Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 12.03.2015, 18:38   #1
funnsurfer
 
DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet - Standard

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet



Hallo,

ich habe gestern eine Mail von der DHL bekommen (scheinbar) und den Link der Sendungsverfolgung geklickt weil ich ein Paket erwarte und nicht auf die Absenderadresse (dasauge55@freenet) geachtet habe.
Es tat sich dann ein Fenster auf in dem ich eine ZIP Datei runterladen sollte. Da hab ich gecheckt was los ist und sofort abgebrochen. Email habe ich dann auch sofort getilgt. Nach ca. 10 minuten kamen plötzlich viele Fenster in der oberen Ecke des Firefox Explorers und waren in einer 1/10 Sekunde auch wieder weg. Ich konnte leider nicht erkennen was da drinn stand. Jetzt habe ich ein komisches Gefühl. Würde mich freuen, wenn sich jemand mal die Logs ansehen könnte

defogger_disable.log

Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 17:32 on 12/03/2015 (admin)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         
Addition.txt

Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 11-03-2015
Ran by admin at 2015-03-12 17:33:59
Running from C:\Users\admin\Downloads
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Acronis*Disk Director Suite (HKLM-x32\...\{2300EE96-0A41-4FAB-BD03-989EC44577A0}) (Version: 10.0.2160 - Acronis)
Acronis*True*Image*Home (HKLM-x32\...\{C2F1F96A-057E-5819-B52E-FEA1D1D2933B}) (Version: 13.0.5055 - Acronis)
Adobe AIR (HKLM-x32\...\Adobe AIR) (Version: 3.4.0.2710 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Photoshop Lightroom 4.4 64-bit (HKLM\...\{11A955CD-4398-405A-886D-E464C3618FBF}) (Version: 4.4.1 - Adobe)
Adobe Reader XI (11.0.10) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.10 - Adobe Systems Incorporated)
Akamai NetSession Interface (HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\...\Akamai) (Version:  - Akamai Technologies, Inc)
Allway Sync version 12.12.12 (HKLM-x32\...\Allway Sync_is1) (Version:  - Botkind Inc)
Amazon MP3-Downloader 1.0.17 (HKLM-x32\...\Amazon MP3-Downloader) (Version: 1.0.17 - Amazon Services LLC)
Antivirus Pro (HKLM-x32\...\Avira AntiVir Desktop) (Version: 15.0.8.644 - Avira)
BBSAK (HKLM-x32\...\{B23F12D4-17DE-453A-B1F4-55E501FE0EBF}) (Version: 1.9.2 - JMT Labs)
Beyond Compare 3.3.10 (HKLM-x32\...\BeyondCompare3_is1) (Version: 3.3.10.17762 - Scooter Software)
BlackBerry USB and Modem Drivers 7.0 (HKLM-x32\...\BlackBerry_HandheldManager) (Version: 7.0.0.43 - Research in Motion Ltd.)
BlackBerry USB and Modem Drivers 7.0 (x32 Version: 7.0.0.43 - Research in Motion Ltd.) Hidden
Bouquet Editor Suite v1.21 Uninstall (HKLM-x32\...\Bouquet Editor Suite_is1) (Version: 1.2.1.0 - )
Bouquet Wizard (HKLM-x32\...\BouquetWizard) (Version:  - )
Broadcom NetXtreme-I Netlink Driver and Management Installer (HKLM\...\{5569655A-9653-42CD-A599-5617DF767D2A}) (Version: 12.37.01 - Broadcom Corporation)
Canon IJ Network Scan Utility (HKLM-x32\...\Canon_IJ_Network_Scan_UTILITY) (Version:  - )
Canon IJ Network Tool (HKLM-x32\...\Canon_IJ_Network_UTILITY) (Version: 3.1.1 - Canon Inc.)
Canon MG5200 series MP Drivers (HKLM\...\{1199FAD5-9546-44f3-81CF-FFDB8040B7BF}_Canon_MG5200_series) (Version:  - Canon Inc.)
Canon MP Navigator EX 4.0 (HKLM-x32\...\MP Navigator EX 4.0) (Version:  - )
Canon My Printer (HKLM-x32\...\CanonMyPrinter) (Version: 3.0.0 - Canon Inc.)
Canon Utilities Digital Photo Professional 4 (HKLM-x32\...\Digital Photo Professional 4 (x64)) (Version: 4.0.0.1 - Canon Inc.)
Canon Utilities EOS Lens Registration Tool (HKLM-x32\...\EOS Lens Registration Tool) (Version: 1.0.0.7 - Canon Inc.)
Canon Utilities EOS Utility 2 (HKLM-x32\...\EOS Utility 2) (Version: 2.14.0.0 - Canon Inc.)
Canon Utilities EOS Utility 3 (HKLM-x32\...\EOS Utility 3) (Version: 3.0.0.0 - Canon Inc.)
Canon Utilities EOS Web Service Registration Tool (HKLM-x32\...\EOS Web Service Registration Tool) (Version: 1.0.0.7 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.23.47 - Canon Inc.)
Canon Utilities Picture Style Editor (HKLM-x32\...\Picture Style Editor) (Version: 1.12.2.0 - Canon Inc.)
CDBurnerXP (HKLM-x32\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.3.4746 - CDBurnerXP)
EOSInfo (HKLM-x32\...\{CC23FF9A-989C-4DEB-8970-50E6E4862315}) (Version: 0.2.0 - astrojargon.net)
EXIFeditor (HKLM-x32\...\{50FC1CE8-FF32-4F3B-B654-050DD6ECD474}) (Version: 1.0.0 - kiwi.software.NET)
Extended Asian Language font pack for Adobe Reader XI (HKLM-x32\...\{AC76BA86-7AD7-2530-0000-A00000000004}) (Version: 11.0.0 - Adobe Systems Incorporated)
FileZilla Client 3.6.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.6.0.2 - FileZilla Project)
FormatFactory 3.3.4.0 (HKLM-x32\...\FormatFactory) (Version: 3.3.4.0 - Format Factory)
Freemake Video Converter Version 4.1.3 (HKLM-x32\...\Freemake Video Converter_is1) (Version: 4.1.3 - Ellora Assets Corporation)
FreePDF (Remove only) (HKLM-x32\...\FreePDF_XP) (Version:  - )
FreeRIP 3.92 (HKLM-x32\...\{501451DE-5808-4599-B544-8BD0915B6B24}_is1) (Version: 3.92 - GreenTree Applications SRL)
GPL Ghostscript (HKLM\...\GPL Ghostscript 9.04) (Version: 9.04 - Artifex Software Inc.)
HashCalc 2.02 (HKLM-x32\...\HashCalc_is1) (Version:  - SlavaSoft Inc.)
Java 7 Update 67 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F03217067FF}) (Version: 7.0.670 - Oracle)
MetaEditor (HKLM-x32\...\{1D04B4D4-80C2-4F02-B5BE-3A5991FF6077}) (Version: 1.0.0 - kiwi.software.NET)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft Image Composite Editor (HKLM\...\{B821CDAA-34DE-46FD-87C9-E6EE7158DB5D}) (Version: 1.4.4 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM-x32\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM-x32\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM-x32\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Core Components (x64) ENU  (HKLM\...\{8CCBEC22-D2DB-4DC9-A58A-E1A1F3A38C8A}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Sync Framework 2.0 Provider Services (x64) ENU  (HKLM\...\{03AC245F-4C64-425C-89CF-7783C1D3AB2C}) (Version: 2.0.1578.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Motorola Device Manager (HKLM-x32\...\{28DB8373-C1BB-444F-A427-A55585A12ED7}) (Version: 2.4.5 - Motorola Mobility)
Motorola Device Software Update (x32 Version: 13.09.3001 - Motorola Mobility) Hidden
Motorola Mobile Drivers Installation 6.3.0 (HKLM\...\{759E6A2F-1F01-45EF-A0C4-22F1B56CB975}) (Version: 6.3.0 - Motorola Mobility LLC)
Mozilla Firefox 36.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 36.0.1 (x86 de)) (Version: 36.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 29.0 - Mozilla)
Mozilla Thunderbird 31.5.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.5.0 (x86 de)) (Version: 31.5.0 - Mozilla)
MSXML 4.0 SP3 Parser (HKLM-x32\...\{196467F1-C11F-4F76-858B-5812ADC83B94}) (Version: 4.30.2100.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2721691) (HKLM-x32\...\{355B5AC0-CEEE-42C5-AD4D-7F3CFD806C36}) (Version: 4.30.2114.0 - Microsoft Corporation)
MSXML 4.0 SP3 Parser (KB2758694) (HKLM-x32\...\{1D95BA90-F4F8-47EC-A882-441C99D30C1E}) (Version: 4.30.2117.0 - Microsoft Corporation)
MyPhoneExplorer (HKLM-x32\...\MPE) (Version: 1.8.4 - F.J. Wechselberger)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.4 - NVIDIA Corporation)
NVIDIA PhysX (HKLM-x32\...\{1C4551A6-4743-4093-91E4-1477CD655043}) (Version: 9.09.0203 - NVIDIA Corporation)
PhotoDose 4.5 (HKLM-x32\...\Photo Dose_is1) (Version:  - )
ProSafe Plus Utility (HKLM-x32\...\InstallShield_{AA42EDB4-A4F2-4386-A0BD-3CF8C3B71BF2}) (Version: 2.2.24 - Ihr Firmenname)
ProSafe Plus Utility (x32 Version: 2.2.24 - Ihr Firmenname) Hidden
QNAP Finder (HKLM-x32\...\QNAP_FINDER) (Version: 3.6.5.1030 - QNAP Systems, Inc.)
QNAP Surveillance Station (HKLM-x32\...\QNAPSurveillanceStation) (Version:  - )
RedMon - Redirection Port Monitor (HKLM\...\Redirection Port Monitor) (Version:  - )
SADP (HKLM-x32\...\{7D9B79C2-B1B2-433B-844F-F4299B86F26E}) (Version: 2.2.1.100 - company)
SNC toolbox (HKLM-x32\...\{A970B0EC-71B1-4225-8E27-CB895C7FBD30}) (Version: 1.30.7036 - Sony Corporation)
SNC viewer (HKLM-x32\...\{79542249-CB2E-4B39-AC3D-383F810F0E29}) (Version: 1.0.0.14 - Sony Corporation)
Spyder2express (HKLM-x32\...\Spyder2express) (Version:  - )
SurveillancePlugin (HKLM-x32\...\{970AE435-8AAE-4F5E-A754-880DAC8968C5}) (Version: 1.0.0.565 - Synology)
SyncToy 2.1 (x64) (HKLM\...\{88DAAF05-5A72-46D2-A7C5-C3759697E943}) (Version: 2.1.0 - Microsoft)
Synology Assistant (remove only) (HKLM-x32\...\Synology Assistant) (Version:  - )
Update for 2007 Microsoft Office System (KB967642) (HKLM-x32\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM-x32\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM-x32\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM-x32\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM-x32\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
VirtualCloneDrive (HKLM-x32\...\VirtualCloneDrive) (Version:  - Elaborate Bytes)
VLC media player 2.0.5 (HKLM\...\VLC media player) (Version: 2.0.5 - VideoLAN)
VmciSockets (Version: 9.1.54.1 - VMware, Inc.) Hidden
VMware Workstation (HKLM-x32\...\VMware_Workstation) (Version: 8.0.1.27038 - VMware, Inc)
VMware Workstation (x32 Version: 8.0.1.27038 - VMware, Inc.) Hidden
Web Components (HKLM-x32\...\{03B13AF8-9625-478A-AF0E-205337B9415A}_is1) (Version:  - )
Win32DiskImager version 0.9.5 (HKLM-x32\...\{D074CE74-912A-4AD3-A0BF-3937D9D01F17}_is1) (Version: 0.9.5 - ImageWriter Developers)
WinPcap 4.1.2 (HKLM-x32\...\WinPcapInst) (Version: 4.1.0.2001 - CACE Technologies)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WISO Steuer-Sparbuch 2013 (HKLM-x32\...\{D6CC2FAF-F827-4091-96A1-D32CC9B69C79}) (Version: 20.00.8137 - Buhl Data Service GmbH)
ZoneAlarm LTD Toolbar (HKLM\...\ZoneAlarm LTD Toolbar) (Version:  - Check Point Software Technologies)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)


==================== Restore Points  =========================

08-02-2015 15:05:31 Geplanter Prüfpunkt
11-02-2015 14:06:33 Windows Update
12-02-2015 16:14:31 Windows Update
13-02-2015 19:24:11 Installed SurveillancePlugin
21-02-2015 19:11:26 Geplanter Prüfpunkt
26-02-2015 19:15:01 Windows Update
06-03-2015 15:53:49 Geplanter Prüfpunkt
11-03-2015 21:05:14 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 03:34 - 2009-06-10 22:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {5846D20D-276B-4814-A4E3-95DC068DE0AB} - System32\Tasks\{615E797A-7A28-44D2-8AC1-7F51012CBCCA} => pcalua.exe -a C:\Users\admin\Downloads\Spyder2_Driver_Setup_1.1.10.exe -d C:\Users\admin\Downloads
Task: {5D388854-79AB-420F-A45D-9EA5688F40F6} - System32\Tasks\Motorola Device Manager Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {C61895FC-72C6-4CCE-B31A-03BB689D9463} - System32\Tasks\Motorola Device Manager Engine => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()
Task: {CF13B033-7D8E-48CE-B784-33894C011363} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {D0FC7936-08D3-41D4-81A5-E4BAF98964C7} - System32\Tasks\Motorola Device Manager Initial Update => C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotorolaDeviceManagerUpdate.exe [2013-10-31] ()

==================== Loaded Modules (whitelisted) ==============

2013-01-21 18:11 - 2010-06-17 21:56 - 00087040 _____ () C:\Windows\System32\redmonnt.dll
2013-01-05 10:11 - 2012-12-26 15:39 - 00182784 _____ () C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe
2014-02-25 02:28 - 2014-02-25 02:28 - 00248736 _____ () C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
2010-01-02 15:42 - 2010-01-02 15:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2013-01-05 10:11 - 2012-12-26 15:39 - 00088064 _____ () C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe
2015-03-12 17:30 - 2015-03-12 17:30 - 00050477 _____ () C:\Users\admin\Downloads\Defogger.exe
2013-10-31 16:05 - 2013-10-31 16:05 - 00172032 _____ () C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\css_core.dll
2011-11-13 22:43 - 2011-11-13 22:43 - 01222656 _____ () C:\Program Files (x86)\VMware\VMware Workstation\libxml2.dll
2013-01-05 10:11 - 2012-12-26 15:39 - 08066560 _____ () C:\Program Files (x86)\Allway Sync\Bin\syncapp.dll
2015-02-26 14:13 - 2015-02-26 14:13 - 03348080 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2015-02-26 14:13 - 2015-02-26 14:13 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-02-26 14:13 - 2015-02-26 14:13 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\admin\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.10.189 - 192.168.10.239

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

admin (S-1-5-21-1907938336-2175037879-4224917378-1000 - Administrator - Enabled) => C:\Users\admin
Administrator (S-1-5-21-1907938336-2175037879-4224917378-500 - Administrator - Disabled)
Gast (S-1-5-21-1907938336-2175037879-4224917378-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: 
Description: 
Class Guid: 
Manufacturer: 
Service: 
Problem: : The drivers for this device are not installed. (Code 28)
Resolution: To install the drivers for this device, click "Update Driver", which starts the Hardware Update wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (02/15/2015 03:01:06 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: SurveillancePlugin.exe, Version: 0.0.0.0, Zeitstempel: 0x54c91102
Name des fehlerhaften Moduls: QTPlayerLib.dll, Version: 0.0.0.0, Zeitstempel: 0x54c910ab
Ausnahmecode: 0xc0000005
Fehleroffset: 0x000548b1
ID des fehlerhaften Prozesses: 0x1030
Startzeit der fehlerhaften Anwendung: 0xSurveillancePlugin.exe0
Pfad der fehlerhaften Anwendung: SurveillancePlugin.exe1
Pfad des fehlerhaften Moduls: SurveillancePlugin.exe2
Berichtskennung: SurveillancePlugin.exe3

Error: (02/14/2015 11:17:36 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MotoHelperService.exe, Version: 2.3.8.0, Zeitstempel: 0x52862eb0
Name des fehlerhaften Moduls: MotoHelperService.exe, Version: 2.3.8.0, Zeitstempel: 0x52862eb0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00010612
ID des fehlerhaften Prozesses: 0x8f8
Startzeit der fehlerhaften Anwendung: 0xMotoHelperService.exe0
Pfad der fehlerhaften Anwendung: MotoHelperService.exe1
Pfad des fehlerhaften Moduls: MotoHelperService.exe2
Berichtskennung: MotoHelperService.exe3

Error: (02/06/2015 07:54:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MotoHelperService.exe, Version: 2.3.8.0, Zeitstempel: 0x52862eb0
Name des fehlerhaften Moduls: MotoHelperService.exe, Version: 2.3.8.0, Zeitstempel: 0x52862eb0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00010612
ID des fehlerhaften Prozesses: 0x8d4
Startzeit der fehlerhaften Anwendung: 0xMotoHelperService.exe0
Pfad der fehlerhaften Anwendung: MotoHelperService.exe1
Pfad des fehlerhaften Moduls: MotoHelperService.exe2
Berichtskennung: MotoHelperService.exe3

Error: (02/01/2015 11:31:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: MotoHelperService.exe, Version: 2.3.8.0, Zeitstempel: 0x52862eb0
Name des fehlerhaften Moduls: MotoHelperService.exe, Version: 2.3.8.0, Zeitstempel: 0x52862eb0
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00010612
ID des fehlerhaften Prozesses: 0x8a0
Startzeit der fehlerhaften Anwendung: 0xMotoHelperService.exe0
Pfad der fehlerhaften Anwendung: MotoHelperService.exe1
Pfad des fehlerhaften Moduls: MotoHelperService.exe2
Berichtskennung: MotoHelperService.exe3

Error: (01/17/2015 11:25:05 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x17d8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/17/2015 11:25:02 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x132c
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/13/2015 07:21:30 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0xdf8
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/08/2015 09:43:27 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x12fc
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (01/08/2015 09:43:22 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: plugin-container.exe, Version: 34.0.5.5443, Zeitstempel: 0x5475dd5d
Name des fehlerhaften Moduls: mozalloc.dll, Version: 34.0.5.5443, Zeitstempel: 0x5475d664
Ausnahmecode: 0x80000003
Fehleroffset: 0x00001425
ID des fehlerhaften Prozesses: 0x12ac
Startzeit der fehlerhaften Anwendung: 0xplugin-container.exe0
Pfad der fehlerhaften Anwendung: plugin-container.exe1
Pfad des fehlerhaften Moduls: plugin-container.exe2
Berichtskennung: plugin-container.exe3

Error: (12/31/2014 05:09:40 PM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm syncappw.exe, Version 12.12.12.0 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: cb4

Startzeit: 01d0250fc9848bd4

Endzeit: 1

Anwendungspfad: C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe

Berichts-ID: 6ae06ba4-9107-11e4-97b7-005056c00008


System errors:
=============
Error: (03/12/2015 05:27:59 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/11/2015 06:19:24 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/10/2015 05:36:50 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/10/2015 05:24:13 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/09/2015 06:48:23 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/08/2015 06:40:49 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/08/2015 08:17:49 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/07/2015 04:02:33 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/07/2015 08:49:45 AM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.

