IE lässt sich nicht updaten, Defender wird blockiert

hillera · 18.03.2015, 16:02

Hallo
Irgendwas blockiert meinen Laptop teilweise. Windows-Vista 32. Beim starten kam immer eine Meldung dass Avira nicht ausgeführt werden kann. Im IE wurden Seiten blockiert aber im Google-Chrome nicht. Windows Defender kann nicht gestartet werden. Avira wurde neu installiert und funktioniert jetzt anscheinend wieder. IE wollte ich deinstallieren und neuinstallieren, aber die Neuinstallation funktioniert nicht.
Avira und Mbam hat zwar schadsoftware gefunden und entfernt, aber die probleme sind immer noch die gleichen.

Ich hoffe Ihr könnt mir helfen. Vielen dank.
Gruß hillera

schrauber · 18.03.2015, 16:07

hi,

Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop:

FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

Starte jetzt FRST.
Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

hillera · 18.03.2015, 19:13

hallo
hier die beiden logs. Diese wurden zwar erstellt, aber das Programm blieb irgendwann mit der Meldung "Getting Office Sessions errors: 1385" stehen. (ca 1,5h).

FRST.TXT

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Patrick (administrator) on PATRICK-PC on 18-03-2015 17:36:07
Running from C:\Users\Patrick\Desktop
Loaded Profiles: Patrick (Available profiles: Patrick)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 7 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\CompPtcVUI.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\BASVC.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Windows\System32\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
(Rocket Division Software) C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(AlcorMicro Co., Ltd.) C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\PdtWzd.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Acer Corp.) C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Hewlett-Packard Co.) C:\Program Files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Realtek Semiconductor Corp.) C:\Users\Patrick\AppData\Local\temp\RtkBtMnt.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\ieuser.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_16_0_0_305_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe
(Microsoft Corporation) C:\Windows\System32\mcbuilder.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ArcadeDeluxeAgent] => C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [156968 2009-01-21] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [202024 2009-01-21] (CyberLink)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [AmIcoSinglun] => C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [237568 2008-10-24] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6957600 2009-03-11] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-09-05] ()
HKLM\...\Run: [VitaKeyPdtWzd] => c:\Program Files\Acer Bio Protection\PdtWzd.exe [3549696 2009-02-13] (Egis Technology Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1410344 2008-12-05] (Synaptics, Inc.)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [870920 2009-02-24] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] => C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [249600 2009-04-11] (NewTech Infosystems, Inc.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-06-23] (Acer Incorporated)
HKLM\...\Run: [EgisTecLiveUpdate] => C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [PlayMovie] => C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [173288 2008-12-26] (Acer Corp.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [703280 2015-02-25] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [AlcoholAutomount] => C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe [203928 2009-09-30] (Alcohol Soft Development Team)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [HP Photosmart 6510 series (NET)] => C:\Program Files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe [1801064 2011-05-25] (Hewlett-Packard Co.)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3631448 2015-02-27] (Electronic Arts)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [413696 2009-01-22] (Acer)
Lsa: [Notification Packages] c:\Program Files\Acer Bio Protection\PwdFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
ShortcutTarget: Acer VCM.lnk -> C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKLM\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKLM\Software\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll [2012-12-17] (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-12-17] (Sun Microsystems, Inc.)
DPF: {538793D5-659C-4639-A56C-A179AD87ED44} https://rz-asa.hs-ulm.de/CACHE/stc/1/binaries/vpnweb.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-09] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll [2008-07-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default
FF DefaultSearchUrl: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-11] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=1.6.0_38 -> C:\Windows\system32\npdeployJava1.dll [2012-11-14] (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-360123627-3130887994-3134240397-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2014-12-14] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\searchplugins\keepmysearch.xml [2014-06-28]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Snap.Do  - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{c8b90241-fbd6-b3e4-4cc9-7ea41dff93db} [2013-11-14]
FF Extension: Greasemonkey - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2012-08-28]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} [2012-05-30]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-06-16]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2013-01-12]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-17]
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [Not Found]
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\fx@foxysecureKDJJHVLSDUVFU.com [Not Found]

Chrome: 
=======
CHR RestoreOnStartup: Default -> "hxxp://start.iminent.com/?appId=A455CC52-8EFB-4ED3-AA1E-20EE9CD10917"
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-20]
CHR Extension: (Google Search) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-20]
CHR Extension: (Avira Browser Safety) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-03-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-21]
CHR Extension: (Gmail) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-20]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-02-25] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-02-25] (Avira Operations GmbH & Co. KG)
R2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [75048 2008-12-18] ()
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [707104 2009-06-23] (Acer Incorporated)
R2 EvtEng; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [860160 2008-10-16] (Intel(R) Corporation) [File not signed]
R2 IGBASVC; c:\Program Files\Acer Bio Protection\BASVC.exe [3440640 2009-02-13] (Egis Technology Inc.) [File not signed]
S4 msvsmon80; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2799808 2005-09-23] (Microsoft Corporation)
R2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [61184 2009-04-11] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
S3 Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-12-18] ()
R2 RegSrvc; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [466944 2008-10-16] (Intel(R) Corporation) [File not signed]
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2008-11-27] (Acer Incorporated) [File not signed]
S3 SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2010-03-17] (SolidWorks) [File not signed]
R2 StarWindServiceAE; C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe [275968 2007-05-28] (Rocket Division Software) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [38440 2012-06-07] (Cisco Systems, Inc.)
S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [57256 2012-06-07] (Cisco Systems, Inc.)
R0 AlfaFF; C:\Windows\System32\drivers\AlfaFF.sys [42608 2009-02-13] (Alfa Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-12-17] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-02-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-02-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-02-25] (Avira Operations GmbH & Co. KG)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R1 ElRawDisk; C:\Windows\system32\drivers\dddsk.sys [22312 2009-02-12] (EldoS Corporation)
R2 FPSensor; C:\Windows\System32\Drivers\FPSensor.sys [26928 2008-12-24] (Egis)
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
R2 int15; c:\Windows\system32\drivers\int15.sys [69632 2009-02-13] () [File not signed]
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-12-17] ()
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] (Egis Incorporated.)
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] (Egis Incorporated.)
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] (Egis Incorporated.)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2009-12-17] () [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-02-25] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [87536 2008-12-26] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Patrick\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-18 17:36 - 2015-03-18 17:36 - 00021859 _____ () C:\Users\Patrick\Desktop\FRST.txt
2015-03-18 17:35 - 2015-03-18 17:36 - 00000000 ____D () C:\FRST
2015-03-18 17:34 - 2015-03-18 17:34 - 01135104 _____ (Farbar) C:\Users\Patrick\Desktop\FRST.exe
2015-03-18 14:43 - 2015-03-18 14:43 - 00012028 _____ () C:\ComboFix.txt
2015-03-18 13:51 - 2015-03-18 13:51 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Intel
2015-03-18 13:51 - 2015-03-18 13:51 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Intel
2015-03-18 13:50 - 2015-03-18 13:50 - 00000000 ____D () C:\Windows\LastGood.Tmp
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\ProgramData\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\Program Files\Common Files\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\Program Files\Cisco
2015-03-18 13:34 - 2015-03-18 13:34 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-03-16 18:14 - 2015-03-16 18:14 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Avira
2015-03-16 18:13 - 2015-03-16 18:13 - 00001851 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-03-16 18:13 - 2015-03-16 18:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-16 18:12 - 2015-02-25 17:54 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-03-16 18:07 - 2015-03-16 18:08 - 163016912 _____ () C:\Users\Patrick\Downloads\avira_free650_antivirus_de.exe
2015-03-16 18:02 - 2015-02-24 04:23 - 00246920 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-15 20:12 - 2015-03-18 14:43 - 00000000 ____D () C:\Qoobox
2015-03-15 20:12 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-15 20:12 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-15 20:12 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-15 20:11 - 2015-03-15 20:34 - 00000000 ____D () C:\Windows\erdnt
2015-03-14 13:46 - 2015-03-14 13:46 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-14 11:50 - 2015-01-29 02:35 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-14 11:49 - 2015-01-29 02:35 - 00975360 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-14 11:47 - 2015-02-26 01:18 - 02064384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-14 11:35 - 2015-02-20 03:03 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-14 11:35 - 2015-02-20 01:28 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-14 11:34 - 2015-02-26 03:01 - 03604408 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-03-14 11:34 - 2015-02-26 03:01 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-14 11:34 - 2015-01-21 03:02 - 00807936 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-14 11:34 - 2015-01-09 03:04 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-14 11:34 - 2015-01-09 01:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-14 11:33 - 2015-03-06 05:01 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-14 11:32 - 2015-02-18 03:02 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-14 11:32 - 2014-10-13 02:12 - 02264064 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll
2015-02-17 16:04 - 2015-02-17 16:04 - 01202848 _____ (Microsoft Corporation) C:\Windows\system32\FM20.DLL

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-18 17:28 - 2006-11-02 11:33 - 01597796 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-18 17:27 - 2009-09-05 16:39 - 01202671 _____ () C:\Windows\WindowsUpdate.log
2015-03-18 17:24 - 2014-09-20 14:30 - 00000000 ____D () C:\ProgramData\Origin
2015-03-18 17:22 - 2012-07-11 12:20 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-03-18 17:22 - 2010-03-17 10:18 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-18 17:21 - 2009-09-05 16:48 - 00220268 _____ () C:\ProgramData\nvModes.001
2015-03-18 17:21 - 2009-09-05 16:47 - 00220268 _____ () C:\ProgramData\nvModes.dat
2015-03-18 17:21 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-18 17:21 - 2006-11-02 13:47 - 00003824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-18 17:21 - 2006-11-02 13:47 - 00003824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-18 17:19 - 2008-01-21 03:47 - 01094706 _____ () C:\Windows\PFRO.log
2015-03-18 17:17 - 2006-11-02 14:01 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-18 17:12 - 2010-03-17 10:18 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-18 17:01 - 2012-12-27 17:33 - 00000260 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2015-03-18 16:43 - 2012-04-04 06:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-18 14:41 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2015-03-18 14:03 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-03-18 13:51 - 2009-10-24 16:19 - 00000000 ____D () C:\Users\Patrick
2015-03-18 13:51 - 2009-09-05 16:54 - 00014358 _____ () C:\Windows\DPINST.LOG
2015-03-18 13:51 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2015-03-18 13:51 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2015-03-18 13:49 - 2009-02-11 21:12 - 00000000 ____D () C:\Program Files\Intel
2015-03-18 13:38 - 2009-11-24 19:09 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Microsoft Help
2015-03-18 13:36 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2015-03-18 13:28 - 2011-05-18 06:54 - 00011780 _____ () C:\Windows\IE9_main.log
2015-03-18 13:01 - 2006-11-02 12:18 - 00000000 ___RD () C:\Windows\Offline Web Pages
2015-03-18 13:01 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-03-16 18:23 - 2009-03-12 04:26 - 00000000 ____D () C:\ProgramData\Temp
2015-03-16 18:12 - 2013-08-08 23:03 - 00000000 ____D () C:\Program Files\Avira
2015-03-16 18:04 - 2010-03-21 11:47 - 00007808 _____ () C:\Users\Patrick\AppData\Local\d3d9caps.dat
2015-03-16 17:51 - 2012-01-05 16:31 - 00000000 ____D () C:\ProgramData\Avira
2015-03-16 12:32 - 2014-07-20 22:54 - 00000000 ____D () C:\Windows\system32\mjcm
2015-03-16 10:29 - 2009-10-24 16:20 - 00000000 ____D () C:\Program Files\Google
2015-03-15 21:10 - 2009-03-12 03:59 - 00000000 ____D () C:\Program Files\Acer GameZone
2015-03-15 21:01 - 2009-12-16 09:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-15 21:00 - 2009-10-24 16:20 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2015-03-15 21:00 - 2009-10-24 16:20 - 00000000 ____D () C:\ProgramData\Google
2015-03-15 20:53 - 2013-11-09 13:38 - 00000901 _____ () C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-03-15 10:00 - 2006-11-02 13:52 - 00168874 _____ () C:\Windows\setupact.log
2015-03-15 08:38 - 2012-06-16 15:55 - 00000000 ____D () C:\Users\Patrick\Tracing
2015-03-14 12:56 - 2006-11-02 13:47 - 00396760 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-14 11:50 - 2009-03-12 04:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-14 11:47 - 2013-08-14 13:28 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-14 11:37 - 2006-11-02 11:24 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-03-13 19:17 - 2013-02-20 12:42 - 00001967 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-08 16:20 - 2010-03-10 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\PokerStars.NET
2015-03-08 16:19 - 2010-03-10 13:43 - 00000000 ____D () C:\Program Files\PokerStars.NET
2015-03-08 15:31 - 2011-01-05 12:37 - 00018183 _____ () C:\Users\Patrick\Desktop\Poker.xlsx
2015-02-27 10:23 - 2014-09-20 14:30 - 00000000 ____D () C:\Program Files\Origin
2015-02-22 11:25 - 2010-03-31 08:38 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\vlc

==================== Files in the root of some directories =======

2015-02-11 23:03 - 2015-02-11 23:03 - 6103040 _____ () C:\Program Files\GUT21F3.tmp
2009-12-18 10:53 - 2009-12-18 10:53 - 0139152 _____ () C:\Users\Patrick\AppData\Roaming\PnkBstrK.sys
2013-10-14 19:02 - 2013-10-14 19:02 - 0023888 _____ () C:\Users\Patrick\AppData\Roaming\UserTile.png
2009-10-24 16:28 - 2013-01-02 09:38 - 0000232 _____ () C:\Users\Patrick\AppData\Roaming\wklnhst.dat
2010-03-21 11:47 - 2015-03-16 18:04 - 0007808 _____ () C:\Users\Patrick\AppData\Local\d3d9caps.dat
2009-12-18 11:31 - 2014-10-10 21:14 - 0012288 _____ () C:\Users\Patrick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-02-28 18:24 - 2012-12-27 00:03 - 0000000 _____ () C:\Users\Patrick\AppData\Local\Temptable.xml
2011-01-11 11:35 - 2012-12-27 00:16 - 0018052 _____ () C:\Users\Patrick\AppData\Local\Temp_table.xml
2012-12-27 17:29 - 2012-12-27 17:29 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-03-12 04:26 - 2009-09-05 17:02 - 0004789 _____ () C:\ProgramData\ArcadeDeluxe2.log
2009-09-05 16:48 - 2015-03-18 17:21 - 0220268 _____ () C:\ProgramData\nvModes.001
2009-09-05 16:47 - 2015-03-18 17:21 - 0220268 _____ () C:\ProgramData\nvModes.dat

Some content of TEMP:
====================
C:\Users\Patrick\AppData\Local\temp\avgnt.exe
C:\Users\Patrick\AppData\Local\temp\RtkBtMnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed

Addition.txt

Code:

ATTFilter

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 11-03-2015
Ran by Patrick at 2015-03-18 17:36:46
Running from C:\Users\Patrick\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Data Recovery Suite version 3.0 (HKLM\...\{02386A56-080B-485c-941D-AF96B29140DD}_is1) (Version: 3.0 - SharpNight Co,Ltd)
7-Zip 9.20 (HKLM\...\7-Zip) (Version:  - )
Acer Arcade Deluxe (HKLM\...\InstallShield_{2637C347-9DAD-11D6-9EA2-00055D0CA761}) (Version: 2.5.6121 - CyberLink Corp.)
Acer Arcade Deluxe (Version: 2.5.6121 - CyberLink Corp.) Hidden
Acer Backup Manager (HKLM\...\InstallShield_{72B776E5-4530-4C4B-9453-751DF87D9D93}) (Version: 1.0.0.58 - NewTech Infosystems)
Acer Bio Protection (HKLM\...\InstallShield_{565A39D6-4FB0-4F35-A2AC-0DC66ACC3520}) (Version: 6.1.20 - Egis Technology Inc.)
Acer Crystal Eye webcam Ver:1.1.79.326 (HKLM\...\{D0ACE89D-EC7F-470F-80BE-4C98ED366B32}) (Version: 1.1.79.326 - Chicony Electronics Co.,Ltd.)
Acer eRecovery Management (HKLM\...\{7F811A54-5A09-4579-90E1-C93498E230D9}) (Version: 4.00.3008 - Acer Incorporated)
Acer GridVista (HKLM\...\GridVista) (Version: 2.72.317 - )
Acer PowerSmart Manager (HKLM\...\{3DB0448D-AD82-4923-B305-D001E521A964}) (Version: 4.01.3016 - Acer Incorporated)
Acer Product Registration (HKLM\...\{DA20E1A8-07CB-4EE7-9B72-A7E28C953F0E}) (Version: 3.0.0.10 - Acer Incorporated)
Acer ScreenSaver (HKLM\...\Acer Screensaver) (Version:  - Acer)
Acer VCM (HKLM\...\{047F790A-7A2A-4B6A-AD02-38092BA63DAC}) (Version: 4.00.3004 - Acer Incorporated)
Adobe Flash Player 16 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Flash Player 16 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 16.0.0.305 - Adobe Systems Incorporated)
Adobe Reader X (10.1.13) - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AA1000000001}) (Version: 10.1.13 - Adobe Systems Incorporated)
Agere Systems HDA Modem (HKLM\...\Agere Systems Soft Modem) (Version:  - Agere Systems)
AmIcoSingLun (HKLM\...\InstallShield_{BF91B300-EEBC-4223-96F3-0FCBF7241B50}) (Version: 1.2.117.1 - Alcor Micro Co., Ltd.)
AmIcoSingLun (Version: 1.2.117.1 - Alcor Micro Co., Ltd.) Hidden
ANNO 1404 (HKLM\...\{3D9CF3CA-3AB0-4A82-9853-D7C43FD1D775}) (Version: 1.00.0000 - Ubisoft)
Anno 1404 (Version: 1.00.0000 - Ubisoft) Hidden
Ashampoo Home Designer Pro v.1.0.1 (HKLM\...\{4D1A0101-17A2-4fca-9119-4734EDBDA12D}_is1) (Version: 1.0.1 - Creative Amadeo GmbH)
Avira Free Antivirus (HKLM\...\Avira AntiVir Desktop) (Version: 15.0.8.650 - Avira)
Backup Manager Basic (Version: 1.0.0.58 - NewTech Infosystems) Hidden
Broadcom Gigabit NetLink Controller (HKLM\...\{9AF0B106-56F1-461B-A270-95BC1682E282}) (Version: 11.34.02 - Broadcom Corporation)
C:\Program Files\Acer GameZone\GameConsole (HKLM\...\{71C2828F-2678-4675-BDEC-895424861262}_is1) (Version: 2.0.1.6 - Oberon Media, Inc.)
Choice Guard (Version: 1.2.87.0 - Microsoft Corporation) Hidden
Compatibility Pack für 2007 Office System (HKLM\...\{90120000-0020-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Cradle of Rome (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11219217}) (Version:  - Oberon Media)
Die Siedler 7 (HKLM\...\{63860309-DA8A-4BAE-9EAE-CE1D6D79340C}) (Version: 1.12.1396 - Ubisoft)
DirectX for Managed Code Update (Summer 2004) (Version: 9.02.2904 - Microsoft) Hidden
DiRT2 (HKLM\...\{52D1D62C-FEAB-4580-849E-1DB624BADBBD}) (Version: 1.00.0000 - Codemasters)
Dropbox (HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Dropbox) (Version: 2.0.6 - Dropbox, Inc.)
FIFA 10 (HKLM\...\{11202615-E557-4ECF-9B86-F59C81E52909}) (Version: 1.0.0.0 - Electronic Arts)
Fingerprint Solution (Version: 6.1.20.0 - Egis Technology Inc.) Hidden
FreeCAD 0.14 - A free open source CAD system (HKLM\...\FreeCAD 0.14) (Version: 0.14.3700 - Juergen Riegel)
Full Tilt Poker.Eu (HKLM\...\{127BEFB3-24B2-4B44-8E99-AD22C2A5A8ED}) (Version: 5.24.2.WIN.FullTilt.EU - )
FUSSBALL MANAGER 13 (HKLM\...\{80AF0300-866F-400F-A350-D53E3C3E34E0}) (Version: 1.0.0.0 - Electronic Arts)
Google Chrome (HKLM\...\Google Chrome) (Version: 41.0.2272.89 - Google Inc.)
Google Earth Plug-in (HKLM\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Grand Theft Auto IV (HKLM\...\{579BA58C-F33D-4970-9953-B94B43768AC3}) (Version: 1.00.0000 - Rockstar Games)
GRID (HKLM\...\{5A0B7BA5-4682-4273-81C2-69B17E649103}) (Version: 1.00.0000 - Codemasters)
HP Photo Creations (HKLM\...\HP Photo Creations) (Version: 1.0.0.5192 - HP Photo Creations)
HP Photosmart 6510 series - Grundlegende Software für das Gerät (HKLM\...\{779A7417-1FA7-4B69-81A5-601504959960}) (Version: 24.0.342.0 - Hewlett-Packard Co.)
HP Photosmart 6510 series Hilfe (HKLM\...\{A2F95F8C-CDA9-4B08-BAD1-CA9656E4EC14}) (Version: 140.0.2.2 - Hewlett Packard)
HP Update (HKLM\...\{85DF2EED-08BC-46FB-90DA-28B0D0A8E8A8}) (Version: 5.003.000.004 - Hewlett-Packard)
Intel(R) PROSet/Wireless WiFi-Software (HKLM\...\{35C0A1E4-D02A-412C-841F-266DBB116ABB}) (Version: 12.02.0000 - Intel(R) Corporation)
Java DB 10.5.3.0 (HKLM\...\{00BA866C-F2A2-4BB9-A308-3DFA695B6F7C}) (Version: 10.5.3.0 - Sun Microsystems, Inc)
Java(TM) 6 Update 38 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83216032FF}) (Version: 6.0.380 - Oracle)
Java-Editor 9.15d, 2010.09.28 (HKLM\...\{65FBA21B-7F80-4E4E-B275-0958D2648F94}_is1) (Version:  - Gerhard Röhner)
Jewel Master - Cradle Of Rome (HKLM\...\{BD11E3C6-065E-40BB-A129-435C4530A159}_is1) (Version:  - cerasus.media GmbH)
Jewel Quest Solitaire (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111771833}) (Version:  - Oberon Media)
Junk Mail filter update (Version: 14.0.8050.1202 - Microsoft Corporation) Hidden
KRASTA 9.4 DEMO (HKLM\...\KRASTA 9.4 DEMO_is1) (Version:  - )
Launch Manager (HKLM\...\LManager) (Version: 2.0.01 - Acer Inc.)
Luxor 2 (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-11170417}) (Version:  - Oberon Media)
Mahjong Escape Ancient China (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-111252743}) (Version:  - Oberon Media)
Microsoft .NET Framework 3.5 Language Pack SP1 - DEU (HKLM\...\Microsoft .NET Framework 3.5 Language Pack SP1 - deu) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 3.5 SP1 (HKLM\...\Microsoft .NET Framework 3.5 SP1) (Version:  - Microsoft Corporation)
Microsoft .NET Framework 4.5.1 (Deutsch) (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1031) (Version: 4.5.50938 - Microsoft Corporation)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM\...\{F2508213-9989-4E85-A078-72BE483917EF}) (Version: 3.5.88.0 - Microsoft Corporation)
Microsoft Games for Windows Marketplace (HKLM\...\{4CB0307C-565E-4441-86BE-0DF2E4FB828C}) (Version: 3.5.50.0 - Microsoft Corporation)
Microsoft Office 2003 Web Components (HKLM\...\{90120000-00A4-0409-0000-0000000FF1CE}) (Version: 12.0.6213.1000 - Microsoft Corporation)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office 2007 Service Pack 3 (SP3) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{6E107EB7-8B55-48BF-ACCB-199F86A2CD93}) (Version:  - Microsoft)
Microsoft Office Enterprise 2007 (HKLM\...\ENTERPRISE) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office File Validation Add-In (HKLM\...\{90140000-2005-0000-0000-0000000FF1CE}) (Version: 14.0.5130.5003 - Microsoft Corporation)
Microsoft Office Home and Student 2007 (HKLM\...\HOMESTUDENTR) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Live Add-in 1.5 (HKLM\...\{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}) (Version: 2.0.4024.1 - Microsoft Corporation)
Microsoft Office PowerPoint Viewer 2007 (German) (HKLM\...\{95120000-00AF-0407-0000-0000000FF1CE}) (Version: 12.0.6612.1000 - Microsoft Corporation)
Microsoft Office Suite Activation Assistant (HKLM\...\{E50AE784-FABE-46DA-A1F8-7B6B56DCB22E}) (Version: 2.9 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.30514.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2008 ATL Update kb973924 - x86 9.0.30729.4148 (HKLM\...\{002D9D5E-29BA-3E6D-9BC4-3D7D6DBC735C}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570 (HKLM\...\{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}) (Version: 9.0.30729.5570 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2005 Tools for Applications - ENU (HKLM\...\Microsoft Visual Studio 2005 Tools for Applications - ENU) (Version:  - Microsoft Corporation)
Microsoft Works (HKLM\...\{62F7DA7E-CCCB-439C-A760-00C3926E761F}) (Version: 9.7.0621 - Microsoft Corporation)
Mozilla Firefox 12.0 (x86 de) (HKLM\...\Mozilla Firefox 12.0 (x86 de)) (Version: 12.0 - Mozilla)
Mozilla Maintenance Service (HKLM\...\MozillaMaintenanceService) (Version: 12.0 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
MyWinLocker (HKLM\...\{68301905-2DEA-41CE-A4D4-E8B443B099BA}) (Version: 3.1.59.0 - Egis Technology Inc.)
NBA Live 2003 (HKLM\...\{9F60FF4E-725D-4B28-0094-FDADF5E73647}) (Version:  - )
NTI Backup Now 5 (HKLM\...\InstallShield_{12EFA1A4-AC3B-443C-8143-237EDE760403}) (Version: 5.1.2.616 - NewTech Infosystems)
NTI Backup Now Standard (Version: 5.1.2.616 - NewTech Infosystems) Hidden
NTI Media Maker 8 (HKLM\...\InstallShield_{2413930C-8309-47A6-BC61-5EF27A4222BC}) (Version: 8.0.2.6509 - NewTech Infosystems)
NTI Media Maker 8 (Version: 8.0.2.6509 - NewTech Infosystems) Hidden
Nuvoton EC Generic HID Driver (HKLM\...\{302E9B7B-2B6A-4C29-9A02-9F2110649779}) (Version: 7.80.5000 - Nuvoton Technology Corporation)
NVIDIA Drivers (HKLM\...\NVIDIA Drivers) (Version: 1.3 - NVIDIA Corporation)
NVIDIA HD-Audiotreiber 1.3.18.0 (HKLM\...\{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver) (Version: 1.3.18.0 - NVIDIA Corporation)
NVIDIA PhysX (HKLM\...\{1C4551A6-4743-4093-91E4-1477CD655043}) (Version: 9.09.0203 - NVIDIA Corporation)
OpenAL (HKLM\...\OpenAL) (Version:  - )
OpenOffice.org 3.1 (HKLM\...\{99E862CC-6F69-4D39-99AA-DBF71BF3B585}) (Version: 3.1.9420 - OpenOffice.org)
Origin (HKLM\...\Origin) (Version: 9.0.11.77 - Electronic Arts, Inc.)
Orion (HKLM\...\{5B63A470-9334-44D1-AF61-6CE2DB565AE9}) (Version: 2.5.0 - Convesoft)
PokerStars.net (HKLM\...\PokerStars.net) (Version:  - PokerStars.net)
PunkBuster Services (HKLM\...\PunkBusterSvc) (Version: 0.987 - Even Balance, Inc.)
Rapture3D 2.3.22 Game (HKLM\...\{D2FCA41E-AC01-4DCD-B3A7-DC9E32363065}}_is1) (Version:  - Blue Ripple Sound)
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.5807 - Realtek Semiconductor Corp.)
Snap.Do (HKLM\...\{234B821C-39E2-4771-B553-6D3A1AB62356}) (Version: 11.22.1.13233 - ReSoft Ltd.) <==== ATTENTION
Studie zur Verbesserung von HP Photosmart 6510 series Produkten (HKLM\...\{B5038398-984C-4F04-8879-938967868724}) (Version: 24.0.342.0 - Hewlett-Packard Co.)
Synaptics Pointing Device Driver (HKLM\...\SynTPDeinstKey) (Version: 12.1.0.0 - Synaptics)
Tom Clancy's H.A.W.X (HKLM\...\{6E36A172-06FB-4BC8-B7FC-D30D219E6776}) (Version: 1.02.00000 - Ubisoft)
Ubisoft Game Launcher (HKLM\...\{888F1505-C2B3-4FDE-835D-36353EBD4754}) (Version: 1.0.0.0 - UBISOFT)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{90120000-0030-0000-0000-0000000FF1CE}_ENTERPRISE_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update for 2007 Microsoft Office System (KB967642) (HKLM\...\{91120000-002F-0000-0000-0000000FF1CE}_HOMESTUDENTR_{C444285D-5E4F-48A4-91DD-47AAAA68E92D}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_ENTERPRISE_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Excel 2007 Help (KB963678) (HKLM\...\{90120000-0016-0407-0000-0000000FF1CE}_HOMESTUDENTR_{BEC163EC-7A83-48A1-BFB6-3BF47CC2F8CF}) (Version:  - Microsoft)
Update für Microsoft Office Outlook 2007 Help (KB963677) (HKLM\...\{90120000-001A-0407-0000-0000000FF1CE}_ENTERPRISE_{F6828576-6F79-470D-AB50-69D1BBADBD30}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_ENTERPRISE_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Powerpoint 2007 Help (KB963669) (HKLM\...\{90120000-0018-0407-0000-0000000FF1CE}_HOMESTUDENTR_{EA160DA3-E9B5-4D03-A518-21D306665B96}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_ENTERPRISE_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Update für Microsoft Office Word 2007 Help (KB963665) (HKLM\...\{90120000-001B-0407-0000-0000000FF1CE}_HOMESTUDENTR_{38472199-D7B6-4833-A949-10E4EE6365A1}) (Version:  - Microsoft)
Uplay (HKLM\...\Uplay) (Version: 4.7 - Ubisoft)
VLC media player 1.0.5 (HKLM\...\VLC media player) (Version: 1.0.5 - VideoLAN Team)
Windows Live Essentials (HKLM\...\WinLiveSuite_Wave3) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live ID Sign-in Assistant (HKLM\...\{0840B4D6-7DD1-4187-8523-E6FC0007EFB7}) (Version: 6.500.3165.0 - Microsoft Corporation)
Windows Live Sync (HKLM\...\{8C1E2925-14F8-45AA-B999-1E2A74BF5607}) (Version: 14.0.8050.1202 - Microsoft Corporation)
Windows Live-Uploadtool (HKLM\...\{205C6BDD-7B73-42DE-8505-9A093F35A238}) (Version: 14.0.8014.1029 - Microsoft Corporation)
WinRAR (HKLM\...\WinRAR archiver) (Version:  - )
Wolfenstein (HKLM\...\InstallShield_{F9B37992-968C-4264-8449-489032FC28DE}) (Version: 1.0 - Activision)
Wolfenstein (Version: 1.0 - Activision) Hidden
Zuma Deluxe (HKLM\...\{82C36957-D2B8-4EF2-B88C-5FA03AA848C7-110111700}) (Version:  - Oberon Media)

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-360123627-3130887994-3134240397-1000_Classes\CLSID\{005A3A96-BAC4-4B0A-94EA-C0CE100EA736}\localserver32 -> C:\Users\Patrick\AppData\Roaming\Dropbox\bin\Dropbox.exe (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-360123627-3130887994-3134240397-1000_Classes\CLSID\{1c492e6a-2803-5ed7-83e1-1b1d4d41eb39}\InprocServer32 -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll ()
CustomCLSID: HKU\S-1-5-21-360123627-3130887994-3134240397-1000_Classes\CLSID\{DF846759-BE0F-4451-B9D3-4BEFF765A1FD}\InprocServer32 -> C:\Users\Patrick\AppData\Local\ASKTOO~1\DOWNLO~1\AVIRAT~1.DLL No File
CustomCLSID: HKU\S-1-5-21-360123627-3130887994-3134240397-1000_Classes\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-360123627-3130887994-3134240397-1000_Classes\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-360123627-3130887994-3134240397-1000_Classes\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll (Dropbox, Inc.)
CustomCLSID: HKU\S-1-5-21-360123627-3130887994-3134240397-1000_Classes\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}\InprocServer32 -> C:\Users\Patrick\AppData\Roaming\Dropbox\bin\DropboxExt.19.dll (Dropbox, Inc.)

