 15:24:20 | 000,224,342 | ---- | C] () -- C:\Windows\System32\atiicdxx.dat ========== LOP Check ========== [2011/04/22 12:43:52 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\GHISLER [2011/08/16 12:19:34 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\LEGO Company [2011/09/08 15:36:13 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\OpenOffice.org [2011/08/12 14:04:14 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\ScummVM [2012/06/09 12:48:42 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\TuneUp Software [2012/06/28 12:41:58 | 000,032,632 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT ========== Purity Check ========== ========== Custom Scans ========== < %ALLUSERSPROFILE%\Application Data\*. > < %ALLUSERSPROFILE%\Application Data\*.exe /s > < %APPDATA%\*. > [2011/04/21 15:27:26 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Adobe [2011/04/21 14:34:30 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\ATI [2011/10/11 15:15:02 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Avira [2012/06/11 02:15:20 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\dvdcss [2011/04/22 12:43:52 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\GHISLER [2011/04/21 14:33:49 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Identities [2011/07/21 21:59:53 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\InstallShield [2011/08/16 12:19:34 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\LEGO Company [2010/09/15 14:21:18 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Macromedia [2011/07/25 13:34:51 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Malwarebytes [2009/07/14 09:48:18 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Media Center Programs [2012/06/22 12:44:24 | 000,000,000 | --SD | M] -- C:\Users\Name\AppData\Roaming\Microsoft [2011/04/22 12:30:39 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\Mozilla [2011/09/08 15:36:13 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\OpenOffice.org [2011/08/12 14:04:14 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\ScummVM [2011/07/22 22:56:50 | 000,000,000 | RH-D | M] -- C:\Users\Name\AppData\Roaming\SecuROM [2012/06/09 12:48:42 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\TuneUp Software [2012/06/11 02:09:16 | 000,000,000 | ---D | M] -- C:\Users\Name\AppData\Roaming\vlc < %APPDATA%\*.exe /s > [2010/11/12 01:58:12 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Name\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe < %SYSTEMDRIVE%\*.exe > < MD5 for: AGP440.SYS > [2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys [2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_65848c2d7375a720\AGP440.sys [2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys [2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys < MD5 for: AHCIX86S.SYS > [2007/11/14 19:44:42 | 000,129,552 | ---- | M] (Promise Technology, Inc.) MD5=58CB1FA96B24DFE2196548E959B1996B -- C:\ATI\Win7_Vista\8_741\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys [2007/11/14 19:44:42 | 000,129,552 | ---- | M] (Promise Technology, Inc.) MD5=58CB1FA96B24DFE2196548E959B1996B -- C:\ATI\Win7_Vista\8_782\Packages\Drivers\SBDrv\SB6xx\RAID\LH\ahcix86s.sys [2009/10/26 19:41:10 | 000,189,496 | ---- | M] (Advanced Micro Devices, Inc) MD5=6C27F0A964EA98F457CAAB9A47030538 -- C:\ATI\Win7_Vista\8_741\Packages\Drivers\SBDrv\SB6xx\RAID\W7\ahcix86s.sys [2009/10/26 19:41:10 | 000,189,496 | ---- | M] (Advanced Micro Devices, Inc) MD5=6C27F0A964EA98F457CAAB9A47030538 -- C:\ATI\Win7_Vista\8_782\Packages\Drivers\SBDrv\SB6xx\RAID\W7\ahcix86s.sys < MD5 for: ATAPI.SYS > [2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys [2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_f64b9c35a3a5be81\atapi.sys [2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys [2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys < MD5 for: CNGAUDIT.DLL > [2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll [2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll < MD5 for: IASTORV.SYS > [2010/05/12 11:05:35 | 000,332,168 | ---- | M] (Intel Corporation) MD5=2D2918606673C46769FB516A5ACE958E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16592_none_aed9db9de9265a3a\iaStorV.sys [2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys [2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\drivers\iaStorV.sys [2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0033117673c16921\iaStorV.sys [2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys [2011/03/11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys [2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_18cccb83b34e1453\iaStorV.sys [2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys [2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys [2011/03/11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys [2010/05/12 11:20:41 | 000,332,160 | ---- | M] (Intel Corporation) MD5=FE8186428F0AB44F0E500C7AA33E9B51 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20712_none_afb9f9af020317a3\iaStorV.sys < MD5 for: NETLOGON.DLL > [2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll [2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\System32\netlogon.dll [2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll < MD5 for: NVSTOR.SYS > [2010/05/12 11:05:45 | 000,143,752 | ---- | M] (NVIDIA Corporation) MD5=1D8B6A440DFF2BDEAA4EB209FCBA21BF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16592_none_39a34c4d205d0412\nvstor.sys [2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys [2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\drivers\nvstor.sys [2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_38e464dbe521cc7f\nvstor.sys [2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys [2011/03/11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys [2011/03/11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys [2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys [2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_5bde3fe2945bce9e\nvstor.sys [2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys [2010/05/12 11:20:52 | 000,143,752 | ---- | M] (NVIDIA Corporation) MD5=F3596C8A63D3871890B0D3A0DFFEF0D0 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20712_none_3a836a5e3939c17b\nvstor.sys < MD5 for: SCECLI.DLL > [2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\System32\scecli.dll [2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll [2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll < MD5 for: USER32.DLL > [2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\System32\user32.dll [2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll [2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll < MD5 for: USERINIT.EXE > [2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe [2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\System32\userinit.exe [2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe < MD5 for: WININIT.EXE > [2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe [2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe < MD5 for: WINLOGON.EXE > [2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Eigene Programme\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe [2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\System32\winlogon.exe [2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe [2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe [2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe [2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe < MD5 for: WS2IFSL.SYS > [2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys [2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys < %systemroot%\system32\drivers\*.sys /lockedfiles > < %systemroot%\System32\config\*.sav > < %systemroot%\*. /mp /s > < %systemroot%\system32\*.dll /lockedfiles > [2 C:\Windows\system32\*.tmp files -> C:\Windows\system32\*.tmp -> ] < End of report > Ist dies besser oder sollte ich es nochmal versuchen? Geändert von othergrunty (29.06.2012 um 14:57 Uhr) |
|
29.06.2012, 14:45
| #8 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Mor.exe abgewendet? Hast du wirklich alles vom Text abkopiert? Da gibt es den Button alles markieren bzw. alles kopieren Die letzte Zeile für den CustomScan lautet CREATERESTOREPOINT
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.06.2012, 15:01
| #9 |
| | Mor.exe abgewendet? Sorry. Ich habe einen Edit in meinen vorherigen Post gemacht nachdem ich einen zweiten lauf gemacht habe, wobei ich aufgepasst habe die letzte Zeile diesmal mit zu kopieren. Kannst du nachsehen ob das nun die richtigen Informationen sind? Geändert von othergrunty (29.06.2012 um 15:37 Uhr) |
|
29.06.2012, 22:28
| #10 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Mor.exe abgewendet? Ja so ist richtig!!  Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!) Code:
ATTFilter :OTL
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet. Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt. Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
29.06.2012, 23:54
| #11 |
| | Mor.exe abgewendet? Okay, habe ich erledigt. Kann ich mir sicher sein das ich nichts auf meinen Rechner habe? Ach ja, ... Schuldige die Skepsis aber was genau habe ich hier jetzt eigentlich gemacht und welche Auswirkungen hat es auf meine Einstellungen und System? Hier ist das Ergebnis, wie vorher habe ich meinen Name entfernt. Code:
ATTFilter All processes killed
========== OTL ==========
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
========== COMMANDS ==========
[EMPTYTEMP]
User: All Users
User: Name
->Temp folder emptied: 281464 bytes
->Temporary Internet Files folder emptied: 30359116 bytes
->FireFox cache emptied: 57096884 bytes
->Flash cache emptied: 82689 bytes
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56502 bytes
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
User: Public
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 619520 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 74822 bytes
RecycleBin emptied: 0 bytes
Total Files Cleaned = 84.00 mb
[EMPTYFLASH]
User: All Users
User: Name
->Flash cache emptied: 0 bytes
User: Default
->Flash cache emptied: 0 bytes
User: Default User
->Flash cache emptied: 0 bytes
User: Public
Total Flash Files Cleaned = 0.00 mb
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
OTL by OldTimer - Version 3.2.53.0 log created on 06302012_004619
Files\Folders moved on Reboot...
PendingFileRenameOperations files...
Registry entries deleted on Reboot...