Error: (03/06/2015 03:26:03 PM) (Source: Service Control Manager) (EventID: 7024) (User: )
Description: Der Dienst "VMware Workstation Server" wurde mit folgendem dienstspezifischem Fehler beendet: %%-1.


Microsoft Office Sessions:
=========================

CodeIntegrity Errors:
===================================
  Date: 2013-04-01 22:32:15.429
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 22:20:38.510
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 21:45:52.890
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 21:26:29.618
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 19:26:00.379
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 18:37:41.609
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 18:22:57.522
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 18:15:21.671
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 17:54:51.354
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.

  Date: 2013-04-01 17:46:00.704
  Description: Die Abbildintegrität der Datei "\Device\HarddiskVolume1\Program Files\CheckPoint\ZAForceField\Plugins\ISWSHEX.dll" konnte nicht überprüft werden, da der Satz seitenbezogener Abbildhashes auf dem System nicht gefunden wurde.


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i7 CPU 860 @ 2.80GHz
Percentage of memory in use: 20%
Total physical RAM: 16343.08 MB
Available physical RAM: 12966.98 MB
Total Pagefile: 32684.34 MB
Available Pagefile: 29392.07 MB
Total Virtual: 8192 MB
Available Virtual: 8191.84 MB

==================== Drives ================================

Drive a: (Laufwerk_A) (Network) (Total:1829.35 GB) (Free:1801.06 GB) NTFS
Drive b: () (Fixed) (Total:1863.01 GB) (Free:1688.67 GB) NTFS
Drive c: () (Fixed) (Total:400.03 GB) (Free:296.93 GB) NTFS ==>[System with boot components (obtained from reading drive)]
Drive d: (CD) (CDROM) (Total:0.31 GB) (Free:0 GB) CDFS
Drive e: () (Fixed) (Total:531.49 GB) (Free:77.96 GB) NTFS
Drive f: (Laufwerk_F) (Network) (Total:1846.88 GB) (Free:1059.32 GB) NTFS
Drive g: (Laufwerk_G) (Network) (Total:260 GB) (Free:181.63 GB) NTFS
Drive n: (Download) (Network) (Total:1829.35 GB) (Free:1801.06 GB) NTFS
Drive p: (Laufwerk_P) (Network) (Total:1496.95 GB) (Free:1059.32 GB) NTFS
Drive r: (Laufwerk_F_Backup) (Network) (Total:913.49 GB) (Free:33.03 GB) NTFS
Drive s: () (Fixed) (Total:280.66 GB) (Free:254.61 GB) NTFS
Drive u: () (Fixed) (Total:650.85 GB) (Free:251.31 GB) NTFS
Drive v: (Laufwerk_V) (Network) (Total:2387.59 GB) (Free:1381.27 GB) NTFS
Drive y: (Laufwerk_X) (Network) (Total:1515.3 GB) (Free:1059.32 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: CADAC71D)
Partition 1: (Active) - (Size=400 GB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=531.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: 48000000)
Partition 1: (Not Active) - (Size=280.7 GB) - (Type=07 NTFS)
Partition 4: (Active) - (Size=650.8 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 1863 GB) (Disk ID: ACEB38F1)
Partition 1: (Active) - (Size=1863 GB) - (Type=07 NTFS)

==================== End Of Log ============================
         
FRST.txt

Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST.txt) (x64) Version: 11-03-2015
Ran by admin (administrator) on XPS8100 on 12-03-2015 17:32:57
Running from C:\Users\admin\Downloads
Loaded Profiles: admin (Available profiles: admin)
Platform: Windows 7 Ultimate Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe
(Microsoft Corporation) C:\Program Files (x86)\Common Files\microsoft shared\VS7DEBUG\mdm.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
(Motorola) C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
() C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnat.exe
(VMware, Inc.) C:\Windows\SysWOW64\vmnetdhcp.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
(Motorola Mobility LLC) C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Acronis) C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
() C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe
(Akamai Technologies, Inc.) C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
(Canon INC.) C:\Program Files (x86)\Canon\EOS Utility\EOS Utility.exe
(Elaborate Bytes AG) C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
(Acronis) C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
(VMware, Inc.) C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
(CANON INC.) C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
(shbox.de) C:\Program Files (x86)\FreePDF_XP\fpassist.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Research In Motion Limited) C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Akamai Technologies, Inc.) C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
() C:\Users\admin\Downloads\Defogger.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\update.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\updrgui.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [Acronis Scheduler2 Service] => C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe [357800 2009-09-12] (Acronis)
HKLM-x32\...\Run: [VirtualCloneDrive] => C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe [89456 2011-03-07] (Elaborate Bytes AG)
HKLM-x32\...\Run: [TrueImageMonitor.exe] => C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe [5082488 2009-09-12] (Acronis)
HKLM-x32\...\Run: [vmware-tray] => C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe [103536 2011-11-13] (VMware, Inc.)
HKLM-x32\...\Run: [IJNetworkScanUtility] => C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe [206240 2010-08-24] (CANON INC.)
HKLM-x32\...\Run: [FreePDF Assistant] => C:\Program Files (x86)\FreePDF_XP\fpassist.exe [371200 2011-02-23] (shbox.de)
HKLM-x32\...\Run: [ZoneAlarm Installer] => "C:\Program Files (x86)\CheckPoint\Install\Launcher.exe" "C:\Program Files (x86)\CheckPoint\Install\Install.exe" /r  /c "C:\Program Files (x86)\CheckPoint\Install\Install.xml"
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [704248 2015-03-10] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [RIMBBLaunchAgent.exe] => C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe [90448 2011-11-02] (Research In Motion Limited)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [256896 2014-07-25] (Oracle Corporation)
HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\...\Run: [Allway Sync] => C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe [88064 2012-12-26] ()
HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\...\Run: [Akamai NetSession Interface] => C:\Users\admin\AppData\Local\Akamai\netsession_win.exe [4673432 2014-10-29] (Akamai Technologies, Inc.)
HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\...\MountPoints2: {86bac973-5417-11e2-81d7-a4badbe59f83} - J:\Runthis.exe "eXamVision.exe"
HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\...\MountPoints2: {badec438-401d-11e4-95b1-005056c00008} - "H:\WD Drive Unlock.exe" autoplay=true
HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\...\MountPoints2: {e1f2db4b-5415-11e2-9269-806e6f6e6963} - D:\autorun.exe
Startup: C:\Users\admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\EOS Utility.lnk
ShortcutTarget: EOS Utility.lnk -> C:\Program Files (x86)\Canon\EOS Utility\EOS Utility.exe (Canon INC.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\ColorVisionStartup.lnk
ShortcutTarget: ColorVisionStartup.lnk -> C:\Program Files (x86)\ColorVision\Utility\ColorVisionStartup.exe (ColorVision Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\WISO Mein Steuer-Sparbuch heute.lnk
ShortcutTarget: WISO Mein Steuer-Sparbuch heute.lnk -> C:\Program Files (x86)\WISO\Steuersoftware 2013\mshaktuell.exe ()

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://192.168.10.233/
HKU\S-1-5-21-1907938336-2175037879-4224917378-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre7\bin\ssv.dll [2014-09-07] (Oracle Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre7\bin\jp2ssv.dll [2014-09-07] (Oracle Corporation)
DPF: HKLM-x32 {3E278D18-99A7-4885-9C9A-8D1219D474F8} hxxp://192.168.10.124/program/SNCIntelligence.cab
DPF: HKLM-x32 {937FE81C-FECF-4A55-9754-49D6D6550EDC} hxxp://192.168.10.157:8080/cgi-bin/NNVRVMon.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.10.111
Tcpip\..\Interfaces\{9ED781B0-02C6-41A5-A36A-432F88716647}: [NameServer] 192.168.10.189,192.168.10.239

FireFox:
========
FF ProfilePath: C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\7e8mva7y.default
FF Homepage: www.google.de
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_16_0_0_305.dll [2015-02-06] ()
FF Plugin: @videolan.org/vlc,version=2.0.5 -> C:\Program Files\VideoLAN\VLC\npvlc.dll [2012-12-16] (VideoLAN)
FF Plugin: synology.com/SurveillancePlugin_x86_64 -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.565\npSurveillancePlugin_x86_64.dll [2015-01-29] (Synology)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-06] ()
FF Plugin-x32: @checkpoint.com/FFApi -> C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker\bin\npFFApi.dll No File
FF Plugin-x32: @java.com/DTPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\dtplugin\npDeployJava1.dll [2014-09-07] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=10.67.2 -> C:\Program Files (x86)\Java\jre7\bin\plugin2\npjp2.dll [2014-09-07] (Oracle Corporation)
FF Plugin-x32: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files (x86)\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin-x32: synology.com/SurveillancePlugin -> C:\Program Files (x86)\Synology\SurveillancePlugin\1.0.0.565\npSurveillancePlugin.dll [2015-01-29] (Synology)
FF Plugin-x32: Web Components -> C:\Program Files (x86)\Web Components\npWebVideoPlugin.dll [2014-07-11] ()
FF Plugin HKU\S-1-5-21-1907938336-2175037879-4224917378-1000: amazon.com/AmazonMP3DownloaderPlugin -> C:\Program Files (x86)\Amazon\MP3 Downloader\npAmazonMP3DownloaderPlugin10174.dll [2012-12-07] (Amazon.com, Inc.)
FF user.js: detected! => C:\Users\admin\AppData\Roaming\Mozilla\Firefox\Profiles\7e8mva7y.default\user.js [2013-01-01]
FF HKLM-x32\...\Firefox\Extensions: [{FFB96CC1-7EB3-449D-B827-DB661701C6BB}] - C:\Program Files\CheckPoint\ZAForceField\WOW64\TrustChecker

Opera: 
=======
StartMenuInternet: (HKLM) Opera - C:\Program Files\Opera x64\Opera.exe

