| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183Windows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
21.08.2012, 13:13
| #16 |
| /// Winkelfunktion /// TB-Süch-Tiger™   |  2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Nur heut ebin ich noch für ein paar Stunden da Wir wären fast fertig. Der Avira Browserschutz ist völlig unnötig und zudem ist das Teil mit diesem Toolbar-Unsinn von Ask gekoppelt, also Finger weg Das Log vom tdsskiller ist leider unvollständig, die untere Zusammenfassung fehlt
__________________ Logfiles bitte immer in CODE-Tags posten  |
|
21.08.2012, 14:07
| #17 |
 | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 2. Versuch:
__________________Code:
ATTFilter 23:11:36.0158 2412 TDSS rootkit removing tool 2.8.7.0 Aug 20 2012 17:30:03
23:11:36.0468 2412 ============================================================
23:11:36.0468 2412 Current date / time: 2012/08/20 23:11:36.0468
23:11:36.0468 2412 SystemInfo:
23:11:36.0468 2412
23:11:36.0468 2412 OS Version: 6.1.7601 ServicePack: 1.0
23:11:36.0468 2412 Product type: Workstation
23:11:36.0468 2412 ComputerName: THINK-Y
23:11:36.0468 2412 UserName: ***
23:11:36.0468 2412 Windows directory: C:\Windows
23:11:36.0468 2412 System windows directory: C:\Windows
23:11:36.0468 2412 Running under WOW64
23:11:36.0468 2412 Processor architecture: Intel x64
23:11:36.0468 2412 Number of processors: 4
23:11:36.0468 2412 Page size: 0x1000
23:11:36.0468 2412 Boot type: Normal boot
23:11:36.0468 2412 ============================================================
23:11:36.0898 2412 Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
23:11:36.0908 2412 ============================================================
23:11:36.0908 2412 \Device\Harddisk0\DR0:
23:11:36.0908 2412 MBR partitions:
23:11:36.0908 2412 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x2EE000
23:11:36.0908 2412 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x2EE800, BlocksNum 0x38157000
23:11:36.0908 2412 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x38445800, BlocksNum 0x1F40000
23:11:36.0908 2412 ============================================================
23:11:36.0928 2412 C: <-> \Device\Harddisk0\DR0\Partition2
23:11:36.0968 2412 Q: <-> \Device\Harddisk0\DR0\Partition3
23:11:36.0968 2412 ============================================================
23:11:36.0968 2412 Initialize success
23:11:36.0968 2412 ============================================================
23:14:21.0497 5280 ============================================================
23:14:21.0497 5280 Scan started
23:14:21.0497 5280 Mode: Manual; SigCheck; TDLFS;
23:14:21.0497 5280 ============================================================
23:14:21.0747 5280 ================ Scan services =============================
23:14:21.0965 5280 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\DRIVERS\1394ohci.sys
23:14:22.0074 5280 1394ohci - ok
23:14:22.0152 5280 [ F4AF97702BAD85BFEF64B9A557F11B6F ] 5U877 C:\Windows\system32\DRIVERS\5U877.sys
23:14:22.0199 5280 5U877 - ok
23:14:22.0230 5280 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys
23:14:22.0261 5280 ACPI - ok
23:14:22.0277 5280 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys
23:14:22.0308 5280 AcpiPmi - ok
23:14:22.0417 5280 [ A9D3B95E8466BD58EEB8A1154654E162 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
23:14:22.0449 5280 AdobeFlashPlayerUpdateSvc - ok
23:14:22.0495 5280 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys
23:14:22.0527 5280 adp94xx - ok
23:14:22.0558 5280 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys
23:14:22.0573 5280 adpahci - ok
23:14:22.0589 5280 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys
23:14:22.0589 5280 adpu320 - ok
23:14:22.0620 5280 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll
23:14:22.0667 5280 AeLookupSvc - ok
23:14:22.0698 5280 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys
23:14:22.0729 5280 AFD - ok
23:14:22.0761 5280 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys
23:14:22.0761 5280 agp440 - ok
23:14:22.0792 5280 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe
23:14:22.0854 5280 ALG - ok
23:14:22.0854 5280 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys
23:14:22.0870 5280 aliide - ok
23:14:22.0870 5280 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys
23:14:22.0885 5280 amdide - ok
23:14:22.0901 5280 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys
23:14:22.0932 5280 AmdK8 - ok
23:14:22.0948 5280 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys
23:14:22.0995 5280 AmdPPM - ok
23:14:23.0026 5280 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys
23:14:23.0041 5280 amdsata - ok
23:14:23.0057 5280 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys
23:14:23.0073 5280 amdsbs - ok
23:14:23.0088 5280 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys
23:14:23.0088 5280 amdxata - ok
23:14:23.0151 5280 [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
23:14:23.0182 5280 AntiVirSchedulerService - ok
23:14:23.0197 5280 [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
23:14:23.0229 5280 AntiVirService - ok
23:14:23.0244 5280 [ 676894FA57B671FEC5C3F05F8929E03B ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
23:14:23.0260 5280 AntiVirWebService - ok
23:14:23.0291 5280 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys
23:14:23.0338 5280 AppID - ok
23:14:23.0369 5280 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll
23:14:23.0416 5280 AppIDSvc - ok
23:14:23.0416 5280 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll
23:14:23.0463 5280 Appinfo - ok
23:14:23.0478 5280 [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt C:\Windows\System32\appmgmts.dll
23:14:23.0525 5280 AppMgmt - ok
23:14:23.0541 5280 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys
23:14:23.0556 5280 arc - ok
23:14:23.0572 5280 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys
23:14:23.0587 5280 arcsas - ok
23:14:23.0634 5280 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys
23:14:23.0728 5280 AsyncMac - ok
23:14:23.0743 5280 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys
23:14:23.0759 5280 atapi - ok
23:14:23.0806 5280 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
23:14:23.0853 5280 AudioEndpointBuilder - ok
23:14:23.0868 5280 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll
23:14:23.0899 5280 AudioSrv - ok
23:14:23.0931 5280 [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys
23:14:23.0977 5280 avgntflt - ok
23:14:24.0009 5280 [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys
23:14:24.0040 5280 avipbb - ok
23:14:24.0055 5280 [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys
23:14:24.0087 5280 avkmgr - ok
23:14:24.0118 5280 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll
23:14:24.0149 5280 AxInstSV - ok
23:14:24.0180 5280 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys
23:14:24.0211 5280 b06bdrv - ok
23:14:24.0243 5280 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys
23:14:24.0289 5280 b57nd60a - ok
23:14:24.0321 5280 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll
23:14:24.0352 5280 BDESVC - ok
23:14:24.0367 5280 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys
23:14:24.0430 5280 Beep - ok
23:14:24.0461 5280 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll
23:14:24.0508 5280 BFE - ok
23:14:24.0539 5280 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll
23:14:24.0617 5280 BITS - ok
23:14:24.0633 5280 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys
23:14:24.0648 5280 blbdrive - ok
23:14:24.0679 5280 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys
23:14:24.0711 5280 bowser - ok
23:14:24.0726 5280 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys
23:14:24.0757 5280 BrFiltLo - ok
23:14:24.0757 5280 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys
23:14:24.0773 5280 BrFiltUp - ok
23:14:24.0789 5280 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll
23:14:24.0820 5280 Browser - ok
23:14:24.0835 5280 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys
23:14:24.0867 5280 Brserid - ok
23:14:24.0882 5280 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys
23:14:24.0898 5280 BrSerWdm - ok
23:14:24.0898 5280 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys
23:14:24.0929 5280 BrUsbMdm - ok
23:14:24.0929 5280 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys
23:14:24.0945 5280 BrUsbSer - ok
23:14:24.0976 5280 [ CF98190A94F62E405C8CB255018B2315 ] BthEnum C:\Windows\system32\drivers\BthEnum.sys
23:14:25.0007 5280 BthEnum - ok
23:14:25.0023 5280 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys
23:14:25.0069 5280 BTHMODEM - ok
23:14:25.0085 5280 [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan C:\Windows\system32\DRIVERS\bthpan.sys
23:14:25.0116 5280 BthPan - ok
23:14:25.0147 5280 [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT C:\Windows\System32\Drivers\BTHport.sys
23:14:25.0194 5280 BTHPORT - ok
23:14:25.0225 5280 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll
23:14:25.0257 5280 bthserv - ok
23:14:25.0288 5280 [ F188B7394D81010767B6DF3178519A37 ] BTHUSB C:\Windows\System32\Drivers\BTHUSB.sys
23:14:25.0319 5280 BTHUSB - ok
23:14:25.0350 5280 [ 8834F87A6A745872894DF8223201A6C3 ] BTWAMPFL C:\Windows\system32\DRIVERS\btwampfl.sys
23:14:25.0381 5280 BTWAMPFL - ok
23:14:25.0381 5280 [ 9863D82ECBEC6106D377ED73680D99D8 ] btwaudio C:\Windows\system32\drivers\btwaudio.sys
23:14:25.0413 5280 btwaudio - ok
23:14:25.0428 5280 [ 3432DD66AE75AB2DE6D0527AD78DBFC7 ] btwavdt C:\Windows\system32\DRIVERS\btwavdt.sys
23:14:25.0459 5280 btwavdt - ok
23:14:25.0600 5280 [ EB4AFE08FB39BB444F221D7D501E0915 ] btwdins C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
23:14:25.0662 5280 btwdins - ok
23:14:25.0693 5280 [ 382DC5A631CED0462EA09B7EB898BDBF ] btwl2cap C:\Windows\system32\DRIVERS\btwl2cap.sys
23:14:25.0725 5280 btwl2cap - ok
23:14:25.0740 5280 [ 13A9C2CEDD44C175E6CA39A536795CA6 ] btwrchid C:\Windows\system32\DRIVERS\btwrchid.sys
23:14:25.0771 5280 btwrchid - ok
23:14:25.0771 5280 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys
23:14:25.0818 5280 cdfs - ok
23:14:25.0849 5280 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys
23:14:25.0896 5280 cdrom - ok
23:14:25.0927 5280 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll
23:14:25.0990 5280 CertPropSvc - ok
23:14:26.0005 5280 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\drivers\circlass.sys
23:14:26.0021 5280 circlass - ok
23:14:26.0052 5280 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys
23:14:26.0068 5280 CLFS - ok
23:14:26.0115 5280 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:14:26.0130 5280 clr_optimization_v2.0.50727_32 - ok
