Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 02.10.2014, 12:59   #1
Büromagnet
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Hallo liebe Helfer,

hab eben Iconpacks für mein Handy heruntergeladen und mir eines mit Trojaner unterjubeln lassen. Avira hat gleich Alarm geschlagen und ihn in Quarantäne verschoben, habe dann trotzdem noch einen Suchlauf mit Malwarebytes gemacht.

Code:
ATTFilter
Avira Free Antivirus
Erstellungsdatum der Reportdatei: Donnerstag, 2. Oktober 2014  11:41


Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer   : Avira Antivirus Free
Seriennummer   : 0000149996-AVHOE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus     : Normal gebootet
Benutzername   : Admin
Computername   : W520

Versionsinformationen:
BUILD.DAT      : 14.0.6.570     92022 Bytes  15.08.2014 10:30:00
AVSCAN.EXE     : 14.0.6.548   1046608 Bytes  07.08.2014 08:33:29
AVSCANRC.DLL   : 14.0.6.522     62544 Bytes  07.08.2014 08:33:29
LUKE.DLL       : 14.0.6.522     57936 Bytes  07.08.2014 08:33:40
AVSCPLR.DLL    : 14.0.6.548     92752 Bytes  07.08.2014 08:33:30
AVREG.DLL      : 14.0.6.522    262224 Bytes  07.08.2014 08:33:28
avlode.dll     : 14.0.6.526    603728 Bytes  07.08.2014 08:33:27
avlode.rdf     : 14.0.4.46      64835 Bytes  10.09.2014 10:54:04
XBV00010.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00011.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00012.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00013.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00014.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00015.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00016.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00017.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00018.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00019.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00020.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00021.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00022.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:14
XBV00023.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00024.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00025.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00026.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00027.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00028.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00029.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00030.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00031.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00032.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00033.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00034.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00035.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00036.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00037.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00038.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00039.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00040.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00041.VDF   : 8.11.165.190     2048 Bytes  07.08.2014 14:33:15
XBV00058.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00059.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00060.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00061.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00062.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00063.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00064.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00065.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00066.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00067.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00068.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00069.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00070.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00071.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00072.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00073.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:16
XBV00074.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00075.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00076.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00077.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00078.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00079.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00080.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00081.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00082.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00083.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00084.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00085.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00086.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00087.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00088.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00089.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00090.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00091.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00092.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00093.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00094.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00095.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:17
XBV00096.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00097.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00098.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00099.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00100.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00101.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00102.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00103.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00104.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00105.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00106.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00107.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00108.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00109.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00110.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00111.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00112.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00113.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00114.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00115.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00116.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:18
XBV00117.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00118.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00119.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00120.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00121.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00122.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00123.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00124.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00125.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00126.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00127.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00128.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00129.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00130.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00131.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00132.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00133.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00134.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:19
XBV00135.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00136.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00137.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00138.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00139.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00140.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00141.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00142.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00143.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00144.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00145.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00146.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00147.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00148.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00149.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00150.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00151.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00152.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:20
XBV00153.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00154.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00155.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00156.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00157.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00158.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00159.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00160.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00161.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00162.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00163.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00164.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00165.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00166.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00167.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00168.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00169.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00170.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00171.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:21
XBV00172.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00173.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00174.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00175.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00176.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00177.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00178.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00179.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00180.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00181.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00182.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00183.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00184.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00185.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00186.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00187.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00188.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00189.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00190.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00191.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00192.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00193.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00194.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00195.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00196.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00197.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00198.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:22
XBV00199.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00200.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00201.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00202.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00203.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00204.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00205.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00206.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00207.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00208.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00209.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00210.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00211.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00212.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00213.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00214.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00215.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00216.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00217.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00218.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00219.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00220.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00221.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00222.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00223.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00224.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00225.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00226.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00227.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00228.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00229.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:23
XBV00230.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00231.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00232.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00233.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00234.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00235.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00236.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00237.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00238.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00239.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00240.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00241.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00242.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00243.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00244.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00245.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00246.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00247.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00248.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00249.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00250.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00251.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00252.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00253.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:24
XBV00254.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:25
XBV00255.VDF   : 8.11.175.172     2048 Bytes  30.09.2014 15:07:25
XBV00000.VDF   : 7.11.70.0   66736640 Bytes  04.04.2013 15:20:13
XBV00001.VDF   : 7.11.74.226  2201600 Bytes  30.04.2013 15:20:15
XBV00002.VDF   : 7.11.80.60   2751488 Bytes  28.05.2013 15:20:16
XBV00003.VDF   : 7.11.85.214  2162688 Bytes  21.06.2013 15:20:17
XBV00004.VDF   : 7.11.91.176  3903488 Bytes  23.07.2013 15:20:19
XBV00005.VDF   : 7.11.98.186  6822912 Bytes  29.08.2013 15:20:22
XBV00006.VDF   : 7.11.139.38 15708672 Bytes  27.03.2014 15:20:29
XBV00007.VDF   : 7.11.152.100  4193792 Bytes  02.06.2014 15:20:31
XBV00008.VDF   : 8.11.165.192  4251136 Bytes  07.08.2014 14:33:14
XBV00009.VDF   : 8.11.172.30  2094080 Bytes  15.09.2014 15:07:26
XBV00042.VDF   : 8.11.175.172  1208832 Bytes  30.09.2014 15:07:15
XBV00043.VDF   : 8.11.175.174    36864 Bytes  30.09.2014 15:07:15
XBV00044.VDF   : 8.11.175.178     5632 Bytes  30.09.2014 21:07:11
XBV00045.VDF   : 8.11.175.180    11264 Bytes  30.09.2014 21:07:11
XBV00046.VDF   : 8.11.175.194     9728 Bytes  30.09.2014 21:07:11
XBV00047.VDF   : 8.11.175.206     3072 Bytes  30.09.2014 09:09:56
XBV00048.VDF   : 8.11.175.218     2560 Bytes  30.09.2014 09:09:56
XBV00049.VDF   : 8.11.175.222    24576 Bytes  01.10.2014 09:09:56
XBV00050.VDF   : 8.11.175.224    28160 Bytes  01.10.2014 15:09:53
XBV00051.VDF   : 8.11.175.230     3072 Bytes  01.10.2014 15:09:53
XBV00052.VDF   : 8.11.175.232    17408 Bytes  01.10.2014 15:09:53
XBV00053.VDF   : 8.11.175.234    19456 Bytes  01.10.2014 15:09:53
XBV00054.VDF   : 8.11.175.236    11264 Bytes  01.10.2014 21:09:50
XBV00055.VDF   : 8.11.175.238    12288 Bytes  01.10.2014 21:09:50
XBV00056.VDF   : 8.11.175.254    10240 Bytes  01.10.2014 21:09:50
XBV00057.VDF   : 8.11.176.8      5120 Bytes  01.10.2014 21:09:50
LOCAL000.VDF   : 8.11.176.8  111426048 Bytes  01.10.2014 21:10:01
Engineversion  : 8.3.24.30 
AEVDF.DLL      : 8.3.1.6       133992 Bytes  20.08.2014 20:34:37
AESCRIPT.DLL   : 8.2.0.26      436136 Bytes  26.09.2014 21:54:58
AESCN.DLL      : 8.3.2.2       139456 Bytes  04.08.2014 15:17:57
AESBX.DLL      : 8.2.20.24    1409224 Bytes  04.08.2014 15:17:58
AERDL.DLL      : 8.2.0.138     704888 Bytes  04.08.2014 15:17:57
AEPACK.DLL     : 8.4.0.54      788392 Bytes  24.09.2014 16:15:12
AEOFFICE.DLL   : 8.3.0.26      223144 Bytes  26.09.2014 21:54:58
AEHEUR.DLL     : 8.1.4.1310   7564144 Bytes  26.09.2014 21:54:58
AEHELP.DLL     : 8.3.1.0       278728 Bytes  04.08.2014 15:17:55
AEGEN.DLL      : 8.1.7.30      453480 Bytes  26.09.2014 21:54:57
AEEXP.DLL      : 8.4.2.32      247712 Bytes  03.09.2014 08:45:09
AEEMU.DLL      : 8.1.3.4       399264 Bytes  07.08.2014 14:33:10
AEDROID.DLL    : 8.4.2.24      442568 Bytes  04.08.2014 15:19:12
AECORE.DLL     : 8.3.2.6       243712 Bytes  07.08.2014 14:33:10
AEBB.DLL       : 8.1.2.0        60448 Bytes  07.08.2014 14:33:10
AVWINLL.DLL    : 14.0.6.522     24144 Bytes  07.08.2014 08:33:25
AVPREF.DLL     : 14.0.6.522     50256 Bytes  07.08.2014 08:33:28
AVREP.DLL      : 14.0.6.522    219216 Bytes  07.08.2014 08:33:28
AVARKT.DLL     : 14.0.5.368    226384 Bytes  04.08.2014 15:19:21
AVEVTLOG.DLL   : 14.0.6.522    182352 Bytes  07.08.2014 08:33:26
SQLITE3.DLL    : 14.0.6.522    452176 Bytes  07.08.2014 08:33:42
AVSMTP.DLL     : 14.0.6.522     76368 Bytes  07.08.2014 08:33:30
NETNT.DLL      : 14.0.6.522     13392 Bytes  07.08.2014 08:33:40
RCIMAGE.DLL    : 14.0.6.544   4863568 Bytes  07.08.2014 08:33:25
RCTEXT.DLL     : 14.0.6.558     76080 Bytes  28.08.2014 10:15:44

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: ShlExt
Konfigurationsdatei...................: C:\Users\y\AppData\Local\Temp\a87b6535.avp
Protokollierung.......................: standard
Primäre Aktion........................: Interaktiv
Sekundäre Aktion......................: Ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:, 
Durchsuche aktive Programme...........: aus
Durchsuche Registrierung..............: aus
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Prüfe alle Dateien....................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +GAME,+JOKE,+PCK,+PFS,+SPR,

Beginn des Suchlaufs: Donnerstag, 2. Oktober 2014  11:41

Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\Users\y\Downloads\darkgrungetheme.rar.exe'
C:\Users\y\Downloads\darkgrungetheme.rar.exe
  [FUND]      Ist das Trojanische Pferd TR/Crypt.XPACK.Gen5

Beginne mit der Desinfektion:
C:\Users\y\Downloads\darkgrungetheme.rar.exe
  [FUND]      Ist das Trojanische Pferd TR/Crypt.XPACK.Gen5
  [HINWEIS]   Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '514dbfd2.qua' verschoben!


Ende des Suchlaufs: Donnerstag, 2. Oktober 2014  11:41
Benötigte Zeit: 00:00 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

      0 Verzeichnisse wurden überprüft
      2 Dateien wurden geprüft
      1 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      1 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
      1 Dateien ohne Befall
      0 Archive wurden durchsucht
      0 Warnungen
      1 Hinweise
         
Beim ersten Start hat Malwarebytes eine Meldung wegen "AppInit_DLLs" gegeben, entsprechend der Anweisung im Dialog drückte ich auf "Nein". Suchlauf lief durch, beim Schließen hat sich das Programm aufgehängt. Also ein zweites Mal geöffnet, "ja" gedrückt, wieder Suchlauf ohne Probleme und am Ende bei Klick auf "Exit" keine Rückmeldung mehr.

Mbar1:
Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.07.0.1012
www.malwarebytes.org

Database version: v2014.10.02.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: W520 [administrator]

02.10.2014 11:53:02
mbar-log-2014-10-02 (11-53-02).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 435271
Time elapsed: 16 minute(s), 5 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         
Mbar2:
Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.07.0.1012
www.malwarebytes.org

Database version: v2014.10.02.03

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: W520 [administrator]

02.10.2014 12:15:50
mbar-log-2014-10-02 (12-15-50).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 435202
Time elapsed: 14 minute(s), 41 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         
FRST:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-10-2014 01
Ran by Admin (administrator) on W520 on 02-10-2014 12:33:59
Running from C:\Users\Admin\Desktop
Loaded Profiles: Admin &  (Available profiles: UpdatusUser & Admin & y & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Ericsson AB) C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SRORest.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
(Avanquest Software ) C:\Program Files (x86)\Digital Line Detect\DLG.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(Microsoft Corporation) C:\Windows\SysWOW64\rundll32.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe
(Microsoft Corporation) C:\Windows\System32\rundll32.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Lenovo.) C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
() C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [380776 2011-03-29] (Lenovo.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [40808 2011-05-31] (Lenovo Group Limited)
HKLM\...\Run: [ALCKRESI.EXE] => C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [281960 2011-07-13] (Lenovo Group Limited)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63832 2014-03-14] (Lenovo)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [X-Rite Legacy Device] => C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe [105984 2010-09-28] (X-Rite Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
HKU\S-1-5-21-3141125159-651349833-1633251973-1006\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-1006-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {83044456-2184-11e4-9c5c-f0def15dfd89} - D:\SETUP.EXE
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\Run: [EPLTarget\P0000000000000000] => C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE [283232 2012-02-28] (SEIKO EPSON CORPORATION)
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {83044456-2184-11e4-9c5c-f0def15dfd89} - D:\SETUP.EXE
HKU\S-1-5-21-3141125159-651349833-1633251973-1009-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-0\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
HKU\S-1-5-21-3141125159-651349833-1633251973-501-{ED1FC765-E35E-4C3D-BF15-2C2B11260CE4}-1\...\MountPoints2: {daa97dd6-85d5-11e0-b12b-806e6f6e6963} - Q:\LenovoQDrive.exe
Lsa: [Notification Packages] scecli ACGina C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibrator Gamma.lnk
ShortcutTarget: Color Calibrator Gamma.lnk -> C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Gamma\CalibrationLoader.exe (LOGO Kommunikations- und Drucktechnik GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibrator Tray.lnk
ShortcutTarget: Color Calibrator Tray.lnk -> C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files (x86)\Digital Line Detect\DLG.exe (Avanquest Software )

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://lenovo.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Secondary Start Pages = hxxp://www.lenovo.com/welcome/thinkpad
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
SearchScopes: HKLM - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKLM-x32 - {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.179.1

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\user.js
FF SearchPlugin: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\searchplugins\zonealarm.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml
FF Extension: zonealarm.com - C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\Extensions\ffxtlbr@zonealarm.com [2014-06-24]

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [477032 2011-07-04] (Lenovo.)
R2 i1 Display Service; C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [163328 2010-09-28] (X-Rite Inc.) [File not signed]
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-06-26] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-06-26] (pdfforge GmbH)
R2 SROSVC; C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [443240 2011-03-02] (Lenovo Group Limited)
R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440 2008-01-10] (Ulead Systems, Inc.) [File not signed]
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [648744 2011-08-12] (Ericsson AB)
R2 xritedeviced; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [142848 2010-09-28] (X-Rite Inc.) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-08-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-08-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-04] (Avira Operations GmbH & Co. KG)
R3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2010-03-03] (Ericsson AB)
R3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [30248 2010-03-03] (Ericsson AB)
R3 l36wgps; C:\Windows\System32\DRIVERS\l36wgps64.sys [101416 2011-07-01] (Ericsson AB)
R3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [92888 2014-10-02] (Malwarebytes Corporation)
R3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [419400 2011-04-13] (MCCI Corporation)
R3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [430664 2011-04-13] (MCCI Corporation)
R3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [19528 2011-04-13] (MCCI Corporation)
R3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [483400 2011-04-13] (MCCI Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-05-24] ()
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [41536 2009-09-24] (Lenovo (United States) Inc.)
S3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [286248 2011-04-06] (Ericsson AB)
S2 smihlp; \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S0 vmci; system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-02 11:52 - 2014-10-02 12:31 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-10-02 11:50 - 2014-10-02 12:31 - 00000000 ____D () C:\Users\Admin\Desktop\mbar
2014-10-02 11:49 - 2014-10-02 11:49 - 14349744 _____ (Malwarebytes Corp.) C:\Users\y\Desktop\mbar-1.07.0.1012.exe
2014-10-02 11:48 - 2014-10-02 11:48 - 00380416 _____ () C:\Users\Admin\Desktop\11d0cftl.exe
2014-10-02 11:47 - 2014-10-02 11:47 - 02108928 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-01 11:13 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 11:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-27 11:27 - 2014-09-27 11:27 - 00000000 ____D () C:\Users\y\AppData\Local\Lenovo
2014-09-25 21:09 - 2014-09-26 09:24 - 00000000 ____D () C:\Users\y\AppData\Local\Mozilla Thunderbird
2014-09-24 23:02 - 2014-09-24 23:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-24 09:50 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 09:50 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-21 17:30 - 2014-09-21 17:30 - 00791895 _____ () C:\Users\y\Downloads\OptiFine_1.7.10_HD_A4.jar
2014-09-21 17:22 - 2014-09-21 17:23 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-09-21 01:07 - 2014-09-21 01:07 - 00001478 _____ () C:\Users\y\AppData\Local\recently-used.xbel
2014-09-21 01:01 - 2014-09-21 01:09 - 00000000 ____D () C:\Users\y\AppData\Local\gtk-2.0
2014-09-21 01:00 - 2014-09-21 01:00 - 00000000 ____D () C:\Users\y\.thumbnails
2014-09-21 00:55 - 2014-09-21 01:09 - 00000000 ____D () C:\Users\y\.gimp-2.8
2014-09-21 00:55 - 2014-09-21 00:55 - 00000000 ____D () C:\Users\y\AppData\Local\gegl-0.2
2014-09-21 00:46 - 2014-09-21 00:46 - 00000905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-09-21 00:45 - 2014-09-21 00:46 - 00000000 ____D () C:\Program Files\GIMP 2
2014-09-21 00:25 - 2014-09-21 00:29 - 91931728 _____ (The GIMP Team ) C:\Users\y\Desktop\gimp-2.8.14-setup-1.exe
2014-09-21 00:17 - 2014-09-21 00:17 - 00001090 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\Users\y\AppData\Local\PDF24
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-09-20 23:59 - 2014-09-20 23:59 - 00000000 ____D () C:\Users\y\Desktop\SpritecraftFull
2014-09-19 22:27 - 2014-10-01 22:23 - 00000000 ____D () C:\Users\y\Desktop\Printables
2014-09-19 14:43 - 2014-09-19 14:43 - 00000000 ____D () C:\Program Files\Common Files\EPSON
2014-09-19 13:51 - 2014-09-19 13:51 - 00000000 ____D () C:\Users\y\AppData\Roaming\Epson
2014-09-19 13:38 - 2014-09-19 14:10 - 00002369 _____ () C:\Users\Public\Desktop\Epson Netzwerkhandbuch WF-3520 Series.lnk
2014-09-19 13:38 - 2014-09-19 14:09 - 00000279 _____ () C:\Users\Public\Desktop\Epson Benutzerhandbuch WF-3520 Series.url
2014-09-19 13:37 - 2014-09-22 15:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
2014-09-19 13:37 - 2014-09-22 15:47 - 00000000 ____D () C:\Program Files (x86)\Epson Software
2014-09-19 13:37 - 2014-09-19 13:37 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Epson
2014-09-19 13:36 - 2014-09-23 12:31 - 00000000 ____D () C:\Program Files (x86)\epson
2014-09-19 13:36 - 2014-09-22 15:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2014-09-19 13:35 - 2014-09-20 14:45 - 00000000 ____D () C:\ProgramData\EPSON
2014-09-19 13:35 - 2011-04-19 03:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMJJE.DLL
2014-09-19 13:35 - 2011-03-14 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BJJE.DLL
2014-09-19 13:35 - 2007-04-10 01:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2014-09-12 23:15 - 2014-09-12 23:15 - 00000000 ____D () C:\Users\y\AppData\Roaming\NVIDIA
2014-09-12 20:21 - 2014-10-02 09:42 - 00000000 ____D () C:\Users\y\AppData\Roaming\.minecraft
2014-09-12 20:12 - 2014-09-12 20:12 - 00675988 _____ () C:\Users\y\Desktop\Minecraft.exe
2014-09-12 16:54 - 2014-08-15 17:48 - 17868288 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 16:54 - 2014-08-15 17:36 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 16:54 - 2014-08-15 17:35 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 16:54 - 2014-08-15 17:31 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 16:54 - 2014-08-15 17:31 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 16:54 - 2014-08-15 17:30 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 16:54 - 2014-08-15 17:30 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-12 16:54 - 2014-08-15 17:30 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 02156032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 16:54 - 2014-08-15 17:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 16:54 - 2014-08-15 17:28 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 16:54 - 2014-08-15 17:28 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 16:54 - 2014-08-15 17:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-12 16:54 - 2014-08-15 17:28 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 16:54 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 16:54 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 16:54 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 16:54 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 16:54 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 16:54 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 16:54 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 16:54 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 16:54 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-09-12 16:54 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-09-12 16:46 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 16:46 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 08:44 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 08:44 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 08:44 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 08:44 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 08:44 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 08:44 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 08:44 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 08:44 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 08:44 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 08:44 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 08:44 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-04 01:02 - 2014-09-04 01:02 - 00012288 ___SH () C:\Users\y\Thumbs.db
2014-09-04 01:00 - 2014-09-04 01:00 - 00001024 _____ () C:\Users\Public\Desktop\PDF Architect 2.lnk
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\Users\Admin\Documents\PDF Architect 2
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\Program Files (x86)\PDF Architect 2
2014-09-04 00:59 - 2014-09-04 01:00 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\pdfforge
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-09-04 00:59 - 2014-04-25 17:44 - 00662288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2014-09-04 00:59 - 2014-04-25 17:44 - 00137000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMAPI32.OCX
2014-09-04 00:59 - 2014-04-25 17:44 - 00110264 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-09-04 00:59 - 2014-04-25 17:44 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPIDE.DLL
2014-09-04 00:59 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6DE.DLL
2014-09-04 00:59 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCDE.DLL
2014-09-04 00:59 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCC2DE.DLL
2014-09-04 00:56 - 2014-09-04 00:56 - 27843432 _____ (pdfforge ) C:\Users\y\Downloads\PDFCreator-1_7_3_setup.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-02 12:34 - 2014-08-07 11:38 - 00021562 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-02 12:34 - 2014-08-07 11:38 - 00000000 ____D () C:\FRST
2014-10-02 12:32 - 2011-06-21 19:59 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2014-10-02 12:29 - 2011-06-21 19:59 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job
2014-10-02 12:13 - 2014-08-07 11:10 - 00128728 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-02 12:10 - 2011-05-24 09:23 - 01509774 _____ () C:\Windows\WindowsUpdate.log
2014-10-02 11:51 - 2014-08-07 11:10 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-02 11:48 - 2014-06-24 12:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-02 11:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-02 10:28 - 2014-08-11 22:40 - 00000000 ____D () C:\Users\y\Desktop\Rezepte
2014-10-02 09:37 - 2009-07-14 06:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-02 09:37 - 2009-07-14 06:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-02 08:56 - 2011-05-24 09:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-02 08:56 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-02 08:56 - 2009-07-14 06:51 - 00079349 _____ () C:\Windows\setupact.log
2014-10-02 00:32 - 2014-06-17 22:26 - 00310170 _____ () C:\Windows\IE11_main.log
2014-10-01 21:15 - 2014-08-12 00:27 - 00000000 ____D () C:\Users\y\Handykarte Dateien
2014-09-27 13:56 - 2014-06-17 20:59 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-09-27 13:56 - 2011-05-24 18:46 - 00000000 ____D () C:\ProgramData\Lenovo
2014-09-27 13:55 - 2011-05-24 09:43 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-09-27 13:55 - 2011-05-24 09:28 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-09-27 13:55 - 2011-05-24 09:27 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-09-27 12:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-25 11:55 - 2014-06-17 20:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-23 12:31 - 2010-11-21 05:47 - 00093108 _____ () C:\Windows\PFRO.log
2014-09-22 15:53 - 2011-05-24 09:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-21 17:22 - 2014-06-24 12:47 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-21 17:22 - 2014-06-24 12:47 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-21 17:22 - 2011-06-25 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-21 01:00 - 2014-06-24 12:42 - 00000000 ____D () C:\Users\y
2014-09-21 00:16 - 2014-06-17 20:52 - 00122712 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-19 19:29 - 2014-08-14 11:38 - 00000000 ____D () C:\Users\y\Studium
2014-09-19 14:06 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-09-12 16:54 - 2014-08-11 21:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-12 16:54 - 2011-06-22 22:29 - 01594892 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 16:54 - 2011-05-24 19:13 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-09-12 16:54 - 2011-05-24 19:13 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-09-12 16:53 - 2014-06-17 22:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 16:53 - 2009-07-14 07:13 - 01594892 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-09-12 16:48 - 2014-06-24 13:18 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-12 16:47 - 2014-08-04 17:21 - 00001148 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-12 16:47 - 2011-06-21 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-12 16:47 - 2011-06-21 19:39 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-12 16:46 - 2014-06-17 22:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-12 16:46 - 2011-06-21 20:16 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 13:28 - 2014-08-11 22:40 - 00000000 ____D () C:\Users\y\Desktop\USB Maus
2014-09-05 11:51 - 2014-08-11 22:24 - 00000000 ____D () C:\Users\y\Bewerbungen

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\AskSLib.dll
C:\Users\Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Admin\AppData\Local\Temp\nvStInst.exe
C:\Users\Admin\AppData\Local\Temp\ose00000.exe
C:\Users\y\AppData\Local\Temp\AskSLib.dll
C:\Users\y\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-27 11:55

==================== End Of Log ============================
         
Nach dem Lauf von GMER ließ sich Avira (Echtzeit-Scanner + FireWall) nicht mehr aktivieren. Angeblich ist manchmal ZoneAlarm das Problem, hab es deinstalliert (war sowieso nicht in Gebrauch); daraufhin funktionierte die Firewall, der Scanner aber immer noch nicht. Wollte den PC herunterfahren um neu zu starten, er blieb aber einfach beim "Herunterfahren-Bildschirm" hängen, also hab ich ihn irgendwann per Knopf gekillt.

Nach dem Start steht im Avira-Control-Panel, es sei aktiv, im Windows-Wartungscenter wird es aber immer noch als inaktiv angezeigt. Hab über Letzteres ein paar Mal auf "aktivieren" gedrückt, das ändert aber nichts.

Sorry für den Roman Ich hoffe, ich mache mir mehr Sorgen als nötig und freue mich sehr über eure Hilfe

LG
Büromagnet

PS: Additions und GMER sind im Anhang, da sonst der Text zu viele Zeichen hat.