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S2 AcronisOSSReinstallSvc; C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe [2217416 2007-02-22] ()
R2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [806192 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [992048 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 BotkindSyncService; C:\Program Files (x86)\Allway Sync\Bin\SyncService.exe [182784 2012-12-26] () [File not signed]
R2 MDM; C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe [335872 2006-10-26] (Microsoft Corporation) [File not signed]
R2 Motorola Device Manager; C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe [137528 2013-11-15] (Motorola Mobility LLC)
R2 PST Service; C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe [65657 2011-09-02] (Motorola) [File not signed]
S3 rpcapd; C:\Program Files (x86)\WinPcap\rpcapd.exe [117264 2010-06-25] (CACE Technologies, Inc.)
R2 UsbClientService; C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe [248736 2014-02-25] ()
R2 VMAuthdService; C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe [79872 2011-11-13] (VMware, Inc.) [File not signed]
S2 VMwareHostd; C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe [11839488 2011-11-13] () [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [128536 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-03-10] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2013-11-25] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-10] (Avira Operations GmbH & Co. KG)
R2 NPF; C:\Windows\System32\drivers\npf.sys [35344 2010-06-25] (CACE Technologies, Inc.)
S3 RimUsb; C:\Windows\System32\Drivers\RimUsb_AMD64.sys [74752 2011-07-25] (Research In Motion Limited)
R3 RimVSerPort; C:\Windows\System32\DRIVERS\RimSerial_AMD64.sys [44032 2011-07-20] (Research in Motion Ltd)
R3 RTL8023x64; C:\Windows\System32\DRIVERS\Rtnic64.sys [51712 2009-06-10] (Realtek Semiconductor Corporation                           )
S3 Spyder2; C:\Windows\System32\DRIVERS\Spyder2.sys [15360 2007-01-17] ()
R0 tdrpman251; C:\Windows\System32\DRIVERS\tdrpm251.sys [1455648 2013-01-02] (Acronis)
S3 motccgpfl; system32\DRIVERS\motccgpfl.sys [X]
S3 Synth3dVsc; System32\drivers\synth3dvsc.sys [X]
S3 tsusbhub; system32\drivers\tsusbhub.sys [X]
S3 VGPU; System32\drivers\rdvgkmd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-12 17:32 - 2015-03-12 17:33 - 00013714 _____ () C:\Users\admin\Downloads\FRST.txt
2015-03-12 17:32 - 2015-03-12 17:32 - 00000472 _____ () C:\Users\admin\Downloads\defogger_disable.log
2015-03-12 17:32 - 2015-03-12 17:32 - 00000000 ____D () C:\FRST
2015-03-12 17:32 - 2015-03-12 17:32 - 00000000 _____ () C:\Users\admin\defogger_reenable
2015-03-12 17:31 - 2015-03-12 17:31 - 00380416 _____ () C:\Users\admin\Downloads\Gmer-19357.exe
2015-03-12 17:30 - 2015-03-12 17:30 - 02095616 _____ (Farbar) C:\Users\admin\Downloads\FRST64.exe
2015-03-12 17:30 - 2015-03-12 17:30 - 00050477 _____ () C:\Users\admin\Downloads\Defogger.exe
2015-03-11 18:42 - 2015-02-20 05:41 - 00041984 _____ (Microsoft Corporation) C:\Windows\system32\lpk.dll
2015-03-11 18:42 - 2015-02-20 05:40 - 00100864 _____ (Microsoft Corporation) C:\Windows\system32\fontsub.dll
2015-03-11 18:42 - 2015-02-20 05:40 - 00046080 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-11 18:42 - 2015-02-20 05:40 - 00014336 _____ (Microsoft Corporation) C:\Windows\system32\dciman32.dll
2015-03-11 18:42 - 2015-02-20 05:13 - 00070656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\fontsub.dll
2015-03-11 18:42 - 2015-02-20 05:13 - 00034304 _____ (Adobe Systems) C:\Windows\SysWOW64\atmlib.dll
2015-03-11 18:42 - 2015-02-20 05:13 - 00010240 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dciman32.dll
2015-03-11 18:42 - 2015-02-20 05:12 - 00025600 _____ (Microsoft Corporation) C:\Windows\SysWOW64\lpk.dll
2015-03-11 18:42 - 2015-02-20 04:29 - 00372224 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-11 18:42 - 2015-02-20 04:09 - 00299008 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\atmfd.dll
2015-03-11 18:42 - 2015-02-03 04:34 - 05554104 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-11 18:42 - 2015-02-03 04:30 - 01480192 _____ (Microsoft Corporation) C:\Windows\system32\crypt32.dll
2015-03-11 18:42 - 2015-02-03 04:16 - 03973048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntkrnlpa.exe
2015-03-11 18:42 - 2015-02-03 04:12 - 11411968 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmp.dll
2015-03-11 18:42 - 2015-02-03 04:12 - 03209728 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mf.dll
2015-03-11 18:42 - 2015-02-03 04:12 - 01174528 _____ (Microsoft Corporation) C:\Windows\SysWOW64\crypt32.dll
2015-03-11 18:41 - 2015-02-03 04:34 - 00693176 _____ (Microsoft Corporation) C:\Windows\system32\winload.efi
2015-03-11 18:41 - 2015-02-03 04:34 - 00094656 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\mountmgr.sys
2015-03-11 18:41 - 2015-02-03 04:33 - 00616360 _____ (Microsoft Corporation) C:\Windows\system32\winresume.efi
2015-03-11 18:41 - 2015-02-03 04:31 - 14632960 _____ (Microsoft Corporation) C:\Windows\system32\wmp.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 04121600 _____ (Microsoft Corporation) C:\Windows\system32\mf.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 01574400 _____ (Microsoft Corporation) C:\Windows\system32\quartz.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00782848 _____ (Microsoft Corporation) C:\Windows\system32\wmdrmsdk.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00641024 _____ (Microsoft Corporation) C:\Windows\system32\msscp.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00503808 _____ (Microsoft Corporation) C:\Windows\system32\srcore.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00500224 _____ (Microsoft Corporation) C:\Windows\system32\AUDIOKSE.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00432128 _____ (Microsoft Corporation) C:\Windows\system32\mfplat.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00371712 _____ (Microsoft Corporation) C:\Windows\system32\qdvd.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00325632 _____ (Microsoft Corporation) C:\Windows\system32\msnetobj.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00229376 _____ (Microsoft Corporation) C:\Windows\system32\wintrust.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00206848 _____ (Microsoft Corporation) C:\Windows\system32\mfps.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00188416 _____ (Microsoft Corporation) C:\Windows\system32\pcasvc.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\setbcdlocale.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00050176 _____ (Microsoft Corporation) C:\Windows\system32\srclient.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00037376 _____ (Microsoft Corporation) C:\Windows\system32\pcadm.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\msmmsp.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\spwmp.dll
2015-03-11 18:41 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\msdxm.ocx
2015-03-11 18:41 - 2015-02-03 04:31 - 00005120 _____ (Microsoft Corporation) C:\Windows\system32\dxmasf.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 12625920 _____ (Microsoft Corporation) C:\Windows\system32\wmploc.DLL
2015-03-11 18:41 - 2015-02-03 04:30 - 01202176 _____ (Microsoft Corporation) C:\Windows\system32\drmv2clt.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 01069056 _____ (Microsoft Corporation) C:\Windows\system32\cryptui.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00842240 _____ (Microsoft Corporation) C:\Windows\system32\blackbox.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00680960 _____ (Microsoft Corporation) C:\Windows\system32\audiosrv.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00631808 _____ (Microsoft Corporation) C:\Windows\system32\evr.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00497664 _____ (Microsoft Corporation) C:\Windows\system32\drmmgrtn.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00440832 _____ (Microsoft Corporation) C:\Windows\system32\AudioEng.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00296960 _____ (Microsoft Corporation) C:\Windows\system32\rstrui.exe
2015-03-11 18:41 - 2015-02-03 04:30 - 00296448 _____ (Microsoft Corporation) C:\Windows\system32\AudioSes.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00284672 _____ (Microsoft Corporation) C:\Windows\system32\EncDump.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00187904 _____ (Microsoft Corporation) C:\Windows\system32\cryptsvc.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00146944 _____ (Microsoft Corporation) C:\Windows\system32\appidpolicyconverter.exe
2015-03-11 18:41 - 2015-02-03 04:30 - 00140288 _____ (Microsoft Corporation) C:\Windows\system32\cryptnet.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00126464 _____ (Microsoft Corporation) C:\Windows\system32\audiodg.exe
2015-03-11 18:41 - 2015-02-03 04:30 - 00112640 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-11 18:41 - 2015-02-03 04:30 - 00082432 _____ (Microsoft Corporation) C:\Windows\system32\cryptsp.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00058880 _____ (Microsoft Corporation) C:\Windows\system32\appidapi.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00055808 _____ (Microsoft Corporation) C:\Windows\system32\rrinstaller.exe
2015-03-11 18:41 - 2015-02-03 04:30 - 00043520 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00032256 _____ (Microsoft Corporation) C:\Windows\system32\appidsvc.dll
2015-03-11 18:41 - 2015-02-03 04:30 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\mfpmp.exe
2015-03-11 18:41 - 2015-02-03 04:30 - 00017920 _____ (Microsoft Corporation) C:\Windows\system32\appidcertstorecheck.exe
2015-03-11 18:41 - 2015-02-03 04:30 - 00011264 _____ (Microsoft Corporation) C:\Windows\system32\pcawrk.exe
2015-03-11 18:41 - 2015-02-03 04:30 - 00009728 _____ (Microsoft Corporation) C:\Windows\system32\pcalua.exe
2015-03-11 18:41 - 2015-02-03 04:29 - 00008704 _____ (Microsoft Corporation) C:\Windows\system32\pcaevts.dll
2015-03-11 18:41 - 2015-02-03 04:28 - 00006656 _____ (Microsoft Corporation) C:\Windows\system32\apisetschema.dll
2015-03-11 18:41 - 2015-02-03 04:28 - 00002048 _____ (Microsoft Corporation) C:\Windows\system32\mferror.dll
2015-03-11 18:41 - 2015-02-03 04:19 - 00663552 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\PEAuth.sys
2015-03-11 18:41 - 2015-02-03 04:16 - 03917760 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ntoskrnl.exe
2015-03-11 18:41 - 2015-02-03 04:12 - 01329664 _____ (Microsoft Corporation) C:\Windows\SysWOW64\quartz.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 01005056 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptui.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00988160 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmv2clt.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00744960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\blackbox.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00617984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmdrmsdk.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00519680 _____ (Microsoft Corporation) C:\Windows\SysWOW64\qdvd.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msscp.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00489984 _____ (Microsoft Corporation) C:\Windows\SysWOW64\evr.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00442880 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AUDIOKSE.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00406016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\drmmgrtn.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00374784 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioEng.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00354816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfplat.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00265216 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msnetobj.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00195584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\AudioSes.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00179200 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wintrust.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00143872 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsvc.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00103936 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptnet.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00103424 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfps.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00081408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\cryptsp.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00050688 _____ (Microsoft Corporation) C:\Windows\SysWOW64\appidapi.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00043008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\srclient.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00008192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\spwmp.dll
2015-03-11 18:41 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msdxm.ocx
2015-03-11 18:41 - 2015-02-03 04:12 - 00004096 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxmasf.dll
2015-03-11 18:41 - 2015-02-03 04:11 - 12625408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wmploc.DLL
2015-03-11 18:41 - 2015-02-03 04:11 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\rrinstaller.exe
2015-03-11 18:41 - 2015-02-03 04:11 - 00023040 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mfpmp.exe
2015-03-11 18:41 - 2015-02-03 04:09 - 00002048 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mferror.dll
2015-03-11 18:41 - 2015-02-03 04:08 - 00006656 _____ (Microsoft Corporation) C:\Windows\SysWOW64\apisetschema.dll
2015-03-11 18:41 - 2015-02-03 03:32 - 00061440 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\appid.sys
2015-03-11 18:41 - 2014-10-31 23:24 - 00619056 _____ (Microsoft Corporation) C:\Windows\system32\winload.exe
2015-03-11 18:40 - 2015-03-06 06:56 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-03-11 18:40 - 2015-03-06 06:56 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-03-11 18:40 - 2015-03-06 06:42 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00341504 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-03-11 18:40 - 2015-03-06 06:42 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-03-11 18:40 - 2015-03-06 06:41 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-03-11 18:40 - 2015-03-06 06:41 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-03-11 18:40 - 2015-03-06 06:39 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-03-11 18:40 - 2015-03-06 06:38 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-03-11 18:40 - 2015-03-06 06:36 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-03-11 18:40 - 2015-03-06 06:10 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-03-11 18:40 - 2015-03-06 06:10 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-03-11 18:40 - 2015-03-06 06:10 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-03-11 18:40 - 2015-03-06 06:10 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-03-11 18:40 - 2015-03-06 06:10 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-03-11 18:40 - 2015-03-06 06:10 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-03-11 18:40 - 2015-03-06 06:10 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-03-11 18:40 - 2015-03-06 06:10 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-03-11 18:40 - 2015-03-06 06:09 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-03-11 18:40 - 2015-03-06 06:09 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-03-11 18:40 - 2015-03-06 06:07 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-03-11 18:40 - 2015-03-06 06:07 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-03-11 18:40 - 2015-03-06 06:06 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-03-11 18:40 - 2015-02-26 04:25 - 03204096 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-11 18:40 - 2015-02-24 04:15 - 00389800 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-11 18:40 - 2015-02-24 03:32 - 00342696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-03-11 18:40 - 2015-02-21 02:16 - 25021440 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-11 18:40 - 2015-02-21 01:41 - 12827648 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-03-11 18:40 - 2015-02-21 01:27 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-03-11 18:40 - 2015-02-21 01:27 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-03-11 18:40 - 2015-02-21 01:25 - 19720192 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-03-11 18:40 - 2015-02-21 00:58 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-11 18:40 - 2015-02-21 00:32 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-03-11 18:40 - 2015-02-20 04:06 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-11 18:40 - 2015-02-20 04:05 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-03-11 18:40 - 2015-02-20 03:50 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-11 18:40 - 2015-02-20 03:49 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-11 18:40 - 2015-02-20 03:49 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-03-11 18:40 - 2015-02-20 03:48 - 02886144 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-11 18:40 - 2015-02-20 03:47 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-03-11 18:40 - 2015-02-20 03:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-11 18:40 - 2015-02-20 03:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-11 18:40 - 2015-02-20 03:36 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-11 18:40 - 2015-02-20 03:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-11 18:40 - 2015-02-20 03:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-03-11 18:40 - 2015-02-20 03:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-03-11 18:40 - 2015-02-20 03:32 - 06035456 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-11 18:40 - 2015-02-20 03:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-03-11 18:40 - 2015-02-20 03:22 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-03-11 18:40 - 2015-02-20 03:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-11 18:40 - 2015-02-20 03:13 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-03-11 18:40 - 2015-02-20 03:09 - 00503296 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-03-11 18:40 - 2015-02-20 03:08 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-11 18:40 - 2015-02-20 03:08 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-03-11 18:40 - 2015-02-20 03:08 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-03-11 18:40 - 2015-02-20 03:06 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-03-11 18:40 - 2015-02-20 03:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-11 18:40 - 2015-02-20 03:03 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-03-11 18:40 - 2015-02-20 03:01 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-03-11 18:40 - 2015-02-20 03:00 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-03-11 18:40 - 2015-02-20 02:58 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-03-11 18:40 - 2015-02-20 02:56 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-03-11 18:40 - 2015-02-20 02:56 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-03-11 18:40 - 2015-02-20 02:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-11 18:40 - 2015-02-20 02:49 - 00718848 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-11 18:40 - 2015-02-20 02:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-03-11 18:40 - 2015-02-20 02:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-11 18:40 - 2015-02-20 02:43 - 14398976 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-11 18:40 - 2015-02-20 02:41 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-03-11 18:40 - 2015-02-20 02:37 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-03-11 18:40 - 2015-02-20 02:30 - 04300288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-03-11 18:40 - 2015-02-20 02:28 - 02358784 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-11 18:40 - 2015-02-20 02:24 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-03-11 18:40 - 2015-02-20 02:24 - 00689152 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-03-11 18:40 - 2015-02-20 02:23 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-03-11 18:40 - 2015-02-20 02:16 - 01548288 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-11 18:40 - 2015-02-20 02:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-11 18:40 - 2015-02-20 02:01 - 01888256 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-03-11 18:40 - 2015-02-20 01:57 - 01311232 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-03-11 18:40 - 2015-02-20 01:55 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-03-11 18:40 - 2015-02-13 06:26 - 12875264 _____ (Microsoft Corporation) C:\Windows\SysWOW64\shell32.dll
2015-03-11 18:40 - 2015-02-13 06:22 - 14177280 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-11 18:40 - 2015-02-03 04:31 - 01424896 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-11 18:40 - 2015-02-03 04:31 - 00215552 _____ (Microsoft Corporation) C:\Windows\system32\ubpm.dll
2015-03-11 18:40 - 2015-02-03 04:12 - 01230848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WindowsCodecs.dll
2015-03-11 18:40 - 2015-02-03 04:12 - 00171520 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ubpm.dll
2015-03-11 18:40 - 2015-01-31 04:48 - 01113088 _____ (Microsoft Corporation) C:\Windows\system32\rdpcorets.dll
2015-03-11 18:40 - 2015-01-31 04:05 - 00162816 _____ (Microsoft Corporation) C:\Windows\system32\rdpudd.dll
2015-03-11 18:40 - 2015-01-31 04:04 - 00020992 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\rdpvideominiport.sys
2015-03-11 18:40 - 2015-01-31 00:56 - 00459336 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\cng.sys
2015-03-11 18:40 - 2015-01-17 03:48 - 01067520 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-11 18:40 - 2015-01-17 03:30 - 00828928 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msctf.dll
2015-03-11 18:39 - 2015-02-04 04:16 - 00465920 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-11 18:39 - 2015-02-04 03:54 - 00417792 _____ (Microsoft Corporation) C:\Windows\SysWOW64\WMPhoto.dll
2015-03-06 15:50 - 2015-03-06 15:50 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-02-26 19:15 - 2015-01-09 00:44 - 00419936 _____ () C:\Windows\SysWOW64\locale.nls
2015-02-26 19:15 - 2015-01-09 00:43 - 00419936 _____ () C:\Windows\system32\locale.nls
2015-02-26 14:13 - 2015-02-27 08:56 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-02-26 13:48 - 2015-01-09 04:14 - 00950272 _____ (Microsoft Corporation) C:\Windows\system32\perftrack.dll
2015-02-26 13:48 - 2015-01-09 04:14 - 00091136 _____ (Microsoft Corporation) C:\Windows\system32\wdi.dll
2015-02-26 13:48 - 2015-01-09 04:14 - 00029696 _____ (Microsoft Corporation) C:\Windows\system32\powertracker.dll
2015-02-26 13:48 - 2015-01-09 03:48 - 00076800 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdi.dll
2015-02-17 16:04 - 2015-02-17 16:04 - 01202848 _____ (Microsoft Corporation) C:\Windows\SysWOW64\FM20.DLL
2015-02-13 19:23 - 2015-02-13 19:23 - 17465344 _____ () C:\Users\admin\Downloads\SurveillancePlugin(2).msi
2015-02-11 11:35 - 2014-12-08 04:09 - 00406528 _____ (Microsoft Corporation) C:\Windows\system32\scesrv.dll
2015-02-11 11:35 - 2014-12-08 03:46 - 00308224 _____ (Microsoft Corporation) C:\Windows\SysWOW64\scesrv.dll
2015-02-11 11:35 - 2014-11-26 04:53 - 00861696 _____ (Microsoft Corporation) C:\Windows\system32\oleaut32.dll
2015-02-11 11:35 - 2014-11-26 04:32 - 00571904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\oleaut32.dll
2015-02-11 11:35 - 2014-10-04 03:10 - 03722752 _____ (Microsoft Corporation) C:\Windows\system32\mstscax.dll
2015-02-11 11:35 - 2014-10-04 02:42 - 03221504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mstscax.dll
2015-02-11 11:35 - 2014-10-04 02:42 - 00131584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\aaclient.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-12 17:33 - 2013-01-01 14:25 - 01229252 _____ () C:\Windows\WindowsUpdate.log
2015-03-12 17:33 - 2009-07-14 05:45 - 00020944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-12 17:33 - 2009-07-14 05:45 - 00020944 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-12 17:32 - 2013-01-01 14:25 - 00000000 ____D () C:\Users\admin
2015-03-12 17:29 - 2009-07-14 05:57 - 00001547 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Windows Media Player.lnk
2015-03-12 17:28 - 2013-01-01 16:29 - 00000000 ____D () C:\Temp
2015-03-12 17:27 - 2013-01-03 16:46 - 00000000 ____D () C:\ProgramData\VMware
2015-03-12 17:27 - 2009-07-14 06:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-12 17:27 - 2009-07-14 05:51 - 00079362 _____ () C:\Windows\setupact.log
2015-03-12 17:27 - 2009-07-14 05:45 - 00339712 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-12 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\SysWOW64\Dism
2015-03-12 17:26 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\system32\Dism
2015-03-11 21:14 - 2013-01-01 17:51 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-11 21:09 - 2013-08-14 20:19 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-11 21:07 - 2013-01-01 15:15 - 122905848 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-03-11 19:07 - 2013-01-05 10:32 - 00000000 ____D () C:\Users\admin\AppData\Roaming\vlc
2015-03-10 17:29 - 2013-05-07 16:32 - 00044088 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avnetflt.sys
2015-03-10 17:29 - 2013-04-01 22:16 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-10 17:29 - 2013-04-01 22:16 - 00128536 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-07 16:22 - 2013-01-03 16:48 - 00000000 ____D () C:\Users\admin\AppData\Roaming\VMware
2015-03-07 16:22 - 2013-01-03 16:48 - 00000000 ____D () C:\Users\admin\AppData\Local\VMware
2015-03-07 16:02 - 2013-01-01 14:43 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-02-27 18:30 - 2013-01-01 14:31 - 00283684 _____ () C:\Windows\PFRO.log
2015-02-27 08:53 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\tracing
2015-02-24 18:25 - 2009-07-14 18:58 - 00705626 _____ () C:\Windows\system32\perfh007.dat
2015-02-24 18:25 - 2009-07-14 18:58 - 00151792 _____ () C:\Windows\system32\perfc007.dat
2015-02-24 18:25 - 2009-07-14 06:13 - 01637530 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-02-13 19:24 - 2014-09-07 14:15 - 00000000 ____D () C:\Program Files (x86)\Synology
2015-02-13 12:15 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\rescache
2015-02-12 15:59 - 2009-07-14 04:20 - 00000000 ____D () C:\Windows\PolicyDefinitions
2015-02-10 19:20 - 2013-01-01 18:01 - 00000000 ____D () C:\Users\admin\AppData\Roaming\MyPhoneExplorer

==================== Files in the root of some directories =======

2014-12-28 10:34 - 2014-12-28 10:34 - 0000600 _____ () C:\Users\admin\AppData\Roaming\winscp.rnd
2013-01-19 19:40 - 2014-12-15 19:11 - 0001534 _____ () C:\ProgramData\ss.ini

Some content of TEMP:
====================
C:\Users\admin\AppData\Local\Temp\avgnt.exe
C:\Users\admin\AppData\Local\Temp\ipl.dll
C:\Users\admin\AppData\Local\Temp\iplpx.dll
C:\Users\admin\AppData\Local\Temp\ose00000.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-06 15:46