==================== Restore Points  =========================

18-03-2015 12:40:19 Windows Update
18-03-2015 12:53:44 Windows-Modulinstallation
18-03-2015 13:20:49 Windows-Modulinstallation
18-03-2015 13:27:18 Windows-Modulinstallation
18-03-2015 13:33:58 Windows Update

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2006-11-02 11:23 - 2006-09-18 22:41 - 00000761 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1             localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {0180660E-DC73-4D21-948C-741A2E005554} - System32\Tasks\HP Photo Creations Messager => C:\ProgramData\HP Photo Creations\MessageCheck.exe [2011-02-15] ()
Task: {2BBAF3B2-45FE-49D1-A0CE-C955BAF93A04} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-01] (Google Inc.)
Task: {67BBC60C-6093-464E-9950-42734969D305} - System32\Tasks\Microsoft\Windows Defender\MP Scheduled Signature Update => c:\program files\windows defender\MpCmdRun.exe [2008-01-21] (Microsoft Corporation)
Task: {6D58A9D3-5164-49C9-9E92-3BE208A1C561} - System32\Tasks\Recovery Management\Burn Notification => C:\Program Files\Acer\Acer eRecovery Management\NotificationCenter\Notification.exe [2009-04-20] (Acer)
Task: {6EF9D090-3A38-4977-BD94-DA135FEFF5A5} - System32\Tasks\HPCustParticipation HP Photosmart 6510 series => C:\Program Files\HP\HP Photosmart 6510 series\Bin\HPCustPartic.exe [2011-05-25] (Hewlett-Packard Co.)
Task: {73258906-2D19-4572-BF3E-0DC4C61678C9} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2014-12-19] (Adobe Systems Incorporated)
Task: {BEF05360-52A2-49CD-8FE1-E263B9340B61} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-02-11] (Adobe Systems Incorporated)
Task: {DB1D1937-FAB2-4EFE-AC0B-C918044F3826} - \Yahoo! Search No Task File <==== ATTENTION
Task: {F1B658A8-DC11-4251-86BF-1039850D4EEB} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-11-01] (Google Inc.)

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\HP Photo Creations Messager.job => C:\ProgramData\HP Photo Creations\MessageCheck.exe

==================== Loaded Modules (whitelisted) ==============

2008-10-16 16:57 - 2008-10-16 16:57 - 00200704 _____ () C:\Program Files\Intel\WiFi\bin\IWMSPROV.DLL
2009-03-12 04:28 - 2008-12-18 13:51 - 00075048 _____ () C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
2009-02-02 16:33 - 2009-02-02 16:33 - 00460199 _____ () C:\Program Files\NewTech Infosystems\Acer Backup Manager\sqlite3.dll
2008-09-28 16:55 - 2008-09-28 16:55 - 01076224 _____ () C:\Program Files\NewTech Infosystems\Acer Backup Manager\ACE.dll
2009-12-18 10:52 - 2009-12-18 10:52 - 00075064 _____ () C:\Windows\system32\PnkBstrA.exe
2009-01-21 00:41 - 2009-01-21 00:41 - 00872448 _____ () C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMediaLibrary.dll
2009-01-21 00:41 - 2009-01-21 00:41 - 00007680 _____ () C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvcPS.dll
2009-09-05 16:54 - 2009-09-05 16:54 - 00200704 _____ () C:\Windows\PLFSetI.exe
2009-09-06 01:22 - 2003-06-07 22:30 - 00057344 _____ () C:\Program Files\Launch Manager\PowerUtl.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)

AlternateDataStreams: C:\ProgramData\Temp:131C0EE9
AlternateDataStreams: C:\ProgramData\Temp:3064D21D
AlternateDataStreams: C:\ProgramData\Temp:35759C73
AlternateDataStreams: C:\ProgramData\Temp:41099CE9
AlternateDataStreams: C:\ProgramData\Temp:4F636E25
AlternateDataStreams: C:\ProgramData\Temp:798A3728
AlternateDataStreams: C:\ProgramData\Temp:814B9485
AlternateDataStreams: C:\ProgramData\Temp:9E22BBE8
AlternateDataStreams: C:\ProgramData\Temp:ABE89FFE
AlternateDataStreams: C:\ProgramData\Temp:B203B914
AlternateDataStreams: C:\ProgramData\Temp:B623B5B8
AlternateDataStreams: C:\ProgramData\Temp:BB24555F
AlternateDataStreams: C:\ProgramData\Temp:CDFF58FE
AlternateDataStreams: C:\ProgramData\Temp:CE0A077E
AlternateDataStreams: C:\ProgramData\Temp:DCAF903C

==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Control Panel\Desktop\\Wallpaper -> C:\Windows\Web\Wallpaper\img35.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-360123627-3130887994-3134240397-500 - Administrator - Disabled)
Gast (S-1-5-21-360123627-3130887994-3134240397-501 - Limited - Disabled)
Patrick (S-1-5-21-360123627-3130887994-3134240397-1000 - Administrator - Enabled) => C:\Users\Patrick

==================== Faulty Device Manager Devices =============

Name: 6TO4 Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: 6TO4 Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: 6TO4 Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: 6TO4 Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: 6TO4 Adapter
Description: Microsoft-6zu4-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.hs-ulm.de
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.hs-ulm.de
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.hs-ulm.de
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.hs-ulm.de
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{4E51EBD4-5E20-48A2-BEFE-2E7C29974FCB}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{4E51EBD4-5E20-48A2-BEFE-2E7C29974FCB}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{4E51EBD4-5E20-48A2-BEFE-2E7C29974FCB}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{4E51EBD4-5E20-48A2-BEFE-2E7C29974FCB}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{4E51EBD4-5E20-48A2-BEFE-2E7C29974FCB}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.fritz.box
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.fritz.box
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{1171FDDF-A64F-45FE-88D3-BCB341499B47}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.

Name: isatap.{77C17AF2-5BDA-4732-88F1-3E08F409708D}
Description: Microsoft-ISATAP-Adapter
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: tunnel
Problem: : This device cannot start. (Code10)
Resolution: Device failed to start. Click "Update Driver" to update the drivers for this device.
On the "General Properties" tab of the device, click "Troubleshoot" to start the troubleshooting wizard.


==================== Event log errors: =========================

Application errors:
==================
Error: (03/18/2015 05:22:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2015 05:22:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2015 05:22:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2015 05:22:03 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2015 05:21:12 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (03/18/2015 02:43:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2015 02:43:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2015 02:43:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2015 02:43:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (03/18/2015 02:43:25 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"1".
Die abhängige Assemblierung "msadctls,processorArchitecture="x86",type="win32",version="1.0.1801.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (03/18/2015 05:22:41 PM) (Source: DCOM) (EventID: 10016) (User: NT-AUTORITÄT)
Description: AnwendungsspezifischLokalStart{C97FCC79-E628-407D-AE68-A06AD6D8B4D1}NT-AUTORITÄTSYSTEMS-1-5-18LocalHost (unter Verwendung von LRPC)

Error: (03/18/2015 05:21:12 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Parallel port driver%%1058

Error: (03/18/2015 02:41:02 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: PEVSystemStart

Error: (03/18/2015 02:36:06 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: PEVSystemStart

Error: (03/18/2015 02:30:48 PM) (Source: Service Control Manager) (EventID: 7030) (User: )
Description: PEVSystemStart

Error: (03/18/2015 01:51:50 PM) (Source: ipnathlp) (EventID: 31004) (User: )
Description: 0 Bytes Speicher konnten durch den DNS-Proxy-Agenten nicht zugeordnet werden. Möglicherweise ist nicht genügend Speicher vorhanden oder ein interner Fehler ist im Speicher-Manager aufgetreten.

Error: (03/18/2015 01:28:10 PM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: Patrick-PC)
Description: Windows-Wartung konnte das Paket Internet Explorer_en-US (Language Pack) nicht in den Status Nicht vorhanden(Absent) setzen.

Error: (03/18/2015 01:28:10 PM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: Patrick-PC)
Description: Windows-Wartung konnte das Paket Microsoft-Windows-InternetExplorer-Package-Package-en-us-MiniLP (Feature Pack) nicht in den Status Nicht vorhanden(Absent) setzen.

Error: (03/18/2015 01:28:10 PM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: Patrick-PC)
Description: Windows-Wartung konnte das Paket VistaPlusUpdate (Update) nicht in den Status Wird aufgelöst(Resolving) setzen.

Error: (03/18/2015 01:28:10 PM) (Source: Microsoft-Windows-Servicing) (EventID: 4375) (User: Patrick-PC)
Description: Windows-Wartung konnte das Paket VistaSP1OnlyUpdate (Update) nicht in den Status Wird aufgelöst(Resolving) setzen.


Microsoft Office Sessions:
=========================
Error: (05/24/2014 00:04:36 PM) (Source: Microsoft Office 12 Sessions) (EventID: 7001) (User: )
Description: ID: 1, Application Name: Microsoft Office Excel, Application Version: 12.0.6683.5002, Microsoft Office Version: 12.0.6612.1000. This session lasted 3117 seconds with 2820 seconds of active time.  This session ended with a crash.

schrauber · 19.03.2015, 09:48

Lade Dir bitte von hier

Revo Uninstaller (alternativ portable Revo Uninstaller) herunter.

Installiere und starte das Programm. (Bebilderte Anleitung zu Revo Uninstaller)
Klicke auf Optionen und wähle als Sprache Deutsch.
Suche im Uninstallerfeld nach den Programmen:

Snap.Do
Wähle die Programme nacheinander aus und klicke jedes Mal auf Uninstall.
Wähle anschließend den Modus "Moderat" aus.
Reste löschen:
Klicke auf dann auf und dann auf .

Downloade dir bitte

Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.

Starte bitte die mbar.exe.
Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
Klicke auf den CleanUp Button und erlaube den Neustart.
Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
Nach dem Neustart starte die mbar.exe erneut.
Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.

Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

hillera · 19.03.2015, 11:55

Hi, Schrauber

hier mal die mbar-log:

Code:

ATTFilter

Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.03.19.03
  rootkit: v2015.02.25.01

Windows Vista Service Pack 2 x86 NTFS
Internet Explorer 7.0.6002.18005
Patrick :: PATRICK-PC [administrator]

19.03.2015 11:04:56
mbar-log-2015-03-19 (11-04-56).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Kernel memory modifications detected. Deep Anti-Rootkit Scan engaged.
Objects scanned: 0
Time elapsed: 38 second(s) [aborted]

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)

und die TDSS-log:

Code:

ATTFilter

11:42:40.0191 0x1784  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
11:42:48.0755 0x1784  ============================================================
11:42:48.0755 0x1784  Current date / time: 2015/03/19 11:42:48.0755
11:42:48.0755 0x1784  SystemInfo:
11:42:48.0755 0x1784  
11:42:48.0755 0x1784  OS Version: 6.0.6002 ServicePack: 2.0
11:42:48.0755 0x1784  Product type: Workstation
11:42:48.0755 0x1784  ComputerName: PATRICK-PC
11:42:48.0755 0x1784  UserName: Patrick
11:42:48.0755 0x1784  Windows directory: C:\Windows
11:42:48.0755 0x1784  System windows directory: C:\Windows
11:42:48.0755 0x1784  Processor architecture: Intel x86
11:42:48.0755 0x1784  Number of processors: 2
11:42:48.0755 0x1784  Page size: 0x1000
11:42:48.0755 0x1784  Boot type: Normal boot
11:42:48.0755 0x1784  ============================================================
11:42:48.0958 0x1784  KLMD registered as C:\Windows\system32\drivers\74543673.sys
11:42:49.0145 0x1784  System UUID: {C35936CA-2E16-3B31-00F7-F9704729536D}
11:42:50.0019 0x1784  Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 ( 465.76 Gb ), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
11:42:50.0019 0x1784  ============================================================
11:42:50.0019 0x1784  \Device\Harddisk0\DR0:
11:42:50.0019 0x1784  MBR partitions:
11:42:50.0019 0x1784  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x1388800, BlocksNum 0x389FD000
11:42:50.0019 0x1784  ============================================================
11:42:50.0050 0x1784  C: <-> \Device\Harddisk0\DR0\Partition1
11:42:50.0050 0x1784  ============================================================
11:42:50.0050 0x1784  Initialize success
11:42:50.0050 0x1784  ============================================================
11:44:58.0219 0x0b58  ============================================================
11:44:58.0219 0x0b58  Scan started
11:44:58.0219 0x0b58  Mode: Manual; SigCheck; TDLFS; 
11:44:58.0219 0x0b58  ============================================================
11:44:58.0219 0x0b58  KSN ping started
11:45:11.0651 0x0b58  KSN ping finished: true
11:45:12.0103 0x0b58  ================ Scan system memory ========================
11:45:12.0103 0x0b58  System memory - ok
11:45:12.0103 0x0b58  ================ Scan services =============================
11:45:12.0259 0x0b58  [ 82B296AE1892FE3DBEE00C9CF92F8AC7, 54B22BA63E1DA616B546992141B0C3117BA057283B8F60CB9BECE203661FEBF3 ] ACPI            C:\Windows\system32\drivers\acpi.sys
11:45:12.0431 0x0b58  ACPI - ok
11:45:12.0509 0x0b58  [ E850B0A94E8703CCBC980B31594DC408, E25E701142A9617165A10B3AB08C6D912FF0A96581D7F94DB38B2912F5D37A22 ] acsint          C:\Windows\system32\DRIVERS\acsint.sys
11:45:12.0540 0x0b58  acsint - ok
11:45:12.0571 0x0b58  [ EA2429C90AEAB09D7F3A99B16DA23CED, 1577692A20DCFEDD4EFC42B481B2EBC82F779BD4819B0A100B24B495DF15E342 ] acsmux          C:\Windows\system32\DRIVERS\acsmux.sys
11:45:12.0587 0x0b58  acsmux - ok
11:45:12.0743 0x0b58  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
11:45:12.0759 0x0b58  AdobeARMservice - ok
11:45:12.0961 0x0b58  [ 080255CDCB878813B481B8C348D47D8E, 75808821FBC732D0504795B8F85852E4C01D3B412989A1E597E1295CFF7B7A45 ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
11:45:12.0977 0x0b58  AdobeFlashPlayerUpdateSvc - ok
11:45:13.0055 0x0b58  [ 04F0FCAC69C7C71A3AC4EB97FAFC8303, FBBDD38574A1F66A5AA12B82E34FDE60B870180C4B7100C15757539DC869ED4B ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
11:45:13.0102 0x0b58  adp94xx - ok
11:45:13.0258 0x0b58  [ 60505E0041F7751BDBB80F88BF45C2CE, 1DE16042B8ABD7B643189E836DE273832EE743FD66AFBB641E8049C4E0CD04D8 ] adpahci         C:\Windows\system32\drivers\adpahci.sys
11:45:13.0305 0x0b58  adpahci - ok
11:45:13.0336 0x0b58  [ 8A42779B02AEC986EAB64ECFC98F8BD7, B89938EFF4E81FA44197D2D839EBD3340DDE01FBC79605049C088621784C1B91 ] adpu160m        C:\Windows\system32\drivers\adpu160m.sys
11:45:13.0351 0x0b58  adpu160m - ok
11:45:13.0492 0x0b58  [ 241C9E37F8CE45EF51C3DE27515CA4E5, 1A03E93DD8C1F3640C96124A14A3D0F4E349B06CCA2118CE40B8AE201A4030A7 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
11:45:13.0507 0x0b58  adpu320 - ok
11:45:13.0570 0x0b58  [ 9D1FDA9E086BA64E3C93C9DE32461BCF, 200FD0BFC811EC8993AF9FC78F58823ECC717063F438B627FBCDD6BD7790CAA8 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
11:45:13.0679 0x0b58  AeLookupSvc - ok
11:45:13.0866 0x0b58  [ F5272A105F59A7B3B345D9D6D87DA7AD, 9E84776994D04240BF2537330DBB555EDE16DFCFC59DEDCBA05A44ED7F70BEFA ] AFD             C:\Windows\system32\drivers\afd.sys
11:45:13.0944 0x0b58  AFD - ok
11:45:14.0022 0x0b58  [ EFBC44FBD75E4F80BD927AEBF6E7EADE, 0A1ACFE5D007DF8ABB97081C93111A1F18D90CB34093CD5784588971BFE86AE7 ] AgereModemAudio C:\Windows\system32\agrsmsvc.exe
11:45:14.0069 0x0b58  AgereModemAudio - ok
11:45:14.0131 0x0b58  [ 38325C6AA8EAE011897D61CE48EC6435, 6F96F992022692E354BB61610936F39EA89F31F58135D0F5339A3690402F74ED ] AgereSoftModem  C:\Windows\system32\DRIVERS\AGRSM.sys
11:45:14.0334 0x0b58  AgereSoftModem - ok
11:45:14.0381 0x0b58  [ 13F9E33747E6B41A3FF305C37DB0D360, 066DD6060B1CF93F85BBAAA52848C801128CD294E8B7EACD912E0EF219DBFBC2 ] agp440          C:\Windows\system32\drivers\agp440.sys
11:45:14.0397 0x0b58  agp440 - ok
11:45:14.0459 0x0b58  [ AE1FDF7BF7BB6C6A70F67699D880592A, B831BF156FC49287A19FC149383D437B1034EA6F42CE9D761EB90ABD0F8D96B1 ] aic78xx         C:\Windows\system32\drivers\djsvs.sys
11:45:14.0475 0x0b58  aic78xx - ok
11:45:14.0553 0x0b58  [ 4490B8BDF38750458EB9B24835FDA8FE, 94C2CEFAF97099843169B78D9A4D038674C2BF69816245C49AD0B5218CC03557 ] AlfaFF          C:\Windows\system32\drivers\AlfaFF.sys
11:45:14.0568 0x0b58  AlfaFF - ok
11:45:14.0584 0x0b58  [ A1545B731579895D8CC44FC0481C1192, 6B0EE833BA39C142D625A03586CCD8F6C9C3136C603CE5DF5BAC1AA3423E3E7F ] ALG             C:\Windows\System32\alg.exe
11:45:14.0724 0x0b58  ALG - ok
11:45:14.0755 0x0b58  [ 9EAEF5FC9B8E351AFA7E78A6FAE91F91, 0EADB6AE21FEDAB55D41F41B638198B556CC2BE2EE57F6C8B40EB044A318319F ] aliide          C:\Windows\system32\drivers\aliide.sys
11:45:14.0771 0x0b58  aliide - ok
11:45:14.0787 0x0b58  [ C47344BC706E5F0B9DCE369516661578, 689C9CDAF6F38227F1C34359CAEB3C7798F318EDFD4B7FE532FBE3C8E4EE3DC8 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
11:45:14.0802 0x0b58  amdagp - ok
11:45:14.0818 0x0b58  [ 9B78A39A4C173FDBC1321E0DD659B34C, 2CA66EB68AD7A317D91C13B8CFD4E8CA985926A610D19595B613F5553B145C7B ] amdide          C:\Windows\system32\drivers\amdide.sys
11:45:14.0818 0x0b58  amdide - ok
11:45:14.0849 0x0b58  [ 18F29B49AD23ECEE3D2A826C725C8D48, 0FA08882301D218E367E63E1966B6406220EE94BAE7E7DAD6E55EB70BF6FED7F ] AmdK7           C:\Windows\system32\drivers\amdk7.sys
11:45:14.0896 0x0b58  AmdK7 - ok
11:45:14.0896 0x0b58  [ 93AE7F7DD54AB986A6F1A1B37BE7442D, ECE0ABA2DECEED94AC678240A4B604F04022F0740F2295CBD07D25F5917E878A ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
11:45:14.0943 0x0b58  AmdK8 - ok
11:45:15.0130 0x0b58  [ 624D29E2D70F83147A79043FD0024D1D, 8B9D4692529155893E3E73E2CF1B0A36354C7032C9524FDCBC5D57562F7F0342 ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
11:45:15.0161 0x0b58  AntiVirSchedulerService - ok
11:45:15.0239 0x0b58  [ 624D29E2D70F83147A79043FD0024D1D, 8B9D4692529155893E3E73E2CF1B0A36354C7032C9524FDCBC5D57562F7F0342 ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
11:45:15.0270 0x0b58  AntiVirService - ok
11:45:15.0395 0x0b58  [ 7983B808D27CEFADD0BCBCAB30736B5B, 5E723476EF71F4C7AFC9E65113F6E78357DC908ED6E09F1142C4DB19B78DC5EF ] AntiVirWebService C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
11:45:15.0473 0x0b58  AntiVirWebService - ok
11:45:15.0535 0x0b58  [ 8F7D200717A58E9800D391F4C2101577, F07CF0F5636F46D8F3D5133284943E991E8739E5A644BCA5F18BB896B374620D ] Appinfo         C:\Windows\System32\appinfo.dll
11:45:15.0582 0x0b58  Appinfo - ok
11:45:15.0598 0x0b58  [ 5D2888182FB46632511ACEE92FDAD522, 2E53231ACAF9B2FB7993DBC1CD15C06D7B0CCE0D08DAFF7B0CC13A2040028A75 ] arc             C:\Windows\system32\drivers\arc.sys
11:45:15.0613 0x0b58  arc - ok
11:45:15.0645 0x0b58  [ 5E2A321BD7C8B3624E41FDEC3E244945, 9D47FF6C823868F2267FEFAB5851D3CD2BC3F619A2D6EFF803EA22DB0509C450 ] arcsas          C:\Windows\system32\drivers\arcsas.sys
11:45:15.0660 0x0b58  arcsas - ok
11:45:15.0863 0x0b58  [ 537B2948976F5D9B5767B74A63EBB395, 1A14F8B582E74AD15B612EDA5B707AA3CB0B2A107ED14572B4232EAA7383B634 ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
11:45:15.0879 0x0b58  aspnet_state - ok
11:45:15.0957 0x0b58  [ 53B202ABEE6455406254444303E87BE1, 4C91CA8DD345FEDD74A6AF2C07580717703F979B7DE2532B1D00B9F6896DDE70 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
11:45:16.0003 0x0b58  AsyncMac - ok
11:45:16.0019 0x0b58  [ 1F05B78AB91C9075565A9D8A4B880BC4, 737BE9F9376DAB0CCDFED93EA6D67F0C432367EA63CD772A453485BE769AF3BD ] atapi           C:\Windows\system32\drivers\atapi.sys
11:45:16.0035 0x0b58  atapi - ok
11:45:16.0113 0x0b58  [ F0D933B42CD0594048E4D5200AE9E417, FF53E843A99948568515964C3C97107FA875BBC3F2906BADEE0B29ACE5532F0D ] atksgt          C:\Windows\system32\DRIVERS\atksgt.sys
11:45:16.0128 0x0b58  atksgt - ok
11:45:16.0191 0x0b58  [ 8E98A99187FF17FC1D48E6FAFFD870BE, 7C935191A0A2BA95CA9A9E450F7C8802E6184F73BC297E91908B59F34C22AB06 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
11:45:16.0284 0x0b58  AudioEndpointBuilder - ok
11:45:16.0331 0x0b58  [ 8E98A99187FF17FC1D48E6FAFFD870BE, 7C935191A0A2BA95CA9A9E450F7C8802E6184F73BC297E91908B59F34C22AB06 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
11:45:16.0362 0x0b58  Audiosrv - ok
11:45:16.0440 0x0b58  [ AF5DA81B19AFA730F1E5246AD81D140A, 532951071F56896A3B5D47874C14D996C8620EA02F87D4BA21B083EC804FB166 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
11:45:16.0456 0x0b58  avgntflt - ok
11:45:16.0518 0x0b58  [ A5674637BCA212D9FE136ADFA04C9857, 95F3632EBB041C539816D285EBE1F379D46A4187379C69D4683D9F4DECBDB80C ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
11:45:16.0534 0x0b58  avipbb - ok
11:45:16.0581 0x0b58  [ D8C712305F73CD34D1B344810E522728, 49A474FF6CA44E8427D7A8290B47395125B0148AF384CF2B3B1FA495A4718CBA ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
11:45:16.0596 0x0b58  avkmgr - ok
11:45:16.0674 0x0b58  [ 502F1C30BD50B32D00CE4DCAECC3D3C7, F1F74D821C0D436C438313B522704F5DCA38A008725B74C2F6659ACAABDB210C ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
11:45:16.0705 0x0b58  b57nd60x - ok
11:45:16.0737 0x0b58  [ 67E506B75BD5326A3EC7B70BD014DFB6, 3B07243970CAB4E93A858BEA6E31F56AD0157C42D624F3FEB469E68EEEF65669 ] Beep            C:\Windows\system32\drivers\Beep.sys
11:45:16.0799 0x0b58  Beep - ok
11:45:16.0861 0x0b58  [ C789AF0F724FDA5852FB9A7D3A432381, 4B0F7A3A8F2D45E49630D24F2630B8014BCDB793B9C6E83FD2B2863A54F62BF5 ] BFE             C:\Windows\System32\bfe.dll
11:45:16.0986 0x0b58  BFE - ok
11:45:17.0049 0x0b58  [ 93952506C6D67330367F7E7934B6A02F, 1D9A6B10B9489C1A32F730E22CC399BFF0796E3FCB3BA52BE45ED487CAC59EBD ] BITS            C:\Windows\system32\qmgr.dll
11:45:17.0236 0x0b58  BITS - ok
11:45:17.0267 0x0b58  [ D4DF28447741FD3D953526E33A617397, E7239BA432090F8AC7DF453DB876507CD4419ECA964D289408A1B2B353618693 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
11:45:17.0361 0x0b58  blbdrive - ok
11:45:17.0407 0x0b58  [ 35F376253F687BDE63976CCB3F2108CA, C5EF6301D7BC067050038DB75D961681D1CBE418285AD60167C1334B0B54DFE9 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
11:45:17.0470 0x0b58  bowser - ok
11:45:17.0501 0x0b58  [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo        C:\Windows\system32\drivers\brfiltlo.sys
11:45:17.0548 0x0b58  BrFiltLo - ok
11:45:17.0579 0x0b58  [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp        C:\Windows\system32\drivers\brfiltup.sys
11:45:17.0626 0x0b58  BrFiltUp - ok
11:45:17.0657 0x0b58  [ A3629A0C4226F9E9C72FAAEEBC3AD33C, FB4D2738B64AADA52B95A6CF7ED4CDBFE4DD4BEBCAF1AE9CE64317F97DB38DDF ] Browser         C:\Windows\System32\browser.dll
11:45:17.0688 0x0b58  Browser - ok
11:45:17.0704 0x0b58  [ B304E75CFF293029EDDF094246747113, CB6B219B186C3511A0DE3CDE7F7B8966A9E32D808A952CA8C5B42B3A3A17BFB0 ] Brserid         C:\Windows\system32\drivers\brserid.sys
11:45:17.0860 0x0b58  Brserid - ok
11:45:17.0891 0x0b58  [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm        C:\Windows\system32\drivers\brserwdm.sys
11:45:17.0953 0x0b58  BrSerWdm - ok
11:45:17.0985 0x0b58  [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm        C:\Windows\system32\drivers\brusbmdm.sys
11:45:18.0047 0x0b58  BrUsbMdm - ok
11:45:18.0063 0x0b58  [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer        C:\Windows\system32\drivers\brusbser.sys
11:45:18.0125 0x0b58  BrUsbSer - ok
11:45:18.0141 0x0b58  [ AD07C1EC6665B8B35741AB91200C6B68, DCE1305A30D6713222A01C1F1D03ED0ADABE23C742CE1E82BB142531B82A3FF7 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
11:45:18.0187 0x0b58  BTHMODEM - ok
11:45:18.0265 0x0b58  catchme - ok
11:45:18.0281 0x0b58  [ 7ADD03E75BEB9E6DD102C3081D29840A, 0CA14A77CE990B5AA32C0725C22CA190ECBC73B75064DD959CABAD79B8846F1D ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
11:45:18.0328 0x0b58  cdfs - ok
11:45:18.0343 0x0b58  [ 6B4BFFB9BECD728097024276430DB314, 4451EFEAD37B05C8A3CB610B6D72E73B55D3D1E1CC1B17405598C1EDAA93C2D5 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
11:45:18.0375 0x0b58  cdrom - ok
11:45:18.0421 0x0b58  [ 312EC3E37A0A1F2006534913E37B4423, 81B8F462336791D162DAFA8092C1F437638DA3022CA24A2458B9FE183FC18C5D ] CertPropSvc     C:\Windows\System32\certprop.dll
11:45:18.0453 0x0b58  CertPropSvc - ok
11:45:18.0484 0x0b58  [ E5D4133F37219DBCFE102BC61072589D, 74C7F8C53D9C71CE3C8B33BC0331948571318402B0A8E1AC4552360504092A46 ] circlass        C:\Windows\system32\drivers\circlass.sys
11:45:18.0515 0x0b58  circlass - ok
11:45:18.0562 0x0b58  [ D7659D3B5B92C31E84E53C1431F35132, 6BFE644AD9890A8CEEDCC4B97ADD564AD57202FBC5D21599469E0C4B31BB27C6 ] CLFS            C:\Windows\system32\CLFS.sys
11:45:18.0577 0x0b58  CLFS - ok
11:45:18.0687 0x0b58  [ 2B272D0A6E5071829B516FFDC7F841CA, A830A47AAC9562C16935BD48C6F342451F4BEBFB5724ABB4825D61971C8A0680 ] CLHNService     C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
11:45:18.0687 0x0b58  CLHNService - ok
11:45:18.0858 0x0b58  [ 6B6943A0CA56B47D6FB2EE476890854F, 6DA779879487F4A187DF54B0362642643D7871AA8F7E30992D781F558C50F052 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
11:45:18.0874 0x0b58  clr_optimization_v2.0.50727_32 - ok
11:45:18.0952 0x0b58  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
11:45:18.0967 0x0b58  clr_optimization_v4.0.30319_32 - ok
11:45:19.0014 0x0b58  [ 99AFC3795B58CC478FBBBCDC658FCB56, 0D1B27C42A058C5D56A0157B5ECA9A054254F6B9C8015D0321021A7EFCE10CE2 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
11:45:19.0045 0x0b58  CmBatt - ok
11:45:19.0061 0x0b58  [ 0CA25E686A4928484E9FDABD168AB629, C2CB2333CAB40CDF93219870E66700F957188C86A1B1A004BC4652953091E5C5 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
11:45:19.0077 0x0b58  cmdide - ok
11:45:19.0123 0x0b58  [ 6AFEF0B60FA25DE07C0968983EE4F60A, E4037EF9EDE57A1039AB814EBCE9A8B12C9A084E7FAC6296212ACF2394DD37B6 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
11:45:19.0139 0x0b58  Compbatt - ok
11:45:19.0139 0x0b58  COMSysApp - ok
11:45:19.0201 0x0b58  [ 741E9DFF4F42D2D8477D0FC1DC0DF871, 06EA43D771E3455F943AB624CC00C2259FE5E561164908630755E933EF44A522 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
11:45:19.0217 0x0b58  crcdisk - ok
11:45:19.0248 0x0b58  [ 1F07BECDCA750766A96CDA811BA86410, F4E36F0003184BCB36D59B23AC903421AD8C0A1FD2D6315E06375235ABC9A0AD ] Crusoe          C:\Windows\system32\drivers\crusoe.sys
11:45:19.0279 0x0b58  Crusoe - ok
11:45:19.0342 0x0b58  [ 684C130BBC6DB681BAD4920A4C944AA5, DDE434B206984808351C98500824A33E6740B4326C455066027F8D549D4C3B92 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
11:45:19.0451 0x0b58  CryptSvc - ok
11:45:19.0498 0x0b58  [ B5ECADF7708960F1818C7FA015F4C239, A58BA71B08A9D46EB79EB3DF0858F553A11DE3461E13B6D926E25D21D4CBB2D8 ] CVirtA          C:\Windows\system32\DRIVERS\CVirtA.sys
11:45:19.0545 0x0b58  CVirtA - ok
11:45:19.0607 0x0b58  [ 3B5B4D53FEC14F7476CA29A20CC31AC9, EC02A412DA5FDE2C759A4A2C5904579E1CE7C4999CE87145812F354FC8F5E183 ] DcomLaunch      C:\Windows\system32\rpcss.dll
11:45:19.0732 0x0b58  DcomLaunch - ok
11:45:19.0857 0x0b58  [ 622C41A07CA7E6DD91770F50D532CB6C, 2A9040949CB45F9970FDE930278F30D2F08E957290CB3D4DC4F2CA94F3D444D2 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
11:45:19.0935 0x0b58  DfsC - ok
11:45:20.0028 0x0b58  [ 2CC3DCFB533A1035B13DCAB6160AB38B, C88C91F662ADE248EEE3B568E70C2BC2D5075B7D9B7D3C63E83D011C5F7812B0 ] DFSR            C:\Windows\system32\DFSR.exe
11:45:20.0356 0x0b58  DFSR - ok
11:45:20.0418 0x0b58  [ 9028559C132146FB75EB7ACF384B086A, 35159D86706441ED94895B4629411B4445FCB4526AFD1F7036EE647931B7A94D ] Dhcp            C:\Windows\System32\dhcpcsvc.dll
11:45:20.0465 0x0b58  Dhcp - ok
11:45:20.0481 0x0b58  [ 5D4AEFC3386920236A548271F8F1AF6A, 11B74D6800EC6F7AAEFB0B6A9F2E8376C7C3B8DB677F03AC3743CB004CA96B08 ] disk            C:\Windows\system32\drivers\disk.sys
11:45:20.0496 0x0b58  disk - ok
11:45:20.0527 0x0b58  [ 73BAF270D24FE726B9CD7F80BB17A23D, 12ADFB26C16A7D3F623C1A6B72D4C6AB9163EBC93CF13CB2AC6897FB95E96105 ] DKbFltr         C:\Windows\system32\DRIVERS\DKbFltr.sys
11:45:20.0543 0x0b58  DKbFltr - ok
11:45:20.0605 0x0b58  [ 57D762F6F5974AF0DA2BE88A3349BAAA, D9E7DC8F9FB7837F88BBB95B52147AA80E688FB9762EEA99B8046D9C6AD48F3C ] Dnscache        C:\Windows\System32\dnsrslvr.dll
11:45:20.0637 0x0b58  Dnscache - ok
11:45:20.0668 0x0b58  [ 324FD74686B1EF5E7C19A8AF49E748F6, DC6EB4304555B60DD17E04D20DFE4E279718E4041A9310DE29E678834BB22C5B ] dot3svc         C:\Windows\System32\dot3svc.dll
11:45:20.0699 0x0b58  dot3svc - ok
11:45:20.0746 0x0b58  [ A622E888F8AA2F6B49E9BC466F0E5DEF, 3DED7F22A29AD2F8C927DFA0FD87FDE5ED0BDCAC7260BD9F71D8EA34328C772A ] DPS             C:\Windows\system32\dps.dll
11:45:20.0777 0x0b58  DPS - ok
11:45:20.0839 0x0b58  [ 97FEF831AB90BEE128C9AF390E243F80, A7F4118603E2D5DDDB117EF7C058684EA5B37690EFAB2BEBA570EEF9C36281BE ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
11:45:20.0917 0x0b58  drmkaud - ok
11:45:21.0058 0x0b58  [ 5C2C209CDEFBC51D83D66E8A53B2BE89, 7AE68672A6BEEF601017BE28AA0BF3673318EFE97AA08E70F58A9391C54DF71F ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
11:45:21.0136 0x0b58  DXGKrnl - ok
11:45:21.0183 0x0b58  [ 5425F74AC0C1DBD96A1E04F17D63F94C, AD133CEDCDEA75420C75A91BB4CF7152475D46ED7B7703E3BAE5F9946D610292 ] E1G60           C:\Windows\system32\DRIVERS\E1G60I32.sys
11:45:21.0229 0x0b58  E1G60 - ok
11:45:21.0276 0x0b58  [ C0B95E40D85CD807D614E264248A45B9, 30421DAF1722A225222268CB8BA4FE60CB76C6FD0C9157B0F53FC1368F806A4E ] EapHost         C:\Windows\System32\eapsvc.dll
11:45:21.0370 0x0b58  EapHost - ok
11:45:21.0417 0x0b58  [ 7F64EA048DCFAC7ACF8B4D7B4E6FE371, F3E9CF5D8E9124CB06F08454C5F0E510DE19A92780151FB2F8A58A0905D59B8F ] Ecache          C:\Windows\system32\drivers\ecache.sys
11:45:21.0432 0x0b58  Ecache - ok
11:45:21.0526 0x0b58  [ 9BE3744D295A7701EB425332014F0797, 1A139EE9232581E466591C5EBEF41E4BF1F82D99C1959F1C68C879B240E9F46D ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
11:45:21.0588 0x0b58  ehRecvr - ok
11:45:21.0619 0x0b58  [ AD1870C8E5D6DD340C829E6074BF3C3F, 064D07106A1BBE80294F1913354832F2B67D22274BB4D36C81D2D83C96FE0B88 ] ehSched         C:\Windows\ehome\ehsched.exe
11:45:21.0651 0x0b58  ehSched - ok
11:45:21.0682 0x0b58  [ C27C4EE8926E74AA72EFCAB24C5242C3, F1EBF78CCE9BA76AFD0478BC66B67CA44DEAF3C380369BFCE91BD8F678C8608A ] ehstart         C:\Windows\ehome\ehstart.dll
11:45:21.0713 0x0b58  ehstart - ok
11:45:21.0729 0x0b58  [ B8EAC99B14772BDC36CA963AED109FA2, 332484E0F0E5D2C4F45A9D840B2946D247B0AA03697E1A1196F04A330A37FEDE ] ElRawDisk       C:\Windows\system32\drivers\dddsk.sys
11:45:21.0744 0x0b58  ElRawDisk - ok
11:45:21.0791 0x0b58  [ 23B62471681A124889978F6295B3F4C6, A90C521F06125B86A26EA625B0E7F811AF7D328E1313165E7AD4A83596A23819 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
11:45:21.0838 0x0b58  elxstor - ok
11:45:21.0963 0x0b58  [ 4E6B23DFC917EA39306B529B773950F4, C4BA77632B4BD46C4C1797F7F57399DB506D3EB6E5A0A36C269A793DAA3445C2 ] EMDMgmt         C:\Windows\system32\emdmgmt.dll
11:45:22.0041 0x0b58  EMDMgmt - ok
11:45:22.0119 0x0b58  [ 2072CBE938DD355C4A52E9A4DCF5439F, 837CFA1ED507ABFB3618B2FFF6D3BA767E713BA10ECDAE4E148725C090E948DC ] ePowerSvc       C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
11:45:22.0165 0x0b58  ePowerSvc - ok
11:45:22.0228 0x0b58  [ 3DB974F3935483555D7148663F726C61, C288CFC04213B0340ABEC752C0A7B308B29122B5F51E68387BA1D9E9D7166FDD ] ErrDev          C:\Windows\system32\drivers\errdev.sys
11:45:22.0275 0x0b58  ErrDev - ok
11:45:22.0337 0x0b58  [ 67058C46504BC12D821F38CF99B7B28F, E8D19F305F78BCA1DA8425315F2C77A377CD51E3CC54323DC2FF355120EA097D ] EventSystem     C:\Windows\system32\es.dll
11:45:22.0368 0x0b58  EventSystem - ok
11:45:22.0493 0x0b58  [ 54B6E150BFF4A47EB0D204119D262E46, 0D6215AE7B29859C2301AADD4260534CD47C94E680E649C8CBBEDBE8713BC39D ] EvtEng          C:\Program Files\Intel\WiFi\bin\EvtEng.exe
11:45:22.0618 0x0b58  EvtEng - detected UnsignedFile.Multi.Generic ( 1 )
11:45:25.0020 0x0b58  Detect skipped due to KSN trusted
11:45:25.0020 0x0b58  EvtEng - ok
11:45:25.0083 0x0b58  [ 22B408651F9123527BCEE54B4F6C5CAE, 31AF9649333A9496A9224001266D1B68CE2A31B9FB182A755D127FC5492AA6B2 ] exfat           C:\Windows\system32\drivers\exfat.sys
11:45:25.0145 0x0b58  exfat - ok
11:45:25.0192 0x0b58  [ 4E404505B3F62ECFBDBCBBCF0A72DBC5, 9F446ED06A31BFE52C4F1E8ACC400B8E3F47A3CC02FFC950DB861B2B3BA4C5B9 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
11:45:25.0254 0x0b58  fastfat - ok
11:45:25.0285 0x0b58  [ AFE1E8B9782A0DD7FB46BBD88E43F89A, B4CBE1DC3430F2F3485F49007C71293D5B86E9C405741EA00A67B00A38BE1F8D ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
11:45:25.0332 0x0b58  fdc - ok
11:45:25.0348 0x0b58  [ 6629B5F0E98151F4AFDD87567EA32BA3, 8CC02D5E0639CDF74B2F85DB56D6199E1858F1A58465ED1D8B25C968E986132C ] fdPHost         C:\Windows\system32\fdPHost.dll
11:45:25.0395 0x0b58  fdPHost - ok
11:45:25.0395 0x0b58  [ 89ED56DCE8E47AF40892778A5BD31FD2, 924360875796C3DDDDA8097FDF53F6846B227F7413766F00AEDD981EFD691BF9 ] FDResPub        C:\Windows\system32\fdrespub.dll
11:45:25.0473 0x0b58  FDResPub - ok
11:45:25.0504 0x0b58  [ A8C0139A884861E3AAE9CFE73B208A9F, 3B021D148A2989AAA46AE58E5FED8A2DCA25E9212C2FA7F922880EF5A077E49B ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
11:45:25.0519 0x0b58  FileInfo - ok
11:45:25.0566 0x0b58  [ 0AE429A696AECBC5970E3CF2C62635AE, 1ECC315C099D17835788B68F0DE00EC98DC5AEE8F329D739E0DB90A898F22244 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
11:45:25.0597 0x0b58  Filetrace - ok
11:45:25.0644 0x0b58  [ 85B7CF99D532820495D68D747FDA9EBD, 682D35D219D1AFBE51CF0AB03F2D3E15C940F5AF291C1A611A19F4D279143F3C ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
11:45:25.0707 0x0b58  flpydisk - ok
11:45:25.0738 0x0b58  [ 01334F9EA68E6877C4EF05D3EA8ABB05, 82F8AA6AD2B5077898773D4A5814819EAF0E872FFD95894E06FEDAB6EE92CF99 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
11:45:25.0769 0x0b58  FltMgr - ok
11:45:25.0863 0x0b58  [ 2AFA3A46986AE935DAECEBC7E66314CF, 747FAF9B7F8291B83EE44B91E5708395E749DC87BD42CC3BF2CD41209C298F4D ] FontCache       C:\Windows\system32\FntCache.dll
11:45:25.0956 0x0b58  FontCache - ok
11:45:26.0019 0x0b58  [ C7FBDD1ED42F82BFA35167A5C9803EA3, 372FF71070D5ECE17342466A690737A0622E93C98DBED8172C49B0854F0012B7 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
11:45:26.0019 0x0b58  FontCache3.0.0.0 - ok
11:45:26.0081 0x0b58  [ 140C20D2EF25993E66E9D60E66977F3E, 014E0D0E7DDC074F0B2EDD6F7A390E8E42638E82F8AFA004F9D8D1E19E5CCD7B ] FPSensor        C:\Windows\system32\Drivers\FPSensor.sys
11:45:26.0097 0x0b58  FPSensor - ok
11:45:26.0128 0x0b58  [ B972A66758577E0BFD1DE0F91AAA27B5, E934034F3F740A83D4E7ABCD2C581845AC2945B0BCCAACF65CC3F99A1DBDE455 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
11:45:26.0175 0x0b58  Fs_Rec - ok
11:45:26.0221 0x0b58  [ 34582A6E6573D54A07ECE5FE24A126B5, 5F45DC38F8015AD90616EAD3B57820CCD284938A96B2C4E1FF5FC7BDEE8A848D ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
11:45:26.0237 0x0b58  gagp30kx - ok
11:45:26.0346 0x0b58  [ CD5D0AEEE35DFD4E986A5AA1500A6E66, DCED5126837292593F1C1B35DF18E3B631D6C0C6D0742B77C7B7742C55A7825F ] gpsvc           C:\Windows\System32\gpsvc.dll
11:45:26.0455 0x0b58  gpsvc - ok
11:45:26.0533 0x0b58  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdate         C:\Program Files\Google\Update\GoogleUpdate.exe
11:45:26.0549 0x0b58  gupdate - ok
11:45:26.0549 0x0b58  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
11:45:26.0565 0x0b58  gupdatem - ok
11:45:26.0627 0x0b58  [ CB04C744BE0A61B1D648FAED182C3B59, 61DC0FF94325DAFCCB7B3980A48727EFBF1283FCF753EC16EF04C730525994C0 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
11:45:26.0674 0x0b58  HdAudAddService - ok
11:45:26.0721 0x0b58  [ 062452B7FFD68C8C042A6261FE8DFF4A, DD9873502456D3C058C6177AC223B28C71370E624FA0814C17EA3D93201F2B56 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
11:45:26.0799 0x0b58  HDAudBus - ok
11:45:26.0814 0x0b58  [ 1338520E78D90154ED6BE8F84DE5FCEB, 8531F1C5856983EBDA4C2B70162645ECE72FFFBA9FE7A28BCEDDF2169B7ECF9D ] HidBth          C:\Windows\system32\drivers\hidbth.sys
11:45:26.0861 0x0b58  HidBth - ok
11:45:26.0908 0x0b58  [ FF3160C3A2445128C5A6D9B076DA519E, DC1A70C80CD55F33B3AD5A21E86AF7C3086D8CC2DC6148C058E74A871E0BAD4A ] HidIr           C:\Windows\system32\drivers\hidir.sys
11:45:27.0001 0x0b58  HidIr - ok
11:45:27.0033 0x0b58  [ 84067081F3318162797385E11A8F0582, 11E32E3800CFCA37354388243F88D0239D622891BAC5483518A2BE5D1CA19015 ] hidserv         C:\Windows\System32\hidserv.dll
11:45:27.0079 0x0b58  hidserv - ok
11:45:27.0126 0x0b58  [ 7F7E5E98CEFED8A10F7E56810EA7B6DF, 7D9F6801B24C96FAE77A50162074EDA4C4470C1E240BDC79ECB6B514E195291C ] hidshim         C:\Windows\system32\DRIVERS\hidshim.sys
11:45:27.0142 0x0b58  hidshim - ok
11:45:27.0173 0x0b58  [ CCA4B519B17E23A00B826C55716809CC, 91AD0758A6185B0FBBE383BDB1B457FFB850477AFF8DE040DE9527A97D28EF62 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
11:45:27.0204 0x0b58  HidUsb - ok
11:45:27.0251 0x0b58  [ D8AD255B37DA92434C26E4876DB7D418, C901EADDD93FC90C8F29F4B6DE808F8E4F486C877FC0AA27DA4ACDE17E28899D ] hkmsvc          C:\Windows\system32\kmsvc.dll
11:45:27.0329 0x0b58  hkmsvc - ok
11:45:27.0360 0x0b58  [ 16EE7B23A009E00D835CDB79574A91A6, 964AFE7D2F7E48C7DE7FDAB48F57ADC4AD44A0B2A9A03071E0E8D334007E5572 ] HpCISSs         C:\Windows\system32\drivers\hpcisss.sys
11:45:27.0376 0x0b58  HpCISSs - ok
11:45:27.0438 0x0b58  [ F870AA3E254628EBEAFE754108D664DE, B0444E7D246AA1982094030ACB991690F6A7DD3FB07B1BB6A1BC0F3AA9718A70 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
11:45:27.0547 0x0b58  HTTP - ok
11:45:27.0579 0x0b58  [ C6B032D69650985468160FC9937CF5B4, 4D5A944C70037F35A9DBA4F49F174455FA80ED7EAEDAA143F0A2C0E05AE585D8 ] i2omp           C:\Windows\system32\drivers\i2omp.sys
11:45:27.0594 0x0b58  i2omp - ok
11:45:27.0657 0x0b58  [ 22D56C8184586B7A1F6FA60BE5F5A2BD, D96A2962848C1F59B143BFEC22EC48BD1C5A75D0EBCFD7FB965E66B85FF7D8CA ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
11:45:27.0703 0x0b58  i8042prt - ok
11:45:27.0750 0x0b58  [ 71ECC07BC7C5E24C3DD01D8A29A24054, 03BB7E80212B038E26B439F41D757152B00CBC5E20ADE54B0FC903B199B73E88 ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
11:45:27.0781 0x0b58  iaStor - ok
11:45:27.0813 0x0b58  [ 54155EA1B0DF185878E0FC9EC3AC3A14, 344A0793499261D2E4FF2FCCC70501329485F8E299EBC68953D07BA86F0D4729 ] iaStorV         C:\Windows\system32\drivers\iastorv.sys
11:45:27.0844 0x0b58  iaStorV - ok
11:45:27.0953 0x0b58  [ DD386C45D2B5863740166783448A2E7A, 10B912BA70306644BE73A53AF4DCDFF63880C4C5860FF6DBA92B0914EB566718 ] idsvc           C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
11:45:28.0047 0x0b58  idsvc - ok
11:45:28.0187 0x0b58  [ EA282B193D3A6B0A64085AD71B0817B0, 086A27C565FD7BEF8FA4BFD9B118DA4C877953763EB7F7DAB6805D011C78264A ] IGBASVC         c:\Program Files\Acer Bio Protection\BASVC.exe
11:45:28.0437 0x0b58  IGBASVC - detected UnsignedFile.Multi.Generic ( 1 )
11:45:30.0839 0x0b58  Detect skipped due to KSN trusted
11:45:30.0839 0x0b58  IGBASVC - ok
11:45:30.0886 0x0b58  [ 2D077BF86E843F901D8DB709C95B49A5, 78FF558A881F307858F5C7C74A748B8B2562AF3CAC7EA8639945609001D790CE ] iirsp           C:\Windows\system32\drivers\iirsp.sys
11:45:30.0948 0x0b58  iirsp - ok
11:45:30.0995 0x0b58  [ 4687EE0C0DD2CE5F7AAA9C2E33C1DC78, FA8EBED2778D9F7560ADC1B563954EEF98AAE651C0553F2803372B37B122AEB3 ] IKEEXT          C:\Windows\System32\ikeext.dll
11:45:31.0151 0x0b58  IKEEXT - ok
11:45:31.0198 0x0b58  [ 4D8D5B1C895EA0F2A721B98A7CE198F1, A7BB7060B9C5353A5EDD18EE5A0950EE94E44B1B686F110F0E5BFA432D743DD1 ] int15           c:\Windows\system32\drivers\int15.sys
11:45:31.0229 0x0b58  int15 - detected UnsignedFile.Multi.Generic ( 1 )
11:45:33.0616 0x0b58  Detect skipped due to KSN trusted
11:45:33.0616 0x0b58  int15 - ok
11:45:33.0741 0x0b58  [ FFB0B713A54DD05193DBCD0B790B37EE, 5D61FAA62AF21719A956667307F875A8132895C08F6575C6C555167A93E58BDD ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
11:45:33.0959 0x0b58  IntcAzAudAddService - ok
11:45:34.0037 0x0b58  [ 83AA759F3189E6370C30DE5DC5590718, 7406FE41EA8FB80052517318CB72E2641E92E579FAFAF5E8DDDFF0BF8DAE773A ] intelide        C:\Windows\system32\drivers\intelide.sys
11:45:34.0053 0x0b58  intelide - ok
11:45:34.0053 0x0b58  [ 224191001E78C89DFA78924C3EA595FF, E4EC9CAAEEEAEB30E13F4A8023AF687F29514667380DDFD638BBFFF1D5FC2563 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
11:45:34.0099 0x0b58  intelppm - ok
11:45:34.0131 0x0b58  [ 9AC218C6E6105477484C6FDBE7D409A4, FF30D09CD2A0F5BBEC309E953370F194B6F26BF4227E627B594AAA48B0F5D3C2 ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
11:45:34.0162 0x0b58  IPBusEnum - ok
11:45:34.0193 0x0b58  [ 62C265C38769B864CB25B4BCF62DF6C3, CAF6BCE967104233E216464E4729B0275C3BD426D812F404AB0EE83A7F2063D8 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
11:45:34.0224 0x0b58  IpFilterDriver - ok
11:45:34.0287 0x0b58  [ 1998BD97F950680BB55F55A7244679C2, A4E8BB4C6B2AF4800BD5E0BA8725FD0927F8FB6751AEBF6DD16B59C414CCB9D8 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
11:45:34.0365 0x0b58  iphlpsvc - ok
11:45:34.0380 0x0b58  IpInIp - ok
11:45:34.0396 0x0b58  [ B25AAF203552B7B3491139D582B39AD1, EA9C38F512F40FF12975A6719E6FE4D7EA93A4B2497103E0FDA5A4CD6033C0A6 ] IPMIDRV         C:\Windows\system32\drivers\ipmidrv.sys
11:45:34.0427 0x0b58  IPMIDRV - ok
11:45:34.0458 0x0b58  [ 8793643A67B42CEC66490B2A0CF92D68, 8B1ED1314E4C6623824DD6B9C15A0F7F996F4D243BF0B305421251BE40850907 ] IPNAT           C:\Windows\system32\DRIVERS\ipnat.sys
11:45:34.0474 0x0b58  IPNAT - ok
11:45:34.0521 0x0b58  [ E50A95179211B12946F7E035D60AF560, 69765E2548BA708FF35545EC944DBA1940AD4065AF90E53B97A7792AC231DCF7 ] irda            C:\Windows\system32\DRIVERS\irda.sys
11:45:34.0599 0x0b58  irda - ok
11:45:34.0614 0x0b58  [ 109C0DFB82C3632FBD11949B73AEEAC9, 73B01426100256B7110DF0B74483AF1B62FC209612EEC29A7BF6DC31A7FBEFB6 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
11:45:34.0645 0x0b58  IRENUM - ok
11:45:34.0677 0x0b58  [ CBB0D940221A281BCFEAEA695BD1CDA5, D05D192019524A02FE3FAE6827B98A942FA1AD651BF7AA53530A8A6F4ADFB7EB ] Irmon           C:\Windows\System32\irmon.dll
11:45:34.0723 0x0b58  Irmon - ok
11:45:34.0755 0x0b58  [ 6C70698A3E5C4376C6AB5C7C17FB0614, 10FBCBA5A74AF5D136B152FD4D3DFA2A1F2CEBC3F979D5BA6DB98B3DCB2F7A07 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
11:45:34.0786 0x0b58  isapnp - ok
11:45:34.0817 0x0b58  [ 232FA340531D940AAC623B121A595034, 90C93F04D8A0094EEBD118F10223605B8169DA5F24C466F503CED5C014BD17B1 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
11:45:34.0833 0x0b58  iScsiPrt - ok
11:45:34.0895 0x0b58  [ BCED60D16156E428F8DF8CF27B0DF150, 4934E9AB8A8A548548F0C63517F2BF4DE84B05E5C9C7C2AA6C1517B8F9C340D4 ] iteatapi        C:\Windows\system32\drivers\iteatapi.sys
11:45:34.0911 0x0b58  iteatapi - ok
11:45:34.0926 0x0b58  [ 06FA654504A498C30ADCA8BEC4E87E7E, 651BC35A0A3D504573BBAB40DE81929BB18C9FC0CD7944FEAE0E99CD7658EA88 ] iteraid         C:\Windows\system32\drivers\iteraid.sys
11:45:34.0942 0x0b58  iteraid - ok
11:45:34.0989 0x0b58  [ EAC21E8014C7E6EE341AFFFB7E2BBD54, 9D40AE48A73D1F818EF98F7BF23AC15696D1905E14712F26450B3DA3B03A43F3 ] k57nd60x        C:\Windows\system32\DRIVERS\k57nd60x.sys
