Guten Tag.

Ich hatte heute aus Routine einen Suchlauf mit der neusten Version von Malwarebytes durchgeführt.

Dabei erkannte das Programm die datei rpcss.dll im Windows System32 Ordner als eine Malware namens "Trojan.Zekos.Patched732SP0".

Beim Betrachten der der Datei stellte ich fest, dass sie sowohl zu Windows gehört, als auch das sie seit 2009 nicht mehr verändert wurde, was mich verwunderte.

Obwohl ich wusste, dass die Datei zu Windows gehörte ließ ich Malwarebytes sie in Quarantäne packen und machte einen Neustart.
Danach war die Datei noch immer wo sie vorher war. Nach zwei erneuten Suchläufen konnte aber Malwarebytes keine Malware mehr finden.

Auch mein normales Anti-Virus programm hatte nicht vorher Alarm geschlagen oder konnte die Datei als Malware erkennen.

Ich bin nun also verwundert.

Hatte Malwarebytes einen Fehler gemacht (was ja passieren kann) und es war nur falscher Alarm?

Oder muss ich jetzt trotzdem mein System platt machen und Windows neu installieren?

hi,

Logfile von MBAM bitte.


Bitte lade dir die passende Version von Farbar's Recovery Scan Tool auf deinen Desktop: FRST 32-Bit | FRST 64-Bit
(Wenn du nicht sicher bist: Lade beide Versionen oder unter Start > Computer (Rechtsklick) > Eigenschaften nachschauen)

• Starte jetzt FRST.
• Ändere ungefragt keine der Checkboxen und klicke auf Untersuchen.
• Die Logdateien werden nun erstellt und befinden sich danach auf deinem Desktop.
• Poste mir die FRST.txt und nach dem ersten Scan auch die Addition.txt in deinem Thread (#-Symbol im Eingabefenster der Webseite anklicken)

Vielen Dank erstmal.

Hier ist zunächst der Malwarebytes Log file:

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 20.04.2015
Suchlauf-Zeit: 22:49:49
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.04.20.06
Rootkit Datenbank: v2015.04.20.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7
CPU: x86
Dateisystem: NTFS
Benutzer: *Mein Name*

Suchlauf-Art: Benutzerdefinierter Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 418956
Verstrichene Zeit: 1 Std, 19 Min, 53 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)
Trojan.Zekos.Patched732SP0, C:\Windows\System32\rpcss.dll, Ersetzen bei Neustart, [b82cd39e336973359d7c9bf911e8e84f], 

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

Und hier die FRST text Datei.

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-04-2015
Ran by *Meine Name* (administrator) on *PCName* on 21-04-2015 13:43:15
Running from C:\Users\*Mein Name*\Desktop
Loaded Profiles: *Mein Name* (Available profiles: *Mein Name*)
Platform: Microsoft Windows 7 Home Premium  (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Eigene Programme\EMET\EMET_notifier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Ghisler Software GmbH) C:\Eigene Programme\totalcmd\TOTALCMD.EXE
(Mozilla Corporation) C:\Eigene Programme\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avcenter.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9288296 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-01] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [EMET Notifier] => C:\Eigene Programme\EMET\EMET_notifier.exe [152152 2012-05-09] (Microsoft Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [704248 2015-03-31] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-648958566-201983947-700737179-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [220672 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-10-20] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.aldi.com
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-20] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-20] (Oracle Corporation)
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
Winsock: Catalog9 01 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 02 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 03 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 04 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 05 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 06 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 07 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 08 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Winsock: Catalog9 19 C:\Program Files\Avira\AntiVir Desktop\avsda.dll [507984] (Avira Operations GmbH & Co. KG)
Tcpip\Parameters: [DhcpNameServer] 192.168.0.10

FireFox:
========
FF ProfilePath: C:\Users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default
FF Homepage: about:blank
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-20] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2010-10-11] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll [2010-09-17] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-648958566-201983947-700737179-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Extension: WOT - C:\Users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: 瀏覽頁組管理員 - C:\Users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2011-07-22]
FF Extension: Adblock Plus - C:\Users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-07-25]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirFirewallService; C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe [1045960 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [804600 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-31] (Avira Operations GmbH & Co. KG)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 ACEDRV05; C:\Windows\system32\drivers\ACEDRV05.sys [97792 2012-02-07] (Protect Software GmbH) [File not signed]
R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [62592 2010-05-15] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [24192 2010-05-15] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-09-24] (ATI Technologies, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [92448 2013-07-29] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [113024 2013-07-29] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-29] (Avira GmbH)
S3 ALSysIO; \??\C:\Users\*Mein Name*\AppData\Local\Temp\ALSysIO.sys [X]
S3 mdxgthkn; \??\C:\Users\*Mein Name*\AppData\Local\Temp\mdxgthkn.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-21 13:43 - 2015-04-21 13:44 - 00011129 _____ () C:\Users\*Mein Name*\Desktop\FRST.txt
2015-04-21 13:43 - 2015-04-21 13:43 - 00000000 ____D () C:\FRST
2015-04-21 13:40 - 2015-04-21 13:40 - 01139200 _____ (Farbar) C:\Users\*Mein Name*\Desktop\FRST.exe
2015-04-21 13:38 - 2015-04-21 13:42 - 00001328 _____ () C:\Users\*Mein Name*\Desktop\mbam.txt
2015-04-21 13:36 - 2015-04-21 13:36 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-21 13:36 - 2015-04-21 13:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-21 13:36 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-21 13:36 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-21 13:34 - 2015-04-21 13:36 - 00000892 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-21 13:34 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-14 20:36 - 2015-04-14 20:36 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-04-10 11:37 - 2015-03-23 03:36 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00331264 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-10 11:37 - 2015-03-23 03:35 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-10 11:37 - 2015-03-23 03:35 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-10 11:37 - 2015-03-23 03:30 - 00896000 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-09 22:58 - 2015-04-09 23:00 - 00000341 _____ () C:\Users\*Mein Name*\AppData\Local\Hinweis GPDI...txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-21 13:40 - 2009-07-14 06:34 - 00015984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-21 13:40 - 2009-07-14 06:34 - 00015984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-21 13:36 - 2011-07-25 13:34 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Roaming\Malwarebytes
2015-04-21 13:36 - 2011-04-22 10:47 - 00000000 ____D () C:\Eigene Programme
2015-04-21 13:36 - 2011-04-21 14:25 - 01433022 _____ () C:\Windows\WindowsUpdate.log
2015-04-21 13:36 - 2010-07-06 22:23 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-21 13:32 - 2011-04-21 14:29 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-21 13:32 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-21 13:32 - 2009-07-14 06:39 - 00201763 _____ () C:\Windows\setupact.log
2015-04-21 04:35 - 2010-07-07 20:31 - 00138178 _____ () C:\Windows\PFRO.log
2015-04-21 04:26 - 2011-04-21 14:29 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-21 04:09 - 2012-10-23 18:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-20 12:18 - 2013-04-23 21:24 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Local\Warframe
2015-04-20 11:35 - 2014-10-27 20:28 - 00000000 ____D () C:\Program Files\Java
2015-04-20 11:34 - 2014-10-27 20:29 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-04-20 00:20 - 2011-07-21 14:31 - 00000000 ____D () C:\Games
2015-04-19 14:59 - 2012-02-11 00:14 - 00000000 ____D () C:\ProgramData\PopCap Games
2015-04-15 23:09 - 2011-12-09 03:20 - 00347464 _____ () C:\Windows\system32\PnkBstrB.xtr
2015-04-15 23:04 - 2011-12-09 03:18 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2015-04-15 23:04 - 2011-12-09 03:18 - 00138904 _____ () C:\Users\*Mein Name*\AppData\Roaming\PnkBstrK.sys
2015-04-15 21:48 - 2011-07-21 15:22 - 00000000 ____D () C:\Program Files\Common Files\Steam
2015-04-15 20:37 - 2013-10-20 21:41 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 20:34 - 2010-07-06 23:03 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-14 22:10 - 2012-07-15 12:41 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-14 22:10 - 2011-07-29 16:36 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-14 20:43 - 2014-09-21 17:43 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Local\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\ProgramData\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\Program Files\Adobe
2015-04-11 13:10 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-10 11:38 - 2014-12-13 00:20 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-10 11:38 - 2014-07-30 12:28 - 00000000 ___SD () C:\Windows\system32\CompatTel

==================== Files in the root of some directories =======

2011-12-09 03:18 - 2015-04-15 23:04 - 0138904 _____ () C:\Users\*Mein Name*\AppData\Roaming\PnkBstrK.sys
2015-04-09 22:58 - 2015-04-09 23:00 - 0000341 _____ () C:\Users\*Mein Name*\AppData\Local\Hinweis GPDI...txt
2011-07-30 17:21 - 2015-03-01 17:16 - 0007601 _____ () C:\Users\*Mein Name*\AppData\Local\Resmon.ResmonCfg
2014-01-04 15:35 - 2014-01-04 15:37 - 0000142 _____ () C:\ProgramData\Einige Securom Elemente noch vorhanden.txt

Some content of TEMP:
====================
C:\Users\*Mein Name*\AppData\Local\Temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-14 12:38

==================== End Of Log ============================
         

--- --- ---

--- --- ---

--- --- ---


Hier die Addition Informationen.

Additional scan result of Farbar Recovery Scan Tool (x86) Version: 20-04-2015
Ran by *Mein Name* at 2015-04-21 13:44:23
Running from C:\Users\*Mein Name*\Desktop
Boot Mode: Normal
==========================================================


==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Desktop (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Desktop (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