Alt 02.10.2014, 13:00   #2
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Hi und

Logs bitte nicht anhängen, notfalls splitten und über mehrere Postings verteilt posten

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR oder 7Z-Archiv zu packen erschwert mir massiv die Arbeit.
Auch wenn die Logs für einen Beitrag zu groß sein sollten, bitte ich dich die Logs direkt und notfalls über mehrere Beiträge verteilt zu posten.
Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
__________________

__________________

Alt 02.10.2014, 13:25   #3
Büromagnet
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Ok, sorry, dann war das ein Missverständnis

Addition:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 05-08-2014
Ran by Admin at 2014-08-07 11:39:04
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

Adobe Flash Player 10 ActiveX (HKLM-x32\...\{B7B3E9B3-FB14-4927-894B-E9124509AF5A}) (Version: 10.0.32.18 - Adobe Systems, Inc.)
Adobe Flash Player 14 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 14.0.0.145 - Adobe Systems Incorporated)
Adobe Reader X (10.1.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.71.00 - )
Avira (HKLM-x32\...\{9590977b-7b6f-467e-a11a-efa1fae804da}) (Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.18.30000 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.552 - Avira)
Broadcom InConcert Maestro (HKLM\...\{57DD35E9-D9BB-4089-BB05-EF933C586CB3}) (Version: 1.0.1.1500 - Broadcom Corporation)
Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) Hidden
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.23.5 - Conexant)
Corel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)
Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) Hidden
Corel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.828 - Corel Inc.)
Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Direct DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) Hidden
Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7 (HKLM\...\DisableAMTPopup) (Version: 1.00 - )
Integrated Camera Driver Installer Package Ver.1.1.0.1147 (HKLM-x32\...\{B2CA6F37-1602-4823-81B5-0384B6888AA6}) (Version: 1.1.0.1147 - RICOH)
Integrated Camera TWAIN (HKLM-x32\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.)
Intel PROSet Wireless (Version:  - ) Hidden
Intel PROSet Wireless (x32 Version:  - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Identity Protection Technology 1.0.74.0 (HKLM-x32\...\{C6D4B05A-EA7E-1027-80EF-C925E740E99C}) (Version: 1.0.74.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 18.7 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2538 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{3C41721F-AF0F-4086-AA1C-4C7F29076228}) (Version: 14.01.1000 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version:  - )
Intel(R) Wireless Display (HKLM-x32\...\{F84906ED-BB54-4889-B131-FED9C9056FC8}) (Version: 2.0.27.0 - Intel Corporation)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.00 - )
Lenovo Mobile Broadband Activation (HKLM-x32\...\{A95D9DF7-CF34-421A-A1DC-936A49A4DAEA}) (Version: 4.0.0013.00 - Lenovo Group Limited)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Lenovo Screen Reading Optimizer (HKLM-x32\...\{91A29166-4E1B-4664-B70B-4C4A3B6B3372}) (Version: 1.07 - Lenovo)
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo System Update (HKLM-x32\...\{25C64847-B900-48AD-A164-1B4F9B774650}) (Version: 5.05.0009 - Lenovo)
Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5849.23 - PC-Doctor, Inc.)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0008.00 - Ihr Firmenname)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0005.00 - Lenovo)
Lenovo Welcome (HKLM-x32\...\Lenovo Welcome_is1) (Version: 2.02.003.0 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Message Center Plus (HKLM-x32\...\{FD331A3B-F7A5-4C31-B8D4-DF413C85AF7A}) (Version: 2.0.0012.00 - Lenovo Group Limited)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM-x32\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50401.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Mobile Broadband Drivers (HKLM-x32\...\{EA9640BE-414E-4195-B53B-7905BF1A5A09}) (Version: 6.5.1.5 - Ericsson AB)
Mozilla Firefox 31.0 (x86 de) (HKLM-x32\...\Mozilla Firefox 31.0 (x86 de)) (Version: 31.0 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA 3D Vision Treiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 312.69 - NVIDIA Corporation)
NVIDIA Grafiktreiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 312.69 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
Oracle VM VirtualBox 4.3.14 (HKLM\...\{8DD94059-60C6-42E3-AB59-8F37445ACC79}) (Version: 4.3.14 - Oracle Corporation)
PANTONE Color Calibrator 1.0 (HKLM-x32\...\PANTONE Color Calibrator_is1) (Version:  - X-Rite)
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (HKLM\...\EnablePS) (Version: 1.00 - )
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
RICOH Media Driver v2.10.18.02 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.10.18.02 - RICOH)
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version:  - )
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6C9D5F7-630C-4125-8C4E-94AF77C1896E}) (Version: 6.4.0.1500 - Broadcom Corporation)
ThinkPad Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 3.62 - )
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.40 - )
ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 6.21 - Lenovo)
ThinkVantage AutoLock (HKLM\...\{E224B44B-B5EB-4af3-A80A-A255358E241A}_is1) (Version: 1.04 - Lenovo)
ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 2.07 - Lenovo)
ThinkVantage Fingerprint Software (HKLM\...\{F58DA859-016E-492D-A588-317D9BB28002}) (Version: 5.9.9.7282 - Authentec Inc.)
ThinkVantage GPS (HKLM-x32\...\{6DB21B2C-2BEF-44B4-B264-8EC2BC2369C6}) (Version: 2.80 - Lenovo)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Intel (e1cexpress) Net  (12/21/2010 11.8.84.0) (HKLM\...\6D23A494E9A245843FB8584D9307D3E328DF8613) (Version: 12/21/2010 11.8.84.0 - Intel)
Windows-Treiberpaket - Intel (MEIx64) System  (10/19/2010 7.0.0.1144) (HKLM\...\90FD26A77B849AE03FF5F07A1CDA7F950406A8D8) (Version: 10/19/2010 7.0.0.1144 - Intel)
Windows-Treiberpaket - Intel System  (09/10/2010 9.2.0.1011) (HKLM\...\0CDBDD444A1F5FFEA227B4E7DCE195F11F08240A) (Version: 09/10/2010 9.2.0.1011 - Intel)
Windows-Treiberpaket - Intel System  (09/10/2010 9.2.0.1011) (HKLM\...\A513FC5E5A08D4EF27F234E91E0E942A0234210B) (Version: 09/10/2010 9.2.0.1011 - Intel)
Windows-Treiberpaket - Intel System  (10/04/2010 9.2.0.1015) (HKLM\...\FE1BEBFD475BB832AAF104F5C63348E98A9286DF) (Version: 10/04/2010 9.2.0.1015 - Intel)
Windows-Treiberpaket - Intel USB  (09/16/2010 9.2.0.1013) (HKLM\...\D97688B8E3830BF9820E15EB8D9552DCBF988CFD) (Version: 09/16/2010 9.2.0.1013 - Intel)
Windows-Treiberpaket - Lenovo 1.61.00.11 (11/11/2010 1.61.00.11) (HKLM\...\466E9B20D871055D6D3CDA2CDD1D355E978A61AF) (Version: 11/11/2010 1.61.00.11 - Lenovo)
Windows-Treiberpaket - Synaptics (SynTP) Mouse  (02/17/2011 15.2.14.0) (HKLM\...\77A943AB876C131591E0EA5DB6AB08D89EE2EA9E) (Version: 02/17/2011 15.2.14.0 - Synaptics)
X-Rite Device i1Display Service (HKLM-x32\...\{D2A53206-6A9E-4241-B21C-D94140EEF1CE}_is1) (Version: 1.0 - X-Rite Inc.)
X-Rite Device Manager (HKLM-x32\...\{9ACEA9CD-63B9-4784-807B-EA295E96A7C3}_is1) (Version: 1.0 - X-Rite Inc.)
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 13.1.211.000 - Check Point)
ZoneAlarm Security Toolbar  (HKCU\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

Could not list Restore Points. Check "winmgmt" service or repair WMI.


==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1B4ECB35-36E2-436D-9F92-6E77BA54A061} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {1D10F913-F57D-440E-A090-680DBFD9A0CD} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-01-21] (Microsoft)
Task: {2250233B-A91F-453F-9969-928AA4A2F096} - System32\Tasks\PCDoctorBackgroundMonitorTask-Delay => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {228BCBEF-4341-4187-A897-495238E406F7} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {474F18C8-A337-433A-AE5E-44A4DD1545D3} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {69033D1C-86B9-46A6-BCC6-E7364DD84646} - System32\Tasks\MCP => C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe [2009-05-27] ()
Task: {94E4E220-421A-4B2F-9FA5-0C6731235738} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-08-04] (Adobe Systems Incorporated)
Task: {B40C9D21-6759-4886-B553-CC3BC215678A} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {BF9A603C-8A54-44D3-9E8F-C78BE2749BCE} - System32\Tasks\Lenovo\SROptimizer => %TRPATH%\SRORest.exe
Task: {E11430E8-B24A-4954-9D5E-CE2C5E8ABD90} - System32\Tasks\TVT\TVSUUpdateTask => C:\Program Files (x86)\Lenovo\System Update\tvsuShim.exe [2014-02-21] ()
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe

==================== Loaded Modules (whitelisted) =============

2011-05-02 13:41 - 2011-05-02 13:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2014-06-17 21:11 - 2013-10-29 02:53 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-05-24 09:36 - 2011-07-04 03:02 - 00055296 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-05-24 09:32 - 2010-10-26 10:40 - 00049056 ____N () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2011-05-02 13:41 - 2011-05-02 13:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-05-24 09:33 - 2011-03-06 13:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2010-12-18 15:50 - 2010-12-18 15:50 - 00173856 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 10383872 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
2009-05-27 22:09 - 2009-05-27 22:09 - 00049976 _____ () C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe
2014-03-14 17:47 - 2014-03-14 17:47 - 00092504 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2014-07-24 11:50 - 2014-07-24 11:50 - 00137296 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-07-24 11:49 - 2014-07-24 11:49 - 00065104 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2011-05-24 09:32 - 2011-05-26 17:17 - 00065576 ____R () C:\Program Files (x86)\Mobile Broadband drivers\WMCore\MBMDebug.dll
2011-09-23 20:10 - 2011-06-29 18:09 - 02085888 _____ () C:\Program Files\Lenovo\AutoLock\cv210.dll
2011-09-23 20:10 - 2011-06-29 18:09 - 02201088 _____ () C:\Program Files\Lenovo\AutoLock\cxcore210.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 00898560 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\libxml2.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 00073728 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\zlib1.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 03449344 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\CxF2_VC90MD_2.1.dll
2011-05-24 09:38 - 2010-12-15 22:54 - 07390720 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtGui4.dll
2011-05-24 09:38 - 2010-12-15 22:54 - 02012160 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtCore4.dll
2014-08-07 11:01 - 2014-07-24 11:50 - 00049744 _____ () C:\Users\Admin\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\vsmon => ""="Service"

==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


==================== Faulty Device Manager Devices =============

Name: SMI Helper Driver (smihlp)
Description: SMI Helper Driver (smihlp)
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: smihlp
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (08/07/2014 11:39:05 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.


Vorgang:
   VSS-Server wird instanziiert

Error: (08/07/2014 11:39:05 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {e579ab5f-1cc4-44b4-bed9-de0991ff0623} und dem Namen "IVssCoordinatorEx2" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]


Vorgang:
   VSS-Server wird instanziiert

Error: (08/07/2014 10:55:34 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{7896eb25-2403-4b7b-235a-a65b8e850e3e}\VBoxNetFlt.inf" "9" "5f09ff663" "00000000000002B8" "WinSta0\Default" "0000000000000664" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netflt"; Beschreibung = Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkdienst; Fehler = 0x80042302).

Error: (08/07/2014 10:55:34 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.

Error: (08/07/2014 10:55:34 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f} und dem Namen "Coordinator" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]

Error: (08/07/2014 10:55:26 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{3d392bf8-9887-07d9-4f73-570aeef63d73}\VBoxNetAdp.inf" "9" "5dd35f09b" "00000000000006BC" "WinSta0\Default" "0000000000000668" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp"; Beschreibung = Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkadapter; Fehler = 0x80042302).

Error: (08/07/2014 10:55:26 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.

Error: (08/07/2014 10:55:26 AM) (Source: VSS) (EventID: 13) (User: )
Description: Volumenschattenkopie-Dienst-Informationen: Der COM-Server mit CLSID {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f} und dem Namen "Coordinator" kann nicht gestartet werden. [0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
]

Error: (08/07/2014 10:55:18 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: Fehler beim Erstellen des Wiederherstellungspunkts (Prozess = C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{5bcc7736-37a7-0e37-fdea-2834f8802439}\VBoxUSB.inf" "9" "56237d90b" "000000000000069C" "WinSta0\Default" "00000000000006BC" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"; Beschreibung = Gerätetreiber-Paketinstallation: Oracle Corporation USB-Controller; Fehler = 0x80042302).

Error: (08/07/2014 10:55:18 AM) (Source: VSS) (EventID: 8193) (User: )
Description: Volumeschattenkopie-Dienstfehler: Beim Aufrufen von Routine "CoCreateInstance" ist ein unerwarteter Fehler aufgetreten. hr = 0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.
.


System errors:
=============
Error: (08/07/2014 10:33:42 AM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme

Error: (08/07/2014 10:31:04 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (08/07/2014 10:31:04 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (08/07/2014 10:28:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "Windows Presentation Foundation-Schriftartcache 3.0.0.0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1053

Error: (08/07/2014 10:28:48 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Windows Presentation Foundation-Schriftartcache 3.0.0.0 erreicht.

Error: (08/07/2014 10:27:23 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SMI Helper Driver (smihlp)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/06/2014 10:48:29 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (08/06/2014 10:48:29 PM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (08/06/2014 10:45:03 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SMI Helper Driver (smihlp)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (08/06/2014 08:24:46 PM) (Source: Microsoft-Windows-WindowsUpdateClient) (EventID: 20) (User: NT-AUTORITÄT)
Description: Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80070643 fehlgeschlagen: Internet Explorer 11 für Windows 7 für x64-basierte Systeme


Microsoft Office Sessions:
=========================
Error: (08/07/2014 11:39:05 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.


Vorgang:
   VSS-Server wird instanziiert

Error: (08/07/2014 11:39:05 AM) (Source: VSS) (EventID: 13) (User: )
Description: {e579ab5f-1cc4-44b4-bed9-de0991ff0623}IVssCoordinatorEx20x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.


Vorgang:
   VSS-Server wird instanziiert

Error: (08/07/2014 10:55:34 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{7896eb25-2403-4b7b-235a-a65b8e850e3e}\VBoxNetFlt.inf" "9" "5f09ff663" "00000000000002B8" "WinSta0\Default" "0000000000000664" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netflt"Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkdienst0x80042302

Error: (08/07/2014 10:55:34 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.

Error: (08/07/2014 10:55:34 AM) (Source: VSS) (EventID: 13) (User: )
Description: {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f}Coordinator0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.

Error: (08/07/2014 10:55:26 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{3d392bf8-9887-07d9-4f73-570aeef63d73}\VBoxNetAdp.inf" "9" "5dd35f09b" "00000000000006BC" "WinSta0\Default" "0000000000000668" "208" "C:\Program Files\Oracle\VirtualBox\drivers\network\netadp"Gerätetreiber-Paketinstallation: Oracle Corporation Netzwerkadapter0x80042302

Error: (08/07/2014 10:55:26 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.

Error: (08/07/2014 10:55:26 AM) (Source: VSS) (EventID: 13) (User: )
Description: {0b5a2c52-3eb9-470a-96e2-6c6d4570e40f}Coordinator0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.

Error: (08/07/2014 10:55:18 AM) (Source: System Restore) (EventID: 8193) (User: )
Description: C:\Windows\system32\DrvInst.exe "4" "0" "C:\Users\y\AppData\Local\Temp\{5bcc7736-37a7-0e37-fdea-2834f8802439}\VBoxUSB.inf" "9" "56237d90b" "000000000000069C" "WinSta0\Default" "00000000000006BC" "208" "C:\Program Files\Oracle\VirtualBox\drivers\USB\device"Gerätetreiber-Paketinstallation: Oracle Corporation USB-Controller0x80042302

Error: (08/07/2014 10:55:18 AM) (Source: VSS) (EventID: 8193) (User: )
Description: CoCreateInstance0x80070422, Der angegebene Dienst kann nicht gestartet werden. Er ist deaktiviert oder nicht mit aktivierten Geräten verbunden.


CodeIntegrity Errors:
===================================
  Date: 2011-06-26 13:11:21.363
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:21.303
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:21.243
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:21.063
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.953
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.803
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.713
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.653
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.563
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.283
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Percentage of memory in use: 21%
Total physical RAM: 8075.23 MB
Available physical RAM: 6312.45 MB
Total Pagefile: 16148.65 MB
Available Pagefile: 14157.66 MB
Total Virtual: 8192 MB
Available Virtual: 8191.82 MB

==================== Drives ================================

Drive c: (Windows7_OS) (Fixed) (Total:674.01 GB) (Free:619.83 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive q: (Lenovo_Recovery) (Fixed) (Total:23.46 GB) (Free:14.01 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 699 GB) (Disk ID: C42CD616)
Partition 1: (Active) - (Size=1 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=674 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=23 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
__________________

Alt 02.10.2014, 13:26   #4
Büromagnet
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



GMER:
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2014-10-02 12:52:46
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD75 rev.01.0 698,64GB
Running: 11d0cftl.exe; Driver: C:\Users\Admin\AppData\Local\Temp\uxtdqpob.sys


---- Kernel code sections - GMER 2.1 ----

INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 528                                                                                                 fffff80002fab000 76 bytes [B9, FF, FF, FF, FF, 0F, 00, ...]
INITKDBG  C:\Windows\system32\ntoskrnl.exe!ExDeleteNPagedLookasideList + 605                                                                                                 fffff80002fab04d 59 bytes [F0, 41, 0F, BA, 6E, 10, 00, ...]

---- User code sections - GMER 2.1 ----

.text     C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                     0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe[2388] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                    00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                           0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe[2592] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                          00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                         0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe[2676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                        00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                               0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE[3316] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                              00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                               0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe[3676] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                              00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe[3700] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe[3744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                  0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe[3744] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                 00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                       0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[4328] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                      00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[1336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe[1336] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                     00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                              000000007742f2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                            0000000077459a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                            00000000774694c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                            0000000077469630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                     00000000774887e0 7 bytes JMP 000000016fff01b8
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                      000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                 000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                   000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                               000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                              000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\ole32.dll!CoCreateInstance                                                      000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Program Files\NVIDIA Corporation\Display\nvxdsync.exe[6672] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                     000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                         000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                    000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                      000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                  000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                   000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlk.exe[6364] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                        000000007742f2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                      0000000077459a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                      00000000774694c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                      0000000077469630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\kernel32.dll!RegSetValueExA                                               00000000774887e0 7 bytes JMP 000000016fff01b8
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                           000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                             000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                         000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                          000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                        000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\ole32.dll!CoCreateInstance                                                000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe[7416] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                               000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                     00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                            000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                            0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                            0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                              00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                 0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                               0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                   0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                      0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                      00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                  0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                              000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                     0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\PROGRA~1\LENOVO\VIRTSCRL\virtscrl.exe[6920] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                      0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                          00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                                 000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                                 0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                                 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                   00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                      0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                    0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                        0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                           0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                           00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                       0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                   000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                     000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                          0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\PROGRA~1\Lenovo\Zoom\TPSCREX.EXE[7652] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                           0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                                   000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                              000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                                000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                            000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                             000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                           000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\dxgi.dll!CreateDXGIFactory                                                                                   000007fef2c6dc88 5 bytes JMP 000007fff2c400d8
.text     C:\Windows\system32\Dwm.exe[7968] C:\Windows\system32\dxgi.dll!CreateDXGIFactory1                                                                                  000007fef2c6de10 5 bytes JMP 000007fff2c40110
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                        00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                               000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                               0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                               0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                 00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                    0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                  0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                      0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                         0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                         00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                     0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                 000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                   000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                        0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\PROGRA~1\Lenovo\HOTKEY\TPONSCR.EXE[6028] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                         0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                        000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                   000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                     000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                 000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                  000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\PROGRA~1\Lenovo\HOTKEY\tpnumlkd.exe[2464] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                          00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                 000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                 0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                 0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                   00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                      0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                    0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                        0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                           0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                  0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                 00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                           00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                       0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                   000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                     000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                          0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe[4300] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                           0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                              000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                         000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                           000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                       000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                        000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Windows\System32\TpShocks.exe[6732] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                      000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                               000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                          000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                            000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                        000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                         000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Program Files\CONEXANT\ForteConfig\fmapp.exe[2544] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                       000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                  00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                         000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                         0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                         0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                           00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                              0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                            0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                   0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                           000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                             000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                   00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                               0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                  0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe[2300] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                   0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                               000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                          000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                            000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                        000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                         000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                       000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                               000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Windows\system32\taskeng.exe[3496] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                              000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                       000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                       0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                       0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                         00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                            0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                          0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                              0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                 0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                 00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                             0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                         000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                           000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe[7120] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                 0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                       000000007742f2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                     0000000077459a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                     00000000774694c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                     0000000077469630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\kernel32.dll!RegSetValueExA                                              00000000774887e0 7 bytes JMP 000000016fff01b8
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                               000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                          000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                            000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                        000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                         000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                       000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\ole32.dll!CoCreateInstance                                               000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe[6584] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                              000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                         000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                    000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                      000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                  000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                         000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                        000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                   000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Windows\system32\wbem\unsecapp.exe[8044] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                 000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                              000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                         000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                           000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                       000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                        000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                      000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                              000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Windows\System32\igfxpers.exe[4604] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                             000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                                         000000007742f2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                                       0000000077459a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                                       00000000774694c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                                       0000000077469630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                                00000000774887e0 7 bytes JMP 000000016fff01b8
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                            000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                              000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                          000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                           000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                         000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Program Files\Synaptics\SynTP\SynTPEnh.exe[5856] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                               000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                                          000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                                            000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                                        000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                               000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                              000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                                         000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Windows\system32\wuauclt.exe[6376] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                                       000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!K32GetMappedFileNameW                                               000000007742f2e0 5 bytes JMP 000000016fff0148
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!K32EnumProcessModulesEx                                             0000000077459a30 7 bytes JMP 000000016fff00d8
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!K32GetModuleInformation                                             00000000774694c0 5 bytes JMP 000000016fff0180
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!K32GetModuleFileNameExW                                             0000000077469630 5 bytes JMP 000000016fff0110
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\kernel32.dll!RegSetValueExA                                                      00000000774887e0 7 bytes JMP 000000016fff01b8
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                       000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                  000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                    000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                 000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe[6012] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                               000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                             00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                    000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                    0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                    0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                      00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                         0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                       0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                           0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                              0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\USER32.dll!CreateWindowExW                              00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                          0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                      000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                        000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                             0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe[6412] C:\Windows\syswow64\ole32.dll!CoCreateInstance                              0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                           00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                  000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                  0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                  0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                    00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                       0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                     0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                         0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                            0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                            00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                        0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                    000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                      000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                           0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files (x86)\Digital Line Detect\DLG.exe[5620] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                            0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                                 000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                            000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                              000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                          000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                           000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                         000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\ole32.dll!CoCreateInstance                                                                 000007fefe127490 11 bytes JMP 000007fffdbf0228
.text     C:\Program Files\Synaptics\SynTP\SynTPLpr.exe[3020] C:\Windows\system32\ole32.dll!CoSetProxyBlanket                                                                000007fefe13bf00 7 bytes JMP 000007fffdbf0260
.text     C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                                              000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                                         000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                                           000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                                       000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                                        000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\PROGRAM FILES\SYNAPTICS\SYNTP\SYNTPHELPER.EXE[1708] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                                      000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Windows\SysWOW64\RunDll32.exe[5064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                                     0000000075881465 2 bytes [88, 75]
.text     C:\Windows\SysWOW64\RunDll32.exe[5064] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                                    00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                   00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                          000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                          0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                          0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                            00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                               0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                             0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                    0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                           0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                          00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                            000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                              000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                    00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                   0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe[4012] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                    0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\KERNELBASE.dll!FreeLibrary                                              000007fefdc22db0 5 bytes JMP 000007fffdbf0180
.text     C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleW                                         000007fefdc237d0 7 bytes JMP 000007fffdbf00d8
.text     C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\KERNELBASE.dll!LoadLibraryExW                                           000007fefdc28ef0 6 bytes JMP 000007fffdbf0148
.text     C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\KERNELBASE.dll!GetModuleHandleExW                                       000007fefdc3af60 5 bytes JMP 000007fffdbf0110
.text     C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\GDI32.dll!D3DKMTQueryAdapterInfo                                        000007feff8c89f0 8 bytes JMP 000007fffdbf01f0
.text     C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe[5004] C:\Windows\system32\GDI32.dll!D3DKMTGetDisplayModeList                                      000007feff8cbe50 8 bytes JMP 000007fffdbf01b8
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!RegSetValueExA           00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW  000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx  0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation  0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW    00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW       0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW     0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW         0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary            0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList    000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo      000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\USER32.dll!CreateWindowExW            00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA        0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket           0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe[2444] C:\Windows\syswow64\ole32.dll!CoCreateInstance            0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                             00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                    000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                    0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                    0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                      00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                         0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                       0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                           0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                              0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                      000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                        000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                              00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                          0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                             0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                              0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                     0000000075881465 2 bytes [88, 75]
.text     C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe[1904] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                    00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!RegSetValueExA                                                   00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleFileNameExW                                          000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!K32EnumProcessModulesEx                                          0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!K32GetModuleInformation                                          0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNEL32.dll!K32GetMappedFileNameW                                            00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                               0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                             0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                 0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe[5408] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                    0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                       00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                              000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                              0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                              0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                                00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                   0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                                 0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                     0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                        0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                                000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                                  000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                        00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                    0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                       0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\Program Files (x86)\PDF24\pdf24.exe[1968] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                        0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!RegSetValueExA                                                                    00000000755f1409 7 bytes JMP 00000001742c12ad
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!K32GetModuleFileNameExW                                                           000000007560b21b 5 bytes JMP 00000001742c15be
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!K32EnumProcessModulesEx                                                           0000000075688e24 7 bytes JMP 00000001742c1357
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!K32GetModuleInformation                                                           0000000075688ea9 5 bytes JMP 00000001742c16e0
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\kernel32.dll!K32GetMappedFileNameW                                                             00000000756891ff 5 bytes JMP 00000001742c1028
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleW                                                                0000000076bf1d29 5 bytes JMP 00000001742c11ef
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\KERNELBASE.dll!GetModuleHandleExW                                                              0000000076bf1dd7 5 bytes JMP 00000001742c1023
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\KERNELBASE.dll!LoadLibraryExW                                                                  0000000076bf2ab1 5 bytes JMP 00000001742c156e
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\KERNELBASE.dll!FreeLibrary                                                                     0000000076bf2d17 5 bytes JMP 00000001742c1294
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\USER32.dll!CreateWindowExW                                                                     00000000756f8a29 5 bytes JMP 00000001742c1050
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\USER32.dll!EnumDisplayDevicesA                                                                 0000000075704572 5 bytes JMP 00000001742c10d2
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\GDI32.dll!D3DKMTGetDisplayModeList                                                             000000007541e96b 5 bytes JMP 00000001742c15d7
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\GDI32.dll!D3DKMTQueryAdapterInfo                                                               000000007541eba5 5 bytes JMP 00000001742c11b8
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\ole32.dll!CoSetProxyBlanket                                                                    0000000076a35ea5 5 bytes JMP 00000001742c1609
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\ole32.dll!CoCreateInstance                                                                     0000000076a69d0b 5 bytes JMP 00000001742c1249
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                            0000000075881465 2 bytes [88, 75]
.text     C:\PROGRA~2\ThinkPad\UTILIT~1\SCHTASK.exe[4080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                           00000000758814bb 2 bytes [88, 75]
.text     ...                                                                                                                                                                * 2

---- Registry - GMER 2.1 ----

Reg       HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\cc52af827b33                                                                                        
Reg       HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\cc52af827b33 (not active ControlSet)                                                                    

---- Disk sectors - GMER 2.1 ----

Disk      \Device\Harddisk0\DR0                                                                                                                                              unknown MBR code

---- EOF - GMER 2.1 ----
         

Alt 02.10.2014, 13:44   #5
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Ist das ein gewerblich genutztes System?

Zitat:
ZoneAlarm Free Firewall (HKLM-x32\...\ZoneAlarm Free Firewall) (Version: 13.1.211.000 - Check Point)
ZoneAlarm Security Toolbar (HKCU\...\zonealarm) (Version: 1.8.29.17 - Check Point Software Technologies LTD)
Und unbedingt dieses SauAlarm-Geraffel deinstallieren...


Alt 02.10.2014, 13:56   #6
Büromagnet
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Ne, ich bin Studentin und darf mir dank DreamSpark / MSDNAA über die Uni fast alle MS-Software kostenlos herunterladen, deshalb das Windows Professional.

Das Geraffel hab ich eben deinstalliert

Alt 02.10.2014, 20:53   #7
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Dann bitte jetzt Combofix ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.