11:45:35.0035 0x0b58  k57nd60x - ok
11:45:35.0051 0x0b58  [ 37605E0A8CF00CBBA538E753E4344C6E, B9A9FFDCE45B0830E277CF322C28ACB49372C16144B0F676B283BE5DAE9A7F30 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
11:45:35.0082 0x0b58  kbdclass - ok
11:45:35.0098 0x0b58  [ EDE59EC70E25C24581ADD1FBEC7325F7, 41B37778E9A12675FC0DF74606AAF18C652EB88513B3C4889C5C512E14587CEE ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
11:45:35.0176 0x0b58  kbdhid - ok
11:45:35.0223 0x0b58  [ A3E186B4B935905B829219502557314E, 7F58EAC6C12208D792C77014AC9D37AD1A7B2E73863C914F5DA831A72E1D52BB ] KeyIso          C:\Windows\system32\lsass.exe
11:45:35.0269 0x0b58  KeyIso - ok
11:45:35.0332 0x0b58  [ 5035EDF1F2E72F78BB1EC5BD9B97463F, 8AFAD580A96F002FFB22761B65D4B414917895C45B11B53089BB3E0331995EF7 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
11:45:35.0425 0x0b58  KSecDD - ok
11:45:35.0457 0x0b58  [ 8078F8F8F7A79E2E6B494523A828C585, BB399993166853F0C01B7508649ECD7E7473238267BA8333D0441128FE656347 ] KtmRm           C:\Windows\system32\msdtckrm.dll
11:45:35.0535 0x0b58  KtmRm - ok
11:45:35.0566 0x0b58  [ 1BF5EEBFD518DD7298434D8C862F825D, F41C79410345C40B346EB5EDEA397ECD29ECB9B921AC3E19F9453E52A7B9288A ] LanmanServer    C:\Windows\System32\srvsvc.dll
11:45:35.0644 0x0b58  LanmanServer - ok
11:45:35.0691 0x0b58  [ 1DB69705B695B987082C8BAEC0C6B34F, D395B272F6B69D4A9FC3CDEFD812EF0DBFECF3C1B1C787C7CC1E1A1B091B8DB3 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
11:45:35.0737 0x0b58  LanmanWorkstation - ok
11:45:35.0769 0x0b58  [ F8A7212D0864EF5E9185FB95E6623F4D, 277EAA06BD3D1CB31E6CD7B9ECD3A4B7D4AB7A369DB5FFF04EC7D749DF26E3D2 ] lirsgt          C:\Windows\system32\DRIVERS\lirsgt.sys
11:45:35.0784 0x0b58  lirsgt - ok
11:45:35.0815 0x0b58  [ D1C5883087A0C3F1344D9D55A44901F6, 608D67357AFDDD538D2C12C93EB0793ECA4EB3AF2BAB779E881C41F50E4AB911 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
11:45:35.0862 0x0b58  lltdio - ok
11:45:35.0971 0x0b58  [ 2D5A428872F1442631D0959A34ABFF63, E532C6ECFFB936EFF744CA57BDC6394C89E797B6B0822D04F1F3F35D9BDDD4F0 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
11:45:36.0049 0x0b58  lltdsvc - ok
11:45:36.0065 0x0b58  [ 35D40113E4A5B961B6CE5C5857702518, 453097AEF46ED48107395D9A1696AAC259FD6CEA8A655D38C5E246FDDAB81664 ] lmhosts         C:\Windows\System32\lmhsvc.dll
11:45:36.0112 0x0b58  lmhosts - ok
11:45:36.0159 0x0b58  [ C7E15E82879BF3235B559563D4185365, 98C9268ADF6BAEB0522BB84BE6C98D0D6D5EB4BD27BB61412D208232164C8435 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
11:45:36.0174 0x0b58  LSI_FC - ok
11:45:36.0205 0x0b58  [ EE01EBAE8C9BF0FA072E0FF68718920A, 655924440E611278998226299645BC72B3627A8A057286DC8D65A162CFBBE484 ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
11:45:36.0221 0x0b58  LSI_SAS - ok
11:45:36.0252 0x0b58  [ 912A04696E9CA30146A62AFA1463DD5C, 1D336D47B9D1C8449F29CDB776C092235E3D70CE53D9440970533E376EB004D3 ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
11:45:36.0268 0x0b58  LSI_SCSI - ok
11:45:36.0315 0x0b58  [ 8F5C7426567798E62A3B3614965D62CC, 659810257D942C5F4168E1247868CDA990F2324AC9ACAA9A6211F64B7AC9EC6E ] luafv           C:\Windows\system32\drivers\luafv.sys
11:45:36.0346 0x0b58  luafv - ok
11:45:36.0377 0x0b58  [ AEF9BABB8A506BC4CE0451A64AADED46, D5608A703EA7E97F11ED4D029B4B820440B0C9317DB7D7DC0152253CD723DC07 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
11:45:36.0408 0x0b58  Mcx2Svc - ok
11:45:36.0439 0x0b58  [ 0001CE609D66632FA17B84705F658879, D5F9758BDC2B733307B565A74B33F5581FB425A5A9F32CCFA307DA1569EBD6CD ] megasas         C:\Windows\system32\drivers\megasas.sys
11:45:36.0439 0x0b58  megasas - ok
11:45:36.0502 0x0b58  [ C252F32CD9A49DBFC25ECF26EBD51A99, 47EC8F475AB62A00FAF989CD2C3ABDF2922588F75CC15C83CD99A62EF6400FB0 ] MegaSR          C:\Windows\system32\drivers\megasr.sys
11:45:36.0549 0x0b58  MegaSR - ok
11:45:36.0642 0x0b58  [ 123271BD5237AB991DC5C21FDF8835EB, 004F8F9228EE291A0E36CE33078D572D61733516F9AA5CFC832AF204C6869E89 ] Microsoft Office Groove Audit Service C:\Program Files\Microsoft Office\Office12\GrooveAuditService.exe
11:45:36.0658 0x0b58  Microsoft Office Groove Audit Service - ok
11:45:36.0720 0x0b58  [ 1076FFCFFAAE8385FD62DFCB25AC4708, 8C5C106FCB018E019DEBA8E1A6AA170CD7A93293F27994F724EBC486238DA0AA ] MMCSS           C:\Windows\system32\mmcss.dll
11:45:36.0751 0x0b58  MMCSS - ok
11:45:36.0783 0x0b58  [ E13B5EA0F51BA5B1512EC671393D09BA, 5B380D1B435D809CA201FD5ED075D42F3C6BA1A4EEDBC4040F7E3329F05A334A ] Modem           C:\Windows\system32\drivers\modem.sys
11:45:36.0892 0x0b58  Modem - ok
11:45:36.0923 0x0b58  [ 0A9BB33B56E294F686ABB7C1E4E2D8A8, 1E8031D51E074FDFB53E98E26DABF313B901C028D01196BFD402EED5D0A89595 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
11:45:36.0985 0x0b58  monitor - ok
11:45:37.0017 0x0b58  [ 5BF6A1326A335C5298477754A506D263, CC7F58E5955A448F6CE28D6D8EB98C7479E11F931B5C733CFE71A29B2E95923D ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
11:45:37.0032 0x0b58  mouclass - ok
11:45:37.0032 0x0b58  [ 93B8D4869E12CFBE663915502900876F, 7464DE60FAAD8793D855F1F86C3C865B3A3EE41C19A3E926D1BE4426E67F5EC2 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
11:45:37.0063 0x0b58  mouhid - ok
11:45:37.0079 0x0b58  [ BDAFC88AA6B92F7842416EA6A48E1600, 2CA8A7BB260016D6B7953980A94C45A3C5D41F7DC7E73EEFB1C18EA144749503 ] MountMgr        C:\Windows\system32\drivers\mountmgr.sys
11:45:37.0095 0x0b58  MountMgr - ok
11:45:37.0219 0x0b58  [ 96AA8BA23142CC8E2B30F3CAE0C80254, C65380761373DAD16425211FBA0B4E15F260F79A1FF328B1314076D732EE6F0E ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
11:45:37.0235 0x0b58  MozillaMaintenance - ok
11:45:37.0282 0x0b58  [ 511D011289755DD9F9A7579FB0B064E6, 1FD0D0D5B6E08FE06F7A5D0821BCD859B0F98A6DEA58AAB7FB6C95B64212FFC8 ] mpio            C:\Windows\system32\drivers\mpio.sys
11:45:37.0297 0x0b58  mpio - ok
11:45:37.0329 0x0b58  [ 22241FEBA9B2DEFA669C8CB0A8DD7D2E, 62055C0DCEB69873B8961AB17DBD002F44319A44CB05EC3A61421A0C6D4736CD ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
11:45:37.0360 0x0b58  mpsdrv - ok
11:45:37.0531 0x0b58  [ 5DE62C6E9108F14F6794060A9BDECAEC, 655E6645CC4A1EDBE5F51F5F80C7B504DD956851E788A6E4E4E08CDCDCE160D9 ] MpsSvc          C:\Windows\system32\mpssvc.dll
11:45:37.0609 0x0b58  MpsSvc - ok
11:45:37.0672 0x0b58  [ 4FBBB70D30FD20EC51F80061703B001E, 72907A0CA5CFF82F40C02A65CD8EFD51D7CFC33BE67DE572D1ACF4FD3B248F0A ] Mraid35x        C:\Windows\system32\drivers\mraid35x.sys
11:45:37.0672 0x0b58  Mraid35x - ok
11:45:37.0719 0x0b58  [ B0584CA7DEF55929FDB5169BD28B2484, AF6A7E404FEB29F7F3428D0AF6682195E5E8ED106996A04E6947DBD575696546 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
11:45:37.0812 0x0b58  MRxDAV - ok
11:45:37.0890 0x0b58  [ 1E94971C4B446AB2290DEB71D01CF0C2, 4701AA1B419AEF735CB2DA34532B0F1844433272C36D79F4EB55807E39B923D1 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
11:45:37.0921 0x0b58  mrxsmb - ok
11:45:38.0015 0x0b58  [ 4FCCB34D793B116423209C0F8B7A3B03, 7A483AEB691ADBE82779F12F0BB1CCCBFFD7E92902EC1ADC99AB7D129F887143 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
11:45:38.0077 0x0b58  mrxsmb10 - ok
11:45:38.0093 0x0b58  [ C3CB1B40AD4A0124D617A1199B0B9D7C, B975A39DE6D324C6274B6E3B883F36082A958F028335CEB3A37F44481EB284B3 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
11:45:38.0124 0x0b58  mrxsmb20 - ok
11:45:38.0155 0x0b58  [ 28023E86F17001F7CD9B15A5BC9AE07D, FC7EAA592C5F796E3BCD7F7EF261709CD899B33FC8486E594A480F143D0D6320 ] msahci          C:\Windows\system32\drivers\msahci.sys
11:45:38.0171 0x0b58  msahci - ok
11:45:38.0187 0x0b58  [ 4468B0F385A86ECDDAF8D3CA662EC0E7, EAEDC9CDD2EEC5000AF8190A4BE7729282576C3F88E64FDF57F455F5CECC81C9 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
11:45:38.0202 0x0b58  msdsm - ok
11:45:38.0280 0x0b58  [ FD7520CC3A80C5FC8C48852BB24C6DED, C3F3D7A07FAB9AF38A2A00BF0DF6EEE18CA8FE26277BEC9D8ADB793F2CD5EC1F ] MSDTC           C:\Windows\System32\msdtc.exe
11:45:38.0327 0x0b58  MSDTC - ok
11:45:38.0358 0x0b58  [ A9927F4A46B816C92F461ACB90CF8515, 753284F726F9B4D3E7322C75532244CA43714F00717C2019391FB36DEE0738C0 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
11:45:38.0389 0x0b58  Msfs - ok
11:45:38.0405 0x0b58  [ 0F400E306F385C56317357D6DEA56F62, C48FA8193787359902D20D869F5F602CD66D3C5D061A58DDB72F51EED433C4BC ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
11:45:38.0421 0x0b58  msisadrv - ok
11:45:38.0452 0x0b58  [ 85466C0757A23D9A9AECDC0755203CB2, 79141B8DF9D7470466872AF03A85C3D3976512BFDBDB8B92A22225DC8EFD70A6 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
11:45:38.0514 0x0b58  MSiSCSI - ok
11:45:38.0514 0x0b58  msiserver - ok
11:45:38.0530 0x0b58  [ D8C63D34D9C9E56C059E24EC7185CC07, D0CBFB8D57E6D908679DC0488ED659CA35B92626DEA890873E165F051A1AD2AE ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
11:45:38.0639 0x0b58  MSKSSRV - ok
11:45:38.0655 0x0b58  [ 1D373C90D62DDB641D50E55B9E78D65E, 1D4897A96EA54D6FAC7916D69B4E88CAE1397C38CC8FAE08554772808476357B ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
11:45:38.0686 0x0b58  MSPCLOCK - ok
11:45:38.0717 0x0b58  [ B572DA05BF4E098D4BBA3A4734FB505B, B7923F204CEADD0F62C2FE4B7CF8C56DAB70F88093B15C5692D0E61490CF4BAA ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
11:45:38.0748 0x0b58  MSPQM - ok
11:45:38.0826 0x0b58  [ B49456D70555DE905C311BCDA6EC6ADB, 8E40586B3A1FAE9996459E0261726C9DD6A8D5F575604868C45604613385C92F ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
11:45:38.0857 0x0b58  MsRPC - ok
11:45:38.0889 0x0b58  [ E384487CB84BE41D09711C30CA79646C, 520391DEE14D4D6C1EA99C7D31DD95D56B44D54CA3CD8E5C9855E9C0A04F026C ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
11:45:38.0904 0x0b58  mssmbios - ok
11:45:38.0935 0x0b58  [ 7199C1EEC1E4993CAF96B8C0A26BD58A, DD02DF8ED7AF5BB88BD2A91F38CE4C52432CB8044BDCBC41C320CD22B10B8A3B ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
11:45:38.0951 0x0b58  MSTEE - ok
11:45:39.0279 0x0b58  [ 73FA09B84B23A1897809A84F976D5D99, 8ADBEE035DF08DB860D56597C88230F4ECE80B214A13AF22D5D5475C9B7FEFC1 ] msvsmon80       C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe
11:45:39.0544 0x0b58  msvsmon80 - ok
11:45:39.0575 0x0b58  [ 6A57B5733D4CB702C8EA4542E836B96C, 080FB0B01E949D24CDD6876125B3A72DA9F88845D8B9A1A425BCA99E7ACF6821 ] Mup             C:\Windows\system32\Drivers\mup.sys
11:45:39.0622 0x0b58  Mup - ok
11:45:39.0684 0x0b58  [ 2DE94E435C3EFDE58C7B1856D4F20724, AD36759F23D9E83135F5CBAA851942A35D81E74D09E7951F8845F7B7A9E0A63B ] mwlPSDFilter    C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
11:45:39.0715 0x0b58  mwlPSDFilter - ok
11:45:39.0731 0x0b58  [ 61920A7146EED3D903DBBB8EC295AF76, A170C90517CC30604E30A87BFFC6E150C264D362C6C521E089AFD3198A372448 ] mwlPSDNServ     C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
11:45:39.0747 0x0b58  mwlPSDNServ - ok
11:45:39.0762 0x0b58  [ E0F49721E68EBD2983E84C44FADA6665, C9F491B1FB7DD02DB80907B20E1DD2212B19DF8A2D7902EC645411A916210D58 ] mwlPSDVDisk     C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
11:45:39.0762 0x0b58  mwlPSDVDisk - ok
11:45:39.0840 0x0b58  [ FD257CD94057D02108B954156D7B2770, E518D3E5FAE3AA919E5F54C0309DEBBAAC8647F982F7DDE1D8FB4ADFD6F4C620 ] MWLService      C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe
11:45:39.0856 0x0b58  MWLService - ok
11:45:39.0918 0x0b58  [ E4EAF0C5C1B41B5C83386CF212CA9584, 5946C3DCE65A0DB164169A1775DFCA544AF4E1895ADF6916BB1653F373F8D9AF ] napagent        C:\Windows\system32\qagentRT.dll
11:45:39.0965 0x0b58  napagent - ok
11:45:40.0012 0x0b58  [ 85C44FDFF9CF7E72A40DCB7EC06A4416, DC37C99C458CA69B33BFD3894187089E947F4F9C01EC2ED024FA8614989E0956 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
11:45:40.0043 0x0b58  NativeWifiP - ok
11:45:40.0121 0x0b58  [ 1357274D1883F68300AEADD15D7BBB42, EE6352CBF0D9D633816F338159CDA27F1A805C3DDC3402D8605B50D8F3CD3300 ] NDIS            C:\Windows\system32\drivers\ndis.sys
11:45:40.0183 0x0b58  NDIS - ok
11:45:40.0230 0x0b58  [ 0E186E90404980569FB449BA7519AE61, DE41791D9D3074007D6DD1D3933E7A2A13E3789D0AD4F029105B58279622FC1B ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
11:45:40.0261 0x0b58  NdisTapi - ok
11:45:40.0277 0x0b58  [ D6973AA34C4D5D76C0430B181C3CD389, 7C303F3D6BFF8B82E39998135B444837091AB1F9EB8F28D013E5EF45DB237EFC ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
11:45:40.0308 0x0b58  Ndisuio - ok
11:45:40.0339 0x0b58  [ 818F648618AE34F729FDB47EC68345C3, 5FC8F9237BD7FCE3C62D5BDDD49DC104BE2BECDC2FA8CDC1DB8F1891CBAA9140 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
11:45:40.0371 0x0b58  NdisWan - ok
11:45:40.0386 0x0b58  [ 71DAB552B41936358F3B541AE5997FB3, 30A8B3E33CBF04FC047254E404C0321F9028F2640036AA8AC1EA0A5E64551684 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
11:45:40.0402 0x0b58  NDProxy - ok
11:45:40.0417 0x0b58  [ BCD093A5A6777CF626434568DC7DBA78, 2A283DD93230361204EA0897864EAF0224CB8C02E025AE2E4237B07A598B3EBD ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
11:45:40.0449 0x0b58  NetBIOS - ok
11:45:40.0480 0x0b58  [ ECD64230A59CBD93C85F1CD1CAB9F3F6, 83650D756C1F2768A2AAAFC7924F2A4316ABAEB1708F4B05803CDDD699B5AB6F ] netbt           C:\Windows\system32\DRIVERS\netbt.sys
11:45:40.0527 0x0b58  netbt - ok
11:45:40.0573 0x0b58  [ A3E186B4B935905B829219502557314E, 7F58EAC6C12208D792C77014AC9D37AD1A7B2E73863C914F5DA831A72E1D52BB ] Netlogon        C:\Windows\system32\lsass.exe
11:45:40.0605 0x0b58  Netlogon - ok
11:45:40.0636 0x0b58  [ C8052711DAECC48B982434C5116CA401, 417DEB86D157DD3F0B4678410FE27FDD3E8FA04AB03AF398F6C02BF207070B35 ] Netman          C:\Windows\System32\netman.dll
11:45:40.0714 0x0b58  Netman - ok
11:45:40.0839 0x0b58  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:45:40.0870 0x0b58  NetMsmqActivator - ok
11:45:40.0901 0x0b58  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:45:40.0917 0x0b58  NetPipeActivator - ok
11:45:40.0979 0x0b58  [ 2EF3BBE22E5A5ACD1428EE387A0D0172, 55DB91EDD0339D2434C06445F8A716A48EA90925B0FF7EBF45BB79D4B54B80BF ] netprofm        C:\Windows\System32\netprofm.dll
11:45:41.0041 0x0b58  netprofm - ok
11:45:41.0057 0x0b58  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:45:41.0073 0x0b58  NetTcpActivator - ok
11:45:41.0088 0x0b58  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
11:45:41.0104 0x0b58  NetTcpPortSharing - ok
11:45:41.0307 0x0b58  [ 8DE67BD902095A13329FD82C85A1FA09, 7F0B058D0C306A845F7BF14B24B0BDBCE6F152A054331072549F46284E75A367 ] NETw5v32        C:\Windows\system32\DRIVERS\NETw5v32.sys
11:45:41.0681 0x0b58  NETw5v32 - ok
11:45:41.0728 0x0b58  [ 2E7FB731D4790A1BC6270ACCEFACB36E, EE9A00B694E8A3A5842CDC56C7BA1364317AC8134E046A0059661D057094B1A3 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
11:45:41.0743 0x0b58  nfrd960 - ok
11:45:41.0790 0x0b58  [ C96411DD46AABC0D6F3CF06D0E0E7E14, 0D36F322AF1B923D96735BFFCAC3FDB0B282E59220BADAB8B49AC178A6765380 ] NlaSvc          C:\Windows\System32\nlasvc.dll
11:45:41.0868 0x0b58  NlaSvc - ok
11:45:41.0884 0x0b58  [ D36F239D7CCE1931598E8FB90A0DBC26, DF9397411D0CE5A87E3346D4E6E25BEC537A21BCE196CC55FD999CD08FC4A637 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
11:45:41.0931 0x0b58  Npfs - ok
11:45:41.0946 0x0b58  [ 6D8D2E5652FC2442C810C5D8BE784148, 013FF4FA03CA2E066B1946CC09889616B243068BA0FB2E58D4C1435BF66FBC87 ] NSCIRDA         C:\Windows\system32\DRIVERS\nscirda.sys
11:45:41.0993 0x0b58  NSCIRDA - ok
11:45:42.0024 0x0b58  [ 8BB86F0C7EEA2BDED6FE095D0B4CA9BD, 15CA178518EB3D457AA4C109D97A8490821590842AE4E9841703B5A55870C8F6 ] nsi             C:\Windows\system32\nsisvc.dll
11:45:42.0055 0x0b58  nsi - ok
11:45:42.0087 0x0b58  [ 609773E344A97410CE4EBF74A8914FCF, 90B9CBD2B62854DD503DE4A910CB987D402368EB99882FE20FFB6DEACD70F2BD ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
11:45:42.0118 0x0b58  nsiproxy - ok
11:45:42.0211 0x0b58  [ 2C1121F2B87E9A6B12485DF53CD848C7, E580428F3BA7B201C6C7CFADF1F44A6ECA4F589EDB034DA14260136236195936 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
11:45:42.0336 0x0b58  Ntfs - ok
11:45:42.0414 0x0b58  [ 944E3911888B9FFFD843B91C8ABBD3F6, FAAE25445234A73A0A88BC2C6CE7AB707A927C3D0228FB1F23A6CA1BE11C66FA ] NTI IScheduleSvc C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
11:45:42.0414 0x0b58  NTI IScheduleSvc - ok
11:45:42.0492 0x0b58  [ 973DCB15731339FCA176E534055CF115, AB27B6B248436BDAC9E2E314FE195FEFEA63E147E558C6B72019015CAB7CA02A ] NTIBackupSvc    C:\Program Files\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
11:45:42.0508 0x0b58  NTIBackupSvc - ok
11:45:42.0539 0x0b58  [ 6DCAA65F49EF3B97A5CFFC0CB5DE1C2F, 97CE08B0797A6A13567B49A2AD9BE95C019E3F199857823005F68702CD6A5B08 ] NTIDrvr         C:\Windows\system32\Drivers\NTIDrvr.sys
11:45:42.0539 0x0b58  NTIDrvr - ok
11:45:42.0586 0x0b58  [ 58751F9248D50BCE1053976C9E2F0859, E4E831C5B706149907F3ED82C9A3277E5C59EACDC33FB2A8F94CEE6C13128929 ] NTISchedulerSvc C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
11:45:42.0601 0x0b58  NTISchedulerSvc - ok
11:45:42.0648 0x0b58  [ E875C093AEC0C978A90F30C9E0DFBB72, D3A480CD7EF374EFBC1BB831B33B81534774DDDBB0FB338BEE1D444949FD8DE7 ] ntrigdigi       C:\Windows\system32\drivers\ntrigdigi.sys
11:45:42.0711 0x0b58  ntrigdigi - ok
11:45:42.0726 0x0b58  [ C5DBBCDA07D780BDA9B685DF333BB41E, 3652893DFF05469A273C3073D8D0A9D6D6BBDEC7855FEA8EAB768F95BA674108 ] Null            C:\Windows\system32\drivers\Null.sys
11:45:42.0773 0x0b58  Null - ok
11:45:42.0804 0x0b58  [ 85D8845B7B6A434B7CE35723BF0E5C57, F10026F2F63F4852D9E174E1D4E0345BB5080A20370F7F350F5D5951CD52F5BC ] nuvotonhidgeneric C:\Windows\system32\DRIVERS\nuvotonhidgeneric.sys
11:45:42.0835 0x0b58  nuvotonhidgeneric - ok
11:45:42.0898 0x0b58  [ 77F9F9A199B87FE3F852E12F5419240B, BE9C05F2AC12BB41EC71A596039F2116E5A0F454D32E5A618112296721001473 ] NVHDA           C:\Windows\system32\drivers\nvhda32v.sys
11:45:42.0913 0x0b58  NVHDA - ok
11:45:43.0319 0x0b58  [ 0F96EEF0E62E536B9A683F058FFBDF0C, 37D1E0E4AD620A7C7C89CD930A9DD82427EB193B187BAF43E156FBDB863E465C ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
11:45:43.0990 0x0b58  nvlddmkm - ok
11:45:44.0052 0x0b58  [ 2EDF9E7751554B42CBB60116DE727101, 37A0AA78E83DBB5A788F7F067EB71DDF6CCC72A66BB41B209E1A5E2F68F8AF9B ] nvraid          C:\Windows\system32\drivers\nvraid.sys
11:45:44.0068 0x0b58  nvraid - ok
11:45:44.0115 0x0b58  [ ABED0C09758D1D97DB0042DBB2688177, 84B9BF886EF9181915E8AB6D971446BC681E6DE4485DBECD62838EAFA10E7F46 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
11:45:44.0130 0x0b58  nvstor - ok
11:45:44.0177 0x0b58  [ 555B3C2B10E301BD46BC9C065698A360, E4FE9E5B9AE3EA25F13D05EAC6430A0445F81CCA0D58A0F949D6A9E56ABEEFFD ] nvsvc           C:\Windows\system32\nvvsvc.exe
11:45:44.0193 0x0b58  nvsvc - ok
11:45:44.0239 0x0b58  [ 18BBDF913916B71BD54575BDB6EEAC0B, 5FBA165149AB09E869DCE35622E91CFC964BDD22B31A5E76CF12F1565402B207 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
11:45:44.0255 0x0b58  nv_agp - ok
11:45:44.0255 0x0b58  NwlnkFlt - ok
11:45:44.0271 0x0b58  NwlnkFwd - ok
11:45:44.0629 0x0b58  [ 785F487A64950F3CB8E9F16253BA3B7B, 02445344BD214370A6D48B1CA04921D8EFCB13E676B5648266DD0E076C0822B6 ] odserv          C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
11:45:44.0676 0x0b58  odserv - ok
11:45:44.0723 0x0b58  [ 790E27C3DB53410B40FF9EF2FD10A1D9, FD06F2702B8F7E04ECF1B6E88602F14301E7AE7FC44AD114282E580FAD530A9C ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
11:45:44.0754 0x0b58  ohci1394 - ok
11:45:44.0957 0x0b58  [ 4E2D0656946F2A19FED1C60E0E4FC1AF, 5551D5BD89EB650C5485BBB58DAA5473044B7C967B72687A27430FA9A1E812FE ] Origin Client Service C:\Program Files\Origin\OriginClientService.exe
11:45:45.0129 0x0b58  Origin Client Service - ok
11:45:45.0285 0x0b58  [ 5A432A042DAE460ABE7199B758E8606C, 6E5D1F477D290905BE27CEBF9572BAC6B05FFEF2FAD901D3C8E11F665F8B9A71 ] ose             C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
11:45:45.0300 0x0b58  ose - ok
11:45:45.0363 0x0b58  [ 0C8E8E61AD1EB0B250B846712C917506, 8F23657B90BFFCD7273B93EDA2D3768F35C1C5A313F22AE33452BE3B2A550649 ] p2pimsvc        C:\Windows\system32\p2psvc.dll
11:45:45.0534 0x0b58  p2pimsvc - ok
11:45:45.0565 0x0b58  [ 0C8E8E61AD1EB0B250B846712C917506, 8F23657B90BFFCD7273B93EDA2D3768F35C1C5A313F22AE33452BE3B2A550649 ] p2psvc          C:\Windows\system32\p2psvc.dll
11:45:45.0597 0x0b58  p2psvc - ok
11:45:45.0659 0x0b58  [ 0FA9B5055484649D63C303FE404E5F4D, ABF357001A5E7B21621560E74FA538E2D899C5111A6AAC784B5B12D9D819C6CD ] Parport         C:\Windows\system32\drivers\parport.sys
11:45:45.0706 0x0b58  Parport - ok
11:45:45.0753 0x0b58  [ B9C2B89F08670E159F7181891E449CD9, BD48CE95CF4B75D1FD5FD379B2A8727BC000F2B6748B77636C6BDB0B37B0344A ] partmgr         C:\Windows\system32\drivers\partmgr.sys
11:45:45.0768 0x0b58  partmgr - ok
11:45:45.0831 0x0b58  [ 4F9A6A8A31413180D0FCB279AD5D8112, DCE48BC6E3447403521BB9FBF727E629DEE45B69B8AE8CFEE1A67FECAE3CB9D3 ] Parvdm          C:\Windows\system32\drivers\parvdm.sys
11:45:45.0877 0x0b58  Parvdm - ok
11:45:45.0940 0x0b58  [ C6276AD11F4BB49B58AA1ED88537F14A, 409E956AF994640DF8D062E5E41F87A6EE7EEE0335C191B582722A49322357CE ] PcaSvc          C:\Windows\System32\pcasvc.dll
11:45:45.0987 0x0b58  PcaSvc - ok
11:45:46.0018 0x0b58  [ 941DC1D19E7E8620F40BBC206981EFDB, 156142A8B587131D2D47074CBFD0A31F69B3C27A8C74C8C4F29DFE7B53BBA802 ] pci             C:\Windows\system32\drivers\pci.sys
11:45:46.0033 0x0b58  pci - ok
11:45:46.0049 0x0b58  [ FC175F5DDAB666D7F4D17449A547626F, 7D6108213D1AD3F97A3B83E491BCCC7D6F5BC72C32A182BDDE8736851A26C8D2 ] pciide          C:\Windows\system32\drivers\pciide.sys
11:45:46.0065 0x0b58  pciide - ok
11:45:46.0143 0x0b58  [ B7C5A8769541900F6DFA6FE0C5E4D513, 1885FE8AE9D6929E8B43D674B43B7B3FEAA25AF6E45973A0B49CBA7B9CBA34C4 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
11:45:46.0158 0x0b58  pcmcia - ok
11:45:46.0205 0x0b58  [ 6349F6ED9C623B44B52EA3C63C831A92, 9EAA3ABD396870123107D6E1B758F56FDA378BD28B28DB8415AA470D24294F92 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
11:45:46.0299 0x0b58  PEAUTH - ok
11:45:46.0392 0x0b58  [ B1689DF169143F57053F795390C99DB3, 887B8C76B34CABC68067C0F27CC4EEF02457A53634C96FE5B0FE9B99453BDBEF ] pla             C:\Windows\system32\pla.dll
11:45:46.0579 0x0b58  pla - ok
11:45:46.0642 0x0b58  [ C5E7F8A996EC0A82D508FD9064A5569E, 416A93816CDF12DD42DEA796D37E6E2000D3172AAAB20D3EAD3B715DACD4B61F ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
11:45:46.0673 0x0b58  PlugPlay - ok
11:45:46.0704 0x0b58  [ A1DD33D16F277CE34124EE52AB2C0F14, DB5215409D0B6C378567A6399C0170226CB1E2FE74D96B16C97A761D487C613F ] PnkBstrA        C:\Windows\system32\PnkBstrA.exe
11:45:46.0720 0x0b58  PnkBstrA - ok
11:45:46.0751 0x0b58  [ 0C8E8E61AD1EB0B250B846712C917506, 8F23657B90BFFCD7273B93EDA2D3768F35C1C5A313F22AE33452BE3B2A550649 ] PNRPAutoReg     C:\Windows\system32\p2psvc.dll
11:45:46.0813 0x0b58  PNRPAutoReg - ok
11:45:46.0923 0x0b58  [ 0C8E8E61AD1EB0B250B846712C917506, 8F23657B90BFFCD7273B93EDA2D3768F35C1C5A313F22AE33452BE3B2A550649 ] PNRPsvc         C:\Windows\system32\p2psvc.dll
11:45:47.0001 0x0b58  PNRPsvc - ok
11:45:47.0110 0x0b58  [ D0494460421A03CD5225CCA0059AA146, FC30E90522C63F2A66D89381705712D2CDF07B2E029DF40C2DEBB2353E763E90 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
11:45:47.0172 0x0b58  PolicyAgent - ok
11:45:47.0203 0x0b58  [ ECFFFAEC0C1ECD8DBC77F39070EA1DB1, 6E4B188A4BFDBBCA51347BCCE2873F2D0F858398851B9B5129CB9F36A02E4354 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
11:45:47.0250 0x0b58  PptpMiniport - ok
11:45:47.0266 0x0b58  [ 2027293619DD0F047C584CF2E7DF4FFD, B7C172CCD08D8A30483D27536355ED1E5009B33629355B426470AFBA8542B394 ] Processor       C:\Windows\system32\drivers\processr.sys
11:45:47.0375 0x0b58  Processor - ok
11:45:47.0437 0x0b58  [ 0D5DAD610D7EA1627581ED06FB2BAA9A, 6E27CF3A1624AE10EECB8B5F38E03D76A6AABE4E75DD66DEDD67E0773935A396 ] ProfSvc         C:\Windows\system32\profsvc.dll
11:45:47.0469 0x0b58  ProfSvc - ok
11:45:47.0500 0x0b58  [ A3E186B4B935905B829219502557314E, 7F58EAC6C12208D792C77014AC9D37AD1A7B2E73863C914F5DA831A72E1D52BB ] ProtectedStorage C:\Windows\system32\lsass.exe
11:45:47.0562 0x0b58  ProtectedStorage - ok
11:45:47.0578 0x0b58  [ 99514FAA8DF93D34B5589187DB3AA0BA, 4DDE5EC0C721B22E1D7D55ED3514B60EA07435C232A3A931BB49C7F486B52C18 ] PSched          C:\Windows\system32\DRIVERS\pacer.sys
11:45:47.0625 0x0b58  PSched - ok
11:45:47.0734 0x0b58  [ 0A6DB55AFB7820C99AA1F3A1D270F4F6, 8B7D44A7698B95FE34CBBE4FAB2F01EC1F5BA86C2B19672F99767E650E99BF1C ] ql2300          C:\Windows\system32\drivers\ql2300.sys
11:45:47.0890 0x0b58  ql2300 - ok
11:45:47.0921 0x0b58  [ 81A7E5C076E59995D54BC1ED3A16E60B, A2988F065F93C41B3B389BFF3BB3FD69F768C2AF249C2356F315CC92E5C9E128 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
11:45:47.0952 0x0b58  ql40xx - ok
11:45:48.0030 0x0b58  [ E9ECAE663F47E6CB43962D18AB18890F, F1A05320CAED9E745AA36A6DA9B64C48AAEDE888B42B249840CEB31448F7F432 ] QWAVE           C:\Windows\system32\qwave.dll
11:45:48.0093 0x0b58  QWAVE - ok
11:45:48.0108 0x0b58  [ 9F5E0E1926014D17486901C88ECA2DB7, 67CDFB99AB546DCEEF20507EAC07DD52FFB51BFDFE9416ABEDDC1201B60D720E ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
11:45:48.0124 0x0b58  QWAVEdrv - ok
11:45:48.0155 0x0b58  [ 147D7F9C556D259924351FEB0DE606C3, E41EBA5F3098C6CF2BE4C0060A5F4BF161C3677D983B7A0D70ACC12FC3CFEFD7 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
11:45:48.0171 0x0b58  RasAcd - ok
11:45:48.0202 0x0b58  [ F6A452EB4CEADBB51C9E0EE6B3ECEF0F, 6A410ABCCD2211EFF511CDBF22E4152B57D2996336EBE711DFF71904AF232DB2 ] RasAuto         C:\Windows\System32\rasauto.dll
11:45:48.0280 0x0b58  RasAuto - ok
11:45:48.0295 0x0b58  [ A214ADBAF4CB47DD2728859EF31F26B0, A24F37F55E2C018B1B4FA2C568A01AAAAEA1220833ED24A93378386174A70A32 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
11:45:48.0327 0x0b58  Rasl2tp - ok
11:45:48.0358 0x0b58  [ 75D47445D70CA6F9F894B032FBC64FCF, 9112EA5D25F867136858524C7965ACCEDC02675D1E2985B950598D89CCF25E14 ] RasMan          C:\Windows\System32\rasmans.dll
11:45:48.0389 0x0b58  RasMan - ok
11:45:48.0420 0x0b58  [ 509A98DD18AF4375E1FC40BC175F1DEF, CC7C278CA298CE102D871E34C176E73F903D6687D1E8B5AFAB8772C7DE1A60B1 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
11:45:48.0451 0x0b58  RasPppoe - ok
11:45:48.0483 0x0b58  [ 2005F4A1E05FA09389AC85840F0A9E4D, D8A664073FDE82F9AB324347024CDB7043635C84EB11C24C59AB384C52F0FD94 ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
11:45:48.0498 0x0b58  RasSstp - ok
11:45:48.0514 0x0b58  [ B14C9D5B9ADD2F84F70570BBBFAA7935, 3D533767A50554B86C769DF4D8841B3EA680B3807E85EA3533BDA9B649548269 ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
11:45:48.0545 0x0b58  rdbss - ok
11:45:48.0561 0x0b58  [ 89E59BE9A564262A3FB6C4F4F1CD9899, 6F948FB0E73495CA60B7B19E758268495EC8A084C475EC59AD7940AA619570BB ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
11:45:48.0607 0x0b58  RDPCDD - ok
11:45:48.0623 0x0b58  [ FBC0BACD9C3D7F6956853F64A66E252D, 7672B10C7039295B152C02C96903E869FF2C0A88A2C3FA89BAE9F1D593B43569 ] rdpdr           C:\Windows\system32\drivers\rdpdr.sys
11:45:48.0654 0x0b58  rdpdr - ok
11:45:48.0670 0x0b58  [ 9D91FE5286F748862ECFFA05F8A0710C, 33F37F1B207151A5564BF051BBF16F35D8C5A0F426CCA078A51F125BF09E487B ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
11:45:48.0685 0x0b58  RDPENCDD - ok
11:45:48.0748 0x0b58  [ C127EBD5AFAB31524662C48DFCEB773A, 40A6B88FEAFF02D1B5C0CA32F290CF3D9B48B85D248C7532F30CC5C09BAA4D89 ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
11:45:48.0810 0x0b58  RDPWD - ok
11:45:48.0904 0x0b58  [ 3FF45B7F17D5837216ABAE652CC61540, 33AF3C99247DD5779CF02AC7C2E170C31CCFAB0282D68AAB606CD6A3279B99E7 ] RegSrvc         C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
11:45:48.0966 0x0b58  RegSrvc - detected UnsignedFile.Multi.Generic ( 1 )
11:45:51.0353 0x0b58  Detect skipped due to KSN trusted
11:45:51.0353 0x0b58  RegSrvc - ok
11:45:51.0400 0x0b58  [ BCDD6B4804D06B1F7EBF29E53A57ECE9, 8A961CCD0A0265E03D9952C733B593B02B5CF64E308D6B420276D2D6B20F86FC ] RemoteAccess    C:\Windows\System32\mprdim.dll
11:45:51.0462 0x0b58  RemoteAccess - ok
11:45:51.0571 0x0b58  [ 9E6894EA18DAFF37B63E1005F83AE4AB, 5D6DF994D297C875D547C7B111A571AA90D582DAECADE18A53F65AD988819E67 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
11:45:51.0618 0x0b58  RemoteRegistry - ok
11:45:51.0696 0x0b58  [ 5123F83CBC4349D065534EEB6BBDC42B, 92A3F38EA924D83D601BB93E3750F9DBC2DD963FB7ACF2A0E776297E21815225 ] RpcLocator      C:\Windows\system32\locator.exe
11:45:51.0743 0x0b58  RpcLocator - ok
11:45:51.0883 0x0b58  [ 3B5B4D53FEC14F7476CA29A20CC31AC9, EC02A412DA5FDE2C759A4A2C5904579E1CE7C4999CE87145812F354FC8F5E183 ] RpcSs           C:\Windows\system32\rpcss.dll
11:45:51.0930 0x0b58  RpcSs - ok
11:45:51.0977 0x0b58  [ 9C508F4074A39E8B4B31D27198146FAD, 84913471E5A6C297B1EDABE45EF3FE7D2C4410EF04370F615109FD9E2690FFDB ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
11:45:52.0086 0x0b58  rspndr - ok
11:45:52.0133 0x0b58  [ 38494041F19F6CD005B711F5E08FAE08, 815B2FECDDC1B3A7DE3BD1290B4ABCB3E4A863F2A54AE88F39AF7CEC9AE2E56A ] RS_Service      C:\Program Files\Acer\Acer VCM\RS_Service.exe
11:45:52.0180 0x0b58  RS_Service - detected UnsignedFile.Multi.Generic ( 1 )
11:45:54.0582 0x0b58  Detect skipped due to KSN trusted
11:45:54.0582 0x0b58  RS_Service - ok
11:45:54.0629 0x0b58  [ 9B09F336DE36A7A6CA871DE8A7847B65, 1F99D1F3298F0C66E93287E269EAB001140A9F2A6E867E11B30F21B04B720AB9 ] RTSTOR          C:\Windows\system32\drivers\RTSTOR.SYS
11:45:54.0691 0x0b58  RTSTOR - ok
11:45:54.0707 0x0b58  [ A3E186B4B935905B829219502557314E, 7F58EAC6C12208D792C77014AC9D37AD1A7B2E73863C914F5DA831A72E1D52BB ] SamSs           C:\Windows\system32\lsass.exe
11:45:54.0738 0x0b58  SamSs - ok
11:45:54.0769 0x0b58  [ 3CE8F073A557E172B330109436984E30, CEC281C6076FAA1E34372CF419C6308E73811316606B8D0D9055B7D8952BDC88 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
11:45:54.0769 0x0b58  sbp2port - ok
11:45:54.0816 0x0b58  [ 77B7A11A0C3D78D3386398FBBEA1B632, A3D290AB793BDC2F84C7B963300DFCE81CFE082A0FFF7489E8E5B14714892C00 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
11:45:54.0832 0x0b58  SCardSvr - ok
11:45:54.0894 0x0b58  [ 1A58069DB21D05EB2AB58EE5753EBE8D, EED8111EB613F4C93D1638C74FDB0A6DC6694E1B108DCD0D794B5B5F9B8C6EE4 ] Schedule        C:\Windows\system32\schedsvc.dll
11:45:55.0003 0x0b58  Schedule - ok
11:45:55.0066 0x0b58  [ 312EC3E37A0A1F2006534913E37B4423, 81B8F462336791D162DAFA8092C1F437638DA3022CA24A2458B9FE183FC18C5D ] SCPolicySvc     C:\Windows\System32\certprop.dll
11:45:55.0081 0x0b58  SCPolicySvc - ok
11:45:55.0128 0x0b58  [ 126EA89BCC413EE45E3004FB0764888F, 367BE2B56113177AE867E00D019C707C6449E0FC4A642101B11036A0534D6901 ] sdbus           C:\Windows\system32\DRIVERS\sdbus.sys
11:45:55.0159 0x0b58  sdbus - ok
11:45:55.0191 0x0b58  [ 716313D9F6B0529D03F726D5AAF6F191, 44FE994A11631C1D99C73026340BACE39973C65A1281D87A61B481C9B5FAB251 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
11:45:55.0222 0x0b58  SDRSVC - ok
11:45:55.0237 0x0b58  [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
11:45:55.0300 0x0b58  secdrv - ok
11:45:55.0315 0x0b58  [ FD5199D4D8A521005E4B5EE7FE00FA9B, 0FB7A1D300C72B1ADC423CC57343C17853E5F8ACFE3EA2C42FAC2FF72E502FBE ] seclogon        C:\Windows\system32\seclogon.dll
11:45:55.0347 0x0b58  seclogon - ok
11:45:55.0362 0x0b58  [ A9BBAB5759771E523F55563D6CBE140F, 415BF6F6A1E4C5F98DABF9C2EEAF8CA49730693046E5F94C7655683717EDAD75 ] SENS            C:\Windows\system32\sens.dll
11:45:55.0393 0x0b58  SENS - ok
11:45:55.0425 0x0b58  [ 68E44E331D46F0FB38F0863A84CD1A31, 0778D85B6869CE2610820DC9724360538BFE832426E898AEBC34E53D2AB4322B ] Serenum         C:\Windows\system32\drivers\serenum.sys
11:45:55.0471 0x0b58  Serenum - ok
11:45:55.0503 0x0b58  [ C70D69A918B178D3C3B06339B40C2E1B, 40BEEECA4C797A3355F4B01C57C2763C33028F27826315062320789A496D0810 ] Serial          C:\Windows\system32\drivers\serial.sys
11:45:55.0565 0x0b58  Serial - ok
11:45:55.0596 0x0b58  [ 8AF3D28A879BF75DB53A0EE7A4289624, C870BEBB969DCD9170E64584D1CD329A193D9FC812A45EF3574891110CA68B45 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
11:45:55.0627 0x0b58  sermouse - ok
11:45:55.0659 0x0b58  [ D2193326F729B163125610DBF3E17D57, 82C894E24E2C139C884246A693AD37BBF0A4E9375B7F7A288EF1DB22F89434B9 ] SessionEnv      C:\Windows\system32\sessenv.dll
11:45:55.0690 0x0b58  SessionEnv - ok
11:45:55.0737 0x0b58  [ 3EFA810BDCA87F6ECC24F9832243FE86, E50FEA94DB9851A46A8A71A8C061AC953A9D5B14585382B3F0FFC84931A0A68F ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