32 Bit HP CIO Components Installer (Version: 8.1.1 - Hewlett-Packard) Hidden
Acrobat.com (HKLM\...\{287ECFA4-719A-2143-A09B-D6A12DE54E40}) (Version: 1.6.65 - Adobe Systems Incorporated)
Adobe Acrobat Reader DC - Deutsch (HKLM\...\{AC76BA86-7AD7-1031-7B44-AC0F074E4100}) (Version: 15.007.20033 - Adobe Systems Incorporated)
Adobe AIR (HKLM\...\Adobe AIR) (Version: 2.5.0.16600 - Adobe Systems Inc.)
Adobe Flash Player 17 ActiveX (HKLM\...\Adobe Flash Player ActiveX) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Flash Player 17 NPAPI (HKLM\...\Adobe Flash Player NPAPI) (Version: 17.0.0.169 - Adobe Systems Incorporated)
Adobe Shockwave Player 12.1 (HKLM\...\Adobe Shockwave Player) (Version: 12.1.3.153 - Adobe Systems, Inc.)
APB Reloaded (HKLM\...\Steam App 113400) (Version:  - )
ATI Catalyst Install Manager (HKLM\...\{586647DB-C4AC-6691-FD95-9A1B3B603502}) (Version: 3.0.795.0 - ATI Technologies, Inc.)
Avira Internet Security (HKLM\...\Avira AntiVir Desktop) (Version: 14.0.9.130 - Avira Operations GmbH & Co. KG)
Borderlands 2 (HKLM\...\Steam App 49520) (Version:  - Gearbox Software)
ccc-core-static (Version: 2010.0930.2237.38732 - ATI) Hidden
Control ActiveX de Windows Live Mesh para conexiones remotas (HKLM\...\{04668DF2-D32F-4555-9C7E-35523DCD6544}) (Version: 15.4.5722.2 - Microsoft Corporation)
Contrôle ActiveX Windows Live Mesh pour connexions à distance (HKLM\...\{55D003F4-9599-44BF-BA9E-95D060730DD3}) (Version: 15.4.5722.2 - Microsoft Corporation)
Controlo ActiveX do Windows Live Mesh para Ligações Remotas (HKLM\...\{E54EEB5D-41ED-40FE-B4A8-8565DB81469B}) (Version: 15.4.5722.2 - Microsoft Corporation)
CorelDRAW Essentials 4 - Content (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Draw (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Filters (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - ICA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - IPM - No VBA (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang BR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang DE (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang EN (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang ES (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang FR (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang IT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Lang NL (Version: 4.0 - Uw bedrijfsnaam) Hidden
CorelDRAW Essentials 4 - PHOTO-PAINT (Version: 4.0 - Corel Corporation) Hidden
CorelDRAW Essentials 4 - Windows Shell Extension (HKLM\...\_{CF0ADC18-6D8F-4353-8EAA-DF45456B7853}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 - Windows Shell Extension (Version: 1.1 - Corel Corporation) Hidden
CorelDRAW Essentials 4 (HKLM\...\_{C0237AA4-1BFB-46EA-860D-7B0EB365CA13}) (Version:  - Corel Corporation)
CorelDRAW Essentials 4 (Version: 4.0 - Corel Corporation) Hidden
CyberLink LabelPrint (HKLM\...\InstallShield_{C59C179C-668D-49A9-B6EA-0121CCFC1243}) (Version: 2.5.2515 - CyberLink Corp.)
CyberLink Power2Go (HKLM\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.3602c - CyberLink Corp.)
CyberLink PowerDVD Copy (HKLM\...\InstallShield_{E3D04529-6EDB-11D8-A372-0050BAE317E1}) (Version: 1.5.1306 - CyberLink Corp.)
D3DX10 (Version: 15.4.2368.0902 - Microsoft) Hidden
Deus Ex: Human Revolution - The Missing Link (HKLM\...\Steam App 201280) (Version:  - Eidos Montreal)
Deus Ex: Human Revolution (HKLM\...\Steam App 28050) (Version:  - Eidos Montreal)
EMET (HKLM\...\{DE7A5DDF-47B3-42FF-A082-E158DEA37392}) (Version: 3.0.0 - Microsoft)
Formant ActiveX programu Windows Live Mesh odpowiedzialny za obsługę połączeń zdalnych (HKLM\...\{B04A0E2F-1E4C-4E61-B18E-3B2BD6779CA7}) (Version: 15.4.5722.2 - Microsoft Corporation)
Fotogalerija Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
FTL: Faster Than Light (HKLM\...\Steam App 212680) (Version:  - Subset Games)
Galeria de Fotografias do Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galería fotográfica de Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galeria fotografii usługi Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Galerie de photos Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Goodbye Deponia (HKLM\...\Steam App 241910) (Version:  - Daedalic Entertainment)
Google Chrome (HKLM\...\Google Chrome) (Version: 5.0.375.125 - Google Inc.)
Google Update Helper (Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (Version: 1.3.26.9 - Google Inc.) Hidden
Half-Life 2 (HKLM\...\Steam App 220) (Version:  - Valve)
Hitman: Blood Money (HKLM\...\Steam App 6860) (Version:  - Eidos)
Jack Orlando Director's Cut (HKLM\...\Steam App 253960) (Version:  - Toontraxx Studios)
Jagged Alliance 2: Gold Pack (HKLM\...\Steam App 12370) (Version:  - Strategy First)
Java 8 Update 45 (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F83218045F0}) (Version: 8.0.450 - Oracle Corporation)
Junk Mail filter update (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Just Cause 2 (HKLM\...\Steam App 8190) (Version:  - Avalanche Studios)
Kerbal Space Program (HKLM\...\Steam App 220200) (Version:  - Squad)
Kontrolnik Windows Live Mesh ActiveX za oddaljene povezave (HKLM\...\{CA227A9D-09BE-4BFB-9764-48FED2DA5454}) (Version: 15.4.5722.2 - Microsoft Corporation)
Legacy of Kain: Soul Reaver 2 (HKLM\...\Steam App 224940) (Version:  - Crystal Dynamics)
Legend of Grimrock (HKLM\...\Steam App 207170) (Version:  - Almost Human Games)
Malwarebytes Anti-Malware Version 2.0.4.1028 (HKLM\...\Malwarebytes Anti-Malware_is1) (Version: 2.0.4.1028 - Malwarebytes Corporation)
Medion Home Cinema (HKLM\...\InstallShield_{AB770FDE-8087-4C98-9A85-BD64262C104C}) (Version: 6.0.0000 - CyberLink Corp.)
Medion Home Cinema (Version: 6.0.0000 - CyberLink Corp.) Hidden
Mesh Runtime (Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Metro 2033 (HKLM\...\Steam App 43110) (Version:  - THQ)
Microsoft .NET Framework 4 Client Profile (HKLM\...\Microsoft .NET Framework 4 Client Profile) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft .NET Framework 4 Extended (HKLM\...\Microsoft .NET Framework 4 Extended) (Version: 4.0.30319 - Microsoft Corporation)
Microsoft Chart Controls for Microsoft .NET Framework 3.5 (KB2500170) (HKLM\...\{41785C66-90F2-40CE-8CB5-1C94BFC97280}) (Version: 3.5.30730.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE (HKLM\...\{F112F66E-25CA-42DD-983C-6118EB38F606}) (Version: 3.0.89.0 - Microsoft Corporation)
Microsoft Games for Windows - LIVE Redistributable (HKLM\...\{2E660A2A-A55F-43CD-9F73-CAD7382EEB78}) (Version: 3.0.19.0 - Microsoft Corporation)
Microsoft Office 2010 (HKLM\...\{95140000-0070-0000-0000-0000000FF1CE}) (Version: 14.0.4763.1000 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 4.0.50917.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053 (HKLM\...\{770657D0-A123-3C07-8E44-1C83EC895118}) (Version: 8.0.50727.4053 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{7299052b-02a4-4627-81f2-1818da5d550d}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM\...\{837b34e3-7c30-493c-8f6a-2b0f04e2912c}) (Version: 8.0.59193 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.21022 (HKLM\...\{FF66E9F6-83E7-3A3E-AF14-8DE9A809A6A4}) (Version: 9.0.21022 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2012 Redistributable (x86) - 11.0.61030 (HKLM\...\{33d1fd90-4274-48a1-9bc1-97e33d9c2d6f}) (Version: 11.0.61030.0 - Microsoft Corporation)
Microsoft Visual J# 2.0 Redistributable Package (HKLM\...\Microsoft Visual J# 2.0 Redistributable Package) (Version:  - Microsoft Corporation)
Microsoft XNA Framework Redistributable 4.0 Refresh (HKLM\...\{D69C8EDE-BBC5-436B-8E0E-C5A6D311CF4F}) (Version: 4.0.30901.0 - Microsoft Corporation)
Mozilla Firefox 37.0.1 (x86 de) (HKU\S-1-5-21-648958566-201983947-700737179-1000\...\Mozilla Firefox 37.0.1 (x86 de)) (Version: 37.0.1 - Mozilla)
Mozilla Firefox 4.0 (x86 de) (HKLM\...\Mozilla Firefox 4.0 (x86 de)) (Version: 4.0 - Mozilla)
MSXML 4.0 SP2 (KB973688) (HKLM\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
NVIDIA PhysX (HKLM\...\{3F5C371F-8EA2-4F25-9D3D-D0B4526E3AEA}) (Version: 9.10.0513 - NVIDIA Corporation)
Oddworld: Abe's Exoddus (HKLM\...\Steam App 15710) (Version:  - Oddworld Inhabitants)
Oddworld: Abe's Oddysee (HKLM\...\Steam App 15700) (Version:  - Oddworld Inhabitants)
OpenOffice.org 3.3 (HKLM\...\{4286716B-1287-48E7-9078-3DC8248DBA96}) (Version: 3.3.9567 - OpenOffice.org)
Orcs Must Die! 2 (HKLM\...\Steam App 201790) (Version:  - )
PlayReady PC Runtime x86 (HKLM\...\{CCA5EAAD-92F4-4B7A-B5EE-14294C66AB61}) (Version: 1.3.0 - Microsoft Corporation)
Poczta usługi Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Podstawowe programy Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Pošta Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Psychonauts (HKLM\...\Steam App 3830) (Version:  - Double Fine Productions)
Raccolta foto di Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Realtek High Definition Audio Driver (HKLM\...\{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}) (Version: 6.0.1.6136 - Realtek Semiconductor Corp.)
Rogue Legacy (HKLM\...\Steam App 241600) (Version:  - Cellar Door Games)
Sam and Max - Im Theater des Teufels (HKLM\...\Sam and Max - Im Theater des Teufels) (Version: 2.0.0.0 - Daedalic Entertainment)
ScummVM 1.3.1 (HKLM\...\ScummVM_is1) (Version:  - The ScummVM Team)
Sid Meier's Civilization V (HKLM\...\Steam App 8930) (Version:  - 2K Games, Inc.)
Sins of a Solar Empire: Rebellion (HKLM\...\Steam App 204880) (Version:  - )
Spelling Dictionaries Support For Adobe Reader 9 (HKLM\...\{AC76BA86-7AD7-5464-3428-900000000004}) (Version: 9.0.0 - Adobe Systems Incorporated)
Star Wars Jedi Knight: Jedi Academy (HKLM\...\Steam App 6020) (Version:  - LucasArts)
Steam (HKLM\...\{048298C9-A4D3-490B-9FF9-AB023A9238F3}) (Version: 1.0.0.0 - Valve Corporation)
Supreme Commander - Forged Alliance (HKLM\...\{31D95937-B237-405D-920C-A3EF4E482395}) (Version: 1.00.0000 - Gas Powered Games)
swMSM (Version: 12.0.0.1 - Adobe Systems, Inc) Hidden
Temple of Elemental Evil (HKLM\...\{AD80F06B-0F21-4EEE-934D-BEF0D21E6383}) (Version: 1.00.000 - )
Terraria (HKLM\...\Steam App 105600) (Version:  - Re-Logic)
The Bard's Tale (HKLM\...\Steam App 41900) (Version:  - )
The Whispered World (HKLM\...\{82225685-1513-4975-B624-155C10F3EE16}) (Version: 1.01 - Deep Silver)
Torchlight II (HKLM\...\Steam App 200710) (Version:  - )
Total Commander (Remove or Repair) (HKLM\...\Totalcmd) (Version: 7.56a - Ghisler Software GmbH)
Uzak Bağlantılar İçin Windows Live Mesh ActiveX Denetimi (HKLM\...\{241E7104-937A-4366-AD57-8FDDDB003939}) (Version: 15.4.5722.2 - Microsoft Corporation)
VLC media player 1.1.9 (HKLM\...\VLC media player) (Version: 1.1.9 - VideoLAN)
Warframe (HKLM\...\Steam App 230410) (Version:  - )
Warhammer® 40,000®: Dawn of War® II – Retribution™ (HKLM\...\Steam App 56400) (Version:  - Relic)
Windows Live Essentials (HKLM\...\WinLiveSuite) (Version: 15.4.3502.0922 - Microsoft Corporation)
Windows Live Mesh - ActiveX-besturingselement voor externe verbindingen (HKLM\...\{C32CE55C-12BA-4951-8797-0967FDEF556F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM\...\{C63A1E60-B6A4-440B-89A5-1FC6E4AC1C94}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX-objekt til fjernforbindelser (HKLM\...\{57220148-3B2B-412A-A2E0-82B9DF423696}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX-vezérlő távoli kapcsolatokhoz (HKLM\...\{6E29C4F7-C2C2-4B18-A15C-E09B92065F15}) (Version: 15.4.5722.2 - Microsoft Corporation)
XCOM: Enemy Unknown (HKLM\...\Steam App 200510) (Version:  - )
Στοιχείο ελέγχου ActiveX του Windows Live Mesh για απομακρυσμένες συνδέσεις (HKLM\...\{F665F3B8-01B4-46A9-8E47-FF8DC2208C9F}) (Version: 15.4.5722.2 - Microsoft Corporation)
Συλλογή φωτογραφιών του Windows Live (Version: 15.4.3502.0922 - Microsoft Corporation) Hidden

==================== Custom CLSID (selected items): ==========================

(If an entry is included in the fixlist, it will be removed from registry. Any eventual file will not be moved.)

CustomCLSID: HKU\S-1-5-21-648958566-201983947-700737179-1000_Classes\CLSID\{1c492e6a-2803-5ed7-83e1-1b1d4d41eb39}\InprocServer32 -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File

==================== Restore Points  =========================

06-04-2015 14:48:04 Geplanter Prüfpunkt
10-04-2015 11:37:41 Windows Update
15-04-2015 20:33:40 Windows Update
16-04-2015 13:12:42 DirectX wurde installiert

==================== Hosts content: ==========================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:04 - 2012-06-30 00:46 - 00000098 ____A C:\Windows\system32\Drivers\etc\hosts
127.0.0.1       localhost
::1       localhost

==================== Scheduled Tasks (whitelisted) =============

(If an entry is included in the fixlist, it will be removed from registry. Any associated file could be listed separately to be moved.)

Task: {009D2C68-1A1B-499B-B066-E473FDD72019} - System32\Tasks\{FE55F115-7800-4953-AADB-F87B398F4550} => C:\Games\LucasArts\SWKotOR\swconfig.exe
Task: {035D24F1-5B82-4F2E-B6CB-08250BAC35EE} - System32\Tasks\{1B0D429B-BE13-4440-9B7D-937A9E4187C7} => C:\Games\Jade Empire\JadeEmpireConfig.exe
Task: {0F8B6484-7DD2-4E59-BA0A-A2EE06DCC0AD} - System32\Tasks\Adobe Acrobat Update Task => C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe [2015-03-07] (Adobe Systems Incorporated)
Task: {16775D3B-A2F0-4A4A-8C76-42D55E7BA341} - System32\Tasks\{83AE811F-6609-456F-B379-CDCD9A96DBFA} => C:\Games\LucasArts\Star Wars Knights of the Old Republic\swkotor.exe
Task: {255056DA-0906-423D-A228-3306C7163EF9} - System32\Tasks\{122089FD-6FCA-413A-AE33-9CDEF9AB0903} => C:\Games\Jeff Wayne's 'The War Of The Worlds'\WoW.exe
Task: {2F0231B5-5D38-4D44-8A3B-1867C9B866BE} - System32\Tasks\{2AD14D3C-CAFF-44C9-A381-DF6804107560} => C:\Games\Jeff Wayne's 'The War Of The Worlds'\WoWStart.exe
Task: {2F471F0A-12A9-4DA3-8C11-B743499C119A} - System32\Tasks\{2314F898-0282-40F5-AD43-26D2EC5E4565} => C:\Games\Jeff Wayne's 'The War Of The Worlds'\WoW.exe
Task: {495283F9-BFAA-4470-815C-21A5F91861CD} - System32\Tasks\{9BAB4E7E-A2BD-4F1B-B3E0-46E256DF846C} => C:\Games\Jeff Wayne's 'The War Of The Worlds'\WoW.exe
Task: {4D1BE5DC-8E50-44BC-BFCE-2F5812208496} - System32\Tasks\{929F2AEE-D308-4DA0-91FF-518B4D7296CC} => C:\Games\LucasArts\SWKotOR\swkotor.exe
Task: {4FD209DD-E736-480F-ACBC-F4834712BECF} - System32\Tasks\{F4078916-DE0B-462F-851E-1AF09ACC2A81} => C:\Eigene Programme\Steam\SteamApps\common\Jedi Academy\JediAcademy.exe [2012-11-25] ()
Task: {5E30E687-C639-4894-A92C-F49B02A1A302} - System32\Tasks\{A900D83C-0950-44F1-A89F-5128EE55E035} => C:\Games\Jade Empire\JadeEmpireConfig.exe
Task: {63173B6E-D252-4B40-ADA6-AEF5CFDD6ECC} - System32\Tasks\{2679DD76-45DD-4647-952A-07C53F20D389} => C:\Games\Jade Empire\JadeEmpireConfig.exe
Task: {69B81CD7-50DC-4454-B234-43113EFD4100} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2015-04-14] (Adobe Systems Incorporated)
Task: {724B97AB-6965-4601-A4EB-808FD7AFEBD0} - System32\Tasks\{BC6BE1F2-4FB0-417F-AEAC-240E44A37246} => C:\Games\Jeff Wayne's 'The War Of The Worlds'\WoW.exe
Task: {7A35C84B-7EF7-4588-9D97-3A5FA7AA2204} - System32\Tasks\{6CEE200D-D983-4CD6-9269-E608D501D7A7} => C:\Games\LucasArts\Star Wars Knights of the Old Republic\swkotor.exe
Task: {844E3CCD-6DBD-42C9-BED5-3592D0ACC29A} - System32\Tasks\{26CCCC46-5AD0-49ED-BD09-5A5292D8085A} => C:\Games\LucasArts\Star Wars Knights of the Old Republic\swkotor.exe
Task: {8534FBA2-76A2-443B-8FF3-73BE9F06BF24} - System32\Tasks\{E11949E5-FCB9-4634-AD8B-5E690F48FFAC} => C:\Games\LucasArts\Star Wars Knights of the Old Republic\swkotor.exe
Task: {871D6DAE-0AFB-4642-BFA7-583A447FEF56} - System32\Tasks\{1FEAF835-C05A-4AFD-9176-3B89DD673767} => pcalua.exe -a E:\Autorun.exe -d E:\
Task: {920775A9-18B7-4216-BC89-CC8DA0713378} - System32\Tasks\Java Update Scheduler => C:\Program Files\Common Files\Java\Java Update\jusched.exe [2015-04-10] (Oracle Corporation)
Task: {A890B662-D7A3-4338-A729-C5519AF7544F} - System32\Tasks\{C11C0753-2068-4E03-91BC-24A2D956B6DE} => C:\Games\LucasArts\SWKotOR2\swkotor2.exe
Task: {AD37CAC8-FD6A-40E4-8667-34BC287E0607} - System32\Tasks\{7154F67C-4CD9-4B41-B9EC-7426689741A5} => C:\Games\Jade Empire\JadeEmpire.exe
Task: {B22E39E3-14FA-43ED-B0D1-D1FB759E5D1C} - System32\Tasks\{9BF3F89D-598F-4EE4-97F6-D94032A68E1F} => C:\Games\Jeff Wayne's 'The War Of The Worlds'\WoW.exe
Task: {BE3BB5C7-34AA-46EE-8740-DC2D2BE7F600} - System32\Tasks\{3B2B0903-2BEF-4F3F-8B7C-1FB058DEC19A} => C:\Games\LucasArts\SWKotOR\swkotor.exe
Task: {C12809A0-B037-42FF-9727-28D6DEC261CE} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)
Task: {FA8F7491-4449-42E0-AB5E-0E7A3A8EC0F8} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files\Google\Update\GoogleUpdate.exe [2014-10-27] (Google Inc.)
Task: {FE32DB1C-2F27-48C9-9F83-F4DB09E74D81} - System32\Tasks\{46DD1B0A-605F-40D0-9094-4C195CC2F68E} => C:\Games\LucasArts\SWKotOR2\swkotor2.exe

(If an entry is included in the fixlist, the task (.job) file will be moved. The file which is running by the task will not be moved.)

Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (whitelisted) ==============

2009-11-02 23:20 - 2009-11-02 23:20 - 00619816 ____N () C:\Program Files\CyberLink\Power2Go\CLMediaLibrary.dll
2009-11-02 23:23 - 2009-11-02 23:23 - 00013096 ____N () C:\Program Files\CyberLink\Power2Go\CLMLSvcPS.dll
2010-10-01 08:36 - 2010-10-01 08:36 - 00270336 _____ () C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll

==================== Alternate Data Streams (whitelisted) =========

(If an entry is included in the fixlist, only the Alternate Data Streams will be removed.)


==================== Safe Mode (whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)

HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\BsScanner => ""="Service"
HKLM\SYSTEM\CurrentControlSet\Control\SafeBoot\Network\BsScanner => ""="Service"

==================== EXE Association (whitelisted) ===============

(If an entry is included in the fixlist, the default will be restored. None default entries will be removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, the associated entry will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-648958566-201983947-700737179-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\*Mein Name*\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.10

==================== MSCONFIG/TASK MANAGER disabled items ==

(Currently there is no automatic fix for this section.)


==================== Accounts: =============================

Administrator (S-1-5-21-648958566-201983947-700737179-500 - Administrator - Disabled)
*Mein Name* (S-1-5-21-648958566-201983947-700737179-1000 - Administrator - Enabled) => C:\Users\*Mein Name*
Gast (S-1-5-21-648958566-201983947-700737179-501 - Limited - Disabled)

==================== Faulty Device Manager Devices =============

Name: Microsoft-Adapter für Miniports virtueller WiFis
Description: Microsoft-Adapter für Miniports virtueller WiFis
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Microsoft
Service: vwifimp
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (04/21/2015 04:34:49 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: Programm avscan.exe, Version 14.0.9.122 kann nicht mehr unter Windows ausgeführt werden und wurde beendet. Überprüfen Sie den Problemverlauf in der Wartungscenter-Systemsteuerung, um nach weiteren Informationen zum Problem zu suchen.

Prozess-ID: e04

Startzeit: 01d07bdb29566ed9

Endzeit: 35287

Anwendungspfad: C:\Program Files\Avira\AntiVir Desktop\avscan.exe

Berichts-ID: bfba22bd-e7ce-11e4-8f85-6c626d90f3d0

Error: (04/20/2015 10:35:42 PM) (Source: VSS) (EventID: 12310) (User: )
Description: Volumeschattenkopie-Dienstfehler: Die Schattenkopie kann nicht zugesichert werden - Vorgang hat das Zeitlimit überschritten.
Fehlerkontext: DeviceIoControl(\\?\Volume{622a7c61-6c63-11e0-93f3-806e6f6e6963} - 00000110,0x0053c010,00737760,0,00738768,4096,[0]).


Vorgang:
   Schattenkopien werden übertragen

Kontext:
   Ausführungskontext: System Provider

Error: (04/20/2015 00:41:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/20/2015 00:40:42 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/19/2015 03:50:21 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/19/2015 03:49:45 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/18/2015 00:26:53 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/18/2015 00:26:17 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/17/2015 00:38:26 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"1".
Die abhängige Assemblierung "Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".

Error: (04/17/2015 00:37:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Fehler beim Generieren des Aktivierungskontextes für "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"1".
Die abhängige Assemblierung "Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"" konnte nicht gefunden werden.
Verwenden Sie für eine detaillierte Diagnose das Programm "sxstrace.exe".


System errors:
=============
Error: (04/21/2015 01:37:42 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "PnP-X-IP-Busenumerator" ist vom Dienst "Funktionssuchanbieter-Host" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:03 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:02 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:02 AM) (Source: Service Control Manager) (EventID: 7001) (User: )
Description: Der Dienst "Netzwerklistendienst" ist vom Dienst "NLA (Network Location Awareness)" abhängig, der aufgrund folgenden Fehlers nicht gestartet wurde: 
%%1068

Error: (04/21/2015 01:36:02 AM) (Source: DCOM) (EventID: 10005) (User: )
Description: 1084WSearch{9E175B6D-F52A-11D8-B9A5-505054503030}


Microsoft Office Sessions:
=========================
Error: (04/21/2015 04:34:49 AM) (Source: Application Hang) (EventID: 1002) (User: )
Description: avscan.exe14.0.9.122e0401d07bdb29566ed935287C:\Program Files\Avira\AntiVir Desktop\avscan.exebfba22bd-e7ce-11e4-8f85-6c626d90f3d0

Error: (04/20/2015 10:35:42 PM) (Source: VSS) (EventID: 12310) (User: )
Description: DeviceIoControl(\\?\Volume{622a7c61-6c63-11e0-93f3-806e6f6e6963} - 00000110,0x0053c010,00737760,0,00738768,4096,[0])

Vorgang:
   Schattenkopien werden übertragen

Kontext:
   Ausführungskontext: System Provider

Error: (04/20/2015 00:41:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Eigene Programme\OpenOffice.org 3\Basis\program\python-core-2.6.1\lib\distutils\command\wininst-9.0-amd64.exe

Error: (04/20/2015 00:40:42 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\eigene programme\Steam\steamapps\common\Warframe\Warframe.x64.exe

Error: (04/19/2015 03:50:21 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Eigene Programme\OpenOffice.org 3\Basis\program\python-core-2.6.1\lib\distutils\command\wininst-9.0-amd64.exe

Error: (04/19/2015 03:49:45 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\eigene programme\Steam\steamapps\common\Warframe\Warframe.x64.exe

Error: (04/18/2015 00:26:53 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Eigene Programme\OpenOffice.org 3\Basis\program\python-core-2.6.1\lib\distutils\command\wininst-9.0-amd64.exe

Error: (04/18/2015 00:26:17 AM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\eigene programme\Steam\steamapps\common\Warframe\Warframe.x64.exe

Error: (04/17/2015 00:38:26 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.VC90.CRT,processorArchitecture="amd64",publicKeyToken="1fc8b3b9a1e18e3b",type="win32",version="9.0.21022.8"C:\Eigene Programme\OpenOffice.org 3\Basis\program\python-core-2.6.1\lib\distutils\command\wininst-9.0-amd64.exe

Error: (04/17/2015 00:37:40 PM) (Source: SideBySide) (EventID: 33) (User: )
Description: Microsoft.Windows.Common-Controls,language="*",processorArchitecture="amd64",publicKeyToken="6595b64144ccf1df",type="win32",version="6.0.0.0"c:\eigene programme\Steam\steamapps\common\Warframe\Warframe.x64.exe


==================== Memory info =========================== 

Processor: AMD Athlon(tm) II X3 440 Processor
Percentage of memory in use: 37%
Total physical RAM: 3327.29 MB
Available physical RAM: 2079.47 MB
Total Pagefile: 6652.86 MB
Available Pagefile: 5010.52 MB
Total Virtual: 2299.88 MB
Available Virtual: 2136.86 MB

==================== Drives ================================

Drive c: (Boot) (Fixed) (Total:900.41 GB) (Free:700.52 GB) NTFS
Drive d: (Recover) (Fixed) (Total:30 GB) (Free:12.52 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (Size: 931.5 GB) (Disk ID: 2BD2C32A)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=900.4 GB) - (Type=07 NTFS)
Partition 3: (Not Active) - (Size=30 GB) - (Type=07 NTFS)
Partition 4: (Not Active) - (Size=1 GB) - (Type=12)

==================== End Of Log ============================
         

Ich hoffe diese Informationen können nicht für irgend etwas misbraucht werden. Ist mir ein bischen unangenehm sie so zu posten, aber wenn es hilft auf Nummer sicher zu gehen ist es vielleicht besser so.

Vielen Dank schon mal.

Ein kurzer Blick durchs Forum hätte Dir gezeigt dass ne Million anderer User die Logs auch posten, die leben alle noch


Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop

• Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
• Drücke Start Scan
  
• Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
  TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
  Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Das ist Wahr.

Kurze Frage noch. Dient dies hier dazu nach zu sehen ob Malwarebytes einen Fehler gemacht hat oder als Vorbereitung dafür mein system neu installieren zu müssen?

So oder so, bin dankbar für deine Hilfe.