23:14:26.0146 5280 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
23:14:26.0161 5280 clr_optimization_v2.0.50727_64 - ok
23:14:26.0208 5280 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:14:26.0239 5280 clr_optimization_v4.0.30319_32 - ok
23:14:26.0255 5280 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
23:14:26.0271 5280 clr_optimization_v4.0.30319_64 - ok
23:14:26.0302 5280 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\DRIVERS\CmBatt.sys
23:14:26.0317 5280 CmBatt - ok
23:14:26.0333 5280 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys
23:14:26.0349 5280 cmdide - ok
23:14:26.0395 5280 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys
23:14:26.0442 5280 CNG - ok
23:14:26.0489 5280 [ DB6F09464C57606892BF6D2458483417 ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT64.sys
23:14:26.0551 5280 CnxtHdAudService - ok
23:14:26.0583 5280 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys
23:14:26.0598 5280 Compbatt - ok
23:14:26.0614 5280 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys
23:14:26.0661 5280 CompositeBus - ok
23:14:26.0661 5280 COMSysApp - ok
23:14:26.0676 5280 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys
23:14:26.0692 5280 crcdisk - ok
23:14:26.0739 5280 [ 4F5414602E2544A4554D95517948B705 ] CryptSvc C:\Windows\system32\cryptsvc.dll
23:14:26.0754 5280 CryptSvc - ok
23:14:26.0770 5280 [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC C:\Windows\system32\drivers\csc.sys
23:14:26.0801 5280 CSC - ok
23:14:26.0832 5280 [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService C:\Windows\System32\cscsvc.dll
23:14:26.0863 5280 CscService - ok
23:14:26.0910 5280 [ 44BDDEB03C84A1C993C992FFB5700357 ] CVirtA C:\Windows\system32\DRIVERS\CVirtA64.sys
23:14:26.0973 5280 CVirtA - ok
23:14:27.0035 5280 [ 98C413E1A2FB6E5A4C101C25B3D0B275 ] CVPND C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
23:14:27.0082 5280 CVPND - ok
23:14:27.0097 5280 [ 79AF0E203D089AF442A3F70ED00A37FB ] CVPNDRVA C:\Windows\system32\Drivers\CVPNDRVA.sys
23:14:27.0129 5280 CVPNDRVA - ok
23:14:27.0144 5280 [ 9D0D050170D47E778B624A28C90F23DE ] CxAudMsg C:\Windows\system32\CxAudMsg64.exe
23:14:27.0175 5280 CxAudMsg - ok
23:14:27.0207 5280 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll
23:14:27.0253 5280 DcomLaunch - ok
23:14:27.0285 5280 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll
23:14:27.0316 5280 defragsvc - ok
23:14:27.0347 5280 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys
23:14:27.0409 5280 DfsC - ok
23:14:27.0441 5280 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll
23:14:27.0487 5280 Dhcp - ok
23:14:27.0503 5280 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys
23:14:27.0550 5280 discache - ok
23:14:27.0581 5280 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys
23:14:27.0597 5280 Disk - ok
23:14:27.0597 5280 [ 5DB085A8A6600BE6401F2B24EECB5415 ] dmvsc C:\Windows\system32\drivers\dmvsc.sys
23:14:27.0628 5280 dmvsc - ok
23:14:27.0643 5280 [ 05CB5910B3CA6019FC3CCA815EE06FFB ] DNE C:\Windows\system32\DRIVERS\dne64x.sys
23:14:27.0659 5280 DNE - ok
23:14:27.0675 5280 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll
23:14:27.0721 5280 Dnscache - ok
23:14:27.0737 5280 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll
23:14:27.0784 5280 dot3svc - ok
23:14:27.0831 5280 [ B42ED0320C6E41102FDE0005154849BB ] Dot4 C:\Windows\system32\DRIVERS\Dot4.sys
23:14:27.0877 5280 Dot4 - ok
23:14:27.0893 5280 [ E9F5969233C5D89F3C35E3A66A52A361 ] Dot4Print C:\Windows\system32\DRIVERS\Dot4Prt.sys
23:14:27.0909 5280 Dot4Print - ok
23:14:27.0924 5280 [ FD05A02B0370BC3000F402E543CA5814 ] dot4usb C:\Windows\system32\DRIVERS\dot4usb.sys
23:14:27.0940 5280 dot4usb - ok
23:14:28.0002 5280 [ 277247B79DA2230D0C3AEB83E6CD8CA7 ] DozeSvc C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
23:14:28.0049 5280 DozeSvc - ok
23:14:28.0065 5280 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll
23:14:28.0111 5280 DPS - ok
23:14:28.0127 5280 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys
23:14:28.0158 5280 drmkaud - ok
23:14:28.0174 5280 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys
23:14:28.0205 5280 DXGKrnl - ok
23:14:28.0221 5280 [ CE4CFFD9F64B86BCEB1C343FC9924D72 ] DzHDD64 C:\Windows\system32\DRIVERS\DzHDD64.sys
23:14:28.0252 5280 DzHDD64 - ok
23:14:28.0283 5280 [ DC1776D086AA9733B1929A3D979D9FDD ] e1cexpress C:\Windows\system32\DRIVERS\e1c62x64.sys
23:14:28.0330 5280 e1cexpress - ok
23:14:28.0345 5280 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll
23:14:28.0392 5280 EapHost - ok
23:14:28.0470 5280 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys
23:14:28.0548 5280 ebdrv - ok
23:14:28.0564 5280 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe
23:14:28.0611 5280 EFS - ok
23:14:28.0657 5280 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe
23:14:28.0735 5280 ehRecvr - ok
23:14:28.0751 5280 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe
23:14:28.0782 5280 ehSched - ok
23:14:28.0813 5280 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys
23:14:28.0845 5280 elxstor - ok
23:14:28.0860 5280 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys
23:14:28.0876 5280 ErrDev - ok
23:14:28.0954 5280 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll
23:14:29.0016 5280 EventSystem - ok
23:14:29.0079 5280 [ E3A96D5AE6E5C7B5472011BA77353368 ] EvtEng C:\Program Files\Intel\WiFi\bin\EvtEng.exe
23:14:29.0110 5280 EvtEng - ok
23:14:29.0141 5280 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys
23:14:29.0172 5280 exfat - ok
23:14:29.0203 5280 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys
23:14:29.0297 5280 fastfat - ok
23:14:29.0344 5280 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe
23:14:29.0391 5280 Fax - ok
23:14:29.0406 5280 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys
23:14:29.0422 5280 fdc - ok
23:14:29.0453 5280 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll
23:14:29.0500 5280 fdPHost - ok
23:14:29.0515 5280 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll
23:14:29.0562 5280 FDResPub - ok
23:14:29.0593 5280 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys
23:14:29.0625 5280 FileInfo - ok
23:14:29.0671 5280 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys
23:14:29.0765 5280 Filetrace - ok
23:14:29.0765 5280 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys
23:14:29.0781 5280 flpydisk - ok
23:14:29.0796 5280 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys
23:14:29.0812 5280 FltMgr - ok
23:14:29.0859 5280 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll
23:14:29.0905 5280 FontCache - ok
23:14:29.0937 5280 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
23:14:29.0952 5280 FontCache3.0.0.0 - ok
23:14:29.0983 5280 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys
23:14:29.0999 5280 FsDepends - ok
23:14:30.0046 5280 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys
23:14:30.0061 5280 Fs_Rec - ok
23:14:30.0093 5280 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys
23:14:30.0108 5280 fvevol - ok
23:14:30.0124 5280 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys
23:14:30.0139 5280 gagp30kx - ok
23:14:30.0171 5280 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll
23:14:30.0217 5280 gpsvc - ok
23:14:30.0233 5280 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys
23:14:30.0280 5280 hcw85cir - ok
23:14:30.0311 5280 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
23:14:30.0342 5280 HdAudAddService - ok
23:14:30.0373 5280 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys
23:14:30.0420 5280 HDAudBus - ok
23:14:30.0420 5280 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys
23:14:30.0451 5280 HidBatt - ok
23:14:30.0467 5280 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys
23:14:30.0498 5280 HidBth - ok
23:14:30.0529 5280 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\drivers\hidir.sys
23:14:30.0561 5280 HidIr - ok
23:14:30.0592 5280 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll
23:14:30.0654 5280 hidserv - ok
23:14:30.0670 5280 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\drivers\hidusb.sys
23:14:30.0685 5280 HidUsb - ok
23:14:30.0717 5280 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll
23:14:30.0748 5280 hkmsvc - ok
23:14:30.0763 5280 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
23:14:30.0810 5280 HomeGroupListener - ok
23:14:30.0826 5280 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
23:14:30.0841 5280 HomeGroupProvider - ok
23:14:30.0935 5280 [ 0A3C6AA4A9FC38C20BA4EAC2C3351C05 ] hpqcxs08 C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
23:14:30.0951 5280 hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
23:14:30.0951 5280 hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
23:14:30.0982 5280 [ F3F72A2A86C22610BCA5439FA789DD52 ] hpqddsvc C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
23:14:30.0998 5280 hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
23:14:30.0998 5280 hpqddsvc - detected UnsignedFile.Multi.Generic (1)
23:14:31.0013 5280 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys
23:14:31.0029 5280 HpSAMD - ok
23:14:31.0076 5280 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys
23:14:31.0138 5280 HTTP - ok
23:14:31.0154 5280 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys
23:14:31.0169 5280 hwpolicy - ok
23:14:31.0232 5280 [ E935C8099F9196BF19224D9EE4808612 ] HyperW7Svc C:\Program Files\Lenovo\RapidBoot\HyperW7Svc64.exe
23:14:31.0247 5280 HyperW7Svc - ok
23:14:31.0263 5280 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\DRIVERS\i8042prt.sys
23:14:31.0278 5280 i8042prt - ok
23:14:31.0325 5280 [ D7921D5A870B11CC1ADAB198A519D50A ] iaStor C:\Windows\system32\drivers\iaStor.sys
23:14:31.0372 5280 iaStor - ok
23:14:31.0403 5280 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys
23:14:31.0419 5280 iaStorV - ok
23:14:31.0466 5280 [ 29ED470689B7C597A9701D6A4C57A578 ] IBMPMDRV C:\Windows\system32\DRIVERS\ibmpmdrv.sys
23:14:31.0528 5280 IBMPMDRV - ok
23:14:31.0544 5280 [ BC7AF43EEC24E995D770EC92A441D5D8 ] IBMPMSVC C:\Windows\system32\ibmpmsvc.exe
23:14:31.0559 5280 IBMPMSVC - ok
23:14:31.0622 5280 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
23:14:31.0653 5280 idsvc - ok
23:14:31.0949 5280 [ 33FAA40B288002C89529DBD14F3AB72C ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys
23:14:32.0308 5280 igfx - ok
23:14:32.0339 5280 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys
23:14:32.0355 5280 iirsp - ok
23:14:32.0386 5280 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll
23:14:32.0448 5280 IKEEXT - ok