Alt 02.10.2014, 21:41   #8
Büromagnet
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Combofix
Code:
ATTFilter
ComboFix 14-10-02.01 - Admin 02.10.2014  22:19:01.1.4 - x64
Microsoft Windows 7 Professional   6.1.7601.1.1252.49.1031.18.8075.6322 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\programdata\Roaming
C:\root
c:\root\wpfdot.exe
c:\users\Admin\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
c:\windows\SysWow64\SET47EE.tmp
c:\windows\SysWow64\SET52EC.tmp
c:\windows\SysWow64\SET533C.tmp
c:\windows\SysWow64\SET5987.tmp
c:\windows\SysWow64\SET6700.tmp
c:\windows\SysWow64\SET6730.tmp
Q:\Autorun.inf
.
.
(((((((((((((((((((((((   Dateien erstellt von 2014-09-02 bis 2014-10-02  ))))))))))))))))))))))))))))))
.
.
2014-10-02 20:24 . 2014-10-02 20:24	--------	d-----w-	c:\users\y\AppData\Local\temp
2014-10-02 20:24 . 2014-10-02 20:24	--------	d-----w-	c:\users\UpdatusUser\AppData\Local\temp
2014-10-02 17:38 . 2014-09-15 00:08	11578928	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{297C58CA-5B5B-441F-8BEC-32EBD1688F23}\mpengine.dll
2014-10-02 11:53 . 2014-10-02 11:53	--------	d-----w-	c:\program files (x86)\7-Zip
2014-10-02 09:52 . 2014-10-02 10:31	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2014-10-01 09:13 . 2014-09-25 02:08	371712	----a-w-	c:\windows\system32\qdvd.dll
2014-10-01 09:13 . 2014-09-25 01:40	519680	----a-w-	c:\windows\SysWow64\qdvd.dll
2014-09-27 09:27 . 2014-09-27 09:27	--------	d-----w-	c:\users\y\AppData\Local\Lenovo
2014-09-25 19:09 . 2014-09-26 07:24	--------	d-----w-	c:\users\y\AppData\Local\Mozilla Thunderbird
2014-09-24 07:50 . 2014-09-09 22:11	2048	----a-w-	c:\windows\system32\tzres.dll
2014-09-24 07:50 . 2014-09-09 21:47	2048	----a-w-	c:\windows\SysWow64\tzres.dll
2014-09-22 19:13 . 2014-09-22 19:13	--------	d-----w-	c:\users\y\AppData\Local\Diagnostics
2014-09-21 15:22 . 2014-09-21 15:23	--------	d-----w-	c:\users\Admin\AppData\Local\Adobe
2014-09-20 23:01 . 2014-09-20 23:09	--------	d-----w-	c:\users\y\AppData\Local\gtk-2.0
2014-09-20 23:00 . 2014-09-20 23:00	--------	d-----w-	c:\users\y\.thumbnails
2014-09-20 22:55 . 2014-09-20 22:55	--------	d-----w-	c:\users\y\AppData\Local\fontconfig
2014-09-20 22:55 . 2014-09-20 23:09	--------	d-----w-	c:\users\y\.gimp-2.8
2014-09-20 22:55 . 2014-09-20 22:55	--------	d-----w-	c:\users\y\AppData\Local\gegl-0.2
2014-09-20 22:45 . 2014-09-20 22:46	--------	d-----w-	c:\program files\GIMP 2
2014-09-20 22:17 . 2014-09-20 22:17	--------	d-----w-	c:\users\y\AppData\Local\PDF24
2014-09-20 22:17 . 2014-09-20 22:17	--------	d-----w-	c:\program files (x86)\PDF24
2014-09-19 12:43 . 2014-09-19 12:43	--------	d-----w-	c:\program files\Common Files\EPSON
2014-09-19 11:51 . 2014-09-19 11:51	--------	d-----w-	c:\users\y\AppData\Roaming\Epson
2014-09-19 11:37 . 2014-09-19 11:37	--------	d-----w-	c:\users\Admin\AppData\Roaming\Epson
2014-09-19 11:37 . 2014-09-22 13:47	--------	d-----w-	c:\program files (x86)\Epson Software
2014-09-19 11:36 . 2014-09-23 10:31	--------	d-----w-	c:\program files (x86)\epson
2014-09-19 11:35 . 2007-04-09 23:06	10752	----a-w-	c:\windows\system32\E_GCINST.DLL
2014-09-19 11:35 . 2011-04-19 01:03	120320	----a-w-	c:\windows\system32\E_YLMJJE.DLL
2014-09-19 11:35 . 2011-03-14 01:03	83968	----a-w-	c:\windows\system32\E_YD4BJJE.DLL
2014-09-19 11:35 . 2014-09-20 12:45	--------	d-----w-	c:\programdata\EPSON
2014-09-12 21:15 . 2014-09-12 21:15	--------	d-----w-	c:\users\y\AppData\Roaming\NVIDIA
2014-09-12 18:21 . 2014-10-02 19:30	--------	d-----w-	c:\users\y\AppData\Roaming\.minecraft
2014-09-12 14:46 . 2014-06-27 02:08	2777088	----a-w-	c:\windows\system32\msmpeg2vdec.dll
2014-09-12 14:46 . 2014-06-27 01:45	2285056	----a-w-	c:\windows\SysWow64\msmpeg2vdec.dll
2014-09-11 06:44 . 2014-08-01 11:53	1031168	----a-w-	c:\windows\system32\TSWorkspace.dll
2014-09-11 06:44 . 2014-08-01 11:35	793600	----a-w-	c:\windows\SysWow64\TSWorkspace.dll
2014-09-11 06:44 . 2014-06-24 03:29	2565120	----a-w-	c:\windows\system32\d3d10warp.dll
2014-09-11 06:44 . 2014-06-24 02:59	1987584	----a-w-	c:\windows\SysWow64\d3d10warp.dll
2014-09-11 06:44 . 2014-07-07 02:06	728064	----a-w-	c:\windows\system32\kerberos.dll
2014-09-11 06:44 . 2014-07-07 02:06	1460736	----a-w-	c:\windows\system32\lsasrv.dll
2014-09-11 06:44 . 2014-07-07 01:40	22016	----a-w-	c:\windows\SysWow64\secur32.dll
2014-09-11 06:44 . 2014-07-07 01:40	550912	----a-w-	c:\windows\SysWow64\kerberos.dll
2014-09-11 06:44 . 2014-07-07 01:39	96768	----a-w-	c:\windows\SysWow64\sspicli.dll
2014-09-11 06:44 . 2014-09-05 02:10	578048	----a-w-	c:\windows\system32\aepdu.dll
2014-09-11 06:44 . 2014-09-05 02:05	424448	----a-w-	c:\windows\system32\aeinv.dll
2014-09-03 23:00 . 2014-09-03 23:00	--------	d-----w-	c:\program files (x86)\PDF Architect 2
2014-09-03 22:59 . 2014-09-03 22:59	--------	d-----w-	c:\programdata\PDF Architect 2
2014-09-03 22:59 . 2014-09-03 22:59	--------	d-----w-	c:\users\Admin\AppData\Roaming\pdfforge
2014-09-03 22:59 . 2014-04-25 15:44	662288	----a-w-	c:\windows\SysWow64\MSCOMCT2.OCX
2014-09-03 22:59 . 2014-04-25 15:44	137000	----a-w-	c:\windows\SysWow64\MSMAPI32.OCX
2014-09-03 22:59 . 2014-04-25 15:44	110264	----a-w-	c:\windows\system32\pdfcmon.dll
2014-09-03 22:59 . 2014-09-03 23:00	--------	d-----w-	c:\program files (x86)\PDFCreator
2014-09-03 22:59 . 2014-04-25 15:44	23552	----a-w-	c:\windows\SysWow64\MSMPIDE.DLL
2014-09-03 22:59 . 1998-07-06 16:56	125712	----a-w-	c:\windows\SysWow64\VB6DE.DLL
2014-09-03 22:59 . 1998-07-06 16:55	158208	----a-w-	c:\windows\SysWow64\MSCMCDE.DLL
2014-09-03 22:59 . 1998-07-06 16:55	64512	----a-w-	c:\windows\SysWow64\MSCC2DE.DLL
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2014-10-02 10:13 . 2014-08-07 09:10	128728	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2014-10-02 09:51 . 2014-08-07 09:10	92888	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2014-09-21 15:22 . 2014-06-24 10:47	701104	----a-w-	c:\windows\SysWow64\FlashPlayerApp.exe
2014-09-21 15:22 . 2011-06-25 15:11	71344	----a-w-	c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2014-09-15 07:06 . 2010-11-21 03:27	278152	------w-	c:\windows\system32\MpSigStub.exe
2014-09-12 14:46 . 2011-06-21 18:16	101694776	----a-w-	c:\windows\system32\MRT.exe
2014-08-23 02:07 . 2014-08-27 19:57	404480	----a-w-	c:\windows\system32\gdi32.dll
2014-08-23 01:45 . 2014-08-27 19:57	311808	----a-w-	c:\windows\SysWow64\gdi32.dll
2014-08-23 00:59 . 2014-08-27 19:57	3163648	----a-w-	c:\windows\system32\win32k.sys
2014-08-11 20:34 . 2014-08-11 20:34	98216	----a-w-	c:\windows\SysWow64\WindowsAccessBridge-32.dll
2014-08-04 15:43 . 2014-08-04 15:43	42040	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2014-08-04 15:19 . 2014-08-04 15:41	28600	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2014-08-04 15:19 . 2014-08-04 15:41	130584	----a-w-	c:\windows\system32\drivers\avipbb.sys
2014-08-04 15:19 . 2014-08-04 15:41	117712	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2014-07-25 00:35 . 2014-07-25 00:35	875688	----a-w-	c:\windows\SysWow64\msvcr120_clr0400.dll
2014-07-24 21:47 . 2014-07-24 21:47	869544	----a-w-	c:\windows\system32\msvcr120_clr0400.dll
2014-07-15 14:16 . 2014-08-07 08:55	863528	----a-w-	c:\windows\system32\drivers\VBoxDrv.sys
2014-07-15 14:15 . 2014-08-07 08:53	129168	----a-w-	c:\windows\system32\drivers\VBoxUSBMon.sys
2014-07-15 14:15 . 2014-07-15 14:15	142528	----a-w-	c:\windows\system32\drivers\VBoxNetAdp.sys
2014-07-15 14:13 . 2014-07-15 14:13	205352	------w-	c:\windows\system32\VBoxNetFltNobj.dll
2014-07-14 02:02 . 2014-08-12 17:08	1216000	----a-w-	c:\windows\system32\rpcrt4.dll
2014-07-14 01:40 . 2014-08-12 17:08	664064	----a-w-	c:\windows\SysWow64\rpcrt4.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"IMSS"="c:\program files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe" [2011-01-17 112152]
"PWMTRV"="c:\progra~2\ThinkPad\UTILIT~1\PWMTR64V.DLL" [2011-07-04 1605992]
"X-Rite Legacy Device"="c:\program files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe" [2010-09-27 105984]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2011-06-06 937920]
"RotateImage"="c:\program files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe" [2008-10-30 55808]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2011-09-16 115048]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2014-08-07 751184]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2014-07-25 256896]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2012-11-05 89184]
"Avira Systray"="c:\program files (x86)\Avira\My Avira\Avira.OE.Systray.exe" [2014-08-27 164656]
"PDFPrint"="c:\program files (x86)\PDF24\pdf24.exe" [2014-07-04 191528]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Bluetooth.lnk - c:\program files\ThinkPad\Bluetooth Software\BTTray.exe [2010-12-18 1202976]
Color Calibrator Gamma.lnk - c:\program files (x86)\X-Rite\PANTONE Color Calibrator\Gamma\CalibrationLoader.exe [2011-5-24 802816]
Color Calibrator Tray.lnk - c:\program files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe [2011-5-24 10383872]
Digital Line Detect.lnk - c:\program files (x86)\Digital Line Detect\DLG.exe [2011-5-24 50688]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"DisableCAD"= 1 (0x1)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\winlogon]
"Userinit"="userinit.exe"
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	scecli c:\program files\ThinkVantage Fingerprint Software\psqlpwd.dll
.
R0 vmci;VMware VMCI Bus Driver;c:\windows\system32\DRIVERS\vmci.sys;c:\windows\SYSNATIVE\DRIVERS\vmci.sys [x]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [x]
R2 smihlp;SMI Helper Driver (smihlp);c:\program files\ThinkVantage Fingerprint Software\smihlp.sys;c:\program files\ThinkVantage Fingerprint Software\smihlp.sys [x]
R3 BTWAMPFL;BTWAMPFL;c:\windows\system32\DRIVERS\btwampfl.sys;c:\windows\SYSNATIVE\DRIVERS\btwampfl.sys [x]
R3 btwl2cap;Bluetooth L2CAP Service;c:\windows\system32\DRIVERS\btwl2cap.sys;c:\windows\SYSNATIVE\DRIVERS\btwl2cap.sys [x]
R3 dmvsc;dmvsc;c:\windows\system32\drivers\dmvsc.sys;c:\windows\SYSNATIVE\drivers\dmvsc.sys [x]
R3 DozeSvc;Lenovo Doze Mode Service;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE;c:\program files (x86)\ThinkPad\Utilities\DZSVC64.EXE [x]
R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys;c:\windows\SYSNATIVE\drivers\mbamchameleon.sys [x]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [x]
R3 PDF Architect 2;PDF Architect 2;c:\program files (x86)\PDF Architect 2\ws.exe;c:\program files (x86)\PDF Architect 2\ws.exe [x]
R3 pdfforge CrashHandler;pdfforge CrashHandler;c:\program files (x86)\PDF Architect 2\crash-handler-ws.exe;c:\program files (x86)\PDF Architect 2\crash-handler-ws.exe [x]
R3 pmxdrv;pmxdrv;c:\windows\system32\drivers\pmxdrv.sys;c:\windows\SYSNATIVE\drivers\pmxdrv.sys [x]
R3 Power Manager DBC Service;Power Manager DBC Service;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE [x]
R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys;c:\windows\SYSNATIVE\drivers\rdpvideominiport.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS;c:\windows\SYSNATIVE\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys;c:\windows\SYSNATIVE\drivers\tsusbflt.sys [x]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys;c:\windows\SYSNATIVE\drivers\TsUsbGD.sys [x]
R3 VBoxNetAdp;VirtualBox Host-Only Ethernet Adapter;c:\windows\system32\DRIVERS\VBoxNetAdp.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetAdp.sys [x]
R3 VBoxNetFlt;VirtualBox Bridged Networking Service;c:\windows\system32\DRIVERS\VBoxNetFlt.sys;c:\windows\SYSNATIVE\DRIVERS\VBoxNetFlt.sys [x]
R3 WwanUsbServ;Mobile Broadband Driver;c:\windows\system32\DRIVERS\WwanUsbMp64.sys;c:\windows\SYSNATIVE\DRIVERS\WwanUsbMp64.sys [x]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe;c:\program files\Windows Live\Mesh\wlcrasvc.exe [x]
S0 DzHDD64;DzHDD64;c:\windows\System32\DRIVERS\DzHDD64.sys;c:\windows\SYSNATIVE\DRIVERS\DzHDD64.sys [x]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvpciflt.sys [x]
S0 TPDIGIMN;TPDIGIMN;c:\windows\System32\DRIVERS\ApsHM64.sys;c:\windows\SYSNATIVE\DRIVERS\ApsHM64.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys;c:\windows\SYSNATIVE\DRIVERS\avkmgr.sys [x]
S1 lenovo.smi;Lenovo System Interface Driver;c:\windows\system32\DRIVERS\smiifx64.sys;c:\windows\SYSNATIVE\DRIVERS\smiifx64.sys [x]
S1 nvkflt;nvkflt;c:\windows\system32\DRIVERS\nvkflt.sys;c:\windows\SYSNATIVE\DRIVERS\nvkflt.sys [x]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [x]
S2 Avira.OE.ServiceHost;Avira Service Host;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe;c:\program files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [x]
S2 CxAudMsg;Conexant Audio Message Service;c:\windows\system32\CxAudMsg64.exe;c:\windows\SYSNATIVE\CxAudMsg64.exe [x]
S2 EPSON_PM_RPCV4_05;EPSON V3 Service4(05);c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE;c:\program files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE [x]
S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe;c:\windows\SYSNATIVE\svchost.exe [x]
S2 i1 Display Service;X-Rite Device i1 Display;c:\program files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe;c:\program files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [x]
S2 jhi_service;Intel(R) Identity Protection Technology Host Interface Service;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe;c:\program files (x86)\Intel\Services\IPT\jhi_service.exe [x]
S2 LENOVO.CAMMUTE;Lenovo Camera Mute;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe;c:\program files\Lenovo\Communications Utility\CAMMUTE.exe [x]
S2 LENOVO.MICMUTE;Lenovo Microphone Mute;c:\program files\LENOVO\HOTKEY\MICMUTE.exe;c:\program files\LENOVO\HOTKEY\MICMUTE.exe [x]
S2 LENOVO.TPKNRSVC;Lenovo Keyboard Noise Reduction;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe;c:\program files\Lenovo\Communications Utility\TPKNRSVC.exe [x]
S2 Lenovo.VIRTSCRLSVC;Lenovo Auto Scroll;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe;c:\program files\LENOVO\VIRTSCRL\lvvsst.exe [x]
S2 PwmEWSvc;Cisco EnergyWise Enabler;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE;c:\program files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE [x]
S2 risdxc;risdxc;c:\windows\system32\DRIVERS\risdxc64.sys;c:\windows\SYSNATIVE\DRIVERS\risdxc64.sys [x]
S2 SAService;Conexant SmartAudio service;c:\windows\system32\SAsrv.exe;c:\windows\SYSNATIVE\SAsrv.exe [x]
S2 SROSVC;Screen Reading Optimizer Service Program;c:\program files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe;c:\program files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [x]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [x]
S2 TPHKLOAD;Lenovo Hotkey Client Loader;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe;c:\program files\LENOVO\HOTKEY\TPHKLOAD.exe [x]
S2 TPHKSVC;Anzeige am Bildschirm;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe;c:\program files\LENOVO\HOTKEY\TPHKSVC.exe [x]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [x]
S2 WMCoreService;Mobile Broadband Service;c:\program files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe servicemode;c:\program files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe servicemode [x]
S2 xritedeviced;X-Rite Device Manager;c:\program files (x86)\X-Rite\Devices\Services\xritedeviced.exe;c:\program files (x86)\X-Rite\Devices\Services\xritedeviced.exe [x]
S3 5U877;USB Video Device;c:\windows\system32\DRIVERS\5U877.sys;c:\windows\SYSNATIVE\DRIVERS\5U877.sys [x]
S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys;c:\windows\SYSNATIVE\DRIVERS\CAXHWAZL.sys [x]
S3 ecnssndis; Mobile Broadband Driver;c:\windows\system32\Drivers\wwuss64.sys;c:\windows\SYSNATIVE\Drivers\wwuss64.sys [x]
S3 ecnssndisfltr; Mobile Broadband Driver Filter;c:\windows\system32\Drivers\wwussf64.sys;c:\windows\SYSNATIVE\Drivers\wwussf64.sys [x]
S3 l36wgps; Mobile Broadband GPS Port;c:\windows\system32\DRIVERS\l36wgps64.sys;c:\windows\SYSNATIVE\DRIVERS\l36wgps64.sys [x]
S3 Mbm3CBus;F5521gw Mobile Broadband Device (WDM);c:\windows\system32\DRIVERS\Mbm3CBus.sys;c:\windows\SYSNATIVE\DRIVERS\Mbm3CBus.sys [x]
S3 Mbm3DevMt; Mobile Broadband Device Management Driver (WDM);c:\windows\system32\DRIVERS\Mbm3DevMt.sys;c:\windows\SYSNATIVE\DRIVERS\Mbm3DevMt.sys [x]
S3 Mbm3mdfl; Mobile Broadband Modem Port Filter;c:\windows\system32\DRIVERS\Mbm3mdfl.sys;c:\windows\SYSNATIVE\DRIVERS\Mbm3mdfl.sys [x]
S3 Mbm3Mdm; Mobile Broadband Modem Port Driver;c:\windows\system32\DRIVERS\Mbm3Mdm.sys;c:\windows\SYSNATIVE\DRIVERS\Mbm3Mdm.sys [x]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3hub.sys [x]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys;c:\windows\SYSNATIVE\DRIVERS\nusb3xhc.sys [x]
S3 TVTI2C;Lenovo SM bus driver;c:\windows\system32\DRIVERS\Tvti2c.sys;c:\windows\SYSNATIVE\DRIVERS\Tvti2c.sys [x]
S3 wdkmd;Intel WiDi KMD;c:\windows\system32\DRIVERS\WDKMD.sys;c:\windows\SYSNATIVE\DRIVERS\WDKMD.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2014-10-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-06-24 15:22]
.
2011-09-09 c:\windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:06]
.
2014-10-02 c:\windows\Tasks\PCDoctorBackgroundMonitorTask.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:06]
.
2014-10-02 c:\windows\Tasks\SystemToolsDailyTest.job
- c:\program files\PC-Doctor\uaclauncher.exe [2011-06-27 15:06]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"TpShocks"="TpShocks.exe" [2011-03-29 380776]
"ForteConfig"="c:\program files\Conexant\ForteConfig\fmapp.exe" [2010-10-26 49056]
"LENOVO.TPKNRRES"="c:\program files\Lenovo\Communications Utility\TPKNRRES.exe" [2011-05-31 40808]
"ALCKRESI.EXE"="c:\program files\Lenovo\AutoLock\ALCKRESI.EXE" [2011-07-13 281960]
"AcWin7Hlpr"="c:\program files (x86)\Lenovo\Access Connections\AcTBenabler.exe" [2014-03-14 63832]
"IntelPAN"="c:\program files\Common Files\Intel\WirelessCommon\iFrmewrk.exe" [2011-05-02 1935120]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2011-10-13 167704]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-03-10 391704]
"Persistence"="c:\windows\system32\igfxpers.exe" [2011-03-10 418840]
"SmartAudio"="c:\program files\CONEXANT\SAII\SAIICpl.exe" [2010-12-14 316032]
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://lenovo.msn.com
mLocal Page = c:\windows\SysWOW64\blank.htm
TCP: DhcpNameServer = 192.168.179.1
FF - ProfilePath - c:\users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\
FF - user.js: extensions.zonealarm.tlbrSrchUrl - hxxp://search.zonealarm.com/search?src=tb&tbid=HFA5&Lan={dfltLng}&gu=a053ba6f3eae4da2947e5617e06943c6 [INSTALLTOOLBAR] [SETSEARCH] [SETHOME]&tu=10GXy00EU1D13P0&sku=&tstsId=&ver=&&q=
FF - user.js: extensions.zonealarm.id - 28637ecf0000000000000024d7c74c78
FF - user.js: extensions.zonealarm.appId - {C56C48A0-DA4E-46F6-9859-1553DC865F84}
FF - user.js: extensions.zonealarm.instlDay - 16238
FF - user.js: extensions.zonealarm.vrsn - 1.8.29.17
FF - user.js: extensions.zonealarm.vrsni - 1.8.29.17
FF - user.js: extensions.zonealarm.vrsnTs - 1.8.29.1722:52
FF - user.js: extensions.zonealarm.prtnrId - checkpoint
FF - user.js: extensions.zonealarm.prdct - zonealarm
FF - user.js: extensions.zonealarm.aflt - 1025
FF - user.js: extensions.zonealarm.smplGrp - NewUSR
FF - user.js: extensions.zonealarm.tlbrId - HFA5
FF - user.js: extensions.zonealarm.instlRef - ZLN22602552235231-1001
FF - user.js: extensions.zonealarm.dfltLng - DE
FF - user.js: extensions.zonealarm.excTlbr - false
FF - user.js: extensions.zonealarm.ffxUnstlRst - false
FF - user.js: extensions.zonealarm.admin - false
FF - user.js: extensions.zonealarm.autoRvrt - false
FF - user.js: extensions.zonealarm.rvrt - false
FF - user.js: extensions.zonealarm.newTab - false
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-Locked - (no file)
Toolbar-Locked - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
c:\program files (x86)\Lenovo\Access Connections\AcSvc.exe
c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
c:\program files (x86)\Avira\AntiVir Desktop\avguard.exe
c:\progra~1\Lenovo\Zoom\TPSCREX.EXE
c:\progra~1\Lenovo\HOTKEY\TPONSCR.EXE
c:\progra~1\LENOVO\VIRTSCRL\virtscrl.exe
c:\program files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
c:\program files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
c:\windows\SysWOW64\SAsrv.exe
c:\program files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
c:\program files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
c:\program files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
c:\program files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2014-10-02  22:30:13 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2014-10-02 20:30
.
Vor Suchlauf: 12 Verzeichnis(se), 446.924.357.632 Bytes frei
Nach Suchlauf: 16 Verzeichnis(se), 449.358.299.136 Bytes frei
.
- - End Of File - - 707E64C4BD48216E28093B4A11E98911
         
In der Zeit vor dem Suchlauf hat Antivir zwei, drei Mal vor Q:\Autorun.inf gewarnt bzw. nach der Deaktivierung wegen Combofix ist gleich eine Warnung wegen Rootkitaktivitäten aufgeploppt. Combofix lief problemlos, nach dem Neustart erkennt das Windows-Wartungscenter immer noch nicht, dass Antivir "laut eigener Aussage" läuft (k. A. was da jetzt stimmt).

Alt 02.10.2014, 21:44   #9
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Bitte ein Log mit dem Tool von Kaspersky:

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Alt 02.10.2014, 22:01   #10
Büromagnet
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