10:22:30.0995 0x1264  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
10:23:30.0184 0x1264  ============================================================
10:23:30.0184 0x1264  Current date / time: 2015/04/22 10:23:30.0184
10:23:30.0184 0x1264  SystemInfo:
10:23:30.0185 0x1264  
10:23:30.0185 0x1264  OS Version: 6.1.7600 ServicePack: 0.0
10:23:30.0185 0x1264  Product type: Workstation
10:23:30.0185 0x1264  ComputerName: *Mein Name*PC
10:23:30.0185 0x1264  UserName: *Mein Name*
10:23:30.0185 0x1264  Windows directory: C:\Windows
10:23:30.0185 0x1264  System windows directory: C:\Windows
10:23:30.0185 0x1264  Processor architecture: Intel x86
10:23:30.0185 0x1264  Number of processors: 3
10:23:30.0185 0x1264  Page size: 0x1000
10:23:30.0185 0x1264  Boot type: Normal boot
10:23:30.0186 0x1264  ============================================================
10:23:43.0746 0x1264  KLMD registered as C:\Windows\system32\drivers\54068416.sys
10:23:44.0214 0x1264  System UUID: {A653FDCC-37F8-E689-1FB4-692C2CC5C8AD}
10:23:44.0807 0x1264  Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
10:23:44.0823 0x1264  ============================================================
10:23:44.0823 0x1264  \Device\Harddisk0\DR0:
10:23:44.0823 0x1264  MBR partitions:
10:23:44.0823 0x1264  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
10:23:44.0823 0x1264  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x708D3000
10:23:44.0823 0x1264  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x70906000, BlocksNum 0x3C00000
10:23:44.0823 0x1264  ============================================================
10:23:44.0901 0x1264  C: <-> \Device\Harddisk0\DR0\Partition2
10:23:45.0057 0x1264  D: <-> \Device\Harddisk0\DR0\Partition3
10:23:45.0057 0x1264  ============================================================
10:23:45.0057 0x1264  Initialize success
10:23:45.0057 0x1264  ============================================================
10:24:26.0303 0x14a4  ============================================================
10:24:26.0303 0x14a4  Scan started
10:24:26.0303 0x14a4  Mode: Manual; SigCheck; TDLFS; 
10:24:26.0303 0x14a4  ============================================================
10:24:26.0303 0x14a4  KSN ping started
10:25:13.0868 0x14a4  KSN ping finished: true
10:25:20.0825 0x14a4  ================ Scan system memory ========================
10:25:20.0825 0x14a4  System memory - ok
10:25:20.0825 0x14a4  ================ Scan services =============================
10:25:21.0169 0x14a4  [ D01E0B1CEF9EE82100C2BB07294880EF, 335817C019E2A214EE3185ED9AFCCF323062D1CF2A0C32A114DD5D83B2FF9132 ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
10:25:21.0340 0x14a4  1394ohci - ok
10:25:21.0387 0x14a4  [ 0A1E97197609F92D2425B67DA0BB0A7F, 818FD957C6EA1869ED13EA8C0681D2850141E22A68A2D982E4AEEA2736F50555 ] ACEDRV05        C:\Windows\system32\drivers\ACEDRV05.sys
10:25:21.0527 0x14a4  ACEDRV05 - detected UnsignedFile.Multi.Generic ( 1 )
10:25:24.0148 0x14a4  Detect skipped due to KSN trusted
10:25:24.0148 0x14a4  ACEDRV05 - ok
10:25:24.0211 0x14a4  [ F0E07D144C8685B8774BC32FC8DA4DF0, 39816ED2623CA9ABE2B2EDCDB2F8481634742F00FEEF7E324F34D2BAAD668A67 ] ACPI            C:\Windows\system32\DRIVERS\ACPI.sys
10:25:24.0242 0x14a4  ACPI - ok
10:25:24.0273 0x14a4  [ 98D81CA942D19F7D9153B095162AC013, ACE5C073323176621F3312AA9B1EE1A3382F8CDD590D90DC57B34035FD6BC281 ] AcpiPmi         C:\Windows\system32\DRIVERS\acpipmi.sys
10:25:24.0351 0x14a4  AcpiPmi - ok
10:25:24.0476 0x14a4  [ 929593D76589294BA3F74540298D1B3E, 3D1C1772579141BD1040363BD65F2A2D78BF42EC85AE96317AE397E3D5267145 ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
10:25:24.0507 0x14a4  AdobeARMservice - ok
10:25:24.0710 0x14a4  [ B04A4810C6CC205F9DC72DC22E4AB236, 547321F5C28C80D4818372D65E2A33D4BAC593015DD6613B24586FE4B4A95D5D ] AdobeFlashPlayerUpdateSvc C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
10:25:24.0757 0x14a4  AdobeFlashPlayerUpdateSvc - ok
10:25:24.0835 0x14a4  [ 21E785EBD7DC90A06391141AAC7892FB, A2D3D764C5E6DC0AD5AAF48485FFB8B121D2A40DC08ECF2D2CB92278A1002B25 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys
10:25:24.0881 0x14a4  adp94xx - ok
10:25:24.0928 0x14a4  [ 0C676BC278D5B59FF5ABD57BBE9123F2, 339E8A433D186BAAB6FCB44C82CC9FB6FCD63C87981449494CBEB2072CB6B7BB ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys
10:25:24.0991 0x14a4  adpahci - ok
10:25:25.0037 0x14a4  [ 7C7B5EE4B7B822EC85321FE23A27DB33, A934AFB71D439555E6376DA9B34F82E8D39A300A4547BE9AC9311F6A3C36270C ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys
10:25:25.0053 0x14a4  adpu320 - ok
10:25:25.0100 0x14a4  [ 8B5EEFEEC1E6D1A72A06C526628AD161, 026CDF4C96F4D493E7BABF79A14C4B0B5ADCCEF0B081FFFA2E3B243B2414167F ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
10:25:25.0162 0x14a4  AeLookupSvc - ok
10:25:25.0209 0x14a4  [ 0DB7A48388D54D154EBEC120461A0FCD, 567B65F96ADE0E8252B7D8CE7F254CB8054C3AE4BC3577C394EFDEF8D8A61427 ] AFD             C:\Windows\system32\drivers\afd.sys
10:25:25.0256 0x14a4  AFD - ok
10:25:25.0271 0x14a4  [ 507812C3054C21CEF746B6EE3D04DD6E, D7E59350AC338AD229E3D10C76E32AE16D120311B263714A9CD94AB538633B0E ] agp440          C:\Windows\system32\DRIVERS\agp440.sys
10:25:25.0318 0x14a4  agp440 - ok
10:25:25.0365 0x14a4  [ 8B30250D573A8F6B4BD23195160D8707, 64EC289AFCD63D84EAFD9D81C50D0A77BCC79A1EFF32C50B2776BB0C0151757D ] aic78xx         C:\Windows\system32\DRIVERS\djsvs.sys
10:25:25.0381 0x14a4  aic78xx - ok
10:25:25.0427 0x14a4  [ 18A54E132947CD98FEA9ACCC57F98F13, 9D39AF972785E49F0DD12C4BAEF39A79CD69F098886BF152AF1B7CCE2E902115 ] ALG             C:\Windows\System32\alg.exe
10:25:25.0505 0x14a4  ALG - ok
10:25:25.0537 0x14a4  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44, 1D1AA8F50935D976C29DE7A84708CADBBBDD936F0DD2C059E820F0D21367B3B6 ] aliide          C:\Windows\system32\DRIVERS\aliide.sys
10:25:25.0568 0x14a4  aliide - ok
10:25:25.0693 0x14a4  ALSysIO - ok
10:25:25.0739 0x14a4  [ AA8C7A0A40D3B8992EA1845EF89FE2D4, A934E78612C58EB0EDBE01294B35DCFBD7C51FC467363D3BE7F2C23CC09CC9FD ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
10:25:25.0802 0x14a4  AMD External Events Utility - ok
10:25:25.0849 0x14a4  [ 3C6600A0696E90A463771C7422E23AB5, 370B33DC1C25B981628A318BAE434A78A5F0A0DA93C2896DC7A3D7B87AE1A5E7 ] amdagp          C:\Windows\system32\DRIVERS\amdagp.sys
10:25:25.0864 0x14a4  amdagp - ok
10:25:25.0911 0x14a4  [ CD5914170297126B6266860198D1D4F0, 2239FCBD1A7EC27CE4F10DA36AE6BD6CCB87E5128C82CA71B84BFE5AF5602A60 ] amdide          C:\Windows\system32\DRIVERS\amdide.sys
10:25:25.0958 0x14a4  amdide - ok
10:25:26.0005 0x14a4  [ 00DDA200D71BAC534BF56A9DB5DFD666, CA316B1FFD85BA1CF8664B3229DA1F238A5341E016059F7ED89702324CFD124B ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys
10:25:26.0067 0x14a4  AmdK8 - ok
10:25:26.0363 0x14a4  [ 5AB10C74C8EA15E98A6C771B7269615E, 8ADC46EFE6BB1C3A31BF484F626BE774ABCE8684363D5BCF8FE7654940C70F33 ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
10:25:26.0909 0x14a4  amdkmdag - ok
10:25:26.0956 0x14a4  [ E9890F7EC1AB4D09AFEB09DD76334622, A10F97CADF794B5222E8E0968CCAD53D60AABB2C2C2D5938E85F7832E51DDBB5 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
10:25:26.0987 0x14a4  amdkmdap - ok
10:25:27.0050 0x14a4  [ 3CBF30F5370FDA40DD3E87DF38EA53B6, 7EACF1743367BE805357B6FD10F8F99E9B1C301FE3782D77719347B13DFA65EC ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
10:25:27.0097 0x14a4  AmdPPM - ok
10:25:27.0143 0x14a4  [ 19CE906B4CDC11FC4FEF5745F33A63B6, 27BF91DB1FDC81CFCF0E0DCFD3C4AD51FCFB778D36F1E83105C2AFCF6851A4DF ] amdsata         C:\Windows\system32\drivers\amdsata.sys
10:25:27.0159 0x14a4  amdsata - ok
10:25:27.0206 0x14a4  [ EA43AF0C423FF267355F74E7A53BDABA, 3F1335909AB0281A2FBDD7AD90E18309E091656CD32B48894B992789D8C61DB4 ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
10:25:27.0253 0x14a4  amdsbs - ok
10:25:27.0268 0x14a4  [ 869E67D66BE326A5A9159FBA8746FA70, 8F493A340F19FB39B5BD24EF8603812BECE7770544AB91817FF67236448569CB ] amdxata         C:\Windows\system32\drivers\amdxata.sys
10:25:27.0268 0x14a4  amdxata - ok
10:25:27.0299 0x14a4  [ 437C824DEAC935DEA9E9C488675EFD09, 72C579EC8F974BC803742F373D3FF2421231981ADB84E6746E5C4B08278E1E27 ] amd_sata        C:\Windows\system32\DRIVERS\amd_sata.sys
10:25:27.0549 0x14a4  amd_sata - ok
10:25:27.0596 0x14a4  [ D919795612EABBA7D5F5222377BEBD7B, 200EBEE44AD88B1FB3493F671DE5B9DBC548EC1E95F056C247DD5BF0DED72A38 ] amd_xata        C:\Windows\system32\DRIVERS\amd_xata.sys
10:25:27.0627 0x14a4  amd_xata - ok
10:25:27.0783 0x14a4  [ C83F208FE6DC871FC3093EE14D4E5D7E, EA0B8AFD44E999F29BBE873F0A3FB802CBDFC7618D59705768F6467D6FD0AC8B ] AntiVirFirewallService C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
10:25:27.0814 0x14a4  AntiVirFirewallService - ok
10:25:27.0908 0x14a4  [ 3BC01196C126B51ADA7C5951F3C451B6, F41C08CD5A540879C2061FC3B1D40A3301B0F09101AA4BD266B246D2185F308C ] AntiVirMailService C:\Program Files\Avira\AntiVir Desktop\avmailc.exe
10:25:27.0970 0x14a4  AntiVirMailService - ok
10:25:28.0033 0x14a4  [ A421CC12577FCB0F06CDA6A6774977C2, 65DCADC40354AA1033DDED02DA299592B4A89F44F3C0869A5EB7B2EB3E431EAA ] AntiVirSchedulerService C:\Program Files\Avira\AntiVir Desktop\sched.exe
10:25:28.0048 0x14a4  AntiVirSchedulerService - ok
10:25:28.0126 0x14a4  [ A421CC12577FCB0F06CDA6A6774977C2, 65DCADC40354AA1033DDED02DA299592B4A89F44F3C0869A5EB7B2EB3E431EAA ] AntiVirService  C:\Program Files\Avira\AntiVir Desktop\avguard.exe
10:25:28.0157 0x14a4  AntiVirService - ok
10:25:28.0267 0x14a4  [ 9B21B8BBDFC4259E7F18C46CB9455608, BFD72255CCC65900BA3E27AB01A9539560FB094B02962FDA91196B70D5D0FE3B ] AntiVirWebService C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE
10:25:28.0298 0x14a4  AntiVirWebService - ok
10:25:28.0345 0x14a4  [ FEB834C02CE1E84B6A38F953CA067706, E5A7F8B632ABFBD1283C3D44FB02449814EDB653B204E1720DAA780A6D64FD01 ] AppID           C:\Windows\system32\drivers\appid.sys
10:25:28.0423 0x14a4  AppID - ok
10:25:28.0469 0x14a4  [ 62A9C86CB6085E20DB4823E4E97826F5, E0F840B49710022C4FB437002AD06F64B0F6B5D628B32D00F2B66765E6B97E4B ] AppIDSvc        C:\Windows\System32\appidsvc.dll
10:25:28.0594 0x14a4  AppIDSvc - ok
10:25:28.0625 0x14a4  [ 7DEAD9E3F65DCB2794F2711003BBF650, F541C30EEFD1BDB70F361B878B6E51DC728873695DD137148CE531FBACCDA21B ] Appinfo         C:\Windows\System32\appinfo.dll
10:25:28.0657 0x14a4  Appinfo - ok
10:25:28.0703 0x14a4  [ 2932004F49677BD84DBC72EDB754FFB3, 73F84582244AC53994A2F4499A119B4A84A6BF7FD3046C29A8080C763DE540B8 ] arc             C:\Windows\system32\DRIVERS\arc.sys
10:25:28.0719 0x14a4  arc - ok
10:25:28.0766 0x14a4  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7, F7C9C3B4F2C816F57A43B2921672858C291054220BADE291044343778216F6BA ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
10:25:28.0828 0x14a4  arcsas - ok
10:25:28.0922 0x14a4  [ 776ACEFA0CA9DF0FAA51A5FB2F435705, 72DF7ED6B085BC468994F5B3189506FD726A9A17A9C42ACA1E420D787691361D ] aspnet_state    C:\Windows\Microsoft.NET\Framework\v4.0.30319\aspnet_state.exe
10:25:29.0031 0x14a4  aspnet_state - ok
10:25:29.0062 0x14a4  [ ADD2ADE1C2B285AB8378D2DAAF991481, 7965A705F37924C0EC7A934E64E89C5DF4069816E2EEA3509E0AC90F78910519 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
10:25:29.0203 0x14a4  AsyncMac - ok
10:25:29.0234 0x14a4  [ 338C86357871C167A96AB976519BF59E, F28CC534523D1701B0552F5D7E18E88369C4218BDB1F69110C3E31D395884AD6 ] atapi           C:\Windows\system32\DRIVERS\atapi.sys
10:25:29.0249 0x14a4  atapi - ok
10:25:29.0296 0x14a4  [ C8B17AC82AD2EE9E0E58E3461008C5F7, A5870143F19317B50EF634DB05218E09B8B8087E14F2FC74F1E247E3ED827AA6 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW73.sys
10:25:29.0312 0x14a4  AtiHDAudioService - ok
10:25:29.0390 0x14a4  [ 8DF873D0587596C1D35A9CECECC61DA1, 41974FCA452CE48C5A6040BF99D1AC9A1C13FF38DF341443CCE2D2ABBC4C9453 ] AtiHdmiService  C:\Windows\system32\drivers\AtiHdmi.sys
10:25:29.0437 0x14a4  AtiHdmiService - ok
10:25:29.0483 0x14a4  [ 4FFE74E33BD9170950116F0CA46EAC89, B69F2DDC63E608E4D53FDB37B720E8C1B4837DDCBA7552B938819B2DA3F701E5 ] AtiPcie         C:\Windows\system32\DRIVERS\AtiPcie.sys
10:25:29.0515 0x14a4  AtiPcie - ok