23:14:32.0495 5280 [ FC727061C0F47C8059E88E05D5C8E381 ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys
23:14:32.0526 5280 IntcDAud - ok
23:14:32.0542 5280 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys
23:14:32.0558 5280 intelide - ok
23:14:32.0589 5280 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys
23:14:32.0620 5280 intelppm - ok
23:14:32.0651 5280 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll
23:14:32.0714 5280 IPBusEnum - ok
23:14:32.0729 5280 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:14:32.0760 5280 IpFilterDriver - ok
23:14:32.0776 5280 [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll
23:14:32.0838 5280 iphlpsvc - ok
23:14:32.0838 5280 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys
23:14:32.0854 5280 IPMIDRV - ok
23:14:32.0870 5280 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys
23:14:32.0916 5280 IPNAT - ok
23:14:32.0932 5280 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys
23:14:32.0948 5280 IRENUM - ok
23:14:32.0963 5280 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys
23:14:32.0963 5280 isapnp - ok
23:14:32.0994 5280 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys
23:14:32.0994 5280 iScsiPrt - ok
23:14:33.0072 5280 [ 6C85719A21B3F62C2C76280F4BD36C7B ] jhi_service C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
23:14:33.0135 5280 jhi_service - ok
23:14:33.0150 5280 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys
23:14:33.0166 5280 kbdclass - ok
23:14:33.0197 5280 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\drivers\kbdhid.sys
23:14:33.0228 5280 kbdhid - ok
23:14:33.0260 5280 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe
23:14:33.0275 5280 KeyIso - ok
23:14:33.0322 5280 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys
23:14:33.0353 5280 KSecDD - ok
23:14:33.0369 5280 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys
23:14:33.0384 5280 KSecPkg - ok
23:14:33.0384 5280 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys
23:14:33.0431 5280 ksthunk - ok
23:14:33.0462 5280 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll
23:14:33.0494 5280 KtmRm - ok
23:14:33.0525 5280 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll
23:14:33.0572 5280 LanmanServer - ok
23:14:33.0603 5280 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
23:14:33.0634 5280 LanmanWorkstation - ok
23:14:33.0650 5280 [ 56B74943929BC575914631EDC0E72220 ] LENOVO.CAMMUTE C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
23:14:33.0665 5280 LENOVO.CAMMUTE - ok
23:14:33.0696 5280 [ 340288B3B2EDC8AFD5FF127DF85142A7 ] LENOVO.MICMUTE C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
23:14:33.0712 5280 LENOVO.MICMUTE - ok
23:14:33.0712 5280 [ 2B9D8555DC004E240082D18E7725CE20 ] lenovo.smi C:\Windows\system32\DRIVERS\smiifx64.sys
23:14:33.0743 5280 lenovo.smi - ok
23:14:33.0759 5280 [ F9B51B2A5DA1222A910021C71E9EA559 ] LENOVO.TPKNRSVC C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
23:14:33.0774 5280 LENOVO.TPKNRSVC - ok
23:14:33.0774 5280 [ F7DE50781DC4D162C1005EB30D98F931 ] Lenovo.VIRTSCRLSVC C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
23:14:33.0790 5280 Lenovo.VIRTSCRLSVC - ok
23:14:33.0821 5280 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys
23:14:33.0899 5280 lltdio - ok
23:14:33.0915 5280 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll
23:14:33.0946 5280 lltdsvc - ok
23:14:33.0977 5280 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll
23:14:34.0024 5280 lmhosts - ok
23:14:34.0040 5280 [ 97F9EAAC985A663394CD8F54DCD3E73A ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
23:14:34.0071 5280 LMS - ok
23:14:34.0086 5280 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys
23:14:34.0102 5280 LSI_FC - ok
23:14:34.0133 5280 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys
23:14:34.0149 5280 LSI_SAS - ok
23:14:34.0164 5280 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys
23:14:34.0164 5280 LSI_SAS2 - ok
23:14:34.0180 5280 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys
23:14:34.0180 5280 LSI_SCSI - ok
23:14:34.0196 5280 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys
23:14:34.0242 5280 luafv - ok
23:14:34.0258 5280 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll
23:14:34.0274 5280 Mcx2Svc - ok
23:14:34.0289 5280 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys
23:14:34.0289 5280 megasas - ok
23:14:34.0305 5280 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys
23:14:34.0320 5280 MegaSR - ok
23:14:34.0336 5280 [ A6518DCC42F7A6E999BB3BEA8FD87567 ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys
23:14:34.0367 5280 MEIx64 - ok
23:14:34.0383 5280 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll
23:14:34.0414 5280 MMCSS - ok
23:14:34.0414 5280 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys
23:14:34.0476 5280 Modem - ok
23:14:34.0492 5280 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys
23:14:34.0539 5280 monitor - ok
23:14:34.0570 5280 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys
23:14:34.0586 5280 mouclass - ok
23:14:34.0601 5280 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\drivers\mouhid.sys
23:14:34.0617 5280 mouhid - ok
23:14:34.0648 5280 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys
23:14:34.0648 5280 mountmgr - ok
23:14:34.0710 5280 [ 46297FA8E30A6007F14118FC2B942FBC ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
23:14:34.0726 5280 MozillaMaintenance - ok
23:14:34.0757 5280 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys
23:14:34.0773 5280 mpio - ok
23:14:34.0788 5280 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys
23:14:34.0820 5280 mpsdrv - ok
23:14:34.0851 5280 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll
23:14:34.0898 5280 MpsSvc - ok
23:14:34.0913 5280 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys
23:14:34.0929 5280 MRxDAV - ok
23:14:34.0944 5280 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys
23:14:34.0976 5280 mrxsmb - ok
23:14:34.0991 5280 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:14:35.0007 5280 mrxsmb10 - ok
23:14:35.0022 5280 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:14:35.0038 5280 mrxsmb20 - ok
23:14:35.0054 5280 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys
23:14:35.0069 5280 msahci - ok
23:14:35.0069 5280 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys
23:14:35.0085 5280 msdsm - ok
23:14:35.0085 5280 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe
23:14:35.0100 5280 MSDTC - ok
23:14:35.0132 5280 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys
23:14:35.0163 5280 Msfs - ok
23:14:35.0178 5280 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys
23:14:35.0225 5280 mshidkmdf - ok
23:14:35.0241 5280 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys
23:14:35.0241 5280 msisadrv - ok
23:14:35.0256 5280 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll
23:14:35.0303 5280 MSiSCSI - ok
23:14:35.0303 5280 msiserver - ok
23:14:35.0334 5280 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys
23:14:35.0381 5280 MSKSSRV - ok
23:14:35.0381 5280 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys
23:14:35.0428 5280 MSPCLOCK - ok
23:14:35.0444 5280 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys
23:14:35.0490 5280 MSPQM - ok
23:14:35.0506 5280 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys
23:14:35.0522 5280 MsRPC - ok
23:14:35.0537 5280 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys
23:14:35.0537 5280 mssmbios - ok
23:14:35.0568 5280 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys
23:14:35.0600 5280 MSTEE - ok
23:14:35.0615 5280 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys
23:14:35.0615 5280 MTConfig - ok
23:14:35.0631 5280 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys
23:14:35.0646 5280 Mup - ok
23:14:35.0678 5280 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll
23:14:35.0724 5280 napagent - ok
23:14:35.0740 5280 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys
23:14:35.0771 5280 NativeWifiP - ok
23:14:35.0818 5280 [ C38B8AE57F78915905064A9A24DC1586 ] NDIS C:\Windows\system32\drivers\ndis.sys
23:14:35.0865 5280 NDIS - ok
23:14:35.0896 5280 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys
23:14:35.0974 5280 NdisCap - ok
23:14:36.0005 5280 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys
23:14:36.0036 5280 NdisTapi - ok
23:14:36.0036 5280 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys
23:14:36.0068 5280 Ndisuio - ok
23:14:36.0083 5280 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys
23:14:36.0114 5280 NdisWan - ok
23:14:36.0130 5280 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys
23:14:36.0177 5280 NDProxy - ok
23:14:36.0208 5280 [ 2334DC48997BA203B794DF3EE70521DB ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
23:14:36.0224 5280 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
23:14:36.0224 5280 Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
23:14:36.0239 5280 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys
23:14:36.0286 5280 NetBIOS - ok
23:14:36.0302 5280 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys
23:14:36.0333 5280 NetBT - ok
23:14:36.0348 5280 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe
23:14:36.0364 5280 Netlogon - ok
23:14:36.0395 5280 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll
23:14:36.0442 5280 Netman - ok
23:14:36.0458 5280 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll
23:14:36.0489 5280 netprofm - ok
23:14:36.0520 5280 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
23:14:36.0520 5280 NetTcpPortSharing - ok
23:14:36.0754 5280 [ 50AD7F7040C22BB7CAA59A0880875A21 ] NETwNs64 C:\Windows\system32\DRIVERS\NETwNs64.sys
23:14:37.0019 5280 NETwNs64 - ok
23:14:37.0050 5280 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys
23:14:37.0066 5280 nfrd960 - ok
23:14:37.0082 5280 [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc C:\Windows\System32\nlasvc.dll
23:14:37.0144 5280 NlaSvc - ok
23:14:37.0175 5280 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys
23:14:37.0206 5280 Npfs - ok
23:14:37.0222 5280 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll
23:14:37.0253 5280 nsi - ok
23:14:37.0284 5280 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys
23:14:37.0316 5280 nsiproxy - ok
23:14:37.0362 5280 [ A2F74975097F52A00745F9637451FDD8 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys
23:14:37.0409 5280 Ntfs - ok
23:14:37.0425 5280 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys
23:14:37.0456 5280 Null - ok
23:14:37.0487 5280 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys
23:14:37.0518 5280 nvraid - ok
23:14:37.0550 5280 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys
23:14:37.0581 5280 nvstor - ok