==================== End Of Log ============================
         
Gmer.txt
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-03-12 17:50:59
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 WDC_WD10 rev.15.0 931,51GB
Running: Gmer-19357.exe; Driver: C:\Users\admin\AppData\Local\Temp\pxldipow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 18                                     0000000074aa1402 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 18                                       0000000074aa141a 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 18                                     0000000074aa1432 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 43                                     0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 18                                        0000000074aa14de 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 18                                 0000000074aa14f6 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 18                                        0000000074aa150e 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 18                                 0000000074aa1526 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 18                                       0000000074aa153e 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!EnumProcesses + 18                                            0000000074aa1556 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 18                                     0000000074aa156e 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 18                                       0000000074aa1586 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 18                                          0000000074aa159e 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 18                                       0000000074aa15b6 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 18                                     0000000074aa15ce 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 21                                 0000000074aa16b3 1 byte [74]
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[2064] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 32                                 0000000074aa16be 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 18                        0000000074aa1402 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 18                          0000000074aa141a 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 18                        0000000074aa1432 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 43                        0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 18                           0000000074aa14de 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 18                    0000000074aa14f6 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 18                           0000000074aa150e 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 18                    0000000074aa1526 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 18                          0000000074aa153e 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!EnumProcesses + 18                               0000000074aa1556 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 18                        0000000074aa156e 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 18                          0000000074aa1586 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 18                             0000000074aa159e 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 18                          0000000074aa15b6 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 18                        0000000074aa15ce 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 21                    0000000074aa16b3 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe[2208] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 32                    0000000074aa16be 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18       0000000074aa1402 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18         0000000074aa141a 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18       0000000074aa1432 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43       0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18          0000000074aa14de 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18   0000000074aa14f6 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18          0000000074aa150e 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18   0000000074aa1526 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18         0000000074aa153e 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18              0000000074aa1556 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18       0000000074aa156e 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18         0000000074aa1586 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18            0000000074aa159e 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18         0000000074aa15b6 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18       0000000074aa15ce 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21   0000000074aa16b3 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe[2244] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32   0000000074aa16be 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18                               0000000074aa1402 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18                                 0000000074aa141a 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18                               0000000074aa1432 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43                               0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18                                  0000000074aa14de 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18                           0000000074aa14f6 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18                                  0000000074aa150e 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18                           0000000074aa1526 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18                                 0000000074aa153e 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18                                      0000000074aa1556 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18                               0000000074aa156e 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18                                 0000000074aa1586 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18                                    0000000074aa159e 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18                                 0000000074aa15b6 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18                               0000000074aa15ce 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21                           0000000074aa16b3 1 byte [74]
.text  C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe[2472] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32                           0000000074aa16be 1 byte [74]
.text  C:\Windows\SysWOW64\vmnat.exe[2520] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 4                                                                  0000000071ed13b0 2 bytes JMP 75595660 C:\Windows\syswow64\SHELL32.dll
.text  C:\Windows\SysWOW64\vmnat.exe[2520] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathW + 20                                                                 0000000071ed13c0 2 bytes CALL 74ff9cee C:\Windows\syswow64\msvcrt.dll
.text  ...                                                                                                                                                        * 20
.text  C:\Windows\SysWOW64\vmnat.exe[2520] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 22                                                                 0000000071ed153e 2 bytes CALL 75627794 C:\Windows\syswow64\SHELL32.dll
.text  C:\Windows\SysWOW64\vmnat.exe[2520] C:\Windows\SysWOW64\SHFOLDER.dll!SHGetFolderPathA + 43                                                                 0000000071ed1553 2 bytes CALL 74e610ff C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18                            0000000074aa1402 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18                              0000000074aa141a 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18                            0000000074aa1432 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43                            0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18                               0000000074aa14de 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18                        0000000074aa14f6 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18                               0000000074aa150e 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18                        0000000074aa1526 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18                              0000000074aa153e 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18                                   0000000074aa1556 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18                            0000000074aa156e 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18                              0000000074aa1586 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18                                 0000000074aa159e 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18                              0000000074aa15b6 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18                            0000000074aa15ce 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21                        0000000074aa16b3 1 byte [74]
.text  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe[2560] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32                        0000000074aa16be 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18         0000000074aa1402 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18           0000000074aa141a 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18         0000000074aa1432 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43         0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18            0000000074aa14de 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18     0000000074aa14f6 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18            0000000074aa150e 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18     0000000074aa1526 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18           0000000074aa153e 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18                0000000074aa1556 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18         0000000074aa156e 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18           0000000074aa1586 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18              0000000074aa159e 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18           0000000074aa15b6 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18         0000000074aa15ce 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21     0000000074aa16b3 1 byte [74]
.text  C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperAgent.exe[3604] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32     0000000074aa16be 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18                                       0000000074aa1402 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18                                         0000000074aa141a 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18                                       0000000074aa1432 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43                                       0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18                                          0000000074aa14de 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18                                   0000000074aa14f6 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18                                          0000000074aa150e 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18                                   0000000074aa1526 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18                                         0000000074aa153e 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18                                              0000000074aa1556 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18                                       0000000074aa156e 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18                                         0000000074aa1586 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18                                            0000000074aa159e 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18                                         0000000074aa15b6 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18                                       0000000074aa15ce 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21                                   0000000074aa16b3 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3948] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32                                   0000000074aa16be 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18      0000000074aa1402 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18        0000000074aa141a 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18      0000000074aa1432 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43      0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18         0000000074aa14de 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18  0000000074aa14f6 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18         0000000074aa150e 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18  0000000074aa1526 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18        0000000074aa153e 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18             0000000074aa1556 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18      0000000074aa156e 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18        0000000074aa1586 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18           0000000074aa159e 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18        0000000074aa15b6 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18      0000000074aa15ce 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21  0000000074aa16b3 1 byte [74]
.text  C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe[3436] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32  0000000074aa16be 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18                                       0000000074aa1402 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18                                         0000000074aa141a 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18                                       0000000074aa1432 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43                                       0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18                                          0000000074aa14de 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18                                   0000000074aa14f6 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18                                          0000000074aa150e 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18                                   0000000074aa1526 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18                                         0000000074aa153e 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18                                              0000000074aa1556 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18                                       0000000074aa156e 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18                                         0000000074aa1586 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18                                            0000000074aa159e 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18                                         0000000074aa15b6 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18                                       0000000074aa15ce 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21                                   0000000074aa16b3 1 byte [74]
.text  C:\Users\admin\AppData\Local\Akamai\netsession_win.exe[3164] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32                                   0000000074aa16be 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 18                                                        0000000074aa1402 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 18                                                          0000000074aa141a 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 18                                                        0000000074aa1432 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 43                                                        0000000074aa144b 1 byte [74]
.text  ...                                                                                                                                                        * 9
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 18                                                           0000000074aa14de 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 18                                                    0000000074aa14f6 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 18                                                           0000000074aa150e 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 18                                                    0000000074aa1526 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 18                                                          0000000074aa153e 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 18                                                               0000000074aa1556 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 18                                                        0000000074aa156e 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 18                                                          0000000074aa1586 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 18                                                             0000000074aa159e 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 18                                                          0000000074aa15b6 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 18                                                        0000000074aa15ce 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 21                                                    0000000074aa16b3 1 byte [74]
.text  C:\Users\admin\Downloads\Defogger.exe[5080] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 32                                                    0000000074aa16be 1 byte [74]

---- EOF - GMER 2.1 ----
         
defogger_enable.log

Code:
ATTFilter
defogger_enable by jpshortstuff (23.02.10.1)
Log created at 17:53 on 12/03/2015 (admin)

Parsing file...


-=E.O.F=-
         

Alt 12.03.2015, 18:49   #2
schrauber
/// the machine
/// TB-Ausbilder
 

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet - Standard

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet



hi,

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.
__________________

__________________

Alt 13.03.2015, 13:45   #3
funnsurfer
 
DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet - Standard

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet



Ich habe beide programme laufen lassen. Hier die Logs:

TDSSKiller

Code:
ATTFilter
13:29:33.0535 0x0d28  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
13:29:41.0678 0x0d28  ============================================================
13:29:41.0678 0x0d28  Current date / time: 2015/03/13 13:29:41.0678
13:29:41.0678 0x0d28  SystemInfo:
13:29:41.0678 0x0d28  
13:29:41.0678 0x0d28  OS Version: 6.1.7601 ServicePack: 1.0
13:29:41.0678 0x0d28  Product type: Workstation
13:29:41.0678 0x0d28  ComputerName: XPS8100
13:29:41.0678 0x0d28  UserName: admin
13:29:41.0678 0x0d28  Windows directory: C:\Windows
13:29:41.0678 0x0d28  System windows directory: C:\Windows
13:29:41.0678 0x0d28  Running under WOW64
13:29:41.0678 0x0d28  Processor architecture: Intel x64
13:29:41.0678 0x0d28  Number of processors: 8
13:29:41.0678 0x0d28  Page size: 0x1000
13:29:41.0678 0x0d28  Boot type: Normal boot
13:29:41.0678 0x0d28  ============================================================
13:29:43.0091 0x0d28  KLMD registered as C:\Windows\system32\drivers\91476202.sys
13:29:43.0259 0x0d28  System UUID: {11E9FB83-9520-BFA1-24B3-8389408F2E62}
13:29:43.0613 0x0d28  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:29:43.0627 0x0d28  Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:29:44.0290 0x0d28  Drive \Device\Harddisk2\DR2 - Size: 0x1D1C1116000 ( 1863.02 Gb ), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
13:29:44.0317 0x0d28  ============================================================
13:29:44.0317 0x0d28  \Device\Harddisk0\DR0:
13:29:44.0317 0x0d28  MBR partitions:
13:29:44.0317 0x0d28  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x3200D0BD
13:29:44.0317 0x0d28  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x3200D0FC, BlocksNum 0x426F88C5
13:29:44.0317 0x0d28  \Device\Harddisk1\DR1:
13:29:44.0317 0x0d28  MBR partitions:
13:29:44.0317 0x0d28  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x2315295F
13:29:44.0317 0x0d28  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x2315299E, BlocksNum 0x515B3023
13:29:44.0317 0x0d28  \Device\Harddisk2\DR2:
13:29:44.0318 0x0d28  MBR partitions:
13:29:44.0318 0x0d28  \Device\Harddisk2\DR2\Partition1: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0xE8E07482
13:29:44.0318 0x0d28  ============================================================
13:29:44.0326 0x0d28  C: <-> \Device\Harddisk0\DR0\Partition1
13:29:44.0344 0x0d28  E: <-> \Device\Harddisk0\DR0\Partition2
13:29:44.0390 0x0d28  B: <-> \Device\Harddisk2\DR2\Partition1
13:29:44.0406 0x0d28  U: <-> \Device\Harddisk1\DR1\Partition2
13:29:44.0407 0x0d28  S: <-> \Device\Harddisk1\DR1\Partition1
13:29:44.0408 0x0d28  ============================================================
13:29:44.0408 0x0d28  Initialize success
13:29:44.0408 0x0d28  ============================================================
13:30:33.0756 0x0a6c  ============================================================
13:30:33.0756 0x0a6c  Scan started
13:30:33.0756 0x0a6c  Mode: Manual; SigCheck; TDLFS; 
13:30:33.0756 0x0a6c  ============================================================
13:30:33.0756 0x0a6c  KSN ping started
13:31:06.0475 0x0a6c  KSN ping finished: true
13:31:07.0459 0x0a6c  ================ Scan system memory ========================
13:31:07.0459 0x0a6c  System memory - ok
13:31:07.0460 0x0a6c  ================ Scan services =============================
13:31:07.0603 0x0a6c  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
13:31:07.0716 0x0a6c  1394ohci - ok
13:31:07.0736 0x0a6c  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
13:31:07.0751 0x0a6c  ACPI - ok
13:31:07.0770 0x0a6c  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
13:31:07.0784 0x0a6c  AcpiPmi - ok
13:31:07.0915 0x0a6c  [ E2769E2699AF88CA3C57289A8A32ED19, B89142CDF2DC4B35E15791B83092E4D6173E11D6A0D98149D7528AD9236972E1 ] AcronisOSSReinstallSvc C:\Program Files (x86)\Common Files\Acronis\Acronis Disk Director\oss_reinstall_svc.exe
13:31:07.0966 0x0a6c  AcronisOSSReinstallSvc - ok
13:31:08.0010 0x0a6c  [ EAC4C4CB23EA3C267062F1EA0F9FFBB3, FDE670BA9ADB282CC0EFB8DC33B0FA4FB9D24E49BAA9F75359B8BDF8F11687B7 ] AcrSch2Svc      C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedul2.exe
13:31:08.0038 0x0a6c  AcrSch2Svc - ok
13:31:08.0097 0x0a6c  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
13:31:08.0120 0x0a6c  AdobeARMservice - ok
13:31:08.0143 0x0a6c  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
13:31:08.0162 0x0a6c  adp94xx - ok
13:31:08.0181 0x0a6c  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
13:31:08.0196 0x0a6c  adpahci - ok
13:31:08.0212 0x0a6c  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
13:31:08.0224 0x0a6c  adpu320 - ok
13:31:08.0246 0x0a6c  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
13:31:08.0285 0x0a6c  AeLookupSvc - ok
13:31:08.0300 0x0a6c  [ 3426A6EAA09077F3AB946FB9CEB85D8E, 8E0AC949724C0D4AC8C1A4E6636F260650FFFD4592D5C257FA08172FDE45C4AD ] afcdp           C:\Windows\system32\DRIVERS\afcdp.sys
13:31:08.0319 0x0a6c  afcdp - ok
13:31:08.0385 0x0a6c  [ 986A134B1A1770599B7AF9354CBB066F, 5F61A40685DB300C1807D220C0CAC7B0295635942DFB758C1131B131F91EE3D3 ] afcdpsrv        C:\Program Files (x86)\Common Files\Acronis\CDP\afcdpsrv.exe
13:31:08.0435 0x0a6c  afcdpsrv - ok
13:31:08.0474 0x0a6c  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
13:31:08.0497 0x0a6c  AFD - ok
13:31:08.0512 0x0a6c  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
13:31:08.0522 0x0a6c  agp440 - ok
13:31:08.0535 0x0a6c  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
13:31:08.0558 0x0a6c  ALG - ok
13:31:08.0572 0x0a6c  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
13:31:08.0580 0x0a6c  aliide - ok
13:31:08.0591 0x0a6c  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
13:31:08.0599 0x0a6c  amdide - ok
13:31:08.0618 0x0a6c  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
13:31:08.0639 0x0a6c  AmdK8 - ok
13:31:08.0653 0x0a6c  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
13:31:08.0674 0x0a6c  AmdPPM - ok
13:31:08.0688 0x0a6c  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
13:31:08.0702 0x0a6c  amdsata - ok
13:31:08.0717 0x0a6c  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
13:31:08.0731 0x0a6c  amdsbs - ok
13:31:08.0744 0x0a6c  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\Windows\system32\drivers\amdxata.sys
13:31:08.0753 0x0a6c  amdxata - ok
13:31:08.0865 0x0a6c  [ 35CCC725A117FD966ADFDE0FDF663C60, 282A07AA3D609E6978E6BF79EF0CDF3FE6A25CFAA433F9F2DD8710F2E4ED4BAA ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
13:31:08.0891 0x0a6c  AntiVirMailService - ok
13:31:08.0942 0x0a6c  [ B5975B61C97F4E47C129CDE76AFF84D4, 0494273946B6DEACC6C6F3AF70F90467A07CB127A5CBD223D4F3450A03C259C3 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
13:31:08.0968 0x0a6c  AntiVirSchedulerService - ok
13:31:08.0991 0x0a6c  [ B5975B61C97F4E47C129CDE76AFF84D4, 0494273946B6DEACC6C6F3AF70F90467A07CB127A5CBD223D4F3450A03C259C3 ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
13:31:09.0005 0x0a6c  AntiVirService - ok
13:31:09.0037 0x0a6c  [ 90E78AD249819ED06951B5B7C0C010A5, 0C387514BAA3F413040E6A0A6F0BFEF12C63AA484AFC3C238A2677BA51661C5D ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
13:31:09.0062 0x0a6c  AntiVirWebService - ok
13:31:09.0092 0x0a6c  [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID           C:\Windows\system32\drivers\appid.sys
13:31:09.0111 0x0a6c  AppID - ok
13:31:09.0123 0x0a6c  [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
13:31:09.0152 0x0a6c  AppIDSvc - ok
13:31:09.0177 0x0a6c  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
13:31:09.0221 0x0a6c  Appinfo - ok
13:31:09.0240 0x0a6c  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
13:31:09.0259 0x0a6c  AppMgmt - ok
13:31:09.0283 0x0a6c  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\DRIVERS\arc.sys
13:31:09.0298 0x0a6c  arc - ok
13:31:09.0304 0x0a6c  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
13:31:09.0319 0x0a6c  arcsas - ok
13:31:09.0406 0x0a6c  [ 9A262EDD17F8473B91B333D6B031A901, 05DFBD3A7D83FDE1D062EA719ACA9EC48CB7FD42D17DDD88B82E5D25469ADD23 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
13:31:09.0434 0x0a6c  aspnet_state - ok
13:31:09.0445 0x0a6c  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
13:31:09.0492 0x0a6c  AsyncMac - ok
13:31:09.0519 0x0a6c  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
13:31:09.0528 0x0a6c  atapi - ok
13:31:09.0593 0x0a6c  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
13:31:09.0624 0x0a6c  AudioEndpointBuilder - ok
13:31:09.0645 0x0a6c  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\Windows\System32\Audiosrv.dll
13:31:09.0668 0x0a6c  AudioSrv - ok
13:31:09.0697 0x0a6c  [ 00BF66D168E1A7AA7E1C9F458BBA0B34, 3D3C42E87B3649819EED685D93417D61EB84FE39B3F4D4943721AE74026DE11B ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
13:31:09.0707 0x0a6c  avgntflt - ok
13:31:09.0728 0x0a6c  [ 055D318220DD4593F2A8C8FF83707D36, 93566931D019D4D4C35C3E2E4E9BAF87BEF863E1B40B2B03ED87EF5C28F908DE ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
13:31:09.0739 0x0a6c  avipbb - ok
13:31:09.0755 0x0a6c  [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
13:31:09.0764 0x0a6c  avkmgr - ok
13:31:09.0790 0x0a6c  [ 13253E5E3B6BDF945B63B336A8C9489B, 671C716E43F89D4BDDAA2BE045CDEBBB569C85BC2BA334E1F550187B79A7740D ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys
13:31:09.0800 0x0a6c  avnetflt - ok
13:31:09.0820 0x0a6c  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
13:31:09.0854 0x0a6c  AxInstSV - ok
13:31:09.0908 0x0a6c  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys
13:31:09.0944 0x0a6c  b06bdrv - ok
13:31:09.0964 0x0a6c  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
13:31:09.0996 0x0a6c  b57nd60a - ok
13:31:10.0026 0x0a6c  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
13:31:10.0046 0x0a6c  BDESVC - ok
13:31:10.0060 0x0a6c  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
13:31:10.0108 0x0a6c  Beep - ok
13:31:10.0161 0x0a6c  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
13:31:10.0190 0x0a6c  BFE - ok
13:31:10.0221 0x0a6c  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
13:31:10.0279 0x0a6c  BITS - ok
13:31:10.0289 0x0a6c  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
13:31:10.0299 0x0a6c  blbdrive - ok
13:31:10.0342 0x0a6c  BotkindSyncService - ok
13:31:10.0361 0x0a6c  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
13:31:10.0388 0x0a6c  bowser - ok
13:31:10.0405 0x0a6c  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
13:31:10.0431 0x0a6c  BrFiltLo - ok
13:31:10.0435 0x0a6c  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
13:31:10.0454 0x0a6c  BrFiltUp - ok
13:31:10.0473 0x0a6c  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
13:31:10.0486 0x0a6c  Browser - ok
13:31:10.0503 0x0a6c  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
13:31:10.0519 0x0a6c  Brserid - ok
13:31:10.0525 0x0a6c  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
13:31:10.0538 0x0a6c  BrSerWdm - ok
13:31:10.0541 0x0a6c  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
13:31:10.0557 0x0a6c  BrUsbMdm - ok
13:31:10.0560 0x0a6c  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
13:31:10.0571 0x0a6c  BrUsbSer - ok
13:31:10.0588 0x0a6c  [ 21A583678FD814794BC3E8E32E5A6BD3, 4EC67E35BAC69A66B480DA50FBB176104C7294744B3F7B7F4C05F2B351FE62DE ] BTCFilterService C:\Windows\system32\DRIVERS\motfilt.sys
13:31:10.0601 0x0a6c  BTCFilterService - ok
13:31:10.0616 0x0a6c  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
13:31:10.0630 0x0a6c  BTHMODEM - ok
13:31:10.0659 0x0a6c  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
13:31:10.0687 0x0a6c  bthserv - ok
13:31:10.0719 0x0a6c  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
13:31:10.0746 0x0a6c  cdfs - ok
13:31:10.0775 0x0a6c  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
13:31:10.0793 0x0a6c  cdrom - ok
13:31:10.0819 0x0a6c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
13:31:10.0854 0x0a6c  CertPropSvc - ok
13:31:10.0862 0x0a6c  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
13:31:10.0886 0x0a6c  circlass - ok
13:31:10.0903 0x0a6c  [ FE1EC06F2253F691FE36217C592A0206, B9F122DB5E665ECDF29A5CB8BB6B531236F31A54A95769D6C5C1924C87FE70CE ] CLFS            C:\Windows\system32\CLFS.sys
13:31:10.0919 0x0a6c  CLFS - ok
13:31:10.0963 0x0a6c  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:31:10.0972 0x0a6c  clr_optimization_v2.0.50727_32 - ok
13:31:10.0991 0x0a6c  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
13:31:11.0000 0x0a6c  clr_optimization_v2.0.50727_64 - ok
13:31:11.0060 0x0a6c  [ E87213F37A13E2B54391E40934F071D0, 7EB221127EFB5BF158FB03D18EFDA2C55FB6CE3D1A1FE69C01D70DBED02C87E5 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:31:11.0088 0x0a6c  clr_optimization_v4.0.30319_32 - ok
13:31:11.0097 0x0a6c  [ 4AEDAB50F83580D0B4D6CF78191F92AA, D113C47013B018B45161911B96E93AF96A2F3B34FA47061BF6E7A71FBA03194A ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
13:31:11.0111 0x0a6c  clr_optimization_v4.0.30319_64 - ok
13:31:11.0126 0x0a6c  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
13:31:11.0143 0x0a6c  CmBatt - ok
13:31:11.0161 0x0a6c  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
13:31:11.0172 0x0a6c  cmdide - ok
13:31:11.0208 0x0a6c  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG             C:\Windows\system32\Drivers\cng.sys
13:31:11.0241 0x0a6c  CNG - ok
13:31:11.0258 0x0a6c  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
13:31:11.0267 0x0a6c  Compbatt - ok
13:31:11.0292 0x0a6c  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
13:31:11.0305 0x0a6c  CompositeBus - ok
13:31:11.0311 0x0a6c  COMSysApp - ok
13:31:11.0322 0x0a6c  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
13:31:11.0332 0x0a6c  crcdisk - ok
13:31:11.0361 0x0a6c  [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc        C:\Windows\system32\cryptsvc.dll
13:31:11.0387 0x0a6c  CryptSvc - ok
13:31:11.0444 0x0a6c  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
13:31:11.0477 0x0a6c  CSC - ok
13:31:11.0523 0x0a6c  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
13:31:11.0558 0x0a6c  CscService - ok
13:31:11.0599 0x0a6c  [ E6CE7188CC47AE5DAFDAF552D370C52F, D68E48F137BF8C6CD0BE4248F9F9D7C68F273C34304641756A76364E915BF428 ] dc3d            C:\Windows\system32\DRIVERS\dc3d.sys
13:31:11.0623 0x0a6c  dc3d - ok
13:31:11.0675 0x0a6c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
13:31:11.0729 0x0a6c  DcomLaunch - ok
13:31:11.0759 0x0a6c  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
13:31:11.0794 0x0a6c  defragsvc - ok
13:31:11.0814 0x0a6c  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
13:31:11.0848 0x0a6c  DfsC - ok
13:31:11.0874 0x0a6c  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
13:31:11.0899 0x0a6c  Dhcp - ok
13:31:11.0911 0x0a6c  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
13:31:11.0941 0x0a6c  discache - ok
13:31:11.0968 0x0a6c  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
13:31:11.0977 0x0a6c  Disk - ok
13:31:11.0998 0x0a6c  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
13:31:12.0011 0x0a6c  Dnscache - ok
13:31:12.0031 0x0a6c  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
13:31:12.0063 0x0a6c  dot3svc - ok
13:31:12.0077 0x0a6c  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
13:31:12.0114 0x0a6c  DPS - ok
13:31:12.0133 0x0a6c  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
13:31:12.0142 0x0a6c  drmkaud - ok
13:31:12.0189 0x0a6c  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
13:31:12.0218 0x0a6c  DXGKrnl - ok
13:31:12.0232 0x0a6c  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
13:31:12.0270 0x0a6c  EapHost - ok
13:31:12.0362 0x0a6c  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys
13:31:12.0434 0x0a6c  ebdrv - ok
13:31:12.0464 0x0a6c  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] EFS             C:\Windows\System32\lsass.exe
13:31:12.0488 0x0a6c  EFS - ok
13:31:12.0543 0x0a6c  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
13:31:12.0580 0x0a6c  ehRecvr - ok
13:31:12.0598 0x0a6c  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
13:31:12.0611 0x0a6c  ehSched - ok
13:31:12.0636 0x0a6c  [ A05FC7ECA0966EBB70E4D17B855A853B, 16A0C8138A3BBD8BE2658261131F9777940CFB1431018A10710E5C1A88AB70EA ] ElbyCDIO        C:\Windows\system32\Drivers\ElbyCDIO.sys
13:31:12.0645 0x0a6c  ElbyCDIO - ok
13:31:12.0671 0x0a6c  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
13:31:12.0692 0x0a6c  elxstor - ok
13:31:12.0709 0x0a6c  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
13:31:12.0729 0x0a6c  ErrDev - ok
13:31:12.0769 0x0a6c  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
13:31:12.0819 0x0a6c  EventSystem - ok
13:31:12.0833 0x0a6c  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
13:31:12.0865 0x0a6c  exfat - ok
13:31:12.0880 0x0a6c  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
13:31:12.0912 0x0a6c  fastfat - ok
13:31:12.0947 0x0a6c  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
13:31:12.0979 0x0a6c  Fax - ok
13:31:12.0987 0x0a6c  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
13:31:13.0004 0x0a6c  fdc - ok
13:31:13.0010 0x0a6c  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
13:31:13.0036 0x0a6c  fdPHost - ok
13:31:13.0042 0x0a6c  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
13:31:13.0079 0x0a6c  FDResPub - ok
13:31:13.0095 0x0a6c  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
13:31:13.0104 0x0a6c  FileInfo - ok
13:31:13.0112 0x0a6c  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
13:31:13.0137 0x0a6c  Filetrace - ok
13:31:13.0145 0x0a6c  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
13:31:13.0155 0x0a6c  flpydisk - ok
13:31:13.0180 0x0a6c  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
13:31:13.0194 0x0a6c  FltMgr - ok
13:31:13.0242 0x0a6c  [ C4C183E6551084039EC862DA1C945E3D, 0874A2ACDD24D64965AA9A76E9C818E216880AE4C9A2E07ED932EE404585CEE6 ] FontCache       C:\Windows\system32\FntCache.dll
13:31:13.0276 0x0a6c  FontCache - ok
13:31:13.0328 0x0a6c  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
13:31:13.0348 0x0a6c  FontCache3.0.0.0 - ok
13:31:13.0366 0x0a6c  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
13:31:13.0390 0x0a6c  FsDepends - ok
13:31:13.0405 0x0a6c  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
13:31:13.0418 0x0a6c  Fs_Rec - ok
13:31:13.0443 0x0a6c  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
13:31:13.0465 0x0a6c  fvevol - ok
13:31:13.0476 0x0a6c  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
13:31:13.0486 0x0a6c  gagp30kx - ok
13:31:13.0523 0x0a6c  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
13:31:13.0567 0x0a6c  gpsvc - ok
13:31:13.0608 0x0a6c  [ ADB4348DA1345877B04E22203AFC8993, D85FC268D1994944CED570A84B0B2E4F3EBFBE59823BE57285CB6CDDDF607358 ] hcmon           C:\Windows\system32\drivers\hcmon.sys
13:31:13.0624 0x0a6c  hcmon - ok
13:31:13.0635 0x0a6c  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
13:31:13.0651 0x0a6c  hcw85cir - ok
13:31:13.0694 0x0a6c  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
13:31:13.0729 0x0a6c  HdAudAddService - ok
13:31:13.0745 0x0a6c  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
13:31:13.0759 0x0a6c  HDAudBus - ok
13:31:13.0781 0x0a6c  [ B6AC71AAA2B10848F57FC49D55A651AF, 4FAD833654E86F9FAF972AC8AF87FD4A9A765B26B96F096BBD63506B5D521A91 ] HECIx64         C:\Windows\system32\DRIVERS\HECIx64.sys
13:31:13.0789 0x0a6c  HECIx64 - ok
13:31:13.0798 0x0a6c  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
13:31:13.0809 0x0a6c  HidBatt - ok
13:31:13.0824 0x0a6c  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
13:31:13.0844 0x0a6c  HidBth - ok
13:31:13.0861 0x0a6c  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
13:31:13.0874 0x0a6c  HidIr - ok
13:31:13.0896 0x0a6c  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
13:31:13.0927 0x0a6c  hidserv - ok
13:31:13.0957 0x0a6c  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
13:31:13.0967 0x0a6c  HidUsb - ok
13:31:13.0982 0x0a6c  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
13:31:14.0009 0x0a6c  hkmsvc - ok
13:31:14.0042 0x0a6c  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
13:31:14.0057 0x0a6c  HomeGroupListener - ok
13:31:14.0083 0x0a6c  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
13:31:14.0098 0x0a6c  HomeGroupProvider - ok
13:31:14.0129 0x0a6c  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
13:31:14.0142 0x0a6c  HpSAMD - ok
13:31:14.0181 0x0a6c  [ 0EA7DE1ACB728DD5A369FD742D6EEE28, 21C489412EB33A12B22290EB701C19BA57006E8702E76F730954F0784DDE9779 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
13:31:14.0233 0x0a6c  HTTP - ok
13:31:14.0247 0x0a6c  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
13:31:14.0256 0x0a6c  hwpolicy - ok
13:31:14.0325 0x0a6c  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
13:31:14.0360 0x0a6c  i8042prt - ok
13:31:14.0468 0x0a6c  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
13:31:14.0493 0x0a6c  iaStorV - ok
13:31:14.0631 0x0a6c  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
13:31:14.0657 0x0a6c  idsvc - ok
13:31:14.0693 0x0a6c  IEEtwCollectorService - ok
13:31:14.0721 0x0a6c  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
13:31:14.0739 0x0a6c  iirsp - ok
13:31:14.0801 0x0a6c  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
13:31:14.0832 0x0a6c  IKEEXT - ok
13:31:14.0855 0x0a6c  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
13:31:14.0865 0x0a6c  intelide - ok
13:31:14.0878 0x0a6c  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
13:31:14.0899 0x0a6c  intelppm - ok
13:31:14.0923 0x0a6c  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
13:31:14.0965 0x0a6c  IPBusEnum - ok
13:31:14.0983 0x0a6c  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
13:31:15.0008 0x0a6c  IpFilterDriver - ok
13:31:15.0070 0x0a6c  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
13:31:15.0100 0x0a6c  iphlpsvc - ok
13:31:15.0118 0x0a6c  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
13:31:15.0137 0x0a6c  IPMIDRV - ok
13:31:15.0153 0x0a6c  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
13:31:15.0189 0x0a6c  IPNAT - ok
13:31:15.0207 0x0a6c  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
13:31:15.0219 0x0a6c  IRENUM - ok