10:25:29.0561 0x14a4  [ 510C873BFA135AA829F4180352772734, BC528D840EB338B0C5D11801C63D8EADD40AF8043DC77ACB4B42E8D20767538F ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
10:25:29.0639 0x14a4  AudioEndpointBuilder - ok
10:25:29.0655 0x14a4  [ 510C873BFA135AA829F4180352772734, BC528D840EB338B0C5D11801C63D8EADD40AF8043DC77ACB4B42E8D20767538F ] Audiosrv        C:\Windows\System32\Audiosrv.dll
10:25:29.0686 0x14a4  Audiosrv - ok
10:25:29.0733 0x14a4  [ 662ECAEC0FAE2C2069B75EF8A762BE87, 707B26ACF83D5E1CDDAF3102F7294F3BCEB026ECF4C1C4A745E83ED22F196E70 ] avfwim          C:\Windows\system32\DRIVERS\avfwim.sys
10:25:29.0780 0x14a4  avfwim - ok
10:25:29.0858 0x14a4  [ E4DC0228AB7492086B96FCC8298CF3B6, 5CB0ACC01F7F8B8B24365B2E0A7699A453235523E67A8D39BC8615B541D7F5B0 ] avfwot          C:\Windows\system32\DRIVERS\avfwot.sys
10:25:29.0905 0x14a4  avfwot - ok
10:25:29.0967 0x14a4  [ AF5DA81B19AFA730F1E5246AD81D140A, 532951071F56896A3B5D47874C14D996C8620EA02F87D4BA21B083EC804FB166 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
10:25:29.0983 0x14a4  avgntflt - ok
10:25:30.0029 0x14a4  [ A5674637BCA212D9FE136ADFA04C9857, 95F3632EBB041C539816D285EBE1F379D46A4187379C69D4683D9F4DECBDB80C ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
10:25:30.0092 0x14a4  avipbb - ok
10:25:30.0139 0x14a4  [ D8C712305F73CD34D1B344810E522728, 49A474FF6CA44E8427D7A8290B47395125B0148AF384CF2B3B1FA495A4718CBA ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
10:25:30.0185 0x14a4  avkmgr - ok
10:25:30.0248 0x14a4  [ DD6A431B43E34B91A767D1CE33728175, 8BFF6474C9DFBEC96FA7B2789EF9B17C7910B52DBCF70CDA1F0C698CFA5EFB6E ] AxInstSV        C:\Windows\System32\AxInstSV.dll
10:25:30.0357 0x14a4  AxInstSV - ok
10:25:30.0419 0x14a4  [ 1A231ABEC60FD316EC54C66715543CEC, 09E2897BA80737997A286EA5408C03DD3CC0EBACD24CB391C2455B6D4BE7D67E ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbdx.sys
10:25:30.0482 0x14a4  b06bdrv - ok
10:25:30.0513 0x14a4  [ BD8869EB9CDE6BBE4508D869929869EE, F4363A12EBFDBB89C69FD59B22F9EE05BADA07D477A1DF2DE01F59D6EE496543 ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
10:25:30.0560 0x14a4  b57nd60x - ok
10:25:30.0622 0x14a4  [ EE1E9C3BB8228AE423DD38DB69128E71, ED54FD9795F3A4D32F02BED6052AD9404409A05644CDBEBFF19C662D104DA95A ] BDESVC          C:\Windows\System32\bdesvc.dll
10:25:30.0716 0x14a4  BDESVC - ok
10:25:30.0731 0x14a4  [ 505506526A9D467307B3C393DEDAF858, 8AD6F1492E357F57CF42261497BA29122045D4FC0DCC9669AA5AC9B2A4BABFA4 ] Beep            C:\Windows\system32\drivers\Beep.sys
10:25:30.0778 0x14a4  Beep - ok
10:25:30.0809 0x14a4  [ 85AC71C045CEB054ED48A7841AAE0C11, BA0C0CC50E5C49838116AC9A12A7CF1A683601FD08D3CF6EC06620C51C0806FF ] BFE             C:\Windows\System32\bfe.dll
10:25:30.0856 0x14a4  BFE - ok
10:25:30.0903 0x14a4  [ 53F476476F55A27F580661BDE09C4EC4, 90DFBF97F011CFF41D2CFA2E33978BC746A7E693AC75EED1436130C4F10B4E67 ] BITS            C:\Windows\System32\qmgr.dll
10:25:31.0012 0x14a4  BITS - ok
10:25:31.0043 0x14a4  [ 2287078ED48FCFC477B05B20CF38F36F, 55BCA6174E6034A8D61CBE4126B2F1989F6052BFA624BEA9C0A0A664AEC74521 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
10:25:31.0059 0x14a4  blbdrive - ok
10:25:31.0090 0x14a4  [ 9A5C671B7FBAE4865149BB11F59B91B2, BE1D5901CB8EF20E34F711D6451BDFBCA4BD65AFAD6028964C5CE1673D94FBAD ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
10:25:31.0137 0x14a4  bowser - ok
10:25:31.0153 0x14a4  [ 9F9ACC7F7CCDE8A15C282D3F88B43309, A9131334BD9CF8FD60BA9D54AA054E2DF2BE1219FB650DF1464F2787BDEAE98F ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
10:25:31.0199 0x14a4  BrFiltLo - ok
10:25:31.0215 0x14a4  [ 56801AD62213A41F6497F96DEE83755A, 0DEB8318FB47DF6473C171C795C735E26A73FA12232876C6856549EA16F33361 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
10:25:31.0262 0x14a4  BrFiltUp - ok
10:25:31.0309 0x14a4  [ A0E691DC6589D4D2CBE373171D1A49E5, 66BAED3EF7AFE0FB4304FC97ABE2BB106ADE1A956F89DCB52E70F30239461D05 ] Browser         C:\Windows\System32\browser.dll
10:25:31.0387 0x14a4  Browser - ok
10:25:31.0418 0x14a4  [ 845B8CE732E67F3B4133164868C666EA, 9309B094CD9B5EBC46295A5EB806BED472C3CEDE3B5F6F497EBDABA496A2A27F ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
10:25:31.0465 0x14a4  Brserid - ok
10:25:31.0496 0x14a4  [ 203F0B1E73ADADBBB7B7B1FABD901F6B, 782FA7B26940FE479C49C9BAA2EB582CDAAAD607013E9BCFC85E6FBBB7D49A6D ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
10:25:31.0589 0x14a4  BrSerWdm - ok
10:25:31.0621 0x14a4  [ BD456606156BA17E60A04E18016AE54B, DFBDC9DA6A3EA40BACFF204BC6C55C2C122B5885D2CBF6D45054DE43EE15EC4D ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
10:25:31.0652 0x14a4  BrUsbMdm - ok
10:25:31.0667 0x14a4  [ AF72ED54503F717A43268B3CC5FAEC2E, 4A638669B0C30B1BDED242A8BF2015A37749570FF4D67D190BACC8D7E0C44468 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
10:25:31.0699 0x14a4  BrUsbSer - ok
10:25:31.0730 0x14a4  [ ED3DF7C56CE0084EB2034432FC56565A, B5B75E002E7BC0209582C635CCCA26DB569BDB23C33A126634E00C6434BF941B ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
10:25:31.0792 0x14a4  BTHMODEM - ok
10:25:31.0839 0x14a4  [ 1DF19C96EEF6C29D1C3E1A8678E07190, 1F4BB161FF3A1C5B1465BB52F3520FEDB7ACB1FAA132466F07D16DB8E394AEA5 ] bthserv         C:\Windows\system32\bthserv.dll
10:25:31.0933 0x14a4  bthserv - ok
10:25:31.0948 0x14a4  [ 77EA11B065E0A8AB902D78145CA51E10, 160EB3BBE9E5F3CC4A02584E6F2576A812C7565B940D74838B983F1EE51FA73A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
10:25:31.0995 0x14a4  cdfs - ok
10:25:32.0042 0x14a4  [ BA6E70AA0E6091BC39DE29477D866A77, A17A68BDA46995F75FB1C2C593A81CD3B2BFE290CEAA45FA2380DDF5537A23C9 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
10:25:32.0104 0x14a4  cdrom - ok
10:25:32.0135 0x14a4  [ 628A9E30EC5E18DD5DE6BE4DBDC12198, DDA43DCCB195440D6BD5752BD00D984F45BD6D23DBE2A656C33E3CD1E5D17AD7 ] CertPropSvc     C:\Windows\System32\certprop.dll
10:25:32.0182 0x14a4  CertPropSvc - ok
10:25:32.0198 0x14a4  [ 3FE3FE94A34DF6FB06E6418D0F6A0060, 6B3A2A26609A75B690D4C0B3059E40822F3B3DB08943F58EC496BABDA7D0A735 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
10:25:32.0229 0x14a4  circlass - ok
10:25:32.0245 0x14a4  [ 635181E0E9BBF16871BF5380D71DB02D, 58D5150C6F3B9F1730FFDF3A8A2ABF5FF207F9785BD66C0C1E03A0F1C223A26A ] CLFS            C:\Windows\system32\CLFS.sys
10:25:32.0260 0x14a4  CLFS - ok
10:25:32.0307 0x14a4  [ D88040F816FDA31C3B466F0FA0918F29, 39D3630E623DA25B8444B6D3AAAB16B98E7E289C5619E19A85D47B74C71449F3 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
10:25:32.0323 0x14a4  clr_optimization_v2.0.50727_32 - ok
10:25:32.0369 0x14a4  [ C5A75EB48E2344ABDC162BDA79E16841, 6070A8AAFD38FBC6A68A2B10C20117612354DF21B4492D90CA522BFB6870D726 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
10:25:32.0463 0x14a4  clr_optimization_v4.0.30319_32 - ok
10:25:32.0479 0x14a4  [ DEA805815E587DAD1DD2C502220B5616, 2D6A7668C95352B818F5EC59FF462894935833D34190257DA9CAC7E67FD3631C ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
10:25:32.0525 0x14a4  CmBatt - ok
10:25:32.0557 0x14a4  [ C537B1DB64D495B9B4717B4D6D9EDBF2, 400EEFE662DE117C9CC956E4CBD5E98F28F962E7447CD93E8A78FDD8CA39EB4B ] cmdide          C:\Windows\system32\DRIVERS\cmdide.sys
10:25:32.0572 0x14a4  cmdide - ok
10:25:32.0650 0x14a4  [ DB5E008B3744DD60C8498CBBF2A1CFA6, 1D851BF2433A953B32438A911D194C9DB42A52CD6E8DA296CA3C8DD2CCA83381 ] CNG             C:\Windows\system32\Drivers\cng.sys
10:25:32.0681 0x14a4  CNG - ok
10:25:32.0713 0x14a4  [ A6023D3823C37043986713F118A89BEE, FAC239A7FA6251C7EDFFA34B4BAE3910B8BC0BD4A3574B6DB6931A8D691E207B ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
10:25:32.0728 0x14a4  Compbatt - ok
10:25:32.0759 0x14a4  [ F1724BA27E97D627F808FB0BA77A28A6, F7D69082EEFEC0FB8B309F6AEE282D4A5DFC1A40851ED65904AA9582C5DEA5AB ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
10:25:32.0791 0x14a4  CompositeBus - ok
10:25:32.0806 0x14a4  COMSysApp - ok
10:25:32.0822 0x14a4  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1, 6FC323217D82EF661BA0E3F949B61B05BB5235D1A69C81D24876C2153FAECEF6 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys
10:25:32.0837 0x14a4  crcdisk - ok
10:25:32.0915 0x14a4  [ F2FDE6C8DBAAD44CC58D1E07E4AF4EED, 579D206CF49FB78C2D9BA29A9C57489B7875242EB618019CB7B8D336C70A09E6 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
10:25:32.0947 0x14a4  CryptSvc - ok
10:25:32.0978 0x14a4  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] DcomLaunch      C:\Windows\system32\rpcss.dll
10:25:33.0040 0x14a4  DcomLaunch - ok
10:25:33.0056 0x14a4  [ 8D6E10A2D9A5EED59562D9B82CF804E1, 888F9650F4E872BA8F4E0C27E38A6672A561042B17EBA40E306A22357965B0AD ] defragsvc       C:\Windows\System32\defragsvc.dll
10:25:33.0103 0x14a4  defragsvc - ok
10:25:33.0134 0x14a4  [ 83D1ECEA8FAAE75604C0FA49AC7AD996, 0EB4F374CB91AFF12ABC7EFC7858BDB6E58B50FCE0ADA1711F90FF592059DA40 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
10:25:33.0227 0x14a4  DfsC - ok
10:25:33.0290 0x14a4  [ C56495FBD770712367CAD35E5DE72DA6, 9D5456A2E208F542F0B6C951EFCABA2A10919777C4287D7298A28F543D5BAC32 ] Dhcp            C:\Windows\system32\dhcpcore.dll
10:25:33.0352 0x14a4  Dhcp - ok
10:25:33.0383 0x14a4  [ 1A050B0274BFB3890703D490F330C0DA, 79D74F4679A2EE040FAAF4D0392A9311239A10A5F8A5CCB48656C6F89B6D62FB ] discache        C:\Windows\system32\drivers\discache.sys
10:25:33.0430 0x14a4  discache - ok
10:25:33.0461 0x14a4  [ 565003F326F99802E68CA78F2A68E9FF, ABC42B24DBA4FFC411120E09278EF26AF56CCAB463B69B4BD6C530B4A07063D2 ] Disk            C:\Windows\system32\DRIVERS\disk.sys
10:25:33.0508 0x14a4  Disk - ok
10:25:33.0571 0x14a4  [ B15BE77A2BACF9C3177D27518AFE26A9, FBF02038C2EC0262B401FCBD348C48DF184AD76E95643E3D6ED32C02E90D8FC9 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
10:25:33.0649 0x14a4  Dnscache - ok
10:25:33.0695 0x14a4  [ 4408C85C21EEA48EB0CE486BAEEF0502, 67EA726F4053665D94D7790EC89616EA0698A7548073A9211E3F75937B4384BE ] dot3svc         C:\Windows\System32\dot3svc.dll
10:25:33.0742 0x14a4  dot3svc - ok
10:25:33.0789 0x14a4  [ 7FA81C6E11CAA594ADB52084DA73A1E5, 9ED1C585D9CA091E75E4A2A1E5B923B104EBDC5FC9D12154DE909C583E4D0CAE ] DPS             C:\Windows\system32\dps.dll
10:25:33.0851 0x14a4  DPS - ok
10:25:33.0883 0x14a4  [ B918E7C5F9BF77202F89E1A9539F2EB4, C589A37DE50BBEF22E2DAA9682EA43147F614AA1AF7DAAA942BA5FC192313A0B ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
10:25:33.0898 0x14a4  drmkaud - ok
10:25:33.0961 0x14a4  [ 1679A4669326CB1A67CC95658D273234, 57429EC10744956635CAE0742320D7C03B3EEA0CB1F5769AEF21C054C0B5E498 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
10:25:33.0992 0x14a4  DXGKrnl - ok
10:25:34.0023 0x14a4  [ 8600142FA91C1B96367D3300AD0F3F3A, 5713625E27DF11FAAFDA7AC79899A6AD813166E167088FA990EC5DE87DBE83DF ] EapHost         C:\Windows\System32\eapsvc.dll
10:25:34.0070 0x14a4  EapHost - ok
10:25:34.0257 0x14a4  [ 024E1B5CAC09731E4D868E64DBFB4AB0, AB0826A74BBEE5B7A1B035861B665C79BC98305CFC7D82BEF420558FBD3EE994 ] ebdrv           C:\Windows\system32\DRIVERS\evbdx.sys
10:25:34.0397 0x14a4  ebdrv - ok
10:25:34.0429 0x14a4  [ C2243FF9E9AAD0C30E8B1A0914DA15B6, CD01BD44659FDAA6FE8679D0F76748409680A4F4885905EA56F655C60DDEC01F ] EFS             C:\Windows\System32\lsass.exe
10:25:34.0475 0x14a4  EFS - ok
10:25:34.0538 0x14a4  [ 1697C39978CD69F6FBC15302EDCECE1F, E496FAE102EE33EBD35AC745E8647976DB9F91EF78E54EB962FF2D04D45B561A ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
10:25:34.0600 0x14a4  ehRecvr - ok
10:25:34.0616 0x14a4  [ D389BFF34F80CAEDE417BF9D1507996A, 12859B9925D7A4631DE61A820922F43F56ED23C2AF014CBF36322685E5CF641E ] ehSched         C:\Windows\ehome\ehsched.exe
10:25:34.0663 0x14a4  ehSched - ok
10:25:34.0694 0x14a4  [ 0ED67910C8C326796FAA00B2BF6D9D3C, 97FAA7627A162B0AEC15545E0165D13355D535B4157604BB87F8EEB72ECD24A8 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys
10:25:34.0709 0x14a4  elxstor - ok
10:25:34.0725 0x14a4  [ 8FC3208352DD3912C94367A206AB3F11, 69B65C12BDADD4B730508674B1B77C5496612B4ACCC447DB9AFE49ADEA8CBF02 ] ErrDev          C:\Windows\system32\DRIVERS\errdev.sys
10:25:34.0772 0x14a4  ErrDev - ok
10:25:34.0803 0x14a4  [ F6916EFC29D9953D5D0DF06882AE8E16, ED41893960018D5EC2F7829B1DE4B6967D9FD074D60B11B9EB854E3E0948EC24 ] EventSystem     C:\Windows\system32\es.dll
10:25:34.0850 0x14a4  EventSystem - ok