11:45:55.0752 0x0b58  sffdisk - ok
11:45:55.0846 0x0b58  [ E95D451F7EA3E583AEC75F3B3EE42DC5, B014BE4F9B0C79ECCE2537D1CF4AAD48ACB4C5AD3DACAC4444F0F465B9689921 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
11:45:55.0893 0x0b58  sffp_mmc - ok
11:45:55.0924 0x0b58  [ 3D0EA348784B7AC9EA9BD9F317980979, 2500CE188C9B71C50E966FA575303AEFE50934E376C530AECEC7C7533C15EF08 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
11:45:56.0002 0x0b58  sffp_sd - ok
11:45:56.0017 0x0b58  [ 46ED8E91793B2E6F848015445A0AC188, 34A97304F23EA153422848F6F1CAF8ADF0944EA781E12F027B6DEAF751A04B5D ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
11:45:56.0080 0x0b58  sfloppy - ok
11:45:56.0111 0x0b58  [ E1499BD0FF76B1B2FBBF1AF339D91165, 9A8F0403467E75880D3070C4D862489A75134383BAF8E7C45F8C5E7DFB0605A5 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
11:45:56.0158 0x0b58  SharedAccess - ok
11:45:56.0205 0x0b58  [ C7230FBEE14437716701C15BE02C27B8, 8221DE73D77CF71C2857D78829E807D015D9CB8BDEE4BAFD6950BF0C718CC774 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
11:45:56.0314 0x0b58  ShellHWDetection - ok
11:45:56.0329 0x0b58  [ 1D76624A09A054F682D746B924E2DBC3, DC903DD466AB8899883253F09477B02E4E93A31C8B279F9F02BD555F1AA083B7 ] sisagp          C:\Windows\system32\drivers\sisagp.sys
11:45:56.0345 0x0b58  sisagp - ok
11:45:56.0376 0x0b58  [ 43CB7AA756C7DB280D01DA9B676CFDE2, 08484CAEA0518C0A4CCCD292D8C803B27FEC453537EE1E4CEE74A7208356A474 ] SiSRaid2        C:\Windows\system32\drivers\sisraid2.sys
11:45:56.0392 0x0b58  SiSRaid2 - ok
11:45:56.0407 0x0b58  [ A99C6C8B0BAA970D8AA59DDC50B57F94, 97AC9DD6DC4F58AC60E819B999BB157663EE7C1739521D16768AA9AC00DAD012 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
11:45:56.0423 0x0b58  SiSRaid4 - ok
11:45:56.0595 0x0b58  [ 862BB4CBC05D80C5B45BE430E5EF872F, F4961B22C93E472C8C862421AA231CDDA9E40D3958741A1D666357F22CC3143D ] slsvc           C:\Windows\system32\SLsvc.exe
11:45:56.0938 0x0b58  slsvc - ok
11:45:56.0985 0x0b58  [ 6EDC422215CD78AA8A9CDE6B30ABBD35, D8342BC3152859F4F7512E85ABEC61147DBCAB515458644728874E42F639D6CA ] SLUINotify      C:\Windows\system32\SLUINotify.dll
11:45:57.0016 0x0b58  SLUINotify - ok
11:45:57.0031 0x0b58  [ 7B75299A4D201D6A6533603D6914AB04, 172BE3951F06B1991EF70B71EB91786D1EFC4E381C22BCA3A5F622CD59F3227E ] Smb             C:\Windows\system32\DRIVERS\smb.sys
11:45:57.0063 0x0b58  Smb - ok
11:45:57.0094 0x0b58  [ 2A146A055B4401C16EE62D18B8E2A032, D0930FFA53951C92F56E1ECB41374F4C0AA01ECBF99F474513A21EAD579CFE47 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
11:45:57.0125 0x0b58  SNMPTRAP - ok
11:45:57.0172 0x0b58  [ 4945020BC094C322571184A6E8056B3A, 9E09257411F7C3631537D0198E0E64CDD1A697D80430F6379139B15A2BA8A6C9 ] SolidWorks Licensing Service C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe
11:45:57.0187 0x0b58  SolidWorks Licensing Service - detected UnsignedFile.Multi.Generic ( 1 )
11:45:59.0574 0x0b58  Detect skipped due to KSN trusted
11:45:59.0574 0x0b58  SolidWorks Licensing Service - ok
11:45:59.0605 0x0b58  [ 7AEBDEEF071FE28B0EEF2CDD69102BFF, E03BEE733F4C2A5F39946D4955679A290E22758DFCE4222EE69ABF64FC54EDF7 ] spldr           C:\Windows\system32\drivers\spldr.sys
11:45:59.0621 0x0b58  spldr - ok
11:45:59.0668 0x0b58  [ 8554097E5136C3BF9F69FE578A1B35F4, 2578545CFD647FB18F217B33C8CB4F0184A35F548659494056E455020CC15FB0 ] Spooler         C:\Windows\System32\spoolsv.exe
11:45:59.0730 0x0b58  Spooler - ok
11:45:59.0777 0x0b58  [ CDDDEC541BC3C96F91ECB48759673505, B030FFA02832317AC5626BF1BF8A4A95A5992C9A6E81BC1C002D5F4D667C27FB ] sptd            C:\Windows\system32\Drivers\sptd.sys
11:45:59.0777 0x0b58  Suspicious file ( NoAccess ): C:\Windows\system32\Drivers\sptd.sys. md5: CDDDEC541BC3C96F91ECB48759673505, sha256: B030FFA02832317AC5626BF1BF8A4A95A5992C9A6E81BC1C002D5F4D667C27FB
11:45:59.0777 0x0b58  sptd - detected LockedFile.Multi.Generic ( 1 )
11:46:02.0413 0x0b58  Detect skipped due to KSN trusted
11:46:02.0413 0x0b58  sptd - ok
11:46:02.0491 0x0b58  [ 41987F9FC0E61ADF54F581E15029AD91, A46E718648C2DD3B43FC3798932C966315893A59442A0686CE46C605B9E4641E ] srv             C:\Windows\system32\DRIVERS\srv.sys
11:46:02.0679 0x0b58  srv - ok
11:46:02.0725 0x0b58  [ FF33AFF99564B1AA534F58868CBE41EF, EFBB005DA19E5B320009CBF93E686D8BFA6A50A23B5A5001C7C84C7D85EF7D49 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
11:46:02.0757 0x0b58  srv2 - ok
11:46:02.0803 0x0b58  [ 7605C0E1D01A08F3ECD743F38B834A44, 83A77E31004BCF83443F30EFC290E04BB1A2F332E8DFD614AB6E25B527C92299 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
11:46:02.0850 0x0b58  srvnet - ok
11:46:02.0881 0x0b58  [ 03D50B37234967433A5EA5BA72BC0B62, 7B61D6A4BF5D446A9473D058BC207FB6DA7C2FEFB8083F3B66CAC8907DBD8327 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
11:46:02.0928 0x0b58  SSDPSRV - ok
11:46:02.0944 0x0b58  [ A36EE93698802CD899F98BFD553D8185, 224CFED921EA230FF8025D259E34968FD2C0FD34BB3A918FB4B9B8BA42BEA5D3 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
11:46:02.0959 0x0b58  ssmdrv - ok
11:46:02.0991 0x0b58  [ 6F1A32E7B7B30F004D9A20AFADB14944, AA9D874A14CA4779E76701D2B02F4CCA92CD5917435FB4CACA149FCB2D1D4C4C ] SstpSvc         C:\Windows\system32\sstpsvc.dll
11:46:03.0022 0x0b58  SstpSvc - ok
11:46:03.0084 0x0b58  [ B1691AF4A072CB674D600DB16DD7308E, 214E35001E7BA10E8C329CE8904E900AA54F9B35C5329F2FF20E3156D6F21A8E ] StarWindServiceAE C:\Program Files\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
11:46:03.0100 0x0b58  StarWindServiceAE - detected UnsignedFile.Multi.Generic ( 1 )
11:46:05.0502 0x0b58  Detect skipped due to KSN trusted
11:46:05.0502 0x0b58  StarWindServiceAE - ok
11:46:05.0549 0x0b58  [ EF70B3D22B4BFFDA6EA851ECB063EFAA, 1666572F8F988805C3A2E949FA6B060B35B72DBB115B86F4CFC710FB6A86C3E3 ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
11:46:05.0596 0x0b58  StillCam - ok
11:46:05.0658 0x0b58  [ 5DE7D67E49B88F5F07F3E53C4B92A352, 6930A598C35646646ED0E91633797EFE139AE6CDD0012335BD1340754A22F997 ] stisvc          C:\Windows\System32\wiaservc.dll
11:46:05.0814 0x0b58  stisvc - ok
11:46:05.0814 0x0b58  [ 7BA58ECF0C0A9A69D44B3DCA62BECF56, 23CC47FA2D6E183D69DB0D3D3F3081A830D94A58FBC0A9A295B3A56C51E9486A ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
11:46:05.0830 0x0b58  swenum - ok
11:46:05.0861 0x0b58  [ F21FD248040681CCA1FB6C9A03AAA93D, 32FE765841A183A1F2C1ACACBBF8CDB11E7D4D4396F9C9F6CFF1B51C9B620ED3 ] swprv           C:\Windows\System32\swprv.dll
11:46:05.0970 0x0b58  swprv - ok
11:46:05.0986 0x0b58  [ 192AA3AC01DF071B541094F251DEED10, 5C6EB56D1C39F3717EB754A1B37C8A618BA4F2107F64048E985D71FA04D1AD05 ] Symc8xx         C:\Windows\system32\drivers\symc8xx.sys
11:46:06.0017 0x0b58  Symc8xx - ok
11:46:06.0048 0x0b58  [ 8C8EB8C76736EBAF3B13B633B2E64125, A6C4845DDED81CCF4947612A4D6E42035136025BCD80812D2FF396927CAADEC5 ] Sym_hi          C:\Windows\system32\drivers\sym_hi.sys
11:46:06.0064 0x0b58  Sym_hi - ok
11:46:06.0064 0x0b58  [ 8072AF52B5FD103BBBA387A1E49F62CB, D336A7D008D145619E79043EBF5D0D455086BA1FEF89612BC2EA11CC363D82B0 ] Sym_u3          C:\Windows\system32\drivers\sym_u3.sys
11:46:06.0079 0x0b58  Sym_u3 - ok
11:46:06.0111 0x0b58  [ AEE6E411A915F50101895BA8DC5C15D4, 3C8612C8A705D31421B58399DEEBE5E475922F7A35FEBF337C8087F75804516A ] SynTP           C:\Windows\system32\DRIVERS\SynTP.sys
11:46:06.0126 0x0b58  SynTP - ok
11:46:06.0189 0x0b58  [ 9A51B04E9886AA4EE90093586B0BA88D, 1666C29FBFA34174B506678C920636519051D03456A6DDCCD6FF708CAE5D9962 ] SysMain         C:\Windows\system32\sysmain.dll
11:46:06.0298 0x0b58  SysMain - ok
11:46:06.0329 0x0b58  [ 2DCA225EAE15F42C0933E998EE0231C3, 67C7913E41854DFA3043426B7D59AA1FBBB9DE01A6E6904E40A696A7C61A5F98 ] TabletInputService C:\Windows\System32\TabSvc.dll
11:46:06.0360 0x0b58  TabletInputService - ok
11:46:06.0391 0x0b58  [ D7673E4B38CE21EE54C59EEEB65E2483, 330D0AD13F5008D8569CE8E5EA0BBD69F54F59FEB54FD903FA18D2849CEC6AF0 ] TapiSrv         C:\Windows\System32\tapisrv.dll
11:46:06.0469 0x0b58  TapiSrv - ok
11:46:06.0485 0x0b58  [ CB05822CD9CC6C688168E113C603DBE7, 9DB8945BDC702BB13E9DE477F2D3CCA4CE0E9E8CE9B54CE1A25375F2A2C93F0E ] TBS             C:\Windows\System32\tbssvc.dll
11:46:06.0532 0x0b58  TBS - ok
11:46:06.0657 0x0b58  [ C7B0746FCD576D7EEBA6A2530B0B2966, F8ADAED40AA12BF8427482A00CCF8374458FEA95C3C381AEF59EC057A2791550 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
11:46:06.0813 0x0b58  Tcpip - ok
11:46:06.0844 0x0b58  [ C7B0746FCD576D7EEBA6A2530B0B2966, F8ADAED40AA12BF8427482A00CCF8374458FEA95C3C381AEF59EC057A2791550 ] Tcpip6          C:\Windows\system32\DRIVERS\tcpip.sys
11:46:06.0891 0x0b58  Tcpip6 - ok
11:46:06.0922 0x0b58  [ 608C345A255D82A6289C2D468EB41FD7, 74ECFDD45DC3EB3AFAEF9C42B546241AA1D6ACB2F6591A76DDB8BB1768545889 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
11:46:07.0031 0x0b58  tcpipreg - ok
11:46:07.0078 0x0b58  [ 5DCF5E267BE67A1AE926F2DF77FBCC56, E00C0A03AEE579B51B39930A72F39F4EFFE7CDA37187B0AE90F4E001AD15473B ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
11:46:07.0140 0x0b58  TDPIPE - ok
11:46:07.0171 0x0b58  [ 389C63E32B3CEFED425B61ED92D3F021, E4718E290678F00995E754AE66F1027D227BFAB9E1A1D2AC8E4EAD27DC50CB17 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
11:46:07.0203 0x0b58  TDTCP - ok
11:46:07.0234 0x0b58  [ 76B06EB8A01FC8624D699E7045303E54, EC30F244B48A35622ED3EE91792F6A1517C5A50770FAB3945E7A945EB7AF28A8 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
11:46:07.0249 0x0b58  tdx - ok
11:46:07.0265 0x0b58  [ 3CAD38910468EAB9A6479E2F01DB43C7, 9D18C71EDF39743A0A592BC0873909D2B75B5B177B2672A865D1EEC0BFD2F61C ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
11:46:07.0281 0x0b58  TermDD - ok
11:46:07.0374 0x0b58  [ DBD84E59D631569EC3E756EF144E8431, 9E58629EC762584A2D294A619593620626F7CBE467045AD0F920B6CF1D4B4724 ] TermService     C:\Windows\System32\termsrv.dll
11:46:07.0437 0x0b58  TermService - ok
11:46:07.0499 0x0b58  [ C7230FBEE14437716701C15BE02C27B8, 8221DE73D77CF71C2857D78829E807D015D9CB8BDEE4BAFD6950BF0C718CC774 ] Themes          C:\Windows\system32\shsvcs.dll
11:46:07.0577 0x0b58  Themes - ok
11:46:07.0608 0x0b58  [ 1076FFCFFAAE8385FD62DFCB25AC4708, 8C5C106FCB018E019DEBA8E1A6AA170CD7A93293F27994F724EBC486238DA0AA ] THREADORDER     C:\Windows\system32\mmcss.dll
11:46:07.0639 0x0b58  THREADORDER - ok
11:46:07.0671 0x0b58  [ EC74E77D0EB004BD3A809B5F8FB8C2CE, 1E4BBC58D0E35D79C764CF1BA73602C5E29A5A2393D40332801D533E445C6667 ] TrkWks          C:\Windows\System32\trkwks.dll
11:46:07.0702 0x0b58  TrkWks - ok
11:46:07.0749 0x0b58  [ 97D9D6A04E3AD9B6C626B9931DB78DBA, 8E42133ED5EE5EEC414A8B11C1035385C6141E445EA9677F947D20768F25A877 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
11:46:07.0827 0x0b58  TrustedInstaller - ok
11:46:07.0858 0x0b58  [ F4EAA7ECBCB25DE901C9B7F2CDCDA0B3, 1CBB5106A32362ABDEE73BF170E205FE64DDBF826C5F6DFFCCD229F220B9C85E ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
11:46:07.0905 0x0b58  tssecsrv - ok
11:46:07.0936 0x0b58  [ CAECC0120AC49E3D2F758B9169872D38, 80DB15ADF5F4FF78D0C7D5081B6C0E8F1E5125872B60D23C19DA8E62C9DAC9A8 ] tunmp           C:\Windows\system32\DRIVERS\tunmp.sys
11:46:07.0967 0x0b58  tunmp - ok
11:46:07.0998 0x0b58  [ 300DB877AC094FEAB0BE7688C3454A9C, 3B36AA191FBE25B1A61150EAA2BDF8BA286DC4C052F6E98B0ED8202135553D8C ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
11:46:08.0045 0x0b58  tunnel - ok
11:46:08.0076 0x0b58  [ 7D33C4DB2CE363C8518D2DFCF533941F, C6A539AD31B0BD9F895E0A537783AA75D5760C8590D83BA832D59A9B090CA0E9 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
11:46:08.0092 0x0b58  uagp35 - ok
11:46:08.0139 0x0b58  [ F763E070843EE2803DE1395002B42938, 0060F5D7AD091D7F0CC25C98AB9DD8258A9837958AFE845971CD04E29A6A8658 ] UBHelper        C:\Windows\system32\drivers\UBHelper.sys
11:46:08.0154 0x0b58  UBHelper - ok
11:46:08.0185 0x0b58  [ D9728AF68C4C7693CB100B8441CBDEC6, A2CEE1EE4EF17106349F4E6967F504354801934179FBB3F10B9A4E3C30BC28CE ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
11:46:08.0217 0x0b58  udfs - ok
11:46:08.0248 0x0b58  [ ECEF404F62863755951E09C802C94AD5, 5D92062B3E371F196774EBFE840C78501E55A244DB2A49703C7AC0141C7DABF1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe
11:46:08.0295 0x0b58  UI0Detect - ok
11:46:08.0310 0x0b58  [ B0ACFDC9E4AF279E9116C03E014B2B27, 455D30859E381361FF6EE8B01EDC22A2E66CD5EC22CA9F314E88009DB77A8BAF ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
11:46:08.0326 0x0b58  uliagpkx - ok
11:46:08.0341 0x0b58  [ 9224BB254F591DE4CA8D572A5F0D635C, C5E7B24587AC5A28ECA63300307AD95B8A846833340126AE378840A40E53C056 ] uliahci         C:\Windows\system32\drivers\uliahci.sys
11:46:08.0357 0x0b58  uliahci - ok
11:46:08.0404 0x0b58  [ 8514D0E5CD0534467C5FC61BE94A569F, A6EFB967044F88335469DB3351587E31CEC659BB6A7D8ED45C68329232C31BB9 ] UlSata          C:\Windows\system32\drivers\ulsata.sys
11:46:08.0419 0x0b58  UlSata - ok
11:46:08.0529 0x0b58  [ 38C3C6E62B157A6BC46594FADA45C62B, 44F87DC955CB4E35E0EB4C8B4E931472B33D97FE000C22370A06AD5EDCEFD0BA ] ulsata2         C:\Windows\system32\drivers\ulsata2.sys
11:46:08.0544 0x0b58  ulsata2 - ok
11:46:08.0560 0x0b58  [ 32CFF9F809AE9AED85464492BF3E32D2, 91AAA47AEF17F373276B01AC8FA823592A0C854541A7A9A3B78F2350DB964EBC ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
11:46:08.0653 0x0b58  umbus - ok
11:46:08.0685 0x0b58  [ 68308183F4AE0BE7BF8ECD07CB297999, 4444233CA3C42BEE50ED47553D4AE5A7C12D8F288D2FA4B2DAE1D9B9FEC1A72D ] upnphost        C:\Windows\System32\upnphost.dll
11:46:08.0763 0x0b58  upnphost - ok
11:46:08.0809 0x0b58  [ AAB0B5F72D2D726FBFDC895A2902DE1D, 7824AF6E2ADEA23F208526F3A62AD1BACDBBDB23E58EB5806890B0761529C50F ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
11:46:08.0856 0x0b58  usbccgp - ok
11:46:08.0903 0x0b58  [ E9476E6C486E76BC4898074768FB7131, D14B8F69A511DC1F990A9C123C18689AFE59659BA8130D248D8D03E9BD2143B6 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
11:46:08.0950 0x0b58  usbcir - ok
11:46:08.0981 0x0b58  [ 153E8515CB86F8BB5D1A8B478EBF4BB2, 0F1F79BA7C32ACAAE69184A56E67D6E18E2E2F07E0BE23F266401431169DAE14 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
11:46:08.0997 0x0b58  usbehci - ok
11:46:09.0215 0x0b58  [ 2AE6BCEBD85D31317E433733DAF25888, 7B2C0E8703D0275A620160E479166EB7AA31B0F146507603535CEBF0BA4684A4 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
11:46:09.0262 0x0b58  usbhub - ok
11:46:09.0402 0x0b58  [ 38DBC7DD6CC5A72011F187425384388B, 456CFCD190035C3033709C8DC0F6DC4352BBF751D57C0C52DD04F8C301FEBACD ] usbohci         C:\Windows\system32\drivers\usbohci.sys
11:46:09.0449 0x0b58  usbohci - ok
11:46:09.0636 0x0b58  [ B51E52ACF758BE00EF3A58EA452FE360, 79E629EC5DE8AB7F31B0EE9AE94C71E8F703FED5C09A816228726974F7790C85 ] usbprint        C:\Windows\system32\drivers\usbprint.sys
11:46:09.0683 0x0b58  usbprint - ok
11:46:09.0870 0x0b58  [ BE3DA31C191BC222D9AD503C5224F2AD, 201FB0FDBF423342202686DC0D8A3221B7798AE04C04A649D3441C257C733CE8 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
11:46:09.0948 0x0b58  USBSTOR - ok
11:46:09.0964 0x0b58  [ 44056325428A8E4C755830426E29878F, 95F182047746D352B7DC2B22298D5E58738E1B787C110D1DE841C026FB8A67EB ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys
11:46:09.0979 0x0b58  usbuhci - ok
11:46:10.0198 0x0b58  [ 73FF24E21B690625A58109637DDA0DF7, 62B1F9CD82678E2110D4BB5CC86EE8A7AB0757681443916620B6AAA1EF0DECEB ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
11:46:10.0276 0x0b58  usbvideo - ok
11:46:10.0307 0x0b58  [ 1509E705F3AC1D474C92454A5C2DD81F, 7F525921A3513224F8B093A16E19B4235B300349A14B0B86EE11B7473BA53337 ] UxSms           C:\Windows\System32\uxsms.dll
11:46:10.0354 0x0b58  UxSms - ok
11:46:10.0572 0x0b58  [ CD88D1B7776DC17A119049742EC07EB4, 6B68B9EDB8C6BCB2644F1F004D5743E928509D12107D996F390A24A72E0AA528 ] vds             C:\Windows\System32\vds.exe
11:46:10.0666 0x0b58  vds - ok
11:46:10.0728 0x0b58  [ 87B06E1F30B749A114F74622D013F8D4, 06C06EF87F7DC668D23B50AA5F419F62474ACF90E325E167491BF290286D6594 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
11:46:10.0775 0x0b58  vga - ok
11:46:10.0806 0x0b58  [ 2E93AC0A1D8C79D019DB6C51F036636C, 8B6F3B4EE90691A22788915AD0F99D8EE617750430A34E7CEB9AB4FB4E581755 ] VgaSave         C:\Windows\System32\drivers\vga.sys
11:46:10.0837 0x0b58  VgaSave - ok
11:46:10.0853 0x0b58  [ 5D7159DEF58A800D5781BA3A879627BC, 499A8E51FDE61AE0D7C1812D1E5B331211A36BD095A4992C629B93DE6D80F4E6 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
11:46:10.0869 0x0b58  viaagp - ok
11:46:10.0884 0x0b58  [ C4F3A691B5BAD343E6249BD8C2D45DEE, 19DE07AD6CD51036FA8A6B8EE82F34D7F5264FF3A12CBE6E52BD036D0303E319 ] ViaC7           C:\Windows\system32\drivers\viac7.sys
11:46:10.0900 0x0b58  ViaC7 - ok
11:46:10.0978 0x0b58  [ AADF5587A4063F52C2C3FED7887426FC, 0A74791A236FDAFCD045CFB79A159245B94F7C2033E0CD830C1B76F0F994E06D ] viaide          C:\Windows\system32\drivers\viaide.sys
11:46:10.0978 0x0b58  viaide - ok
11:46:10.0993 0x0b58  [ 69503668AC66C77C6CD7AF86FBDF8C43, 2CE407674A58313737073F02B9A617460BBA84B36C3A16D98AE5ED45279F5006 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
11:46:11.0009 0x0b58  volmgr - ok
11:46:11.0259 0x0b58  [ 23E41B834759917BFD6B9A0D625D0C28, 9F60992805262F936E8DA33610FDF60A191ECAFC08BBF657C8F9A21833C8EFC5 ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
11:46:11.0274 0x0b58  volmgrx - ok
11:46:11.0321 0x0b58  [ 786DB5771F05EF300390399F626BF30A, 4A07BE5AEDBA4C15C2F9A91250F0488A0B0305C67BB7A037508D5CBF86D4E1B7 ] volsnap         C:\Windows\system32\drivers\volsnap.sys
11:46:11.0337 0x0b58  volsnap - ok
11:46:11.0368 0x0b58  [ 587253E09325E6BF226B299774B728A9, C9F46197819C2A095456393C518A9B00B59ECDC54F464D038AA7F8DCCDB93CCF ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
11:46:11.0383 0x0b58  vsmraid - ok
11:46:11.0461 0x0b58  [ DB3D19F850C6EB32BDCB9BC0836ACDDB, D81FF1CDA87A2FE83EFD5B3FE01EFF940952F8BAEE70BEA3B2F6EF30E2121704 ] VSS             C:\Windows\system32\vssvc.exe
11:46:11.0571 0x0b58  VSS - ok
11:46:11.0617 0x0b58  [ 96EA68B9EB310A69C25EBB0282B2B9DE, C76D3427F8A2953CB4D96BBA1523679CBE1BBF7FA821A35D2FBEB3E67AC6A10B ] W32Time         C:\Windows\system32\w32time.dll
11:46:11.0664 0x0b58  W32Time - ok
11:46:11.0695 0x0b58  [ 48DFEE8F1AF7C8235D4E626F0C4FE031, A41D05BC0DA3C476C32E0A4DAF015DF7BADF28A03CE236D5596885FF1772F148 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
11:46:11.0789 0x0b58  WacomPen - ok
11:46:11.0820 0x0b58  [ 55201897378CCA7AF8B5EFD874374A26, 350ADDCEFAA33E301027CFEA8DDE703F6FBD6E53624598CB2E7B671B9E48F7CC ] Wanarp          C:\Windows\system32\DRIVERS\wanarp.sys
11:46:11.0836 0x0b58  Wanarp - ok
11:46:11.0851 0x0b58  [ 55201897378CCA7AF8B5EFD874374A26, 350ADDCEFAA33E301027CFEA8DDE703F6FBD6E53624598CB2E7B671B9E48F7CC ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
11:46:11.0867 0x0b58  Wanarpv6 - ok
11:46:11.0914 0x0b58  [ A3CD60FD826381B49F03832590E069AF, 213C5DB5E5D828264286FD7548527566D6160CCA780BC6853B7B28CECF329674 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
11:46:11.0976 0x0b58  wcncsvc - ok
11:46:12.0023 0x0b58  [ 11BCB7AFCDD7AADACB5746F544D3A9C7, 0370E20FD12ED713F94E5CD76F068F7A7A5E7F42416DD2A8A41249020DA7DA31 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
11:46:12.0070 0x0b58  WcsPlugInService - ok
11:46:12.0085 0x0b58  [ 78FE9542363F297B18C027B2D7E7C07F, 6BC3ED2A48EF41E1EE597FD58271DB12256EC013518663331CD0FBCB3FC415EE ] Wd              C:\Windows\system32\drivers\wd.sys
11:46:12.0117 0x0b58  Wd - ok
11:46:12.0195 0x0b58  [ 25944D2CC49E0A6C581D02A74B7D6645, AF8FFAFEC07F1A6A3D4008E609E8E1D705A8DFCC7995C766E3946887203F7BEE ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
11:46:12.0241 0x0b58  Wdf01000 - ok
11:46:12.0273 0x0b58  [ ABFC76B48BB6C96E3338D8943C5D93B5, B5B22D445724D58641A53276063A4AA2A98F07B93865C86E94661EB31BD63511 ] WdiServiceHost  C:\Windows\system32\wdi.dll
11:46:12.0319 0x0b58  WdiServiceHost - ok
11:46:12.0319 0x0b58  [ ABFC76B48BB6C96E3338D8943C5D93B5, B5B22D445724D58641A53276063A4AA2A98F07B93865C86E94661EB31BD63511 ] WdiSystemHost   C:\Windows\system32\wdi.dll
11:46:12.0351 0x0b58  WdiSystemHost - ok
11:46:12.0413 0x0b58  [ 04C37D8107320312FBAE09926103D5E2, 1C6726A9871CBACB240AFA93E57781515F01758D43693DDA395EA683D97234F0 ] WebClient       C:\Windows\System32\webclnt.dll
11:46:12.0475 0x0b58  WebClient - ok
11:46:12.0538 0x0b58  [ AE3736E7E8892241C23E4EBBB7453B60, 0F998116CC07CD719CB237EAE53BB16B2EDD6973828B9C1055EB981AEA0453D1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
11:46:12.0585 0x0b58  Wecsvc - ok
11:46:12.0616 0x0b58  [ 670FF720071ED741206D69BD995EA453, 4B96F5E3545F69AE9EBC75DC4AB27B87306D656EE526AE39E7EC7E2B6F83F7FD ] wercplsupport   C:\Windows\System32\wercplsupport.dll
11:46:12.0663 0x0b58  wercplsupport - ok
11:46:12.0678 0x0b58  [ 32B88481D3B326DA6DEB07B1D03481E7, 821FBAF147E525ED15EB9391B16A96C6D5464841258B11F277EFB57A3BD50E37 ] WerSvc          C:\Windows\System32\WerSvc.dll
11:46:12.0709 0x0b58  WerSvc - ok
11:46:12.0803 0x0b58  [ 4575AA12561C5648483403541D0D7F2B, 2DBB7904285F16E879E1662C4CC4DFAA420D5EB24DDFC4BAC0B7616F5F44649A ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll
11:46:12.0834 0x0b58  WinDefend - ok
11:46:12.0834 0x0b58  WinHttpAutoProxySvc - ok
11:46:12.0912 0x0b58  [ 6B2A1D0E80110E3D04E6863C6E62FD8A, EE8BC7C378993EFE90273764C83119EBF331768CD7B24DE949233C74A51306C2 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
11:46:12.0928 0x0b58  Winmgmt - ok
11:46:13.0037 0x0b58  [ 7CFE68BDC065E55AA5E8421607037511, C2CE76D52AD4E31FC4216E94457DC16ABF65A5F3E883F0BD97AD387FB7574533 ] WinRM           C:\Windows\system32\WsmSvc.dll
11:46:13.0146 0x0b58  WinRM - ok
11:46:13.0224 0x0b58  [ C008405E4FEEB069E30DA1D823910234, C392A7B5FEACB7D11A3A231C1AD65D533984E6E7429ECD3BFBF90A27E8DEB157 ] Wlansvc         C:\Windows\System32\wlansvc.dll
11:46:13.0318 0x0b58  Wlansvc - ok
11:46:13.0474 0x0b58  [ 5144AE67D60EC653F97DDF3FEED29E77, F6238767284B2356A9F502E2ACCFAAC283FA13CBF238E98B5115A55179526B10 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
11:46:13.0583 0x0b58  wlidsvc - ok
11:46:13.0645 0x0b58  [ 2E7255D172DF0B8283CDFB7B433B864E, 60C786CF0EA4A29B309B9457F0496D5A0AF1F093FC2C5D88078865814B7DBBA3 ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
11:46:13.0661 0x0b58  WmiAcpi - ok
11:46:13.0708 0x0b58  [ 43BE3875207DCB62A85C8C49970B66CC, 27169F2E8A30807794407DA8F80611E4287F940AAE2A1F00F547901872FB9703 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
11:46:13.0755 0x0b58  wmiApSrv - ok
11:46:13.0848 0x0b58  [ 3978704576A121A9204F8CC49A301A9B, 936CC13B90A183613BDA4081556C96D48CA415B5F65D61E18CB5F2E51EEBE59F ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe
11:46:13.0973 0x0b58  WMPNetworkSvc - ok
11:46:14.0004 0x0b58  [ CFC5A04558F5070CEE3E3A7809F3FF52, 45899E04000E21C4E009BE8B6149F199A5B2E0512C657A525770BF9DBFED7D2B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
11:46:14.0051 0x0b58  WPCSvc - ok
11:46:14.0082 0x0b58  [ 801FBDB89D472B3C467EB112A0FC9246, C24053FA12732089384D3AF06C676FF201D282FC5AD56A42B6EE8BAED4379CB2 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
11:46:14.0129 0x0b58  WPDBusEnum - ok
11:46:14.0238 0x0b58  [ C108DC20ACE05072350DBB6934E277FB, 548E6ABE4C4ADE48260FFDC7BADFD1697972EA3AE94D6576498C8A183D8CE0C8 ] WPFFontCache_v0400 C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
11:46:14.0347 0x0b58  WPFFontCache_v0400 - ok
11:46:14.0394 0x0b58  [ E3A3CB253C0EC2494D4A61F5E43A389C, 10BA8B102E31B961819E524FCA5FA817B588EC77FB26B4E176D0A5CFF11EDF79 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
11:46:14.0425 0x0b58  ws2ifsl - ok
11:46:14.0457 0x0b58  [ 1CA6C40261DDC0425987980D0CD2AAAB, 727C1E3A170316641F832A8D197EDA6D6EE1206E4ED7B741E5A4017B7F2F7B88 ] wscsvc          C:\Windows\system32\wscsvc.dll
11:46:14.0519 0x0b58  wscsvc - ok
11:46:14.0613 0x0b58  [ 4422AC5ED8D4C2F0DB63E71D4C069DD7, B010DCC7B802C26A701A7DE1CA1B21D6B43D99FE88524D015C9228376B0BDA6E ] WSDPrintDevice  C:\Windows\system32\DRIVERS\WSDPrint.sys
11:46:14.0644 0x0b58  WSDPrintDevice - ok
11:46:14.0644 0x0b58  WSearch - ok
11:46:14.0784 0x0b58  [ FC3EC24FCE372C89423E015A2AC1A31E, 8D028182CF83667D3E4D148979972D208FA6D9B8540EE47A0A7831B770ECD257 ] wuauserv        C:\Windows\system32\wuaueng.dll
11:46:14.0925 0x0b58  wuauserv - ok
11:46:14.0956 0x0b58  [ 06E6F32C8D0A3F66D956F57B43A2E070, 9A6BD96A28294B0372F16E13D652FD603308F64B74A56E41E0C68C5E8011F943 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
11:46:15.0003 0x0b58  WudfPf - ok
11:46:15.0034 0x0b58  [ 867C301E8B790040AE9CF6486E8041DF, D867D6498C987944D99508B2FAD6D6B749FA1EDFE8124B0863D4A642352F0855 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
11:46:15.0065 0x0b58  WUDFRd - ok
11:46:15.0096 0x0b58  [ FE47B7BC8EA320C2D9B5E5BF6E303765, 34518DBD1E9EA6E5DA62273B18613761E1D9C6B4E074A93C6D639FBAF02222EA ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
11:46:15.0112 0x0b58  wudfsvc - ok
11:46:15.0190 0x0b58  [ 556B5CFE8D21B256ADD7F87D7F4B4123, 7D3CC5C0DAC1CC418E9692CCCBBBC61AB0124E0280DA366B2A7F207F61CE9BAD ] {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl
11:46:15.0190 0x0b58  {49DE1C67-83F8-4102-99E0-C16DCC7EEC796} - ok
11:46:15.0205 0x0b58  ================ Scan global ===============================
11:46:15.0221 0x0b58  [ F31EEBC1A1C81FD04005489CC3DCDFE7, 098C35ACFCCE1686C5A6DB6057001CBF8B06A863A0802CB2E9D793F4795F8CEE ] C:\Windows\system32\basesrv.dll
11:46:15.0268 0x0b58  [ A508314231C49AEE86987CEA3EAECAD1, D29BCFA967C23C7264592576D62D95FA8C687E8662D19DCCC73653A9EFB6340D ] C:\Windows\system32\winsrv.dll
11:46:15.0315 0x0b58  [ A508314231C49AEE86987CEA3EAECAD1, D29BCFA967C23C7264592576D62D95FA8C687E8662D19DCCC73653A9EFB6340D ] C:\Windows\system32\winsrv.dll
11:46:15.0361 0x0b58  [ D4E6D91C1349B7BFB3599A6ADA56851B, 8748091BF27F05D28D45688E04DD9229A4B2E159209A64F457703F66A8CECE4D ] C:\Windows\system32\services.exe
11:46:15.0393 0x0b58  [ Global ] - ok
11:46:15.0393 0x0b58  ================ Scan MBR ==================================
11:46:15.0439 0x0b58  [ 5586EABCC0D095DB340D873E2B236896 ] \Device\Harddisk0\DR0
11:46:16.0469 0x0b58  \Device\Harddisk0\DR0 - ok
11:46:16.0469 0x0b58  ================ Scan VBR ==================================
11:46:16.0500 0x0b58  [ 3BD18029846414131250710B0475CDCA ] \Device\Harddisk0\DR0\Partition1
11:46:16.0531 0x0b58  \Device\Harddisk0\DR0\Partition1 - ok
11:46:16.0531 0x0b58  ================ Scan generic autorun ======================
11:46:16.0578 0x0b58  [ 04AF1033DA631C180CB606571BD05B65, 22EFE6DC96EDAEF010FE702B75F20000F07C0281DCCE8A59F5BE88A3B5A0AE8A ] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
11:46:16.0578 0x0b58  ArcadeDeluxeAgent - ok
11:46:16.0625 0x0b58  [ 81CB1A5F6CDEA9D644A8538ADEE23FFB, ABD8697C3F6A3589E935F9DC8EFAF2C2E19014E16711D24F3A76159F852E5C29 ] C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
11:46:16.0641 0x0b58  CLMLServer - ok
11:46:16.0656 0x0b58  NvCplDaemon - ok
11:46:16.0687 0x0b58  [ 1E6F89160B2231FD286F81DB1631D9B5, A8E8E273D36F95E9C54E0D32D32EBC0D66AA1DF49A9889D8BF0EE151A2CA55D9 ] C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
11:46:16.0719 0x0b58  AmIcoSinglun - detected UnsignedFile.Multi.Generic ( 1 )
11:46:26.0827 0x0b58  AmIcoSinglun ( UnsignedFile.Multi.Generic ) - warning
11:46:26.0827 0x0b58  Force sending object to P2P due to detect: C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
11:46:30.0525 0x0b58  Object send P2P result: true
11:46:33.0301 0x0b58  [ B3634EA7EF2F25034C13EC675949C21F, F2CB88EF23FE23639035D9617802A9E3E5938DA64F57DAC9F263DC4CC49DEE5A ] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
11:46:33.0613 0x0b58  RtHDVCpl - ok
11:46:33.0707 0x0b58  [ E74B7600258ED95E7FD2CC05DF1EBA17, 54DA7251E22D0EE79912DD8D834BF77983C46F949861A6CD55E7D3E2B9B04BE2 ] C:\Program Files\Realtek\Audio\HDA\Skytel.exe
11:46:33.0910 0x0b58  Skytel - ok
11:46:33.0972 0x0b58  [ 0D3DFFA8BA3E63592FC2C652CF3B0E9C, B5237E04006436F5C1A156D46BC0FC8F5FFFF049A04A66170FDF934A971F512E ] C:\Windows\PLFSetI.exe
11:46:33.0988 0x0b58  PLFSetI - detected UnsignedFile.Multi.Generic ( 1 )
11:46:36.0390 0x0b58  Detect skipped due to KSN trusted
11:46:36.0390 0x0b58  PLFSetI - ok
11:46:36.0577 0x0b58  [ 48C6F43F8D2458C510648C7F2615C39D, 5C75F1AF20E7CB72C7EA800DEF8DDF5D487E6ED3A5D1B614FF86F9230990FCFF ] c:\Program Files\Acer Bio Protection\PdtWzd.exe
11:46:36.0780 0x0b58  VitaKeyPdtWzd - detected UnsignedFile.Multi.Generic ( 1 )
11:46:39.0183 0x0b58  Detect skipped due to KSN trusted
11:46:39.0183 0x0b58  VitaKeyPdtWzd - ok
11:46:39.0307 0x0b58  [ 6C4878F3483B959891408B804DE4475C, 7C7843544070AAAA46A361CE831881D414C76AFEF70D63EE6DBEEFA0E7692609 ] C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
11:46:39.0401 0x0b58  SynTPEnh - ok
11:46:39.0495 0x0b58  [ B1D67301071949FA3A498FB282B90403, B32CD6168933625ABE9E492F725C4C95C9264EE28B429A84365DDEA0FE37DF4C ] C:\Program Files\Launch Manager\LManager.exe
11:46:39.0573 0x0b58  LManager - ok
11:46:39.0588 0x0b58  [ 632D5B4CECA11FAC1ED5D3D8FD5EECD5, FC4F5F65AB3B7434A48A4CE16F9F292E94EBEC7E483653DC28FA8FEAFE419B6E ] C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
11:46:39.0604 0x0b58  BackupManagerTray - ok
11:46:39.0807 0x0b58  [ 31351C6701E4899ECD4F6EF54C5C7387, 788C8DE18BE76F92203951B03E6470F328E987FAD0B688177F204FB4BCA117C4 ] C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe
11:46:39.0838 0x0b58  Acer ePower Management - ok
11:46:39.0869 0x0b58  [ 05C7B4108B6C4EE95D41B7DFCBE7D39A, AC2CD53DCADAFBA680C913163F6DC0D9B1AB418E65F43F3DA27B45739D108681 ] C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
11:46:39.0885 0x0b58  EgisTecLiveUpdate - ok
11:46:39.0978 0x0b58  [ 0BF547F313B248FFFB3AC858318054CB, D4243BED51127DEA6F7BE35B99AFC2580D7F17C55D2499B54C962B469715BA54 ] C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
11:46:39.0994 0x0b58  mwlDaemon - ok
11:46:40.0056 0x0b58  [ 98E216DEF3BFA62E9A849FD3E3B6AFDB, B42D0648C3D3BC9B3AB153C14A70852C32BFA73DB98B692FFBEA735D6F958453 ] C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
11:46:40.0072 0x0b58  PlayMovie - ok
11:46:40.0197 0x0b58  [ 0E34B7BB1FCF22BCC1E394D16F9E992B, 382CA8E6BAC301E2F277F8EDA03D263FF71272796A8EED582C36294EEE9191F9 ] C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
11:46:40.0197 0x0b58  GrooveMonitor - ok
11:46:40.0321 0x0b58  [ 6E95474CB9E22BC9768EFA176C6A0A29, 0AE08EA94B239F4418BF49A734E36AFEE624CF5C2EB1C24820131D24FD0A7C27 ] C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe
11:46:40.0321 0x0b58  HP Software Update - ok
11:46:40.0602 0x0b58  [ 69B388D8F3085411D00F875FF5CBCAF6, 22F6DCF1E6D1DD28793CCDFE9FC33E737180BB3C5C65BE3BFA9C2522B6B6F66B ] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
11:46:40.0633 0x0b58  avgnt - ok
11:46:40.0696 0x0b58  [ BF08674925F151BD4537B89A493E3E0C, 6A97562E998A2B90649FF7986313AD33823053FF98BBE163AD39AAA5E01FC545 ] C:\Windows\ehome\ehTray.exe
11:46:40.0743 0x0b58  ehTray.exe - ok
11:46:40.0758 0x0b58  [ 9D4EFD270A7EB7957D6751F60B275357, AD12290EA69DDBFB2599CD1B6524E9E43DA35EF695C9295C223F31F7306C96FA ] C:\Program Files\Alcohol Soft\Alcohol 120\axcmd.exe
11:46:40.0774 0x0b58  AlcoholAutomount - ok
11:46:41.0086 0x0b58  [ 2457344535A189B6950D339FE011650B, 3D5B3C5550B5D3E2F09E1848274E0807834730721699D1C8F4539AB6024E0ED8 ] C:\Program Files\Origin\Origin.exe
11:46:41.0398 0x0b58  EADM - ok
11:46:41.0538 0x0b58  [ 9E7CF18F5B355CFEF20AB9F61C392936, A5478D10F31961188DF3ED18287F63373F47AB21280A608400798D47B5BAFF62 ] C:\Program Files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe
11:46:41.0725 0x0b58  HP Photosmart 6510 series (NET) - ok
11:46:41.0725 0x0b58  Waiting for KSN requests completion. In queue: 14
11:46:42.0739 0x0b58  Waiting for KSN requests completion. In queue: 14
11:46:43.0753 0x0b58  Waiting for KSN requests completion. In queue: 14
11:46:44.0939 0x0b58  AV detected via SS2: Avira Desktop, C:\Program Files\Avira\AntiVir Desktop\wsctool.exe ( 15.0.8.652 ), 0x41000 ( enabled : updated )
11:46:44.0970 0x0b58  Win FW state via NFP2: enabled
11:46:47.0373 0x0b58  ============================================================
11:46:47.0373 0x0b58  Scan finished
11:46:47.0373 0x0b58  ============================================================
11:46:47.0373 0x0c60  Detected object count: 1
11:46:47.0373 0x0c60  Actual detected object count: 1
11:49:17.0320 0x0c60  AmIcoSinglun ( UnsignedFile.Multi.Generic ) - skipped by user
11:49:17.0320 0x0c60  AmIcoSinglun ( UnsignedFile.Multi.Generic ) - User select action: Skip 
11:50:12.0357 0x13ac  Deinitialize success