TDSSKiller hat nichts gefunden:
Code:
ATTFilter
22:56:19.0447 0x1b3c  TDSS rootkit removing tool 3.0.0.40 Jul 10 2014 12:37:58
22:57:00.0773 0x1b3c  ============================================================
22:57:00.0773 0x1b3c  Current date / time: 2014/10/02 22:57:00.0763
22:57:00.0773 0x1b3c  SystemInfo:
22:57:00.0773 0x1b3c  
22:57:00.0773 0x1b3c  OS Version: 6.1.7601 ServicePack: 1.0
22:57:00.0773 0x1b3c  Product type: Workstation
22:57:00.0773 0x1b3c  ComputerName: W520
22:57:00.0773 0x1b3c  UserName: Admin
22:57:00.0773 0x1b3c  Windows directory: C:\Windows
22:57:00.0773 0x1b3c  System windows directory: C:\Windows
22:57:00.0773 0x1b3c  Running under WOW64
22:57:00.0773 0x1b3c  Processor architecture: Intel x64
22:57:00.0773 0x1b3c  Number of processors: 4
22:57:00.0773 0x1b3c  Page size: 0x1000
22:57:00.0773 0x1b3c  Boot type: Normal boot
22:57:00.0773 0x1b3c  ============================================================
22:57:00.0903 0x1b3c  KLMD registered as C:\Windows\system32\drivers\91978147.sys
22:57:01.0303 0x1b3c  System UUID: {4A5A2BAE-9B7E-AB9D-1FF3-0009BFD34506}
22:57:01.0633 0x1b3c  Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 ( 698.64 Gb ), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
22:57:01.0643 0x1b3c  ============================================================
22:57:01.0643 0x1b3c  \Device\Harddisk0\DR0:
22:57:01.0643 0x1b3c  MBR partitions:
22:57:01.0643 0x1b3c  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x258000
22:57:01.0643 0x1b3c  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x258800, BlocksNum 0x54404000
22:57:01.0643 0x1b3c  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x5465C800, BlocksNum 0x2EE9800
22:57:01.0643 0x1b3c  ============================================================
22:57:01.0653 0x1b3c  C: <-> \Device\Harddisk0\DR0\Partition2
22:57:01.0703 0x1b3c  Q: <-> \Device\Harddisk0\DR0\Partition3
22:57:01.0703 0x1b3c  ============================================================
22:57:01.0703 0x1b3c  Initialize success
22:57:01.0703 0x1b3c  ============================================================
22:58:03.0723 0x1448  ============================================================
22:58:03.0723 0x1448  Scan started
22:58:03.0723 0x1448  Mode: Manual; SigCheck; TDLFS; 
22:58:03.0723 0x1448  ============================================================
22:58:03.0723 0x1448  KSN ping started
22:58:23.0933 0x1448  KSN ping finished: true
22:58:24.0643 0x1448  ================ Scan system memory ========================
22:58:24.0643 0x1448  System memory - ok
22:58:24.0643 0x1448  ================ Scan services =============================
22:58:24.0823 0x1448  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
22:58:24.0923 0x1448  1394ohci - ok
22:58:24.0983 0x1448  [ F4AF97702BAD85BFEF64B9A557F11B6F, 8255B2FBE64C60562A7DAAAD575EED49EE0D23DD42E5C76C988B8A3673843EA6 ] 5U877           C:\Windows\system32\DRIVERS\5U877.sys
22:58:25.0033 0x1448  5U877 - ok
22:58:25.0063 0x1448  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
22:58:25.0083 0x1448  ACPI - ok
22:58:25.0103 0x1448  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
22:58:25.0123 0x1448  AcpiPmi - ok
22:58:25.0203 0x1448  [ 81FDE4250DA1720657A42C2020B1AA28, 0E35C692347A576B41ADC45D922AF6B9F0A7F857E94A50842873A55D21F4C9D0 ] AcPrfMgrSvc     C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
22:58:25.0233 0x1448  AcPrfMgrSvc - ok
22:58:25.0253 0x1448  [ 01A8EAA10F8B827F59CF506A97EC37C0, 44351082300A5B3A90F742F5C39AFF219D5FCF2F94CA7785DB2762AEB854212E ] AcSvc           C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
22:58:25.0263 0x1448  AcSvc - ok
22:58:25.0323 0x1448  [ 11A52CF7B265631DEEB24C6149309EFF, CBA25D358185FD4BE261C6C1B518AD60F5D27D5FB418098AB262B10F5A11C178 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
22:58:25.0353 0x1448  AdobeARMservice - ok
22:58:25.0493 0x1448  [ FBB312C9DA3863673EC18F4AE4101778, 4E9AAE7C700E485C17FDFCC9100A79784673B006D00D4D4CE8F1DB617D25C864 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
22:58:25.0513 0x1448  AdobeFlashPlayerUpdateSvc - ok
22:58:25.0563 0x1448  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
22:58:25.0603 0x1448  adp94xx - ok
22:58:25.0633 0x1448  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\drivers\adpahci.sys
22:58:25.0653 0x1448  adpahci - ok
22:58:25.0653 0x1448  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
22:58:25.0663 0x1448  adpu320 - ok
22:58:25.0683 0x1448  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
22:58:25.0713 0x1448  AeLookupSvc - ok
22:58:25.0773 0x1448  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
22:58:25.0803 0x1448  AFD - ok
22:58:25.0823 0x1448  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
22:58:25.0833 0x1448  agp440 - ok
22:58:25.0843 0x1448  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
22:58:25.0863 0x1448  ALG - ok
22:58:25.0903 0x1448  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
22:58:25.0923 0x1448  aliide - ok
22:58:25.0943 0x1448  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
22:58:25.0953 0x1448  amdide - ok
22:58:25.0963 0x1448  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
22:58:25.0973 0x1448  AmdK8 - ok
22:58:25.0993 0x1448  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
22:58:26.0003 0x1448  AmdPPM - ok
22:58:26.0023 0x1448  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
22:58:26.0033 0x1448  amdsata - ok
22:58:26.0053 0x1448  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
22:58:26.0063 0x1448  amdsbs - ok
22:58:26.0073 0x1448  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
22:58:26.0083 0x1448  amdxata - ok
22:58:26.0163 0x1448  [ 0327A6CE0934C324E3E82920E9EC0EE4, B4A1E6A77032F7DF97FED3C01E76E2BD3270A3FFC500C7C9A118C0E2EB675D75 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
22:58:26.0183 0x1448  AntiVirSchedulerService - ok
22:58:26.0203 0x1448  [ 0327A6CE0934C324E3E82920E9EC0EE4, B4A1E6A77032F7DF97FED3C01E76E2BD3270A3FFC500C7C9A118C0E2EB675D75 ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
22:58:26.0213 0x1448  AntiVirService - ok
22:58:26.0253 0x1448  [ 89A69C3F2F319B43379399547526D952, 8ABDB4B8E106F96EBBA0D4D04C4F432296516E107E7BA5644ED2E50CF9BB491A ] AppID           C:\Windows\system32\drivers\appid.sys
22:58:26.0323 0x1448  AppID - ok
22:58:26.0333 0x1448  [ 0BC381A15355A3982216F7172F545DE1, C33AF13CB218F7BF52E967452573DF2ADD20A95C6BF99229794FEF07C4BBE725 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
22:58:26.0383 0x1448  AppIDSvc - ok
22:58:26.0403 0x1448  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
22:58:26.0443 0x1448  Appinfo - ok
22:58:26.0483 0x1448  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
22:58:26.0533 0x1448  AppMgmt - ok
22:58:26.0563 0x1448  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\drivers\arc.sys
22:58:26.0583 0x1448  arc - ok
22:58:26.0603 0x1448  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\drivers\arcsas.sys
22:58:26.0613 0x1448  arcsas - ok
22:58:26.0723 0x1448  [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
22:58:26.0743 0x1448  aspnet_state - ok
22:58:26.0763 0x1448  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
22:58:26.0793 0x1448  AsyncMac - ok
22:58:26.0843 0x1448  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
22:58:26.0853 0x1448  atapi - ok
22:58:26.0913 0x1448  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
22:58:26.0963 0x1448  AudioEndpointBuilder - ok
22:58:26.0993 0x1448  [ F23FEF6D569FCE88671949894A8BECF1, FCE7B156ED663471CF9A736915F00302E93B50FC647563D235313A37FCE8F0F6 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
22:58:27.0023 0x1448  AudioSrv - ok
22:58:27.0063 0x1448  [ 4663C5AD76FE8E19592DE808156FA07D, 605827B4A9D6930BC752D124BF75D55D4927B0ABEF881CDE66F3C5CC1DB215FE ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
22:58:27.0093 0x1448  avgntflt - ok
22:58:27.0103 0x1448  [ 8902AEC2382A37E9E99A4E0D52DBD42B, 138F2D7E7430132B2C527D413BC845CC467F084F39C232EC3A17DD2A74EE401E ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
22:58:27.0113 0x1448  avipbb - ok
22:58:27.0203 0x1448  [ 05ABC09DC0DFA5DF79A0BB39F60636B7, FEDE900D991F1FB40BA0A44E05181A6A506DC8B5F365E78E523CB6DF2CDACC15 ] Avira.OE.ServiceHost C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
22:58:27.0223 0x1448  Avira.OE.ServiceHost - ok
22:58:27.0233 0x1448  [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
22:58:27.0243 0x1448  avkmgr - ok
22:58:27.0293 0x1448  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
22:58:27.0323 0x1448  AxInstSV - ok
22:58:27.0383 0x1448  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
22:58:27.0443 0x1448  b06bdrv - ok
22:58:27.0473 0x1448  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
22:58:27.0503 0x1448  b57nd60a - ok
22:58:27.0533 0x1448  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
22:58:27.0563 0x1448  BDESVC - ok
22:58:27.0573 0x1448  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
22:58:27.0603 0x1448  Beep - ok
22:58:27.0643 0x1448  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
22:58:27.0683 0x1448  BFE - ok
22:58:27.0723 0x1448  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\system32\qmgr.dll
22:58:27.0763 0x1448  BITS - ok
22:58:27.0793 0x1448  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
22:58:27.0803 0x1448  blbdrive - ok
22:58:27.0823 0x1448  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
22:58:27.0843 0x1448  bowser - ok
22:58:27.0873 0x1448  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
22:58:27.0903 0x1448  BrFiltLo - ok
22:58:27.0903 0x1448  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
22:58:27.0913 0x1448  BrFiltUp - ok
22:58:27.0943 0x1448  [ 5C2F352A4E961D72518261257AAE204B, 9EE1001E1D46A414A7A86FE1DBBE232203E26F54D9EF43ED31ED8EACD4D09853 ] BridgeMP        C:\Windows\system32\DRIVERS\bridge.sys
22:58:27.0963 0x1448  BridgeMP - ok
22:58:27.0993 0x1448  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
22:58:28.0003 0x1448  Browser - ok
22:58:28.0013 0x1448  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
22:58:28.0053 0x1448  Brserid - ok
22:58:28.0073 0x1448  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
22:58:28.0083 0x1448  BrSerWdm - ok
22:58:28.0103 0x1448  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
22:58:28.0113 0x1448  BrUsbMdm - ok
22:58:28.0123 0x1448  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
22:58:28.0123 0x1448  BrUsbSer - ok
22:58:28.0163 0x1448  [ CF98190A94F62E405C8CB255018B2315, E1B2540023C4FE9FD588E4B6AE6347DFA565EB3898F21E5360882BF3E8B5E781 ] BthEnum         C:\Windows\system32\drivers\BthEnum.sys
22:58:28.0213 0x1448  BthEnum - ok
22:58:28.0243 0x1448  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
22:58:28.0263 0x1448  BTHMODEM - ok
22:58:28.0283 0x1448  [ 02DD601B708DD0667E1331FA8518E9FF, 7DE6CC4DBB621CD03B01D9CE6CF66EAFE31D39030A391562CD0E278E1D70ADE1 ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
22:58:28.0313 0x1448  BthPan - ok
22:58:28.0383 0x1448  [ 738D0E9272F59EB7A1449C3EC118E6C4, FE3D32C2A5E4DC21376A0F89C0B2EE024ECF1A3FB99213CC9BBC986ADF7AF080 ] BTHPORT         C:\Windows\System32\Drivers\BTHport.sys
22:58:28.0463 0x1448  BTHPORT - ok
22:58:28.0493 0x1448  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
22:58:28.0553 0x1448  bthserv - ok
22:58:28.0573 0x1448  [ F188B7394D81010767B6DF3178519A37, 576304E92FD94908F093A6AB5F4D328F25829BE32EC3CA0D29EBFDF5DE83539B ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
22:58:28.0583 0x1448  BTHUSB - ok
22:58:28.0653 0x1448  [ 8834F87A6A745872894DF8223201A6C3, B8C26E11EAAB4A93E4241B4B6F00C1CA05501011E28D6A06D4B009BA4E3AB7CD ] BTWAMPFL        C:\Windows\system32\DRIVERS\btwampfl.sys
22:58:28.0683 0x1448  BTWAMPFL - ok
22:58:28.0703 0x1448  [ 9863D82ECBEC6106D377ED73680D99D8, 27DA7335BB14BBF9DC627C8F97ED59BA3479E5E084704AE4C16B1A3E67CB184C ] btwaudio        C:\Windows\system32\drivers\btwaudio.sys
22:58:28.0723 0x1448  btwaudio - ok
22:58:28.0733 0x1448  [ 3432DD66AE75AB2DE6D0527AD78DBFC7, C2DEB409CDA3621E33E429E592A81E09095C52CDCE36732C9BEA00B92994E44D ] btwavdt         C:\Windows\system32\DRIVERS\btwavdt.sys
22:58:28.0743 0x1448  btwavdt - ok
22:58:28.0833 0x1448  [ EB4AFE08FB39BB444F221D7D501E0915, 2AF8ECEEAB5A0E972660C1553B555E49C49F19500ABD67DFEB9BEBA7E577A700 ] btwdins         C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
22:58:28.0863 0x1448  btwdins - ok
22:58:28.0883 0x1448  [ 382DC5A631CED0462EA09B7EB898BDBF, 7457145E194310F4EB9273471EA41100D3A1448BC2A366064B25A212B389AACB ] btwl2cap        C:\Windows\system32\DRIVERS\btwl2cap.sys
22:58:28.0883 0x1448  btwl2cap - ok
22:58:28.0903 0x1448  [ 13A9C2CEDD44C175E6CA39A536795CA6, 13D6D24C2127E6A5E9AB2DFAA9729D57AA6CFCC72DFACF78E4DE7E63ABA122DF ] btwrchid        C:\Windows\system32\DRIVERS\btwrchid.sys
22:58:28.0903 0x1448  btwrchid - ok
22:58:28.0933 0x1448  catchme - ok
22:58:28.0983 0x1448  [ 48360B88C4BF45850653BB7C86888ED4, 454C2DD81BFCC7FF4819CDFE3C5506E31A3FE86B06FB18009783CD2FEA74B0BF ] CAXHWAZL        C:\Windows\system32\DRIVERS\CAXHWAZL.sys
22:58:29.0023 0x1448  CAXHWAZL - ok
22:58:29.0043 0x1448  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
22:58:29.0083 0x1448  cdfs - ok
22:58:29.0113 0x1448  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
22:58:29.0133 0x1448  cdrom - ok
22:58:29.0173 0x1448  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
22:58:29.0233 0x1448  CertPropSvc - ok
22:58:29.0253 0x1448  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\drivers\circlass.sys
22:58:29.0273 0x1448  circlass - ok
22:58:29.0283 0x1448  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
22:58:29.0303 0x1448  CLFS - ok
22:58:29.0373 0x1448  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
22:58:29.0403 0x1448  clr_optimization_v2.0.50727_32 - ok
22:58:29.0433 0x1448  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
22:58:29.0463 0x1448  clr_optimization_v2.0.50727_64 - ok
22:58:29.0513 0x1448  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
22:58:29.0523 0x1448  clr_optimization_v4.0.30319_32 - ok
22:58:29.0553 0x1448  [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
22:58:29.0563 0x1448  clr_optimization_v4.0.30319_64 - ok
22:58:29.0583 0x1448  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
22:58:29.0593 0x1448  CmBatt - ok
22:58:29.0603 0x1448  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
22:58:29.0613 0x1448  cmdide - ok
22:58:29.0673 0x1448  [ EBF28856F69CF094A902F884CF989706, AD6C9F0BC20AA49EEE5478DA0F856F0EA2B414B63208C5FFB03C9D7F5B59765F ] CNG             C:\Windows\system32\Drivers\cng.sys
22:58:29.0703 0x1448  CNG - ok
22:58:29.0793 0x1448  [ 5BEC441B6B91E874C987C06F98176D90, FA4B523271947AE908C41BA2ABB1E4871359C8DE21E0ECC2B4CD49F734EF8FB4 ] CnxtHdAudService C:\Windows\system32\drivers\CHDRT64.sys
22:58:29.0833 0x1448  CnxtHdAudService - ok
22:58:29.0863 0x1448  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
22:58:29.0873 0x1448  Compbatt - ok
22:58:29.0893 0x1448  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
22:58:29.0923 0x1448  CompositeBus - ok
22:58:29.0933 0x1448  COMSysApp - ok
22:58:29.0943 0x1448  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
22:58:29.0953 0x1448  crcdisk - ok
22:58:30.0013 0x1448  [ 6B400F211BEE880A37A1ED0368776BF4, 2F27C6FA96A1C8CBDA467846DA57E63949A7EA37DB094B13397DDD30114295BD ] CryptSvc        C:\Windows\system32\cryptsvc.dll
22:58:30.0033 0x1448  CryptSvc - ok
22:58:30.0053 0x1448  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
22:58:30.0083 0x1448  CSC - ok
22:58:30.0153 0x1448  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
22:58:30.0193 0x1448  CscService - ok
22:58:30.0223 0x1448  [ 9D0D050170D47E778B624A28C90F23DE, 48528AA9EB0C9FB5086D992EF1F9556C8249D267C2E3D4E681D5C8B6BC316C71 ] CxAudMsg        C:\Windows\system32\CxAudMsg64.exe
22:58:30.0233 0x1448  CxAudMsg - ok
22:58:30.0263 0x1448  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
22:58:30.0293 0x1448  DcomLaunch - ok
22:58:30.0313 0x1448  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
22:58:30.0343 0x1448  defragsvc - ok
22:58:30.0343 0x1448  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
22:58:30.0383 0x1448  DfsC - ok
22:58:30.0443 0x1448  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
22:58:30.0503 0x1448  Dhcp - ok
22:58:30.0513 0x1448  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
22:58:30.0533 0x1448  discache - ok
22:58:30.0563 0x1448  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\drivers\disk.sys
22:58:30.0563 0x1448  Disk - ok
22:58:30.0573 0x1448  [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc           C:\Windows\system32\drivers\dmvsc.sys
22:58:30.0593 0x1448  dmvsc - ok
22:58:30.0623 0x1448  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
22:58:30.0653 0x1448  Dnscache - ok
22:58:30.0673 0x1448  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
22:58:30.0703 0x1448  dot3svc - ok
22:58:30.0783 0x1448  [ 7719FB1A82B2972B1F326AD2F80C2606, CF63DB41327D8531C5D808F885BD55F58C3619395EA69F0C29EE72B870D960DD ] DozeSvc         C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
22:58:30.0813 0x1448  DozeSvc - ok
22:58:30.0853 0x1448  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
22:58:30.0893 0x1448  DPS - ok
22:58:30.0923 0x1448  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
22:58:30.0943 0x1448  drmkaud - ok
22:58:31.0013 0x1448  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
22:58:31.0043 0x1448  DXGKrnl - ok
22:58:31.0083 0x1448  [ CE4CFFD9F64B86BCEB1C343FC9924D72, A7E03531661C808F34560765136E1912A1389C459BA996880761539F4967056E ] DzHDD64         C:\Windows\system32\DRIVERS\DzHDD64.sys
22:58:31.0103 0x1448  DzHDD64 - ok
22:58:31.0173 0x1448  [ 23B6F8081F5C7AF1343810641EE0DD58, 571EF6BC76C062AF0FC696213638831EBC90B056B353AD440B01CA17E0D5B1B7 ] e1cexpress      C:\Windows\system32\DRIVERS\e1c62x64.sys
22:58:31.0193 0x1448  e1cexpress - ok
22:58:31.0203 0x1448  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
22:58:31.0243 0x1448  EapHost - ok
22:58:31.0363 0x1448  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\drivers\evbda.sys
22:58:31.0523 0x1448  ebdrv - ok
22:58:31.0543 0x1448  [ F88F2E5806FC405B0FA94B7947A5875E, 292DA82C308C9F9775DF4E2C8FDE726D4BA6B224049C113809422EDE07919248 ] ecnssndis       C:\Windows\system32\Drivers\wwuss64.sys
22:58:31.0553 0x1448  ecnssndis - ok
22:58:31.0563 0x1448  [ C8CD88218EFC28F7E44A9892B3E97F4D, 3C84997B657808BBE1A9B9AD5EB8E1900ED703D67C3CE66F85BA0BADDA616CD8 ] ecnssndisfltr   C:\Windows\system32\Drivers\wwussf64.sys
22:58:31.0573 0x1448  ecnssndisfltr - ok
22:58:31.0613 0x1448  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] EFS             C:\Windows\System32\lsass.exe
22:58:31.0633 0x1448  EFS - ok
22:58:31.0683 0x1448  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
22:58:31.0763 0x1448  ehRecvr - ok
22:58:31.0773 0x1448  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
22:58:31.0793 0x1448  ehSched - ok
22:58:31.0833 0x1448  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
22:58:31.0853 0x1448  elxstor - ok
22:58:31.0913 0x1448  [ A7E8186E04F38E836C19AC147F8B2ED0, 329639595F02060C215A6334FCE1651FB9B9B5679BA9052A487B57265608D162 ] EPSON_PM_RPCV4_05 C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
22:58:31.0943 0x1448  EPSON_PM_RPCV4_05 - ok
22:58:31.0963 0x1448  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
22:58:31.0983 0x1448  ErrDev - ok
22:58:32.0033 0x1448  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
22:58:32.0073 0x1448  EventSystem - ok
22:58:32.0203 0x1448  [ 54FC81B0162478A72A93DBBEAFB35671, 1C0FA242E81105E2BB839ED32119DAF012FA4A3DB5D0E079350449CBB0CBF033 ] EvtEng          C:\Program Files\Intel\WiFi\bin\EvtEng.exe
22:58:32.0243 0x1448  EvtEng - ok
22:58:32.0293 0x1448  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
22:58:32.0363 0x1448  exfat - ok
22:58:32.0383 0x1448  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
22:58:32.0413 0x1448  fastfat - ok
22:58:32.0463 0x1448  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
22:58:32.0523 0x1448  Fax - ok
22:58:32.0533 0x1448  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\drivers\fdc.sys
22:58:32.0563 0x1448  fdc - ok
22:58:32.0573 0x1448  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
22:58:32.0593 0x1448  fdPHost - ok
22:58:32.0603 0x1448  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
22:58:32.0633 0x1448  FDResPub - ok
22:58:32.0643 0x1448  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
22:58:32.0653 0x1448  FileInfo - ok
22:58:32.0653 0x1448  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
22:58:32.0753 0x1448  Filetrace - ok
22:58:32.0773 0x1448  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
22:58:32.0783 0x1448  flpydisk - ok
22:58:32.0793 0x1448  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
22:58:32.0813 0x1448  FltMgr - ok
22:58:32.0923 0x1448  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
22:58:33.0003 0x1448  FontCache - ok
22:58:33.0053 0x1448  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
22:58:33.0073 0x1448  FontCache3.0.0.0 - ok
22:58:33.0083 0x1448  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
22:58:33.0103 0x1448  FsDepends - ok
22:58:33.0103 0x1448  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
22:58:33.0123 0x1448  Fs_Rec - ok
22:58:33.0143 0x1448  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
22:58:33.0153 0x1448  fvevol - ok
22:58:33.0183 0x1448  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
22:58:33.0183 0x1448  gagp30kx - ok
22:58:33.0213 0x1448  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
22:58:33.0263 0x1448  gpsvc - ok
22:58:33.0283 0x1448  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
22:58:33.0303 0x1448  hcw85cir - ok
22:58:33.0333 0x1448  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
22:58:33.0363 0x1448  HdAudAddService - ok
22:58:33.0373 0x1448  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
22:58:33.0403 0x1448  HDAudBus - ok
22:58:33.0413 0x1448  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys
22:58:33.0433 0x1448  HidBatt - ok
22:58:33.0433 0x1448  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
22:58:33.0453 0x1448  HidBth - ok
22:58:33.0463 0x1448  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\drivers\hidir.sys
22:58:33.0473 0x1448  HidIr - ok
22:58:33.0493 0x1448  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\System32\hidserv.dll
22:58:33.0513 0x1448  hidserv - ok
22:58:33.0543 0x1448  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
22:58:33.0553 0x1448  HidUsb - ok
22:58:33.0573 0x1448  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
22:58:33.0603 0x1448  hkmsvc - ok
22:58:33.0613 0x1448  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
22:58:33.0633 0x1448  HomeGroupListener - ok
22:58:33.0663 0x1448  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
22:58:33.0683 0x1448  HomeGroupProvider - ok
22:58:33.0713 0x1448  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
22:58:33.0723 0x1448  HpSAMD - ok
22:58:33.0843 0x1448  [ 447256D1C026654C5CD3CC17E7B20631, F89589AC17BC50483E6687963370937E6CD19D6030F30D70577A7DA266116919 ] HsfXAudioService C:\Windows\SysWOW64\XAudio64.dll
22:58:33.0893 0x1448  HsfXAudioService - ok
22:58:33.0943 0x1448  [ F6AC1087A131FBB385400667BEA64FBE, 131661287953708893FE564602E8ED6832B96CCA523C205EDE0C9E82DD930178 ] HSF_DPV         C:\Windows\system32\DRIVERS\CAX_DPV.sys
22:58:34.0003 0x1448  HSF_DPV - ok
22:58:34.0043 0x1448  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
22:58:34.0103 0x1448  HTTP - ok
22:58:34.0103 0x1448  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
22:58:34.0113 0x1448  hwpolicy - ok
22:58:34.0213 0x1448  [ BB82D8E54C68154E3A0677541617DE6D, C58FE396FA66446A725820FE167EDE86B3616C7D9530DF4E1CD70A0B2293069D ] i1 Display Service C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe
22:58:34.0233 0x1448  i1 Display Service - detected UnsignedFile.Multi.Generic ( 1 )
22:58:36.0593 0x1448  Detect skipped due to KSN trusted
22:58:36.0593 0x1448  i1 Display Service - ok
22:58:36.0663 0x1448  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
22:58:36.0693 0x1448  i8042prt - ok
22:58:36.0743 0x1448  [ CCFA835960E35F30D28A868E0B3B8722, 47D95E75685F9D40229902A92426FBCB358EA929202EAFBBF79C72873B8B9032 ] iaStor          C:\Windows\system32\drivers\iaStor.sys
22:58:36.0773 0x1448  iaStor - ok
22:58:36.0833 0x1448  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
22:58:36.0873 0x1448  iaStorV - ok
22:58:36.0903 0x1448  [ A9BD44426A69079240767FE4AEE0EA71, 5B1DE9ACFEADEDE92F2FA1531DE78A0C6D4057F2501FF7D72FC1F1BBD7400B58 ] IBMPMDRV        C:\Windows\system32\DRIVERS\ibmpmdrv.sys
22:58:36.0923 0x1448  IBMPMDRV - ok
22:58:36.0943 0x1448  [ 57D4A3ED5497DB0C5A53E680A9BDD1C6, 55C94A0DAC11A4C13DE7DD924DEC1232EA31193F5650E2A55BC31DC0BC2F657F ] IBMPMSVC        C:\Windows\system32\ibmpmsvc.exe
22:58:36.0943 0x1448  IBMPMSVC - ok
22:58:37.0003 0x1448  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
22:58:37.0043 0x1448  idsvc - ok
22:58:37.0373 0x1448  [ 978D876A581D57E0DE6437674EB0014D, CDE6F41D75177F9A1F3AF6B576320B93906E33133FF8568FCB1148568FE78BF3 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
22:58:37.0773 0x1448  igfx - ok
22:58:37.0803 0x1448  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
22:58:37.0813 0x1448  iirsp - ok
22:58:37.0863 0x1448  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
22:58:37.0913 0x1448  IKEEXT - ok
22:58:37.0933 0x1448  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
22:58:37.0933 0x1448  intelide - ok
22:58:37.0963 0x1448  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
22:58:37.0973 0x1448  intelppm - ok
22:58:37.0993 0x1448  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
22:58:38.0023 0x1448  IPBusEnum - ok
22:58:38.0023 0x1448  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
22:58:38.0063 0x1448  IpFilterDriver - ok
22:58:38.0153 0x1448  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
22:58:38.0193 0x1448  iphlpsvc - ok
22:58:38.0213 0x1448  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
22:58:38.0223 0x1448  IPMIDRV - ok
22:58:38.0223 0x1448  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
22:58:38.0253 0x1448  IPNAT - ok
22:58:38.0273 0x1448  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
22:58:38.0293 0x1448  IRENUM - ok
22:58:38.0313 0x1448  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
22:58:38.0313 0x1448  isapnp - ok
22:58:38.0343 0x1448  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
22:58:38.0353 0x1448  iScsiPrt - ok
22:58:38.0443 0x1448  [ 6FAF199FDFFDD2376973143C3E012765, 0CDEAC0F8DEC5BDF1226ADBA665B37671D3FB4D6A5226B1526FDD5B5026F887F ] jhi_service     C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
22:58:38.0473 0x1448  jhi_service - ok
22:58:38.0473 0x1448  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
22:58:38.0483 0x1448  kbdclass - ok
22:58:38.0513 0x1448  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
22:58:38.0553 0x1448  kbdhid - ok
22:58:38.0573 0x1448  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] KeyIso          C:\Windows\system32\lsass.exe
22:58:38.0583 0x1448  KeyIso - ok
22:58:38.0613 0x1448  [ 353009DEDF918B2A51414F330CF72DEC, BF157D6E329F26E02FA16271B751B421396040DBB1D7BF9B2E0A21BC569672E2 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
22:58:38.0633 0x1448  KSecDD - ok
22:58:38.0653 0x1448  [ 1C2D8E18AA8FD50CD04C15CC27F7F5AB, 4BA3B0F9F01BD47D66091D3AD86B69A523981D61DFB4D677F2CD39405B2DA989 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
22:58:38.0653 0x1448  KSecPkg - ok
22:58:38.0663 0x1448  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
22:58:38.0683 0x1448  ksthunk - ok
22:58:38.0723 0x1448  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
22:58:38.0763 0x1448  KtmRm - ok
22:58:38.0783 0x1448  [ F761A831C9DC8D0204B7FB43E3A896B7, 9739FC721C774C0C754D0E558D39A77FF8B976CC98C044CB4D16446A9AF3E0A1 ] l36wgps         C:\Windows\system32\DRIVERS\l36wgps64.sys
22:58:38.0793 0x1448  l36wgps - ok
22:58:38.0813 0x1448  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\System32\srvsvc.dll
22:58:38.0843 0x1448  LanmanServer - ok
22:58:38.0863 0x1448  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
22:58:38.0903 0x1448  LanmanWorkstation - ok
22:58:38.0963 0x1448  [ 56B74943929BC575914631EDC0E72220, 47AC85C1837FB412AD08EB9E81411E3560826F978910A89354CF689B0BCDF78B ] LENOVO.CAMMUTE  C:\Program Files\Lenovo\Communications Utility\CAMMUTE.exe
22:58:38.0983 0x1448  LENOVO.CAMMUTE - ok
22:58:39.0043 0x1448  [ 128158D8B1DF639BF3E3FDBCBB64CDAC, F55DA8F202A8E81D4E8ABECCC1B7CE5162D6891A23278A8C664AA1EE9AE3C7CF ] LENOVO.MICMUTE  C:\Program Files\LENOVO\HOTKEY\MICMUTE.exe
22:58:39.0063 0x1448  LENOVO.MICMUTE - ok
22:58:39.0093 0x1448  [ 2B9D8555DC004E240082D18E7725CE20, 9DEF9463CB099C0BC8782C1E5FCE62F038B971ABC12966774D1F83569B081A42 ] lenovo.smi      C:\Windows\system32\DRIVERS\smiifx64.sys
22:58:39.0103 0x1448  lenovo.smi - ok
22:58:39.0123 0x1448  [ F9B51B2A5DA1222A910021C71E9EA559, 4B7040808828991B2C075B91E41E6AB03A50FADDCC477444A673B08FE77BE96A ] LENOVO.TPKNRSVC C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
22:58:39.0133 0x1448  LENOVO.TPKNRSVC - ok
22:58:39.0153 0x1448  [ 6F2CC57EB5836D2AC9BD37F3554D55F8, C877F63AACA68AD3505EC4A8B8916FA2E07C2CB29E74FA368A103F612E18499E ] Lenovo.VIRTSCRLSVC C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe
22:58:39.0163 0x1448  Lenovo.VIRTSCRLSVC - ok
22:58:39.0183 0x1448  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
22:58:39.0243 0x1448  lltdio - ok
22:58:39.0263 0x1448  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
22:58:39.0303 0x1448  lltdsvc - ok
22:58:39.0333 0x1448  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
22:58:39.0373 0x1448  lmhosts - ok
22:58:39.0413 0x1448  [ 97F9EAAC985A663394CD8F54DCD3E73A, D5BA3E7ED36BA361B1941F12D83568C30F7E49A8B9D54D3EBBBD05767E1F3B0A ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
22:58:39.0433 0x1448  LMS - ok
22:58:39.0453 0x1448  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
22:58:39.0463 0x1448  LSI_FC - ok
22:58:39.0503 0x1448  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
22:58:39.0513 0x1448  LSI_SAS - ok
22:58:39.0523 0x1448  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
22:58:39.0533 0x1448  LSI_SAS2 - ok
22:58:39.0543 0x1448  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
22:58:39.0553 0x1448  LSI_SCSI - ok
22:58:39.0553 0x1448  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
22:58:39.0593 0x1448  luafv - ok
22:58:39.0643 0x1448  [ 1A243DAD23BB639D47F25AB9EC51FCAD, 596A9676F38730B520F36BDA964C555F31FD9CD1A45CD5280A534C6336E344AF ] mbamchameleon   C:\Windows\system32\drivers\mbamchameleon.sys
22:58:39.0673 0x1448  mbamchameleon - ok
22:58:39.0713 0x1448  [ D8BA1ECBF0B9A4B4E1F3B7EB517D6C20, 9A72B2FAE2E39D1F7E73DD55888D30AAE46BDC5294A5EA558AF00CABF1C20D5B ] Mbm3CBus        C:\Windows\system32\DRIVERS\Mbm3CBus.sys
22:58:39.0743 0x1448  Mbm3CBus - ok
22:58:39.0763 0x1448  [ 01E60917101B309E15F30DA26ACF64F6, 141BBBCA6A2E20A1AF242483F98E03401A956C691177EBCC1946D87736B42D59 ] Mbm3DevMt       C:\Windows\system32\DRIVERS\Mbm3DevMt.sys
22:58:39.0783 0x1448  Mbm3DevMt - ok
22:58:39.0793 0x1448  [ 6350A2CA21FB7B14432EFFDC61863AED, C2C051E155455AD57219C1E8689B51D736FB50876BE10F3770B0560BF27C538B ] Mbm3mdfl        C:\Windows\system32\DRIVERS\Mbm3mdfl.sys
22:58:39.0793 0x1448  Mbm3mdfl - ok
22:58:39.0823 0x1448  [ 9FC3A8713D148E15D0472E1C44DD0FDA, A36FF9787477E7D1F9C202B7D87A701114B76B6A796A89D6D199D351CC040622 ] Mbm3Mdm         C:\Windows\system32\DRIVERS\Mbm3Mdm.sys
22:58:39.0833 0x1448  Mbm3Mdm - ok
22:58:39.0853 0x1448  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
22:58:39.0873 0x1448  Mcx2Svc - ok
22:58:39.0893 0x1448  [ E4F44EC214B3E381E1FC844A02926666, 6EE8C87EFCEFFBEA08B9B9DA036B37564542EE4D31942115CDBF895295DD5FE2 ] mdmxsdk         C:\Windows\system32\DRIVERS\mdmxsdk.sys
22:58:39.0903 0x1448  mdmxsdk - ok
22:58:39.0903 0x1448  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\drivers\megasas.sys
22:58:39.0913 0x1448  megasas - ok
22:58:39.0933 0x1448  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
22:58:39.0943 0x1448  MegaSR - ok
22:58:39.0963 0x1448  [ A6518DCC42F7A6E999BB3BEA8FD87567, 8A9AE992F93F37E0723761EA271A7E1AA8172702C471041A17324474FC96B9BC ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
22:58:39.0973 0x1448  MEIx64 - ok
22:58:40.0033 0x1448  Microsoft SharePoint Workspace Audit Service - ok
22:58:40.0073 0x1448  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
22:58:40.0123 0x1448  MMCSS - ok
22:58:40.0133 0x1448  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
22:58:40.0163 0x1448  Modem - ok
22:58:40.0183 0x1448  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
22:58:40.0193 0x1448  monitor - ok
22:58:40.0213 0x1448  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
22:58:40.0223 0x1448  mouclass - ok
22:58:40.0233 0x1448  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
22:58:40.0253 0x1448  mouhid - ok
22:58:40.0263 0x1448  [ 32E7A3D591D671A6DF2DB515A5CBE0FA, 47CED0B9067AE8BF5EEF60B17ADEE5906BEDCC56E4CB460B7BFBC12BB9A69E63 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
22:58:40.0273 0x1448  mountmgr - ok
22:58:40.0323 0x1448  [ 707E98CC15C2224C078C9E71FF1889BC, 958416FE081436FDBF7F2BEBBB2795C54CC4F3F349D6DF463296A7BBA3404F13 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
22:58:40.0353 0x1448  MozillaMaintenance - ok
22:58:40.0363 0x1448  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
22:58:40.0383 0x1448  mpio - ok
22:58:40.0393 0x1448  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
22:58:40.0423 0x1448  mpsdrv - ok
22:58:40.0443 0x1448  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
22:58:40.0493 0x1448  MpsSvc - ok
22:58:40.0533 0x1448  [ 1A4F75E63C9FB84B85DFFC6B63FD5404, 01AFA6DBB4CDE55FE4EA05BBE8F753A4266F8D072EA1EE01DB79F5126780C21F ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
22:58:40.0573 0x1448  MRxDAV - ok
22:58:40.0633 0x1448  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
22:58:40.0653 0x1448  mrxsmb - ok
22:58:40.0683 0x1448  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
22:58:40.0723 0x1448  mrxsmb10 - ok
22:58:40.0753 0x1448  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
22:58:40.0763 0x1448  mrxsmb20 - ok
22:58:40.0793 0x1448  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
22:58:40.0803 0x1448  msahci - ok
22:58:40.0813 0x1448  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
22:58:40.0833 0x1448  msdsm - ok
22:58:40.0863 0x1448  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
22:58:40.0893 0x1448  MSDTC - ok
22:58:40.0913 0x1448  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
22:58:40.0943 0x1448  Msfs - ok
22:58:40.0963 0x1448  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
22:58:40.0993 0x1448  mshidkmdf - ok
22:58:40.0993 0x1448  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
22:58:41.0003 0x1448  msisadrv - ok
22:58:41.0023 0x1448  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
22:58:41.0053 0x1448  MSiSCSI - ok
22:58:41.0053 0x1448  msiserver - ok
22:58:41.0073 0x1448  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
22:58:41.0103 0x1448  MSKSSRV - ok
22:58:41.0143 0x1448  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
22:58:41.0173 0x1448  MSPCLOCK - ok
22:58:41.0183 0x1448  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
22:58:41.0203 0x1448  MSPQM - ok
22:58:41.0213 0x1448  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
22:58:41.0223 0x1448  MsRPC - ok
22:58:41.0233 0x1448  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
22:58:41.0243 0x1448  mssmbios - ok
22:58:41.0253 0x1448  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
22:58:41.0273 0x1448  MSTEE - ok
22:58:41.0283 0x1448  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
22:58:41.0293 0x1448  MTConfig - ok
22:58:41.0293 0x1448  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
22:58:41.0303 0x1448  Mup - ok
22:58:41.0383 0x1448  [ 4BBB9D9C4DF259FAE2D172C5BB25DDD0, 165EE2AB6F989E8D48AA52121B608510E932106835DA43071CC6476630C012FE ] MyWiFiDHCPDNS   C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
22:58:41.0433 0x1448  MyWiFiDHCPDNS - ok
22:58:41.0463 0x1448  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
22:58:41.0503 0x1448  napagent - ok
22:58:41.0543 0x1448  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
22:58:41.0573 0x1448  NativeWifiP - ok
22:58:41.0673 0x1448  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
22:58:41.0703 0x1448  NDIS - ok
22:58:41.0733 0x1448  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
22:58:41.0753 0x1448  NdisCap - ok
22:58:41.0783 0x1448  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
22:58:41.0803 0x1448  NdisTapi - ok
22:58:41.0813 0x1448  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
22:58:41.0833 0x1448  Ndisuio - ok
22:58:41.0833 0x1448  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
22:58:41.0873 0x1448  NdisWan - ok
22:58:41.0873 0x1448  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
22:58:41.0913 0x1448  NDProxy - ok
22:58:41.0923 0x1448  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
22:58:41.0953 0x1448  NetBIOS - ok
22:58:41.0963 0x1448  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
22:58:41.0993 0x1448  NetBT - ok
22:58:42.0003 0x1448  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] Netlogon        C:\Windows\system32\lsass.exe
22:58:42.0013 0x1448  Netlogon - ok
22:58:42.0043 0x1448  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
22:58:42.0073 0x1448  Netman - ok
22:58:42.0123 0x1448  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:58:42.0153 0x1448  NetMsmqActivator - ok
22:58:42.0183 0x1448  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:58:42.0203 0x1448  NetPipeActivator - ok
22:58:42.0233 0x1448  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
22:58:42.0283 0x1448  netprofm - ok
22:58:42.0293 0x1448  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:58:42.0303 0x1448  NetTcpActivator - ok
22:58:42.0313 0x1448  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
22:58:42.0323 0x1448  NetTcpPortSharing - ok
22:58:42.0563 0x1448  [ AC69618DE5BCCE8747C9AB0AAE1003C1, D975963FA338AB58684BE0556633F3A846D5360FAD1A5E11BB7A273474DFB64D ] NETwNs64        C:\Windows\system32\DRIVERS\NETwNs64.sys
22:58:42.0863 0x1448  NETwNs64 - ok
22:58:42.0893 0x1448  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
22:58:42.0903 0x1448  nfrd960 - ok
22:58:42.0933 0x1448  [ 8AD77806D336673F270DB31645267293, E23F324913554A23CD043DD27D4305AF62F48C0561A0FC7B7811E55B74B1BE79 ] NlaSvc          C:\Windows\System32\nlasvc.dll
22:58:42.0953 0x1448  NlaSvc - ok
22:58:42.0953 0x1448  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
22:58:42.0983 0x1448  Npfs - ok
22:58:42.0993 0x1448  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
22:58:43.0013 0x1448  nsi - ok
22:58:43.0023 0x1448  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