10:25:34.0865 0x14a4  [ 2DC9108D74081149CC8B651D3A26207F, 75CB47923A867DDAC512701CE71DFCFC340FC3A2E27F4255D0836A1FBC463176 ] exfat           C:\Windows\system32\drivers\exfat.sys
10:25:34.0912 0x14a4  exfat - ok
10:25:34.0928 0x14a4  [ 7E0AB74553476622FB6AE36F73D97D35, 41463A255FDA1D550B3385EC7C73ABC343B1BBBE9CEE4DF9F2A8B3E7338C4947 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
10:25:34.0959 0x14a4  fastfat - ok
10:25:35.0006 0x14a4  [ F7EA23CC5E6BF2181F3F399D54F6EFC1, 4659A2EDC5D5171668FB20BED7B56466A674876888519D6F524F7456EBD11263 ] Fax             C:\Windows\system32\fxssvc.exe
10:25:35.0053 0x14a4  Fax - ok
10:25:35.0084 0x14a4  [ E817A017F82DF2A1F8CFDBDA29388B29, 4CC9320A21E6FEA2D16C48D6BEA14391B695BD541A3C5FDDAEEE086A414FC837 ] fdc             C:\Windows\system32\DRIVERS\fdc.sys
10:25:35.0099 0x14a4  fdc - ok
10:25:35.0131 0x14a4  [ F3222C893BD2F5821A0179E5C71E88FB, A85B947249DBB986358CCD4B158DD58A9301F074F3C6CCCDEF2D01F432E59D1B ] fdPHost         C:\Windows\system32\fdPHost.dll
10:25:35.0162 0x14a4  fdPHost - ok
10:25:35.0177 0x14a4  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B, 0E76C29D2A974A3F2FBFCB63D066D4136B78E02F6B1F579B1865CA7A76193987 ] FDResPub        C:\Windows\system32\fdrespub.dll
10:25:35.0209 0x14a4  FDResPub - ok
10:25:35.0224 0x14a4  [ 6CF00369C97F3CF563BE99BE983D13D8, F65F35324A2FB9DFB533B1C4D089D990CC242218FE83414329D07B786D8EFF33 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
10:25:35.0240 0x14a4  FileInfo - ok
10:25:35.0271 0x14a4  [ 42C51DC94C91DA21CB9196EB64C45DB9, 388C68D12ECC8FFE3116FEAAF4DB7B80CF4A3F97E935788DD21C6ADE2369F635 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
10:25:35.0318 0x14a4  Filetrace - ok
10:25:35.0333 0x14a4  [ 87907AA70CB3C56600F1C2FB8841579B, CA1CD82A1CD453617CE5EA431A1836997F14E3580554E8A516D9FE1E9926D979 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
10:25:35.0349 0x14a4  flpydisk - ok
10:25:35.0380 0x14a4  [ 7520EC808E0C35E0EE6F841294316653, 6EC65511B4838A7172A8F89E35C2F9DF4F0BFCE3BE12EDA790F3EB567102FF67 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
10:25:35.0396 0x14a4  FltMgr - ok
10:25:35.0458 0x14a4  [ 7FE4995528A7529A761875151EE3D512, 63F062A8E6AA9AEF39A46E94ADD548C72B4E21C1090DE9CBDCFB3F4489637BAF ] FontCache       C:\Windows\system32\FntCache.dll
10:25:35.0521 0x14a4  FontCache - ok
10:25:35.0567 0x14a4  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F, DBED26852B99B362152DA9CD4F31A1883EF6F9B496F3CF3772A197BA72DB61DA ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
10:25:35.0583 0x14a4  FontCache3.0.0.0 - ok
10:25:35.0630 0x14a4  [ 1A16B57943853E598CFF37FE2B8CBF1D, 87609F46F3B8123552141FD70866E895220B1BBD92BC2B580CAF49201AA0197E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
10:25:35.0645 0x14a4  FsDepends - ok
10:25:35.0677 0x14a4  [ 500A9814FD9446A8126858A5A7F7D273, FB9607A43B8DDA87A449A3BFEBDC035F00BA7B5D9CC56AD5F310732A38F56A46 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
10:25:35.0692 0x14a4  Fs_Rec - ok
10:25:35.0708 0x14a4  [ 4732E596BB1C50D9F9188C5074EE7782, 465E47C6AFA53B7CAFED5C61A5D832E7B3A1A33F82E1F11A472B84CD24D2ED55 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
10:25:35.0739 0x14a4  fvevol - ok
10:25:35.0770 0x14a4  [ 65EE0C7A58B65E74AE05637418153938, 0E1A398ADD8411AF4CCC3344D67BE1B261320C58328BD5C5855A357476FAEBEF ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
10:25:35.0786 0x14a4  gagp30kx - ok
10:25:35.0817 0x14a4  [ 8BA3C04702BF8F927AB36AE8313CA4EE, 3B6460C8134AA9D6E4FB978201B35FE9B67DD5BBB6C8D9625F3097DDA30C2893 ] gpsvc           C:\Windows\System32\gpsvc.dll
10:25:35.0848 0x14a4  gpsvc - ok
10:25:35.0879 0x14a4  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdate         C:\Program Files\Google\Update\GoogleUpdate.exe
10:25:35.0895 0x14a4  gupdate - ok
10:25:35.0911 0x14a4  [ 51508F0C2476177E50C31B0BBFBF1BDB, 3F62A05181D54711180C8727AC66D624AFA7FC816A4ACC4DC0CFCF2D2DBE7F87 ] gupdatem        C:\Program Files\Google\Update\GoogleUpdate.exe
10:25:35.0926 0x14a4  gupdatem - ok
10:25:35.0957 0x14a4  [ C44E3C2BAB6837DB337DDEE7544736DB, 88A24FF7D2FECCEAFFD421B2039A0FB623DA47A6B220B80EF1E52DD26D9E222D ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
10:25:36.0020 0x14a4  hcw85cir - ok
10:25:36.0067 0x14a4  [ 3530CAD25DEBA7DC7DE8BB51632CBC5F, 6706B8AD211A4B89B6571ACD227412026EAD87D71456B3EC6E7DD8FA15B997BE ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
10:25:36.0113 0x14a4  HdAudAddService - ok
10:25:36.0145 0x14a4  [ 717A2207FD6F13AD3E664C7D5A43C7BF, BF28A6F00B64FA0E801493E3289CFFD5E313E724DF7B5AB521C9E37A20890DCF ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
10:25:36.0176 0x14a4  HDAudBus - ok
10:25:36.0207 0x14a4  [ 1D58A7F3E11A9731D0EAAAA8405ACC36, 7056FA18B86FBD52C4A6092D80476C02553EA053D6A0BEDB01A2FA5E152D5215 ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys
10:25:36.0223 0x14a4  HidBatt - ok
10:25:36.0254 0x14a4  [ 89448F40E6DF260C206A193A4683BA78, 71E0FCC32AE6FF8DFF420DB0383D6A200E1EAE14BD2E32453F92CE18B31C1F3C ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
10:25:36.0332 0x14a4  HidBth - ok
10:25:36.0347 0x14a4  [ CF50B4CF4A4F229B9F3C08351F99CA5E, B97843620AF80FF0EC8F2C438255C0A42A756C6314FAF3DEF415DE16E14C108F ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys
10:25:36.0379 0x14a4  HidIr - ok
10:25:36.0410 0x14a4  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B, 2AF3312F1C8C8923C0A29AA5DAE57CE269417E53DEA2F0CCCC8DB57029698FE1 ] hidserv         C:\Windows\system32\hidserv.dll
10:25:36.0457 0x14a4  hidserv - ok
10:25:36.0488 0x14a4  [ 25072FB35AC90B25F9E4E3BACF774102, EBCE089947CC5A251A517CB91E81FCB948B18405FBACA04C874D4A48AF88676D ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
10:25:36.0503 0x14a4  HidUsb - ok
10:25:36.0535 0x14a4  [ 741C2A45CA8407E374AABA3E330B7872, FCF31C46297CFDF8240F0E783A61C8463FEDB1EF7A676AB89DFF0EAE9F3534B4 ] hkmsvc          C:\Windows\system32\kmsvc.dll
10:25:36.0566 0x14a4  hkmsvc - ok
10:25:36.0597 0x14a4  [ A768CA158BB06782A2835B907F4873C3, EFF736C6BA38FB8FC8807286AB273E7274F505E8E59D952E8563DF77C412C5AE ] HomeGroupListener C:\Windows\system32\ListSvc.dll
10:25:36.0644 0x14a4  HomeGroupListener - ok
10:25:36.0659 0x14a4  [ FB08DEC5EF43D0C66D83B8E9694E7549, 9C9ECE9E90F524791FC5DCE797BAE39605F966592126FF058BA3FA0BEFD07BEB ] HomeGroupProvider C:\Windows\system32\provsvc.dll
10:25:36.0691 0x14a4  HomeGroupProvider - ok
10:25:36.0722 0x14a4  [ 295FDC419039090EB8B49FFDBB374549, 670E8015FD374640C6570F56F7FE8DE4D8F92E7A8072F5D1B2B95D0BD699CEF7 ] HpSAMD          C:\Windows\system32\DRIVERS\HpSAMD.sys
10:25:36.0737 0x14a4  HpSAMD - ok
10:25:36.0800 0x14a4  [ C531C7FD9E8B62021112787C4E2C5A5A, 09205E2A5BFB6C623B312B8AC82F7F7CA8A922B1D9A0E3952BD3BA47BBE1F18C ] HTTP            C:\Windows\system32\drivers\HTTP.sys
10:25:36.0878 0x14a4  HTTP - ok
10:25:36.0878 0x14a4  [ 8305F33CDE89AD6C7A0763ED0B5A8D42, A7CA4978DC1FF6105EA39124DF854F0B1FD478476B871ED0E018AF3AE2165282 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
10:25:36.0893 0x14a4  hwpolicy - ok
10:25:36.0940 0x14a4  [ F151F0BDC47F4A28B1B20A0818EA36D6, 84B24B5796D9F70A8C37773F5484A4606CC7908370CCD942627ACBEDC4952D79 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
10:25:37.0003 0x14a4  i8042prt - ok
10:25:37.0049 0x14a4  [ 71F1A494FEDF4B33C02C4A6A28D6D9E9, 3AF6B8220E5081C79951979FE59E980C0309C826E201AE286D3B42CD2BA8145F ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
10:25:37.0081 0x14a4  iaStorV - ok
10:25:37.0159 0x14a4  [ 1CF03C69B49ACB70C722DF92755C0C8C, C227850C133F29BB9DED91A26A22AE077FD69629CEF35B67D305F016C4BDAA81 ] IDriverT        C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
10:25:37.0205 0x14a4  IDriverT - detected UnsignedFile.Multi.Generic ( 1 )
10:25:39.0826 0x14a4  Detect skipped due to KSN trusted
10:25:39.0826 0x14a4  IDriverT - ok
10:25:40.0107 0x14a4  [ 5AF815EB5BC9802E5A064E2BA62BFC0C, DC8CED05F623D30C57E8A7A382A219B4266C9C766ABF8A8D71783EACB8607B82 ] idsvc           C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
10:25:40.0201 0x14a4  idsvc - ok
10:25:40.0232 0x14a4  [ 4173FF5708F3236CF25195FECD742915, 0A9C0701DF6EAC6602BE342FC13C7950EF04BB5BDF7D96C2C5DABBD2A29AA55D ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys
10:25:40.0247 0x14a4  iirsp - ok
10:25:40.0294 0x14a4  [ FAC0EE6562B121B1399D6E855583F7A5, 034C9EE9232EB2CE64297EC4BCBEB5DA443ED9176C436CC754EF84FFB4AD4B08 ] IKEEXT          C:\Windows\System32\ikeext.dll
10:25:40.0341 0x14a4  IKEEXT - ok
10:25:40.0513 0x14a4  [ 4BE85CF5831A41104C2DDED55FBC3565, D5052C717710579A31E030CFFCA59B3632591FDDD2CE237C68276AE58783BD6F ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHDA.sys
10:25:40.0731 0x14a4  IntcAzAudAddService - ok
10:25:40.0825 0x14a4  [ A0F12F2C9BA6C72F3987CE780E77C130, 5F53DF8BE1621AA7DFB655CFD9C95E0AFA1AD3CE2E290E19D7B7FB3C6E380034 ] intelide        C:\Windows\system32\DRIVERS\intelide.sys
10:25:40.0856 0x14a4  intelide - ok
10:25:40.0903 0x14a4  [ 3B514D27BFC4ACCB4037BC6685F766E0, F12D7AC62F8550E6F33B28AD751D8413AB7FFEF963242D99FFA76CE8A48B027A ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
10:25:40.0965 0x14a4  intelppm - ok
10:25:40.0981 0x14a4  [ ACB364B9075A45C0736E5C47BE5CAE19, 202F77C659103D2D0E787B8CB0A23BE32EA5AA2E6B3B0A0F0A8DFA906AB3C0C0 ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
10:25:41.0043 0x14a4  IPBusEnum - ok
10:25:41.0074 0x14a4  [ 709D1761D3B19A932FF0238EA6D50200, 0A9D2C3A6E91CA45540555B40CB4E2DF3EBE98C1D164C4EECEE20C86782F5823 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
10:25:41.0137 0x14a4  IpFilterDriver - ok
10:25:41.0168 0x14a4  [ 477397B432A256A50EE7E4339EB9EA14, 3722938E69D16962F773F39669E9B90279DC9527BBC63564B33C89DAFD283497 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
10:25:41.0199 0x14a4  iphlpsvc - ok
10:25:41.0230 0x14a4  [ E4454B6C37D7FFD5649611F6496308A7, 5B2AA8C06076C9A1FF944E5EA07C29BA7FABEBB38E6BFB388ED46933EAC465FB ] IPMIDRV         C:\Windows\system32\DRIVERS\IPMIDrv.sys
10:25:41.0261 0x14a4  IPMIDRV - ok
10:25:41.0277 0x14a4  [ A5FA468D67ABCDAA36264E463A7BB0CD, EDB828D596E43372F97DAE1AADA46428C4C45FB80646DDC64FAD5F25C826CF63 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
10:25:41.0308 0x14a4  IPNAT - ok
10:25:41.0355 0x14a4  [ 42996CFF20A3084A56017B7902307E9F, 688176DAB91BE569280E4822E4C5BDE755794D293591C53F8047AD59C441751D ] IRENUM          C:\Windows\system32\drivers\irenum.sys
10:25:41.0371 0x14a4  IRENUM - ok
10:25:41.0402 0x14a4  [ 1F32BB6B38F62F7DF1A7AB7292638A35, 86522358680FBB1CEBC56B4D139290689BB0F71A3EC78CE883E4D75D0B37586F ] isapnp          C:\Windows\system32\DRIVERS\isapnp.sys
10:25:41.0417 0x14a4  isapnp - ok
10:25:41.0433 0x14a4  [ ED46C223AE46C6866AB77CDC41C404B7, 1B2A4A3FF0E5F8F02717F20983D57612D62DFF809064A7E524700E7254BB7DB3 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
10:25:41.0464 0x14a4  iScsiPrt - ok
10:25:41.0511 0x14a4  [ ADEF52CA1AEAE82B50DF86B56413107E, A3AE1E96B04AC81665ABBD3CB267DFB3F78376DAE18FB0DBD447908DDAAA22D2 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
10:25:41.0558 0x14a4  kbdclass - ok
10:25:41.0651 0x14a4  [ 3D9F0EBF350EDCFD6498057301455964, B3CB5F0C045B06C86E683F3C67DC0D4E37AF16E20B189B05C926A5A7011438FB ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
10:25:41.0683 0x14a4  kbdhid - ok
10:25:41.0698 0x14a4  [ C2243FF9E9AAD0C30E8B1A0914DA15B6, CD01BD44659FDAA6FE8679D0F76748409680A4F4885905EA56F655C60DDEC01F ] KeyIso          C:\Windows\system32\lsass.exe
10:25:41.0714 0x14a4  KeyIso - ok
10:25:41.0745 0x14a4  [ 52FC17C8589F11747D01D3CF592673D0, 0D432F14DF6A0964947FADF4AFBCC195946A68230DC17FA610CC000BB0C921A7 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
10:25:41.0761 0x14a4  KSecDD - ok
10:25:41.0807 0x14a4  [ 3E5474B03568CFAB834DA3C38E8C9EFA, 1223B99AD86905C34BC95C61DA894F36567F4A23EA7E32E955133C5B2FD558DB ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
10:25:41.0823 0x14a4  KSecPkg - ok
10:25:41.0854 0x14a4  [ 89A7B9CC98D0D80C6F31B91C0A310FCD, 4583CAEEE0D50C0C7CE955E533FDA063CDC37B69033D41EF22EF1BA242E4C747 ] KtmRm           C:\Windows\system32\msdtckrm.dll
10:25:41.0901 0x14a4  KtmRm - ok
10:25:41.0948 0x14a4  [ 8F6BF790D3168224C16F2AF68A84438C, CEEA0E38B746163A4110E157DAB50CC35A689A5BBC9B3691F2B9D3AE49B0D95E ] LanmanServer    C:\Windows\system32\srvsvc.dll