Auf jeden fall vielen Dank schonmal. |
|
01.07.2012, 15:02
| #12 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Mor.exe abgewendet? Beim Fix ist das egal, nur bei der Logerstellung ist das wichtig Zitat:
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm! Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet, Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten. Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C nach, da speichert der TDSS-Killer seine Logs.Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten! 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.07.2012, 15:29
| #13 |
| | Mor.exe abgewendet? Ich weiß das man sich nie 100% sicher sein kann, wer weiß vielleicht laufe ich auch mit irgendeinen Retrovirus im körper herum. Ich könnte mir auch nicht sicher sein wenn ich meine Rechner platt gemacht hätte und neu installiert. Aber ich würde nun langsam gerne wissen was nun eigentlich das Ziel unserer Aktionen hier ist? Sorry, ich möchte nicht undankbar klingen. Ich bin sehr Dankbar für deine Zeit, Aufmerksamkeit und Expertise mit der du mir hilfst, aber wie viel müssen wir noch machen und wofür? Edit:Habe den Scan gemacht. Hier ist das Ergebnis: Code:
ATTFilter 16:37:03.0542 3424 TDSS rootkit removing tool 2.7.43.0 Jun 29 2012 17:54:22
16:37:03.0822 3424 ============================================================
16:37:03.0822 3424 Current date / time: 2012/07/01 16:37:03.0822
16:37:03.0822 3424 SystemInfo:
16:37:03.0822 3424
16:37:03.0822 3424 OS Version: 6.1.7600 ServicePack: 0.0
16:37:03.0822 3424 Product type: Workstation
16:37:03.0822 3424 ComputerName: Name
16:37:03.0822 3424 UserName: Name
16:37:03.0822 3424 Windows directory: C:\Windows
16:37:03.0822 3424 System windows directory: C:\Windows
16:37:03.0822 3424 Processor architecture: Intel x86
16:37:03.0822 3424 Number of processors: 3
16:37:03.0822 3424 Page size: 0x1000
16:37:03.0822 3424 Boot type: Normal boot
16:37:03.0822 3424 ============================================================
16:37:04.0805 3424 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
16:37:04.0821 3424 ============================================================
16:37:04.0821 3424 \Device\Harddisk0\DR0:
16:37:04.0821 3424 MBR partitions:
16:37:04.0821 3424 \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:37:04.0821 3424 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x708D3000
16:37:04.0821 3424 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x70906000, BlocksNum 0x3C00000
16:37:04.0821 3424 ============================================================
16:37:04.0852 3424 C: <-> \Device\Harddisk0\DR0\Partition1
16:37:04.0914 3424 D: <-> \Device\Harddisk0\DR0\Partition2
16:37:04.0914 3424 ============================================================
16:37:04.0914 3424 Initialize success
16:37:04.0914 3424 ============================================================
16:37:29.0328 4140 ============================================================
16:37:29.0328 4140 Scan started
16:37:29.0328 4140 Mode: Manual; SigCheck; TDLFS;
16:37:29.0328 4140 ============================================================
16:37:31.0856 4140 1394ohci (d01e0b1cef9ee82100c2bb07294880ef) C:\Windows\system32\DRIVERS\1394ohci.sys
16:37:32.0027 4140 1394ohci - ok
16:37:32.0058 4140 ACEDRV05 (0a1e97197609f92d2425b67da0bb0a7f) C:\Windows\system32\drivers\ACEDRV05.sys
16:37:32.0074 4140 ACEDRV05 ( UnsignedFile.Multi.Generic ) - warning
16:37:32.0074 4140 ACEDRV05 - detected UnsignedFile.Multi.Generic (1)
16:37:32.0121 4140 ACPI (f0e07d144c8685b8774bc32fc8da4df0) C:\Windows\system32\DRIVERS\ACPI.sys
16:37:32.0136 4140 ACPI - ok
16:37:32.0168 4140 AcpiPmi (98d81ca942d19f7d9153b095162ac013) C:\Windows\system32\DRIVERS\acpipmi.sys
16:37:32.0246 4140 AcpiPmi - ok
16:37:32.0324 4140 adp94xx (21e785ebd7dc90a06391141aac7892fb) C:\Windows\system32\DRIVERS\adp94xx.sys
16:37:32.0355 4140 adp94xx - ok
16:37:32.0417 4140 adpahci (0c676bc278d5b59ff5abd57bbe9123f2) C:\Windows\system32\DRIVERS\adpahci.sys
16:37:32.0448 4140 adpahci - ok
16:37:32.0495 4140 adpu320 (7c7b5ee4b7b822ec85321fe23a27db33) C:\Windows\system32\DRIVERS\adpu320.sys
16:37:32.0511 4140 adpu320 - ok
16:37:32.0542 4140 AeLookupSvc (8b5eefeec1e6d1a72a06c526628ad161) C:\Windows\System32\aelupsvc.dll
16:37:32.0667 4140 AeLookupSvc - ok
16:37:32.0729 4140 AFD (0db7a48388d54d154ebec120461a0fcd) C:\Windows\system32\drivers\afd.sys
16:37:32.0792 4140 AFD - ok
16:37:32.0823 4140 agp440 (507812c3054c21cef746b6ee3d04dd6e) C:\Windows\system32\DRIVERS\agp440.sys
16:37:32.0838 4140 agp440 - ok
16:37:32.0916 4140 aic78xx (8b30250d573a8f6b4bd23195160d8707) C:\Windows\system32\DRIVERS\djsvs.sys
16:37:32.0948 4140 aic78xx - ok
16:37:32.0979 4140 ALG (18a54e132947cd98fea9accc57f98f13) C:\Windows\System32\alg.exe
16:37:33.0057 4140 ALG - ok
16:37:33.0088 4140 aliide (0d40bcf52ea90fc7df2aeab6503dea44) C:\Windows\system32\DRIVERS\aliide.sys
16:37:33.0119 4140 aliide - ok
16:37:33.0150 4140 AMD External Events Utility (aa8c7a0a40d3b8992ea1845ef89fe2d4) C:\Windows\system32\atiesrxx.exe
16:37:33.0197 4140 AMD External Events Utility - ok
16:37:33.0228 4140 amdagp (3c6600a0696e90a463771c7422e23ab5) C:\Windows\system32\DRIVERS\amdagp.sys
16:37:33.0244 4140 amdagp - ok
16:37:33.0291 4140 amdide (cd5914170297126b6266860198d1d4f0) C:\Windows\system32\DRIVERS\amdide.sys
16:37:33.0306 4140 amdide - ok
16:37:33.0353 4140 AmdK8 (00dda200d71bac534bf56a9db5dfd666) C:\Windows\system32\DRIVERS\amdk8.sys
16:37:33.0431 4140 AmdK8 - ok
16:37:33.0977 4140 amdkmdag (5ab10c74c8ea15e98a6c771b7269615e) C:\Windows\system32\DRIVERS\atikmdag.sys
16:37:34.0164 4140 amdkmdag - ok
16:37:34.0305 4140 amdkmdap (e9890f7ec1ab4d09afeb09dd76334622) C:\Windows\system32\DRIVERS\atikmpag.sys
16:37:34.0336 4140 amdkmdap - ok
16:37:34.0383 4140 AmdPPM (3cbf30f5370fda40dd3e87df38ea53b6) C:\Windows\system32\DRIVERS\amdppm.sys
16:37:34.0414 4140 AmdPPM - ok
16:37:34.0445 4140 amdsata (19ce906b4cdc11fc4fef5745f33a63b6) C:\Windows\system32\drivers\amdsata.sys
16:37:34.0476 4140 amdsata - ok
16:37:34.0523 4140 amdsbs (ea43af0c423ff267355f74e7a53bdaba) C:\Windows\system32\DRIVERS\amdsbs.sys
16:37:34.0539 4140 amdsbs - ok
16:37:34.0554 4140 amdxata (869e67d66be326a5a9159fba8746fa70) C:\Windows\system32\drivers\amdxata.sys
16:37:34.0570 4140 amdxata - ok
16:37:34.0586 4140 amd_sata (437c824deac935dea9e9c488675efd09) C:\Windows\system32\DRIVERS\amd_sata.sys
16:37:34.0617 4140 amd_sata - ok
16:37:34.0632 4140 amd_xata (d919795612eabba7d5f5222377bebd7b) C:\Windows\system32\DRIVERS\amd_xata.sys
16:37:34.0648 4140 amd_xata - ok
16:37:34.0757 4140 AntiVirFirewallService (6acc11e9d2f01c88251123d26c1c5489) C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
16:37:34.0804 4140 AntiVirFirewallService - ok
16:37:34.0882 4140 AntiVirMailService (b7fa28aefa586fb5a04876c7b31d03e6) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
16:37:34.0913 4140 AntiVirMailService - ok
16:37:34.0976 4140 AntiVirSchedulerService (2e35310d600f4cc64624786a813a041e) C:\Program Files\Avira\AntiVir Desktop\sched.exe
16:37:35.0007 4140 AntiVirSchedulerService - ok
16:37:35.0069 4140 AntiVirService (984102b9e2f6513008ed4e0c5ac4151d) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
16:37:35.0085 4140 AntiVirService - ok
16:37:35.0163 4140 AntiVirWebService (9bc7247fd7379307bcff92cf8eb64b87) C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
16:37:35.0194 4140 AntiVirWebService - ok
16:37:35.0334 4140 AppID (feb834c02ce1e84b6a38f953ca067706) C:\Windows\system32\drivers\appid.sys
16:37:35.0412 4140 AppID - ok
16:37:35.0459 4140 AppIDSvc (62a9c86cb6085e20db4823e4e97826f5) C:\Windows\System32\appidsvc.dll
16:37:35.0553 4140 AppIDSvc - ok
16:37:35.0584 4140 Appinfo (7dead9e3f65dcb2794f2711003bbf650) C:\Windows\System32\appinfo.dll
16:37:35.0646 4140 Appinfo - ok
16:37:35.0709 4140 arc (2932004f49677bd84dbc72edb754ffb3) C:\Windows\system32\DRIVERS\arc.sys
16:37:35.0740 4140 arc - ok
16:37:35.0756 4140 arcsas (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\Windows\system32\DRIVERS\arcsas.sys
16:37:35.0771 4140 arcsas - ok
16:37:35.0802 4140 AsyncMac (add2ade1c2b285ab8378d2daaf991481) C:\Windows\system32\DRIVERS\asyncmac.sys
16:37:35.0927 4140 AsyncMac - ok
16:37:35.0958 4140 atapi (338c86357871c167a96ab976519bf59e) C:\Windows\system32\DRIVERS\atapi.sys
16:37:35.0974 4140 atapi - ok
16:37:36.0021 4140 AtiHDAudioService (c8b17ac82ad2ee9e0e58e3461008c5f7) C:\Windows\system32\drivers\AtihdW73.sys
16:37:36.0052 4140 AtiHDAudioService - ok
16:37:36.0099 4140 AtiHdmiService (8df873d0587596c1d35a9cececc61da1) C:\Windows\system32\drivers\AtiHdmi.sys