22:58:43.0053 0x1448  nsiproxy - ok
22:58:43.0113 0x1448  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
22:58:43.0153 0x1448  Ntfs - ok
22:58:43.0163 0x1448  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
22:58:43.0183 0x1448  Null - ok
22:58:43.0203 0x1448  [ 69FCDECD0215195261EC5362AB4A1520, B1B1DBACC4641AC4A4520CDE736074468BC9B5605BD5DFB140D946A0DF810F08 ] nusb3hub        C:\Windows\system32\DRIVERS\nusb3hub.sys
22:58:43.0213 0x1448  nusb3hub - ok
22:58:43.0243 0x1448  [ F813EA99DA158FB4079622D882873D63, 243DE756315C8652718871AB499DC3AEBA2A48438706CA37B3C46B02ED6DFF63 ] nusb3xhc        C:\Windows\system32\DRIVERS\nusb3xhc.sys
22:58:43.0263 0x1448  nusb3xhc - ok
22:58:43.0323 0x1448  [ DC933C28D5A1595B042863F6A61ED86E, F71D9C24F9FF617ECC861419C077353D9464F17B3524582F4FA989951F51747F ] nvkflt          C:\Windows\system32\DRIVERS\nvkflt.sys
22:58:43.0353 0x1448  nvkflt - ok
22:58:43.0683 0x1448  [ A51F78816F7F4B5862D9F6E0E0E588C4, 7634A83B60E7496651299690D766EA7AFF185437D3173D10D093ED71D2C13270 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
22:58:43.0883 0x1448  nvlddmkm - ok
22:58:43.0943 0x1448  [ 88EE7DDE10562A71D995C37F88220281, 4C53B770C153AAD6C1BB27F5D738E94DCB6E1D3CB81615BECE30401B44BAD9E8 ] nvpciflt        C:\Windows\system32\DRIVERS\nvpciflt.sys
22:58:43.0973 0x1448  nvpciflt - ok
22:58:44.0023 0x1448  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
22:58:44.0053 0x1448  nvraid - ok
22:58:44.0103 0x1448  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
22:58:44.0133 0x1448  nvstor - ok
22:58:44.0163 0x1448  [ 5DCB3AE42B3430EDAC80A42BB9BADEB6, FA57B03D10B6BB50D878F4720E30D3753622A711A6DF990FFA8875E409C4678A ] NVSvc           C:\Windows\system32\nvvsvc.exe
22:58:44.0193 0x1448  NVSvc - ok
22:58:44.0293 0x1448  [ 05E0B6C24F94EBEB17958385B8C2F316, CCED36F94A6EB74A8FF0BA3A8E47D16530072000ECEE33FB0A5927B8ACEA464C ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
22:58:44.0343 0x1448  nvUpdatusService - ok
22:58:44.0363 0x1448  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
22:58:44.0363 0x1448  nv_agp - ok
22:58:44.0373 0x1448  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
22:58:44.0393 0x1448  ohci1394 - ok
22:58:44.0463 0x1448  [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
22:58:44.0483 0x1448  ose - ok
22:58:44.0693 0x1448  [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
22:58:44.0883 0x1448  osppsvc - ok
22:58:44.0913 0x1448  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
22:58:44.0963 0x1448  p2pimsvc - ok
22:58:44.0983 0x1448  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
22:58:45.0003 0x1448  p2psvc - ok
22:58:45.0013 0x1448  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\drivers\parport.sys
22:58:45.0023 0x1448  Parport - ok
22:58:45.0053 0x1448  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
22:58:45.0063 0x1448  partmgr - ok
22:58:45.0073 0x1448  [ 3AEAA8B561E63452C655DC0584922257, 04C072969B58657602EB0C21CEDF24FCEE14E61B90A0F758F93925EF2C9FC32D ] PcaSvc          C:\Windows\System32\pcasvc.dll
22:58:45.0103 0x1448  PcaSvc - ok
22:58:45.0113 0x1448  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
22:58:45.0123 0x1448  pci - ok
22:58:45.0163 0x1448  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
22:58:45.0183 0x1448  pciide - ok
22:58:45.0213 0x1448  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
22:58:45.0223 0x1448  pcmcia - ok
22:58:45.0223 0x1448  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
22:58:45.0233 0x1448  pcw - ok
22:58:45.0373 0x1448  [ F97DC1A5244469D367B1334D47118E34, A36B6C402F92BEBE14082296CBF5F69656ED87AB700789028799768FA1FE2A72 ] PDF Architect 2 C:\Program Files (x86)\PDF Architect 2\ws.exe
22:58:45.0423 0x1448  PDF Architect 2 - ok
22:58:45.0463 0x1448  [ E81F7D5371C95904D4105B06405D5EDA, A6A41793AC241801D37A95C25B2DA0C3CDDC804B4F2BD087ECBD30C562F3517B ] pdfforge CrashHandler C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe
22:58:45.0493 0x1448  pdfforge CrashHandler - ok
22:58:45.0513 0x1448  [ 68769C3356B3BE5D1C732C97B9A80D6E, FB2D61145980A2899D1B7729184C54070315B0E63C9A22400A76CCD39E00029C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
22:58:45.0563 0x1448  PEAUTH - ok
22:58:45.0603 0x1448  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
22:58:45.0673 0x1448  PeerDistSvc - ok
22:58:45.0763 0x1448  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
22:58:45.0803 0x1448  PerfHost - ok
22:58:45.0893 0x1448  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
22:58:45.0973 0x1448  pla - ok
22:58:46.0043 0x1448  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
22:58:46.0103 0x1448  PlugPlay - ok
22:58:46.0153 0x1448  [ F485770EEC8959684CC4C4786B63C06C, 34ECC6D83782A2F8E9E32456F3C6C527999283775626C772D0354D232A10604A ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
22:58:46.0193 0x1448  Pml Driver HPZ12 - ok
22:58:46.0223 0x1448  [ 0BEE791C7C7ACE453C134E73633C497D, 82B30461DBF40AC15FCE6A83B9BAD2EBD05B27DEA1B784EAA096422FE8927B7B ] pmxdrv          C:\Windows\system32\drivers\pmxdrv.sys
22:58:46.0233 0x1448  pmxdrv - ok
22:58:46.0243 0x1448  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
22:58:46.0273 0x1448  PNRPAutoReg - ok
22:58:46.0303 0x1448  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
22:58:46.0323 0x1448  PNRPsvc - ok
22:58:46.0353 0x1448  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
22:58:46.0403 0x1448  PolicyAgent - ok
22:58:46.0413 0x1448  [ A2CCA4FB273E6050F17A0A416CFF2FCD, C42BA18DF0C8E3F7358669A784E51E4DC7A4112096345EA699EDC95F561E0255 ] Power           C:\Windows\system32\umpo.dll
22:58:46.0443 0x1448  Power - ok
22:58:46.0513 0x1448  [ 7A1E6CF32EDFF1F13186997FCA086FC7, BD9BF58557046B535C59EE2DBFB887C317542A9EDB33BA07D5A151BC2CFA63C1 ] Power Manager DBC Service C:\Program Files (x86)\ThinkPad\Utilities\PWMDBSVC.EXE
22:58:46.0533 0x1448  Power Manager DBC Service - ok
22:58:46.0583 0x1448  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
22:58:46.0643 0x1448  PptpMiniport - ok
22:58:46.0663 0x1448  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\drivers\processr.sys
22:58:46.0703 0x1448  Processor - ok
22:58:46.0733 0x1448  [ 53E83F1F6CF9D62F32801CF66D8352A8, 1225FED810BE8E0729EEAE5B340035CCBB9BACD3EF247834400F9B72D05ACE48 ] ProfSvc         C:\Windows\system32\profsvc.dll
22:58:46.0773 0x1448  ProfSvc - ok
22:58:46.0783 0x1448  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] ProtectedStorage C:\Windows\system32\lsass.exe
22:58:46.0793 0x1448  ProtectedStorage - ok
22:58:46.0823 0x1448  [ A70AD30223866947E39BC221DF4C2306, E1714080D6DDF966413311D8D2F7AFF57195BB681B1BE194DE2237DA7B05D7A6 ] psadd           C:\Windows\system32\DRIVERS\psadd.sys
22:58:46.0833 0x1448  psadd - ok
22:58:46.0863 0x1448  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
22:58:46.0923 0x1448  Psched - ok
22:58:46.0943 0x1448  [ F036CFB275D0C55F4E45FBBF5F98B3C8, D8D1CA9F65B34A93AB9F7FD9BB6C453B2BF4E8320E620F56055B743DF1D56DE8 ] PSI_SVC_2       C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
22:58:46.0953 0x1448  PSI_SVC_2 - ok
22:58:46.0963 0x1448  [ 20EFF1CA8922F6A834261B985550A51D, 20EC7A845CF3D6DEE6F208E782D12E091CC69D2944D28527A76C3DE7CDAB2502 ] PwmEWSvc        C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.EXE
22:58:46.0973 0x1448  PwmEWSvc - ok
22:58:47.0063 0x1448  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
22:58:47.0113 0x1448  ql2300 - ok
22:58:47.0133 0x1448  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
22:58:47.0143 0x1448  ql40xx - ok
22:58:47.0173 0x1448  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
22:58:47.0183 0x1448  QWAVE - ok
22:58:47.0193 0x1448  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
22:58:47.0213 0x1448  QWAVEdrv - ok
22:58:47.0223 0x1448  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
22:58:47.0243 0x1448  RasAcd - ok
22:58:47.0273 0x1448  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
22:58:47.0303 0x1448  RasAgileVpn - ok
22:58:47.0313 0x1448  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
22:58:47.0353 0x1448  RasAuto - ok
22:58:47.0353 0x1448  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
22:58:47.0383 0x1448  Rasl2tp - ok
22:58:47.0403 0x1448  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
22:58:47.0433 0x1448  RasMan - ok
22:58:47.0433 0x1448  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
22:58:47.0463 0x1448  RasPppoe - ok
22:58:47.0473 0x1448  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
22:58:47.0493 0x1448  RasSstp - ok
22:58:47.0503 0x1448  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
22:58:47.0533 0x1448  rdbss - ok
22:58:47.0553 0x1448  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
22:58:47.0563 0x1448  rdpbus - ok
22:58:47.0593 0x1448  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
22:58:47.0613 0x1448  RDPCDD - ok
22:58:47.0613 0x1448  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
22:58:47.0633 0x1448  RDPDR - ok
22:58:47.0643 0x1448  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
22:58:47.0663 0x1448  RDPENCDD - ok
22:58:47.0693 0x1448  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
22:58:47.0713 0x1448  RDPREFMP - ok
22:58:47.0753 0x1448  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
22:58:47.0783 0x1448  RdpVideoMiniport - ok
22:58:47.0823 0x1448  [ E61608AA35E98999AF9AAEEEA6114B0A, F754CDE89DC96786D2A3C4D19EE2AEF1008E634E4DE3C0CBF927436DE90C04A6 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
22:58:47.0913 0x1448  RDPWD - ok
22:58:47.0943 0x1448  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
22:58:47.0973 0x1448  rdyboost - ok
22:58:48.0043 0x1448  [ A436F5E7D80BBDBB0826D0F176D5BEA8, 7862CE61F182C7613E34415C01AC1C228F79A45470CFD1D316DF2BD24EE09E3C ] RegSrvc         C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
22:58:48.0063 0x1448  RegSrvc - ok
22:58:48.0083 0x1448  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
22:58:48.0103 0x1448  RemoteAccess - ok
22:58:48.0133 0x1448  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
22:58:48.0153 0x1448  RemoteRegistry - ok
22:58:48.0193 0x1448  [ 3DD798846E2C28102B922C56E71B7932, 30B111615D74CB2213997A5C08DD9C8613ADE441D9423CC1C49A753D13CE524D ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
22:58:48.0213 0x1448  RFCOMM - ok
22:58:48.0253 0x1448  [ FF501F212E5D5A97F8339928320F269E, E148AD940FD274C8C5775F835C5E1FC61943BA648445C32432965B7B4AA5EA7E ] risdxc          C:\Windows\system32\DRIVERS\risdxc64.sys
22:58:48.0273 0x1448  risdxc - ok
22:58:48.0273 0x1448  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
22:58:48.0293 0x1448  RpcEptMapper - ok
22:58:48.0313 0x1448  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
22:58:48.0323 0x1448  RpcLocator - ok
22:58:48.0333 0x1448  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
22:58:48.0373 0x1448  RpcSs - ok
22:58:48.0383 0x1448  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
22:58:48.0403 0x1448  rspndr - ok
22:58:48.0413 0x1448  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
22:58:48.0433 0x1448  s3cap - ok
22:58:48.0443 0x1448  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] SamSs           C:\Windows\system32\lsass.exe
22:58:48.0453 0x1448  SamSs - ok
22:58:48.0453 0x1448  SAService - ok
22:58:48.0463 0x1448  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
22:58:48.0473 0x1448  sbp2port - ok
22:58:48.0483 0x1448  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
22:58:48.0523 0x1448  SCardSvr - ok
22:58:48.0523 0x1448  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
22:58:48.0553 0x1448  scfilter - ok
22:58:48.0583 0x1448  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
22:58:48.0633 0x1448  Schedule - ok
22:58:48.0653 0x1448  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
22:58:48.0683 0x1448  SCPolicySvc - ok
22:58:48.0693 0x1448  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
22:58:48.0713 0x1448  SDRSVC - ok
22:58:48.0723 0x1448  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
22:58:48.0753 0x1448  secdrv - ok
22:58:48.0753 0x1448  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
22:58:48.0783 0x1448  seclogon - ok
22:58:48.0793 0x1448  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\system32\sens.dll
22:58:48.0813 0x1448  SENS - ok
22:58:48.0833 0x1448  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
22:58:48.0863 0x1448  SensrSvc - ok
22:58:48.0873 0x1448  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
22:58:48.0883 0x1448  Serenum - ok
22:58:48.0893 0x1448  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
22:58:48.0923 0x1448  Serial - ok
22:58:48.0963 0x1448  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\drivers\sermouse.sys
22:58:49.0003 0x1448  sermouse - ok
22:58:49.0023 0x1448  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
22:58:49.0083 0x1448  SessionEnv - ok
22:58:49.0093 0x1448  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
22:58:49.0103 0x1448  sffdisk - ok
22:58:49.0113 0x1448  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
22:58:49.0123 0x1448  sffp_mmc - ok
22:58:49.0143 0x1448  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
22:58:49.0153 0x1448  sffp_sd - ok
22:58:49.0163 0x1448  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
22:58:49.0173 0x1448  sfloppy - ok
22:58:49.0213 0x1448  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
22:58:49.0263 0x1448  SharedAccess - ok
22:58:49.0283 0x1448  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
22:58:49.0313 0x1448  ShellHWDetection - ok
22:58:49.0333 0x1448  [ C3F190562FE82EFDA7CCEF305EBAD3E3, BE809035A9B11945B3BB630F73A7651BBD4D1EA2091060378BCF7AD20003BBE4 ] Shockprf        C:\Windows\system32\DRIVERS\Apsx64.sys
22:58:49.0343 0x1448  Shockprf - ok
22:58:49.0353 0x1448  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
22:58:49.0363 0x1448  SiSRaid2 - ok
22:58:49.0373 0x1448  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
22:58:49.0373 0x1448  SiSRaid4 - ok
22:58:49.0393 0x1448  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
22:58:49.0423 0x1448  Smb - ok
22:58:49.0483 0x1448  smihlp - ok
22:58:49.0503 0x1448  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
22:58:49.0533 0x1448  SNMPTRAP - ok
22:58:49.0533 0x1448  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
22:58:49.0543 0x1448  spldr - ok
22:58:49.0573 0x1448  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
22:58:49.0593 0x1448  Spooler - ok
22:58:49.0683 0x1448  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
22:58:49.0843 0x1448  sppsvc - ok
22:58:49.0853 0x1448  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
22:58:49.0873 0x1448  sppuinotify - ok
22:58:49.0973 0x1448  [ 47118A04B1D4DCCCE3A1CDA3C10095B9, 797E6E575BBCD413B3ADBA1FAD0183EBAC994A482118D423EC885BF7920254D0 ] SROSVC          C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
22:58:49.0993 0x1448  SROSVC - ok
22:58:50.0013 0x1448  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
22:58:50.0043 0x1448  srv - ok
22:58:50.0063 0x1448  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
22:58:50.0093 0x1448  srv2 - ok
22:58:50.0133 0x1448  [ 0C4540311E11664B245A263E1154CEF8, 63376322BFFAFF2F166AF3FDD3F1A346C21FAE21F406F659F8630779D1D6525D ] SrvHsfHDA       C:\Windows\system32\DRIVERS\VSTAZL6.SYS
22:58:50.0143 0x1448  SrvHsfHDA - ok
22:58:50.0183 0x1448  [ 02071D207A9858FBE3A48CBFD59C4A04, FEA4DEBAEC3465E0C7C1E8B721805922F6BBCB96A60A193B11688F4252F4B89E ] SrvHsfV92       C:\Windows\system32\DRIVERS\VSTDPV6.SYS
22:58:50.0253 0x1448  SrvHsfV92 - ok
22:58:50.0273 0x1448  [ 18E40C245DBFAF36FD0134A7EF2DF396, 0138A68958112101A5D3BD94114F320CE80B0C9A93E009AC78DE7415FCCC7DE7 ] SrvHsfWinac     C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
22:58:50.0313 0x1448  SrvHsfWinac - ok
22:58:50.0333 0x1448  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
22:58:50.0343 0x1448  srvnet - ok
22:58:50.0353 0x1448  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
22:58:50.0383 0x1448  SSDPSRV - ok
22:58:50.0383 0x1448  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
22:58:50.0413 0x1448  SstpSvc - ok
22:58:50.0473 0x1448  [ 845305743E0F7DB9B3A9AC1F49C635F1, 042B1667DF7A09F0845024C878D60272078BC4F1781D98A3C9E01653FE06BB03 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
22:58:50.0493 0x1448  Stereo Service - ok
22:58:50.0523 0x1448  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
22:58:50.0523 0x1448  stexstor - ok
22:58:50.0573 0x1448  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
22:58:50.0603 0x1448  stisvc - ok
22:58:50.0633 0x1448  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
22:58:50.0643 0x1448  storflt - ok
22:58:50.0643 0x1448  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
22:58:50.0663 0x1448  StorSvc - ok
22:58:50.0693 0x1448  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
22:58:50.0723 0x1448  storvsc - ok
22:58:50.0733 0x1448  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
22:58:50.0733 0x1448  swenum - ok
22:58:50.0763 0x1448  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
22:58:50.0803 0x1448  swprv - ok
22:58:50.0873 0x1448  [ AEAE48AF681BAF5904608FF5D84E3C9C, 39B362E9E64A43B9AF5CCE2E704CCAE5E10B5BA0B45E535098BC0E40A4F772A8 ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys
22:58:50.0903 0x1448  SynTP - ok
22:58:50.0993 0x1448  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
22:58:51.0083 0x1448  SysMain - ok
22:58:51.0093 0x1448  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
22:58:51.0103 0x1448  TabletInputService - ok
22:58:51.0113 0x1448  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
22:58:51.0143 0x1448  TapiSrv - ok
22:58:51.0163 0x1448  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
22:58:51.0183 0x1448  TBS - ok
22:58:51.0243 0x1448  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
22:58:51.0283 0x1448  Tcpip - ok
22:58:51.0383 0x1448  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
22:58:51.0423 0x1448  TCPIP6 - ok
22:58:51.0443 0x1448  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
22:58:51.0453 0x1448  tcpipreg - ok
22:58:51.0473 0x1448  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
22:58:51.0503 0x1448  TDPIPE - ok
22:58:51.0523 0x1448  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
22:58:51.0543 0x1448  TDTCP - ok
22:58:51.0583 0x1448  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
22:58:51.0623 0x1448  tdx - ok
22:58:51.0623 0x1448  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
22:58:51.0633 0x1448  TermDD - ok
22:58:51.0653 0x1448  [ 2E648163254233755035B46DD7B89123, 6FA0D07CE18A3A69D82EE49D875F141E39406E92C34EAC76AC4EB052E6EBCBCD ] TermService     C:\Windows\System32\termsrv.dll
22:58:51.0693 0x1448  TermService - ok
22:58:51.0693 0x1448  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
22:58:51.0703 0x1448  Themes - ok
22:58:51.0723 0x1448  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
22:58:51.0743 0x1448  THREADORDER - ok
22:58:51.0773 0x1448  [ 1BB77ECCBFA3675B1EE8D6D6D37A1E1E, 6C22ED2FC9FF1EDFAFFA9C5F89A65D348B45F0087885401D056D6448F56F97AF ] TPDIGIMN        C:\Windows\system32\DRIVERS\ApsHM64.sys
22:58:51.0773 0x1448  TPDIGIMN - ok
22:58:51.0793 0x1448  [ 88F81D810FF16AC65B02643DAF308D4F, FDD4AFD1836D2CB528F92A788CEEC0D7800CC18B861E7D7601DA69543F0AD315 ] TPHDEXLGSVC     C:\Windows\system32\TPHDEXLG64.exe
22:58:51.0803 0x1448  TPHDEXLGSVC - ok
22:58:51.0863 0x1448  [ 2670D23A61CD706004C24A83D4D48294, 4A7740E8D6E00AD7C27FFB1BD2AD33F7880F35BF4AA29B186A60983AE78DEB6F ] TPHKLOAD        C:\Program Files\LENOVO\HOTKEY\TPHKLOAD.exe
22:58:51.0883 0x1448  TPHKLOAD - ok
22:58:51.0903 0x1448  [ CB0625C2F5B7C72C50C5AE34F8E8F7D0, 301BA79C4CA350EB9CFC083B69D830C27B3298DD23ADC986D002B4C58BD6DBAD ] TPHKSVC         C:\Program Files\LENOVO\HOTKEY\TPHKSVC.exe
22:58:51.0913 0x1448  TPHKSVC - ok
22:58:51.0923 0x1448  [ DBCC20C02E8A3E43B03C304A4E40A84F, BF5F3ACCB0342304A6870E94D2576644B08DBF307C853C7DBA4B82B0C7309DA4 ] TPM             C:\Windows\system32\drivers\tpm.sys
22:58:51.0953 0x1448  TPM - ok
22:58:51.0993 0x1448  [ 7165B5A9B4867F64A6D6935F57D4196B, 716BF044005E11A84D2B114E4DBCDA390C7842EBD4B6E8FA710D2D002BAE09DC ] TPPWRIF         C:\Windows\system32\drivers\Tppwr64v.sys
22:58:52.0013 0x1448  TPPWRIF - ok
22:58:52.0023 0x1448  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
22:58:52.0083 0x1448  TrkWks - ok
22:58:52.0133 0x1448  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
22:58:52.0173 0x1448  TrustedInstaller - ok
22:58:52.0203 0x1448  [ 4CE278FC9671BA81A138D70823FCAA09, CBE501436696E32A3701B9F377B823AC36647B6626595F76CC63E2396AD7D300 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
22:58:52.0233 0x1448  tssecsrv - ok
22:58:52.0253 0x1448  [ E9981ECE8D894CEF7038FD1D040EB426, DCDDCE933CAECE8180A3447199B07F2F0413704EEC1A09606EE357901A84A7CF ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
22:58:52.0283 0x1448  TsUsbFlt - ok
22:58:52.0313 0x1448  [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys
22:58:52.0343 0x1448  TsUsbGD - ok
22:58:52.0373 0x1448  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
22:58:52.0403 0x1448  tunnel - ok
22:58:52.0433 0x1448  [ 4DAAE0413CD4E816258838E2FAFB3147, 7D45621A0148C2EEA4302A5852D9407DCEF1947936E9E840788F01625E869CDD ] TVTI2C          C:\Windows\system32\DRIVERS\Tvti2c.sys
22:58:52.0443 0x1448  TVTI2C - ok
22:58:52.0453 0x1448  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
22:58:52.0463 0x1448  uagp35 - ok
22:58:52.0473 0x1448  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
22:58:52.0513 0x1448  udfs - ok
22:58:52.0513 0x1448  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
22:58:52.0533 0x1448  UI0Detect - ok
22:58:52.0593 0x1448  [ BE788A747457E6916586C410EC0111E7, 525F9065270AF40FED854C5B3C7E690783F5169C2F9286EE225F6C817ED1E237 ] UleadBurningHelper C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
22:58:52.0613 0x1448  UleadBurningHelper - detected UnsignedFile.Multi.Generic ( 1 )
22:58:55.0043 0x1448  Detect skipped due to KSN trusted
22:58:55.0043 0x1448  UleadBurningHelper - ok
22:58:55.0053 0x1448  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
22:58:55.0083 0x1448  uliagpkx - ok
22:58:55.0103 0x1448  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
22:58:55.0123 0x1448  umbus - ok
22:58:55.0153 0x1448  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\drivers\umpass.sys
22:58:55.0173 0x1448  UmPass - ok
22:58:55.0193 0x1448  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
22:58:55.0213 0x1448  UmRdpService - ok
22:58:55.0363 0x1448  [ A69CD6BDB82872999D2E46F9324ADA83, 1F06D5B716D48E693A082C1FC49D80405F50D60C78FDF5829FF51F1CC11CF011 ] UNS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
22:58:55.0433 0x1448  UNS - ok
22:58:55.0453 0x1448  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
22:58:55.0503 0x1448  upnphost - ok
22:58:55.0543 0x1448  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
22:58:55.0573 0x1448  usbccgp - ok
22:58:55.0593 0x1448  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
22:58:55.0643 0x1448  usbcir - ok
22:58:55.0673 0x1448  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
22:58:55.0703 0x1448  usbehci - ok
22:58:55.0753 0x1448  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
22:58:55.0813 0x1448  usbhub - ok
22:58:55.0833 0x1448  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
22:58:55.0843 0x1448  usbohci - ok
22:58:55.0853 0x1448  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\drivers\usbprint.sys
22:58:55.0883 0x1448  usbprint - ok
22:58:55.0893 0x1448  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
22:58:55.0933 0x1448  USBSTOR - ok
22:58:55.0943 0x1448  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
22:58:55.0953 0x1448  usbuhci - ok
22:58:55.0983 0x1448  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys
22:58:56.0023 0x1448  usbvideo - ok
22:58:56.0073 0x1448  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
22:58:56.0153 0x1448  UxSms - ok
22:58:56.0193 0x1448  [ 204F3F58212B3E422C90BD9691A2DF28, D748A8CEE4D59B4248C9B1ACA5155D0FF6635A29564B4391B7FAC6261F93FE99 ] VaultSvc        C:\Windows\system32\lsass.exe
22:58:56.0223 0x1448  VaultSvc - ok
22:58:56.0253 0x1448  [ E45073C03C0B2D837DFFF110C728E852, B9BEE85ABD26829A0E21746B4F42C2EF97BFD82977229A22966C40A83FFA009E ] VBoxNetAdp      C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
22:58:56.0273 0x1448  VBoxNetAdp - ok
22:58:56.0273 0x1448  VBoxNetFlt - ok
22:58:56.0303 0x1448  [ 3C8E2C591345F38149C69FE8E5DF8C90, 9F4BB9BDA09CB2E99A6A888B288F322AE5C460B5D124CD714C6F00FF5029144B ] VClone          C:\Windows\system32\DRIVERS\VClone.sys
22:58:56.0333 0x1448  VClone - ok
22:58:56.0353 0x1448  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
22:58:56.0373 0x1448  vdrvroot - ok
22:58:56.0403 0x1448  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
22:58:56.0493 0x1448  vds - ok
22:58:56.0503 0x1448  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
22:58:56.0513 0x1448  vga - ok
22:58:56.0523 0x1448  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
22:58:56.0563 0x1448  VgaSave - ok
22:58:56.0573 0x1448  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
22:58:56.0583 0x1448  vhdmp - ok
22:58:56.0603 0x1448  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
22:58:56.0603 0x1448  viaide - ok
22:58:56.0633 0x1448  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
22:58:56.0643 0x1448  vmbus - ok
22:58:56.0643 0x1448  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
22:58:56.0653 0x1448  VMBusHID - ok
22:58:56.0683 0x1448  vmci - ok
22:58:56.0693 0x1448  VMnetAdapter - ok
22:58:56.0703 0x1448  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
22:58:56.0713 0x1448  volmgr - ok
22:58:56.0723 0x1448  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
22:58:56.0733 0x1448  volmgrx - ok
22:58:56.0743 0x1448  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
22:58:56.0753 0x1448  volsnap - ok
22:58:56.0773 0x1448  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
22:58:56.0783 0x1448  vsmraid - ok
22:58:56.0823 0x1448  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
22:58:56.0913 0x1448  VSS - ok
22:58:56.0913 0x1448  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
22:58:56.0933 0x1448  vwifibus - ok
22:58:56.0933 0x1448  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
22:58:56.0943 0x1448  vwififlt - ok
22:58:56.0943 0x1448  [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
22:58:56.0963 0x1448  vwifimp - ok
22:58:56.0993 0x1448  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
22:58:57.0023 0x1448  W32Time - ok
22:58:57.0043 0x1448  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
22:58:57.0053 0x1448  WacomPen - ok
22:58:57.0073 0x1448  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
22:58:57.0093 0x1448  WANARP - ok
22:58:57.0093 0x1448  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
22:58:57.0123 0x1448  Wanarpv6 - ok
22:58:57.0163 0x1448  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
22:58:57.0213 0x1448  wbengine - ok
22:58:57.0243 0x1448  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
22:58:57.0253 0x1448  WbioSrvc - ok
22:58:57.0283 0x1448  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
22:58:57.0303 0x1448  wcncsvc - ok
22:58:57.0313 0x1448  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
22:58:57.0343 0x1448  WcsPlugInService - ok
22:58:57.0343 0x1448  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\drivers\wd.sys
22:58:57.0353 0x1448  Wd - ok
22:58:57.0393 0x1448  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
22:58:57.0423 0x1448  Wdf01000 - ok
22:58:57.0423 0x1448  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
22:58:57.0473 0x1448  WdiServiceHost - ok
22:58:57.0473 0x1448  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
22:58:57.0483 0x1448  WdiSystemHost - ok
22:58:57.0523 0x1448  [ 94DC2BF6CBAAA95E369C3756D3115A76, 3DF44939ADBB4E30896993A85470BE5E16B1A3EDADFDD8F113D9615A6E431C12 ] wdkmd           C:\Windows\system32\DRIVERS\WDKMD.sys
22:58:57.0533 0x1448  wdkmd - ok
22:58:57.0563 0x1448  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
22:58:57.0583 0x1448  WebClient - ok
22:58:57.0603 0x1448  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
22:58:57.0643 0x1448  Wecsvc - ok
22:58:57.0653 0x1448  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
22:58:57.0683 0x1448  wercplsupport - ok
22:58:57.0683 0x1448  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
22:58:57.0713 0x1448  WerSvc - ok
22:58:57.0733 0x1448  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
22:58:57.0753 0x1448  WfpLwf - ok
22:58:57.0763 0x1448  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
22:58:57.0763 0x1448  WIMMount - ok
22:58:57.0793 0x1448  [ 1EDBBF412A382550AF6EB35F5E46928E, 23FC32929913CF784A78C334D0B0E9D812EA6BDF70BB5C993DDE492CBEE8265E ] winachsf        C:\Windows\system32\DRIVERS\CAX_CNXT.sys
22:58:57.0843 0x1448  winachsf - ok
22:58:57.0853 0x1448  WinDefend - ok
22:58:57.0853 0x1448  WinHttpAutoProxySvc - ok
22:58:57.0913 0x1448  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
22:58:57.0963 0x1448  Winmgmt - ok
22:58:58.0043 0x1448  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\Windows\system32\WsmSvc.dll
22:58:58.0123 0x1448  WinRM - ok
22:58:58.0183 0x1448  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUSB.sys
22:58:58.0203 0x1448  WinUsb - ok
22:58:58.0263 0x1448  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
22:58:58.0303 0x1448  Wlansvc - ok
22:58:58.0333 0x1448  [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
22:58:58.0333 0x1448  wlcrasvc - ok
22:58:58.0443 0x1448  [ 7E47C328FC4768CB8BEAFBCFAFA70362, C98BD6A0C2F70E069D5FD3BAB31BD028DFEAC0490D180BBC28A14BE375897D8C ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
22:58:58.0513 0x1448  wlidsvc - ok
22:58:58.0563 0x1448  WMCoreService - ok
22:58:58.0593 0x1448  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
22:58:58.0633 0x1448  WmiAcpi - ok
22:58:58.0663 0x1448  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
22:58:58.0723 0x1448  wmiApSrv - ok
22:58:58.0743 0x1448  WMPNetworkSvc - ok
22:58:58.0773 0x1448  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
22:58:58.0793 0x1448  WPCSvc - ok
22:58:58.0813 0x1448  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
22:58:58.0843 0x1448  WPDBusEnum - ok
22:58:58.0843 0x1448  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
22:58:58.0883 0x1448  ws2ifsl - ok
22:58:58.0893 0x1448  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\system32\wscsvc.dll
22:58:58.0923 0x1448  wscsvc - ok
22:58:58.0923 0x1448  WSearch - ok
22:58:59.0003 0x1448  [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv        C:\Windows\system32\wuaueng.dll
22:58:59.0073 0x1448  wuauserv - ok
22:58:59.0103 0x1448  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
22:58:59.0113 0x1448  WudfPf - ok
22:58:59.0143 0x1448  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
22:58:59.0163 0x1448  WUDFRd - ok
22:58:59.0193 0x1448  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
22:58:59.0213 0x1448  wudfsvc - ok
22:58:59.0233 0x1448  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
22:58:59.0263 0x1448  WwanSvc - ok
22:58:59.0303 0x1448  [ AA0A3A08A501237CD5BC4CFBFB64B3D6, BA0250A3FA5DC3FD9D72AF5B48E0F6610E6C0CDE7DE0D544A27F5E9EFC6343DA ] WwanUsbServ     C:\Windows\system32\DRIVERS\WwanUsbMp64.sys
22:58:59.0333 0x1448  WwanUsbServ - ok
22:58:59.0383 0x1448  [ E8F3FA126A06F8E7088F63757112A186, FC742ECA6DD823C5B17A514EC4473F65EE290FA6501370675B3628FD881A1C4B ] XAudio          C:\Windows\system32\DRIVERS\XAudio64.sys
22:58:59.0413 0x1448  XAudio - ok
22:58:59.0493 0x1448  [ 595B5F1FB9DFAD3DB2A02AE833665495, 9B12CC3CD7A4D723102851D07798F5BC92CA0D39E982BDC8699BAE01A5882FF6 ] xritedeviced    C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
22:58:59.0493 0x1448  xritedeviced - detected UnsignedFile.Multi.Generic ( 1 )
22:59:02.0003 0x1448  Detect skipped due to KSN trusted
22:59:02.0003 0x1448  xritedeviced - ok
22:59:02.0073 0x1448  ================ Scan global ===============================
22:59:02.0103 0x1448  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
22:59:02.0143 0x1448  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
22:59:02.0173 0x1448  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
22:59:02.0203 0x1448  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
22:59:02.0233 0x1448  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
22:59:02.0243 0x1448  [ Global ] - ok
22:59:02.0243 0x1448  ================ Scan MBR ==================================
22:59:02.0253 0x1448  [ 1EC07DA70A194E3D3CA6F9A368C1BC7C ] \Device\Harddisk0\DR0
22:59:02.0603 0x1448  \Device\Harddisk0\DR0 - ok
22:59:02.0603 0x1448  ================ Scan VBR ==================================
22:59:02.0613 0x1448  [ 75B8CFE4C4158908A0A9C7F3E7B57E24 ] \Device\Harddisk0\DR0\Partition1
22:59:02.0613 0x1448  \Device\Harddisk0\DR0\Partition1 - ok
22:59:02.0613 0x1448  [ 95315048B07F98162ED55B546C7554CE ] \Device\Harddisk0\DR0\Partition2
22:59:02.0623 0x1448  \Device\Harddisk0\DR0\Partition2 - ok
22:59:02.0623 0x1448  [ 1E65B7A0D0DAC39166C798FFE69BF43D ] \Device\Harddisk0\DR0\Partition3
22:59:02.0633 0x1448  \Device\Harddisk0\DR0\Partition3 - ok
22:59:02.0633 0x1448  ================ Scan generic autorun ======================
22:59:02.0693 0x1448  [ 2508FA41A1B58C97D94FFF044111492F, 656AC5EC110C5F8CE68CE1962D6B2CBD47EE6CE20A181C88BB1E5481793F0578 ] C:\Windows\system32\TpShocks.exe
22:59:02.0713 0x1448  TpShocks - ok
22:59:02.0753 0x1448  [ 42361B4BD80768E82B80285851037665, A555A6BF8016645B838FEA993AD273D1F472586F3600619DC243B1C33438FA07 ] C:\Program Files\Conexant\ForteConfig\fmapp.exe
22:59:02.0753 0x1448  ForteConfig - ok
22:59:02.0783 0x1448  [ EC80D4878D3824C289868E007B9C43EF, 8076D0F6C3D3EC60D3C638C60625F8063D2FA93FEAD00A3E6551812996087FFB ] C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe
22:59:02.0803 0x1448  LENOVO.TPKNRRES - ok
22:59:02.0853 0x1448  [ 788D7964EDFCF639850B18CE01B287D2, ED8164370F1DD53DB987427A48E6C5E6C50F561C1F9A2D117D526755E8665F59 ] C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE
22:59:02.0883 0x1448  ALCKRESI.EXE - ok
22:59:02.0923 0x1448  [ B0C52A038B318257412437F99406D39F, 6ABCEB2AC7883CE97C24394A4F113DE13F717ED80B94FAEBCE8BE1A5FE3BD7D2 ] C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe
22:59:02.0943 0x1448  AcWin7Hlpr - ok
22:59:03.0013 0x1448  [ 6A94CD69E9C2BD1864096AB0B16660E6, E22F3C432F104AD25512D1F97526D772D50BE0FC7910FFF12335F4ECC0EEE184 ] C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
22:59:03.0063 0x1448  IntelPAN - ok
22:59:03.0093 0x1448  [ 609617A22E765492C54D8BB438D61B23, 3C28D4B2929D88CB4D3595049F4F740A33E1A92215AC8DF0E481CCB558F0617F ] C:\Windows\system32\igfxtray.exe
22:59:03.0103 0x1448  IgfxTray - ok
22:59:03.0143 0x1448  [ 5D4069AEF369F011205CD71EACB5BBF7, 41769086CE903D4AA6572FB5DF6BCAE9647412E309537365AC31A89083B72FED ] C:\Windows\system32\hkcmd.exe
22:59:03.0153 0x1448  HotKeysCmds - ok
22:59:03.0173 0x1448  [ F0F898B89FD490AB77CC9D072B62004B, D0EAF4C0C993AA9ABB194AEADBBC09CF97FE3818ED22429CDBC60DF72423069A ] C:\Windows\system32\igfxpers.exe
22:59:03.0193 0x1448  Persistence - ok
22:59:03.0213 0x1448  [ 4F12EAD0B4C8BDAED5A11CC11F394B0A, EF769C2C2564D42979746B8BFD1D6E6532BFAB3BFCE2D09A0A17D0E64498B9B3 ] C:\Program Files\CONEXANT\SAII\SAIICpl.exe
22:59:03.0233 0x1448  SmartAudio - ok
22:59:03.0233 0x1448  SynTPEnh - ok
22:59:03.0263 0x1448  [ 49FBD026C73B6EFBFD3F58E641E39411, A2B80515D5107AD9817036B118D141F7A7306C372D54211A0B9687DB12D715FA ] C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe
22:59:03.0273 0x1448  IMSS - ok
22:59:03.0273 0x1448  PWMTRV - ok
22:59:03.0283 0x1448  [ 5BF0F8B139C9654B969D4FBB78760D8D, 138F13FCF9F84938A6929AD2731FFE0B5F82BB1EE347078E2E9DD4B617DF7190 ] C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe
22:59:03.0283 0x1448  X-Rite Legacy Device - detected UnsignedFile.Multi.Generic ( 1 )
22:59:05.0883 0x1448  Detect skipped due to KSN trusted
22:59:05.0883 0x1448  X-Rite Legacy Device - ok
22:59:06.0003 0x1448  [ 47C1DE0A890613FFCFF1D67648EEDF90, 5821567D7DD99623257AEA794023EF4200E6E17FD09656B40D97C44A35C701BB ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
22:59:06.0063 0x1448  Adobe ARM - ok
22:59:06.0113 0x1448  [ 0307536FD43CC7BFB92F9DAC8DB913F1, 6C8BEDA4ADFBEF28E647B39B3EEA37A20BFE5C93C7EDA79471EFB46156197843 ] C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
22:59:06.0133 0x1448  RotateImage - detected UnsignedFile.Multi.Generic ( 1 )
22:59:08.0853 0x1448  Detect skipped due to KSN trusted
22:59:08.0853 0x1448  RotateImage - ok
22:59:08.0923 0x1448  [ 8943465BEFA91044227D42E84ECB8280, 76D19CE3EB7E6C6573F250543CDC10B3601604535BFB756805AE246FA55AC265 ] C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
22:59:08.0943 0x1448  NUSB3MON - ok
22:59:09.0013 0x1448  [ 2AA5DD75EA1281432C40D22B5FD87D3A, 9868D4176C8F08EB72B0B992D3E2A480C587930CA025B4FDF3212F99B79C3017 ] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
22:59:09.0043 0x1448  avgnt - ok
22:59:09.0083 0x1448  [ 308F2EE28005510DE616409148CF077B, A2126CB185B0053086BDD6F0A16A503F6CA629AC677E4B7AE6D43C770061D087 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
22:59:09.0093 0x1448  SunJavaUpdateSched - ok
22:59:09.0183 0x1448  [ 187F4C75A89E3F412322C94526320074, D78FA7EF93C8C7B4326A5B6DB04A92ADD091DF00658FA8731D07C5D3BE29ED04 ] C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe
22:59:09.0193 0x1448  BCSSync - ok
22:59:09.0243 0x1448  [ 845EB283583BD3C89F09636A10114EF3, BCB3002B867052FB381B1E44D31E381200751E1AD3F991EB4233B73E3E034A0E ] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
22:59:09.0273 0x1448  Avira Systray - ok
22:59:09.0323 0x1448  [ 16D4D2AB28EDD90AEE06826B3ADF50AB, EE8E54702B22E7F1DB8DE7296132C3473DD9D18B9E9C47414F315173E0A26E16 ] C:\Program Files (x86)\PDF24\pdf24.exe
22:59:09.0353 0x1448  PDFPrint - ok
22:59:09.0453 0x1448  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
22:59:09.0503 0x1448  Sidebar - ok
22:59:09.0533 0x1448  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
22:59:09.0553 0x1448  mctadmin - ok
22:59:09.0633 0x1448  [ 6ECE746BB283927604DA192CA0D1403D, 327E1E908B6DB1C8414B31DB277EF5EABA340B2EE7FEE19349860B3C8F7778FE ] C:\Windows\system32\spool\DRIVERS\x64\3\E_YATIJJE.EXE
22:59:09.0653 0x1448  EPLTarget\P0000000000000000 - ok
22:59:09.0653 0x1448  Waiting for KSN requests completion. In queue: 94
22:59:10.0653 0x1448  Waiting for KSN requests completion. In queue: 94
22:59:11.0653 0x1448  Waiting for KSN requests completion. In queue: 94
22:59:12.0673 0x1448  AV detected via SS2: Avira Desktop, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 14.0.6.548 ), 0x40000 ( disabled : updated )
22:59:12.0683 0x1448  Win FW state via NFP2: enabled
22:59:15.0163 0x1448  ============================================================
22:59:15.0163 0x1448  Scan finished
22:59:15.0163 0x1448  ============================================================
22:59:15.0173 0x12f0  Detected object count: 0
22:59:15.0173 0x12f0  Actual detected object count: 0
         