gruß, hillera

schrauber · 19.03.2015, 21:05

hi,

Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

hillera · 20.03.2015, 08:37

Hi Schrauber

Mein IE hat sich jetzt automatisch upgedatet (IE 9).

Hier die log von ComboFix:

Code:

ATTFilter

ComboFix 15-03-14.03 - Patrick 20.03.2015   8:18.3.2 - x86
ausgeführt von:: c:\users\Patrick\Desktop\ComboFix.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-02-20 bis 2015-03-20  ))))))))))))))))))))))))))))))
.
.
2015-03-20 07:27 . 2015-03-20 07:28	--------	d-----w-	c:\users\Patrick\AppData\Local\temp
2015-03-20 07:27 . 2015-03-20 07:27	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-03-20 07:16 . 2015-02-16 04:21	9041640	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{1160F611-4468-4FF0-8D6E-8BFCA0709EE4}\mpengine.dll
2015-03-19 11:12 . 2015-02-10 07:02	305152	----a-w-	c:\program files\Internet Explorer\ieuser.exe
2015-03-19 10:04 . 2015-03-19 10:35	--------	d-----w-	c:\programdata\Malwarebytes' Anti-Malware (portable)
2015-03-19 10:04 . 2015-03-19 10:04	119512	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-03-19 10:02 . 2015-03-19 10:02	92888	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-03-19 09:48 . 2015-03-19 09:48	--------	d-----w-	c:\program files\VS Revo Group
2015-03-18 16:35 . 2015-03-18 16:36	--------	d-----w-	C:\FRST
2015-03-18 12:51 . 2015-03-18 12:51	--------	d-----w-	c:\users\Public\Roaming
2015-03-18 12:51 . 2015-03-18 12:51	--------	d-----w-	c:\users\Patrick\Roaming
2015-03-18 12:51 . 2015-03-18 12:51	--------	d-----w-	c:\users\Default\Roaming
2015-03-18 12:51 . 2015-03-18 12:51	--------	d-----w-	c:\users\Default\AppData\Roaming\Intel
2015-03-18 12:49 . 2015-03-18 12:49	--------	d-----w-	c:\program files\Cisco
2015-03-18 12:49 . 2015-03-18 12:49	--------	d-----w-	c:\program files\Common Files\Intel
2015-03-18 12:49 . 2015-03-18 12:49	--------	d-----w-	c:\programdata\Intel
2015-03-18 12:34 . 2015-03-18 12:34	--------	d-----w-	c:\program files\NVIDIA Corporation
2015-03-16 17:14 . 2015-03-16 17:14	--------	d-----w-	c:\users\Patrick\AppData\Roaming\Avira
2015-03-16 17:12 . 2015-02-25 16:53	37352	----a-w-	c:\windows\system32\drivers\avkmgr.sys
2015-03-16 17:12 . 2015-02-25 16:53	136216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2015-03-16 17:12 . 2015-02-25 16:53	105864	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2015-03-16 17:02 . 2015-02-24 03:23	246920	------w-	c:\windows\system32\MpSigStub.exe
2015-03-14 12:46 . 2015-03-19 10:04	--------	d-----w-	c:\programdata\Malwarebytes
2015-03-14 10:50 . 2015-01-29 01:35	369664	----a-w-	c:\windows\system32\WMPhoto.dll
2015-03-14 10:49 . 2015-01-29 01:35	975360	----a-w-	c:\windows\system32\WindowsCodecs.dll
2015-03-14 10:47 . 2015-02-26 00:18	2064384	----a-w-	c:\windows\system32\win32k.sys
2015-03-14 10:35 . 2015-02-20 02:03	34304	----a-w-	c:\windows\system32\atmlib.dll
2015-03-14 10:35 . 2015-02-20 00:28	296960	----a-w-	c:\windows\system32\atmfd.dll
2015-03-14 10:34 . 2015-02-26 02:01	3604408	----a-w-	c:\windows\system32\ntkrnlpa.exe
2015-03-14 10:34 . 2015-01-09 02:04	49152	----a-w-	c:\windows\system32\csrsrv.dll
2015-03-14 10:34 . 2015-01-09 00:18	64000	----a-w-	c:\windows\system32\smss.exe
2015-03-14 10:34 . 2015-02-26 02:01	3552184	----a-w-	c:\windows\system32\ntoskrnl.exe
2015-03-14 10:34 . 2015-01-21 02:02	807936	----a-w-	c:\windows\system32\msctf.dll
2015-03-14 10:33 . 2015-03-06 04:01	279040	----a-w-	c:\windows\system32\schannel.dll
2015-03-14 10:32 . 2014-10-13 01:12	2264064	----a-w-	c:\windows\system32\msi.dll
2015-02-18 08:47 . 2015-02-18 08:47	17323192	----a-w-	c:\program files\Common Files\Microsoft Shared\OFFICE12\MSO.DLL
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-02-17 15:04 . 2015-02-17 15:04	1202848	----a-w-	c:\windows\system32\FM20.DLL
2015-02-11 22:45 . 2012-04-04 05:56	701616	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2015-02-11 22:45 . 2011-07-05 05:26	71344	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2015-02-11 22:03 . 2015-02-11 22:03	6103040	----a-w-	c:\program files\GUT21F3.tmp
2015-02-10 08:30 . 2015-03-19 11:12	54272	----a-w-	c:\windows\apppatch\iebrshim.dll
2015-01-15 04:13 . 2015-02-11 22:50	440760	----a-w-	c:\windows\system32\drivers\ksecdd.sys
2012-04-21 01:18 . 2011-05-25 11:32	97208	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-05-14 21:02	120104	----a-w-	c:\program files\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ehTray.exe"="c:\windows\ehome\ehTray.exe" [2008-01-21 125952]
"AlcoholAutomount"="c:\program files\Alcohol Soft\Alcohol 120\axcmd.exe" [2009-09-30 203928]
"EADM"="c:\program files\Origin\Origin.exe" [2015-02-27 3631448]
"HP Photosmart 6510 series (NET)"="c:\program files\HP\HP Photosmart 6510 series\Bin\ScanToPCActivationApp.exe" [2011-05-25 1801064]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"ArcadeDeluxeAgent"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-01-20 156968]
"CLMLServer"="c:\program files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe" [2009-01-20 202024]
"NvCplDaemon"="c:\windows\system32\NvCpl.dll" [2009-06-23 13793824]
"AmIcoSinglun"="c:\program files\AmIcoSingLun\AmIcoSinglun.exe" [2008-10-24 237568]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2009-03-11 6957600]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-03-11 1833504]
"PLFSetI"="c:\windows\PLFSetI.exe" [2009-09-05 200704]
"VitaKeyPdtWzd"="c:\program files\Acer Bio Protection\PdtWzd.exe" [2009-02-13 3549696]
"SynTPEnh"="c:\program files\Synaptics\SynTP\SynTPEnh.exe" [2008-12-05 1410344]
"LManager"="c:\program files\Launch Manager\LManager.exe" [2009-02-24 870920]
"BackupManagerTray"="c:\program files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-04-11 249600]
"Acer ePower Management"="c:\program files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe" [2009-06-23 440864]
"EgisTecLiveUpdate"="c:\program files\EgisTec Egis Software Update\EgisUpdate.exe" [2009-05-13 199464]
"mwlDaemon"="c:\program files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-05-14 345384]
"PlayMovie"="c:\program files\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2008-12-26 173288]
"GrooveMonitor"="c:\program files\Microsoft Office\Office12\GrooveMonitor.exe" [2009-02-26 30040]
"HP Software Update"="c:\program files\Hp\HP Software Update\HPWuSchd2.exe" [2011-03-24 49208]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-03-19 704512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Notification Packages	REG_MULTI_SZ   	c:\program files\Acer Bio Protection\PwdFilter
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfPf]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfRd]
@="Driver"
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\WudfSvc]
@="Service"
.
R3 acsint;acsint;c:\windows\system32\DRIVERS\acsint.sys [2012-06-07 38440]
R3 acsmux;acsmux;c:\windows\system32\DRIVERS\acsmux.sys [2012-06-07 57256]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
[HKEY_LOCAL_MACHINE\software\microsoft\active setup\installed components\{8A69D345-D564-463c-AFF1-A69D9E530F96}]
2015-03-13 18:13	1061704	----a-w-	c:\program files\Google\Chrome\Application\41.0.2272.89\Installer\chrmstp.exe
.
Inhalt des "geplante Tasks" Ordners
.
2015-03-19 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-04 22:45]
.
2015-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 10:04]
.
2015-03-20 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2010-03-17 10:04]
.
2015-03-20 c:\windows\Tasks\HP Photo Creations Messager.job
- c:\programdata\HP Photo Creations\MessageCheck.exe [2011-02-15 10:11]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = https://www.google.de/
mStart Page = about:blank
uSearchAssistant = www.google.com
Trusted Zone: hs-ulm.de\www
TCP: DhcpNameServer = 192.168.2.1
DPF: {538793D5-659C-4639-A56C-A179AD87ED44} - hxxps://rz-asa.hs-ulm.de/CACHE/stc/1/binaries/vpnweb.cab
FF - ProfilePath - c:\users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\
FF - prefs.js: browser.search.defaulturl - 
FF - ExtSQL: 2015-03-14 13:32; fx@foxysecureKDJJHVLSDUVFU.com; c:\users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\fx@foxysecureKDJJHVLSDUVFU.com
FF - ExtSQL: !HIDDEN! 2009-12-21 20:15; {20a82645-c095-46ed-80e3-08825760534b}; c:\windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2015-03-20 08:28
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Services\{49DE1C67-83F8-4102-99E0-C16DCC7EEC796}]
"ImagePath"="\??\c:\program files\Acer Arcade Deluxe\PlayMovie\000.fcl"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-360123627-3130887994-3134240397-1000\Software\SecuROM\License information*]
"datasecu"=hex:8c,02,c1,91,b8,49,ca,ba,1c,05,6e,91,26,92,29,22,89,00,8d,1f,31,
   d6,bd,88,15,6f,12,e3,8b,50,47,2e,ef,2a,c8,51,4e,34,f9,b1,21,33,68,93,75,d8,\
"rkeysecu"=hex:29,23,be,84,e1,6c,d6,ae,52,90,49,f1,f1,bb,e9,eb
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
--------------------- Durch laufende Prozesse gestartete DLLs ---------------------
.
- - - - - - - > 'lsass.exe'(764)
c:\program files\Acer Bio Protection\PwdFilter.dll
.
- - - - - - - > 'Explorer.exe'(5952)
c:\program files\EgisTec\MyWinLocker 3\x86\psdprotect.dll
c:\program files\EgisTec\MyWinLocker 3\x86\sysenv.dll
c:\program files\Acer\Acer PowerSmart Manager\SysHook.dll
.
Zeit der Fertigstellung: 2015-03-20  08:30:40
ComboFix-quarantined-files.txt  2015-03-20 07:30
ComboFix2.txt  2015-03-18 13:43
ComboFix3.txt  2015-03-15 19:36
.
Vor Suchlauf: 20 Verzeichnis(se), 209.588.064.256 Bytes frei
Nach Suchlauf: 20 Verzeichnis(se), 209.620.455.424 Bytes frei
.
- - End Of File - - 828C1B5706E7A6D118E69EF0B545E4DB
5586EABCC0D095DB340D873E2B236896

gruß, hillera

schrauber · 21.03.2015, 09:47

Downloade Dir bitte

Malwarebytes Anti-Malware

Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
Starte Malwarebytes' Anti-Malware (MBAM).
Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte

AdwCleaner auf deinen Desktop.

Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
Starte die AdwCleaner.exe mit einem Doppelklick.
Stimme den Nutzungsbedingungen zu.
Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
- "Tracing" Schlüssel löschen
- Winsock Einstellungen zurücksetzen
- Proxy Einstellungen zurücksetzen
- Internet Explorer Richtlinien zurücksetzen
- Chrome Richtlinien zurücksetzen
- Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
Drücke eine beliebige Taste, um das Tool zu starten.
Je nach System kann der Scan eine Weile dauern.
Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

hillera · 21.03.2015, 11:51

Hi, Schrauber

Eine Frage. Mbam konnte ich mit meinem IE nicht downloaden(Seite kann nicht angezeigt werden). Mit Google-Chrome hat es funktioniert.

Hier die erste beiden logs.

Mbam.txt:

Code:

ATTFilter

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 21.03.2015
Suchlauf-Zeit: 10:35:21
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.4.1018
Malware Datenbank: v2015.03.21.03
Rootkit Datenbank: v2015.02.25.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows Vista Service Pack 2
CPU: x86
Dateisystem: NTFS
Benutzer: Patrick

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 330864
Verstrichene Zeit: 17 Min, 41 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 2
PUP.Optional.Iminent.A, C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_start.iminent.com_0.localstorage, In Quarantäne, [a483df69ec9edc5a6662c076ac597c84], 
PUP.Optional.Iminent.A, C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Local Storage\http_start.iminent.com_0.localstorage-journal, In Quarantäne, [4bdcdf69dfab61d5b21691a55da8f20e], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)

Adwcleaner.txt:

Code:

ATTFilter

# AdwCleaner v4.112 - Bericht erstellt 21/03/2015 um 11:23:48
# Aktualisiert 09/03/2015 von Xplode
# Datenbank : 2015-03-05.1 [Lokal]
# Betriebssystem : Windows Vista (TM) Home Premium Service Pack 2 (x86)
# Benutzername : Patrick - PATRICK-PC
# Gestarted von : C:\Users\Patrick\Desktop\AdwCleaner_4.112.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****


***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****


***** [ Internetbrowser ] *****

-\\ Internet Explorer v9.0.8112.16633


-\\ Mozilla Firefox v12.0 (de)


-\\ Google Chrome v41.0.2272.101

[C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Web Data] - Gelöscht [Search Provider] : hxxp://start.iminent.com/?appId=A455CC52-8EFB-4ED3-AA1E-20EE9CD10917&ref=toolbox&q={searchTerms}

*************************

AdwCleaner[R3].txt - [1069 Bytes] - [21/03/2015 11:14:25]
AdwCleaner[S3].txt - [962 Bytes] - [21/03/2015 11:23:48]

########## EOF - C:\AdwCleaner\AdwCleaner[S3].txt - [1020  Bytes] ##########

die restlichen logs folgen. Danke

Hi, Schrauber

hier die zwei restlichen Logs.

JRT.txt:

Code:

ATTFilter

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.4.5 (03.17.2015:1)
OS: Windows Vista (TM) Home Premium x86
Ran by Patrick on 21.03.2015 at 11:39:08,71
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders



~~~ Event Viewer Logs were cleared





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 21.03.2015 at 11:42:28,60
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~

FRST.txt:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Patrick (administrator) on PATRICK-PC on 21-03-2015 11:47:04
Running from C:\Users\Patrick\Desktop
Loaded Profiles: Patrick (Available profiles: Patrick)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\CompPtcVUI.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\BASVC.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Windows\System32\PnkBstrA.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(AlcorMicro Co., Ltd.) C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\PdtWzd.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor Corp.) C:\Users\Patrick\AppData\Local\temp\RtkBtMnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Acer Corp.) C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_16_0_0_305_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ArcadeDeluxeAgent] => C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [156968 2009-01-21] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [202024 2009-01-21] (CyberLink)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [AmIcoSinglun] => C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [237568 2008-10-24] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6957600 2009-03-11] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-09-05] ()
HKLM\...\Run: [VitaKeyPdtWzd] => c:\Program Files\Acer Bio Protection\PdtWzd.exe [3549696 2009-02-13] (Egis Technology Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1410344 2008-12-05] (Synaptics, Inc.)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [870920 2009-02-24] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] => C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [249600 2009-04-11] (NewTech Infosystems, Inc.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-06-23] (Acer Incorporated)
HKLM\...\Run: [EgisTecLiveUpdate] => C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [PlayMovie] => C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [173288 2008-12-26] (Acer Corp.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-19] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3631448 2015-02-27] (Electronic Arts)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [413696 2009-01-22] (Acer)
Lsa: [Notification Packages] c:\Program Files\Acer Bio Protection\PwdFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
ShortcutTarget: Acer VCM.lnk -> C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-360123627-3130887994-3134240397-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll [2012-12-17] (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-12-17] (Sun Microsystems, Inc.)
DPF: {538793D5-659C-4639-A56C-A179AD87ED44} https://rz-asa.hs-ulm.de/CACHE/stc/1/binaries/vpnweb.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-09] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll [2008-07-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default
FF DefaultSearchUrl: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-11] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=1.6.0_38 -> C:\Windows\system32\npdeployJava1.dll [2012-11-14] (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-360123627-3130887994-3134240397-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-20] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\searchplugins\keepmysearch.xml [2014-06-28]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Snap.Do  - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{c8b90241-fbd6-b3e4-4cc9-7ea41dff93db} [2013-11-14]
FF Extension: Greasemonkey - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2012-08-28]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} [2012-05-30]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-06-16]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2013-01-12]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-17]
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [Not Found]
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\fx@foxysecureKDJJHVLSDUVFU.com [Not Found]

Chrome: 
=======
CHR HomePage: Default -> 
CHR RestoreOnStartup: Default -> "hxxp://start.iminent.com/?appId=A455CC52-8EFB-4ED3-AA1E-20EE9CD10917"
CHR DefaultSearchKeyword: Default -> start.iminent.com
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-20]
CHR Extension: (Google Search) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-20]
CHR Extension: (Avira Browser Safety) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-03-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-21]
CHR Extension: (Gmail) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-20]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [75048 2008-12-18] ()
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [707104 2009-06-23] (Acer Incorporated)
R2 EvtEng; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [860160 2008-10-16] (Intel(R) Corporation) [File not signed]
R2 IGBASVC; c:\Program Files\Acer Bio Protection\BASVC.exe [3440640 2009-02-13] (Egis Technology Inc.) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S4 msvsmon80; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2799808 2005-09-23] (Microsoft Corporation)
R2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [61184 2009-04-11] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
S3 Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-12-18] ()
S2 RegSrvc; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [466944 2008-10-16] (Intel(R) Corporation) [File not signed]
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2008-11-27] (Acer Incorporated) [File not signed]
S3 SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2010-03-17] (SolidWorks) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [38440 2012-06-07] (Cisco Systems, Inc.)
S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [57256 2012-06-07] (Cisco Systems, Inc.)
R0 AlfaFF; C:\Windows\System32\drivers\AlfaFF.sys [42608 2009-02-13] (Alfa Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-12-17] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-02-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-02-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-02-25] (Avira Operations GmbH & Co. KG)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R1 ElRawDisk; C:\Windows\system32\drivers\dddsk.sys [22312 2009-02-12] (EldoS Corporation)
R2 FPSensor; C:\Windows\System32\Drivers\FPSensor.sys [26928 2008-12-24] (Egis)
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
R2 int15; c:\Windows\system32\drivers\int15.sys [69632 2009-02-13] () [File not signed]
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-12-17] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] (Egis Incorporated.)
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] (Egis Incorporated.)
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] (Egis Incorporated.)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2009-12-17] () [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-02-25] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [87536 2008-12-26] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Patrick\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-21 11:47 - 2015-03-21 11:47 - 00021130 _____ () C:\Users\Patrick\Desktop\FRST.txt
2015-03-21 11:42 - 2015-03-21 11:42 - 00000636 _____ () C:\Users\Patrick\Desktop\JRT.txt
2015-03-21 11:37 - 2015-03-21 11:37 - 01388672 _____ (Thisisu) C:\Users\Patrick\Desktop\JRT.exe
2015-03-21 11:30 - 2015-03-21 11:23 - 00001100 _____ () C:\Users\Patrick\Desktop\AdwCleaner[S3].txt
2015-03-21 11:13 - 2015-03-21 11:23 - 00000000 ____D () C:\AdwCleaner
2015-03-21 11:11 - 2015-03-21 11:11 - 02171392 _____ () C:\Users\Patrick\Desktop\AdwCleaner_4.112.exe
2015-03-21 11:09 - 2015-03-21 11:09 - 00001573 _____ () C:\Users\Patrick\Desktop\mbam.txt
2015-03-21 10:32 - 2015-03-21 10:32 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-21 10:32 - 2015-03-21 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-21 10:32 - 2015-03-21 10:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-03-21 10:32 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-21 10:32 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-21 10:30 - 2015-03-21 10:28 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Desktop\mbam-setup-2.1.4.1018.exe
2015-03-21 10:28 - 2015-03-21 10:28 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-20 08:30 - 2015-03-20 08:30 - 00011532 _____ () C:\Users\Patrick\Desktop\ComboFix.txt
2015-03-20 08:14 - 2015-03-20 08:30 - 00000000 ____D () C:\ComboFix
2015-03-20 08:10 - 2015-03-20 08:10 - 05615380 ____R (Swearware) C:\Users\Patrick\Desktop\ComboFix.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 12375040 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-03-19 12:15 - 2015-03-19 12:15 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-19 12:15 - 2015-03-19 12:15 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-19 12:15 - 2015-03-19 12:15 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-19 12:15 - 2015-03-19 12:15 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-03-19 12:15 - 2015-03-19 12:15 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-19 11:41 - 2015-03-19 11:41 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Patrick\Desktop\tdsskiller.exe
2015-03-19 11:04 - 2015-03-21 10:34 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-19 11:04 - 2015-03-19 11:35 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-19 11:02 - 2015-03-19 11:37 - 00000000 ____D () C:\Users\Patrick\Desktop\mbar
2015-03-19 11:02 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-19 10:58 - 2015-03-19 10:58 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Patrick\Desktop\mbar-1.09.1.1004.exe
2015-03-19 10:48 - 2015-03-19 10:48 - 00001061 _____ () C:\Users\Patrick\Desktop\Revo Uninstaller.lnk
2015-03-19 10:48 - 2015-03-19 10:48 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-03-19 10:40 - 2015-03-19 10:35 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Patrick\Desktop\revosetup95.exe
2015-03-18 17:36 - 2015-03-18 19:18 - 00043637 _____ () C:\Users\Patrick\Desktop\Addition.txt
2015-03-18 17:36 - 2015-03-18 17:36 - 00033280 _____ () C:\Users\Patrick\Desktop\1.FRST.txt
2015-03-18 17:35 - 2015-03-21 11:47 - 00000000 ____D () C:\FRST
2015-03-18 17:34 - 2015-03-18 17:34 - 01135104 _____ (Farbar) C:\Users\Patrick\Desktop\FRST.exe
2015-03-18 13:51 - 2015-03-18 13:51 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Intel
2015-03-18 13:51 - 2015-03-18 13:51 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\ProgramData\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\Program Files\Common Files\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\Program Files\Cisco
2015-03-18 13:34 - 2015-03-18 13:34 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-03-16 18:14 - 2015-03-16 18:14 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Avira
2015-03-16 18:13 - 2015-03-16 18:13 - 00001851 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-03-16 18:13 - 2015-03-16 18:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-16 18:12 - 2015-02-25 17:54 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-03-16 18:07 - 2015-03-16 18:08 - 163016912 _____ () C:\Users\Patrick\Downloads\avira_free650_antivirus_de.exe
2015-03-16 18:02 - 2015-02-24 04:23 - 00246920 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-15 20:12 - 2015-03-20 08:30 - 00000000 ____D () C:\Qoobox
2015-03-15 20:12 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-15 20:12 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-15 20:12 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-15 20:11 - 2015-03-15 20:34 - 00000000 ____D () C:\Windows\erdnt
2015-03-14 13:46 - 2015-03-19 11:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-14 11:50 - 2015-01-29 02:35 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-14 11:49 - 2015-01-29 02:35 - 00975360 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-14 11:47 - 2015-02-26 01:18 - 02064384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-14 11:35 - 2015-02-20 03:03 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-14 11:35 - 2015-02-20 01:28 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-14 11:34 - 2015-02-26 03:01 - 03604408 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-03-14 11:34 - 2015-02-26 03:01 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-14 11:34 - 2015-01-21 03:02 - 00807936 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-14 11:34 - 2015-01-09 03:04 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-14 11:34 - 2015-01-09 01:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-14 11:33 - 2015-03-06 05:01 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-14 11:32 - 2015-02-18 03:02 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-14 11:32 - 2014-10-13 02:12 - 02264064 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-21 11:43 - 2012-04-04 06:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-21 11:30 - 2014-09-20 14:30 - 00000000 ____D () C:\ProgramData\Origin
2015-03-21 11:29 - 2006-11-02 11:33 - 01597796 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-21 11:25 - 2012-07-11 12:20 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-03-21 11:25 - 2010-03-17 10:18 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-21 11:25 - 2009-09-05 16:48 - 00220268 _____ () C:\ProgramData\nvModes.001
2015-03-21 11:25 - 2009-09-05 16:47 - 00220268 _____ () C:\ProgramData\nvModes.dat
2015-03-21 11:25 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-21 11:25 - 2006-11-02 13:47 - 00003824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-21 11:25 - 2006-11-02 13:47 - 00003824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-21 11:24 - 2009-09-05 16:39 - 01374584 _____ () C:\Windows\WindowsUpdate.log
2015-03-21 11:24 - 2008-01-21 03:47 - 01095982 _____ () C:\Windows\PFRO.log
2015-03-21 11:24 - 2006-11-02 14:01 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-21 11:14 - 2013-02-20 12:42 - 00001967 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-21 11:14 - 2010-03-17 10:18 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-21 11:01 - 2012-12-27 17:33 - 00000260 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2015-03-20 19:59 - 2014-09-20 13:47 - 00000000 ____D () C:\Users\Patrick\Documents\Settlers7
2015-03-20 19:58 - 2009-12-16 09:42 - 00000000 ____D () C:\Program Files\OpenOffice.org 3
2015-03-20 19:57 - 2009-12-16 09:43 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.1
2015-03-20 19:37 - 2012-12-27 17:28 - 00000000 ____D () C:\Users\Patrick\AppData\Local\HP
2015-03-20 19:37 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\twain_32
2015-03-20 08:28 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2015-03-20 08:12 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2015-03-20 07:52 - 2006-11-02 12:18 - 00000000 ___RD () C:\Windows\Offline Web Pages
2015-03-20 07:52 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-03-19 12:15 - 2011-05-18 06:54 - 00014861 _____ () C:\Windows\IE9_main.log
2015-03-19 12:15 - 2006-11-02 07:32 - 00008798 _____ () C:\Windows\system32\icrav03.rat
2015-03-19 12:15 - 2006-11-02 07:32 - 00001988 _____ () C:\Windows\system32\ticrf.rat
2015-03-18 14:03 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-03-18 13:51 - 2009-10-24 16:19 - 00000000 ____D () C:\Users\Patrick
2015-03-18 13:51 - 2009-09-05 16:54 - 00014358 _____ () C:\Windows\DPINST.LOG
2015-03-18 13:51 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2015-03-18 13:51 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2015-03-18 13:49 - 2009-02-11 21:12 - 00000000 ____D () C:\Program Files\Intel
2015-03-18 13:38 - 2009-11-24 19:09 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Microsoft Help
2015-03-16 18:23 - 2009-03-12 04:26 - 00000000 ____D () C:\ProgramData\Temp
2015-03-16 18:12 - 2013-08-08 23:03 - 00000000 ____D () C:\Program Files\Avira
2015-03-16 18:04 - 2010-03-21 11:47 - 00007808 _____ () C:\Users\Patrick\AppData\Local\d3d9caps.dat
2015-03-16 17:51 - 2012-01-05 16:31 - 00000000 ____D () C:\ProgramData\Avira
2015-03-16 12:32 - 2014-07-20 22:54 - 00000000 ____D () C:\Windows\system32\mjcm
2015-03-16 10:29 - 2009-10-24 16:20 - 00000000 ____D () C:\Program Files\Google
2015-03-15 21:10 - 2009-03-12 03:59 - 00000000 ____D () C:\Program Files\Acer GameZone
2015-03-15 21:01 - 2009-12-16 09:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-15 21:00 - 2009-10-24 16:20 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2015-03-15 21:00 - 2009-10-24 16:20 - 00000000 ____D () C:\ProgramData\Google
2015-03-15 20:53 - 2013-11-09 13:38 - 00000901 _____ () C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-03-15 10:00 - 2006-11-02 13:52 - 00168874 _____ () C:\Windows\setupact.log
2015-03-15 08:38 - 2012-06-16 15:55 - 00000000 ____D () C:\Users\Patrick\Tracing
2015-03-14 12:56 - 2006-11-02 13:47 - 00396760 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-14 11:50 - 2009-03-12 04:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-14 11:47 - 2013-08-14 13:28 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-14 11:37 - 2006-11-02 11:24 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-03-08 16:20 - 2010-03-10 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\PokerStars.NET
2015-03-08 16:19 - 2010-03-10 13:43 - 00000000 ____D () C:\Program Files\PokerStars.NET
2015-02-27 10:23 - 2014-09-20 14:30 - 00000000 ____D () C:\Program Files\Origin
2015-02-22 11:25 - 2010-03-31 08:38 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\vlc

==================== Files in the root of some directories =======

2015-02-11 23:03 - 2015-02-11 23:03 - 6103040 _____ () C:\Program Files\GUT21F3.tmp
2009-12-18 10:53 - 2009-12-18 10:53 - 0139152 _____ () C:\Users\Patrick\AppData\Roaming\PnkBstrK.sys
2013-10-14 19:02 - 2013-10-14 19:02 - 0023888 _____ () C:\Users\Patrick\AppData\Roaming\UserTile.png
2009-10-24 16:28 - 2013-01-02 09:38 - 0000232 _____ () C:\Users\Patrick\AppData\Roaming\wklnhst.dat
2010-03-21 11:47 - 2015-03-16 18:04 - 0007808 _____ () C:\Users\Patrick\AppData\Local\d3d9caps.dat
2009-12-18 11:31 - 2014-10-10 21:14 - 0012288 _____ () C:\Users\Patrick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-02-28 18:24 - 2012-12-27 00:03 - 0000000 _____ () C:\Users\Patrick\AppData\Local\Temptable.xml
2011-01-11 11:35 - 2012-12-27 00:16 - 0018052 _____ () C:\Users\Patrick\AppData\Local\Temp_table.xml
2012-12-27 17:29 - 2012-12-27 17:29 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-03-12 04:26 - 2009-09-05 17:02 - 0004789 _____ () C:\ProgramData\ArcadeDeluxe2.log
2009-09-05 16:48 - 2015-03-21 11:25 - 0220268 _____ () C:\ProgramData\nvModes.001
2009-09-05 16:47 - 2015-03-21 11:25 - 0220268 _____ () C:\ProgramData\nvModes.dat

Some content of TEMP:
====================
C:\Users\Patrick\AppData\Local\temp\avgnt.exe
C:\Users\Patrick\AppData\Local\temp\Quarantine.exe
C:\Users\Patrick\AppData\Local\temp\RtkBtMnt.exe
C:\Users\Patrick\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-21 11:31

==================== End Of Log ============================

--- --- ---

--- --- ---

Gruß, hillera

schrauber · 21.03.2015, 21:17

ESET Online Scanner

Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
Lade und starte Eset Online Scanner
Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
Klicke auf Starten.
Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
Klicke am Ende des Suchlaufs auf Fertig stellen.
Schließe das Fenster von ESET.
Explorer öffnen.
C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
Logfile hier posten.
Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte

SecurityCheck und:

Speichere es auf dem Desktop.
Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

hillera · 22.03.2015, 10:38

Hallo Schrauber

Eset-online-scanner hatte zwei Bedrohungen gefunden, ich bin nicht sicher ob diese auch entfernt wurden. Oder kann ESET gar nich bereinigen?
Hier die Log von ESET:

Code:

ATTFilter

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=c7733ed7ddfa1541b1cceb8aa368a405
# engine=23019
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-03-22 12:14:48
# local_time=2015-03-22 01:14:48 (+0100, Mitteleuropäische Zeit)
# country="Germany"
# lang=1031
# osver=6.0.6002 NT Service Pack 2
# compatibility_mode_1=''
# compatibility_mode=5892 16776574 100 100 143614 264516016 0 0
# scanned=257130
# found=2
# cleaned=0
# scan_time=10995
sh=19A86F0DEBB54A4C068A27E7A403178A174B5E9A ft=0 fh=0000000000000000 vn="Win32/Packed.VMProtect.D Trojaner" ac=I fn="C:\Stefan Spiele\Anno.1404.Venedig.GERMAN-0x0007\de-a14v.iso"
sh=58FD5BFD5621171F4F1C69389E3ACA9BC3C80F64 ft=1 fh=ee2985aba3d07ac3 vn="Win32/SweetIM.J evtl. unerwünschte Anwendung" ac=I fn="C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AEUTJE3\SkywalkerSetup[1].exe"

Hallo Schrauber

Hier die nächsten Logs.

SecurityCheck:

Code:

ATTFilter

 Results of screen317's Security Check version 0.99.97  
 Windows Vista Service Pack 2 x86 (UAC is enabled)  
 Internet Explorer 9  
 Internet Explorer 8  
``````````````Antivirus/Firewall Check:`````````````` 
 WMI entry may not exist for antivirus; attempting automatic update. 
 Avira successfully updated! 
`````````Anti-malware/Other Utilities Check:````````` 
 Java DB 10.5.3.0   
 Java(TM) 6 Update 38  
 Java-Editor 9.15d, 2010.09.28   
 Java version 32-bit out of Date! 
  Java 64-bit 8 Update 31  
 Adobe Flash Player 	16.0.0.305  
 Adobe Reader 10.1.13 Adobe Reader out of Date!  
 Mozilla Firefox 12.0 Firefox out of Date!  
 Google Chrome (41.0.2272.101) 
 Google Chrome (41.0.2272.89) 
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  % 
````````````````````End of Log``````````````````````

FRST:

FRST Logfile:

FRST Logfile:

Code:

ATTFilter

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 11-03-2015
Ran by Patrick (administrator) on PATRICK-PC on 22-03-2015 10:24:12
Running from C:\Users\Patrick\Desktop
Loaded Profiles: Patrick (Available profiles: Patrick)
Platform: Microsoft® Windows Vista™ Home Premium  Service Pack 2 (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: IE)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Microsoft Corporation) C:\Windows\System32\SLsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(NVIDIA Corporation) C:\Windows\System32\nvvsvc.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\CompPtcVUI.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Agere Systems) C:\Windows\System32\agrsmsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
() C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe
(Intel(R) Corporation) C:\Program Files\Intel\WiFi\bin\EvtEng.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\BASVC.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\MWLService.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
() C:\Windows\System32\PnkBstrA.exe
(Intel(R) Corporation) C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\RS_Service.exe
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corporation) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(CyberLink Corp.) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe
(CyberLink) C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe
(AlcorMicro Co., Ltd.) C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
() C:\Windows\PLFSetI.exe
(Egis Technology Inc.) C:\Program Files\Acer Bio Protection\PdtWzd.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPEnh.exe
(Realtek Semiconductor Corp.) C:\Users\Patrick\AppData\Local\temp\RtkBtMnt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(Dritek System Inc.) C:\Program Files\Launch Manager\LManager.exe
(NewTech Infosystems, Inc.) C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe
(Egis Technology Inc.) C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe
(Egis Technology Inc.) C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe
(Acer Corp.) C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe
(Hewlett-Packard) C:\Program Files\HP\HP Software Update\hpwuschd2.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Microsoft Corporation) C:\Windows\ehome\ehtray.exe
(Microsoft Corporation) C:\Windows\ehome\ehmsas.exe
(Acer Incorporated) C:\Program Files\Acer\Acer VCM\AcerVCM.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTray.exe
(Synaptics, Inc.) C:\Program Files\Synaptics\SynTP\SynTPHelper.exe
(Microsoft Corporation) C:\Windows\System32\wbem\unsecapp.exe
(Acer Incorporated) C:\Program Files\Acer\Acer PowerSmart Manager\ePowerEvent.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil32_16_0_0_305_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\conime.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [ArcadeDeluxeAgent] => C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe [156968 2009-01-21] (CyberLink Corp.)
HKLM\...\Run: [CLMLServer] => C:\Program Files\Acer Arcade Deluxe\Acer Arcade Deluxe\Kernel\CLML\CLMLSvc.exe [202024 2009-01-21] (CyberLink)
HKLM\...\Run: [NvCplDaemon] => RUNDLL32.EXE C:\Windows\system32\NvCpl.dll,NvStartup
HKLM\...\Run: [AmIcoSinglun] => C:\Program Files\AmIcoSingLun\AmIcoSinglun.exe [237568 2008-10-24] (AlcorMicro Co., Ltd.)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [6957600 2009-03-11] (Realtek Semiconductor)
HKLM\...\Run: [Skytel] => C:\Program Files\Realtek\Audio\HDA\Skytel.exe [1833504 2009-03-11] (Realtek Semiconductor Corp.)
HKLM\...\Run: [PLFSetI] => C:\Windows\PLFSetI.exe [200704 2009-09-05] ()
HKLM\...\Run: [VitaKeyPdtWzd] => c:\Program Files\Acer Bio Protection\PdtWzd.exe [3549696 2009-02-13] (Egis Technology Inc.)
HKLM\...\Run: [SynTPEnh] => C:\Program Files\Synaptics\SynTP\SynTPEnh.exe [1410344 2008-12-05] (Synaptics, Inc.)
HKLM\...\Run: [LManager] => C:\Program Files\Launch Manager\LManager.exe [870920 2009-02-24] (Dritek System Inc.)
HKLM\...\Run: [BackupManagerTray] => C:\Program Files\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe [249600 2009-04-11] (NewTech Infosystems, Inc.)
HKLM\...\Run: [Acer ePower Management] => C:\Program Files\Acer\Acer PowerSmart Manager\ePowerTrayLauncher.exe [440864 2009-06-23] (Acer Incorporated)
HKLM\...\Run: [EgisTecLiveUpdate] => C:\Program Files\EgisTec Egis Software Update\EgisUpdate.exe [199464 2009-05-13] (Egis Technology Inc.)
HKLM\...\Run: [mwlDaemon] => C:\Program Files\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe [345384 2009-05-14] (Egis Technology Inc.)
HKLM\...\Run: [PlayMovie] => C:\Program Files\Acer Arcade Deluxe\PlayMovie\PMVService.exe [173288 2008-12-26] (Acer Corp.)
HKLM\...\Run: [GrooveMonitor] => C:\Program Files\Microsoft Office\Office12\GrooveMonitor.exe [30040 2009-02-26] (Microsoft Corporation)
HKLM\...\Run: [HP Software Update] => C:\Program Files\Hp\HP Software Update\HPWuSchd2.exe [49208 2011-03-24] (Hewlett-Packard)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [704512 2015-03-19] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [ehTray.exe] => C:\Windows\ehome\ehTray.exe [125952 2008-01-21] (Microsoft Corporation)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\...\Run: [EADM] => C:\Program Files\Origin\Origin.exe [3631448 2015-02-27] (Electronic Arts)
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Acer.scr [413696 2009-01-22] (Acer)
Lsa: [Notification Packages] c:\Program Files\Acer Bio Protection\PwdFilter
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Acer VCM.lnk
ShortcutTarget: Acer VCM.lnk -> C:\Program Files\Acer\Acer VCM\AcerVCM.exe (Acer Incorporated)
ShellIconOverlayIdentifiers: [egisPSDP] -> {30A0A3F6-38AC-4C53-BB8B-0D95238E25BA} => C:\Program Files\EgisTec\MyWinLocker 3\x86\psdprotect.dll (Egis Technology Inc.)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-360123627-3130887994-3134240397-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKLM\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Software\Microsoft\Internet Explorer\Main,Start Page = https://www.google.de/
HKU\S-1-5-21-360123627-3130887994-3134240397-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Groove GFS Browser Helper -> {72853161-30C5-4D22-B7F9-0BBC1D38A37E} -> C:\Program Files\Microsoft Office\Office12\GrooveShellExtensions.dll [2009-02-26] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre6\bin\ssv.dll [2012-12-17] (Sun Microsystems, Inc.)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2009-08-18] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre6\bin\jp2ssv.dll [2012-12-17] (Sun Microsystems, Inc.)
DPF: {538793D5-659C-4639-A56C-A179AD87ED44} https://rz-asa.hs-ulm.de/CACHE/stc/1/binaries/vpnweb.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_38-windows-i586.cab
DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab
Handler: grooveLocalGWS - {88FED34C-F0CA-4636-A375-3CB6248B04CD} - C:\Program Files\Microsoft Office\Office12\GrooveSystemServices.dll [2009-02-26] (Microsoft Corporation)
Handler: livecall - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler: ms-itss - {0A9007C0-4076-11D3-8789-0000F8105754} - c:\Program Files\Common Files\Microsoft Shared\Information Retrieval\msitss.dll [2007-06-09] (Microsoft Corporation)
Handler: msnim - {828030A1-22C1-4009-854F-8E305202313F} - C:\Program Files\Windows Live\Messenger\msgrapp.14.0.8050.1202.dll [2008-12-02] (Microsoft Corporation)
Handler: skype4com - {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Program Files\Acer\Acer VCM\Skype4COM.dll [2008-07-02] (Skype Technologies)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default
FF DefaultSearchUrl: 
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_16_0_0_305.dll [2015-02-11] ()
FF Plugin: @Google.com/GoogleEarthPlugin -> C:\Program Files\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin: @java.com/DTPlugin,version=1.6.0_38 -> C:\Windows\system32\npdeployJava1.dll [2012-11-14] (Sun Microsystems, Inc.)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.30514.0\npctrl.dll [2014-05-13] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeLive,version=1.5 -> C:\Program Files\Microsoft\Office Live\npOLW.dll [2010-04-26] (Microsoft Corp.)
FF Plugin: @microsoft.com/WLPG,version=14.0.8051.1204 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2008-12-04] (Microsoft Corporation)
FF Plugin: @microsoft.com/WPF,version=3.5 -> c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll [2008-07-29] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-21] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-360123627-3130887994-3134240397-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll [2015-03-20] ()
FF Plugin ProgramFiles/Appdata: C:\Program Files\mozilla firefox\plugins\nppdf32.dll [2014-12-03] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\searchplugins\keepmysearch.xml [2014-06-28]
FF Extension: Microsoft .NET Framework Assistant - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{20a82645-c095-46ed-80e3-08825760534b} [2010-04-28]
FF Extension: Snap.Do  - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{c8b90241-fbd6-b3e4-4cc9-7ea41dff93db} [2013-11-14]
FF Extension: Greasemonkey - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{e4a8a97b-f2ed-450b-b12d-ee082ba24781} [2012-08-28]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0032-ABCDEFFEDCBA} [2012-05-30]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} [2012-06-16]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0035-ABCDEFFEDCBA} [2012-09-20]
FF Extension: Java Console - C:\Program Files\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0038-ABCDEFFEDCBA} [2013-01-12]
FF HKLM\...\Firefox\Extensions: [{20a82645-c095-46ed-80e3-08825760534b}] - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension
FF Extension: Microsoft .NET Framework Assistant - c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\DotNetAssistantExtension [2009-12-17]
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [Not Found]
FF Extension: No Name - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\extensions\fx@foxysecureKDJJHVLSDUVFU.com [Not Found]