16:37:36.0130 4140 AtiHdmiService - ok
16:37:36.0146 4140 AtiPcie (4ffe74e33bd9170950116f0ca46eac89) C:\Windows\system32\DRIVERS\AtiPcie.sys
16:37:36.0161 4140 AtiPcie - ok
16:37:36.0255 4140 atksgt (f0d933b42cd0594048e4d5200ae9e417) C:\Windows\system32\DRIVERS\atksgt.sys
16:37:36.0286 4140 atksgt - ok
16:37:36.0333 4140 AudioEndpointBuilder (510c873bfa135aa829f4180352772734) C:\Windows\System32\Audiosrv.dll
16:37:36.0380 4140 AudioEndpointBuilder - ok
16:37:36.0395 4140 Audiosrv (510c873bfa135aa829f4180352772734) C:\Windows\System32\Audiosrv.dll
16:37:36.0411 4140 Audiosrv - ok
16:37:36.0473 4140 avfwim (e6263cdd0ef3b98cfa2a251a21d8be2e) C:\Windows\system32\DRIVERS\avfwim.sys
16:37:36.0504 4140 avfwim - ok
16:37:36.0551 4140 avfwot (48929a52c039738c3193581f7fc483a5) C:\Windows\system32\DRIVERS\avfwot.sys
16:37:36.0582 4140 avfwot - ok
16:37:36.0614 4140 avgntflt (d5541f0afb767e85fc412fc609d96a74) C:\Windows\system32\DRIVERS\avgntflt.sys
16:37:36.0629 4140 avgntflt - ok
16:37:36.0660 4140 avipbb (7d967a682d4694df7fa57d63a2db01fe) C:\Windows\system32\DRIVERS\avipbb.sys
16:37:36.0660 4140 avipbb - ok
16:37:36.0676 4140 avkmgr (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys
16:37:36.0692 4140 avkmgr - ok
16:37:36.0723 4140 AxInstSV (dd6a431b43e34b91a767d1ce33728175) C:\Windows\System32\AxInstSV.dll
16:37:36.0832 4140 AxInstSV - ok
16:37:36.0894 4140 b06bdrv (1a231abec60fd316ec54c66715543cec) C:\Windows\system32\DRIVERS\bxvbdx.sys
16:37:36.0988 4140 b06bdrv - ok
16:37:37.0066 4140 b57nd60x (bd8869eb9cde6bbe4508d869929869ee) C:\Windows\system32\DRIVERS\b57nd60x.sys
16:37:37.0097 4140 b57nd60x - ok
16:37:37.0128 4140 BDESVC (ee1e9c3bb8228ae423dd38db69128e71) C:\Windows\System32\bdesvc.dll
16:37:37.0222 4140 BDESVC - ok
16:37:37.0238 4140 Beep (505506526a9d467307b3c393dedaf858) C:\Windows\system32\drivers\Beep.sys
16:37:37.0300 4140 Beep - ok
16:37:37.0362 4140 BFE (85ac71c045ceb054ed48a7841aae0c11) C:\Windows\System32\bfe.dll
16:37:37.0409 4140 BFE - ok
16:37:37.0472 4140 BITS (53f476476f55a27f580661bde09c4ec4) C:\Windows\System32\qmgr.dll
16:37:37.0534 4140 BITS - ok
16:37:37.0581 4140 blbdrive (2287078ed48fcfc477b05b20cf38f36f) C:\Windows\system32\DRIVERS\blbdrive.sys
16:37:37.0612 4140 blbdrive - ok
16:37:37.0643 4140 bowser (9a5c671b7fbae4865149bb11f59b91b2) C:\Windows\system32\DRIVERS\bowser.sys
16:37:37.0706 4140 bowser - ok
16:37:37.0737 4140 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\DRIVERS\BrFiltLo.sys
16:37:37.0752 4140 BrFiltLo - ok
16:37:37.0768 4140 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\DRIVERS\BrFiltUp.sys
16:37:37.0799 4140 BrFiltUp - ok
16:37:37.0846 4140 Browser (598e1280e7ff3744f4b8329366cc5635) C:\Windows\System32\browser.dll
16:37:37.0908 4140 Browser - ok
16:37:37.0940 4140 Brserid (845b8ce732e67f3b4133164868c666ea) C:\Windows\System32\Drivers\Brserid.sys
16:37:38.0033 4140 Brserid - ok
16:37:38.0064 4140 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\System32\Drivers\BrSerWdm.sys
16:37:38.0096 4140 BrSerWdm - ok
16:37:38.0127 4140 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\System32\Drivers\BrUsbMdm.sys
16:37:38.0158 4140 BrUsbMdm - ok
16:37:38.0174 4140 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\System32\Drivers\BrUsbSer.sys
16:37:38.0189 4140 BrUsbSer - ok
16:37:38.0220 4140 BTHMODEM (ed3df7c56ce0084eb2034432fc56565a) C:\Windows\system32\DRIVERS\bthmodem.sys
16:37:38.0252 4140 BTHMODEM - ok
16:37:38.0283 4140 bthserv (1df19c96eef6c29d1c3e1a8678e07190) C:\Windows\system32\bthserv.dll
16:37:38.0330 4140 bthserv - ok
16:37:38.0361 4140 cdfs (77ea11b065e0a8ab902d78145ca51e10) C:\Windows\system32\DRIVERS\cdfs.sys
16:37:38.0392 4140 cdfs - ok
16:37:38.0423 4140 cdrom (ba6e70aa0e6091bc39de29477d866a77) C:\Windows\system32\DRIVERS\cdrom.sys
16:37:38.0439 4140 cdrom - ok
16:37:38.0470 4140 CertPropSvc (628a9e30ec5e18dd5de6be4dbdc12198) C:\Windows\System32\certprop.dll
16:37:38.0517 4140 CertPropSvc - ok
16:37:38.0532 4140 circlass (3fe3fe94a34df6fb06e6418d0f6a0060) C:\Windows\system32\DRIVERS\circlass.sys
16:37:38.0579 4140 circlass - ok
16:37:38.0610 4140 CLFS (635181e0e9bbf16871bf5380d71db02d) C:\Windows\system32\CLFS.sys
16:37:38.0626 4140 CLFS - ok
16:37:38.0720 4140 clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:37:38.0735 4140 clr_optimization_v2.0.50727_32 - ok
16:37:38.0813 4140 clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:37:38.0891 4140 clr_optimization_v4.0.30319_32 - ok
16:37:38.0922 4140 CmBatt (dea805815e587dad1dd2c502220b5616) C:\Windows\system32\DRIVERS\CmBatt.sys
16:37:38.0938 4140 CmBatt - ok
16:37:38.0954 4140 cmdide (c537b1db64d495b9b4717b4d6d9edbf2) C:\Windows\system32\DRIVERS\cmdide.sys
16:37:38.0969 4140 cmdide - ok
16:37:39.0016 4140 CNG (36c252e474b2ffa0f0fbbff20d92a640) C:\Windows\system32\Drivers\cng.sys
16:37:39.0078 4140 CNG - ok
16:37:39.0110 4140 Compbatt (a6023d3823c37043986713f118a89bee) C:\Windows\system32\DRIVERS\compbatt.sys
16:37:39.0125 4140 Compbatt - ok
16:37:39.0141 4140 CompositeBus (f1724ba27e97d627f808fb0ba77a28a6) C:\Windows\system32\DRIVERS\CompositeBus.sys
16:37:39.0172 4140 CompositeBus - ok
16:37:39.0188 4140 COMSysApp - ok
16:37:39.0219 4140 crcdisk (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\Windows\system32\DRIVERS\crcdisk.sys
16:37:39.0234 4140 crcdisk - ok
16:37:39.0281 4140 CryptSvc (520a108a2657f4bca7fced9ca7d885de) C:\Windows\system32\cryptsvc.dll
16:37:39.0359 4140 CryptSvc - ok
16:37:39.0406 4140 DcomLaunch (b82cd39e336973359d7c9bf911e8e84f) C:\Windows\system32\rpcss.dll
16:37:39.0453 4140 DcomLaunch - ok
16:37:39.0484 4140 defragsvc (8d6e10a2d9a5eed59562d9b82cf804e1) C:\Windows\System32\defragsvc.dll
16:37:39.0546 4140 defragsvc - ok
16:37:39.0578 4140 DfsC (83d1ecea8faae75604c0fa49ac7ad996) C:\Windows\system32\Drivers\dfsc.sys
16:37:39.0624 4140 DfsC - ok
16:37:39.0687 4140 Dhcp (c56495fbd770712367cad35e5de72da6) C:\Windows\system32\dhcpcore.dll
16:37:39.0765 4140 Dhcp - ok
16:37:39.0780 4140 discache (1a050b0274bfb3890703d490f330c0da) C:\Windows\system32\drivers\discache.sys
16:37:39.0858 4140 discache - ok
16:37:39.0905 4140 Disk (565003f326f99802e68ca78f2a68e9ff) C:\Windows\system32\DRIVERS\disk.sys
16:37:39.0936 4140 Disk - ok
16:37:39.0968 4140 Dnscache (b15be77a2bacf9c3177d27518afe26a9) C:\Windows\System32\dnsrslvr.dll
16:37:40.0030 4140 Dnscache - ok
16:37:40.0077 4140 dot3svc (4408c85c21eea48eb0ce486baeef0502) C:\Windows\System32\dot3svc.dll
16:37:40.0124 4140 dot3svc - ok
16:37:40.0155 4140 DPS (7fa81c6e11caa594adb52084da73a1e5) C:\Windows\system32\dps.dll
16:37:40.0186 4140 DPS - ok
16:37:40.0217 4140 drmkaud (b918e7c5f9bf77202f89e1a9539f2eb4) C:\Windows\system32\drivers\drmkaud.sys
16:37:40.0233 4140 drmkaud - ok
16:37:40.0280 4140 DXGKrnl (1679a4669326cb1a67cc95658d273234) C:\Windows\System32\drivers\dxgkrnl.sys
16:37:40.0311 4140 DXGKrnl - ok
16:37:40.0326 4140 EapHost (8600142fa91c1b96367d3300ad0f3f3a) C:\Windows\System32\eapsvc.dll
16:37:40.0358 4140 EapHost - ok
16:37:40.0826 4140 ebdrv (024e1b5cac09731e4d868e64dbfb4ab0) C:\Windows\system32\DRIVERS\evbdx.sys
16:37:40.0966 4140 ebdrv - ok
16:37:41.0060 4140 EFS (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\System32\lsass.exe
16:37:41.0122 4140 EFS - ok
16:37:41.0216 4140 ehRecvr (1697c39978cd69f6fbc15302edcece1f) C:\Windows\ehome\ehRecvr.exe
16:37:41.0294 4140 ehRecvr - ok
16:37:41.0309 4140 ehSched (d389bff34f80caede417bf9d1507996a) C:\Windows\ehome\ehsched.exe
16:37:41.0387 4140 ehSched - ok
16:37:41.0496 4140 elxstor (0ed67910c8c326796faa00b2bf6d9d3c) C:\Windows\system32\DRIVERS\elxstor.sys
16:37:41.0528 4140 elxstor - ok
16:37:41.0559 4140 ErrDev (8fc3208352dd3912c94367a206ab3f11) C:\Windows\system32\DRIVERS\errdev.sys
16:37:41.0574 4140 ErrDev - ok
16:37:41.0621 4140 EventSystem (f6916efc29d9953d5d0df06882ae8e16) C:\Windows\system32\es.dll
16:37:41.0668 4140 EventSystem - ok
16:37:41.0715 4140 exfat (2dc9108d74081149cc8b651d3a26207f) C:\Windows\system32\drivers\exfat.sys
16:37:41.0777 4140 exfat - ok
16:37:41.0808 4140 fastfat (7e0ab74553476622fb6ae36f73d97d35) C:\Windows\system32\drivers\fastfat.sys
16:37:41.0840 4140 fastfat - ok
16:37:41.0933 4140 Fax (f7ea23cc5e6bf2181f3f399d54f6efc1) C:\Windows\system32\fxssvc.exe
16:37:42.0011 4140 Fax - ok
16:37:42.0058 4140 fdc (e817a017f82df2a1f8cfdbda29388b29) C:\Windows\system32\DRIVERS\fdc.sys
16:37:42.0105 4140 fdc - ok
16:37:42.0136 4140 fdPHost (f3222c893bd2f5821a0179e5c71e88fb) C:\Windows\system32\fdPHost.dll
16:37:42.0198 4140 fdPHost - ok
16:37:42.0230 4140 FDResPub (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\Windows\system32\fdrespub.dll