23:14:37.0612 5280 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys
23:14:37.0628 5280 nv_agp - ok
23:14:37.0721 5280 [ 785F487A64950F3CB8E9F16253BA3B7B ] odserv C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
23:14:37.0752 5280 odserv - ok
23:14:37.0768 5280 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys
23:14:37.0784 5280 ohci1394 - ok
23:14:37.0815 5280 [ 5A432A042DAE460ABE7199B758E8606C ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
23:14:37.0846 5280 ose - ok
23:14:37.0877 5280 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll
23:14:37.0924 5280 p2pimsvc - ok
23:14:37.0955 5280 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll
23:14:37.0971 5280 p2psvc - ok
23:14:37.0986 5280 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\drivers\parport.sys
23:14:38.0002 5280 Parport - ok
23:14:38.0033 5280 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys
23:14:38.0049 5280 partmgr - ok
23:14:38.0080 5280 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll
23:14:38.0111 5280 PcaSvc - ok
23:14:38.0127 5280 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys
23:14:38.0142 5280 pci - ok
23:14:38.0158 5280 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys
23:14:38.0158 5280 pciide - ok
23:14:38.0174 5280 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys
23:14:38.0189 5280 pcmcia - ok
23:14:38.0205 5280 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys
23:14:38.0205 5280 pcw - ok
23:14:38.0220 5280 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys
23:14:38.0283 5280 PEAUTH - ok
23:14:38.0330 5280 [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc C:\Windows\system32\peerdistsvc.dll
23:14:38.0376 5280 PeerDistSvc - ok
23:14:38.0454 5280 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe
23:14:38.0501 5280 PerfHost - ok
23:14:38.0532 5280 [ 52C9F4359AF4A25969B882AECC6F3BDA ] PHCORE C:\Program Files\Lenovo\RapidBoot\PHCORE64.SYS
23:14:38.0548 5280 PHCORE - ok
23:14:38.0595 5280 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll
23:14:38.0673 5280 pla - ok
23:14:38.0704 5280 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll
23:14:38.0735 5280 PlugPlay - ok
23:14:38.0766 5280 [ AC78DF349F0E4CFB8B667C0CFFF83CCE ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
23:14:38.0782 5280 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
23:14:38.0782 5280 Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
23:14:38.0813 5280 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll
23:14:38.0829 5280 PNRPAutoReg - ok
23:14:38.0844 5280 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll
23:14:38.0860 5280 PNRPsvc - ok
23:14:38.0891 5280 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll
23:14:38.0938 5280 PolicyAgent - ok
23:14:38.0969 5280 [ A2CCA4FB273E6050F17A0A416CFF2FCD ] Power C:\Windows\system32\umpo.dll
23:14:39.0016 5280 Power - ok
23:14:39.0063 5280 [ 0BF1D6B41E4D4376BE4E4FA31D1A88C0 ] Power Manager DBC Service C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
23:14:39.0078 5280 Power Manager DBC Service - ok
23:14:39.0125 5280 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys
23:14:39.0172 5280 PptpMiniport - ok
23:14:39.0203 5280 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys
23:14:39.0250 5280 Processor - ok
23:14:39.0281 5280 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll
23:14:39.0344 5280 ProfSvc - ok
23:14:39.0359 5280 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
23:14:39.0390 5280 ProtectedStorage - ok
23:14:39.0422 5280 [ B8035AF9CC0CCBA9A09AC0A0D9801797 ] psadd C:\Windows\system32\DRIVERS\psadd.sys
23:14:39.0437 5280 psadd - ok
23:14:39.0453 5280 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys
23:14:39.0500 5280 Psched - ok
23:14:39.0515 5280 [ F036CFB275D0C55F4E45FBBF5F98B3C8 ] PSI_SVC_2 C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
23:14:39.0531 5280 PSI_SVC_2 - ok
23:14:39.0546 5280 [ D20BF8B293EB90E3C4ED2F38B51948A1 ] PwmEWSvc C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE
23:14:39.0546 5280 PwmEWSvc - ok
23:14:39.0656 5280 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys
23:14:39.0718 5280 ql2300 - ok
23:14:39.0718 5280 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys
23:14:39.0734 5280 ql40xx - ok
23:14:39.0749 5280 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll
23:14:39.0765 5280 QWAVE - ok
23:14:39.0796 5280 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys
23:14:39.0812 5280 QWAVEdrv - ok
23:14:39.0827 5280 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys
23:14:39.0858 5280 RasAcd - ok
23:14:39.0890 5280 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys
23:14:39.0921 5280 RasAgileVpn - ok
23:14:39.0952 5280 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll
23:14:39.0983 5280 RasAuto - ok
23:14:39.0999 5280 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys
23:14:40.0030 5280 Rasl2tp - ok
23:14:40.0046 5280 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll
23:14:40.0092 5280 RasMan - ok
23:14:40.0124 5280 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys
23:14:40.0186 5280 RasPppoe - ok
23:14:40.0202 5280 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys
23:14:40.0233 5280 RasSstp - ok
23:14:40.0248 5280 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys
23:14:40.0295 5280 rdbss - ok
23:14:40.0326 5280 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\DRIVERS\rdpbus.sys
23:14:40.0342 5280 rdpbus - ok
23:14:40.0358 5280 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys
23:14:40.0389 5280 RDPCDD - ok
23:14:40.0404 5280 [ 1B6163C503398B23FF8B939C67747683 ] RDPDR C:\Windows\system32\drivers\rdpdr.sys
23:14:40.0420 5280 RDPDR - ok
23:14:40.0451 5280 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys
23:14:40.0514 5280 RDPENCDD - ok
23:14:40.0529 5280 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys
23:14:40.0560 5280 RDPREFMP - ok
23:14:40.0607 5280 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys
23:14:40.0623 5280 RDPWD - ok
23:14:40.0654 5280 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys
23:14:40.0670 5280 rdyboost - ok
23:14:40.0732 5280 [ FD11C1287D38A46FB72353E14D50089C ] RegSrvc C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
23:14:40.0748 5280 RegSrvc - ok
23:14:40.0763 5280 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll
23:14:40.0841 5280 RemoteAccess - ok
23:14:40.0872 5280 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll
23:14:40.0935 5280 RemoteRegistry - ok
23:14:40.0966 5280 [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM C:\Windows\system32\DRIVERS\rfcomm.sys
23:14:40.0997 5280 RFCOMM - ok
23:14:41.0028 5280 [ 5A227511ED22DDFEDF7EF7323C8F7D2F ] risdxc C:\Windows\system32\DRIVERS\risdxc64.sys
23:14:41.0060 5280 risdxc - ok
23:14:41.0075 5280 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll
23:14:41.0122 5280 RpcEptMapper - ok
23:14:41.0153 5280 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe
23:14:41.0169 5280 RpcLocator - ok
23:14:41.0184 5280 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll
23:14:41.0231 5280 RpcSs - ok
23:14:41.0247 5280 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys
23:14:41.0278 5280 rspndr - ok
23:14:41.0294 5280 [ E60C0A09F997826C7627B244195AB581 ] s3cap C:\Windows\system32\drivers\vms3cap.sys
23:14:41.0309 5280 s3cap - ok
23:14:41.0325 5280 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe
23:14:41.0325 5280 SamSs - ok
23:14:41.0340 5280 SAService - ok
23:14:41.0356 5280 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys
23:14:41.0356 5280 sbp2port - ok
23:14:41.0387 5280 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll
23:14:41.0434 5280 SCardSvr - ok
23:14:41.0465 5280 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys
23:14:41.0528 5280 scfilter - ok
23:14:41.0543 5280 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll
23:14:41.0606 5280 Schedule - ok
23:14:41.0621 5280 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll
23:14:41.0652 5280 SCPolicySvc - ok
23:14:41.0684 5280 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll
23:14:41.0715 5280 SDRSVC - ok
23:14:41.0746 5280 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys
23:14:41.0793 5280 secdrv - ok
23:14:41.0808 5280 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll
23:14:41.0840 5280 seclogon - ok
23:14:41.0855 5280 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll
23:14:41.0902 5280 SENS - ok
23:14:41.0933 5280 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll
23:14:41.0964 5280 SensrSvc - ok
23:14:41.0980 5280 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\drivers\serenum.sys
23:14:41.0996 5280 Serenum - ok
23:14:42.0027 5280 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\drivers\serial.sys
23:14:42.0042 5280 Serial - ok
23:14:42.0042 5280 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys
23:14:42.0074 5280 sermouse - ok
23:14:42.0089 5280 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll
23:14:42.0167 5280 SessionEnv - ok
23:14:42.0167 5280 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys
23:14:42.0183 5280 sffdisk - ok
23:14:42.0183 5280 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys
23:14:42.0198 5280 sffp_mmc - ok
23:14:42.0214 5280 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys
23:14:42.0261 5280 sffp_sd - ok
23:14:42.0261 5280 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys
23:14:42.0276 5280 sfloppy - ok
23:14:42.0308 5280 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll
23:14:42.0354 5280 SharedAccess - ok
23:14:42.0386 5280 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
23:14:42.0432 5280 ShellHWDetection - ok
23:14:42.0448 5280 [ E2FC046D4EDABFE3B5EF7DA06406277D ] Shockprf C:\Windows\system32\DRIVERS\Apsx64.sys
23:14:42.0479 5280 Shockprf - ok
23:14:42.0495 5280 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys
23:14:42.0510 5280 SiSRaid2 - ok
23:14:42.0510 5280 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys
23:14:42.0526 5280 SiSRaid4 - ok
23:14:42.0542 5280 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys
23:14:42.0573 5280 Smb - ok
23:14:42.0604 5280 [ C5B1A19B14F19B08AE72FCB20A3075B6 ] smihlp C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys
23:14:42.0620 5280 smihlp - ok
23:14:42.0651 5280 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe
23:14:42.0682 5280 SNMPTRAP - ok
23:14:42.0698 5280 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys
23:14:42.0713 5280 spldr - ok
23:14:42.0744 5280 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe
23:14:42.0760 5280 Spooler - ok
23:14:42.0869 5280 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe
23:14:42.0978 5280 sppsvc - ok
23:14:42.0994 5280 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll
23:14:43.0025 5280 sppuinotify - ok
23:14:43.0056 5280 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys
23:14:43.0072 5280 srv - ok
23:14:43.0088 5280 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys
23:14:43.0119 5280 srv2 - ok
23:14:43.0134 5280 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys
23:14:43.0134 5280 srvnet - ok
23:14:43.0166 5280 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll
23:14:43.0197 5280 SSDPSRV - ok
23:14:43.0212 5280 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll
23:14:43.0244 5280 SstpSvc - ok
23:14:43.0275 5280 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys
23:14:43.0290 5280 stexstor - ok
23:14:43.0322 5280 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll
23:14:43.0353 5280 stisvc - ok
23:14:43.0368 5280 [ 7785DC213270D2FC066538DAF94087E7 ] storflt C:\Windows\system32\drivers\vmstorfl.sys
23:14:43.0384 5280 storflt - ok
23:14:43.0400 5280 [ C40841817EF57D491F22EB103DA587CC ] StorSvc C:\Windows\system32\storsvc.dll
23:14:43.0446 5280 StorSvc - ok
23:14:43.0478 5280 [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc C:\Windows\system32\drivers\storvsc.sys
23:14:43.0493 5280 storvsc - ok
23:14:43.0540 5280 [ 6EA2F517373771CAC5188E82617C9C0B ] SUService C:\Program Files (x86)\Lenovo\System Update\SUService.exe
23:14:43.0540 5280 SUService ( UnsignedFile.Multi.Generic ) - warning
23:14:43.0540 5280 SUService - detected UnsignedFile.Multi.Generic (1)
23:14:43.0556 5280 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys
23:14:43.0571 5280 swenum - ok
23:14:43.0602 5280 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll
23:14:43.0649 5280 swprv - ok
23:14:43.0712 5280 [ FFDD13B42D4B106AC9FAFBB0E1F7FAA5 ] SynTP C:\Windows\system32\DRIVERS\SynTP.sys
23:14:43.0758 5280 SynTP - ok
23:14:43.0805 5280 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll
23:14:43.0852 5280 SysMain - ok
23:14:43.0868 5280 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
23:14:43.0883 5280 TabletInputService - ok
23:14:43.0914 5280 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll
23:14:43.0946 5280 TapiSrv - ok
23:14:43.0961 5280 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll
23:14:44.0008 5280 TBS - ok
23:14:44.0086 5280 [ ACB82BDA8F46C84F465C1AFA517DC4B9 ] Tcpip C:\Windows\system32\drivers\tcpip.sys
23:14:44.0133 5280 Tcpip - ok
23:14:44.0180 5280 [ ACB82BDA8F46C84F465C1AFA517DC4B9 ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys
23:14:44.0211 5280 TCPIP6 - ok
23:14:44.0242 5280 [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys
23:14:44.0289 5280 tcpipreg - ok
23:14:44.0289 5280 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys
23:14:44.0320 5280 TDPIPE - ok
23:14:44.0351 5280 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys
23:14:44.0367 5280 TDTCP - ok
23:14:44.0398 5280 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys
23:14:44.0429 5280 tdx - ok
23:14:44.0445 5280 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys
23:14:44.0460 5280 TermDD - ok
23:14:44.0492 5280 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll
23:14:44.0538 5280 TermService - ok
23:14:44.0554 5280 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll
23:14:44.0570 5280 Themes - ok
23:14:44.0585 5280 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll
23:14:44.0616 5280 THREADORDER - ok
23:14:44.0616 5280 [ 55B7FE3E1D3B616BDC4E9EA48D92D6E6 ] TPDIGIMN C:\Windows\system32\DRIVERS\ApsHM64.sys
23:14:44.0648 5280 TPDIGIMN - ok
23:14:44.0679 5280 [ F0684C62ED8FD3061CD488ECFC851022 ] TPHDEXLGSVC C:\Windows\system32\TPHDEXLG64.exe
23:14:44.0710 5280 TPHDEXLGSVC - ok
23:14:44.0726 5280 [ 83415782D47F8064FCAFEA308ABB2246 ] TPHKLOAD C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
23:14:44.0741 5280 TPHKLOAD - ok
23:14:44.0741 5280 [ C04BB65441913AB621C58A8BD3169B23 ] TPHKSVC C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
23:14:44.0757 5280 TPHKSVC - ok
23:14:44.0788 5280 [ DBCC20C02E8A3E43B03C304A4E40A84F ] TPM C:\Windows\system32\drivers\tpm.sys
23:14:44.0804 5280 TPM - ok
23:14:44.0819 5280 [ 7165B5A9B4867F64A6D6935F57D4196B ] TPPWRIF C:\Windows\system32\drivers\Tppwr64v.sys
23:14:44.0850 5280 TPPWRIF - ok
23:14:44.0866 5280 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll
23:14:44.0913 5280 TrkWks - ok
23:14:44.0960 5280 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
23:14:45.0022 5280 TrustedInstaller - ok
23:14:45.0038 5280 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys
23:14:45.0084 5280 tssecsrv - ok
23:14:45.0100 5280 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys
23:14:45.0131 5280 TsUsbFlt - ok
23:14:45.0147 5280 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys
23:14:45.0162 5280 TsUsbGD - ok
23:14:45.0178 5280 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys
23:14:45.0225 5280 tunnel - ok
23:14:45.0240 5280 [ 4DAAE0413CD4E816258838E2FAFB3147 ] TVTI2C C:\Windows\system32\DRIVERS\Tvti2c.sys
23:14:45.0272 5280 TVTI2C - ok
23:14:45.0272 5280 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys
23:14:45.0287 5280 uagp35 - ok
23:14:45.0303 5280 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys
23:14:45.0350 5280 udfs - ok
23:14:45.0365 5280 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe
23:14:45.0396 5280 UI0Detect - ok
23:14:45.0443 5280 [ BE788A747457E6916586C410EC0111E7 ] UleadBurningHelper C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
23:14:45.0459 5280 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - warning
23:14:45.0459 5280 UleadBurningHelper - detected UnsignedFile.Multi.Generic (1)
23:14:45.0490 5280 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys
23:14:45.0521 5280 uliagpkx - ok
23:14:45.0537 5280 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys
23:14:45.0568 5280 umbus - ok
23:14:45.0568 5280 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys
23:14:45.0599 5280 UmPass - ok
23:14:45.0615 5280 [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService C:\Windows\System32\umrdp.dll
23:14:45.0646 5280 UmRdpService - ok
23:14:45.0740 5280 [ A69CD6BDB82872999D2E46F9324ADA83 ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
23:14:45.0818 5280 UNS - ok
23:14:45.0833 5280 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll
23:14:45.0880 5280 upnphost - ok
23:14:45.0896 5280 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys
23:14:45.0927 5280 usbccgp - ok
23:14:45.0942 5280 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys
23:14:45.0974 5280 usbcir - ok
23:14:45.0989 5280 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\DRIVERS\usbehci.sys
23:14:46.0005 5280 usbehci - ok
23:14:46.0036 5280 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys
23:14:46.0052 5280 usbhub - ok
23:14:46.0067 5280 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys
23:14:46.0098 5280 usbohci - ok
23:14:46.0130 5280 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\DRIVERS\usbprint.sys
23:14:46.0161 5280 usbprint - ok
23:14:46.0192 5280 [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan C:\Windows\system32\DRIVERS\usbscan.sys
23:14:46.0223 5280 usbscan - ok
23:14:46.0239 5280 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:14:46.0270 5280 USBSTOR - ok
23:14:46.0286 5280 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys
23:14:46.0301 5280 usbuhci - ok
23:14:46.0332 5280 [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo C:\Windows\system32\Drivers\usbvideo.sys
23:14:46.0364 5280 usbvideo - ok
23:14:46.0395 5280 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll
23:14:46.0457 5280 UxSms - ok
23:14:46.0457 5280 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe
23:14:46.0473 5280 VaultSvc - ok
23:14:46.0488 5280 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys
23:14:46.0504 5280 vdrvroot - ok
23:14:46.0520 5280 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe
23:14:46.0566 5280 vds - ok
23:14:46.0582 5280 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys
23:14:46.0598 5280 vga - ok
23:14:46.0613 5280 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys
23:14:46.0644 5280 VgaSave - ok
23:14:46.0660 5280 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys
23:14:46.0660 5280 vhdmp - ok
23:14:46.0676 5280 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys
23:14:46.0676 5280 viaide - ok
23:14:46.0691 5280 VIPAppService - ok
23:14:46.0691 5280 [ 86EA3E79AE350FEA5331A1303054005F ] vmbus C:\Windows\system32\drivers\vmbus.sys
23:14:46.0707 5280 vmbus - ok
23:14:46.0707 5280 [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID C:\Windows\system32\drivers\VMBusHID.sys
23:14:46.0722 5280 VMBusHID - ok
23:14:46.0738 5280 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys
23:14:46.0754 5280 volmgr - ok
23:14:46.0769 5280 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys
23:14:46.0785 5280 volmgrx - ok
23:14:46.0785 5280 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys
23:14:46.0800 5280 volsnap - ok
23:14:46.0832 5280 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys
23:14:46.0847 5280 vsmraid - ok
23:14:46.0894 5280 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe
23:14:46.0972 5280 VSS - ok
23:14:46.0972 5280 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\system32\DRIVERS\vwifibus.sys
23:14:47.0003 5280 vwifibus - ok
23:14:47.0019 5280 [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt C:\Windows\system32\DRIVERS\vwififlt.sys
23:14:47.0050 5280 vwififlt - ok
23:14:47.0081 5280 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll
23:14:47.0112 5280 W32Time - ok
23:14:47.0128 5280 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys
23:14:47.0144 5280 WacomPen - ok
23:14:47.0190 5280 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys
23:14:47.0253 5280 WANARP - ok
23:14:47.0253 5280 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys
23:14:47.0284 5280 Wanarpv6 - ok
23:14:47.0346 5280 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe
23:14:47.0440 5280 wbengine - ok
23:14:47.0456 5280 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll
23:14:47.0471 5280 WbioSrvc - ok
23:14:47.0487 5280 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll
23:14:47.0518 5280 wcncsvc - ok
23:14:47.0534 5280 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
23:14:47.0565 5280 WcsPlugInService - ok
23:14:47.0596 5280 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys
23:14:47.0627 5280 Wd - ok
23:14:47.0658 5280 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys
23:14:47.0674 5280 Wdf01000 - ok