Chrome: 
=======
CHR HomePage: Default -> 
CHR RestoreOnStartup: Default -> "hxxp://start.iminent.com/?appId=A455CC52-8EFB-4ED3-AA1E-20EE9CD10917"
CHR DefaultSearchKeyword: Default -> start.iminent.com
CHR DefaultSuggestURL: Default -> 
CHR Profile: C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (YouTube) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2013-02-20]
CHR Extension: (Google Search) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2013-02-20]
CHR Extension: (Avira Browser Safety) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2015-03-14]
CHR Extension: (Chrome Hotword Shared Module) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\lccekmodgklaepjeofjdjpbminllajkg [2015-03-14]
CHR Extension: (Google Wallet) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-09-21]
CHR Extension: (Gmail) - C:\Users\Patrick\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2013-02-20]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-19] (Avira Operations GmbH & Co. KG)
R2 CLHNService; C:\Program Files\Acer Arcade Deluxe\HomeMedia\Kernel\DMP\CLHNService.exe [75048 2008-12-18] ()
R2 ePowerSvc; C:\Program Files\Acer\Acer PowerSmart Manager\ePowerSvc.exe [707104 2009-06-23] (Acer Incorporated)
R2 EvtEng; C:\Program Files\Intel\WiFi\bin\EvtEng.exe [860160 2008-10-16] (Intel(R) Corporation) [File not signed]
R2 IGBASVC; c:\Program Files\Acer Bio Protection\BASVC.exe [3440640 2009-02-13] (Egis Technology Inc.) [File not signed]
S2 MBAMService; C:\Program Files\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-03-17] (Malwarebytes Corporation)
S4 msvsmon80; C:\Program Files\Microsoft Visual Studio 8\Common7\IDE\Remote Debugger\x86\msvsmon.exe [2799808 2005-09-23] (Microsoft Corporation)
R2 MWLService; C:\Program Files\EgisTec\MyWinLocker 3\x86\\MWLService.exe [305448 2009-05-14] (Egis Technology Inc.)
R2 NTI IScheduleSvc; C:\Program Files\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [61184 2009-04-11] (NewTech Infosystems, Inc.)
R2 NTISchedulerSvc; C:\Program Files\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [144632 2008-09-23] (NewTech Infosystems, Inc.)
S3 Origin Client Service; C:\Program Files\Origin\OriginClientService.exe [1910640 2015-02-27] (Electronic Arts)
R2 PnkBstrA; C:\Windows\system32\PnkBstrA.exe [75064 2009-12-18] ()
R2 RegSrvc; C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe [466944 2008-10-16] (Intel(R) Corporation) [File not signed]
R2 RS_Service; C:\Program Files\Acer\Acer VCM\RS_Service.exe [237568 2008-11-27] (Acer Incorporated) [File not signed]
S3 SolidWorks Licensing Service; C:\Program Files\Common Files\SolidWorks Shared\Service\SolidWorksLicensing.exe [79360 2010-03-17] (SolidWorks) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [272952 2008-01-21] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

S3 acsint; C:\Windows\System32\DRIVERS\acsint.sys [38440 2012-06-07] (Cisco Systems, Inc.)
S3 acsmux; C:\Windows\System32\DRIVERS\acsmux.sys [57256 2012-06-07] (Cisco Systems, Inc.)
R0 AlfaFF; C:\Windows\System32\drivers\AlfaFF.sys [42608 2009-02-13] (Alfa Corporation)
R2 atksgt; C:\Windows\System32\DRIVERS\atksgt.sys [281760 2009-12-17] ()
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-02-25] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-02-25] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2015-02-25] (Avira Operations GmbH & Co. KG)
S3 CVirtA; C:\Windows\System32\DRIVERS\CVirtA.sys [5275 2007-01-18] (Cisco Systems, Inc.)
R1 ElRawDisk; C:\Windows\system32\drivers\dddsk.sys [22312 2009-02-12] (EldoS Corporation)
R2 FPSensor; C:\Windows\System32\Drivers\FPSensor.sys [26928 2008-12-24] (Egis)
R3 hidshim; C:\Windows\System32\DRIVERS\hidshim.sys [5632 2008-10-08] (Windows (R) Codename Longhorn DDK provider)
R2 int15; c:\Windows\system32\drivers\int15.sys [69632 2009-02-13] () [File not signed]
R2 lirsgt; C:\Windows\System32\DRIVERS\lirsgt.sys [25888 2009-12-17] ()
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [23256 2015-03-17] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [51928 2015-03-17] (Malwarebytes Corporation)
R1 mwlPSDFilter; C:\Windows\System32\DRIVERS\mwlPSDFilter.sys [19504 2008-12-04] (Egis Incorporated.)
R1 mwlPSDNServ; C:\Windows\System32\DRIVERS\mwlPSDNServ.sys [16432 2008-12-04] (Egis Incorporated.)
R1 mwlPSDVDisk; C:\Windows\System32\DRIVERS\mwlPSDVDisk.sys [59952 2008-12-04] (Egis Incorporated.)
R3 nuvotonhidgeneric; C:\Windows\System32\DRIVERS\nuvotonhidgeneric.sys [22528 2008-10-08] (Nuvoton Technology Corporation)
R0 sptd; C:\Windows\System32\Drivers\sptd.sys [691696 2009-12-17] () [File not signed]
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2015-02-25] (Avira GmbH)
R2 {49DE1C67-83F8-4102-99E0-C16DCC7EEC796}; C:\Program Files\Acer Arcade Deluxe\PlayMovie\000.fcl [87536 2008-12-26] (CyberLink Corp.)
U5 AppMgmt; C:\Windows\system32\svchost.exe [21504 2008-01-21] (Microsoft Corporation)
S3 catchme; \??\C:\Users\Patrick\AppData\Local\Temp\catchme.sys [X]
S3 IpInIp; system32\DRIVERS\ipinip.sys [X]
S3 NwlnkFlt; system32\DRIVERS\nwlnkflt.sys [X]
S3 NwlnkFwd; system32\DRIVERS\nwlnkfwd.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-22 10:24 - 2015-03-22 10:24 - 00021363 _____ () C:\Users\Patrick\Desktop\FRST.txt
2015-03-22 10:22 - 2015-03-22 10:22 - 00001171 _____ () C:\Users\Patrick\Desktop\checkup.txt
2015-03-22 10:12 - 2015-03-22 10:12 - 00852604 _____ () C:\Users\Patrick\Desktop\SecurityCheck.exe
2015-03-21 22:06 - 2015-03-21 22:06 - 02347384 _____ (ESET) C:\Users\Patrick\Desktop\esetsmartinstaller_deu.exe
2015-03-21 11:47 - 2015-03-21 11:48 - 00041429 _____ () C:\Users\Patrick\Desktop\2.FRST.txt
2015-03-21 11:42 - 2015-03-21 11:42 - 00000636 _____ () C:\Users\Patrick\Desktop\JRT.txt
2015-03-21 11:37 - 2015-03-21 11:37 - 01388672 _____ (Thisisu) C:\Users\Patrick\Desktop\JRT.exe
2015-03-21 11:30 - 2015-03-21 11:23 - 00001100 _____ () C:\Users\Patrick\Desktop\AdwCleaner[S3].txt
2015-03-21 11:13 - 2015-03-21 11:23 - 00000000 ____D () C:\AdwCleaner
2015-03-21 11:11 - 2015-03-21 11:11 - 02171392 _____ () C:\Users\Patrick\Desktop\AdwCleaner_4.112.exe
2015-03-21 11:09 - 2015-03-21 11:09 - 00001573 _____ () C:\Users\Patrick\Desktop\mbam.txt
2015-03-21 10:32 - 2015-03-21 10:32 - 00000903 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-03-21 10:32 - 2015-03-21 10:32 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-03-21 10:32 - 2015-03-21 10:32 - 00000000 ____D () C:\Program Files\ Malwarebytes Anti-Malware 
2015-03-21 10:32 - 2015-03-17 06:15 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-03-21 10:32 - 2015-03-17 06:15 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-03-21 10:30 - 2015-03-21 10:28 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Desktop\mbam-setup-2.1.4.1018.exe
2015-03-21 10:28 - 2015-03-21 10:28 - 21540440 _____ (Malwarebytes Corporation ) C:\Users\Patrick\Downloads\mbam-setup-2.1.4.1018.exe
2015-03-20 08:30 - 2015-03-20 08:30 - 00011532 _____ () C:\Users\Patrick\Desktop\ComboFix.txt
2015-03-20 08:14 - 2015-03-20 08:30 - 00000000 ____D () C:\ComboFix
2015-03-20 08:10 - 2015-03-20 08:10 - 05615380 ____R (Swearware) C:\Users\Patrick\Desktop\ComboFix.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 12375040 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 09747968 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 03695416 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dat
2015-03-19 12:15 - 2015-03-19 12:15 - 02382848 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-03-19 12:15 - 2015-03-19 12:15 - 01810944 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01803264 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01427968 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-03-19 12:15 - 2015-03-19 12:15 - 01139200 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 01129472 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00717824 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00607744 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00434176 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00421376 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00367104 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-03-19 12:15 - 2015-03-19 12:15 - 00353792 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00353584 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00231936 _____ (Microsoft Corporation) C:\Windows\system32\url.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00227840 _____ (Microsoft Corporation) C:\Windows\system32\ieaksie.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00223232 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00203776 _____ (Microsoft Corporation) C:\Windows\system32\webcheck.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00176640 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00163840 _____ (Microsoft Corporation) C:\Windows\system32\ieakui.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00162304 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00161792 _____ (Microsoft Corporation) C:\Windows\system32\msls31.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00152064 _____ (Microsoft Corporation) C:\Windows\system32\wextract.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00150528 _____ (Microsoft Corporation) C:\Windows\system32\iexpress.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00142848 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00130560 _____ (Microsoft Corporation) C:\Windows\system32\ieakeng.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00123392 _____ (Microsoft Corporation) C:\Windows\system32\occache.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00118784 _____ (Microsoft Corporation) C:\Windows\system32\iepeers.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00110592 _____ (Microsoft Corporation) C:\Windows\system32\IEAdvpack.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00101888 _____ (Microsoft Corporation) C:\Windows\system32\admparse.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\iesysprep.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00078848 _____ (Microsoft Corporation) C:\Windows\system32\inseng.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00076800 _____ (Microsoft Corporation) C:\Windows\system32\SetIEInstalledDate.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\RegisterIEPKEYs.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00074752 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00074240 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00073216 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00066048 _____ (Microsoft Corporation) C:\Windows\system32\icardie.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00065536 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00063488 _____ (Microsoft Corporation) C:\Windows\system32\tdc.ocx
2015-03-19 12:15 - 2015-03-19 12:15 - 00054272 _____ (Microsoft Corporation) C:\Windows\system32\pngfilt.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\mshtmler.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00041472 _____ (Microsoft Corporation) C:\Windows\system32\msfeedsbs.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00035840 _____ (Microsoft Corporation) C:\Windows\system32\imgutil.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00031744 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00023552 _____ (Microsoft Corporation) C:\Windows\system32\licmgr10.dll
2015-03-19 12:15 - 2015-03-19 12:15 - 00011776 _____ (Microsoft Corporation) C:\Windows\system32\mshta.exe
2015-03-19 12:15 - 2015-03-19 12:15 - 00010752 _____ (Microsoft Corporation) C:\Windows\system32\msfeedssync.exe
2015-03-19 11:41 - 2015-03-19 11:41 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Patrick\Desktop\tdsskiller.exe
2015-03-19 11:04 - 2015-03-21 10:34 - 00119512 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-03-19 11:04 - 2015-03-19 11:35 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-03-19 11:02 - 2015-03-19 11:37 - 00000000 ____D () C:\Users\Patrick\Desktop\mbar
2015-03-19 11:02 - 2015-03-17 06:15 - 00092888 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-03-19 10:58 - 2015-03-19 10:58 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Patrick\Desktop\mbar-1.09.1.1004.exe
2015-03-19 10:48 - 2015-03-19 10:48 - 00001061 _____ () C:\Users\Patrick\Desktop\Revo Uninstaller.lnk
2015-03-19 10:48 - 2015-03-19 10:48 - 00000000 ____D () C:\Program Files\VS Revo Group
2015-03-19 10:40 - 2015-03-19 10:35 - 02623656 _____ (VS Revo Group Ltd.) C:\Users\Patrick\Desktop\revosetup95.exe
2015-03-18 17:36 - 2015-03-18 19:18 - 00043637 _____ () C:\Users\Patrick\Desktop\Addition.txt
2015-03-18 17:36 - 2015-03-18 17:36 - 00033280 _____ () C:\Users\Patrick\Desktop\1.FRST.txt
2015-03-18 17:35 - 2015-03-22 10:24 - 00000000 ____D () C:\FRST
2015-03-18 17:34 - 2015-03-18 17:34 - 01135104 _____ (Farbar) C:\Users\Patrick\Desktop\FRST.exe
2015-03-18 13:51 - 2015-03-18 13:51 - 00000000 ____D () C:\Users\Default\AppData\Roaming\Intel
2015-03-18 13:51 - 2015-03-18 13:51 - 00000000 ____D () C:\Users\Default User\AppData\Roaming\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Intel PROSet Wireless
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\ProgramData\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\Program Files\Common Files\Intel
2015-03-18 13:49 - 2015-03-18 13:49 - 00000000 ____D () C:\Program Files\Cisco
2015-03-18 13:34 - 2015-03-18 13:34 - 00000000 ____D () C:\Program Files\NVIDIA Corporation
2015-03-16 18:14 - 2015-03-16 18:14 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\Avira
2015-03-16 18:13 - 2015-03-16 18:13 - 00001851 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-03-16 18:13 - 2015-03-16 18:13 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-03-16 18:12 - 2015-02-25 17:54 - 00028520 _____ (Avira GmbH) C:\Windows\system32\Drivers\ssmdrv.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00136216 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00105864 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-03-16 18:12 - 2015-02-25 17:53 - 00037352 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avkmgr.sys
2015-03-16 18:07 - 2015-03-16 18:08 - 163016912 _____ () C:\Users\Patrick\Downloads\avira_free650_antivirus_de.exe
2015-03-16 18:02 - 2015-02-24 04:23 - 00246920 ____N (Microsoft Corporation) C:\Windows\system32\MpSigStub.exe
2015-03-15 20:12 - 2015-03-20 08:30 - 00000000 ____D () C:\Qoobox
2015-03-15 20:12 - 2011-06-26 07:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-03-15 20:12 - 2010-11-07 18:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-03-15 20:12 - 2009-04-20 05:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00098816 _____ () C:\Windows\sed.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00080412 _____ () C:\Windows\grep.exe
2015-03-15 20:12 - 2000-08-31 01:00 - 00068096 _____ () C:\Windows\zip.exe
2015-03-15 20:11 - 2015-03-15 20:34 - 00000000 ____D () C:\Windows\erdnt
2015-03-14 13:46 - 2015-03-19 11:04 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-03-14 11:50 - 2015-01-29 02:35 - 00369664 _____ (Microsoft Corporation) C:\Windows\system32\WMPhoto.dll
2015-03-14 11:49 - 2015-01-29 02:35 - 00975360 _____ (Microsoft Corporation) C:\Windows\system32\WindowsCodecs.dll
2015-03-14 11:47 - 2015-02-26 01:18 - 02064384 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-03-14 11:35 - 2015-02-20 03:03 - 00034304 _____ (Adobe Systems) C:\Windows\system32\atmlib.dll
2015-03-14 11:35 - 2015-02-20 01:28 - 00296960 _____ (Adobe Systems Incorporated) C:\Windows\system32\atmfd.dll
2015-03-14 11:34 - 2015-02-26 03:01 - 03604408 _____ (Microsoft Corporation) C:\Windows\system32\ntkrnlpa.exe
2015-03-14 11:34 - 2015-02-26 03:01 - 03552184 _____ (Microsoft Corporation) C:\Windows\system32\ntoskrnl.exe
2015-03-14 11:34 - 2015-01-21 03:02 - 00807936 _____ (Microsoft Corporation) C:\Windows\system32\msctf.dll
2015-03-14 11:34 - 2015-01-09 03:04 - 00049152 _____ (Microsoft Corporation) C:\Windows\system32\csrsrv.dll
2015-03-14 11:34 - 2015-01-09 01:18 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\smss.exe
2015-03-14 11:33 - 2015-03-06 05:01 - 00279040 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-03-14 11:32 - 2015-02-18 03:02 - 11587584 _____ (Microsoft Corporation) C:\Windows\system32\shell32.dll
2015-03-14 11:32 - 2014-10-13 02:12 - 02264064 _____ (Microsoft Corporation) C:\Windows\system32\msi.dll

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-03-22 10:13 - 2010-03-17 10:18 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-03-22 10:01 - 2012-12-27 17:33 - 00000260 _____ () C:\Windows\Tasks\HP Photo Creations Messager.job
2015-03-22 10:01 - 2009-09-05 16:39 - 01402652 _____ () C:\Windows\WindowsUpdate.log
2015-03-22 10:01 - 2006-11-02 11:33 - 01597796 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-03-22 09:59 - 2014-09-20 14:30 - 00000000 ____D () C:\ProgramData\Origin
2015-03-22 09:54 - 2012-07-11 12:20 - 00000374 _____ () C:\Windows\system32\Drivers\etc\hosts.ics
2015-03-22 09:54 - 2010-03-17 10:18 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-03-22 09:54 - 2009-09-05 16:48 - 00220268 _____ () C:\ProgramData\nvModes.001
2015-03-22 09:54 - 2009-09-05 16:47 - 00220268 _____ () C:\ProgramData\nvModes.dat
2015-03-22 09:54 - 2006-11-02 14:01 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-03-22 09:54 - 2006-11-02 13:47 - 00003824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0
2015-03-22 09:54 - 2006-11-02 13:47 - 00003824 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0
2015-03-22 01:15 - 2006-11-02 14:01 - 00032562 _____ () C:\Windows\Tasks\SCHEDLGU.TXT
2015-03-22 00:43 - 2012-04-04 06:56 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-03-21 11:24 - 2008-01-21 03:47 - 01095982 _____ () C:\Windows\PFRO.log
2015-03-21 11:14 - 2013-02-20 12:42 - 00001967 _____ () C:\Users\Public\Desktop\Google Chrome.lnk
2015-03-20 19:59 - 2014-09-20 13:47 - 00000000 ____D () C:\Users\Patrick\Documents\Settlers7
2015-03-20 19:58 - 2009-12-16 09:42 - 00000000 ____D () C:\Program Files\OpenOffice.org 3
2015-03-20 19:57 - 2009-12-16 09:43 - 00000000 ___RD () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\OpenOffice.org 3.1
2015-03-20 19:37 - 2012-12-27 17:28 - 00000000 ____D () C:\Users\Patrick\AppData\Local\HP
2015-03-20 19:37 - 2006-11-02 13:37 - 00000000 ____D () C:\Windows\twain_32
2015-03-20 08:28 - 2006-11-02 11:23 - 00000215 _____ () C:\Windows\system.ini
2015-03-20 08:12 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\rescache
2015-03-20 07:52 - 2006-11-02 12:18 - 00000000 ___RD () C:\Windows\Offline Web Pages
2015-03-20 07:52 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\system32\de-DE
2015-03-19 12:15 - 2011-05-18 06:54 - 00014861 _____ () C:\Windows\IE9_main.log
2015-03-19 12:15 - 2006-11-02 07:32 - 00008798 _____ () C:\Windows\system32\icrav03.rat
2015-03-19 12:15 - 2006-11-02 07:32 - 00001988 _____ () C:\Windows\system32\ticrf.rat
2015-03-18 14:03 - 2006-11-02 12:18 - 00000000 ____D () C:\Windows\Microsoft.NET
2015-03-18 13:51 - 2009-10-24 16:19 - 00000000 ____D () C:\Users\Patrick
2015-03-18 13:51 - 2009-09-05 16:54 - 00014358 _____ () C:\Windows\DPINST.LOG
2015-03-18 13:51 - 2006-11-02 12:18 - 00000000 __RHD () C:\Users\Default
2015-03-18 13:51 - 2006-11-02 12:18 - 00000000 ___RD () C:\Users\Public
2015-03-18 13:49 - 2009-02-11 21:12 - 00000000 ____D () C:\Program Files\Intel
2015-03-18 13:38 - 2009-11-24 19:09 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Microsoft Help
2015-03-16 18:23 - 2009-03-12 04:26 - 00000000 ____D () C:\ProgramData\Temp
2015-03-16 18:12 - 2013-08-08 23:03 - 00000000 ____D () C:\Program Files\Avira
2015-03-16 18:04 - 2010-03-21 11:47 - 00007808 _____ () C:\Users\Patrick\AppData\Local\d3d9caps.dat
2015-03-16 17:51 - 2012-01-05 16:31 - 00000000 ____D () C:\ProgramData\Avira
2015-03-16 12:32 - 2014-07-20 22:54 - 00000000 ____D () C:\Windows\system32\mjcm
2015-03-16 10:29 - 2009-10-24 16:20 - 00000000 ____D () C:\Program Files\Google
2015-03-15 21:10 - 2009-03-12 03:59 - 00000000 ____D () C:\Program Files\Acer GameZone
2015-03-15 21:01 - 2009-12-16 09:51 - 00000000 ____D () C:\Program Files\Mozilla Firefox
2015-03-15 21:00 - 2009-10-24 16:20 - 00000000 ____D () C:\Users\Patrick\AppData\Local\Google
2015-03-15 21:00 - 2009-10-24 16:20 - 00000000 ____D () C:\ProgramData\Google
2015-03-15 20:53 - 2013-11-09 13:38 - 00000901 _____ () C:\Users\Patrick\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Search.lnk
2015-03-15 10:00 - 2006-11-02 13:52 - 00168874 _____ () C:\Windows\setupact.log
2015-03-15 08:38 - 2012-06-16 15:55 - 00000000 ____D () C:\Users\Patrick\Tracing
2015-03-14 12:56 - 2006-11-02 13:47 - 00396760 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-03-14 11:50 - 2009-03-12 04:11 - 00000000 ____D () C:\ProgramData\Microsoft Help
2015-03-14 11:47 - 2013-08-14 13:28 - 00000000 ____D () C:\Windows\system32\MRT
2015-03-14 11:37 - 2006-11-02 11:24 - 119837696 _____ (Microsoft Corporation) C:\Windows\system32\mrt.exe
2015-03-08 16:20 - 2010-03-10 13:43 - 00000000 ____D () C:\Users\Patrick\AppData\Local\PokerStars.NET
2015-03-08 16:19 - 2010-03-10 13:43 - 00000000 ____D () C:\Program Files\PokerStars.NET
2015-02-27 10:23 - 2014-09-20 14:30 - 00000000 ____D () C:\Program Files\Origin
2015-02-22 11:25 - 2010-03-31 08:38 - 00000000 ____D () C:\Users\Patrick\AppData\Roaming\vlc

==================== Files in the root of some directories =======

2015-02-11 23:03 - 2015-02-11 23:03 - 6103040 _____ () C:\Program Files\GUT21F3.tmp
2009-12-18 10:53 - 2009-12-18 10:53 - 0139152 _____ () C:\Users\Patrick\AppData\Roaming\PnkBstrK.sys
2013-10-14 19:02 - 2013-10-14 19:02 - 0023888 _____ () C:\Users\Patrick\AppData\Roaming\UserTile.png
2009-10-24 16:28 - 2013-01-02 09:38 - 0000232 _____ () C:\Users\Patrick\AppData\Roaming\wklnhst.dat
2010-03-21 11:47 - 2015-03-16 18:04 - 0007808 _____ () C:\Users\Patrick\AppData\Local\d3d9caps.dat
2009-12-18 11:31 - 2014-10-10 21:14 - 0012288 _____ () C:\Users\Patrick\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2011-02-28 18:24 - 2012-12-27 00:03 - 0000000 _____ () C:\Users\Patrick\AppData\Local\Temptable.xml
2011-01-11 11:35 - 2012-12-27 00:16 - 0018052 _____ () C:\Users\Patrick\AppData\Local\Temp_table.xml
2012-12-27 17:29 - 2012-12-27 17:29 - 0000057 _____ () C:\ProgramData\Ament.ini
2009-03-12 04:26 - 2009-09-05 17:02 - 0004789 _____ () C:\ProgramData\ArcadeDeluxe2.log
2009-09-05 16:48 - 2015-03-22 09:54 - 0220268 _____ () C:\ProgramData\nvModes.001
2009-09-05 16:47 - 2015-03-22 09:54 - 0220268 _____ () C:\ProgramData\nvModes.dat

Some content of TEMP:
====================
C:\Users\Patrick\AppData\Local\temp\avgnt.exe
C:\Users\Patrick\AppData\Local\temp\Quarantine.exe
C:\Users\Patrick\AppData\Local\temp\RtkBtMnt.exe
C:\Users\Patrick\AppData\Local\temp\sqlite3.dll


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-03-22 10:01

==================== End Of Log ============================

--- --- ---

--- --- ---

schrauber · 22.03.2015, 17:45

Die enfernen wir jetzt.

Java, Adobe und Firefox updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:

ATTFilter

C:\Stefan Spiele\Anno.1404.Venedig.GERMAN-0x0007\de-a14v.iso

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AEUTJE3\SkywalkerSetup[1].exe
FF Extension: Snap.Do  - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{c8b90241-fbd6-b3e4-4cc9-7ea41dff93db} [2013-11-14]
Emptytemp:

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).

Starte nun FRST erneut und klicke den Entfernen Button.
Das Tool erstellt eine Fixlog.txt.
Poste mir deren Inhalt.

Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
Klicke auf OK.
Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte

DelFix herunter.

Schließe alle offenen Programme.
Starte die delfix.exe mit einem Doppelklick.
Setze vor jede Funktion ein Häkchen.
Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...

und/oder das Forum mit einer kleinen Spende unterstützen.

Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:

NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.

Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.

Lade Software von einem sauberen Portal wie

.
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .

Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

hillera · 22.03.2015, 19:49

hallo Schrauber

hier noch die Fixlog:

Code:

ATTFilter

Fix result of Farbar Recovery Tool (FRST written by Farbar) (x86) Version: 11-03-2015
Ran by Patrick at 2015-03-22 19:39:53 Run:1
Running from C:\Users\Patrick\Desktop
Loaded Profiles: Patrick (Available profiles: Patrick)
Boot Mode: Normal

==============================================

Content of fixlist:
*****************
C:\Stefan Spiele\Anno.1404.Venedig.GERMAN-0x0007\de-a14v.iso

C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AEUTJE3\SkywalkerSetup[1].exe
FF Extension: Snap.Do  - C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{c8b90241-fbd6-b3e4-4cc9-7ea41dff93db} [2013-11-14]
Emptytemp:
         
*****************

C:\Stefan Spiele\Anno.1404.Venedig.GERMAN-0x0007\de-a14v.iso => Moved successfully.
C:\Windows\System32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\1AEUTJE3\SkywalkerSetup[1].exe => Moved successfully.
C:\Users\Patrick\AppData\Roaming\Mozilla\Firefox\Profiles\aavhlr60.default\Extensions\{c8b90241-fbd6-b3e4-4cc9-7ea41dff93db} => Moved successfully.
EmptyTemp: => Removed 1.6 GB temporary data.


The system needed a reboot. 

==== End of Fixlog 19:40:42 ====

ich mache jetzt noch den CleanUp und melde mich dann evtl. nochmal.
Dir schon mal Vielen Dank.
Gruß hillera

schrauber · 23.03.2015, 13:43

ok

23.03.2015, 13:43	#14
schrauber /// the machine /// TB-Ausbilder	IE lässt sich nicht updaten, Defender wird blockiert ok __________________ gruß, schrauber *Proud Member of UNITE and ASAP since 2009* Spenden Anleitungen und Hilfestellungen Trojaner-Board Facebook-Seite Keine Hilfestellung via PM!

IE lässt sich nicht updaten, Defender wird blockiert

Plagegeister aller Art und deren Bekämpfung: IE lässt sich nicht updaten, Defender wird blockiert