10:25:41.0995 0x14a4  LanmanServer - ok
10:25:42.0026 0x14a4  [ B9891F885DCF1F0513A51CB58493CB1F, C883D243E1E7B7AEA031FB90FE4FCEED631F835DC95F9D9D60BC554E6EC358C2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
10:25:42.0119 0x14a4  LanmanWorkstation - ok
10:25:42.0151 0x14a4  [ F7611EC07349979DA9B0AE1F18CCC7A6, 879AA7A391966F00761CA039C25EBC62F6712DD5461694911EEC673E12DE103E ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
10:25:42.0182 0x14a4  lltdio - ok
10:25:42.0229 0x14a4  [ 5700673E13A2117FA3B9020C852C01E2, 6684A2905EE8C438F2A64BE47E51A54D287B08DEFB8E0AE7FC2809D845EE3C5F ] lltdsvc         C:\Windows\System32\lltdsvc.dll
10:25:42.0275 0x14a4  lltdsvc - ok
10:25:42.0291 0x14a4  [ 55CA01BA19D0006C8F2639B6C045E08B, 4DBBDC820C514DB18CC13F8EE178F8C4E39C295C6E3C255416C235553CE7BDC1 ] lmhosts         C:\Windows\System32\lmhsvc.dll
10:25:42.0338 0x14a4  lmhosts - ok
10:25:42.0385 0x14a4  [ EB119A53CCF2ACC000AC71B065B78FEF, 1FD60735C4945AE565C223F0B47EAF9602D8777E3D15600914C1A9D761215AF9 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
10:25:42.0400 0x14a4  LSI_FC - ok
10:25:42.0416 0x14a4  [ 8ADE1C877256A22E49B75D1CC9161F9C, 3D64F233DC866537E50549A7C1A2B40A954055B22F0BDA39825B04C38C607CB7 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys
10:25:42.0447 0x14a4  LSI_SAS - ok
10:25:42.0463 0x14a4  [ DC9DC3D3DAA0E276FD2EC262E38B11E9, A264990857CBC74036799E17A087130626C0A09BE19879019BAF2D761C62AECC ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
10:25:42.0494 0x14a4  LSI_SAS2 - ok
10:25:42.0525 0x14a4  [ 0A036C7D7CAB643A7F07135AC47E0524, 2F662D07FCB74B8D493156DB555EAA90A47E93CF14C7B30039D2FE47EB8682B8 ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
10:25:42.0572 0x14a4  LSI_SCSI - ok
10:25:42.0603 0x14a4  [ 6703E366CC18D3B6E534F5CF7DF39CEE, 7396B9AF938284D99EC51206A7B2FA4A0DC10A493DCE6707818B03A7473782C4 ] luafv           C:\Windows\system32\drivers\luafv.sys
10:25:42.0650 0x14a4  luafv - ok
10:25:42.0681 0x14a4  [ E2B0887816ED336685954E3D8FDAA51D, 4DCB08ADC6A89DCA68D1285734B283B567888EF72249F6BBA73A63D1BD462466 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
10:25:42.0697 0x14a4  Mcx2Svc - ok
10:25:42.0728 0x14a4  mdxgthkn - ok
10:25:42.0743 0x14a4  [ 0FFF5B045293002AB38EB1FD1FC2FB74, 49071B565FD5B2DE43EC00D8518C3BE70843F38919E82F13104B8C1FAFB20374 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys
10:25:42.0759 0x14a4  megasas - ok
10:25:42.0790 0x14a4  [ DCBAB2920C75F390CAF1D29F675D03D6, 85C3A7A010BEA5E3C6179161B295F2CB900A6A214833A5F87A4327392880E2BB ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
10:25:42.0821 0x14a4  MegaSR - ok
10:25:42.0853 0x14a4  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] MMCSS           C:\Windows\system32\mmcss.dll
10:25:42.0884 0x14a4  MMCSS - ok
10:25:42.0899 0x14a4  [ F001861E5700EE84E2D4E52C712F4964, F4DC5AEED6F34D76CCEF360862CC47EF71097BE0813C8CE04EE5F0DB387DFFAE ] Modem           C:\Windows\system32\drivers\modem.sys
10:25:42.0931 0x14a4  Modem - ok
10:25:42.0977 0x14a4  [ 79D10964DE86B292320E9DFE02282A23, 52714827B7EEDACA55326A4E4F6158D4942DFAA3BACDE303A2F569BF3F4FAA72 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
10:25:43.0024 0x14a4  monitor - ok
10:25:43.0055 0x14a4  [ FB18CC1D4C2E716B6B903B0AC0CC0609, F10CCA63493782B16DE6B96B94A27078DBE68AECEF34FDF840CFF86D2C6E3C5E ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
10:25:43.0087 0x14a4  mouclass - ok
10:25:43.0149 0x14a4  [ 2C388D2CD01C9042596CF3C8F3C7B24D, B2FB72272BB01AEDA4047B57C943B7E9BD8A6497854F8CC34672AAA592D0A703 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
10:25:43.0196 0x14a4  mouhid - ok
10:25:43.0211 0x14a4  [ 921C18727C5920D6C0300736646931C2, 19ACE502982E9C5B0134676102EAEE96675C9CA237E410DB36C389D6B4078301 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
10:25:43.0227 0x14a4  mountmgr - ok
10:25:43.0243 0x14a4  [ 2AF5997438C55FB79D33D015C30E1974, E8F048A02FEB400C133D0BFC1659921E73B59549E3F7D2A13929901B87A1901F ] mpio            C:\Windows\system32\DRIVERS\mpio.sys
10:25:43.0274 0x14a4  mpio - ok
10:25:43.0289 0x14a4  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0, 1D6DCFA0E56C3E55B6AED819176E751502F863BA0FCF4F0B3253A81D208141A2 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
10:25:43.0367 0x14a4  mpsdrv - ok
10:25:43.0399 0x14a4  [ 5CD996CECF45CBC3E8D109C86B82D69E, ABE40DA4DA555D3D5054BE28BF82E775D90DCB9E31409DC95FABF2F016B17700 ] MpsSvc          C:\Windows\system32\mpssvc.dll
10:25:43.0461 0x14a4  MpsSvc - ok
10:25:43.0492 0x14a4  [ B1BE47008D20E43DA3ADC37C24CDB89D, 6E8555E84B42E5098227B35EA5ABADF2CD3AC247B37CB9E9304FF67064EBE59B ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
10:25:43.0523 0x14a4  MRxDAV - ok
10:25:43.0555 0x14a4  [ CA7570E42522E24324A12161DB14EC02, E4DA5EDC7CBCC9E601543071A49347A0AA3EB4EAC205E342A1F2768FD785D08F ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
10:25:43.0617 0x14a4  mrxsmb - ok
10:25:43.0648 0x14a4  [ F965C3AB2B2AE5C378F4562486E35051, 5FFDD5531B98FF0EA19A901C4EE1CE6043C245A4BE5533A495E331B5834D696B ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
10:25:43.0695 0x14a4  mrxsmb10 - ok
10:25:43.0726 0x14a4  [ 25C38264A3C72594DD21D355D70D7A5D, DCEF2DEBB1859FED6FC7A19D13A841B6B6CA10577E12F116D0EB2D2B8C72A4A1 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
10:25:43.0773 0x14a4  mrxsmb20 - ok
10:25:43.0804 0x14a4  [ 4326D168944123F38DD3B2D9C37A0B12, 322AE93418BE3BA6B3E11C86431EC3F4B23CADC3B968B92978A08A7C0D0D8902 ] msahci          C:\Windows\system32\DRIVERS\msahci.sys
10:25:43.0835 0x14a4  msahci - ok
10:25:43.0867 0x14a4  [ 455029C7174A2DBB03DBA8A0D8BDDD9A, 614D71978B024109ADD9A7A74F74ABD5FAA1C36A2E859AF288398EAE7CD76DF2 ] msdsm           C:\Windows\system32\DRIVERS\msdsm.sys
10:25:43.0882 0x14a4  msdsm - ok
10:25:43.0898 0x14a4  [ E1BCE74A3BD9902B72599C0192A07E27, 5162EB623FE64E9DFEAC6CA2410EFA1314E62EC13207FFBFED2D61AA887603C4 ] MSDTC           C:\Windows\System32\msdtc.exe
10:25:43.0913 0x14a4  MSDTC - ok
10:25:43.0960 0x14a4  [ DAEFB28E3AF5A76ABCC2C3078C07327F, 6EB558532400B489763BAE7203538DE5F196282A8CB46A1B31D59120FC5AFCEF ] Msfs            C:\Windows\system32\drivers\Msfs.sys
10:25:44.0007 0x14a4  Msfs - ok
10:25:44.0007 0x14a4  [ 3E1E5767043C5AF9367F0056295E9F84, B2EDFECD3C14E4FE1BA87D9A86334043A9BD696A554EBD186DA7EAEB2EBD4F70 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
10:25:44.0038 0x14a4  mshidkmdf - ok
10:25:44.0069 0x14a4  [ 0A4E5757AE09FA9622E3158CC1AEF114, ED574E420E57374E328C7C526504ECA569C164287966F06019EC207CB17F2C54 ] msisadrv        C:\Windows\system32\DRIVERS\msisadrv.sys
10:25:44.0069 0x14a4  msisadrv - ok
10:25:44.0101 0x14a4  [ 90F7D9E6B6F27E1A707D4A297F077828, BEFC220EAA7307849600748842ACB9254A6A91158812D9B23EFAF912C498BA7F ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
10:25:44.0147 0x14a4  MSiSCSI - ok
10:25:44.0147 0x14a4  msiserver - ok
10:25:44.0179 0x14a4  [ 8C0860D6366AAFFB6C5BB9DF9448E631, 949C5A14E57F2D7385543C17C3485E7ADE36EA2016F6E0A1866571D2EDE90A77 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
10:25:44.0210 0x14a4  MSKSSRV - ok
10:25:44.0225 0x14a4  [ 3EA8B949F963562CEDBB549EAC0C11CE, 1B0B2F16A1790282504F3C548D47C3281EFB440D5D9711A1EF76D6371B768D2D ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
10:25:44.0257 0x14a4  MSPCLOCK - ok
10:25:44.0288 0x14a4  [ F456E973590D663B1073E9C463B40932, 48BA6D5580EE7B6A4C06E04772FD35B51779553FC0DD6C5C30DD8B5DEEB25B11 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
10:25:44.0303 0x14a4  MSPQM - ok
10:25:44.0319 0x14a4  [ 0E008FC4819D238C51D7C93E7B41E560, 141FCEBDD05874407EAEC35A9DCD3BB16F2A428F23E55487D6A5DBFCADBF10D2 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
10:25:44.0335 0x14a4  MsRPC - ok
10:25:44.0381 0x14a4  [ FC6B9FF600CC585EA38B12589BD4E246, F05DB01AE1955D2468CE6B51E51998B111CA3B0BDEED090EE6B99B625CBA564A ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
10:25:44.0397 0x14a4  mssmbios - ok
10:25:44.0413 0x14a4  [ B42C6B921F61A6E55159B8BE6CD54A36, 6BB0A7BE005B8F281E551D1B8046CE4202372BC7AE0161881C858BFAC675FE1C ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
10:25:44.0475 0x14a4  MSTEE - ok
10:25:44.0491 0x14a4  [ 33599130F44E1F34631CEA241DE8AC84, E15B31D1AFDC8DC6D2B21D4215796A99ECC69EEDBB06CEED01AECC3C99A44C8B ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
10:25:44.0506 0x14a4  MTConfig - ok
10:25:44.0522 0x14a4  [ 159FAD02F64E6381758C990F753BCC80, E55AB01DCFA95ECAB24A2A9656E28FF9D064BA08B3D82DC8AA42F5991BA09598 ] Mup             C:\Windows\system32\Drivers\mup.sys
10:25:44.0537 0x14a4  Mup - ok
10:25:44.0631 0x14a4  [ 80284F1985C70C86F0B5F86DA2DFE1DF, 424A5BBC28C72DA0DBABEB9E423B8C409754CD1BA3DFC9E174BF22D8BCE1BE63 ] napagent        C:\Windows\system32\qagentRT.dll
10:25:44.0709 0x14a4  napagent - ok
10:25:44.0756 0x14a4  [ 26384429FCD85D83746F63E798AB1480, 957C115C263A4B4DC854558B43ECE632D8E2BCCB744E23A01EBA7476BA2E7FFB ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
10:25:44.0803 0x14a4  NativeWifiP - ok
10:25:44.0834 0x14a4  [ 23759D175A0A9BAAF04D05047BC135A8, 2C8C553B4E1ED3A644F619F16BCEDD5A3C6D74A17E6E75A3E740E06B1D636348 ] NDIS            C:\Windows\system32\drivers\ndis.sys
10:25:44.0865 0x14a4  NDIS - ok
10:25:44.0881 0x14a4  [ 0E1787AA6C9191D3D319E8BAFE86F80C, F535022747355B2C66424BDA892D7DCB820C2EB8EE05BAE5BC6D1B1D65186278 ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
10:25:44.0927 0x14a4  NdisCap - ok
10:25:44.0959 0x14a4  [ E4A8AEC125A2E43A9E32AFEEA7C9C888, 6EA181117126FC70B3C1DD1AC73CC26D1603A2CF49E47F66623E2C9489C49B55 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
10:25:44.0990 0x14a4  NdisTapi - ok
10:25:45.0005 0x14a4  [ B30AE7F2B6D7E343B0DF32E6C08FCE75, 39BBBF7AF886732CB9ED3E6C06DA4318554089F3BEA74C74328FE1C6EF68E70B ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
10:25:45.0037 0x14a4  Ndisuio - ok
10:25:45.0068 0x14a4  [ 267C415EADCBE53C9CA873DEE39CF3A4, BAA8626BDA7B68176B19A99FBBD40FB2A774C8F44B56F9FFB99A1F5C16A1C555 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
10:25:45.0115 0x14a4  NdisWan - ok
10:25:45.0130 0x14a4  [ AF7E7C63DCEF3F8772726F86039D6EB4, 1CFDED48E8844138864786DBF9D5519162A6DB28F885A781934E8AFBD52EAC50 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
10:25:45.0161 0x14a4  NDProxy - ok
10:25:45.0208 0x14a4  [ A081CB6FB9A12668F233EB5414BE3A0E, EE2A1311B51D1FEBAF79F45E568A927D8EA7704AFC8495AED2D26927566F61E3 ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
10:25:45.0239 0x14a4  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
10:25:47.0735 0x14a4  Detect skipped due to KSN trusted
10:25:47.0735 0x14a4  Net Driver HPZ12 - ok
10:25:47.0751 0x14a4  [ 80B275B1CE3B0E79909DB7B39AF74D51, 75B406B0D9D28239D4EB2A298419A5F78A58237D88C5FD688EF1DFFAFACCF796 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
10:25:47.0798 0x14a4  NetBIOS - ok
10:25:47.0829 0x14a4  [ DD52A733BF4CA5AF84562A5E2F963B91, 5CEB9664CED3D120F5408A12035748728710D41090A289CF66023CED4C838A1F ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
10:25:47.0876 0x14a4  NetBT - ok
10:25:47.0876 0x14a4  [ C2243FF9E9AAD0C30E8B1A0914DA15B6, CD01BD44659FDAA6FE8679D0F76748409680A4F4885905EA56F655C60DDEC01F ] Netlogon        C:\Windows\system32\lsass.exe
10:25:47.0891 0x14a4  Netlogon - ok
10:25:47.0907 0x14a4  [ 7CCCFCA7510684768DA22092D1FA4DB2, BB9E4F8FABBF596D888E6D303CB54A336D9DFF95B36AEA9369D2ED787DDC4B5D ] Netman          C:\Windows\System32\netman.dll
10:25:47.0954 0x14a4  Netman - ok
10:25:48.0001 0x14a4  [ D22CD77D4F0D63D1169BB35911BFF12D, 85B1FDFA02E1B8EA4FCB9B7EEB687C5C448697FC7EC9D178C5A2F64D2C9CFEE8 ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
10:25:48.0063 0x14a4  NetMsmqActivator - ok
10:25:48.0079 0x14a4  [ D22CD77D4F0D63D1169BB35911BFF12D, 85B1FDFA02E1B8EA4FCB9B7EEB687C5C448697FC7EC9D178C5A2F64D2C9CFEE8 ] NetPipeActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
10:25:48.0094 0x14a4  NetPipeActivator - ok
10:25:48.0125 0x14a4  [ 8C338238C16777A802D6A9211EB2BA50, 0D08A47CD403EDA5E8CAD7409BBBBCDC29A9861D2DC41D42B68B22B1AA1EBDD6 ] netprofm        C:\Windows\System32\netprofm.dll
10:25:48.0188 0x14a4  netprofm - ok
10:25:48.0203 0x14a4  [ D22CD77D4F0D63D1169BB35911BFF12D, 85B1FDFA02E1B8EA4FCB9B7EEB687C5C448697FC7EC9D178C5A2F64D2C9CFEE8 ] NetTcpActivator C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