23:14:47.0690 5280 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll
23:14:47.0768 5280 WdiServiceHost - ok
23:14:47.0768 5280 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll
23:14:47.0783 5280 WdiSystemHost - ok
23:14:47.0814 5280 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll
23:14:47.0846 5280 WebClient - ok
23:14:47.0861 5280 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll
23:14:47.0908 5280 Wecsvc - ok
23:14:47.0924 5280 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll
23:14:47.0970 5280 wercplsupport - ok
23:14:47.0986 5280 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll
23:14:48.0017 5280 WerSvc - ok
23:14:48.0048 5280 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys
23:14:48.0080 5280 WfpLwf - ok
23:14:48.0095 5280 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys
23:14:48.0111 5280 WIMMount - ok
23:14:48.0126 5280 WinDefend - ok
23:14:48.0142 5280 WinHttpAutoProxySvc - ok
23:14:48.0189 5280 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll
23:14:48.0220 5280 Winmgmt - ok
23:14:48.0282 5280 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll
23:14:48.0345 5280 WinRM - ok
23:14:48.0376 5280 [ FE88B288356E7B47B74B13372ADD906D ] WinUsb C:\Windows\system32\DRIVERS\WinUSB.sys
23:14:48.0407 5280 WinUsb - ok
23:14:48.0423 5280 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll
23:14:48.0470 5280 Wlansvc - ok
23:14:48.0516 5280 [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
23:14:48.0516 5280 wlcrasvc - ok
23:14:48.0610 5280 [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
23:14:48.0704 5280 wlidsvc - ok
23:14:48.0719 5280 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\DRIVERS\wmiacpi.sys
23:14:48.0750 5280 WmiAcpi - ok
23:14:48.0782 5280 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe
23:14:48.0797 5280 wmiApSrv - ok
23:14:48.0828 5280 WMPNetworkSvc - ok
23:14:48.0860 5280 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll
23:14:48.0891 5280 WPCSvc - ok
23:14:48.0906 5280 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll
23:14:48.0922 5280 WPDBusEnum - ok
23:14:48.0953 5280 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys
23:14:48.0984 5280 ws2ifsl - ok
23:14:49.0000 5280 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll
23:14:49.0016 5280 wscsvc - ok
23:14:49.0016 5280 WSearch - ok
23:14:49.0094 5280 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll
23:14:49.0156 5280 wuauserv - ok
23:14:49.0172 5280 [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf C:\Windows\system32\drivers\WudfPf.sys
23:14:49.0203 5280 WudfPf - ok
23:14:49.0218 5280 [ CF8D590BE3373029D57AF80914190682 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys
23:14:49.0265 5280 WUDFRd - ok
23:14:49.0281 5280 [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc C:\Windows\System32\WUDFSvc.dll
23:14:49.0312 5280 wudfsvc - ok
23:14:49.0328 5280 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll
23:14:49.0359 5280 WwanSvc - ok
23:14:49.0390 5280 ================ Scan global ===============================
23:14:49.0421 5280 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
23:14:49.0452 5280 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
23:14:49.0468 5280 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
23:14:49.0499 5280 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
23:14:49.0515 5280 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
23:14:49.0530 5280 [Global] - ok
23:14:49.0530 5280 ================ Scan MBR ==================================
23:14:49.0546 5280 [ CB28A275E2DDF97FA2C27AC353685C47 ] \Device\Harddisk0\DR0
23:14:49.0780 5280 \Device\Harddisk0\DR0 - ok
23:14:49.0780 5280 ================ Scan VBR ==================================
23:14:49.0780 5280 [ 0B5F710D4C65D6BC9CFD628D57A4498E ] \Device\Harddisk0\DR0\Partition1
23:14:49.0796 5280 \Device\Harddisk0\DR0\Partition1 - ok
23:14:49.0811 5280 [ 833F7F71AB4876D9719123BB61413325 ] \Device\Harddisk0\DR0\Partition2
23:14:49.0811 5280 \Device\Harddisk0\DR0\Partition2 - ok
23:14:49.0842 5280 [ 5B71D72B5D0E2FC0AF551CB87A70B6D5 ] \Device\Harddisk0\DR0\Partition3
23:14:49.0842 5280 \Device\Harddisk0\DR0\Partition3 - ok
23:14:49.0842 5280 ============================================================
23:14:49.0842 5280 Scan finished
23:14:49.0842 5280 ============================================================
23:14:49.0842 5328 Detected object count: 6
23:14:49.0842 5328 Actual detected object count: 6
23:17:53.0868 5328 hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
23:17:53.0868 5328 hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
23:17:53.0868 5328 hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
23:17:53.0868 5328 hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
23:17:53.0868 5328 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
23:17:53.0868 5328 Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
23:17:53.0868 5328 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
23:17:53.0878 5328 Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
23:17:53.0878 5328 SUService ( UnsignedFile.Multi.Generic ) - skipped by user
23:17:53.0878 5328 SUService ( UnsignedFile.Multi.Generic ) - User select action: Skip
23:17:53.0878 5328 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - skipped by user
23:17:53.0878 5328 UleadBurningHelper ( UnsignedFile.Multi.Generic ) - User select action: Skip
23:46:23.0669 2964 Deinitialize success
|
|
21.08.2012, 14:11
| #18 | |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Dann bitte jetzt CF ausführen:
__________________ComboFix Ein Leitfaden und Tutorium zur Nutzung von ComboFix
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat! Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie Zitat:
__________________ |
|
21.08.2012, 17:05
| #19 |
| | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Hier das Log [code] Combofix Logfile: Code:
ATTFilter ComboFix 12-08-20.02 - *** 21.08.2012 15:25:58.1.4 - x64
Microsoft Windows 7 Professional 6.1.7601.1.1252.49.1031.18.3979.2540 [GMT 2:00]
ausgeführt von:: c:\users\***\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((((((((((((((( Weitere Löschungen ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk
c:\programdata\Roaming
C:\root
c:\root\wpfdot.exe
c:\users\***\AppData\Local\assembly\tmp
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\A Rebel's Dream-1999\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\African Herbsman-1970\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Babylon By Bus-1978\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Best Of The Wailers-1967-1972\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Bob Marley - Best of\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Bob Marley & Peter Tosh\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Burnin'-1973\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Chant Down Babylon-1999\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Confrontation-1983\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Exodus-1977\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Kaya-1978\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Keep On Skanking-1967\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Legend-1994\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Legend (Best Of)\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Legend\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Live At Rockpalast-1980\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Live Jam 12-2-73\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Natural Mystic-1995\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\One Love-The Very Best of Bob Marley & the Wailers-2002\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Rastaman Vibration-1976\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Rebel Music-2001\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Rock to the Rock-1973\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Satisfy My Soul-1972\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Selassie is the Chapel-1999\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Shakedown Marley Remixed Vol 1 (2001)\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Survival-1979\_desktop.ini
c:\users\***\Meins\Kram\Musik\Anderes\Bob Marley\Uprising-1980\_desktop.ini
c:\users\***\Meins\Kram\Musik\Metal\Arch Enemy\Doomsday Machine\_desktop.ini
c:\users\***\Meins\Kram\Musik\Metal\Arch Enemy\Rise of the Tyrant\_desktop.ini
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-07-21 bis 2012-08-21 ))))))))))))))))))))))))))))))
.
.
2012-08-21 13:51 . 2012-08-21 13:51 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-08-21 13:16 . 2012-08-21 13:16 69000 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83F25CBB-3D80-486D-9D23-C6EC08249672}\offreg.dll
2012-08-21 13:09 . 2012-08-01 22:58 9309624 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{83F25CBB-3D80-486D-9D23-C6EC08249672}\mpengine.dll
2012-08-19 16:51 . 2012-08-19 16:51 -------- d-----w- C:\_OTL
2012-08-16 14:04 . 2012-08-16 14:04 -------- d-----w- c:\program files (x86)\ESET
2012-08-15 22:57 . 2012-06-29 03:51 887296 ----a-w- c:\program files\Internet Explorer\iedvtool.dll
2012-08-15 22:57 . 2012-06-29 03:50 499200 ----a-w- c:\program files\Internet Explorer\jsdbgui.dll
2012-08-15 22:57 . 2012-06-29 00:10 678912 ----a-w- c:\program files (x86)\Internet Explorer\iedvtool.dll
2012-08-15 22:57 . 2012-06-29 00:10 387584 ----a-w- c:\program files (x86)\Internet Explorer\jsdbgui.dll
2012-08-15 22:57 . 2012-06-29 04:55 17809920 ----a-w- c:\windows\system32\mshtml.dll
2012-08-15 22:57 . 2012-06-29 04:09 10925568 ----a-w- c:\windows\system32\ieframe.dll
2012-08-15 22:50 . 2012-05-05 08:36 503808 ----a-w- c:\windows\system32\srcore.dll
2012-08-15 22:50 . 2012-05-05 07:46 43008 ----a-w- c:\windows\SysWow64\srclient.dll
2012-08-15 22:50 . 2012-02-11 06:43 751104 ----a-w- c:\windows\system32\win32spl.dll
2012-08-15 22:50 . 2012-02-11 06:36 559104 ----a-w- c:\windows\system32\spoolsv.exe
2012-08-15 22:50 . 2012-02-11 06:36 67072 ----a-w- c:\windows\splwow64.exe
2012-08-15 22:50 . 2012-02-11 05:43 492032 ----a-w- c:\windows\SysWow64\win32spl.dll
2012-08-15 22:46 . 2012-07-04 22:16 73216 ----a-w- c:\windows\system32\netapi32.dll
2012-08-15 22:46 . 2012-07-04 22:13 59392 ----a-w- c:\windows\system32\browcli.dll
2012-08-15 22:46 . 2012-07-04 22:13 136704 ----a-w- c:\windows\system32\browser.dll
2012-08-15 22:46 . 2012-07-04 21:14 41984 ----a-w- c:\windows\SysWow64\browcli.dll
2012-08-15 22:44 . 2012-07-18 18:15 3148800 ----a-w- c:\windows\system32\win32k.sys
2012-08-15 22:44 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll
2012-08-13 09:22 . 2012-08-13 09:22 -------- d-----w- c:\program files\7-Zip
2012-08-07 21:08 . 2012-08-07 21:08 -------- d-----w- c:\users\***\AppData\Roaming\Canneverbe Limited
2012-08-07 21:08 . 2012-08-07 21:08 -------- d-----w- c:\programdata\Canneverbe Limited
2012-08-07 21:08 . 2012-08-07 21:08 -------- d-----w- c:\program files (x86)\CDBurnerXP
2012-08-07 20:46 . 2012-08-07 20:56 -------- d-----w- c:\users\***\AppData\Roaming\DVDVideoSoft
2012-08-07 20:46 . 2012-08-07 20:46 -------- d-----w- c:\program files (x86)\Common Files\DVDVideoSoft
2012-08-07 20:46 . 2012-08-07 20:46 -------- d-----w- c:\program files (x86)\DVDVideoSoft
2012-07-24 11:50 . 2012-07-05 11:02 95744 ----a-w- c:\windows\system32\pdfcmon.dll
2012-07-24 11:50 . 2004-03-08 23:00 662288 ----a-w- c:\windows\SysWow64\MSCOMCT2.OCX
2012-07-24 11:50 . 1998-06-23 23:00 137000 ----a-w- c:\windows\SysWow64\MSMAPI32.OCX
2012-07-24 11:50 . 2012-07-24 11:50 -------- d-----w- c:\program files (x86)\PDFCreator
2012-07-24 11:50 . 1998-07-06 16:56 125712 ----a-w- c:\windows\SysWow64\VB6DE.DLL
2012-07-24 11:50 . 1998-07-06 16:55 158208 ----a-w- c:\windows\SysWow64\MSCMCDE.DLL
2012-07-24 11:50 . 1998-07-06 16:55 64512 ----a-w- c:\windows\SysWow64\MSCC2DE.DLL
2012-07-24 11:50 . 1998-07-05 23:00 23552 ----a-w- c:\windows\SysWow64\MSMPIDE.DLL
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-15 22:27 . 2012-03-28 23:22 70344 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-15 22:27 . 2012-03-28 23:22 426184 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe
2012-07-03 11:46 . 2012-04-21 17:59 24904 ----a-w- c:\windows\system32\drivers\mbam.sys
2012-06-09 05:43 . 2012-07-11 19:05 14172672 ----a-w- c:\windows\system32\shell32.dll
2012-06-06 18:59 . 2012-06-06 18:59 1070152 ----a-w- c:\windows\SysWow64\MSCOMCTL.OCX
2012-06-06 06:06 . 2012-07-11 19:05 2004480 ----a-w- c:\windows\system32\msxml6.dll
2012-06-06 06:06 . 2012-07-11 19:05 1881600 ----a-w- c:\windows\system32\msxml3.dll
2012-06-06 06:02 . 2012-07-11 19:05 1133568 ----a-w- c:\windows\system32\cdosys.dll
2012-06-06 05:05 . 2012-07-11 19:05 1390080 ----a-w- c:\windows\SysWow64\msxml6.dll
2012-06-06 05:05 . 2012-07-11 19:05 1236992 ----a-w- c:\windows\SysWow64\msxml3.dll
2012-06-06 05:03 . 2012-07-11 19:05 805376 ----a-w- c:\windows\SysWow64\cdosys.dll
2012-06-04 07:25 . 2012-06-04 07:26 476960 ----a-w- c:\windows\SysWow64\npdeployJava1.dll
2012-06-04 07:25 . 2012-06-04 07:26 472864 ----a-w- c:\windows\SysWow64\deployJava1.dll
2012-06-02 22:19 . 2012-06-22 16:31 38424 ----a-w- c:\windows\system32\wups.dll
2012-06-02 22:19 . 2012-06-22 16:31 2428952 ----a-w- c:\windows\system32\wuaueng.dll
2012-06-02 22:19 . 2012-06-22 16:31 57880 ----a-w- c:\windows\system32\wuauclt.exe
2012-06-02 22:19 . 2012-06-22 16:31 44056 ----a-w- c:\windows\system32\wups2.dll
2012-06-02 22:19 . 2012-06-22 16:31 701976 ----a-w- c:\windows\system32\wuapi.dll
2012-06-02 22:15 . 2012-06-22 16:31 2622464 ----a-w- c:\windows\system32\wucltux.dll
2012-06-02 22:15 . 2012-06-22 16:31 99840 ----a-w- c:\windows\system32\wudriver.dll
2012-06-02 13:19 . 2012-06-22 16:31 186752 ----a-w- c:\windows\system32\wuwebv.dll
2012-06-02 13:15 . 2012-06-22 16:31 36864 ----a-w- c:\windows\system32\wuapp.exe
2012-06-02 05:50 . 2012-07-11 19:05 458704 ----a-w- c:\windows\system32\drivers\cng.sys
2012-06-02 05:48 . 2012-07-11 19:05 95600 ----a-w- c:\windows\system32\drivers\ksecdd.sys
2012-06-02 05:48 . 2012-07-11 19:05 151920 ----a-w- c:\windows\system32\drivers\ksecpkg.sys
2012-06-02 05:45 . 2012-07-11 19:05 340992 ----a-w- c:\windows\system32\schannel.dll
2012-06-02 05:44 . 2012-07-11 19:05 307200 ----a-w- c:\windows\system32\ncrypt.dll
2012-06-02 04:40 . 2012-07-11 19:05 22016 ----a-w- c:\windows\SysWow64\secur32.dll
2012-06-02 04:40 . 2012-07-11 19:05 225280 ----a-w- c:\windows\SysWow64\schannel.dll
2012-06-02 04:39 . 2012-07-11 19:05 219136 ----a-w- c:\windows\SysWow64\ncrypt.dll
2012-06-02 04:34 . 2012-07-11 19:05 96768 ----a-w- c:\windows\SysWow64\sspicli.dll
2012-05-31 10:25 . 2010-11-21 03:27 279656 ------w- c:\windows\system32\MpSigStub.exe
.
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"LTT"="c:\program files\PC-Doctor\EnableToolbarW32.exe" [2011-06-27 23120]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808]
"PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2011-08-31 1629544]
"Lenovo Registration"="c:\program files (x86)\Lenovo Registration\LenovoReg.exe" [2011-07-13 4351712]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-13 348664]
"WinampAgent"="c:\program files (x86)\Winamp\winampa.exe" [2011-12-09 74752]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2011-05-10 49208]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-03-27 37296]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-02 843712]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OneNote 2007 Bildschirmausschnitt- und Startprogramm.lnk - c:\program files (x86)\Microsoft Office\Office12\ONENOTEM.EXE [2009-2-26 97680]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2010-12-18 1202976]
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages REG_MULTI_SZ scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
Security Packages REG_MULTI_SZ kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 HyperW7Svc;HyperW7 Service;c:\program files\Lenovo\RapidBoot\HyperW7Svc64.exe [2011-07-08 144232]
R2 VIPAppService;VIPAppService;c:\program files (x86)\Symantec\VIP Access Client\VIPAppService.exe [x]
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-08-15 250056]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys [2010-11-21 71168]
R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [2011-08-31 478056]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-07-20 113120]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [2011-08-31 87400]
R3 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [2011-08-31 173416]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-22 57184]
S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys [2011-08-31 31344]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys [2010-12-15 23664]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-09-16 27760]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys [2010-09-07 15472]
S1 PHCORE;PHCORE;c:\program files\Lenovo\RapidBoot\PHCORE64.SYS [2011-07-08 32104]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-08 86224]
S2 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-05-08 465360]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe [2010-12-16 198784]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [2011-02-23 212944]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [2011-05-31 41320]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [2011-07-12 101736]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [2011-05-31 59240]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [2011-07-12 133992]
S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys [2011-05-25 101888]
S2 SAService;Conexant SmartAudio service;c:\windows\system32\SAsrv.exe [x]
S2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [2009-03-13 13840]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [2011-07-12 145256]
S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [2011-07-12 142696]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-01-17 2656280]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys [2011-03-04 166016]
S3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys [2010-12-18 425000]
S3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys [2010-12-18 39464]
S3 e1cexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver C;c:\windows\system32\DRIVERS\e1c62x64.sys [2010-12-20 316080]
S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-08-18 317440]
S3 MEIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2010-10-19 56344]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link der Serie 5000 Adaptertreiber für Windows 7 64-Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2011-08-03 8604672]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys [2009-09-24 41536]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt REG_MULTI_SZ hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-08-21 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-28 22:27]
.
2012-08-16 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:06]
.
2012-08-21 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:06]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"="TpShocks.exe" [2010-12-09 380776]
"ForteConfig"="c:\program files\Conexant\ForteConfig\fmapp.exe" [2010-10-26 49056]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2011-03-14 316032]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-08-18 165456]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-08-18 392472]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-08-18 416024]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2011-05-31 40808]
"ALCKRESI.EXE"="c:\program files\Lenovo\AutoLock\ALCKRESI.EXE" [2011-05-25 281960]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.com/ig/redirectdomain?brand=LENP&bmod=LENP
uLocal Page = c:\windows\system32\blank.htm
mLocal Page = c:\windows\SysWOW64\blank.htm
IE: Bild an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie_ctx.htm
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Google Sidewiki... - c:\program files (x86)\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_43C348BC2E93EB2B.dll/cmsidewiki.html
IE: Nach Microsoft E&xel exportieren - c:\progra~2\MICROS~3\Office12\EXCEL.EXE/3000
IE: Seite an &Bluetooth-Gerät senden... - c:\program files\ThinkPad\Bluetooth Software\btsendto_ie.htm
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\xldqboj9.default\
FF - prefs.js: browser.search.selectedEngine - LEO Eng-Deu
FF - prefs.js: browser.startup.homepage - hxxp://www.tagesschau.de/
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil10c.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\LocalServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\FlashUtil10c.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{19114156-8E9A-4D4E-9EE9-17A0E48D3BBB}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWow64\\Macromed\\Flash\\Flash10c.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}]
@Denied: (A 2) (Everyone)
@="IFlashBroker3"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{1D4C8A81-B7AC-460A-8C23-98713C41D6B3}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-08-21 16:42:36
ComboFix-quarantined-files.txt 2012-08-21 14:42
.
Vor Suchlauf: 13 Verzeichnis(se), 296.509.628.416 Bytes frei
Nach Suchlauf: 17 Verzeichnis(se), 295.996.768.256 Bytes frei
.