16:37:42.0261 4140 FDResPub - ok
16:37:42.0292 4140 FileInfo (6cf00369c97f3cf563be99be983d13d8) C:\Windows\system32\drivers\fileinfo.sys
16:37:42.0292 4140 FileInfo - ok
16:37:42.0308 4140 Filetrace (42c51dc94c91da21cb9196eb64c45db9) C:\Windows\system32\drivers\filetrace.sys
16:37:42.0339 4140 Filetrace - ok
16:37:42.0370 4140 flpydisk (87907aa70cb3c56600f1c2fb8841579b) C:\Windows\system32\DRIVERS\flpydisk.sys
16:37:42.0386 4140 flpydisk - ok
16:37:42.0401 4140 FltMgr (7520ec808e0c35e0ee6f841294316653) C:\Windows\system32\drivers\fltmgr.sys
16:37:42.0417 4140 FltMgr - ok
16:37:42.0495 4140 FontCache (7fe4995528a7529a761875151ee3d512) C:\Windows\system32\FntCache.dll
16:37:42.0588 4140 FontCache - ok
16:37:42.0635 4140 FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
16:37:42.0698 4140 FontCache3.0.0.0 - ok
16:37:42.0729 4140 FsDepends (1a16b57943853e598cff37fe2b8cbf1d) C:\Windows\system32\drivers\FsDepends.sys
16:37:42.0760 4140 FsDepends - ok
16:37:42.0791 4140 Fs_Rec (500a9814fd9446a8126858a5a7f7d273) C:\Windows\system32\drivers\Fs_Rec.sys
16:37:42.0791 4140 Fs_Rec - ok
16:37:42.0838 4140 fvevol (dafbd9fe39197495aed6d51f3b85b5d2) C:\Windows\system32\DRIVERS\fvevol.sys
16:37:42.0869 4140 fvevol - ok
16:37:42.0885 4140 gagp30kx (65ee0c7a58b65e74ae05637418153938) C:\Windows\system32\DRIVERS\gagp30kx.sys
16:37:42.0900 4140 gagp30kx - ok
16:37:42.0963 4140 gpsvc (8ba3c04702bf8f927ab36ae8313ca4ee) C:\Windows\System32\gpsvc.dll
16:37:43.0010 4140 gpsvc - ok
16:37:43.0088 4140 gupdate (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
16:37:43.0103 4140 gupdate - ok
16:37:43.0134 4140 gupdatem (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
16:37:43.0166 4140 gupdatem - ok
16:37:43.0197 4140 hcw85cir (c44e3c2bab6837db337ddee7544736db) C:\Windows\system32\drivers\hcw85cir.sys
16:37:43.0275 4140 hcw85cir - ok
16:37:43.0322 4140 HdAudAddService (3530cad25deba7dc7de8bb51632cbc5f) C:\Windows\system32\drivers\HdAudio.sys
16:37:43.0384 4140 HdAudAddService - ok
16:37:43.0415 4140 HDAudBus (717a2207fd6f13ad3e664c7d5a43c7bf) C:\Windows\system32\DRIVERS\HDAudBus.sys
16:37:43.0446 4140 HDAudBus - ok
16:37:43.0478 4140 HidBatt (1d58a7f3e11a9731d0eaaaa8405acc36) C:\Windows\system32\DRIVERS\HidBatt.sys
16:37:43.0493 4140 HidBatt - ok
16:37:43.0524 4140 HidBth (89448f40e6df260c206a193a4683ba78) C:\Windows\system32\DRIVERS\hidbth.sys
16:37:43.0556 4140 HidBth - ok
16:37:43.0587 4140 HidIr (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\Windows\system32\DRIVERS\hidir.sys
16:37:43.0618 4140 HidIr - ok
16:37:43.0649 4140 hidserv (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\Windows\system32\hidserv.dll
16:37:43.0696 4140 hidserv - ok
16:37:43.0727 4140 HidUsb (25072fb35ac90b25f9e4e3bacf774102) C:\Windows\system32\DRIVERS\hidusb.sys
16:37:43.0758 4140 HidUsb - ok
16:37:43.0790 4140 hkmsvc (741c2a45ca8407e374aaba3e330b7872) C:\Windows\system32\kmsvc.dll
16:37:43.0852 4140 hkmsvc - ok
16:37:43.0883 4140 HomeGroupListener (a768ca158bb06782a2835b907f4873c3) C:\Windows\system32\ListSvc.dll
16:37:43.0977 4140 HomeGroupListener - ok
16:37:44.0024 4140 HomeGroupProvider (fb08dec5ef43d0c66d83b8e9694e7549) C:\Windows\system32\provsvc.dll
16:37:44.0055 4140 HomeGroupProvider - ok
16:37:44.0086 4140 HpSAMD (295fdc419039090eb8b49ffdbb374549) C:\Windows\system32\DRIVERS\HpSAMD.sys
16:37:44.0102 4140 HpSAMD - ok
16:37:44.0180 4140 HTTP (c531c7fd9e8b62021112787c4e2c5a5a) C:\Windows\system32\drivers\HTTP.sys
16:37:44.0258 4140 HTTP - ok
16:37:44.0273 4140 hwpolicy (8305f33cde89ad6c7a0763ed0b5a8d42) C:\Windows\system32\drivers\hwpolicy.sys
16:37:44.0289 4140 hwpolicy - ok
16:37:44.0336 4140 i8042prt (f151f0bdc47f4a28b1b20a0818ea36d6) C:\Windows\system32\DRIVERS\i8042prt.sys
16:37:44.0382 4140 i8042prt - ok
16:37:44.0445 4140 iaStorV (71f1a494fedf4b33c02c4a6a28d6d9e9) C:\Windows\system32\drivers\iaStorV.sys
16:37:44.0476 4140 iaStorV - ok
16:37:44.0585 4140 IDriverT (1cf03c69b49acb70c722df92755c0c8c) C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
16:37:44.0648 4140 IDriverT ( UnsignedFile.Multi.Generic ) - warning
16:37:44.0648 4140 IDriverT - detected UnsignedFile.Multi.Generic (1)
16:37:44.0788 4140 idsvc (5af815eb5bc9802e5a064e2ba62bfc0c) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
16:37:44.0897 4140 idsvc - ok
16:37:45.0022 4140 iirsp (4173ff5708f3236cf25195fecd742915) C:\Windows\system32\DRIVERS\iirsp.sys
16:37:45.0053 4140 iirsp - ok
16:37:45.0116 4140 IKEEXT (fac0ee6562b121b1399d6e855583f7a5) C:\Windows\System32\ikeext.dll
16:37:45.0162 4140 IKEEXT - ok
16:37:45.0459 4140 IntcAzAudAddService (4be85cf5831a41104c2dded55fbc3565) C:\Windows\system32\drivers\RTKVHDA.sys
16:37:45.0537 4140 IntcAzAudAddService - ok
16:37:45.0802 4140 intelide (a0f12f2c9ba6c72f3987ce780e77c130) C:\Windows\system32\DRIVERS\intelide.sys
16:37:45.0818 4140 intelide - ok
16:37:45.0880 4140 intelppm (3b514d27bfc4accb4037bc6685f766e0) C:\Windows\system32\DRIVERS\intelppm.sys
16:37:45.0911 4140 intelppm - ok
16:37:45.0958 4140 IPBusEnum (acb364b9075a45c0736e5c47be5cae19) C:\Windows\system32\ipbusenum.dll
16:37:46.0020 4140 IPBusEnum - ok
16:37:46.0052 4140 IpFilterDriver (709d1761d3b19a932ff0238ea6d50200) C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:37:46.0083 4140 IpFilterDriver - ok
16:37:46.0161 4140 iphlpsvc (477397b432a256a50ee7e4339eb9ea14) C:\Windows\System32\iphlpsvc.dll
16:37:46.0208 4140 iphlpsvc - ok
16:37:46.0239 4140 IPMIDRV (e4454b6c37d7ffd5649611f6496308a7) C:\Windows\system32\DRIVERS\IPMIDrv.sys
16:37:46.0254 4140 IPMIDRV - ok
16:37:46.0286 4140 IPNAT (a5fa468d67abcdaa36264e463a7bb0cd) C:\Windows\system32\drivers\ipnat.sys
16:37:46.0317 4140 IPNAT - ok
16:37:46.0364 4140 IRENUM (42996cff20a3084a56017b7902307e9f) C:\Windows\system32\drivers\irenum.sys
16:37:46.0410 4140 IRENUM - ok
16:37:46.0442 4140 isapnp (1f32bb6b38f62f7df1a7ab7292638a35) C:\Windows\system32\DRIVERS\isapnp.sys
16:37:46.0457 4140 isapnp - ok
16:37:46.0488 4140 iScsiPrt (ed46c223ae46c6866ab77cdc41c404b7) C:\Windows\system32\DRIVERS\msiscsi.sys
16:37:46.0504 4140 iScsiPrt - ok
16:37:46.0520 4140 kbdclass (adef52ca1aeae82b50df86b56413107e) C:\Windows\system32\DRIVERS\kbdclass.sys
16:37:46.0535 4140 kbdclass - ok
16:37:46.0566 4140 kbdhid (3d9f0ebf350edcfd6498057301455964) C:\Windows\system32\DRIVERS\kbdhid.sys
16:37:46.0598 4140 kbdhid - ok
16:37:46.0613 4140 KeyIso (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe
16:37:46.0629 4140 KeyIso - ok
16:37:46.0644 4140 KSecDD (0263364acb9c834ace52fb85c2c064ec) C:\Windows\system32\Drivers\ksecdd.sys
16:37:46.0644 4140 KSecDD - ok
16:37:46.0676 4140 KSecPkg (27391db553be2a4e2b0adeea2873b2af) C:\Windows\system32\Drivers\ksecpkg.sys
16:37:46.0707 4140 KSecPkg - ok
16:37:46.0769 4140 KtmRm (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\Windows\system32\msdtckrm.dll
16:37:46.0816 4140 KtmRm - ok
16:37:46.0847 4140 LanmanServer (8f6bf790d3168224c16f2af68a84438c) C:\Windows\system32\srvsvc.dll
16:37:46.0894 4140 LanmanServer - ok
16:37:46.0925 4140 LanmanWorkstation (b9891f885dcf1f0513a51cb58493cb1f) C:\Windows\System32\wkssvc.dll
16:37:46.0988 4140 LanmanWorkstation - ok
16:37:47.0050 4140 lirsgt (f8a7212d0864ef5e9185fb95e6623f4d) C:\Windows\system32\DRIVERS\lirsgt.sys
16:37:47.0081 4140 lirsgt - ok
16:37:47.0112 4140 lltdio (f7611ec07349979da9b0ae1f18ccc7a6) C:\Windows\system32\DRIVERS\lltdio.sys
16:37:47.0144 4140 lltdio - ok
16:37:47.0222 4140 lltdsvc (5700673e13a2117fa3b9020c852c01e2) C:\Windows\System32\lltdsvc.dll
16:37:47.0300 4140 lltdsvc - ok
16:37:47.0300 4140 lmhosts (55ca01ba19d0006c8f2639b6c045e08b) C:\Windows\System32\lmhsvc.dll
16:37:47.0346 4140 lmhosts - ok
16:37:47.0378 4140 LSI_FC (eb119a53ccf2acc000ac71b065b78fef) C:\Windows\system32\DRIVERS\lsi_fc.sys
16:37:47.0393 4140 LSI_FC - ok
16:37:47.0409 4140 LSI_SAS (8ade1c877256a22e49b75d1cc9161f9c) C:\Windows\system32\DRIVERS\lsi_sas.sys
16:37:47.0424 4140 LSI_SAS - ok
16:37:47.0456 4140 LSI_SAS2 (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\Windows\system32\DRIVERS\lsi_sas2.sys
16:37:47.0487 4140 LSI_SAS2 - ok
16:37:47.0518 4140 LSI_SCSI (0a036c7d7cab643a7f07135ac47e0524) C:\Windows\system32\DRIVERS\lsi_scsi.sys
16:37:47.0565 4140 LSI_SCSI - ok
16:37:47.0580 4140 luafv (6703e366cc18d3b6e534f5cf7df39cee) C:\Windows\system32\drivers\luafv.sys
16:37:47.0627 4140 luafv - ok
16:37:47.0674 4140 MBAMProtector (fb097bbc1a18f044bd17bd2fccf97865) C:\Windows\system32\drivers\mbam.sys
16:37:47.0690 4140 MBAMProtector - ok
16:37:47.0846 4140 MBAMService (ba400ed640bca1eae5c727ae17c10207) C:\Eigene Programme\Malwarebytes' Anti-Malware\mbamservice.exe
16:37:47.0892 4140 MBAMService - ok