13:31:15.0246 0x0a6c  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
13:31:15.0255 0x0a6c  isapnp - ok
13:31:15.0274 0x0a6c  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
13:31:15.0288 0x0a6c  iScsiPrt - ok
13:31:15.0316 0x0a6c  [ D85F3F18E44F7447B5F1BA5C85BAEB7C, 0FA419F9BF061AC3F81A978FAE1523904081BA6FEA6FACEA228B20F5608FCF1E ] k57nd60a        C:\Windows\system32\DRIVERS\k57nd60a.sys
13:31:15.0328 0x0a6c  k57nd60a - ok
13:31:15.0337 0x0a6c  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
13:31:15.0346 0x0a6c  kbdclass - ok
13:31:15.0363 0x0a6c  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
13:31:15.0382 0x0a6c  kbdhid - ok
13:31:15.0389 0x0a6c  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] KeyIso          C:\Windows\system32\lsass.exe
13:31:15.0398 0x0a6c  KeyIso - ok
13:31:15.0420 0x0a6c  [ 56ED3EE5FED6BF2FC1305CF872042868, 44F77AE3CD83284800FF106156ABCB63047327855E2535EE278289AF6F05579C ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
13:31:15.0431 0x0a6c  KSecDD - ok
13:31:15.0445 0x0a6c  [ 8BA90F480705D7153AD0060CCA62222A, B3E610DFAB382368114D026947084A72AFC4F5BF9C28317F411D4ED91E0B3192 ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
13:31:15.0456 0x0a6c  KSecPkg - ok
13:31:15.0469 0x0a6c  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
13:31:15.0500 0x0a6c  ksthunk - ok
13:31:15.0518 0x0a6c  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
13:31:15.0554 0x0a6c  KtmRm - ok
13:31:15.0569 0x0a6c  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
13:31:15.0606 0x0a6c  LanmanServer - ok
13:31:15.0624 0x0a6c  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
13:31:15.0651 0x0a6c  LanmanWorkstation - ok
13:31:15.0679 0x0a6c  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
13:31:15.0717 0x0a6c  lltdio - ok
13:31:15.0744 0x0a6c  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
13:31:15.0784 0x0a6c  lltdsvc - ok
13:31:15.0792 0x0a6c  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
13:31:15.0827 0x0a6c  lmhosts - ok
13:31:15.0852 0x0a6c  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
13:31:15.0862 0x0a6c  LSI_FC - ok
13:31:15.0867 0x0a6c  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
13:31:15.0878 0x0a6c  LSI_SAS - ok
13:31:15.0883 0x0a6c  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
13:31:15.0893 0x0a6c  LSI_SAS2 - ok
13:31:15.0898 0x0a6c  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
13:31:15.0908 0x0a6c  LSI_SCSI - ok
13:31:15.0921 0x0a6c  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
13:31:15.0947 0x0a6c  luafv - ok
13:31:15.0961 0x0a6c  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
13:31:15.0973 0x0a6c  Mcx2Svc - ok
13:31:16.0041 0x0a6c  [ 7CF1B716372B89568AE4C0FE769F5869, 0D70A7A594BCFBB26D7249C0F4B0AF9EF874F2318B3FDCE44648CC61279594ED ] MDM             C:\Program Files (x86)\Common Files\Microsoft Shared\VS7DEBUG\mdm.exe
13:31:16.0073 0x0a6c  MDM - detected UnsignedFile.Multi.Generic ( 1 )
13:31:23.0034 0x0a6c  Detect skipped due to KSN trusted
13:31:23.0034 0x0a6c  MDM - ok
13:31:23.0050 0x0a6c  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
13:31:23.0073 0x0a6c  megasas - ok
13:31:23.0094 0x0a6c  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
13:31:23.0115 0x0a6c  MegaSR - ok
13:31:23.0138 0x0a6c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
13:31:23.0178 0x0a6c  MMCSS - ok
13:31:23.0190 0x0a6c  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
13:31:23.0231 0x0a6c  Modem - ok
13:31:23.0241 0x0a6c  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
13:31:23.0262 0x0a6c  monitor - ok
13:31:23.0291 0x0a6c  [ 4BD239A90FAFC80CA91AF2DD644D719A, D26D48AB392426544C9E57593BB72F9416E7EFF73769C94A9A4614099EA31E18 ] motandroidusb   C:\Windows\system32\Drivers\motoandroid.sys
13:31:23.0302 0x0a6c  motandroidusb - ok
13:31:23.0318 0x0a6c  [ 12588483F1A69AB2970D36D96B07F71B, CDC044F2FDAD3B22B295528A117D93B7DF464DE63E421DAE9C19E7A1535E3743 ] motccgp         C:\Windows\system32\DRIVERS\motccgp.sys
13:31:23.0338 0x0a6c  motccgp - ok
13:31:23.0351 0x0a6c  motccgpfl - ok
13:31:23.0405 0x0a6c  [ 7ED3A9C3763725BD700946971215EE77, 6150D52945E10B69CFA5E3E637DCEBA67158092C6350B4AFE456EA846CA90C18 ] Motorola Device Manager C:\Program Files (x86)\Motorola Mobility\Motorola Device Manager\MotoHelperService.exe
13:31:23.0424 0x0a6c  Motorola Device Manager - ok
13:31:23.0440 0x0a6c  [ 19BC2161C3FCCED802F1BCD9B78C3466, 2EA39F23C49191A4651CD785A742554801A4AC59AACE1993B3A30EA137B4A321 ] MotoSwitchService C:\Windows\system32\DRIVERS\motswch.sys
13:31:23.0456 0x0a6c  MotoSwitchService - ok
13:31:23.0472 0x0a6c  [ 6A3C0B01551B614B6C6BC9743DEF60D9, 9144C0149A764355045711B36C12F87B2F914B76809407F46FB7BA72F83DDB9D ] Motousbnet      C:\Windows\system32\DRIVERS\Motousbnet.sys
13:31:23.0493 0x0a6c  Motousbnet - ok
13:31:23.0522 0x0a6c  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
13:31:23.0536 0x0a6c  mouclass - ok
13:31:23.0563 0x0a6c  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
13:31:23.0584 0x0a6c  mouhid - ok
13:31:23.0603 0x0a6c  [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
13:31:23.0620 0x0a6c  mountmgr - ok
13:31:23.0643 0x0a6c  [ 81E8AF6407EC3F41908FE37F054353EA, 756C7656ED68AEAE4225E952ED1CED0717264D3378DB8DF0B2D70B6EBC67C62F ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
13:31:23.0655 0x0a6c  MozillaMaintenance - ok
13:31:23.0675 0x0a6c  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
13:31:23.0687 0x0a6c  mpio - ok
13:31:23.0705 0x0a6c  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
13:31:23.0732 0x0a6c  mpsdrv - ok
13:31:23.0771 0x0a6c  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
13:31:23.0819 0x0a6c  MpsSvc - ok
13:31:23.0838 0x0a6c  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
13:31:23.0850 0x0a6c  MRxDAV - ok
13:31:23.0871 0x0a6c  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
13:31:23.0891 0x0a6c  mrxsmb - ok
13:31:23.0908 0x0a6c  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
13:31:23.0929 0x0a6c  mrxsmb10 - ok
13:31:23.0950 0x0a6c  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
13:31:23.0962 0x0a6c  mrxsmb20 - ok
13:31:23.0992 0x0a6c  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\drivers\msahci.sys
13:31:24.0014 0x0a6c  msahci - ok
13:31:24.0028 0x0a6c  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
13:31:24.0042 0x0a6c  msdsm - ok
13:31:24.0059 0x0a6c  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
13:31:24.0073 0x0a6c  MSDTC - ok
13:31:24.0090 0x0a6c  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
13:31:24.0117 0x0a6c  Msfs - ok
13:31:24.0134 0x0a6c  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
13:31:24.0157 0x0a6c  mshidkmdf - ok
13:31:24.0173 0x0a6c  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
13:31:24.0181 0x0a6c  msisadrv - ok
13:31:24.0197 0x0a6c  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
13:31:24.0224 0x0a6c  MSiSCSI - ok
13:31:24.0227 0x0a6c  msiserver - ok
13:31:24.0235 0x0a6c  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
13:31:24.0260 0x0a6c  MSKSSRV - ok
13:31:24.0273 0x0a6c  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
13:31:24.0299 0x0a6c  MSPCLOCK - ok
13:31:24.0306 0x0a6c  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
13:31:24.0342 0x0a6c  MSPQM - ok
13:31:24.0364 0x0a6c  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
13:31:24.0379 0x0a6c  MsRPC - ok
13:31:24.0390 0x0a6c  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
13:31:24.0400 0x0a6c  mssmbios - ok
13:31:24.0403 0x0a6c  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
13:31:24.0428 0x0a6c  MSTEE - ok
13:31:24.0432 0x0a6c  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
13:31:24.0441 0x0a6c  MTConfig - ok
13:31:24.0454 0x0a6c  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
13:31:24.0464 0x0a6c  Mup - ok
13:31:24.0495 0x0a6c  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
13:31:24.0529 0x0a6c  napagent - ok
13:31:24.0550 0x0a6c  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
13:31:24.0583 0x0a6c  NativeWifiP - ok
13:31:24.0656 0x0a6c  [ 760E38053BF56E501D562B70AD796B88, F856E81A975D44F8684A6F2466549CEEDFAEB3950191698555A93A1206E0A42D ] NDIS            C:\Windows\system32\drivers\ndis.sys
13:31:24.0687 0x0a6c  NDIS - ok
13:31:24.0697 0x0a6c  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
13:31:24.0721 0x0a6c  NdisCap - ok
13:31:24.0742 0x0a6c  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
13:31:24.0767 0x0a6c  NdisTapi - ok
13:31:24.0786 0x0a6c  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
13:31:24.0813 0x0a6c  Ndisuio - ok
13:31:24.0832 0x0a6c  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
13:31:24.0869 0x0a6c  NdisWan - ok
13:31:24.0886 0x0a6c  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
13:31:24.0910 0x0a6c  NDProxy - ok
13:31:24.0918 0x0a6c  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
13:31:24.0952 0x0a6c  NetBIOS - ok
13:31:24.0974 0x0a6c  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
13:31:25.0003 0x0a6c  NetBT - ok
13:31:25.0014 0x0a6c  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] Netlogon        C:\Windows\system32\lsass.exe
13:31:25.0023 0x0a6c  Netlogon - ok
13:31:25.0055 0x0a6c  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
13:31:25.0086 0x0a6c  Netman - ok
13:31:25.0117 0x0a6c  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:31:25.0129 0x0a6c  NetMsmqActivator - ok
13:31:25.0134 0x0a6c  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:31:25.0145 0x0a6c  NetPipeActivator - ok
13:31:25.0158 0x0a6c  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
13:31:25.0201 0x0a6c  netprofm - ok
13:31:25.0234 0x0a6c  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:31:25.0245 0x0a6c  NetTcpActivator - ok
13:31:25.0250 0x0a6c  [ 21318671BCAD3ACF16638F98D4D00973, CEA6E3B6BCB4B74A9ACACBEEA12EEA967BBC2240398E2EBC04D7910109CACA11 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
13:31:25.0262 0x0a6c  NetTcpPortSharing - ok
13:31:25.0278 0x0a6c  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
13:31:25.0287 0x0a6c  nfrd960 - ok
13:31:25.0311 0x0a6c  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
13:31:25.0325 0x0a6c  NlaSvc - ok
13:31:25.0355 0x0a6c  [ 351533ACC2A069B94E80BBFC177E8FDF, 54B2749E0496ECC94CE65657627762B485CBC825767BAEDDAD0D2598820FFB9E ] NPF             C:\Windows\system32\drivers\npf.sys
13:31:25.0362 0x0a6c  NPF - ok
13:31:25.0372 0x0a6c  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
13:31:25.0399 0x0a6c  Npfs - ok
13:31:25.0408 0x0a6c  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
13:31:25.0434 0x0a6c  nsi - ok
13:31:25.0440 0x0a6c  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
13:31:25.0474 0x0a6c  nsiproxy - ok
13:31:25.0535 0x0a6c  [ 1A29A59A4C5BA6F8C85062A613B7E2B2, CC137F499A12C724D4166C2D85E9F447413419A0683DAC6F1A802B7F210C77F1 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
13:31:25.0576 0x0a6c  Ntfs - ok
13:31:25.0586 0x0a6c  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
13:31:25.0617 0x0a6c  Null - ok
13:31:25.0932 0x0a6c  [ 51BD7EF17F0B525994AD5B3748C8288B, EDCFB0FC26119F540A749C9EEA178BB5673F7C2F8480FE0B7843277103A1862E ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
13:31:26.0161 0x0a6c  nvlddmkm - ok
13:31:26.0196 0x0a6c  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
13:31:26.0207 0x0a6c  nvraid - ok
13:31:26.0219 0x0a6c  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
13:31:26.0230 0x0a6c  nvstor - ok
13:31:26.0265 0x0a6c  [ FCE8537BF5D504680212D536A3BFE5E2, 6AE56331F6873D9A003BFDCD2C60B13B1E2C3A81C856807F4620A0FD94F30182 ] nvsvc           C:\Windows\system32\nvvsvc.exe
13:31:26.0280 0x0a6c  nvsvc - ok
13:31:26.0299 0x0a6c  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
13:31:26.0311 0x0a6c  nv_agp - ok
13:31:26.0350 0x0a6c  [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv          C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
13:31:26.0365 0x0a6c  odserv - ok
13:31:26.0382 0x0a6c  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
13:31:26.0392 0x0a6c  ohci1394 - ok
13:31:26.0433 0x0a6c  [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:31:26.0454 0x0a6c  ose - ok
13:31:26.0483 0x0a6c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
13:31:26.0506 0x0a6c  p2pimsvc - ok
13:31:26.0537 0x0a6c  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
13:31:26.0559 0x0a6c  p2psvc - ok
13:31:26.0590 0x0a6c  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\DRIVERS\parport.sys
13:31:26.0601 0x0a6c  Parport - ok
13:31:26.0622 0x0a6c  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
13:31:26.0632 0x0a6c  partmgr - ok
13:31:26.0654 0x0a6c  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\Windows\System32\pcasvc.dll
13:31:26.0668 0x0a6c  PcaSvc - ok
13:31:26.0677 0x0a6c  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
13:31:26.0690 0x0a6c  pci - ok
13:31:26.0715 0x0a6c  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
13:31:26.0725 0x0a6c  pciide - ok
13:31:26.0742 0x0a6c  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
13:31:26.0756 0x0a6c  pcmcia - ok
13:31:26.0767 0x0a6c  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
13:31:26.0777 0x0a6c  pcw - ok
13:31:26.0829 0x0a6c  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
13:31:26.0857 0x0a6c  PEAUTH - ok
13:31:26.0943 0x0a6c  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
13:31:26.0993 0x0a6c  PeerDistSvc - ok
13:31:27.0058 0x0a6c  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
13:31:27.0094 0x0a6c  PerfHost - ok
13:31:27.0190 0x0a6c  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
13:31:27.0251 0x0a6c  pla - ok
13:31:27.0305 0x0a6c  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
13:31:27.0332 0x0a6c  PlugPlay - ok
13:31:27.0348 0x0a6c  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
13:31:27.0358 0x0a6c  PNRPAutoReg - ok
13:31:27.0372 0x0a6c  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
13:31:27.0388 0x0a6c  PNRPsvc - ok
13:31:27.0414 0x0a6c  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
13:31:27.0458 0x0a6c  PolicyAgent - ok
13:31:27.0478 0x0a6c  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
13:31:27.0508 0x0a6c  Power - ok
13:31:27.0527 0x0a6c  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
13:31:27.0564 0x0a6c  PptpMiniport - ok
13:31:27.0583 0x0a6c  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
13:31:27.0605 0x0a6c  Processor - ok
13:31:27.0639 0x0a6c  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
13:31:27.0664 0x0a6c  ProfSvc - ok
13:31:27.0672 0x0a6c  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] ProtectedStorage C:\Windows\system32\lsass.exe
13:31:27.0683 0x0a6c  ProtectedStorage - ok
13:31:27.0711 0x0a6c  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
13:31:27.0754 0x0a6c  Psched - ok
13:31:27.0791 0x0a6c  [ EA735BF6DF13A857A83C99BF27A422AD, 026A57155FB9E01CFAFD8613980CDF0F3D744ABBBC66EFDC6C20B89980FB45CF ] PST Service     C:\Program Files (x86)\Motorola\MotForwardDaemon\ForwardDaemon.exe
13:31:27.0807 0x0a6c  PST Service - detected UnsignedFile.Multi.Generic ( 1 )
13:31:36.0083 0x0a6c  Detect skipped due to KSN trusted
13:31:36.0083 0x0a6c  PST Service - ok
13:31:36.0164 0x0a6c  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
13:31:36.0204 0x0a6c  ql2300 - ok
13:31:36.0214 0x0a6c  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
13:31:36.0225 0x0a6c  ql40xx - ok
13:31:36.0250 0x0a6c  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
13:31:36.0269 0x0a6c  QWAVE - ok
13:31:36.0273 0x0a6c  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
13:31:36.0286 0x0a6c  QWAVEdrv - ok
13:31:36.0295 0x0a6c  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
13:31:36.0320 0x0a6c  RasAcd - ok
13:31:36.0345 0x0a6c  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
13:31:36.0381 0x0a6c  RasAgileVpn - ok
13:31:36.0390 0x0a6c  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
13:31:36.0417 0x0a6c  RasAuto - ok
13:31:36.0430 0x0a6c  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
13:31:36.0456 0x0a6c  Rasl2tp - ok
13:31:36.0487 0x0a6c  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
13:31:36.0524 0x0a6c  RasMan - ok
13:31:36.0539 0x0a6c  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
13:31:36.0570 0x0a6c  RasPppoe - ok
13:31:36.0591 0x0a6c  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
13:31:36.0616 0x0a6c  RasSstp - ok
13:31:36.0636 0x0a6c  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
13:31:36.0665 0x0a6c  rdbss - ok
13:31:36.0678 0x0a6c  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
13:31:36.0689 0x0a6c  rdpbus - ok
13:31:36.0705 0x0a6c  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
13:31:36.0740 0x0a6c  RDPCDD - ok
13:31:36.0762 0x0a6c  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
13:31:36.0774 0x0a6c  RDPDR - ok
13:31:36.0786 0x0a6c  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
13:31:36.0818 0x0a6c  RDPENCDD - ok
13:31:36.0831 0x0a6c  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
13:31:36.0867 0x0a6c  RDPREFMP - ok
13:31:36.0901 0x0a6c  [ 76D8CC526512ECAE2AEF63B1A6D018A1, 7281AFEBA5455BB879D4BA2DBADDCF6DAC87C1040605907CC907142609985B17 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys
13:31:36.0910 0x0a6c  RdpVideoMiniport - ok
13:31:36.0930 0x0a6c  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
13:31:36.0956 0x0a6c  RDPWD - ok
13:31:36.0979 0x0a6c  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
13:31:36.0994 0x0a6c  rdyboost - ok
13:31:37.0013 0x0a6c  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
13:31:37.0044 0x0a6c  RemoteAccess - ok
13:31:37.0062 0x0a6c  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
13:31:37.0101 0x0a6c  RemoteRegistry - ok
13:31:37.0138 0x0a6c  [ AD42432D22940B4215177BE113E4919C, BF04E1F942846B928E523727EB03BBFA83FCE535CF7C0A4E787A5CBA46D5BF8D ] RimUsb          C:\Windows\system32\Drivers\RimUsb_AMD64.sys
13:31:37.0160 0x0a6c  RimUsb - ok
13:31:37.0184 0x0a6c  [ 4AAFFFA67AC4DFA3D9985D78573887E2, A2A4623A1DFA3C1BF0B09390F3731AFF5616BF9E9144F5DEEAA89B37E445D834 ] RimVSerPort     C:\Windows\system32\DRIVERS\RimSerial_AMD64.sys
13:31:37.0204 0x0a6c  RimVSerPort - ok
13:31:37.0219 0x0a6c  [ 388D3DD1A6457280F3BADBA9F3ACD6B1, 5C534EA15195B1301C917904627AF09FE2ABA3FEE1641B5C87E8F3191BC49058 ] ROOTMODEM       C:\Windows\system32\Drivers\RootMdm.sys
13:31:37.0266 0x0a6c  ROOTMODEM - ok
13:31:37.0292 0x0a6c  [ B60F58F175DE20A6739194E85B035178, 6E66D6041AF0B69896E4556F9FF3A3AA70CF4B09FFBE68E14E60313C5E3FFDDB ] rpcapd          C:\Program Files (x86)\WinPcap\rpcapd.exe
13:31:37.0305 0x0a6c  rpcapd - ok
13:31:37.0324 0x0a6c  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
13:31:37.0366 0x0a6c  RpcEptMapper - ok
13:31:37.0385 0x0a6c  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
13:31:37.0396 0x0a6c  RpcLocator - ok
13:31:37.0432 0x0a6c  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
13:31:37.0474 0x0a6c  RpcSs - ok
13:31:37.0484 0x0a6c  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
13:31:37.0512 0x0a6c  rspndr - ok
13:31:37.0540 0x0a6c  [ 68DD0457D18FCCEF7384AE84022F0C86, 82C02EDB30D4FA1145AB1818F9FCE0B73FEB1B94C138B5513794F25FAC85F2CC ] RTL8023x64      C:\Windows\system32\DRIVERS\Rtnic64.sys
13:31:37.0557 0x0a6c  RTL8023x64 - ok
13:31:37.0571 0x0a6c  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] SamSs           C:\Windows\system32\lsass.exe
13:31:37.0584 0x0a6c  SamSs - ok
13:31:37.0601 0x0a6c  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
13:31:37.0614 0x0a6c  sbp2port - ok
13:31:37.0640 0x0a6c  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
13:31:37.0679 0x0a6c  SCardSvr - ok
13:31:37.0693 0x0a6c  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
13:31:37.0718 0x0a6c  scfilter - ok
13:31:37.0764 0x0a6c  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
13:31:37.0815 0x0a6c  Schedule - ok
13:31:37.0831 0x0a6c  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
13:31:37.0855 0x0a6c  SCPolicySvc - ok
13:31:37.0869 0x0a6c  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
13:31:37.0886 0x0a6c  SDRSVC - ok
13:31:37.0913 0x0a6c  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
13:31:37.0947 0x0a6c  secdrv - ok
13:31:37.0954 0x0a6c  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
13:31:37.0982 0x0a6c  seclogon - ok
13:31:37.0992 0x0a6c  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
13:31:38.0018 0x0a6c  SENS - ok
13:31:38.0028 0x0a6c  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
13:31:38.0043 0x0a6c  SensrSvc - ok
13:31:38.0058 0x0a6c  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
13:31:38.0079 0x0a6c  Serenum - ok
13:31:38.0092 0x0a6c  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
13:31:38.0111 0x0a6c  Serial - ok
13:31:38.0132 0x0a6c  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
13:31:38.0144 0x0a6c  sermouse - ok
13:31:38.0172 0x0a6c  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
13:31:38.0208 0x0a6c  SessionEnv - ok
13:31:38.0227 0x0a6c  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
13:31:38.0250 0x0a6c  sffdisk - ok
13:31:38.0259 0x0a6c  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
13:31:38.0273 0x0a6c  sffp_mmc - ok
13:31:38.0276 0x0a6c  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
13:31:38.0287 0x0a6c  sffp_sd - ok
13:31:38.0295 0x0a6c  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
13:31:38.0307 0x0a6c  sfloppy - ok
13:31:38.0333 0x0a6c  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
13:31:38.0375 0x0a6c  SharedAccess - ok
13:31:38.0397 0x0a6c  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
13:31:38.0428 0x0a6c  ShellHWDetection - ok
13:31:38.0439 0x0a6c  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
13:31:38.0449 0x0a6c  SiSRaid2 - ok
13:31:38.0453 0x0a6c  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
13:31:38.0463 0x0a6c  SiSRaid4 - ok
13:31:38.0483 0x0a6c  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
13:31:38.0509 0x0a6c  Smb - ok
13:31:38.0540 0x0a6c  [ 446EB38CE4A6D040F548B2F547CA96FF, 3433C72426675EC7003F04E0016C470A011CA13AABC93A7AC0ED25CF0C6B5E2E ] snapman         C:\Windows\system32\DRIVERS\snapman.sys
13:31:38.0553 0x0a6c  snapman - ok
13:31:38.0571 0x0a6c  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