Alt 02.10.2014, 22:50   #11
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Adware/Junkware/Toolbars entfernen

(alte Versionen von adwCleaner und falls vorhanden JRT vorher löschen, danach neu runterladen auf den Desktop!)

1. Schritt: adwCleaner

Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).




2. Schritt: JRT - Junkware Removal Tool

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.




3. Schritt: Frisches Log mit FRST

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST Download FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)
  • Starte jetzt FRST.
  • Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
  • Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
  • Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)


Alt 03.10.2014, 21:27   #12
Büromagnet
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



adwCleaner:
Code:
ATTFilter
# AdwCleaner v3.311 - Bericht erstellt am 03/10/2014 um 22:05:35
# Aktualisiert 30/09/2014 von Xplode
# Betriebssystem : Windows 7 Professional Service Pack 1 (64 bits)
# Benutzername : Admin - W520
# Gestartet von : C:\Users\Admin\Desktop\AdwCleaner_3.311.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\Users\Admin\AppData\Roaming\pdfforge
Datei Gelöscht : C:\Users\y\AppData\Roaming\Mozilla\Firefox\Profiles\4bxl55bg.default\foxydeal.sqlite
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\searchplugins\zonealarm.xml
Datei Gelöscht : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\user.js

***** [ Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\escortEng.DLL
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\esrv.EXE
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\ScriptHost.Tool.1
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASAPI32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\apnstub_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasapi32
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\au__rasmancs
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Tracing\BingBar_RASMANCS
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{B12E99ED-69BD-437C-86BE-C862B9E5444D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{19D2F415-D58B-46BC-9390-C03DCBC21EB2}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{6E45F3E8-2683-4824-A6BE-08108022FB36}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{987D9269-F8A1-408F-BF62-4397D2F5363E}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{9F0F16DD-4E76-4049-A9B1-7A91E48F0323}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{E0722BEB-FDA1-4AA1-A2A8-15A74A5B3F70}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\CLSID\{F4288797-CB12-49CE-9DF8-7CDFA1143BEA}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\Interface\{79FB5FC8-44B9-4AF5-BADD-CCE547F953E5}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{06DEB529-DE09-43EC-B6E2-451AAB0FF000}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{212C2C4F-C845-4FBC-9561-C833A13D8DCE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{3C5D1D57-16C8-473C-A552-37B8D88596FE}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{4A115D8A-6A7B-4C72-92B1-2E2D01F36979}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{99DF8440-814E-497F-BDDD-FB93E9E9DF96}
Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\TypeLib\{E00DE9B9-B128-4C39-B732-B5D85013FA48}
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\Low Rights\ElevationPolicy\{83CAD530-387D-40FD-82EA-B9E863D92A9B}
Schlüssel Gelöscht : [x64] HKLM\SOFTWARE\Classes\Interface\{744E0E81-BC79-4719-A58B-C98F7E78EE5D}
Schlüssel Gelöscht : HKCU\Software\OCS

***** [ Browser ] *****

-\\ Internet Explorer v9.0.8112.16575


-\\ Mozilla Firefox v32.0.3 (x86 de)

[ Datei : C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default\prefs.js ]


[ Datei : C:\Users\y\AppData\Roaming\Mozilla\Firefox\Profiles\4bxl55bg.default\prefs.js ]


*************************

AdwCleaner[R0].txt - [3754 octets] - [03/10/2014 22:03:39]
AdwCleaner[S0].txt - [3625 octets] - [03/10/2014 22:05:35]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [3685 octets] ##########
         
JRT
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.2.7 (10.03.2014:1)
OS: Windows 7 Professional x64
Ran by Admin on 03.10.2014 at 22:13:16,42
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ FireFox

Emptied folder: C:\Users\Admin\AppData\Roaming\mozilla\firefox\profiles\bnq9dguw.default\minidumps [1 files]



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 03.10.2014 at 22:16:06,26
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
FRST

FRST Logfile:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 01-10-2014 01
Ran by Admin (administrator) on W520 on 03-10-2014 22:19:56
Running from C:\Users\Admin\Desktop
Loaded Profile: Admin (Available profiles: UpdatusUser & Admin & y & Gast)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Lenovo.) C:\Windows\System32\ibmpmsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(NVIDIA Corporation) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
(NVIDIA Corporation) C:\Program Files\NVIDIA Corporation\Display\NvXDSync.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Authentec Inc.) C:\Program Files\ThinkVantage Fingerprint Software\upeksvr.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPHKSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tphkload.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcPrfMgrSvc.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlk.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcSvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\btwdins.exe
(Conexant Systems Inc.) C:\Windows\System32\CxAudMsg64.exe
(SEIKO EPSON CORPORATION) C:\Program Files\Common Files\EPSON\EPW!3 SSRP\E_WT50RP.EXE
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Services\IPT\jhi_service.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\CamMute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\micmute.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TPKNRSVC.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\lvvsst.exe
(Protexis Inc.) C:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\PWMEWSVC.exe
(Conexant Systems, Inc.) C:\Windows\SysWOW64\SASrv.exe
(Ulead Systems, Inc.) C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Ericsson AB) C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\VIRTSCRL\virtscrl.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\ZOOM\TpScrex.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\TPONSCR.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\HOTKEY\tpnumlkd.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SRORest.exe
(Lenovo.) C:\Windows\System32\TpShocks.exe
() C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\Communications Utility\TpKnrres.exe
(Lenovo Group Limited) C:\Program Files\Lenovo\AutoLock\ALCKRESI.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe
(Intel Corporation) C:\Windows\System32\hkcmd.exe
(Intel Corporation) C:\Windows\System32\igfxpers.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Broadcom Corporation.) C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe
() C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
(Avanquest Software ) C:\Program Files (x86)\Digital Line Detect\DLG.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\SvcGuiHlpr.exe
(X-Rite Inc.) C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe
(Ricoh co.,Ltd.) C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe
(Renesas Electronics Corporation) C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPLpr.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(Geek Software GmbH) C:\Program Files (x86)\PDF24\pdf24.exe
(Lenovo Group Limited) C:\Program Files (x86)\ThinkPad\Utilities\SCHTASK.EXE
(Synaptics Incorporated) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Lenovo Group Limited) C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PrivacyIconClient.exe
(Lenovo.) C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE
() C:\Program Files (x86)\Lenovo\Message Center Plus\MCPLaunch.exe
(Lenovo) C:\Program Files (x86)\Lenovo\Access Connections\AcDeskBandHlpr.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [TpShocks] => C:\Windows\system32\TpShocks.exe [380776 2011-03-29] (Lenovo.)
HKLM\...\Run: [ForteConfig] => C:\Program Files\Conexant\ForteConfig\fmapp.exe [49056 2010-10-26] ()
HKLM\...\Run: [LENOVO.TPKNRRES] => C:\Program Files\Lenovo\Communications Utility\TPKNRRES.exe [40808 2011-05-31] (Lenovo Group Limited)
HKLM\...\Run: [ALCKRESI.EXE] => C:\Program Files\Lenovo\AutoLock\ALCKRESI.EXE [281960 2011-07-13] (Lenovo Group Limited)
HKLM\...\Run: [AcWin7Hlpr] => C:\Program Files (x86)\Lenovo\Access Connections\AcTBenabler.exe [63832 2014-03-14] (Lenovo)
HKLM\...\Run: [IntelPAN] => C:\Program Files\Common Files\Intel\WirelessCommon\iFrmewrk.exe [1935120 2011-05-02] (Intel(R) Corporation)
HKLM\...\Run: [SmartAudio] => C:\Program Files\CONEXANT\SAII\SAIICpl.exe [316032 2010-12-14] (Conexant systems, Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [2963184 2013-04-24] (Synaptics Incorporated)
HKLM-x32\...\Run: [IMSS] => C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IMSS\PIconStartup.exe [112152 2011-01-17] (Intel Corporation)
HKLM-x32\...\Run: [PWMTRV] => rundll32 C:\PROGRA~2\ThinkPad\UTILIT~1\PWMTR64V.DLL,PwrMgrBkGndMonitor
HKLM-x32\...\Run: [X-Rite Legacy Device] => C:\Program Files (x86)\X-Rite\Devices\Lib\xritelegacyd.exe [105984 2010-09-28] (X-Rite Inc.)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [937920 2011-06-06] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [RotateImage] => C:\Program Files (x86)\Integrated Camera Driver\X64\RCIMGDIR.exe [55808 2008-10-30] (Ricoh co.,Ltd.)
HKLM-x32\...\Run: [NUSB3MON] => C:\Program Files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe [115048 2011-09-16] (Renesas Electronics Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [751184 2014-08-07] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKLM-x32\...\Run: [BCSSync] => C:\Program Files (x86)\Microsoft Office\Office14\BCSSync.exe [89184 2012-11-05] (Microsoft Corporation)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [164656 2014-08-27] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [PDFPrint] => C:\Program Files (x86)\PDF24\pdf24.exe [191528 2014-07-04] (Geek Software GmbH)
Winlogon\Notify\igfxcui: C:\Windows\system32\igfxdev.dll (Intel Corporation)
Winlogon\Notify\psfus: C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll (Authentec Inc.)
Lsa: [Notification Packages] scecli C:\Program Files\ThinkVantage Fingerprint Software\psqlpwd.dll
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Bluetooth.lnk
ShortcutTarget: Bluetooth.lnk -> C:\Program Files\ThinkPad\Bluetooth Software\BTTray.exe (Broadcom Corporation.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibrator Gamma.lnk
ShortcutTarget: Color Calibrator Gamma.lnk -> C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Gamma\CalibrationLoader.exe (LOGO Kommunikations- und Drucktechnik GmbH & Co. KG)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Color Calibrator Tray.lnk
ShortcutTarget: Color Calibrator Tray.lnk -> C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Digital Line Detect.lnk
ShortcutTarget: Digital Line Detect.lnk -> C:\Program Files (x86)\Digital Line Detect\DLG.exe (Avanquest Software )