16:37:47.0970 4140 Mcx2Svc (e2b0887816ed336685954e3d8fdaa51d) C:\Windows\system32\Mcx2Svc.dll
16:37:47.0986 4140 Mcx2Svc - ok
16:37:48.0064 4140 mdxgthkn - ok
16:37:48.0095 4140 megasas (0fff5b045293002ab38eb1fd1fc2fb74) C:\Windows\system32\DRIVERS\megasas.sys
16:37:48.0126 4140 megasas - ok
16:37:48.0158 4140 MegaSR (dcbab2920c75f390caf1d29f675d03d6) C:\Windows\system32\DRIVERS\MegaSR.sys
16:37:48.0173 4140 MegaSR - ok
16:37:48.0204 4140 MMCSS (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
16:37:48.0251 4140 MMCSS - ok
16:37:48.0267 4140 Modem (f001861e5700ee84e2d4e52c712f4964) C:\Windows\system32\drivers\modem.sys
16:37:48.0282 4140 Modem - ok
16:37:48.0314 4140 monitor (79d10964de86b292320e9dfe02282a23) C:\Windows\system32\DRIVERS\monitor.sys
16:37:48.0345 4140 monitor - ok
16:37:48.0360 4140 mouclass (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\Windows\system32\DRIVERS\mouclass.sys
16:37:48.0392 4140 mouclass - ok
16:37:48.0438 4140 mouhid (2c388d2cd01c9042596cf3c8f3c7b24d) C:\Windows\system32\DRIVERS\mouhid.sys
16:37:48.0485 4140 mouhid - ok
16:37:48.0501 4140 mountmgr (921c18727c5920d6c0300736646931c2) C:\Windows\system32\drivers\mountmgr.sys
16:37:48.0516 4140 mountmgr - ok
16:37:48.0548 4140 mpio (2af5997438c55fb79d33d015c30e1974) C:\Windows\system32\DRIVERS\mpio.sys
16:37:48.0563 4140 mpio - ok
16:37:48.0579 4140 mpsdrv (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\Windows\system32\drivers\mpsdrv.sys
16:37:48.0610 4140 mpsdrv - ok
16:37:48.0672 4140 MpsSvc (5cd996cecf45cbc3e8d109c86b82d69e) C:\Windows\system32\mpssvc.dll
16:37:48.0719 4140 MpsSvc - ok
16:37:48.0750 4140 MRxDAV (b1be47008d20e43da3adc37c24cdb89d) C:\Windows\system32\drivers\mrxdav.sys
16:37:48.0766 4140 MRxDAV - ok
16:37:48.0813 4140 mrxsmb (ca7570e42522e24324a12161db14ec02) C:\Windows\system32\DRIVERS\mrxsmb.sys
16:37:48.0875 4140 mrxsmb - ok
16:37:48.0922 4140 mrxsmb10 (f965c3ab2b2ae5c378f4562486e35051) C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:37:48.0984 4140 mrxsmb10 - ok
16:37:49.0016 4140 mrxsmb20 (25c38264a3c72594dd21d355d70d7a5d) C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:37:49.0047 4140 mrxsmb20 - ok
16:37:49.0078 4140 msahci (4326d168944123f38dd3b2d9c37a0b12) C:\Windows\system32\DRIVERS\msahci.sys
16:37:49.0078 4140 msahci - ok
16:37:49.0125 4140 msdsm (455029c7174a2dbb03dba8a0d8bddd9a) C:\Windows\system32\DRIVERS\msdsm.sys
16:37:49.0140 4140 msdsm - ok
16:37:49.0172 4140 MSDTC (e1bce74a3bd9902b72599c0192a07e27) C:\Windows\System32\msdtc.exe
16:37:49.0187 4140 MSDTC - ok
16:37:49.0218 4140 Msfs (daefb28e3af5a76abcc2c3078c07327f) C:\Windows\system32\drivers\Msfs.sys
16:37:49.0265 4140 Msfs - ok
16:37:49.0265 4140 mshidkmdf (3e1e5767043c5af9367f0056295e9f84) C:\Windows\System32\drivers\mshidkmdf.sys
16:37:49.0296 4140 mshidkmdf - ok
16:37:49.0328 4140 msisadrv (0a4e5757ae09fa9622e3158cc1aef114) C:\Windows\system32\DRIVERS\msisadrv.sys
16:37:49.0328 4140 msisadrv - ok
16:37:49.0359 4140 MSiSCSI (90f7d9e6b6f27e1a707d4a297f077828) C:\Windows\system32\iscsiexe.dll
16:37:49.0390 4140 MSiSCSI - ok
16:37:49.0390 4140 msiserver - ok
16:37:49.0437 4140 MSKSSRV (8c0860d6366aaffb6c5bb9df9448e631) C:\Windows\system32\drivers\MSKSSRV.sys
16:37:49.0484 4140 MSKSSRV - ok
16:37:49.0499 4140 MSPCLOCK (3ea8b949f963562cedbb549eac0c11ce) C:\Windows\system32\drivers\MSPCLOCK.sys
16:37:49.0530 4140 MSPCLOCK - ok
16:37:49.0562 4140 MSPQM (f456e973590d663b1073e9c463b40932) C:\Windows\system32\drivers\MSPQM.sys
16:37:49.0577 4140 MSPQM - ok
16:37:49.0608 4140 MsRPC (0e008fc4819d238c51d7c93e7b41e560) C:\Windows\system32\drivers\MsRPC.sys
16:37:49.0608 4140 MsRPC - ok
16:37:49.0640 4140 mssmbios (fc6b9ff600cc585ea38b12589bd4e246) C:\Windows\system32\DRIVERS\mssmbios.sys
16:37:49.0655 4140 mssmbios - ok
16:37:49.0686 4140 MSTEE (b42c6b921f61a6e55159b8be6cd54a36) C:\Windows\system32\drivers\MSTEE.sys
16:37:49.0702 4140 MSTEE - ok
16:37:49.0733 4140 MTConfig (33599130f44e1f34631cea241de8ac84) C:\Windows\system32\DRIVERS\MTConfig.sys
16:37:49.0764 4140 MTConfig - ok
16:37:49.0796 4140 Mup (159fad02f64e6381758c990f753bcc80) C:\Windows\system32\Drivers\mup.sys
16:37:49.0811 4140 Mup - ok
16:37:49.0842 4140 napagent (80284f1985c70c86f0b5f86da2dfe1df) C:\Windows\system32\qagentRT.dll
16:37:49.0889 4140 napagent - ok
16:37:49.0936 4140 NativeWifiP (26384429fcd85d83746f63e798ab1480) C:\Windows\system32\DRIVERS\nwifi.sys
16:37:49.0983 4140 NativeWifiP - ok
16:37:50.0076 4140 NDIS (23759d175a0a9baaf04d05047bc135a8) C:\Windows\system32\drivers\ndis.sys
16:37:50.0123 4140 NDIS - ok
16:37:50.0154 4140 NdisCap (0e1787aa6c9191d3d319e8bafe86f80c) C:\Windows\system32\DRIVERS\ndiscap.sys
16:37:50.0201 4140 NdisCap - ok
16:37:50.0232 4140 NdisTapi (e4a8aec125a2e43a9e32afeea7c9c888) C:\Windows\system32\DRIVERS\ndistapi.sys
16:37:50.0279 4140 NdisTapi - ok
16:37:50.0295 4140 Ndisuio (b30ae7f2b6d7e343b0df32e6c08fce75) C:\Windows\system32\DRIVERS\ndisuio.sys
16:37:50.0326 4140 Ndisuio - ok
16:37:50.0342 4140 NdisWan (267c415eadcbe53c9ca873dee39cf3a4) C:\Windows\system32\DRIVERS\ndiswan.sys
16:37:50.0373 4140 NdisWan - ok
16:37:50.0388 4140 NDProxy (af7e7c63dcef3f8772726f86039d6eb4) C:\Windows\system32\drivers\NDProxy.sys
16:37:50.0420 4140 NDProxy - ok
16:37:50.0435 4140 Net Driver HPZ12 (a081cb6fb9a12668f233eb5414be3a0e) C:\Windows\system32\HPZinw12.dll
16:37:50.0466 4140 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
16:37:50.0466 4140 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
16:37:50.0482 4140 NetBIOS (80b275b1ce3b0e79909db7b39af74d51) C:\Windows\system32\DRIVERS\netbios.sys
16:37:50.0560 4140 NetBIOS - ok
16:37:50.0591 4140 NetBT (dd52a733bf4ca5af84562a5e2f963b91) C:\Windows\system32\DRIVERS\netbt.sys
16:37:50.0622 4140 NetBT - ok
16:37:50.0654 4140 Netlogon (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe
16:37:50.0654 4140 Netlogon - ok
16:37:50.0700 4140 Netman (7cccfca7510684768da22092d1fa4db2) C:\Windows\System32\netman.dll
16:37:50.0747 4140 Netman - ok
16:37:50.0778 4140 netprofm (8c338238c16777a802d6a9211eb2ba50) C:\Windows\System32\netprofm.dll
16:37:50.0810 4140 netprofm - ok
16:37:50.0888 4140 NetTcpPortSharing (fe2aa5a684b0dd9b1fae57b7817c198b) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
16:37:50.0919 4140 NetTcpPortSharing - ok
16:37:50.0934 4140 nfrd960 (1d85c4b390b0ee09c7a46b91efb2c097) C:\Windows\system32\DRIVERS\nfrd960.sys
16:37:50.0950 4140 nfrd960 - ok
16:37:50.0981 4140 NlaSvc (2226496e34bd40734946a054b1cd657f) C:\Windows\System32\nlasvc.dll
16:37:51.0012 4140 NlaSvc - ok
16:37:51.0028 4140 Npfs (1db262a9f8c087e8153d89bef3d2235f) C:\Windows\system32\drivers\Npfs.sys
16:37:51.0075 4140 Npfs - ok
16:37:51.0090 4140 nsi (ba387e955e890c8a88306d9b8d06bf17) C:\Windows\system32\nsisvc.dll
16:37:51.0106 4140 nsi - ok
16:37:51.0137 4140 nsiproxy (e9a0a4d07e53d8fea2bb8387a3293c58) C:\Windows\system32\drivers\nsiproxy.sys
16:37:51.0168 4140 nsiproxy - ok
16:37:51.0262 4140 Ntfs (187002ce05693c306f43c873f821381f) C:\Windows\system32\drivers\Ntfs.sys
16:37:51.0293 4140 Ntfs - ok
16:37:51.0418 4140 Null (f9756a98d69098dca8945d62858a812c) C:\Windows\system32\drivers\Null.sys
16:37:51.0480 4140 Null - ok
16:37:52.0245 4140 nvlddmkm (b0881dda5a8160422561ffab7f0008b1) C:\Windows\system32\DRIVERS\nvlddmkm.sys
16:37:52.0479 4140 nvlddmkm - ok
16:37:52.0619 4140 nvraid (f1b0bed906f97e16f6d0c3629d2f21c6) C:\Windows\system32\drivers\nvraid.sys
16:37:52.0650 4140 nvraid - ok
16:37:52.0682 4140 nvstor (4520b63899e867f354ee012d34e11536) C:\Windows\system32\drivers\nvstor.sys
16:37:52.0728 4140 nvstor - ok
16:37:52.0760 4140 nv_agp (5a0983915f02bae73267cc2a041f717d) C:\Windows\system32\DRIVERS\nv_agp.sys
16:37:52.0775 4140 nv_agp - ok
16:37:52.0806 4140 ohci1394 (08a70a1f2cdde9bb49b885cb817a66eb) C:\Windows\system32\DRIVERS\ohci1394.sys
16:37:52.0853 4140 ohci1394 - ok
16:37:52.0900 4140 p2pimsvc (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
16:37:52.0994 4140 p2pimsvc - ok
16:37:53.0072 4140 p2psvc (59c3ddd501e39e006dac31bf55150d91) C:\Windows\system32\p2psvc.dll
16:37:53.0103 4140 p2psvc - ok
16:37:53.0134 4140 Parport (2ea877ed5dd9713c5ac74e8ea7348d14) C:\Windows\system32\DRIVERS\parport.sys
16:37:53.0150 4140 Parport - ok
16:37:53.0181 4140 partmgr (66d3415c159741ade7038a277efff99f) C:\Windows\system32\drivers\partmgr.sys
16:37:53.0196 4140 partmgr - ok
16:37:53.0212 4140 Parvdm (eb0a59f29c19b86479d36b35983daadc) C:\Windows\system32\DRIVERS\parvdm.sys
16:37:53.0243 4140 Parvdm - ok
16:37:53.0274 4140 PcaSvc (358ab7956d3160000726574083dfc8a6) C:\Windows\System32\pcasvc.dll
16:37:53.0290 4140 PcaSvc - ok