13:31:38.0588 0x0a6c  SNMPTRAP - ok
13:31:38.0599 0x0a6c  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
13:31:38.0609 0x0a6c  spldr - ok
13:31:38.0638 0x0a6c  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\Windows\System32\spoolsv.exe
13:31:38.0662 0x0a6c  Spooler - ok
13:31:38.0768 0x0a6c  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
13:31:38.0864 0x0a6c  sppsvc - ok
13:31:38.0877 0x0a6c  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
13:31:38.0908 0x0a6c  sppuinotify - ok
13:31:38.0941 0x0a6c  [ B9413B99DBB704E0F5824775A1118CC7, 75AAA548705764ECFB7A0C96E691AF80DBB824DC2BA8D356D8D157E6768F14C9 ] Spyder2         C:\Windows\system32\DRIVERS\Spyder2.sys
13:31:38.0949 0x0a6c  Spyder2 - ok
13:31:38.0977 0x0a6c  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
13:31:38.0995 0x0a6c  srv - ok
13:31:39.0014 0x0a6c  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
13:31:39.0033 0x0a6c  srv2 - ok
13:31:39.0051 0x0a6c  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
13:31:39.0070 0x0a6c  srvnet - ok
13:31:39.0083 0x0a6c  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
13:31:39.0118 0x0a6c  SSDPSRV - ok
13:31:39.0131 0x0a6c  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
13:31:39.0158 0x0a6c  SstpSvc - ok
13:31:39.0170 0x0a6c  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
13:31:39.0179 0x0a6c  stexstor - ok
13:31:39.0215 0x0a6c  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
13:31:39.0239 0x0a6c  stisvc - ok
13:31:39.0254 0x0a6c  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\drivers\swenum.sys
13:31:39.0263 0x0a6c  swenum - ok
13:31:39.0280 0x0a6c  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
13:31:39.0324 0x0a6c  swprv - ok
13:31:39.0335 0x0a6c  Synth3dVsc - ok
13:31:39.0392 0x0a6c  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
13:31:39.0448 0x0a6c  SysMain - ok
13:31:39.0468 0x0a6c  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
13:31:39.0488 0x0a6c  TabletInputService - ok
13:31:39.0505 0x0a6c  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
13:31:39.0534 0x0a6c  TapiSrv - ok
13:31:39.0545 0x0a6c  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
13:31:39.0576 0x0a6c  TBS - ok
13:31:39.0638 0x0a6c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
13:31:39.0682 0x0a6c  Tcpip - ok
13:31:39.0750 0x0a6c  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
13:31:39.0794 0x0a6c  TCPIP6 - ok
13:31:39.0812 0x0a6c  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
13:31:39.0835 0x0a6c  tcpipreg - ok
13:31:39.0849 0x0a6c  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
13:31:39.0862 0x0a6c  TDPIPE - ok
13:31:39.0923 0x0a6c  [ DF9179B7BDF0C5B71F9C3D93C016BAE5, F065E7ECEC27B4312A361A5C2AD388C10578250BAF31B20801B901449B736C77 ] tdrpman251      C:\Windows\system32\DRIVERS\tdrpm251.sys
13:31:39.0959 0x0a6c  tdrpman251 - ok
13:31:39.0976 0x0a6c  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
13:31:39.0991 0x0a6c  TDTCP - ok
13:31:40.0014 0x0a6c  [ 70988118145F5F10EF24720B97F35F65, F80C806417A68047FFB3D63214BC4AE5445315219AC594E043293006B704A63D ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
13:31:40.0026 0x0a6c  tdx - ok
13:31:40.0037 0x0a6c  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\drivers\termdd.sys
13:31:40.0047 0x0a6c  TermDD - ok
13:31:40.0081 0x0a6c  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
13:31:40.0111 0x0a6c  TermService - ok
13:31:40.0130 0x0a6c  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
13:31:40.0146 0x0a6c  Themes - ok
13:31:40.0162 0x0a6c  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
13:31:40.0187 0x0a6c  THREADORDER - ok
13:31:40.0218 0x0a6c  [ F7546EAD58CC3000AC02CF9529B9934E, 932A7A7AA50F207B97F52EF25CF2E38E57C2F88AC1AC203E1DC9CFA461CFA441 ] timounter       C:\Windows\system32\DRIVERS\timntr.sys
13:31:40.0242 0x0a6c  timounter - ok
13:31:40.0257 0x0a6c  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
13:31:40.0292 0x0a6c  TrkWks - ok
13:31:40.0319 0x0a6c  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
13:31:40.0346 0x0a6c  TrustedInstaller - ok
13:31:40.0368 0x0a6c  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
13:31:40.0383 0x0a6c  tssecsrv - ok
13:31:40.0408 0x0a6c  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
13:31:40.0425 0x0a6c  TsUsbFlt - ok
13:31:40.0428 0x0a6c  tsusbhub - ok
13:31:40.0454 0x0a6c  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
13:31:40.0496 0x0a6c  tunnel - ok
13:31:40.0509 0x0a6c  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
13:31:40.0519 0x0a6c  uagp35 - ok
13:31:40.0539 0x0a6c  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
13:31:40.0575 0x0a6c  udfs - ok
13:31:40.0587 0x0a6c  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
13:31:40.0600 0x0a6c  UI0Detect - ok
13:31:40.0630 0x0a6c  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
13:31:40.0640 0x0a6c  uliagpkx - ok
13:31:40.0661 0x0a6c  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
13:31:40.0677 0x0a6c  umbus - ok
13:31:40.0687 0x0a6c  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
13:31:40.0698 0x0a6c  UmPass - ok
13:31:40.0729 0x0a6c  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
13:31:40.0748 0x0a6c  UmRdpService - ok
13:31:40.0770 0x0a6c  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
13:31:40.0803 0x0a6c  upnphost - ok
13:31:40.0833 0x0a6c  [ B0435098C81D04CAFFF80DDB746CD3A2, A17B207740382E38729571F0B0BC98FF874E856A7C7CE9EB930328A2AD88F52A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys
13:31:40.0855 0x0a6c  usbaudio - ok
13:31:40.0878 0x0a6c  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
13:31:40.0903 0x0a6c  usbccgp - ok
13:31:40.0930 0x0a6c  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
13:31:40.0955 0x0a6c  usbcir - ok
13:31:41.0030 0x0a6c  [ 635686E528F2C9CB916EC1BB04EE6AD1, 080A0F209773232860F510F17005EF92650BA831F69BB0006AEF11A2BB0A4906 ] UsbClientService C:\Program Files (x86)\Synology\Assistant\UsbClientService.exe
13:31:41.0056 0x0a6c  UsbClientService - ok
13:31:41.0070 0x0a6c  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
13:31:41.0096 0x0a6c  usbehci - ok
13:31:41.0120 0x0a6c  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
13:31:41.0144 0x0a6c  usbhub - ok
13:31:41.0159 0x0a6c  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\Windows\system32\drivers\usbohci.sys
13:31:41.0174 0x0a6c  usbohci - ok
13:31:41.0193 0x0a6c  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
13:31:41.0208 0x0a6c  usbprint - ok
13:31:41.0225 0x0a6c  [ FED648B01349A3C8395A5169DB5FB7D6, DC4D7594C24ADD076927B9347F1B50B91CF03A4ABDB284248D5711D9C19DEB96 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
13:31:41.0239 0x0a6c  USBSTOR - ok
13:31:41.0252 0x0a6c  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
13:31:41.0274 0x0a6c  usbuhci - ok
13:31:41.0316 0x0a6c  [ 1F775DA4CF1A3A1834207E975A72E9D7, 6D3DE5BD3EF3A76E997E5BAF900C51D25308F5A9682D1F62017F577A24095B90 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
13:31:41.0334 0x0a6c  usbvideo - ok
13:31:41.0350 0x0a6c  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
13:31:41.0376 0x0a6c  UxSms - ok
13:31:41.0389 0x0a6c  [ B6C7729936AAF8E0697F0A7DCA82CED8, 9706E5234364488DD18527AAC82760E5ECB6EC9EBFDD4D04D2708D3C9C576FE6 ] VaultSvc        C:\Windows\system32\lsass.exe
13:31:41.0399 0x0a6c  VaultSvc - ok
13:31:41.0417 0x0a6c  [ FD911873C0BB6945FA38C16E9A2B58F9, EF8C833321449A6E8B671890F2EBC82ABC276B890D274AADDB626D763EE98964 ] VClone          C:\Windows\system32\DRIVERS\VClone.sys
13:31:41.0426 0x0a6c  VClone - ok
13:31:41.0443 0x0a6c  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
13:31:41.0452 0x0a6c  vdrvroot - ok
13:31:41.0483 0x0a6c  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
13:31:41.0533 0x0a6c  vds - ok
13:31:41.0550 0x0a6c  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
13:31:41.0563 0x0a6c  vga - ok
13:31:41.0576 0x0a6c  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
13:31:41.0619 0x0a6c  VgaSave - ok
13:31:41.0621 0x0a6c  VGPU - ok
13:31:41.0638 0x0a6c  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
13:31:41.0651 0x0a6c  vhdmp - ok
13:31:41.0679 0x0a6c  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
13:31:41.0688 0x0a6c  viaide - ok
13:31:41.0735 0x0a6c  [ 16073F2BC424558EBD277A15188D329E, A6FF88A52E25B865362A9621EA658F2E5B0481F3E510C4BF938B81FF785DD808 ] VMAuthdService  C:\Program Files (x86)\VMware\VMware Workstation\vmware-authd.exe
13:31:41.0745 0x0a6c  VMAuthdService - detected UnsignedFile.Multi.Generic ( 1 )
13:31:49.0207 0x0a6c  Detect skipped due to KSN trusted
13:31:49.0208 0x0a6c  VMAuthdService - ok
13:31:49.0248 0x0a6c  [ 87FC1DD880E8CAC4FAEBB84AF61A87C4, ED1B1B1DDEAA776E3CBFFDE4B8FC7FDD44A6DECEE8DEFC96EAFBFAB1ADF68A29 ] vmci            C:\Windows\system32\DRIVERS\vmci.sys
13:31:49.0269 0x0a6c  vmci - ok
13:31:49.0299 0x0a6c  [ B259C31378BC855AFD1B53F59311C251, 5FEDEC6EBA72652B89F57E275B25CC6333BE78FB2B74DEADDD588CE1089DCE89 ] VMnetAdapter    C:\Windows\system32\DRIVERS\vmnetadapter.sys
13:31:49.0308 0x0a6c  VMnetAdapter - ok
13:31:49.0331 0x0a6c  [ DEC4CE720FFEDA939CF1BA315CFBD993, B06BB836B824FC682F5FD84E1D6B313A4E99089A5CED2C14CC721D172C1E3C51 ] VMnetBridge     C:\Windows\system32\DRIVERS\vmnetbridge.sys
13:31:49.0342 0x0a6c  VMnetBridge - ok
13:31:49.0346 0x0a6c  VMnetDHCP - ok
13:31:49.0357 0x0a6c  [ 6B17D7FAD2D61D5A2C2B6D3EA25BDCA8, 4968A1D89D10DE09B3E32367B3CBDE05965DC01399FC91D1FA98E41E0D474561 ] VMnetuserif     C:\Windows\system32\drivers\vmnetuserif.sys
13:31:49.0368 0x0a6c  VMnetuserif - ok
13:31:49.0396 0x0a6c  [ 415B167695C4B5960A13098622EF3D80, E68AE845A6967E68FB22EB0F4D95631D041DA906801202F7662B22EAD34B2371 ] vmusb           C:\Windows\system32\Drivers\vmusb.sys
13:31:49.0408 0x0a6c  vmusb - ok
13:31:49.0458 0x0a6c  [ 18903CA7936912C337C9D28858880CF2, 6A3CF68E62AAF7DC22A299ADF7037D408CEB554BC36CD72C4C37AFEA16B84915 ] VMUSBArbService C:\Program Files (x86)\Common Files\VMware\USB\vmware-usbarbitrator64.exe
13:31:49.0481 0x0a6c  VMUSBArbService - ok
13:31:49.0486 0x0a6c  VMware NAT Service - ok
13:31:49.0806 0x0a6c  [ D580C4EDC87A6AC6C2E0607CCFA685F4, F133351FDD740DF7FB79F9AD705D12363655533E38D1859828A0537DF351F8D9 ] VMwareHostd     C:\Program Files (x86)\VMware\VMware Workstation\vmware-hostd.exe
13:31:50.0052 0x0a6c  VMwareHostd - detected UnsignedFile.Multi.Generic ( 1 )
13:31:57.0211 0x0a6c  Detect skipped due to KSN trusted
13:31:57.0215 0x0a6c  VMwareHostd - ok
13:31:57.0368 0x0a6c  [ E2A591ECC4525EB0B05C65A9B24CF05E, 8A7F826B91A28EC638C636A864BB77AE6E3744BE6F03E1AADCBF0ECD636F2EFE ] vmx86           C:\Windows\system32\drivers\vmx86.sys
13:31:57.0386 0x0a6c  vmx86 - ok
13:31:57.0410 0x0a6c  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
13:31:57.0434 0x0a6c  volmgr - ok
13:31:57.0464 0x0a6c  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
13:31:57.0484 0x0a6c  volmgrx - ok
13:31:57.0506 0x0a6c  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
13:31:57.0524 0x0a6c  volsnap - ok
13:31:57.0546 0x0a6c  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
13:31:57.0558 0x0a6c  vsmraid - ok
13:31:57.0614 0x0a6c  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
13:31:57.0672 0x0a6c  VSS - ok
13:31:57.0711 0x0a6c  [ 6107E33A30C0B923F31C872E1980D2D1, 5094C193997CDD50EEB15CB7AF96F2106BDE0BC675FDF83D7C3CE3F7299EE286 ] vstor2-mntapi10-shared C:\Windows\syswow64\drivers\vstor2-mntapi10-shared.sys
13:31:57.0727 0x0a6c  vstor2-mntapi10-shared - ok
13:31:57.0748 0x0a6c  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
13:31:57.0775 0x0a6c  vwifibus - ok
13:31:57.0802 0x0a6c  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
13:31:57.0845 0x0a6c  W32Time - ok
13:31:57.0859 0x0a6c  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
13:31:57.0869 0x0a6c  WacomPen - ok
13:31:57.0883 0x0a6c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
13:31:57.0910 0x0a6c  WANARP - ok
13:31:57.0914 0x0a6c  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
13:31:57.0939 0x0a6c  Wanarpv6 - ok
13:31:57.0995 0x0a6c  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
13:31:58.0041 0x0a6c  wbengine - ok
13:31:58.0056 0x0a6c  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
13:31:58.0073 0x0a6c  WbioSrvc - ok
13:31:58.0091 0x0a6c  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
13:31:58.0111 0x0a6c  wcncsvc - ok
13:31:58.0122 0x0a6c  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
13:31:58.0140 0x0a6c  WcsPlugInService - ok
13:31:58.0143 0x0a6c  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
13:31:58.0152 0x0a6c  Wd - ok
13:31:58.0184 0x0a6c  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
13:31:58.0208 0x0a6c  Wdf01000 - ok
13:31:58.0582 0x0a6c  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\Windows\system32\wdi.dll
13:31:58.0615 0x0a6c  WdiServiceHost - ok
13:31:58.0621 0x0a6c  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost   C:\Windows\system32\wdi.dll
13:31:58.0638 0x0a6c  WdiSystemHost - ok
13:31:58.0658 0x0a6c  [ 0EB0E5D22B1760F2DBCE632F2DD7A54D, B8A4CC62F88768947FB0A161CF9564DB28FD9C1C037B5475DF192982DE035C22 ] WebClient       C:\Windows\System32\webclnt.dll
13:31:58.0683 0x0a6c  WebClient - ok
13:31:58.0691 0x0a6c  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
13:31:58.0727 0x0a6c  Wecsvc - ok
13:31:58.0738 0x0a6c  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
13:31:58.0765 0x0a6c  wercplsupport - ok
13:31:58.0774 0x0a6c  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
13:31:58.0800 0x0a6c  WerSvc - ok
13:31:58.0803 0x0a6c  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
13:31:58.0827 0x0a6c  WfpLwf - ok
13:31:58.0840 0x0a6c  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
13:31:58.0848 0x0a6c  WIMMount - ok
13:31:58.0861 0x0a6c  WinDefend - ok
13:31:58.0872 0x0a6c  WinHttpAutoProxySvc - ok
13:31:58.0920 0x0a6c  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
13:31:58.0965 0x0a6c  Winmgmt - ok
13:31:59.0050 0x0a6c  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\Windows\system32\WsmSvc.dll
13:31:59.0100 0x0a6c  WinRM - ok
13:31:59.0130 0x0a6c  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
13:31:59.0143 0x0a6c  WinUsb - ok
13:31:59.0177 0x0a6c  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
13:31:59.0213 0x0a6c  Wlansvc - ok
13:31:59.0224 0x0a6c  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
13:31:59.0239 0x0a6c  WmiAcpi - ok
13:31:59.0252 0x0a6c  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
13:31:59.0266 0x0a6c  wmiApSrv - ok
13:31:59.0271 0x0a6c  WMPNetworkSvc - ok
13:31:59.0286 0x0a6c  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
13:31:59.0295 0x0a6c  WPCSvc - ok
13:31:59.0316 0x0a6c  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
13:31:59.0329 0x0a6c  WPDBusEnum - ok
13:31:59.0347 0x0a6c  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
13:31:59.0373 0x0a6c  ws2ifsl - ok
13:31:59.0384 0x0a6c  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
13:31:59.0399 0x0a6c  wscsvc - ok
13:31:59.0402 0x0a6c  WSearch - ok
13:31:59.0471 0x0a6c  [ 61FF576450CCC80564B850BC3FB6713A, B2843BC9E2F62D27DCF6787D063378926748CE75002BADA1873DCB5039883705 ] wuauserv        C:\Windows\system32\wuaueng.dll
13:31:59.0529 0x0a6c  wuauserv - ok
13:31:59.0546 0x0a6c  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
13:31:59.0556 0x0a6c  WudfPf - ok
13:31:59.0581 0x0a6c  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
13:31:59.0595 0x0a6c  WUDFRd - ok
13:31:59.0614 0x0a6c  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
13:31:59.0641 0x0a6c  wudfsvc - ok
13:31:59.0667 0x0a6c  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\Windows\System32\wwansvc.dll
13:31:59.0686 0x0a6c  WwanSvc - ok
13:31:59.0708 0x0a6c  ================ Scan global ===============================
13:31:59.0726 0x0a6c  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
13:31:59.0744 0x0a6c  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
13:31:59.0754 0x0a6c  [ 88EDD0B34EED542745931E581AD21A32, DC2B93E1CEF5B0BCEE08D72669BB0F3AD0E8E6E75BDC08858407ED92F6FFA031 ] C:\Windows\system32\winsrv.dll
13:31:59.0772 0x0a6c  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
13:31:59.0790 0x0a6c  [ 24ACB7E5BE595468E3B9AA488B9B4FCB, 63541E3432FCE953F266AE553E7A394978D6EE3DB52388D885F668CF42C5E7E2 ] C:\Windows\system32\services.exe
13:31:59.0797 0x0a6c  [ Global ] - ok
13:31:59.0797 0x0a6c  ================ Scan MBR ==================================
13:31:59.0810 0x0a6c  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
13:32:00.0076 0x0a6c  \Device\Harddisk0\DR0 - ok
13:32:00.0090 0x0a6c  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
13:32:00.0337 0x0a6c  \Device\Harddisk1\DR1 - ok
13:32:00.0341 0x0a6c  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk2\DR2
13:32:00.0407 0x0a6c  \Device\Harddisk2\DR2 - ok
13:32:00.0408 0x0a6c  ================ Scan VBR ==================================
13:32:00.0411 0x0a6c  [ 243740A26A2AA0A95B3429946FCCC961 ] \Device\Harddisk0\DR0\Partition1
13:32:00.0446 0x0a6c  \Device\Harddisk0\DR0\Partition1 - ok
13:32:00.0450 0x0a6c  [ 0C81DF881E5D9008475C9B4E4456AC79 ] \Device\Harddisk0\DR0\Partition2
13:32:00.0497 0x0a6c  \Device\Harddisk0\DR0\Partition2 - ok
13:32:00.0501 0x0a6c  [ 5EEA01B2C94B8023442E8D3C9FA77707 ] \Device\Harddisk1\DR1\Partition1
13:32:00.0550 0x0a6c  \Device\Harddisk1\DR1\Partition1 - ok
13:32:00.0554 0x0a6c  [ C622FC4D782C9379988D3FD60F35213D ] \Device\Harddisk1\DR1\Partition2
13:32:00.0604 0x0a6c  \Device\Harddisk1\DR1\Partition2 - ok
13:32:00.0608 0x0a6c  [ D097EFEA389B13A054E7AD99EA258D82 ] \Device\Harddisk2\DR2\Partition1
13:32:00.0707 0x0a6c  \Device\Harddisk2\DR2\Partition1 - ok
13:32:00.0708 0x0a6c  ================ Scan generic autorun ======================
13:32:00.0710 0x0a6c  NvCplDaemon - ok
13:32:00.0767 0x0a6c  [ C0FB9C45E749EAD86588755CE263AB4C, 2F819CE88F306DEA3DADE6CDA3BA5C9D903F0A99ACCC9E987C118A3E176D72FE ] C:\Program Files (x86)\Common Files\Acronis\Schedule2\schedhlp.exe
13:32:00.0789 0x0a6c  Acronis Scheduler2 Service - ok
13:32:00.0814 0x0a6c  [ 2A21FE60A9BC5247BD8C57409A2B97F8, 6C9851684FB90AB6038A326F4B362C1948DF2173063CA198DCEAEA6BFAC636E0 ] C:\Program Files (x86)\Elaborate Bytes\VirtualCloneDrive\VCDDaemon.exe
13:32:00.0823 0x0a6c  VirtualCloneDrive - ok
13:32:00.0988 0x0a6c  [ 120B482E4A0333ED3C7D6159DCAA3F4B, 887A63E33D0927240732EF1A6C445366BC91C96EC2EF794132CB4325D737CBBA ] C:\Program Files (x86)\Acronis\TrueImageHome\TrueImageMonitor.exe
13:32:01.0089 0x0a6c  TrueImageMonitor.exe - ok
13:32:01.0112 0x0a6c  [ 4B808F7A14F481734CB828E04E9F1A58, 4816FCC09EE1A501A734BECA94DCFB21291B762395A9CF1EF02777AA0B08A20B ] C:\Program Files (x86)\VMware\VMware Workstation\vmware-tray.exe
13:32:01.0121 0x0a6c  vmware-tray - ok
13:32:01.0159 0x0a6c  [ 46E91D8F23069D12CB990FE8A9B05CAA, 54C3677D42463DBE33C2390D72AB35C1FB76B0DB919F0237ED5DB03D08FA004E ] C:\Program Files (x86)\Canon\Canon IJ Network Scan Utility\CNMNSUT.exe
13:32:01.0173 0x0a6c  IJNetworkScanUtility - ok
13:32:01.0211 0x0a6c  [ 12E54BDE520DC85A611D7245DF44BCE5, 8F90F71AC97CE47D6A4F3491A48E3F857E8DEFD51E2DFDD528666AFC592E3B4E ] C:\Program Files (x86)\FreePDF_XP\fpassist.exe
13:32:01.0236 0x0a6c  FreePDF Assistant - detected UnsignedFile.Multi.Generic ( 1 )
13:32:09.0230 0x0a6c  Detect skipped due to KSN trusted
13:32:09.0230 0x0a6c  FreePDF Assistant - ok
13:32:09.0231 0x0a6c  ZoneAlarm Installer - ok
13:32:09.0310 0x0a6c  [ 182B036928F4C7111A1B7EF4CEE1B40C, 3FA7D5047DE519C1CD40394A51AB715F09A7F914519C81DB28888A21250BC3D4 ] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
13:32:09.0335 0x0a6c  avgnt - ok
13:32:09.0360 0x0a6c  [ CDB517386A26AE420CB24BDB3CD88779, BAF1EEA0B69A969E0641AAF371BAF51A130D2BAB91C6388F7F60C8904C463EE6 ] C:\Program Files (x86)\Common Files\Research In Motion\USB Drivers\RIMBBLaunchAgent.exe
13:32:09.0368 0x0a6c  RIMBBLaunchAgent.exe - ok
13:32:09.0392 0x0a6c  [ 308F2EE28005510DE616409148CF077B, A2126CB185B0053086BDD6F0A16A503F6CA629AC677E4B7AE6D43C770061D087 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
13:32:09.0405 0x0a6c  SunJavaUpdateSched - ok
13:32:09.0484 0x0a6c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
13:32:09.0521 0x0a6c  Sidebar - ok
13:32:09.0536 0x0a6c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
13:32:09.0551 0x0a6c  mctadmin - ok
13:32:09.0589 0x0a6c  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
13:32:09.0621 0x0a6c  Sidebar - ok
13:32:09.0626 0x0a6c  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
13:32:09.0641 0x0a6c  mctadmin - ok
13:32:09.0679 0x0a6c  [ CA9BF45EA9ED966B4683EAD60A81DDB5, 40652FC707A0DAAFF43C58D4582948293D158A375ACF5E862AC0DD1067E05CDD ] C:\Program Files (x86)\Allway Sync\Bin\syncappw.exe
13:32:09.0688 0x0a6c  Allway Sync - detected UnsignedFile.Multi.Generic ( 1 )
13:32:17.0262 0x0a6c  Detect skipped due to KSN trusted
13:32:17.0262 0x0a6c  Allway Sync - ok
13:32:17.0449 0x0a6c  [ D6E2ED7F1F7BE7CCB8676491BF950B57, CBF07EE746F2C27ACC532E83ADC43FBE954DC3C598C4333F13B1A7615AEA9AD5 ] C:\Users\admin\AppData\Local\Akamai\netsession_win.exe
13:32:17.0544 0x0a6c  Akamai NetSession Interface - ok
13:32:17.0548 0x0a6c  Waiting for KSN requests completion. In queue: 8
13:32:18.0548 0x0a6c  Waiting for KSN requests completion. In queue: 8
13:32:19.0548 0x0a6c  Waiting for KSN requests completion. In queue: 1
13:32:20.0548 0x0a6c  Waiting for KSN requests completion. In queue: 1
13:32:21.0548 0x0a6c  Waiting for KSN requests completion. In queue: 1
13:32:22.0548 0x0a6c  Waiting for KSN requests completion. In queue: 1
13:32:23.0548 0x0a6c  Waiting for KSN requests completion. In queue: 1
13:32:24.0548 0x0a6c  Waiting for KSN requests completion. In queue: 1
13:32:25.0548 0x0a6c  Waiting for KSN requests completion. In queue: 1
13:32:26.0588 0x0a6c  AV detected via SS2: Avira Desktop, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 15.0.8.644 ), 0x40000 ( disabled : updated )
13:32:26.0610 0x0a6c  Win FW state via NFP2: enabled
13:32:46.0611 0x0a6c  ============================================================
13:32:46.0611 0x0a6c  Scan finished
13:32:46.0611 0x0a6c  ============================================================
13:32:46.0622 0x1530  Detected object count: 0
13:32:46.0622 0x1530  Actual detected object count: 0
         