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKCU\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKCU\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://lenovo.msn.com
HKCU\Software\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = hxxp://www.lenovo.com/welcome/thinkpad
StartMenuInternet: IEXPLORE.EXE - C:\Program Files (x86)\Internet Explorer\iexplore.exe
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll (Adobe Systems Incorporated)
BHO-x32: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files (x86)\Microsoft Office\Office14\GROOVEEX.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll (Oracle Corporation)
BHO-x32: Windows Live ID-Anmelde-Hilfsprogramm -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)
DPF: HKLM-x32 {1E54D648-B804-468d-BC78-4AFFED8E262F} hxxp://www.nvidia.com/content/DriverDownload/srl/3.0.0.4/srl_bin/sysreqlab_nvd.cab

FireFox:
========
FF ProfilePath: C:\Users\Admin\AppData\Roaming\Mozilla\Firefox\Profiles\bnq9dguw.default
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_15_0_0_152.dll ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_15_0_0_152.dll ()
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.30514.0\npctrl.dll ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPAUTHZ.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~4\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3508.1109 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF Plugin-x32: @nvidia.com/3DVision -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF Plugin-x32: @nvidia.com/3DVisionStreaming -> C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\amazondotcom-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\eBay-de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\leo_ende_de.xml
FF SearchPlugin: C:\Program Files (x86)\mozilla firefox\browser\searchplugins\yahoo-de.xml

Chrome: 
=======

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [430160 2014-08-07] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [160048 2014-08-27] (Avira Operations GmbH & Co. KG)
R3 DozeSvc; C:\Program Files (x86)\ThinkPad\Utilities\DZSVC64.EXE [477032 2011-07-04] (Lenovo.)
R2 i1 Display Service; C:\Program Files (x86)\X-Rite\Devices\Services\i1Display\i1DisplayDeviceService.exe [163328 2010-09-28] (X-Rite Inc.) [File not signed]
R2 Lenovo.VIRTSCRLSVC; C:\Program Files\LENOVO\VIRTSCRL\lvvsst.exe [93032 2010-04-07] (Lenovo Group Limited)
S3 MyWiFiDHCPDNS; C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe [340240 2011-05-02] ()
S3 PDF Architect 2; C:\Program Files (x86)\PDF Architect 2\ws.exe [1771560 2014-06-26] (pdfforge GmbH)
S3 pdfforge CrashHandler; C:\Program Files (x86)\PDF Architect 2\crash-handler-ws.exe [861736 2014-06-26] (pdfforge GmbH)
R2 SROSVC; C:\Program Files (x86)\Lenovo\Screen Reading Optimizer\SROSVC.exe [443240 2011-03-02] (Lenovo Group Limited)
R2 UleadBurningHelper; C:\Program Files (x86)\Common Files\Ulead Systems\DVD\ULCDRSvr.exe [61440 2008-01-10] (Ulead Systems, Inc.) [File not signed]
R2 WMCoreService; C:\Program Files (x86)\Mobile Broadband drivers\WMCore\mini_WMCore.exe [648744 2011-08-12] (Ericsson AB)
R2 xritedeviced; C:\Program Files (x86)\X-Rite\Devices\Services\xritedeviced.exe [142848 2010-09-28] (X-Rite Inc.) [File not signed]

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [117712 2014-08-04] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [130584 2014-08-04] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-08-04] (Avira Operations GmbH & Co. KG)
R3 ecnssndis; C:\Windows\System32\Drivers\wwuss64.sys [26664 2010-03-03] (Ericsson AB)
R3 ecnssndisfltr; C:\Windows\System32\Drivers\wwussf64.sys [30248 2010-03-03] (Ericsson AB)
R3 l36wgps; C:\Windows\System32\DRIVERS\l36wgps64.sys [101416 2011-07-01] (Ericsson AB)
S3 mbamchameleon; C:\Windows\system32\drivers\mbamchameleon.sys [92888 2014-10-02] (Malwarebytes Corporation)
R3 Mbm3CBus; C:\Windows\System32\DRIVERS\Mbm3CBus.sys [419400 2011-04-13] (MCCI Corporation)
R3 Mbm3DevMt; C:\Windows\System32\DRIVERS\Mbm3DevMt.sys [430664 2011-04-13] (MCCI Corporation)
R3 Mbm3mdfl; C:\Windows\System32\DRIVERS\Mbm3mdfl.sys [19528 2011-04-13] (MCCI Corporation)
R3 Mbm3Mdm; C:\Windows\System32\DRIVERS\Mbm3Mdm.sys [483400 2011-04-13] (MCCI Corporation)
R1 nvkflt; C:\Windows\System32\DRIVERS\nvkflt.sys [284448 2013-10-29] (NVIDIA Corporation)
S3 pmxdrv; C:\Windows\system32\drivers\pmxdrv.sys [31152 2011-05-24] ()
R3 TVTI2C; C:\Windows\System32\DRIVERS\Tvti2c.sys [41536 2009-09-24] (Lenovo (United States) Inc.)
S3 WwanUsbServ; C:\Windows\System32\DRIVERS\WwanUsbMp64.sys [286248 2011-04-06] (Ericsson AB)
S3 catchme; \??\C:\ComboFix\catchme.sys [X]
S2 smihlp; \??\C:\Program Files\ThinkVantage Fingerprint Software\smihlp.sys [X]
S3 VBoxNetFlt; system32\DRIVERS\VBoxNetFlt.sys [X]
S0 vmci; system32\DRIVERS\vmci.sys [X]
S3 VMnetAdapter; system32\DRIVERS\vmnetadapter.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-03 22:19 - 2014-10-03 22:19 - 00018587 _____ () C:\Users\Admin\Desktop\FRST.txt
2014-10-03 22:16 - 2014-10-03 22:16 - 00000756 _____ () C:\Users\Admin\Desktop\JRT.txt
2014-10-03 22:13 - 2014-10-03 22:13 - 00000000 ____D () C:\Windows\ERUNT
2014-10-03 22:11 - 2014-10-03 22:11 - 00003769 _____ () C:\Users\Admin\Desktop\AdwCleaner[S0].txt
2014-10-03 22:03 - 2014-10-03 22:05 - 00000000 ____D () C:\AdwCleaner
2014-10-03 22:02 - 2014-10-03 22:02 - 01702068 _____ (Thisisu) C:\Users\Admin\Desktop\JRT.exe
2014-10-03 22:01 - 2014-10-03 22:01 - 01375089 _____ () C:\Users\Admin\Desktop\AdwCleaner_3.311.exe
2014-10-02 22:55 - 2014-10-02 22:55 - 04181856 _____ (Kaspersky Lab ZAO) C:\Users\Admin\Desktop\tdsskiller.exe
2014-10-02 22:30 - 2014-10-02 22:30 - 00025239 _____ () C:\ComboFix.txt
2014-10-02 22:17 - 2014-10-02 22:30 - 00000000 ____D () C:\Qoobox
2014-10-02 22:17 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2014-10-02 22:17 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2014-10-02 22:17 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2014-10-02 22:17 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2014-10-02 22:16 - 2014-10-02 22:29 - 00000000 ____D () C:\Windows\erdnt
2014-10-02 22:03 - 2014-10-02 22:03 - 05582981 ____R (Swearware) C:\Users\Admin\Desktop\ComboFix.exe
2014-10-02 13:55 - 2014-10-02 13:55 - 00011790 _____ () C:\Users\Admin\Desktop\Logfiles.7z
2014-10-02 13:53 - 2014-10-02 13:53 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\7-Zip
2014-10-02 13:53 - 2014-10-02 13:53 - 00000000 ____D () C:\Program Files (x86)\7-Zip
2014-10-02 13:52 - 2014-10-02 13:52 - 01110476 _____ () C:\Users\Admin\Downloads\7z920.exe
2014-10-02 13:12 - 2014-10-02 13:12 - 00044202 _____ () C:\Users\Admin\Desktop\AVSCAN-20141002-114128-2D47BB75.LOG
2014-10-02 12:52 - 2014-10-02 12:52 - 00087021 _____ () C:\Users\Admin\Desktop\gmer.txt
2014-10-02 11:52 - 2014-10-02 12:31 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2014-10-02 11:50 - 2014-10-02 12:31 - 00000000 ____D () C:\Users\Admin\Desktop\mbar
2014-10-02 11:49 - 2014-10-02 11:49 - 14349744 _____ (Malwarebytes Corp.) C:\Users\y\Desktop\mbar-1.07.0.1012.exe
2014-10-02 11:48 - 2014-10-02 11:48 - 00380416 _____ () C:\Users\Admin\Desktop\11d0cftl.exe
2014-10-02 11:47 - 2014-10-02 11:47 - 02108928 _____ (Farbar) C:\Users\Admin\Desktop\FRST64.exe
2014-10-01 11:13 - 2014-09-25 04:08 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2014-10-01 11:13 - 2014-09-25 03:40 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2014-09-27 11:27 - 2014-09-27 11:27 - 00000000 ____D () C:\Users\y\AppData\Local\Lenovo
2014-09-25 21:09 - 2014-09-26 09:24 - 00000000 ____D () C:\Users\y\AppData\Local\Mozilla Thunderbird
2014-09-24 23:02 - 2014-09-24 23:02 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2014-09-24 09:50 - 2014-09-10 00:11 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\tzres.dll
2014-09-24 09:50 - 2014-09-09 23:47 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\tzres.dll
2014-09-21 17:30 - 2014-09-21 17:30 - 00791895 _____ () C:\Users\y\Downloads\OptiFine_1.7.10_HD_A4.jar
2014-09-21 17:22 - 2014-09-21 17:23 - 00000000 ____D () C:\Users\Admin\AppData\Local\Adobe
2014-09-21 01:07 - 2014-09-21 01:07 - 00001478 _____ () C:\Users\y\AppData\Local\recently-used.xbel
2014-09-21 01:01 - 2014-09-21 01:09 - 00000000 ____D () C:\Users\y\AppData\Local\gtk-2.0
2014-09-21 01:00 - 2014-09-21 01:00 - 00000000 ____D () C:\Users\y\.thumbnails
2014-09-21 00:55 - 2014-09-21 01:09 - 00000000 ____D () C:\Users\y\.gimp-2.8
2014-09-21 00:55 - 2014-09-21 00:55 - 00000000 ____D () C:\Users\y\AppData\Local\gegl-0.2
2014-09-21 00:46 - 2014-09-21 00:46 - 00000905 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\GIMP 2.lnk
2014-09-21 00:45 - 2014-09-21 00:46 - 00000000 ____D () C:\Program Files\GIMP 2
2014-09-21 00:25 - 2014-09-21 00:29 - 91931728 _____ (The GIMP Team ) C:\Users\y\Desktop\gimp-2.8.14-setup-1.exe
2014-09-21 00:17 - 2014-09-21 00:17 - 00001090 _____ () C:\Users\Public\Desktop\PDF24 Creator.lnk
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\Users\y\AppData\Local\PDF24
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF24
2014-09-21 00:17 - 2014-09-21 00:17 - 00000000 ____D () C:\Program Files (x86)\PDF24
2014-09-20 23:59 - 2014-09-20 23:59 - 00000000 ____D () C:\Users\y\Desktop\SpritecraftFull
2014-09-19 22:27 - 2014-10-01 22:23 - 00000000 ____D () C:\Users\y\Desktop\Printables
2014-09-19 14:43 - 2014-09-19 14:43 - 00000000 ____D () C:\Program Files\Common Files\EPSON
2014-09-19 13:51 - 2014-09-19 13:51 - 00000000 ____D () C:\Users\y\AppData\Roaming\Epson
2014-09-19 13:38 - 2014-09-19 14:10 - 00002369 _____ () C:\Users\Public\Desktop\Epson Netzwerkhandbuch WF-3520 Series.lnk
2014-09-19 13:38 - 2014-09-19 14:09 - 00000279 _____ () C:\Users\Public\Desktop\Epson Benutzerhandbuch WF-3520 Series.url
2014-09-19 13:37 - 2014-09-22 15:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Epson Software
2014-09-19 13:37 - 2014-09-22 15:47 - 00000000 ____D () C:\Program Files (x86)\Epson Software
2014-09-19 13:37 - 2014-09-19 13:37 - 00000000 ____D () C:\Users\Admin\AppData\Roaming\Epson
2014-09-19 13:36 - 2014-09-23 12:31 - 00000000 ____D () C:\Program Files (x86)\epson
2014-09-19 13:36 - 2014-09-22 15:54 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\EPSON
2014-09-19 13:35 - 2014-09-20 14:45 - 00000000 ____D () C:\ProgramData\EPSON
2014-09-19 13:35 - 2011-04-19 03:03 - 00120320 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YLMJJE.DLL
2014-09-19 13:35 - 2011-03-14 03:03 - 00083968 _____ (SEIKO EPSON CORPORATION) C:\Windows\system32\E_YD4BJJE.DLL
2014-09-19 13:35 - 2007-04-10 01:06 - 00010752 _____ (SEIKO EPSON CORP.) C:\Windows\system32\E_GCINST.DLL
2014-09-12 23:15 - 2014-09-12 23:15 - 00000000 ____D () C:\Users\y\AppData\Roaming\NVIDIA
2014-09-12 20:21 - 2014-10-03 00:09 - 00000000 ____D () C:\Users\y\AppData\Roaming\.minecraft
2014-09-12 20:12 - 2014-09-12 20:12 - 00675988 _____ () C:\Users\y\Desktop\Minecraft.exe
2014-09-12 16:54 - 2014-08-15 17:48 - 17868288 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2014-09-12 16:54 - 2014-08-15 17:36 - 10920960 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2014-09-12 16:54 - 2014-08-15 17:35 - 02339328 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2014-09-12 16:54 - 2014-08-15 17:31 - 01392128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2014-09-12 16:54 - 2014-08-15 17:31 - 01384960 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2014-09-12 16:54 - 2014-08-15 17:30 - 01494016 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2014-09-12 16:54 - 2014-08-15 17:30 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2014-09-12 16:54 - 2014-08-15 17:30 - 00599040 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 02156032 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00729088 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00453120 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00282112 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00237056 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00173056 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2014-09-12 16:54 - 2014-08-15 17:29 - 00096768 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00085504 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2014-09-12 16:54 - 2014-08-15 17:29 - 00055296 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2014-09-12 16:54 - 2014-08-15 17:28 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2014-09-12 16:54 - 2014-08-15 17:28 - 00248320 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2014-09-12 16:54 - 2014-08-15 17:28 - 00012800 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2014-09-12 16:54 - 2014-08-15 17:28 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2014-09-12 16:54 - 2014-08-15 16:51 - 12363264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2014-09-12 16:54 - 2014-08-15 16:42 - 09739776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2014-09-12 16:54 - 2014-08-15 16:42 - 01810432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2014-09-12 16:54 - 2014-08-15 16:37 - 01137664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2014-09-12 16:54 - 2014-08-15 16:37 - 01129472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2014-09-12 16:54 - 2014-08-15 16:36 - 01427968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2014-09-12 16:54 - 2014-08-15 16:35 - 01802240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00717824 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00607744 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00421376 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00353792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00231936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\url.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00223232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00142848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2014-09-12 16:54 - 2014-08-15 16:35 - 00065024 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2014-09-12 16:54 - 2014-08-15 16:35 - 00041472 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedsbs.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 02382848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2014-09-12 16:54 - 2014-08-15 16:34 - 00176640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 00073216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2014-09-12 16:54 - 2014-08-15 16:34 - 00011776 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshta.exe
2014-09-12 16:54 - 2014-08-15 16:34 - 00010752 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeedssync.exe
2014-09-12 16:46 - 2014-06-27 04:08 - 02777088 _____ (Microsoft Corporation) C:\Windows\system32\msmpeg2vdec.dll
2014-09-12 16:46 - 2014-06-27 03:45 - 02285056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msmpeg2vdec.dll
2014-09-11 08:44 - 2014-09-05 04:10 - 00578048 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2014-09-11 08:44 - 2014-09-05 04:05 - 00424448 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2014-09-11 08:44 - 2014-08-01 13:53 - 01031168 _____ (Microsoft Corporation) C:\Windows\system32\TSWorkspace.dll
2014-09-11 08:44 - 2014-08-01 13:35 - 00793600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSWorkspace.dll
2014-09-11 08:44 - 2014-07-07 04:06 - 01460736 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2014-09-11 08:44 - 2014-07-07 04:06 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2014-09-11 08:44 - 2014-07-07 03:40 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2014-09-11 08:44 - 2014-07-07 03:40 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2014-09-11 08:44 - 2014-07-07 03:39 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2014-09-11 08:44 - 2014-06-24 05:29 - 02565120 _____ (Microsoft Corporation) C:\Windows\system32\d3d10warp.dll
2014-09-11 08:44 - 2014-06-24 04:59 - 01987584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\d3d10warp.dll
2014-09-04 01:02 - 2014-09-04 01:02 - 00012288 ___SH () C:\Users\y\Thumbs.db
2014-09-04 01:00 - 2014-09-04 01:00 - 00001024 _____ () C:\Users\Public\Desktop\PDF Architect 2.lnk
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\Users\Admin\Documents\PDF Architect 2
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDF Architect 2
2014-09-04 01:00 - 2014-09-04 01:00 - 00000000 ____D () C:\Program Files (x86)\PDF Architect 2
2014-09-04 00:59 - 2014-09-04 01:00 - 00000000 ____D () C:\Program Files (x86)\PDFCreator
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\ProgramData\PDF Architect 2
2014-09-04 00:59 - 2014-09-04 00:59 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\PDFCreator
2014-09-04 00:59 - 2014-04-25 17:44 - 00662288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCOMCT2.OCX
2014-09-04 00:59 - 2014-04-25 17:44 - 00137000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMAPI32.OCX
2014-09-04 00:59 - 2014-04-25 17:44 - 00110264 _____ (pdfforge GmbH) C:\Windows\system32\pdfcmon.dll
2014-09-04 00:59 - 2014-04-25 17:44 - 00023552 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSMPIDE.DLL
2014-09-04 00:59 - 1998-07-06 18:56 - 00125712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\VB6DE.DLL
2014-09-04 00:59 - 1998-07-06 18:55 - 00158208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCMCDE.DLL
2014-09-04 00:59 - 1998-07-06 18:55 - 00064512 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MSCC2DE.DLL
2014-09-04 00:56 - 2014-09-04 00:56 - 27843432 _____ (pdfforge ) C:\Users\y\Downloads\PDFCreator-1_7_3_setup.exe

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2014-10-03 22:19 - 2014-08-07 11:38 - 00000000 ____D () C:\FRST
2014-10-03 22:16 - 2011-06-21 19:59 - 00000528 _____ () C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job
2014-10-03 22:15 - 2009-07-14 06:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2014-10-03 22:15 - 2009-07-14 06:45 - 00031072 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2014-10-03 22:14 - 2011-06-21 19:59 - 00000466 _____ () C:\Windows\Tasks\SystemToolsDailyTest.job
2014-10-03 22:06 - 2011-05-24 09:34 - 00000000 ____D () C:\ProgramData\NVIDIA
2014-10-03 22:06 - 2010-11-21 05:47 - 00102902 _____ () C:\Windows\PFRO.log
2014-10-03 22:06 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2014-10-03 22:06 - 2009-07-14 06:51 - 00079685 _____ () C:\Windows\setupact.log
2014-10-03 22:05 - 2011-05-24 09:23 - 01677645 _____ () C:\Windows\WindowsUpdate.log
2014-10-03 22:00 - 2014-06-17 22:26 - 00323165 _____ () C:\Windows\IE11_main.log
2014-10-03 00:48 - 2014-06-24 12:47 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2014-10-02 22:30 - 2009-07-14 05:20 - 00000000 __RHD () C:\Users\Default
2014-10-02 22:26 - 2009-07-14 04:34 - 00000215 _____ () C:\Windows\system.ini
2014-10-02 22:24 - 2009-07-14 04:34 - 76808192 _____ () C:\Windows\system32\config\SOFTWARE.bak
2014-10-02 22:24 - 2009-07-14 04:34 - 17563648 _____ () C:\Windows\system32\config\SYSTEM.bak
2014-10-02 22:24 - 2009-07-14 04:34 - 00524288 _____ () C:\Windows\system32\config\DEFAULT.bak
2014-10-02 22:24 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SECURITY.bak
2014-10-02 22:24 - 2009-07-14 04:34 - 00262144 _____ () C:\Windows\system32\config\SAM.bak
2014-10-02 20:30 - 2009-07-14 07:08 - 00032624 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2014-10-02 13:11 - 2011-05-24 19:13 - 00699666 _____ () C:\Windows\system32\perfh007.dat
2014-10-02 13:11 - 2011-05-24 19:13 - 00149774 _____ () C:\Windows\system32\perfc007.dat
2014-10-02 13:11 - 2009-07-14 07:13 - 01620612 _____ () C:\Windows\system32\PerfStringBackup.INI
2014-10-02 12:35 - 2014-08-07 11:38 - 00040003 _____ () C:\Users\Admin\Desktop\FRST1.txt
2014-10-02 12:13 - 2014-08-07 11:10 - 00128728 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2014-10-02 11:51 - 2014-08-07 11:10 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2014-10-02 11:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2014-10-02 10:28 - 2014-08-11 22:40 - 00000000 ____D () C:\Users\y\Desktop\Rezepte
2014-10-01 21:15 - 2014-08-12 00:27 - 00000000 ____D () C:\Users\y\Handykarte Dateien
2014-09-27 13:56 - 2014-06-17 20:59 - 00000000 ____D () C:\Windows\System32\Tasks\TVT
2014-09-27 13:56 - 2011-05-24 18:46 - 00000000 ____D () C:\ProgramData\Lenovo
2014-09-27 13:55 - 2011-05-24 09:43 - 00000000 ____D () C:\Windows\Downloaded Installations
2014-09-27 13:55 - 2011-05-24 09:28 - 00000000 ___HD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Lenovo ThinkVantage Tools
2014-09-27 13:55 - 2011-05-24 09:27 - 00000000 ____D () C:\Program Files (x86)\Lenovo
2014-09-27 12:03 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2014-09-25 11:55 - 2014-06-17 20:57 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2014-09-22 15:53 - 2011-05-24 09:23 - 00000000 ___HD () C:\Program Files (x86)\InstallShield Installation Information
2014-09-21 17:22 - 2014-06-24 12:47 - 00701104 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2014-09-21 17:22 - 2014-06-24 12:47 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2014-09-21 17:22 - 2011-06-25 17:11 - 00071344 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2014-09-21 01:00 - 2014-06-24 12:42 - 00000000 ____D () C:\Users\y
2014-09-21 00:16 - 2014-06-17 20:52 - 00122712 _____ () C:\Users\Admin\AppData\Local\GDIPFONTCACHEV1.DAT
2014-09-19 19:29 - 2014-08-14 11:38 - 00000000 ____D () C:\Users\y\Studium
2014-09-19 14:06 - 2009-07-14 07:32 - 00000000 ____D () C:\Windows\system32\FxsTmp
2014-09-15 09:06 - 2010-11-21 05:27 - 00278152 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2014-09-12 16:54 - 2014-08-11 21:23 - 00000000 ____D () C:\ProgramData\Microsoft Help
2014-09-12 16:54 - 2011-06-22 22:29 - 01594892 _____ () C:\Windows\SysWOW64\PerfStringBackup.INI
2014-09-12 16:53 - 2014-06-17 22:49 - 00000000 ____D () C:\Windows\system32\MRT
2014-09-12 16:48 - 2014-06-24 13:18 - 00000000 ____D () C:\ProgramData\Package Cache
2014-09-12 16:47 - 2014-08-04 17:21 - 00001148 _____ () C:\Users\Public\Desktop\Avira.lnk
2014-09-12 16:47 - 2011-06-21 19:39 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2014-09-12 16:47 - 2011-06-21 19:39 - 00000000 ____D () C:\Program Files (x86)\Avira
2014-09-12 16:46 - 2014-06-17 22:54 - 00000000 ___SD () C:\Windows\system32\CompatTel
2014-09-12 16:46 - 2011-06-21 20:16 - 101694776 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2014-09-10 13:28 - 2014-08-11 22:40 - 00000000 ____D () C:\Users\y\Desktop\USB Maus
2014-09-05 11:51 - 2014-08-11 22:24 - 00000000 ____D () C:\Users\y\Bewerbungen

Some content of TEMP:
====================
C:\Users\Admin\AppData\Local\Temp\avgnt.exe
C:\Users\Admin\AppData\Local\Temp\Quarantine.exe
C:\Users\y\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2014-09-27 11:55

==================== End Of Log ============================
         
--- --- ---

Alt 03.10.2014, 23:26   #13
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Bitte auch ne neue Addition.txt erstellen, dazu FRST starten und einen Haken setzen bei Addition.txt, dann auf Scan klicken.