16:37:53.0321 4140 pci (c858cb77c577780ecc456a892e7e7d0f) C:\Windows\system32\DRIVERS\pci.sys
16:37:53.0352 4140 pci - ok
16:37:53.0368 4140 pciide (afe86f419014db4e5593f69ffe26ce0a) C:\Windows\system32\DRIVERS\pciide.sys
16:37:53.0368 4140 pciide - ok
16:37:53.0399 4140 pcmcia (f396431b31693e71e8a80687ef523506) C:\Windows\system32\DRIVERS\pcmcia.sys
16:37:53.0446 4140 pcmcia - ok
16:37:53.0462 4140 pcw (250f6b43d2b613172035c6747aeeb19f) C:\Windows\system32\drivers\pcw.sys
16:37:53.0477 4140 pcw - ok
16:37:53.0540 4140 PEAUTH (9e0104ba49f4e6973749a02bf41344ed) C:\Windows\system32\drivers\peauth.sys
16:37:53.0586 4140 PEAUTH - ok
16:37:53.0696 4140 pla (9c1bff7910c89a1d12e57343475840cb) C:\Windows\system32\pla.dll
16:37:53.0742 4140 pla - ok
16:37:53.0898 4140 PlugPlay (71def5ec79774c798342d0ea16e41780) C:\Windows\system32\umpnpmgr.dll
16:37:53.0961 4140 PlugPlay - ok
16:37:54.0008 4140 Pml Driver HPZ12 (65bc271f337637731d3c71455ae1f476) C:\Windows\system32\HPZipm12.dll
16:37:54.0039 4140 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
16:37:54.0039 4140 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
16:37:54.0117 4140 PnkBstrA (3a2e85f7d90d15460c337ce80c2e3b29) C:\Windows\system32\PnkBstrA.exe
16:37:54.0148 4140 PnkBstrA - ok
16:37:54.0179 4140 PNRPAutoReg (63ff8572611249931eb16bb8eed6afc8) C:\Windows\system32\pnrpauto.dll
16:37:54.0195 4140 PNRPAutoReg - ok
16:37:54.0226 4140 PNRPsvc (82a8521ddc60710c3d3d3e7325209bec) C:\Windows\system32\pnrpsvc.dll
16:37:54.0242 4140 PNRPsvc - ok
16:37:54.0304 4140 PolicyAgent (48e1b75c6dc0232fd92baae4bd344721) C:\Windows\System32\ipsecsvc.dll
16:37:54.0366 4140 PolicyAgent - ok
16:37:54.0398 4140 Power (dbff83f709a91049621c1d35dd45c92c) C:\Windows\system32\umpo.dll
16:37:54.0429 4140 Power - ok
16:37:54.0491 4140 PptpMiniport (631e3e205ad6d86f2aed6a4a8e69f2db) C:\Windows\system32\DRIVERS\raspptp.sys
16:37:54.0554 4140 PptpMiniport - ok
16:37:54.0585 4140 Processor (85b1e3a0c7585bc4aae6899ec6fcf011) C:\Windows\system32\DRIVERS\processr.sys
16:37:54.0616 4140 Processor - ok
16:37:54.0647 4140 ProfSvc (aea3bdbdba667aa6f678cb38907e4f5e) C:\Windows\system32\profsvc.dll
16:37:54.0741 4140 ProfSvc - ok
16:37:54.0756 4140 ProtectedStorage (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe
16:37:54.0788 4140 ProtectedStorage - ok
16:37:54.0834 4140 Psched (6270ccae2a86de6d146529fe55b3246a) C:\Windows\system32\DRIVERS\pacer.sys
16:37:54.0897 4140 Psched - ok
16:37:54.0944 4140 PSI_SVC_2 (a6a7ad767bf5141665f5c675f671b3e1) c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
16:37:54.0975 4140 PSI_SVC_2 - ok
16:37:55.0084 4140 ql2300 (ab95ecf1f6659a60ddc166d8315b0751) C:\Windows\system32\DRIVERS\ql2300.sys
16:37:55.0115 4140 ql2300 - ok
16:37:55.0256 4140 ql40xx (b4dd51dd25182244b86737dc51af2270) C:\Windows\system32\DRIVERS\ql40xx.sys
16:37:55.0287 4140 ql40xx - ok
16:37:55.0318 4140 QWAVE (31ac809e7707eb580b2bdb760390765a) C:\Windows\system32\qwave.dll
16:37:55.0349 4140 QWAVE - ok
16:37:55.0380 4140 QWAVEdrv (584078ca1b95ca72df2a27c336f9719d) C:\Windows\system32\drivers\qwavedrv.sys
16:37:55.0427 4140 QWAVEdrv - ok
16:37:55.0427 4140 RasAcd (30a81b53c766d0133bb86d234e5556ab) C:\Windows\system32\DRIVERS\rasacd.sys
16:37:55.0474 4140 RasAcd - ok
16:37:55.0505 4140 RasAgileVpn (57ec4aef73660166074d8f7f31c0d4fd) C:\Windows\system32\DRIVERS\AgileVpn.sys
16:37:55.0536 4140 RasAgileVpn - ok
16:37:55.0568 4140 RasAuto (a60f1839849c0c00739787fd5ec03f13) C:\Windows\System32\rasauto.dll
16:37:55.0599 4140 RasAuto - ok
16:37:55.0630 4140 Rasl2tp (d9f91eafec2815365cbe6d167e4e332a) C:\Windows\system32\DRIVERS\rasl2tp.sys
16:37:55.0692 4140 Rasl2tp - ok
16:37:55.0724 4140 RasMan (0ce66ec736b7fc526d78f7624c7d2a94) C:\Windows\System32\rasmans.dll
16:37:55.0770 4140 RasMan - ok
16:37:55.0802 4140 RasPppoe (0fe8b15916307a6ac12bfb6a63e45507) C:\Windows\system32\DRIVERS\raspppoe.sys
16:37:55.0817 4140 RasPppoe - ok
16:37:55.0864 4140 RasSstp (44101f495a83ea6401d886e7fd70096b) C:\Windows\system32\DRIVERS\rassstp.sys
16:37:55.0911 4140 RasSstp - ok
16:37:55.0942 4140 rdbss (835d7e81bf517a3b72384bdcc85e1ce6) C:\Windows\system32\DRIVERS\rdbss.sys
16:37:55.0973 4140 rdbss - ok
16:37:55.0989 4140 rdpbus (0d8f05481cb76e70e1da06ee9f0da9df) C:\Windows\system32\DRIVERS\rdpbus.sys
16:37:56.0004 4140 rdpbus - ok
16:37:56.0036 4140 RDPCDD (1e016846895b15a99f9a176a05029075) C:\Windows\system32\DRIVERS\RDPCDD.sys
16:37:56.0098 4140 RDPCDD - ok
16:37:56.0129 4140 RDPENCDD (5a53ca1598dd4156d44196d200c94b8a) C:\Windows\system32\drivers\rdpencdd.sys
16:37:56.0160 4140 RDPENCDD - ok
16:37:56.0176 4140 RDPREFMP (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\Windows\system32\drivers\rdprefmp.sys
16:37:56.0207 4140 RDPREFMP - ok
16:37:56.0254 4140 RDPWD (c5b8d47a4688de9d335204ea757c2240) C:\Windows\system32\drivers\RDPWD.sys
16:37:56.0332 4140 RDPWD - ok
16:37:56.0379 4140 rdyboost (4ea225bf1cf05e158853f30a99ca29a7) C:\Windows\system32\drivers\rdyboost.sys
16:37:56.0394 4140 rdyboost - ok
16:37:56.0410 4140 RemoteAccess (7b5e1419717fac363a31cc302895217a) C:\Windows\System32\mprdim.dll
16:37:56.0457 4140 RemoteAccess - ok
16:37:56.0488 4140 RemoteRegistry (cb9a8683f4ef2bf99e123d79950d7935) C:\Windows\system32\regsvc.dll
16:37:56.0519 4140 RemoteRegistry - ok
16:37:56.0535 4140 RpcEptMapper (78d072f35bc45d9e4e1b61895c152234) C:\Windows\System32\RpcEpMap.dll
16:37:56.0566 4140 RpcEptMapper - ok
16:37:56.0597 4140 RpcLocator (94d36c0e44677dd26981d2bfeef2a29d) C:\Windows\system32\locator.exe
16:37:56.0613 4140 RpcLocator - ok
16:37:56.0644 4140 RpcSs (b82cd39e336973359d7c9bf911e8e84f) C:\Windows\system32\rpcss.dll
16:37:56.0675 4140 RpcSs - ok
16:37:56.0706 4140 rspndr (032b0d36ad92b582d869879f5af5b928) C:\Windows\system32\DRIVERS\rspndr.sys
16:37:56.0722 4140 rspndr - ok
16:37:56.0769 4140 RTL8167 (0516998076ad894ae7e362c3110aa071) C:\Windows\system32\DRIVERS\Rt86win7.sys
16:37:56.0784 4140 RTL8167 - ok
16:37:56.0847 4140 RTL8192su (740fd26a79655a90e60b4e752bef0fe3) C:\Windows\system32\DRIVERS\RTL8192su.sys
16:37:56.0909 4140 RTL8192su - ok
16:37:56.0925 4140 SamSs (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe
16:37:56.0940 4140 SamSs - ok
16:37:56.0972 4140 sbp2port (34ee0c44b724e3e4ce2eff29126de5b5) C:\Windows\system32\DRIVERS\sbp2port.sys
16:37:56.0987 4140 sbp2port - ok
16:37:57.0018 4140 SCardSvr (8fc518ffe9519c2631d37515a68009c4) C:\Windows\System32\SCardSvr.dll
16:37:57.0050 4140 SCardSvr - ok
16:37:57.0065 4140 scfilter (a95c54b2ac3cc9c73fcdf9e51a1d6b51) C:\Windows\system32\DRIVERS\scfilter.sys
16:37:57.0096 4140 scfilter - ok
16:37:57.0159 4140 Schedule (df1e5c82e4d09cf8105cc644980c4803) C:\Windows\system32\schedsvc.dll
16:37:57.0206 4140 Schedule - ok
16:37:57.0221 4140 SCPolicySvc (628a9e30ec5e18dd5de6be4dbdc12198) C:\Windows\System32\certprop.dll
16:37:57.0237 4140 SCPolicySvc - ok
16:37:57.0268 4140 SDRSVC (5fd90abdbfaee85986802622cbb03446) C:\Windows\System32\SDRSVC.dll
16:37:57.0330 4140 SDRSVC - ok
16:37:57.0362 4140 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
16:37:57.0408 4140 secdrv - ok
16:37:57.0440 4140 seclogon (a59b3a4442c52060cc7a85293aa3546f) C:\Windows\system32\seclogon.dll
16:37:57.0471 4140 seclogon - ok
16:37:57.0533 4140 SENS (dcb7fcdcc97f87360f75d77425b81737) C:\Windows\System32\sens.dll
16:37:57.0596 4140 SENS - ok
16:37:57.0611 4140 SensrSvc (50087fe1ee447009c9cc2997b90de53f) C:\Windows\system32\sensrsvc.dll
16:37:57.0689 4140 SensrSvc - ok
16:37:57.0720 4140 Serenum (9ad8b8b515e3df6acd4212ef465de2d1) C:\Windows\system32\DRIVERS\serenum.sys
16:37:57.0767 4140 Serenum - ok
16:37:57.0798 4140 Serial (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\Windows\system32\DRIVERS\serial.sys
16:37:57.0845 4140 Serial - ok
16:37:57.0876 4140 sermouse (79bffb520327ff916a582dfea17aa813) C:\Windows\system32\DRIVERS\sermouse.sys
16:37:57.0892 4140 sermouse - ok
16:37:57.0923 4140 SessionEnv (8f55ce568c543d5adf45c409d16718fc) C:\Windows\system32\sessenv.dll
16:37:57.0970 4140 SessionEnv - ok
16:37:57.0986 4140 sffdisk (9f976e1eb233df46fce808d9dea3eb9c) C:\Windows\system32\DRIVERS\sffdisk.sys
16:37:58.0017 4140 sffdisk - ok
16:37:58.0048 4140 sffp_mmc (932a68ee27833cfd57c1639d375f2731) C:\Windows\system32\DRIVERS\sffp_mmc.sys
16:37:58.0079 4140 sffp_mmc - ok
16:37:58.0110 4140 sffp_sd (a0708bbd07d245c06ff9de549ca47185) C:\Windows\system32\DRIVERS\sffp_sd.sys
16:37:58.0142 4140 sffp_sd - ok
16:37:58.0188 4140 sfloppy (db96666cc8312ebc45032f30b007a547) C:\Windows\system32\DRIVERS\sfloppy.sys
16:37:58.0220 4140 sfloppy - ok
16:37:58.0282 4140 SharedAccess (d1a079a0de2ea524513b6930c24527a2) C:\Windows\System32\ipnathlp.dll