- - End Of File - - 1845D1971318DC910A302484A80B2D46
|
|
30.08.2012, 11:49
| #20 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Bitte nun Logs mit GMER und OSAM erstellen und posten. GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen. Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst. Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM! Downloade dir bitte  aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none). Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes: Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
30.08.2012, 21:10
| #21 |
| | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Hallo cosinus, schön, dass du zurück bist. Ich hoffe, du hattest nen guten Urlaub. Wegen Gmer: In der Anleitung "Für alle Hilfesuchenden" steht, man sollte das nur bei einer 32 bit Version ausführen. Ich hab aber eine 64 bit Version. Soll ich GMER trotzdem scannen lassen? |
|
30.08.2012, 23:35
| #23 |
| | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 GMER: [code] GMER Logfile: Code:
ATTFilter GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-08-30 23:19:11
Windows 6.1.7601 Service Pack 1
Running: 5jndgrcl.exe
---- Registry - GMER 1.0.15 ----
Reg HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\60d819afb7b3
Reg HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\60d819afb7b3 (not active ControlSet)
---- EOF - GMER 1.0.15 ----
OSAM: Code:
ATTFilter OSAM Logfile: Code:
ATTFilter aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-30 23:42:03
-----------------------------
23:42:03.462 OS Version: Windows x64 6.1.7601 Service Pack 1
23:42:03.462 Number of processors: 4 586 0x2A07
23:42:03.462 ComputerName: THINK-Y UserName: ***
23:42:04.922 Initialize success
23:48:02.237 AVAST engine defs: 12083001
00:02:48.558 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
00:02:48.558 Disk 0 Vendor: HITACHI_ JF3Z Size: 476940MB BusType: 3
00:02:48.568 Disk 0 MBR read successfully
00:02:48.568 Disk 0 MBR scan
00:02:48.568 Disk 0 unknown MBR code
00:02:48.578 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 1500 MB offset 2048
00:02:48.588 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 459438 MB offset 3074048
00:02:48.628 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 16000 MB offset 944003072
00:02:48.688 Disk 0 scanning C:\Windows\system32\drivers
00:02:56.608 Service scanning
00:03:19.708 Modules scanning
00:03:19.718 Disk 0 trace - called modules:
00:03:19.738 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
00:03:19.748 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005fc8060]
00:03:19.758 3 CLASSPNP.SYS[fffff88001b9243f] -> nt!IofCallDriver -> [0xfffffa80044c1e40]
00:03:19.768 5 ACPI.sys[fffff88000f967a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80044ce050]
00:03:20.818 AVAST engine scan C:\Windows
00:03:24.178 AVAST engine scan C:\Windows\system32
00:05:38.478 AVAST engine scan C:\Windows\system32\drivers
00:05:48.048 AVAST engine scan C:\Users\***
00:27:42.002 AVAST engine scan C:\ProgramData
00:29:52.608 Scan finished successfully
00:31:03.299 Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"
00:31:03.299 The log file has been saved successfully to "C:\Users\***\Desktop\aswMBR.txt"
|
|
31.08.2012, 10:45
| #24 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht. Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar. Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR. Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm! Anschließend Windows neu starten und ein neues Log mit aswMBR machen.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
31.08.2012, 20:59
| #25 |
| | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Hier das Log: Code:
ATTFilter aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-08-31 21:28:52
-----------------------------
21:28:52.543 OS Version: Windows x64 6.1.7601 Service Pack 1
21:28:52.543 Number of processors: 4 586 0x2A07
21:28:52.543 ComputerName: THINK-Y UserName: ***
21:28:53.820 Initialize success
21:29:02.657 AVAST engine defs: 12083001
21:29:14.461 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
21:29:14.461 Disk 0 Vendor: HITACHI_ JF3Z Size: 476940MB BusType: 3
21:29:14.492 Disk 0 MBR read successfully
21:29:14.492 Disk 0 MBR scan
21:29:14.507 Disk 0 Windows 7 default MBR code
21:29:14.523 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 1500 MB offset 2048
21:29:14.539 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 459438 MB offset 3074048
21:29:14.570 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 16000 MB offset 944003072
21:29:14.632 Disk 0 scanning C:\Windows\system32\drivers
21:29:22.245 Service scanning
21:29:43.742 Modules scanning
21:29:43.757 Disk 0 trace - called modules:
21:29:43.773 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
21:29:43.773 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8005fc9060]
21:29:43.789 3 CLASSPNP.SYS[fffff88001b9343f] -> nt!IofCallDriver -> [0xfffffa80036a6040]
21:29:43.789 5 ACPI.sys[fffff88000f2e7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80040d6050]
21:29:45.130 AVAST engine scan C:\Windows
21:29:48.718 AVAST engine scan C:\Windows\system32
21:32:15.998 AVAST engine scan C:\Windows\system32\drivers
21:32:25.748 AVAST engine scan C:\Users\***
21:53:03.094 AVAST engine scan C:\ProgramData
21:55:07.239 Scan finished successfully
21:56:56.408 Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat"
21:56:56.423 The log file has been saved successfully to "C:\Users\***\Desktop\aswMBR.txt"
|
|
01.09.2012, 10:00
| #26 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!!
__________________ Logfiles bitte immer in CODE-Tags posten |
|
02.09.2012, 17:27
| #27 |
| | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Hier das Log von Malwarebytes: Code:
ATTFilter Malwarebytes Anti-Malware 1.62.0.1300 www.malwarebytes.org Datenbank Version: v2012.09.02.03 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 *** :: THINK-Y [Administrator] 02.09.2012 15:26:58 mbam-log-2012-09-02 (15-26-58).txt Art des Suchlaufs: Vollständiger Suchlauf (C:\|Q:\|) Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 374477 Laufzeit: 40 Minute(n), 49 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) Code:
ATTFilter SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com
Generated 09/02/2012 at 06:17 PM
Application Version : 5.5.1012
Core Rules Database Version : 9166
Trace Rules Database Version: 6978
Scan type : Complete Scan
Total Scan Time : 01:55:25
Operating System Information
Windows 7 Professional 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Administrator
Memory items scanned : 745
Memory threats detected : 0
Registry items scanned : 67015
Registry threats detected : 0
File items scanned : 179843
File threats detected : 58
Adware.Tracking Cookie
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\KYBIQQAE.txt [ /zanox.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\9FIJ9OJ4.txt [ /imrworldwide.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\X7R47SV0.txt [ /fastclick.net ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\RQHDBG1A.txt [ /adfarm1.adition.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\1JDLNMI7.txt [ /www.zanox-affiliate.de ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\BIUX72TP.txt [ /atdmt.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\US7V7L3C.txt [ /tracking.quisma.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\H7U7063S.txt [ /doubleclick.net ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\4JJWIFYQ.txt [ /www.etracker.de ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\9O9X49MV.txt [ /ad1.adfarm1.adition.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\G1AI2JBL.txt [ /adform.net ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\R24U15IL.txt [ /apmebf.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\VS8OZRKG.txt [ /2o7.net ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\BXDJEYTH.txt [ /ad.zanox.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\SETGU0YG.txt [ /track.adform.net ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\GEHQQLPG.txt [ /smartadserver.com ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\01LF626D.txt [ /zanox-affiliate.de ]
C:\Users\***\AppData\Roaming\Microsoft\Windows\Cookies\9SWV1UUL.txt [ /mediaplex.com ]
C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\Low\97QDF4F8.txt [ Cookie:***@statse.webtrendslive.com/ ]
C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\Low\SS0Y7GYF.txt [ Cookie:***@specificclick.net/ ]
C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\Low\RV4Z87FL.txt [ Cookie:***@doubleclick.net/ ]
C:\USERS\***\AppData\Roaming\Microsoft\Windows\Cookies\Low\EB42L1J1.txt [ Cookie:***@adviva.net/ ]
C:\USERS\***\Cookies\KYBIQQAE.txt [ Cookie:***@zanox.com/ ]
C:\USERS\***\Cookies\9FIJ9OJ4.txt [ Cookie:***@imrworldwide.com/cgi-bin ]
C:\USERS\***\Cookies\X7R47SV0.txt [ Cookie:***@fastclick.net/ ]
C:\USERS\***\Cookies\RQHDBG1A.txt [ Cookie:***@adfarm1.adition.com/ ]
C:\USERS\***\Cookies\1JDLNMI7.txt [ Cookie:***@www.zanox-affiliate.de/ ]
C:\USERS\***\Cookies\BIUX72TP.txt [ Cookie:***@atdmt.com/ ]
C:\USERS\***\Cookies\US7V7L3C.txt [ Cookie:***@tracking.quisma.com/ ]
C:\USERS\***\Cookies\H7U7063S.txt [ Cookie:***@doubleclick.net/ ]
C:\USERS\***\Cookies\4JJWIFYQ.txt [ Cookie:***@www.etracker.de/ ]
C:\USERS\***\Cookies\9O9X49MV.txt [ Cookie:***@ad1.adfarm1.adition.com/ ]
C:\USERS\***\Cookies\G1AI2JBL.txt [ Cookie:***@adform.net/ ]
C:\USERS\***\Cookies\VS8OZRKG.txt [ Cookie:***@2o7.net/ ]
C:\USERS\***\Cookies\GEHQQLPG.txt [ Cookie:***@smartadserver.com/ ]
C:\USERS\***\Cookies\01LF626D.txt [ Cookie:***@zanox-affiliate.de/ ]
C:\USERS\***\Cookies\9SWV1UUL.txt [ Cookie:***@mediaplex.com/ ]
.atdmt.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.atdmt.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.doubleclick.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
ad4.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.revsci.net [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.adbrite.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
audit.median.hu [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
fl01.ct2.comclick.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
fl01.ct2.comclick.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
ad3.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
.adfarm1.adition.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
m1.webstats.motigo.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
m1.webstats.motigo.com [ C:\USERS\***\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\XLDQBOJ9.DEFAULT\COOKIES.SQLITE ]
|
|
03.09.2012, 19:24
| #28 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Sieht ok aus, da wurden nur Cookies gefunden. Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie ) Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat. Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/ Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird. Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da. Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?
__________________ Logfiles bitte immer in CODE-Tags posten |
|
04.09.2012, 17:04
| #29 |
| | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Hm. Und ich hab FF schon so eingestellt, dass ich vor jedem Cookie gefragt werde, ob es gesetzt werden darf. Aber da ist ja echt einiges drauf. Ich werd mir deine Links mal durchlesen und überlegen, wie ich das in Zukunft handhabe. Ansonsten funktioniert der PC einwandfrei und es gibt keine Probleme mehr. Deshalb ein fettes  an dich! Du hast mir super weitergeholfen!!!  Vielen, vielen Dank! |
|
04.09.2012, 19:14
| #30 |
| /// Winkelfunktion /// TB-Süch-Tiger™ | 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 Dann wären wir durch!  Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen: Starte bitte OTL und klicke auf Bereinigung. Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen. Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken. Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden. Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern. Microsoftupdate Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren. Windows Vista/7: Anleitung Windows-Update PDF-Reader aktualisieren Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast) Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader. Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers: Prüfen => Adobe - Flash Player Downloadlinks => Adobe Flash Player Distribution | Adobe Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind. Java-Update Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.
__________________ Logfiles bitte immer in CODE-Tags posten |
|
| Themen zu 2 Trojaner auf PC: TR/ATRAPS.Gen2 und TR/Rogue.kdv.695183 |
| 'tr/atraps.gen2', .dll, administratorrechte, adobe, antivir, avira searchfree toolbar, bho, converter, desktop, e-banking, flash player, lenovo, logfile, mozilla, mp3, neustart, plug-in, problem, programm, prozesse, pwmtr64v.dll, registry, rundll, starten, svchost.exe, symantec, temp, trojan, trojaner, verweise, virus, windows |
Linear-Darstellung