Alt 04.10.2014, 02:51   #14
Büromagnet
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Ok, dann hier noch die neue Additions:
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 01-10-2014 01
Ran by Admin at 2014-10-04 03:44:17
Running from C:\Users\Admin\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Disabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Disabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (HKLM-x32\...\7-Zip) (Version:  - )
Adobe Flash Player 15 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 15.0.0.152 - Adobe Systems Incorporated)
Adobe Reader X (10.1.1) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.1 - Adobe Systems Incorporated)
Anzeige am Bildschirm (HKLM\...\OnScreenDisplay) (Version: 6.71.00 - )
Avira (HKLM-x32\...\{70e83cd8-4bd5-4039-ab5a-6b94a8abb641}) (Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.21.25162 - Avira Operations GmbH & Co. KG) Hidden
Avira Free Antivirus (HKLM-x32\...\Avira AntiVir Desktop) (Version: 14.0.6.570 - Avira)
Broadcom InConcert Maestro (HKLM\...\{57DD35E9-D9BB-4089-BB05-EF933C586CB3}) (Version: 1.0.1.1500 - Broadcom Corporation)
Burn.Now 4.5 (x32 Version: 4.5.0 - Corel Corporation) Hidden
Conexant 20672 SmartAudio HD (HKLM\...\CNXT_AUDIO_HDA) (Version: 8.32.23.5 - Conexant)
Corel Burn.Now Lenovo Edition (HKLM-x32\...\InstallShield_{A3BE3F1E-2472-4211-8735-E8239BE49D9F}) (Version: 4.5.0 - Corel Corporation)
Corel DVD MovieFactory 7 (x32 Version: 7.0.0 - Corel Corporation) Hidden
Corel DVD MovieFactory Lenovo Edition (HKLM-x32\...\InstallShield_{50F68032-B5B7-4513-9116-C978DBD8F27A}) (Version: 7.0.0 - Corel Corporation)
Corel WinDVD (HKLM-x32\...\{5C1F18D2-F6B7-4242-B803-B5A78648185D}) (Version: 10.0.5.828 - Corel Inc.)
Create Recovery Media (HKLM-x32\...\{50DC5136-21E8-48BC-97E5-1AD055F6B0B6}) (Version: 1.20.0.00 - Lenovo Group Limited)
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Definition Update for Microsoft Office 2010 (KB982726) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{650DE870-ECA3-4E63-8D77-778512BE5D4C}) (Version:  - Microsoft)
Dienstprogramm "ThinkPad UltraNav" (HKLM-x32\...\{17CBC505-D1AE-459D-B445-3D2000A85842}) (Version: 2.13.0 - Lenovo)
Direct DiscRecorder (x32 Version: 1.00.0000 - Corel Corporation) Hidden
Disable AMT Profile Synchronization Pop-up for Windows XP/Vista/7 (HKLM\...\DisableAMTPopup) (Version: 1.00 - )
Epson Benutzerhandbuch WF-3520 Series (HKLM-x32\...\WF-3520 Series Useg) (Version:  - )
Epson Netzwerkhandbuch WF-3520 Series (HKLM-x32\...\WF-3520 Series Netg) (Version:  - )
EPSON WF-3520 Series Printer Uninstall (HKLM\...\EPSON WF-3520 Series) (Version:  - SEIKO EPSON Corporation)
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Integrated Camera Driver Installer Package Ver.1.1.0.1147 (HKLM-x32\...\{B2CA6F37-1602-4823-81B5-0384B6888AA6}) (Version: 1.1.0.1147 - RICOH)
Integrated Camera TWAIN (HKLM-x32\...\{9CA0DEE4-E84B-466F-9B96-FC255F3A929F}) (Version: 1.0.11.1223 - Chicony Electronics Co.,Ltd.)
Intel PROSet Wireless (Version:  - ) Hidden
Intel PROSet Wireless (x32 Version:  - ) Hidden
Intel(R) Control Center (HKLM-x32\...\{F8A9085D-4C7A-41a9-8A77-C8998A96C421}) (Version: 1.2.1.1007 - Intel Corporation)
Intel(R) Identity Protection Technology 1.0.74.0 (HKLM-x32\...\{C6D4B05A-EA7E-1027-80EF-C925E740E99C}) (Version: 1.0.74.0 - Intel Corporation)
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 7.0.0.1144 - Intel Corporation)
Intel(R) Network Connections Drivers (HKLM\...\PROSet) (Version: 18.7 - Intel)
Intel(R) Processor Graphics (HKLM-x32\...\{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}) (Version: 8.15.10.2538 - Intel Corporation)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{3C41721F-AF0F-4086-AA1C-4C7F29076228}) (Version: 14.01.1000 - Intel Corporation)
Intel(R) Wireless Display (HKLM\...\{28EF7372-9087-4AC3-9B9F-D9751FCDF830}) (Version:  - )
Intel(R) Wireless Display (HKLM-x32\...\{F84906ED-BB54-4889-B131-FED9C9056FC8}) (Version: 2.0.27.0 - Intel Corporation)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
Java Auto Updater (x32 Version: 2.1.67.1 - Oracle, Inc.) Hidden
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Lenovo Auto Scroll Utility (HKLM\...\LenovoAutoScrollUtility) (Version: 1.00 - )
Lenovo Mobile Broadband Activation (HKLM-x32\...\{A95D9DF7-CF34-421A-A1DC-936A49A4DAEA}) (Version: 4.0.0013.00 - Lenovo Group Limited)
Lenovo Patch Utility (x32 Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Patch Utility 64 bit (Version: 1.4.0.4 - Lenovo Group Limited) Hidden
Lenovo Power Management Driver (HKLM\...\Power Management Driver) (Version: 1.67.04.05 - )
Lenovo Screen Reading Optimizer (HKLM-x32\...\{91A29166-4E1B-4664-B70B-4C4A3B6B3372}) (Version: 1.07 - Lenovo)
Lenovo System Interface Driver (HKLM\...\LENOVO.SMIIF) (Version: 1.05 - )
Lenovo ThinkVantage Toolbox (HKLM\...\PC-Doctor for Windows) (Version: 6.0.5849.23 - PC-Doctor, Inc.)
Lenovo User Guide (HKLM-x32\...\{13F59938-C595-479C-B479-F171AB9AF64F}) (Version: 1.0.0008.00 - Ihr Firmenname)
Lenovo Warranty Information (HKLM-x32\...\{FD4EC278-C1B1-4496-99ED-C0BE1B0AA521}) (Version: 1.0.0005.00 - Lenovo)
Lenovo Welcome (HKLM-x32\...\Lenovo Welcome_is1) (Version: 2.02.003.0 - Lenovo)
Malwarebytes Anti-Malware Version 2.0.2.1012 (HKLM-x32\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.2.1012 - Malwarebytes Corporation)
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Message Center Plus (HKLM-x32\...\{FD331A3B-F7A5-4C31-B8D4-DF413C85AF7A}) (Version: 2.0.0012.00 - Lenovo Group Limited)
Metric Collection SDK (x32 Version: 1.1.0005.00 - Lenovo Group Limited) Hidden
Microsoft .NET Framework 4.5.1 (DEU) (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Version: 4.5.50938 - Microsoft Corporation) Hidden
Microsoft Application Error Reporting (Version: 12.0.6015.5000 - Microsoft Corporation) Hidden
Microsoft Office 2010 (HKLM-x32\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Office Access MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Excel MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Groove MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office InfoPath MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Office 64-bit Components 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office OneNote MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Outlook MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office PowerPoint MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Professional Plus 2010 (HKLM-x32\...\Office14.PROPLUSR) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Office Professional Plus 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (English) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (French) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proof (Italian) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Proofing (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Publisher MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared 64-bit MUI (German) 2010 (Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Shared MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Office Word MUI (German) 2010 (x32 Version: 14.0.7015.1000 - Microsoft Corporation) Hidden
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{6E8E85E8-CE4B-4FF5-91F7-04999C9FAE6A}) (Version: 8.0.50727.42 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.30319 (HKLM\...\{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}) (Version: 10.0.30319 - Microsoft Corporation)
Mobile Broadband Drivers (HKLM-x32\...\{EA9640BE-414E-4195-B53B-7905BF1A5A09}) (Version: 6.5.1.5 - Ericsson AB)
Mozilla Firefox 32.0.3 (x86 de) (HKLM-x32\...\Mozilla Firefox 32.0.3 (x86 de)) (Version: 32.0.3 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 30.0 - Mozilla)
MSVCRT (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSVCRT_amd64 (x32 Version: 15.4.2862.0708 - Microsoft) Hidden
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA 3D Vision Treiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision) (Version: 312.69 - NVIDIA Corporation)
NVIDIA Grafiktreiber 312.69 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver) (Version: 312.69 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.24.2 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.24.2 - NVIDIA Corporation)
NVIDIA Install Application (Version: 2.1002.124.810 - NVIDIA Corporation) Hidden
NVIDIA Optimus 1.11.3 (Version: 1.11.3 - NVIDIA Corporation) Hidden
NVIDIA Stereoscopic 3D Driver (x32 Version: 7.17.13.1269 - NVIDIA Corporation) Hidden
NVIDIA Systemsteuerung 312.69 (Version: 312.69 - NVIDIA Corporation) Hidden
NVIDIA Update Components (Version: 1.11.3 - NVIDIA Corporation) Hidden
PANTONE Color Calibrator 1.0 (HKLM-x32\...\PANTONE Color Calibrator_is1) (Version:  - X-Rite)
PDF Architect 2 (HKLM-x32\...\PDF Architect 2) (Version: 2.0.24.16092 - pdfforge GmbH)
PDF Architect 2 View Module (HKLM-x32\...\{C960FF38-431D-429D-AD1F-FBD12A45B7C5}) (Version: 2.0.17.17583 - pdfforge GmbH)
PDF24 Creator 6.7.0 (HKLM-x32\...\{81A6F461-0DBA-4F12-B56F-0E977EC10576}_is1) (Version:  - PDF24.org)
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.7.3 - pdfforge)
Registry Patch to Enable Maximum Power Saving on WiFi Adapters for Windows 7 (HKLM\...\EnablePS) (Version: 1.00 - )
Renesas Electronics USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{5442DAB8-7177-49E1-8B22-09A049EA5996}) (Version: 2.1.36.0 - Renesas Electronics Corporation)
Renesas Electronics USB 3.0 Host Controller Driver (x32 Version: 2.1.36.0 - Renesas Electronics Corporation) Hidden
RICOH Media Driver v2.10.18.02 (HKLM-x32\...\{FE041B02-234C-4AAA-9511-80DF6482A458}) (Version: 2.10.18.02 - RICOH)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (x32 Version:  - Microsoft) Hidden
System Requirements Lab (HKLM-x32\...\SystemRequirementsLab) (Version:  - )
ThinkPad Bluetooth with Enhanced Data Rate Software (HKLM\...\{C6C9D5F7-630C-4125-8C4E-94AF77C1896E}) (Version: 6.4.0.1500 - Broadcom Corporation)
ThinkPad Energie-Manager (HKLM-x32\...\{DAC01CEE-5BAE-42D5-81FC-B687E84E8405}) (Version: 3.62 - )
ThinkPad FullScreen Magnifier (HKLM\...\ThinkPad FullScreen Magnifier) (Version: 2.40 - )
ThinkPad Modem Adapter (HKLM\...\CNXT_MODEM_HDA_HSF) (Version: 7.80.5.0 - Conexant Systems)
ThinkPad UltraNav Driver (HKLM\...\SynTPDeinstKey) (Version: 16.2.19.7 - )
ThinkVantage Access Connections (HKLM-x32\...\{8E537894-A559-4D60-B3CB-F4485E3D24E3}) (Version: 6.21 - Lenovo)
ThinkVantage AutoLock (HKLM\...\{E224B44B-B5EB-4af3-A80A-A255358E241A}_is1) (Version: 1.04 - Lenovo)
ThinkVantage Communications Utility (HKLM\...\{88C6A6D9-324C-46E8-BA87-563D14021442}_is1) (Version: 2.07 - Lenovo)
ThinkVantage Fingerprint Software (HKLM\...\{F58DA859-016E-492D-A588-317D9BB28002}) (Version: 5.9.9.7282 - Authentec Inc.)
ThinkVantage GPS (HKLM-x32\...\{6DB21B2C-2BEF-44B4-B264-8EC2BC2369C6}) (Version: 2.80 - Lenovo)
ThinkVantage System für aktiven Festplattenschutz (HKLM\...\{46A84694-59EC-48F0-964C-7E76E9F8A2ED}) (Version: 1.79.00.03 - Lenovo)
Update for Microsoft Access 2010 (KB2553446) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B4A38370-2ADB-46B0-A1B0-0C4A2F7DCA31}) (Version:  - Microsoft)
Update for Microsoft Excel 2010 (KB2889836) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9179FC17-97A8-4D98-9E09-05720AF5D44E}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft Filter Pack 2.0 (KB2878281) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{302A8FE3-EBF5-486C-A431-16A1CD914443}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817369) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{4EEA3D3E-989C-4DF4-AB0A-3042C0C12AA3}) (Version:  - Microsoft)
Update for Microsoft InfoPath 2010 (KB2817396) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{39767ECA-1731-45DB-AB5B-6BF40E151D66}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589298) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{DADF7E25-FFA4-4D02-BE84-1DAE62C18516}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589352) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F4284D93-7AE8-4309-8CF3-9AD394F35F3A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2589375) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{287A1E92-9E41-4BC1-8920-B3D0E9220800}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2597087) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{9D69691D-823D-4C3E-9B12-563A3F520366}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2687502) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0409-0000-0000000FF1CE}_Office14.PROPLUSR_{7DE7DF97-82FE-4B3A-AB8D-1621F9CC464A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2760598) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{ECFE33A3-B8B7-439A-ADE4-59FBD29EF9B8}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2794737) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{5AA578BB-759C-40FD-9661-A737C0884541}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825635) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F1A20C69-9FE5-40FD-9CD5-84EABC2EF64A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2825640) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{BA610006-2C39-4419-9834-CF61AB24810A}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837581) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{334FB202-28D7-4BA4-8BC9-4FE4AB233EA0}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2837606) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0D672F7-883E-4279-8E75-D97A5445AB46}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2878252) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B0DB9F71-E0F7-4FE6-8925-35B860CAC0C4}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{EAD7BEF9-B28C-425F-B2C5-538CB27EF013}) (Version:  - Microsoft)
Update for Microsoft Office 2010 (KB2881028) 32-Bit Edition (HKLM-x32\...\{90140000-001F-040C-0000-0000000FF1CE}_Office14.PROPLUSR_{089DBFD7-8211-43B2-AAAE-5BDD8C23E3A8}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft OneNote 2010 (KB2837595) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{51CCA922-A0CC-47C4-8910-6936D97CAC2E}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{90140000-001A-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{A0657506-69DC-44AE-8DC1-58E7C6F5B1C9}) (Version:  - Microsoft)
Update for Microsoft Outlook 2010 (KB2687567) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2AB483F1-C86E-427A-83B4-23889B03512D}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{90140000-0018-0407-0000-0000000FF1CE}_Office14.PROPLUSR_{40EC8FB1-5202-469D-9232-C28FB1C6FC64}) (Version:  - Microsoft)
Update for Microsoft PowerPoint 2010 (KB2837579) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{2BA40F82-F3A4-441C-BF1A-ED4C42FF4872}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{90140000-002A-0000-1000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft SharePoint Workspace 2010 (KB2760601) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{F9F5A080-AF38-4966-9A6B-C43DCA465035}) (Version:  - Microsoft)
Update for Microsoft Visio 2010 (KB2880526) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{7B29D8B8-6A87-496C-A65E-B935E740448A}) (Version:  - Microsoft)
Update for Microsoft Visio Viewer 2010 (KB2837587) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{38CF30E4-3348-4BD1-A859-B630C355A56F}) (Version:  - Microsoft)
Update for Microsoft Word 2010 (KB2880529) 32-Bit Edition (HKLM-x32\...\{91140000-0011-0000-0000-0000000FF1CE}_Office14.PROPLUSR_{B9B89E01-5B6B-4F73-BC34-B2C0D8ACB4CD}) (Version:  - Microsoft)
Windows Live Communications Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3508.1109 - Microsoft Corporation)
Windows Live Essentials (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Fotogalerie (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live ID Sign-in Assistant (Version: 7.250.4225.0 - Microsoft Corporation) Hidden
Windows Live Installer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Language Selector (Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Mail (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Messenger (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live MIME IFilter (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Movie Maker (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Common (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Photo Gallery (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live PIMT Platform (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Remote Client (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Client Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live Remote Service Resources (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Windows Live SOXE (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live SOXE Definitions (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live UX Platform Language Pack (x32 Version: 15.4.3508.1109 - Microsoft Corporation) Hidden
Windows Live Writer (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows Live Writer Resources (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Windows-Treiberpaket - Intel (e1cexpress) Net  (12/21/2010 11.8.84.0) (HKLM\...\6D23A494E9A245843FB8584D9307D3E328DF8613) (Version: 12/21/2010 11.8.84.0 - Intel)
Windows-Treiberpaket - Intel (MEIx64) System  (10/19/2010 7.0.0.1144) (HKLM\...\90FD26A77B849AE03FF5F07A1CDA7F950406A8D8) (Version: 10/19/2010 7.0.0.1144 - Intel)
Windows-Treiberpaket - Intel System  (09/10/2010 9.2.0.1011) (HKLM\...\0CDBDD444A1F5FFEA227B4E7DCE195F11F08240A) (Version: 09/10/2010 9.2.0.1011 - Intel)
Windows-Treiberpaket - Intel System  (09/10/2010 9.2.0.1011) (HKLM\...\A513FC5E5A08D4EF27F234E91E0E942A0234210B) (Version: 09/10/2010 9.2.0.1011 - Intel)
Windows-Treiberpaket - Intel System  (10/04/2010 9.2.0.1015) (HKLM\...\FE1BEBFD475BB832AAF104F5C63348E98A9286DF) (Version: 10/04/2010 9.2.0.1015 - Intel)
Windows-Treiberpaket - Intel USB  (09/16/2010 9.2.0.1013) (HKLM\...\D97688B8E3830BF9820E15EB8D9552DCBF988CFD) (Version: 09/16/2010 9.2.0.1013 - Intel)
Windows-Treiberpaket - Lenovo 1.61.00.11 (11/11/2010 1.61.00.11) (HKLM\...\466E9B20D871055D6D3CDA2CDD1D355E978A61AF) (Version: 11/11/2010 1.61.00.11 - Lenovo)
Windows-Treiberpaket - Synaptics (SynTP) Mouse  (02/17/2011 15.2.14.0) (HKLM\...\77A943AB876C131591E0EA5DB6AB08D89EE2EA9E) (Version: 02/17/2011 15.2.14.0 - Synaptics)
X-Rite Device i1Display Service (HKLM-x32\...\{D2A53206-6A9E-4241-B21C-D94140EEF1CE}_is1) (Version: 1.0 - X-Rite Inc.)
X-Rite Device Manager (HKLM-x32\...\{9ACEA9CD-63B9-4784-807B-EA295E96A7C3}_is1) (Version: 1.0 - X-Rite Inc.)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

03-10-2014 19:57:50 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2014-10-02 22:24 - 00000027 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {1B4ECB35-36E2-436D-9F92-6E77BA54A061} - System32\Tasks\Lenovo\Lenovo Customer Feedback Program 64 => C:\Program Files (x86)\Lenovo\Customer Feedback Program\Lenovo.TVT.CustomerFeedback.Agent.exe [2014-02-13] (Lenovo)
Task: {2250233B-A91F-453F-9969-928AA4A2F096} - System32\Tasks\PCDoctorBackgroundMonitorTask-Delay => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {228BCBEF-4341-4187-A897-495238E406F7} - System32\Tasks\PCDEventLauncher => C:\Program Files\PC-Doctor\sessionchecker.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {474F18C8-A337-433A-AE5E-44A4DD1545D3} - System32\Tasks\PCDoctorBackgroundMonitorTask => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {578223BE-BB63-4563-8BFD-5D5108542391} - System32\Tasks\TVT\LenovoWERMonitor => C:\Program Files (x86)\Common Files\lenovo\SUP\sup_wermonitor.exe [2014-05-27] (Lenovo)
Task: {69033D1C-86B9-46A6-BCC6-E7364DD84646} - System32\Tasks\MCP => C:\Program Files (x86)\LENOVO\Message Center Plus\MCPLaunch.exe [2009-05-27] ()
Task: {94E4E220-421A-4B2F-9FA5-0C6731235738} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2014-09-21] (Adobe Systems Incorporated)
Task: {B40C9D21-6759-4886-B553-CC3BC215678A} - System32\Tasks\SystemToolsDailyTest => C:\Program Files\PC-Doctor\uaclauncher.exe [2011-06-27] (PC-Doctor, Inc.)
Task: {BF9A603C-8A54-44D3-9E8F-C78BE2749BCE} - System32\Tasks\Lenovo\SROptimizer => %TRPATH%\SRORest.exe
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask-Delay.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\PCDoctorBackgroundMonitorTask.job => C:\Program Files\PC-Doctor\uaclauncher.exe
Task: C:\Windows\Tasks\SystemToolsDailyTest.job => C:\Program Files\PC-Doctor\uaclauncher.exe

==================== Loaded Modules (whitelisted) =============

2014-06-17 21:11 - 2013-10-29 02:53 - 00087328 _____ () C:\Program Files\NVIDIA Corporation\Display\NvSmartMax64.dll
2011-05-02 13:41 - 2011-05-02 13:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\Libeay32.dll
2013-09-05 00:17 - 2013-09-05 00:17 - 04300456 _____ () C:\Program Files\Common Files\Microsoft Shared\OFFICE14\Cultures\OFFICE.ODF
2011-05-24 09:36 - 2011-07-04 03:02 - 00055296 ____N () C:\Program Files (x86)\ThinkPad\Utilities\GR\PWMRT64V.DLL
2011-05-24 09:32 - 2010-10-26 10:40 - 00049056 ____N () C:\Program Files\CONEXANT\ForteConfig\fmapp.exe
2011-05-02 13:41 - 2011-05-02 13:41 - 01501696 _____ () C:\Program Files\Common Files\Intel\WirelessCommon\LIBEAY32.dll
2011-05-24 09:33 - 2011-03-06 13:07 - 00094208 _____ () C:\Windows\System32\IccLibDll_x64.dll
2010-12-18 15:50 - 2010-12-18 15:50 - 00173856 _____ () C:\Program Files\ThinkPad\Bluetooth Software\btkeyind.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 10383872 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\Color Calibrator Tray.exe
2014-03-14 17:47 - 2014-03-14 17:47 - 00092504 _____ () C:\Program Files (x86)\Lenovo\Access Connections\AcWrpc.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00139056 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.NativeCore.dll
2014-08-27 15:00 - 2014-08-27 15:00 - 00066864 _____ () C:\Program Files (x86)\Avira\My Avira\Avira.OE.AvConnectorNative.dll
2011-09-23 20:10 - 2011-06-29 18:09 - 02085888 _____ () C:\Program Files\Lenovo\AutoLock\cv210.dll
2011-09-23 20:10 - 2011-06-29 18:09 - 02201088 _____ () C:\Program Files\Lenovo\AutoLock\cxcore210.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 00898560 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\libxml2.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 00073728 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\zlib1.dll
2011-05-24 09:38 - 2010-12-15 22:53 - 03449344 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\CxF2_VC90MD_2.1.dll
2011-05-24 09:38 - 2010-12-15 22:54 - 07390720 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtGui4.dll
2011-05-24 09:38 - 2010-12-15 22:54 - 02012160 _____ () C:\Program Files (x86)\X-Rite\PANTONE Color Calibrator\QtCore4.dll
2014-10-02 22:53 - 2014-08-27 15:00 - 00052472 _____ () C:\Users\Admin\AppData\Local\Temp\avgnt.exe\Avira.OE.ExtApi.dll
2011-05-24 09:32 - 2011-05-26 17:17 - 00065576 ____R () C:\Program Files (x86)\Mobile Broadband drivers\WMCore\MBMDebug.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\Users\y\Desktop\MagicLauncher_1.2.5.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\audacity-win-2.0.5.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\blender-2.69-windows64.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\ChromeSetup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\Citavi4Setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\install_flashplayer13x32au_mssd_aaa_aih.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\install_flashplayer14x32au_mssd_aaa_aih.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\jdk-8u5-windows-x64.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\jre-8u5-windows-i586-iftw.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\KiesSetup_2.6.1.13105_7.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\liteloader-installer-1.7.2-04.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\MP3SkypeRecorder31Setup(1).exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\MP3SkypeRecorder31Setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\NCInst64_7.4.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\nitro_pdf_reader3565_64_dlm.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\PDFCreator-1_7_2_setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\povwin-3.7-agpl3-setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\PSI9015Setup.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\Thunderbird Setup 24.3.0.exe:BDU
AlternateDataStreams: C:\Users\y\Downloads\v3dSetup.exe:BDU

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) =============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== MSCONFIG/TASK MANAGER disabled items =========

(Currently there is no automatic fix for this section.)


========================= Accounts: ==========================

Admin (S-1-5-21-3141125159-651349833-1633251973-1006 - Administrator - Enabled) => C:\Users\Admin
Administrator (S-1-5-21-3141125159-651349833-1633251973-500 - Administrator - Disabled)
Gast (S-1-5-21-3141125159-651349833-1633251973-501 - Limited - Enabled) => C:\Users\Gast
HomeGroupUser$ (S-1-5-21-3141125159-651349833-1633251973-1008 - Limited - Enabled)
tvsu_tmp_onjimBYVYD (S-1-5-21-3141125159-651349833-1633251973-1010 - Administrator - Enabled)
UpdatusUser (S-1-5-21-3141125159-651349833-1633251973-1000 - Limited - Enabled) => C:\Users\UpdatusUser
y (S-1-5-21-3141125159-651349833-1633251973-1009 - Limited - Enabled) => C:\Users\y

==================== Faulty Device Manager Devices =============

Name: SMI Helper Driver (smihlp)
Description: SMI Helper Driver (smihlp)
Class Guid: {8ECC055D-047F-11D1-A537-0000F8753ED1}
Manufacturer: 
Service: smihlp
Problem: : This device is not present, is not working properly, or does not have all its drivers installed. (Code 24)
Resolution: The device is installed incorrectly. The problem could be a hardware failure, or a new driver might be needed.
Devices stay in this state if they have been prepared for removal.
After you remove the device, this error disappears.Remove the device, and this error should be resolved.


==================== Event log errors: =========================

Application errors:
==================
Error: (10/04/2014 03:39:35 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


System errors:
=============
Error: (10/04/2014 03:42:48 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "NVIDIA Update Service Daemon" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%1069

Error: (10/04/2014 03:42:48 AM) (Source: Service Control Manager) (EventID: 7038) (User: )
Description: Der Dienst "nvUpdatusService" konnte sich nicht als ".\UpdatusUser" mit dem aktuellen Kennwort aufgrund des folgenden Fehlers anmelden: 
%%1330

Vergewissern Sie sich, dass der Dienst richtig konfiguriert ist im Dienste-Snap-In in der Microsoft Management Console (MMC).

Error: (10/04/2014 03:39:05 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "SMI Helper Driver (smihlp)" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (10/04/2014 00:14:02 AM) (Source: DCOM) (EventID: 10010) (User: )
Description: {995C996E-D918-4A8C-A302-45719A6F4EA7}


Microsoft Office Sessions:
=========================
Error: (10/04/2014 03:39:35 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003


CodeIntegrity Errors:
===================================
  Date: 2014-10-02 22:23:38.801
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2014-10-02 22:23:38.754
  Description: Windows konnte die Abbildintegrität der Datei "\Device\HarddiskVolume2\ComboFix\catchme.sys" nicht überprüfen, weil der Dateihash nicht im System gefunden wurde. Möglicherweise wurde durch eine kürzlich durchgeführte Hardware- oder Softwareänderung eine falsch signierte oder beschädigte Datei oder eine Datei, bei der es sich um schädliche Software aus einer unbekannten Quelle handelt, installiert.

  Date: 2011-06-26 13:11:21.363
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:21.303
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:21.243
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:21.063
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.953
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.803
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.713
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2011-06-26 13:11:20.653
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume2\Windows\System32\cryptnet.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7-2820QM CPU @ 2.30GHz
Percentage of memory in use: 24%
Total physical RAM: 8075.23 MB
Available physical RAM: 6114.91 MB
Total Pagefile: 16148.65 MB
Available Pagefile: 14071.01 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive c: (Windows7_OS) (Fixed) (Total:674.01 GB) (Free:417.69 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive q: (Lenovo_Recovery) (Fixed) (Total:23.46 GB) (Free:14.01 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 698.6 GB) (Disk ID: C42CD616)
Partition 1: (Active) - (Size=1.2 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=674 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=23.5 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         

Alt 04.10.2014, 12:10   #15
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Standard

Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter



Okay, dann Kontrollscans mit MBAM und ESET bitte:

Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Antwort

Themen zu Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter
browser, explorer, fehlercode 0x5, fehlercode 24, firewall, flash player, herunterfahren, hängen, iexplore.exe, keine rückmeldung, programm, pwmtr64v.dll, services.exe, software, svchost.exe, tr/crypt.xpack.gen, tr/crypt.xpack.gen5, trojaner, win32/installmonetizer.aq, win32/softonicdownloader.a, win32/toolbar.conduit, win32/toolbar.conduit.ai, windows 7, winlogon.exe



Ähnliche Themen: Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter


  1. Cursor wechselt unnötig Status, Windows fährt nicht herunter
    Plagegeister aller Art und deren Bekämpfung - 22.10.2015 (7)
  2. Laptop fährt nicht mehr herunter und führt sich selbst wieder aus
    Alles rund um Windows - 16.03.2015 (43)
  3. PC öffnet keine anwendungen mehr im explorer, fährt nicht herunter und 16-Bit Problem
    Plagegeister aller Art und deren Bekämpfung - 27.11.2014 (9)
  4. Windows 7: PC fährt bei drücken der Windows- und Entfernen-Taste herunter.
    Log-Analyse und Auswertung - 22.11.2014 (3)
  5. Windows 7 Minianwendungen fehlerhaft und PC fährt nicht richtig herunter
    Plagegeister aller Art und deren Bekämpfung - 29.12.2013 (21)
  6. AntiVir hat folgede Viren gefunden: TR/Crypt.ZPACK.Gen2' & 'TR/Crypt.XPACK.Gen5' [trojan
    Plagegeister aller Art und deren Bekämpfung - 26.09.2012 (33)
  7. TR/Crypt.XPACK.Gen5
    Plagegeister aller Art und deren Bekämpfung - 01.08.2012 (9)
  8. Tr.Crypt.XPACK.Gen5 / Tr.Rogue.kdv
    Plagegeister aller Art und deren Bekämpfung - 03.07.2012 (4)
  9. TR/Crypt.XPACK.Gen5
    Log-Analyse und Auswertung - 23.05.2012 (5)
  10. crypt.xpack.gen5
    Plagegeister aller Art und deren Bekämpfung - 22.05.2012 (2)
  11. Trojaner TR/Crypt.XPACK.Gen5" gefunden C:\Windows\winsxs\Temp\PendingRenames
    Log-Analyse und Auswertung - 16.05.2012 (6)
  12. TR/Crypt.XPACK.Gen5, TR/Crypt.ZPACK.Gen2, TR/Fake.Rean.3394, TR/PSW.Fareit.A.64
    Plagegeister aller Art und deren Bekämpfung - 19.12.2011 (30)
  13. Windows fährt nach 1 Min herunter
    Alles rund um Windows - 08.08.2010 (6)
  14. Windows fährt nicht herunter
    Log-Analyse und Auswertung - 27.07.2009 (2)
  15. PC fährt nicht mehr herunter...
    Log-Analyse und Auswertung - 03.04.2009 (14)
  16. PC fährt selbst herunter und nicht mehr hoch
    Plagegeister aller Art und deren Bekämpfung - 03.03.2009 (1)
  17. Windows fährt nicht mehr herunter!
    Alles rund um Windows - 26.02.2008 (4)

Zum Thema Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter - Hallo liebe Helfer, hab eben Iconpacks für mein Handy heruntergeladen und mir eines mit Trojaner unterjubeln lassen. Avira hat gleich Alarm geschlagen und ihn in Quarantäne verschoben, habe dann trotzdem - Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter...
Archiv
Du betrachtest: Windows 7: TR/Crypt.XPACK.Gen5 & Windows fährt nicht mehr herunter auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.