16:37:58.0329 4140 SharedAccess - ok
16:37:58.0376 4140 ShellHWDetection (cd2e48fa5b29ee2b3b5858056d246ef2) C:\Windows\System32\shsvcs.dll
16:37:58.0422 4140 ShellHWDetection - ok
16:37:58.0454 4140 sisagp (2565cac0dc9fe0371bdce60832582b2e) C:\Windows\system32\DRIVERS\sisagp.sys
16:37:58.0469 4140 sisagp - ok
16:37:58.0500 4140 SiSRaid2 (a9f0486851becb6dda1d89d381e71055) C:\Windows\system32\DRIVERS\SiSRaid2.sys
16:37:58.0516 4140 SiSRaid2 - ok
16:37:58.0547 4140 SiSRaid4 (3727097b55738e2f554972c3be5bc1aa) C:\Windows\system32\DRIVERS\sisraid4.sys
16:37:58.0563 4140 SiSRaid4 - ok
16:37:58.0610 4140 Smb (3e21c083b8a01cb70ba1f09303010fce) C:\Windows\system32\DRIVERS\smb.sys
16:37:58.0688 4140 Smb - ok
16:37:58.0719 4140 SNMPTRAP (6a984831644eca1a33ffeae4126f4f37) C:\Windows\System32\snmptrap.exe
16:37:58.0734 4140 SNMPTRAP - ok
16:37:58.0766 4140 spldr (95cf1ae7527fb70f7816563cbc09d942) C:\Windows\system32\drivers\spldr.sys
16:37:58.0781 4140 spldr - ok
16:37:58.0828 4140 Spooler (d1bb750eb51694de183e08b9c33be5b2) C:\Windows\System32\spoolsv.exe
16:37:58.0875 4140 Spooler - ok
16:37:59.0171 4140 sppsvc (4c287f9069fedbd791178876ee9de536) C:\Windows\system32\sppsvc.exe
16:37:59.0296 4140 sppsvc - ok
16:37:59.0405 4140 sppuinotify (d8e3e19eebdab49dd4a8d3062ead4ec7) C:\Windows\system32\sppuinotify.dll
16:37:59.0468 4140 sppuinotify - ok
16:37:59.0530 4140 srv (c4a027b8c0bd3fc0699f41fa5e9e0c87) C:\Windows\system32\DRIVERS\srv.sys
16:37:59.0608 4140 srv - ok
16:37:59.0639 4140 srv2 (414bb592cad8a79649d01f9d94318fb3) C:\Windows\system32\DRIVERS\srv2.sys
16:37:59.0686 4140 srv2 - ok
16:37:59.0717 4140 srvnet (ff207d67700aa18242aaf985d3e7d8f4) C:\Windows\system32\DRIVERS\srvnet.sys
16:37:59.0733 4140 srvnet - ok
16:37:59.0764 4140 SSDPSRV (d887c9fd02ac9fa880f6e5027a43e118) C:\Windows\System32\ssdpsrv.dll
16:37:59.0811 4140 SSDPSRV - ok
16:37:59.0826 4140 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
16:37:59.0842 4140 ssmdrv - ok
16:37:59.0858 4140 SstpSvc (d318f23be45d5e3a107469eb64815b50) C:\Windows\system32\sstpsvc.dll
16:37:59.0889 4140 SstpSvc - ok
16:37:59.0967 4140 Steam Client Service - ok
16:37:59.0998 4140 stexstor (db32d325c192b801df274bfd12a7e72b) C:\Windows\system32\DRIVERS\stexstor.sys
16:38:00.0014 4140 stexstor - ok
16:38:00.0076 4140 StiSvc (a22825e7bb7018e8af3e229a5af17221) C:\Windows\System32\wiaservc.dll
16:38:00.0154 4140 StiSvc - ok
16:38:00.0170 4140 swenum (e58c78a848add9610a4db6d214af5224) C:\Windows\system32\DRIVERS\swenum.sys
16:38:00.0185 4140 swenum - ok
16:38:00.0232 4140 swprv (a28bd92df340e57b024ba433165d34d7) C:\Windows\System32\swprv.dll
16:38:00.0279 4140 swprv - ok
16:38:00.0372 4140 SysMain (04105c8da62353589c29bdaeb8d88bd8) C:\Windows\system32\sysmain.dll
16:38:00.0404 4140 SysMain - ok
16:38:00.0435 4140 TabletInputService (fcfb6c552fbc0da299799cbd50ad9fd4) C:\Windows\System32\TabSvc.dll
16:38:00.0466 4140 TabletInputService - ok
16:38:00.0497 4140 TapiSrv (2f46b0c70a4adc8c90cf825da3b4feaf) C:\Windows\System32\tapisrv.dll
16:38:00.0513 4140 TapiSrv - ok
16:38:00.0544 4140 TBS (b799d9fdb26111737f58288d8dc172d9) C:\Windows\System32\tbssvc.dll
16:38:00.0591 4140 TBS - ok
16:38:00.0762 4140 Tcpip (55e9965552741f3850cb22cbba9671ed) C:\Windows\system32\drivers\tcpip.sys
16:38:00.0809 4140 Tcpip - ok
16:38:01.0059 4140 TCPIP6 (55e9965552741f3850cb22cbba9671ed) C:\Windows\system32\DRIVERS\tcpip.sys
16:38:01.0090 4140 TCPIP6 - ok
16:38:01.0199 4140 tcpipreg (e64444523add154f86567c469bc0b17f) C:\Windows\system32\drivers\tcpipreg.sys
16:38:01.0277 4140 tcpipreg - ok
16:38:01.0308 4140 TDPIPE (1875c1490d99e70e449e3afae9fcbadf) C:\Windows\system32\drivers\tdpipe.sys
16:38:01.0371 4140 TDPIPE - ok
16:38:01.0418 4140 TDTCP (7156308896d34ea75a582f9a09e50c17) C:\Windows\system32\drivers\tdtcp.sys
16:38:01.0449 4140 TDTCP - ok
16:38:01.0464 4140 tdx (cb39e896a2a83702d1737bfd402b3542) C:\Windows\system32\DRIVERS\tdx.sys
16:38:01.0496 4140 tdx - ok
16:38:01.0527 4140 TermDD (c36f41ee20e6999dbf4b0425963268a5) C:\Windows\system32\DRIVERS\termdd.sys
16:38:01.0527 4140 TermDD - ok
16:38:01.0605 4140 TermService (a01e50a04d7b1960b33e92b9080e6a94) C:\Windows\System32\termsrv.dll
16:38:01.0667 4140 TermService - ok
16:38:01.0683 4140 Themes (42fb6afd6b79d9fe07381609172e7ca4) C:\Windows\system32\themeservice.dll
16:38:01.0698 4140 Themes - ok
16:38:01.0730 4140 THREADORDER (146b6f43a673379a3c670e86d89be5ea) C:\Windows\system32\mmcss.dll
16:38:01.0761 4140 THREADORDER - ok
16:38:01.0776 4140 TrkWks (4792c0378db99a9bc2ae2de6cfff0c3a) C:\Windows\System32\trkwks.dll
16:38:01.0839 4140 TrkWks - ok
16:38:01.0901 4140 TrustedInstaller (41a4c781d2286208d397d72099304133) C:\Windows\servicing\TrustedInstaller.exe
16:38:01.0948 4140 TrustedInstaller - ok
16:38:01.0979 4140 tssecsrv (98ae6fa07d12cb4ec5cf4a9bfa5f4242) C:\Windows\system32\DRIVERS\tssecsrv.sys
16:38:02.0057 4140 tssecsrv - ok
16:38:02.0104 4140 tunnel (3e461d890a97f9d4c168f5fda36e1d00) C:\Windows\system32\DRIVERS\tunnel.sys
16:38:02.0166 4140 tunnel - ok
16:38:02.0198 4140 uagp35 (750fbcb269f4d7dd2e420c56b795db6d) C:\Windows\system32\DRIVERS\uagp35.sys
16:38:02.0213 4140 uagp35 - ok
16:38:02.0244 4140 udfs (09cc3e16f8e5ee7168e01cf8fcbe061a) C:\Windows\system32\DRIVERS\udfs.sys
16:38:02.0322 4140 udfs - ok
16:38:02.0354 4140 UI0Detect (8344fd4fce927880aa1aa7681d4927e5) C:\Windows\system32\UI0Detect.exe
16:38:02.0385 4140 UI0Detect - ok
16:38:02.0416 4140 uliagpkx (44e8048ace47befbfdc2e9be4cbc8880) C:\Windows\system32\DRIVERS\uliagpkx.sys
16:38:02.0416 4140 uliagpkx - ok
16:38:02.0447 4140 umbus (049b3a50b3d646baeeee9eec9b0668dc) C:\Windows\system32\DRIVERS\umbus.sys
16:38:02.0463 4140 umbus - ok
16:38:02.0494 4140 UmPass (7550ad0c6998ba1cb4843e920ee0feac) C:\Windows\system32\DRIVERS\umpass.sys
16:38:02.0525 4140 UmPass - ok
16:38:02.0619 4140 upnphost (833fbb672460efce8011d262175fad33) C:\Windows\System32\upnphost.dll
16:38:02.0666 4140 upnphost - ok
16:38:02.0697 4140 usbccgp (8455c4ed038efd09e99327f9d2d48ffa) C:\Windows\system32\drivers\usbccgp.sys
16:38:02.0759 4140 usbccgp - ok
16:38:03.0180 4140 usbcir (04ec7cec62ec3b6d9354eee93327fc82) C:\Windows\system32\DRIVERS\usbcir.sys
16:38:03.0227 4140 usbcir - ok
16:38:03.0258 4140 usbehci (e4c436d914768ce965d5e659ba7eebd8) C:\Windows\system32\DRIVERS\usbehci.sys
16:38:03.0321 4140 usbehci - ok
16:38:03.0352 4140 usbfilter (fb0e8b624d1f7e214edb3d6e56b4ec88) C:\Windows\system32\DRIVERS\usbfilter.sys
16:38:03.0383 4140 usbfilter - ok
16:38:03.0414 4140 usbhub (bdcd7156ec37448f08633fd899823620) C:\Windows\system32\DRIVERS\usbhub.sys
16:38:03.0477 4140 usbhub - ok
16:38:03.0492 4140 usbohci (eb2d819a639015253c871cda09d91d58) C:\Windows\system32\DRIVERS\usbohci.sys
16:38:03.0524 4140 usbohci - ok
16:38:03.0555 4140 usbprint (797d862fe0875e75c7cc4c1ad7b30252) C:\Windows\system32\DRIVERS\usbprint.sys
16:38:03.0586 4140 usbprint - ok
16:38:03.0617 4140 USBSTOR (694c991cd0b8138888f086da6009adbc) C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:38:03.0695 4140 USBSTOR - ok
16:38:03.0711 4140 usbuhci (22480bf4e5a09192e5e30ba4dde79fa4) C:\Windows\system32\drivers\usbuhci.sys
16:38:03.0742 4140 usbuhci - ok
16:38:03.0773 4140 UxSms (081e6e1c91aec36758902a9f727cd23c) C:\Windows\System32\uxsms.dll
16:38:03.0804 4140 UxSms - ok
16:38:03.0820 4140 VaultSvc (c2243ff9e9aad0c30e8b1a0914da15b6) C:\Windows\system32\lsass.exe
16:38:03.0820 4140 VaultSvc - ok
16:38:03.0851 4140 vdrvroot (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\Windows\system32\DRIVERS\vdrvroot.sys
16:38:03.0867 4140 vdrvroot - ok
16:38:03.0914 4140 vds (8c4e7c49d3641bc9e299e466a7f8867d) C:\Windows\System32\vds.exe
16:38:03.0945 4140 vds - ok
16:38:03.0992 4140 vga (17c408214ea61696cec9c66e388b14f3) C:\Windows\system32\DRIVERS\vgapnp.sys
16:38:04.0023 4140 vga - ok
16:38:04.0054 4140 VgaSave (8e38096ad5c8570a6f1570a61e251561) C:\Windows\System32\drivers\vga.sys
16:38:04.0085 4140 VgaSave - ok
16:38:04.0116 4140 vhdmp (3be6e1f3a4f1afec8cee0d7883f93583) C:\Windows\system32\DRIVERS\vhdmp.sys
16:38:04.0132 4140 vhdmp - ok
16:38:04.0163 4140 viaagp (c829317a37b4bea8f39735d4b076e923) C:\Windows\system32\DRIVERS\viaagp.sys
16:38:04.0163 4140 viaagp - ok
16:38:04.0194 4140 ViaC7 (e02f079a6aa107f06b16549c6e5c7b74) C:\Windows\system32\DRIVERS\viac7.sys
16:38:04.0194 4140 ViaC7 - ok
16:38:04.0226 4140 viaide (e43574f6a56a0ee11809b48c09e4fd3c) C:\Windows\system32\DRIVERS\viaide.sys
16:38:04.0241 4140 viaide - ok
16:38:04.0257 4140 volmgr (384e5a2aa49934295171e499f86ba6f3) C:\Windows\system32\DRIVERS\volmgr.sys
16:38:04.0257 4140 volmgr - ok