Malwarebytes Log:

Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.03.13.05
  rootkit: v2015.02.25.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17691
admin :: XPS8100 [administrator]

13.03.2015 12:39:15
mbar-log-2015-03-13 (12-39-15).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 344988
Time elapsed: 9 minute(s), 47 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         
sieht doch ganz gut aus oder??
__________________

Alt 13.03.2015, 17:28   #4
schrauber
/// the machine
/// TB-Ausbilder
 

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet - Standard

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet



ja alles gut
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 13.03.2015, 20:01   #5
funnsurfer
 
DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet - Standard

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet



Klasse! Vielen Dank für die Mühe!


Alt 14.03.2015, 10:35   #6
schrauber
/// the machine
/// TB-Ausbilder
 

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet - Standard

DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet



Gern Geschehen
__________________
--> DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet

Antwort

Themen zu DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet
adware, browser, converter, desktop, fehlercode 0x80000003, fehlercode 0xc0000005, fehlercode 28, fehlercode windows, firefox, flash player, homepage, install.exe, installation, programm, realtek, rundll, security, software, svchost.exe, synology, windows



Ähnliche Themen: DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet


  1. AVG schlägt Alarm - Datei aber nicht geöffnet - Risiko?
    Plagegeister aller Art und deren Bekämpfung - 22.10.2015 (10)
  2. Zip datei entpackt aber exe nicht geöffnet, Trojaner an Bord oder nicht?
    Plagegeister aller Art und deren Bekämpfung - 14.10.2015 (6)
  3. Auf einen Link geklickt, .exe Datei gedownloaded ABER nicht ausgeführt
    Plagegeister aller Art und deren Bekämpfung - 04.10.2015 (6)
  4. DHL Fake Link geöffnet, ZIP extrahiert und .exe Datei geöffnet
    Plagegeister aller Art und deren Bekämpfung - 02.06.2015 (10)
  5. DHL E-Mail Trojaner - Link NICHT geöffnet, aber Outlook stürzt ab
    Plagegeister aller Art und deren Bekämpfung - 01.06.2015 (8)
  6. DHL Phishing Mail - Link angeklickt - ZIP-Datei NICHT geöffnet / gelöscht
    Plagegeister aller Art und deren Bekämpfung - 11.05.2015 (8)
  7. UPS Phishing Mail geöffnet uns auf Link geklickt
    Log-Analyse und Auswertung - 02.04.2015 (24)
  8. Windows 7: DHL-Phishing-Mail geöffnet, auf den Link geklickt, .zip-File nicht heruntergeladen
    Log-Analyse und Auswertung - 10.03.2015 (13)
  9. (iPhone) Geklickt: Link geklickt
    Smartphone, Tablet & Handy Security - 15.11.2014 (2)
  10. Phising Mail von Paypal geöffnet und Link geklickt auf OSX -> Trojanerbefall?
    Plagegeister aller Art und deren Bekämpfung - 06.10.2014 (5)
  11. Fake E-Mail mit anhang erhalten. Dummerweise (.zip) datei heruntergeladen aber nicht geöffnet.
    Plagegeister aller Art und deren Bekämpfung - 08.08.2014 (16)
  12. paypal-Trojaner (zip email attachment geöffnet und auf die Datei geklickt)?
    Plagegeister aller Art und deren Bekämpfung - 07.08.2014 (3)
  13. Phishing Mail geöffnet, auf Link geklickt, nichts ist passiert - was tun?
    Log-Analyse und Auswertung - 18.06.2014 (7)
  14. Phishing Mail geöffnet, auf Link geklickt, nichts ist passiert - was tun?
    Plagegeister aller Art und deren Bekämpfung - 09.03.2014 (5)
  15. Pishing Mail Diba, Link geöffnet und ausgefüllt - aber nicht abgeschickt
    Plagegeister aller Art und deren Bekämpfung - 02.11.2013 (1)
  16. Battle.net Phishing Mail, Link geklickt, aber nichts eingegeben
    Plagegeister aller Art und deren Bekämpfung - 27.06.2013 (13)
  17. Unbekannte ZIP-Datei geöffnet, aber nicht entpackt
    Plagegeister aller Art und deren Bekämpfung - 22.06.2013 (14)

Zum Thema DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet - Hallo, ich habe gestern eine Mail von der DHL bekommen (scheinbar) und den Link der Sendungsverfolgung geklickt weil ich ein Paket erwarte und nicht auf die Absenderadresse (dasauge55@freenet) geachtet habe. - DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet...
Archiv
Du betrachtest: DHL Sendungsverfolgung Link geklickt aber ZIP Datei nicht geöffnet auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.