16:38:04.0304 4140 volmgrx (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\Windows\system32\drivers\volmgrx.sys
16:38:04.0335 4140 volmgrx - ok
16:38:04.0366 4140 volsnap (58df9d2481a56edde167e51b334d44fd) C:\Windows\system32\DRIVERS\volsnap.sys
16:38:04.0397 4140 volsnap - ok
16:38:04.0428 4140 vsmraid (9dfa0cc2f8855a04816729651175b631) C:\Windows\system32\DRIVERS\vsmraid.sys
16:38:04.0460 4140 vsmraid - ok
16:38:04.0569 4140 VSS (7ea2bcd94d9cfaf4c556f5cc94532a6c) C:\Windows\system32\vssvc.exe
16:38:04.0631 4140 VSS - ok
16:38:04.0662 4140 vwifibus (90567b1e658001e79d7c8bbd3dde5aa6) C:\Windows\System32\drivers\vwifibus.sys
16:38:04.0678 4140 vwifibus - ok
16:38:04.0694 4140 vwififlt (7090d3436eeb4e7da3373090a23448f7) C:\Windows\system32\DRIVERS\vwififlt.sys
16:38:04.0709 4140 vwififlt - ok
16:38:04.0756 4140 W32Time (55187fd710e27d5095d10a472c8baf1c) C:\Windows\system32\w32time.dll
16:38:04.0787 4140 W32Time - ok
16:38:04.0803 4140 WacomPen (de3721e89c653aa281428c8a69745d90) C:\Windows\system32\DRIVERS\wacompen.sys
16:38:04.0818 4140 WacomPen - ok
16:38:04.0850 4140 WANARP (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
16:38:04.0896 4140 WANARP - ok
16:38:04.0896 4140 Wanarpv6 (692a712062146e96d28ba0b7d75de31b) C:\Windows\system32\DRIVERS\wanarp.sys
16:38:04.0912 4140 Wanarpv6 - ok
16:38:05.0052 4140 WatAdminSvc (353a04c273ec58475d8633e75ccd5604) C:\Windows\system32\Wat\WatAdminSvc.exe
16:38:05.0099 4140 WatAdminSvc - ok
16:38:05.0318 4140 wbengine (7790b77fe1e5ee47dcc66247095bb4c9) C:\Windows\system32\wbengine.exe
16:38:05.0458 4140 wbengine - ok
16:38:05.0489 4140 WbioSrvc (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\Windows\System32\wbiosrvc.dll
16:38:05.0520 4140 WbioSrvc - ok
16:38:05.0552 4140 wcncsvc (6d9b75275c3e3a5f51aef81affadb2b6) C:\Windows\System32\wcncsvc.dll
16:38:05.0598 4140 wcncsvc - ok
16:38:05.0630 4140 WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\Windows\System32\WcsPlugInService.dll
16:38:05.0708 4140 WcsPlugInService - ok
16:38:05.0754 4140 Wd (1112a9badacb47b7c0bb0392e3158dff) C:\Windows\system32\DRIVERS\wd.sys
16:38:05.0786 4140 Wd - ok
16:38:05.0848 4140 Wdf01000 (9950e3d0f08141c7e89e64456ae7dc73) C:\Windows\system32\drivers\Wdf01000.sys
16:38:05.0879 4140 Wdf01000 - ok
16:38:05.0895 4140 WdiServiceHost (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
16:38:05.0926 4140 WdiServiceHost - ok
16:38:05.0926 4140 WdiSystemHost (46ef9dc96265fd0b423db72e7c38c2a5) C:\Windows\system32\wdi.dll
16:38:05.0942 4140 WdiSystemHost - ok
16:38:05.0973 4140 WebClient (bb5ec38f8d4600119b4720bc5d4211f1) C:\Windows\System32\webclnt.dll
16:38:06.0035 4140 WebClient - ok
16:38:06.0066 4140 Wecsvc (760f0afe937a77cff27153206534f275) C:\Windows\system32\wecsvc.dll
16:38:06.0113 4140 Wecsvc - ok
16:38:06.0129 4140 wercplsupport (ac804569bb2364fb6017370258a4091b) C:\Windows\System32\wercplsupport.dll
16:38:06.0160 4140 wercplsupport - ok
16:38:06.0191 4140 WerSvc (08e420d873e4fd85241ee2421b02c4a4) C:\Windows\System32\WerSvc.dll
16:38:06.0207 4140 WerSvc - ok
16:38:06.0238 4140 WfpLwf (8b9a943f3b53861f2bfaf6c186168f79) C:\Windows\system32\DRIVERS\wfplwf.sys
16:38:06.0285 4140 WfpLwf - ok
16:38:06.0316 4140 WIMMount (5cf95b35e59e2a38023836fff31be64c) C:\Windows\system32\drivers\wimmount.sys
16:38:06.0332 4140 WIMMount - ok
16:38:06.0441 4140 WinDefend (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
16:38:06.0488 4140 WinDefend - ok
16:38:06.0488 4140 WinHttpAutoProxySvc - ok
16:38:06.0550 4140 Winmgmt (f62e510b6ad4c21eb9fe8668ed251826) C:\Windows\system32\wbem\WMIsvc.dll
16:38:06.0612 4140 Winmgmt - ok
16:38:06.0706 4140 WinRM (c4f5d3901d1b41d602ddc196e0b95b51) C:\Windows\system32\WsmSvc.dll
16:38:06.0737 4140 WinRM - ok
16:38:06.0800 4140 Wlansvc (16935c98ff639d185086a3529b1f2067) C:\Windows\System32\wlansvc.dll
16:38:06.0831 4140 Wlansvc - ok
16:38:06.0909 4140 wlcrasvc (6067acef367e79914af628fa1e9b5330) C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
16:38:06.0940 4140 wlcrasvc - ok
16:38:07.0143 4140 wlidsvc (0a70f4022ec2e14c159efc4f69aa2477) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
16:38:07.0190 4140 wlidsvc - ok
16:38:07.0315 4140 WmiAcpi (0217679b8fca58714c3bf2726d2ca84e) C:\Windows\system32\DRIVERS\wmiacpi.sys
16:38:07.0361 4140 WmiAcpi - ok
16:38:07.0424 4140 wmiApSrv (6eb6b66517b048d87dc1856ddf1f4c3f) C:\Windows\system32\wbem\WmiApSrv.exe
16:38:07.0471 4140 wmiApSrv - ok
16:38:07.0627 4140 WMPNetworkSvc (77fbd400984cf72ba0fc4b3489d65f74) C:\Program Files\Windows Media Player\wmpnetwk.exe
16:38:07.0736 4140 WMPNetworkSvc - ok
16:38:07.0861 4140 WPCSvc (a2f0ec770a92f2b3f9de6d518e11409c) C:\Windows\System32\wpcsvc.dll
16:38:07.0939 4140 WPCSvc - ok
16:38:07.0970 4140 WPDBusEnum (b7f658a2ebc07129538ad9ab35212637) C:\Windows\system32\wpdbusenum.dll
16:38:08.0048 4140 WPDBusEnum - ok
16:38:08.0095 4140 ws2ifsl (6db3276587b853bf886b69528fdb048c) C:\Windows\system32\drivers\ws2ifsl.sys
16:38:08.0157 4140 ws2ifsl - ok
16:38:08.0173 4140 wscsvc (a661a76333057b383a06e65f0073222f) C:\Windows\System32\wscsvc.dll
16:38:08.0204 4140 wscsvc - ok
16:38:08.0204 4140 WSearch - ok
16:38:08.0407 4140 wuauserv (fc3ec24fce372c89423e015a2ac1a31e) C:\Windows\system32\wuaueng.dll
16:38:08.0453 4140 wuauserv - ok
16:38:08.0578 4140 WudfPf (6f9b6c0c93232cff47d0f72d6db1d21e) C:\Windows\system32\drivers\WudfPf.sys
16:38:08.0641 4140 WudfPf - ok
16:38:08.0672 4140 WUDFRd (f91ff1e51fca30b3c3981db7d5924252) C:\Windows\system32\DRIVERS\WUDFRd.sys
16:38:08.0719 4140 WUDFRd - ok
16:38:08.0750 4140 wudfsvc (ddee3682fe97037c45f4d7ab467cb8b6) C:\Windows\System32\WUDFSvc.dll
16:38:08.0781 4140 wudfsvc - ok
16:38:08.0812 4140 WwanSvc (ff2d745b560f7c71b31f30f4d49f73d2) C:\Windows\System32\wwansvc.dll
16:38:08.0843 4140 WwanSvc - ok
16:38:08.0875 4140 MBR (0x1B8) (4624822e540ec83cd0819525c65846ba) \Device\Harddisk0\DR0
16:38:11.0324 4140 \Device\Harddisk0\DR0 - ok
16:38:11.0324 4140 Boot (0x1200) (58dce7f82636db6c7e9db6ece2538b58) \Device\Harddisk0\DR0\Partition0
16:38:11.0324 4140 \Device\Harddisk0\DR0\Partition0 - ok
16:38:11.0371 4140 Boot (0x1200) (97f7cf239436882d20a672eabe986f93) \Device\Harddisk0\DR0\Partition1
16:38:11.0371 4140 \Device\Harddisk0\DR0\Partition1 - ok
16:38:11.0417 4140 Boot (0x1200) (a549e879ecbf85aa75f70ed669e492c8) \Device\Harddisk0\DR0\Partition2
16:38:11.0417 4140 \Device\Harddisk0\DR0\Partition2 - ok
16:38:11.0417 4140 ============================================================
16:38:11.0417 4140 Scan finished
16:38:11.0417 4140 ============================================================
16:38:11.0433 4004 Detected object count: 4
16:38:11.0433 4004 Actual detected object count: 4
16:38:19.0327 4004 ACEDRV05 ( UnsignedFile.Multi.Generic ) - skipped by user
16:38:19.0327 4004 ACEDRV05 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:38:19.0327 4004 IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
16:38:19.0327 4004 IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:38:19.0327 4004 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
16:38:19.0327 4004 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:38:19.0327 4004 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
16:38:19.0327 4004 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
16:38:28.0499 2872 Deinitialize success
Geändert von othergrunty (01.07.2012 um 16:19 Uhr) |
|
01.07.2012, 16:25
| #14 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | Mor.exe abgewendet?Zitat:
Eine Analyse ist nicht mit einem Tool getan. Und die Entfernung auch nicht wenn da da was sein sollte Wir können auch einfach an dieser Stelle Schluss machen, denn bisher hab ich keine weiteren Hinweise auf Schädlinge und du fühlst dich eh nicht sehr wohl dabei 
__________________ Logfiles bitte immer in CODE-Tags posten |
|
01.07.2012, 16:28
| #15 |
| | Mor.exe abgewendet? Nochmal verzei mir, aber es ist nun eine Woche her und jedes mal wenn wir einen neun Scan machen fühle ich als würde mein Herz stehen bleiben, weil doch irgend etwas sein könnte. Machen wir einfach weiter und vergessen wir meinen kurzen Ausbruch okay? Ich weiß du machst das alles hier in deiner freihen Zeit und aus gutem Willen. Habe meinen log oben in einen Edit gepostet. |
|
| Themen zu Mor.exe abgewendet? |
| administrator, autostart, avira, bier, clean, datei, dateien, dateisystem, einstellung, explorer, festplatte, firefox, frage, heuristiks/extra, heuristiks/shuriken, internet, java, link, mal-ware, malware, malwarebytes, microsoft, nicht sicher, ordner, rechner, scan, seite, tab, update, version., viren, wichtige daten |
Button.
Textbox von OTL - wenn OTL auf deutsch ist wird sie mit 
beschriftet
.
Linear-Darstellung