10:25:48.0203 0x14a4  NetTcpActivator - ok
10:25:48.0219 0x14a4  [ D22CD77D4F0D63D1169BB35911BFF12D, 85B1FDFA02E1B8EA4FCB9B7EEB687C5C448697FC7EC9D178C5A2F64D2C9CFEE8 ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v4.0.30319\SMSvcHost.exe
10:25:48.0235 0x14a4  NetTcpPortSharing - ok
10:25:48.0266 0x14a4  [ 1D85C4B390B0EE09C7A46B91EFB2C097, 6A8850B151E88EE371F3CC543A946302DDF9494908D684B8B0C706A42CC54348 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys
10:25:48.0281 0x14a4  nfrd960 - ok
10:25:48.0297 0x14a4  [ 2226496E34BD40734946A054B1CD657F, 98392D98C9213822268971432BB55047ABD8B4EBD42483FA69BF50FB8FAD64A2 ] NlaSvc          C:\Windows\System32\nlasvc.dll
10:25:48.0344 0x14a4  NlaSvc - ok
10:25:48.0359 0x14a4  [ 1DB262A9F8C087E8153D89BEF3D2235F, A51EE5D5AD3CD76B74BEA9C66C462608BF3B50C53DAA4110A75DB10495A8C101 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
10:25:48.0391 0x14a4  Npfs - ok
10:25:48.0406 0x14a4  [ BA387E955E890C8A88306D9B8D06BF17, 3477BD9686C5777A93251C154512671AAA7533B18C536DF51F7B1D6D28E7F8A5 ] nsi             C:\Windows\system32\nsisvc.dll
10:25:48.0422 0x14a4  nsi - ok
10:25:48.0437 0x14a4  [ E9A0A4D07E53D8FEA2BB8387A3293C58, 690CAD6C4E35ECC1172A2E1FD3933DF73158B3BF42CB21244269612A53DE4D7A ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
10:25:48.0469 0x14a4  nsiproxy - ok
10:25:48.0656 0x14a4  [ A8F59428E9F361C7AC42A94AC1560BC9, 5B056375C8D21E7AE9E2EAC2EF62F5A2D6D0DBB52DD2FC34F9CC35F55C6766A6 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
10:25:48.0749 0x14a4  Ntfs - ok
10:25:48.0796 0x14a4  [ F9756A98D69098DCA8945D62858A812C, 572ADBFCFDE2030B34A013AADC14DBC144EB3F34D06991E2464A3EA9605BC045 ] Null            C:\Windows\system32\drivers\Null.sys
10:25:48.0843 0x14a4  Null - ok
10:25:49.0389 0x14a4  [ B0881DDA5A8160422561FFAB7F0008B1, 0D89792394CF44119CCBE9B1E8C0F5563ED41141C17C6B2D32B1D1C458BAC359 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
10:25:49.0873 0x14a4  nvlddmkm - ok
10:25:49.0919 0x14a4  [ F1B0BED906F97E16F6D0C3629D2F21C6, 563DE1AF0BE884264FD0D17AAA92EA32A2EACDF1E6C56D038773919D731E110C ] nvraid          C:\Windows\system32\drivers\nvraid.sys
10:25:49.0935 0x14a4  nvraid - ok
10:25:49.0966 0x14a4  [ 4520B63899E867F354EE012D34E11536, BDFF1033609834F44B0EDBE8B360FD7977D027034C469862385736AEFE8832B7 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
10:25:50.0013 0x14a4  nvstor - ok
10:25:50.0060 0x14a4  [ 5A0983915F02BAE73267CC2A041F717D, D83461D74597BF2BE042FEFCC27FCD18BF63CB8135B0666D731D50951C3468A8 ] nv_agp          C:\Windows\system32\DRIVERS\nv_agp.sys
10:25:50.0075 0x14a4  nv_agp - ok
10:25:50.0091 0x14a4  [ 08A70A1F2CDDE9BB49B885CB817A66EB, 0BB98123B544124B144F3E95D77E01E973D060B8B2302503FF24ABBBE803EB63 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
10:25:50.0122 0x14a4  ohci1394 - ok
10:25:50.0153 0x14a4  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
10:25:50.0185 0x14a4  p2pimsvc - ok
10:25:50.0231 0x14a4  [ 59C3DDD501E39E006DAC31BF55150D91, E02B63AB7F34CF6FF3F644AF354D10004E6F50014E03172D80BD78934EF71EF1 ] p2psvc          C:\Windows\system32\p2psvc.dll
10:25:50.0309 0x14a4  p2psvc - ok
10:25:50.0325 0x14a4  [ 2EA877ED5DD9713C5AC74E8EA7348D14, 14BA3722CE5F8FF07F2D97DCDD6558EB49C9B02E5E6FAD6D9F18D354733EFECE ] Parport         C:\Windows\system32\DRIVERS\parport.sys
10:25:50.0372 0x14a4  Parport - ok
10:25:50.0403 0x14a4  [ 66D3415C159741ADE7038A277EFFF99F, D9853845FE495A546328986718074373EAB0F59538CFE7E604B1A94C8CBE7140 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
10:25:50.0419 0x14a4  partmgr - ok
10:25:50.0450 0x14a4  [ EB0A59F29C19B86479D36B35983DAADC, AC09AFE7F13BE4079D01383BAC44091997E1AAF6512C9673A42B9E3780EB08A8 ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
10:25:50.0512 0x14a4  Parvdm - ok
10:25:50.0559 0x14a4  [ 358AB7956D3160000726574083DFC8A6, 6CAFD4D1B8AB8C1D167ADC018985DDAB5AC2CBFFB3434FE6390F14AF50C19025 ] PcaSvc          C:\Windows\System32\pcasvc.dll
10:25:50.0590 0x14a4  PcaSvc - ok
10:25:50.0637 0x14a4  [ C858CB77C577780ECC456A892E7E7D0F, 21AE545B736739DE5A7B02CF227516BA6D02B1AAAECD8CC516CCF9F1FD710BCF ] pci             C:\Windows\system32\DRIVERS\pci.sys
10:25:50.0668 0x14a4  pci - ok
10:25:50.0684 0x14a4  [ AFE86F419014DB4E5593F69FFE26CE0A, CAF36E61BE7B511D3A03A65FF5A3017CEE4D2F53005B410F2D4A2AAE9FED4C00 ] pciide          C:\Windows\system32\DRIVERS\pciide.sys
10:25:50.0715 0x14a4  pciide - ok
10:25:50.0746 0x14a4  [ F396431B31693E71E8A80687EF523506, BC614FC21E029E2497F1CCE3131BBD295B827F2310762B47D5BBC7703D80554B ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
10:25:50.0777 0x14a4  pcmcia - ok
10:25:50.0809 0x14a4  [ 250F6B43D2B613172035C6747AEEB19F, A91F15B133F2619912CF750E6F3662E011CD0FA4B9477CE532CE3196D23307D9 ] pcw             C:\Windows\system32\drivers\pcw.sys
10:25:50.0824 0x14a4  pcw - ok
10:25:50.0855 0x14a4  [ 9E0104BA49F4E6973749A02BF41344ED, B32F39F38DB48D77FBA884DEE34112BAB81CCEF5DD2EAAA12D9589D73D2BB116 ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
10:25:50.0902 0x14a4  PEAUTH - ok
10:25:51.0043 0x14a4  [ 9C1BFF7910C89A1D12E57343475840CB, 62E00E1278BD263B2AC8CB803C31F2818C54DB143C49470FAD07731E04BD2DE3 ] pla             C:\Windows\system32\pla.dll
10:25:51.0199 0x14a4  pla - ok
10:25:51.0261 0x14a4  [ 71DEF5EC79774C798342D0EA16E41780, 5B5A365E57A7ACE3C4EDA1D891BD613879B284831E8253FDE498E40B2091E3B6 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
10:25:51.0323 0x14a4  PlugPlay - ok
10:25:51.0386 0x14a4  [ 65BC271F337637731D3C71455AE1F476, DAD32B61FE0147F8D2DA4C8F016920CD6BB2098F16E3CC2768009763E71DEFBC ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
10:25:51.0433 0x14a4  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic ( 1 )
10:25:53.0866 0x14a4  Detect skipped due to KSN trusted
10:25:53.0866 0x14a4  Pml Driver HPZ12 - ok
10:25:53.0897 0x14a4  [ 63FF8572611249931EB16BB8EED6AFC8, 9732CCBCB93A7A4BEC88812B952C20244479E9BD781240C195E57F09E619EA33 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
10:25:53.0944 0x14a4  PNRPAutoReg - ok
10:25:53.0975 0x14a4  [ 82A8521DDC60710C3D3D3E7325209BEC, C4E34571EDD57C7FBB3D736B5FE8BD154624705B5C8EA2EC898F19F75B9A5942 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
10:25:54.0007 0x14a4  PNRPsvc - ok
10:25:54.0022 0x14a4  [ 48E1B75C6DC0232FD92BAAE4BD344721, 5BA4EB5A60725836D8085EABF87F51160BA57E318A0C4378410217911A393CE7 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
10:25:54.0069 0x14a4  PolicyAgent - ok
10:25:54.0116 0x14a4  [ DBFF83F709A91049621C1D35DD45C92C, 0A722A44F431CAB5EA77FF5F25EB6975C2111B605564FF9FB59751067E7CD3A7 ] Power           C:\Windows\system32\umpo.dll
10:25:54.0147 0x14a4  Power - ok
10:25:54.0178 0x14a4  [ 631E3E205AD6D86F2AED6A4A8E69F2DB, 1D3BF0CFC37D91A3A56246920B9CF1084E78A055D56E85A773417809C58C8065 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
10:25:54.0209 0x14a4  PptpMiniport - ok
10:25:54.0209 0x14a4  [ 85B1E3A0C7585BC4AAE6899EC6FCF011, 1E067113C146D6842D7FB04007F363D6FB7783C6BC7C9AB6614E44075C4F86C3 ] Processor       C:\Windows\system32\DRIVERS\processr.sys
10:25:54.0256 0x14a4  Processor - ok
10:25:54.0303 0x14a4  [ AEA3BDBDBA667AA6F678CB38907E4F5E, AB698DCA117F8D5F22F9CD8D7884147BAB4E0C055B8A487BC035C18ED1634752 ] ProfSvc         C:\Windows\system32\profsvc.dll
10:25:54.0350 0x14a4  ProfSvc - ok
10:25:54.0365 0x14a4  [ C2243FF9E9AAD0C30E8B1A0914DA15B6, CD01BD44659FDAA6FE8679D0F76748409680A4F4885905EA56F655C60DDEC01F ] ProtectedStorage C:\Windows\system32\lsass.exe
10:25:54.0381 0x14a4  ProtectedStorage - ok
10:25:54.0397 0x14a4  [ 6270CCAE2A86DE6D146529FE55B3246A, 463209CBAF1B0E269DC8FC6FBDEE5BB7E5ADB5D3F024930BFD0B97E0A9678883 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
10:25:54.0443 0x14a4  Psched - ok
10:25:54.0475 0x14a4  [ A6A7AD767BF5141665F5C675F671B3E1, 11D43F732C3B82679E53516F83E675B60B0EFEDE3F4EE3C42AC752AD8D5155AF ] PSI_SVC_2       c:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
10:25:54.0521 0x14a4  PSI_SVC_2 - ok
10:25:54.0646 0x14a4  [ AB95ECF1F6659A60DDC166D8315B0751, 0ED6D3460D28978BADF31B930DBB3298A6A10EFF8883763EABA0E36A21A0E83D ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
10:25:54.0724 0x14a4  ql2300 - ok
10:25:54.0755 0x14a4  [ B4DD51DD25182244B86737DC51AF2270, 7E62B04F054A6330B7F9968222523BDE8F3EE47A11D17E6C0E2D5ACDC07B9E6B ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
10:25:54.0787 0x14a4  ql40xx - ok
10:25:54.0818 0x14a4  [ 31AC809E7707EB580B2BDB760390765A, A8481FD19A0F778F5591B7676F591F664ADC68B6867E663C0F9564173F4AC909 ] QWAVE           C:\Windows\system32\qwave.dll
10:25:54.0849 0x14a4  QWAVE - ok
10:25:54.0880 0x14a4  [ 584078CA1B95CA72DF2A27C336F9719D, 836F115C92D343463C14A9DE39648C1EFA7C7EE4720F5C692EE0F68B84830121 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
10:25:54.0943 0x14a4  QWAVEdrv - ok
10:25:54.0943 0x14a4  [ 30A81B53C766D0133BB86D234E5556AB, 726C6B83B5ACAA84CAB1689B6DD6DDAE3199D61A57B5D7B5B5A0F62FCF838090 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
10:25:54.0989 0x14a4  RasAcd - ok
10:25:55.0021 0x14a4  [ 57EC4AEF73660166074D8F7F31C0D4FD, C66B425EC4DB5E7FD289AE631C9B019EB16717C55E80FAE964BB22203E4AACEF ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
10:25:55.0083 0x14a4  RasAgileVpn - ok
10:25:55.0114 0x14a4  [ A60F1839849C0C00739787FD5EC03F13, B210DFA5A843CF1DA73635F168E2EA5052CBED15C664F8523CDFB34CA165D0E0 ] RasAuto         C:\Windows\System32\rasauto.dll
10:25:55.0145 0x14a4  RasAuto - ok
10:25:55.0192 0x14a4  [ D9F91EAFEC2815365CBE6D167E4E332A, 8350457A39D141C13807E7DB5A8D4113197C4016F7744B9993391F4AEA0C4A5C ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
10:25:55.0223 0x14a4  Rasl2tp - ok
10:25:55.0255 0x14a4  [ 0CE66EC736B7FC526D78F7624C7D2A94, D70B45AA413691CF84B24E966EBA1689955E54BDDA206380CAB7CD50F56D5CEB ] RasMan          C:\Windows\System32\rasmans.dll
10:25:55.0301 0x14a4  RasMan - ok
10:25:55.0333 0x14a4  [ 0FE8B15916307A6AC12BFB6A63E45507, 64119474DE7499E6E8B82E78BBD50074B3AA70B3E8329089FAE9B7F29919004E ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
10:25:55.0379 0x14a4  RasPppoe - ok
10:25:55.0379 0x14a4  [ 44101F495A83EA6401D886E7FD70096B, 56A0CE5C89870752B9B2AB795C1A248CA28209E049B2F20CCA0308CBE2488A0A ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
10:25:55.0426 0x14a4  RasSstp - ok
10:25:55.0442 0x14a4  [ 835D7E81BF517A3B72384BDCC85E1CE6, DC855AF17150C1B27926293115C01B5E1FD00FABCE18AFAEAB3DC68BDE4C908B ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
10:25:55.0489 0x14a4  rdbss - ok
10:25:55.0520 0x14a4  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF, 2AFCBE3237D27AFBF095F91F1FCCA63E6890F34A9E4F00E5C34C92394CDA89FB ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
10:25:55.0613 0x14a4  rdpbus - ok
10:25:55.0645 0x14a4  [ 1E016846895B15A99F9A176A05029075, 78AE674B6E7D3A69099B24AC07E06563A4C867F9DCD8548E4DAAE6FC5ACA4E29 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
10:25:55.0691 0x14a4  RDPCDD - ok
10:25:55.0723 0x14a4  [ 5A53CA1598DD4156D44196D200C94B8A, 8112FE14FEC94C67B1C5BDE4171E37584F1D0098D2C557C9E4BDD3E0291E25E4 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
10:25:55.0785 0x14a4  RDPENCDD - ok
10:25:55.0785 0x14a4  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F, CDA80B08E67AD034081C0C920CD66147689F1844403CBC552F65005E7C011A91 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
10:25:55.0832 0x14a4  RDPREFMP - ok
10:25:55.0863 0x14a4  [ C5B8D47A4688DE9D335204EA757C2240, 2F646466120911B0CA0E331B4959A470E18DFD51C8FAAB69BE0461C31D52DBBE ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
10:25:55.0910 0x14a4  RDPWD - ok
10:25:55.0941 0x14a4  [ 4EA225BF1CF05E158853F30A99CA29A7, F211480F13E2FE36C31110AE67ABE74E9D572D3A36BEEDE29E14ECBD8C246878 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
10:25:56.0003 0x14a4  rdyboost - ok
10:25:56.0019 0x14a4  [ 7B5E1419717FAC363A31CC302895217A, 048B96B127CC20833948DAE53C59886D5C725ECA7A744424A01339447D2DDC32 ] RemoteAccess    C:\Windows\System32\mprdim.dll
10:25:56.0097 0x14a4  RemoteAccess - ok
10:25:56.0113 0x14a4  [ CB9A8683F4EF2BF99E123D79950D7935, B9FA3E7E91E76D975CF40BFA37909E50F29CC13AB1399007884710651827E9AA ] RemoteRegistry  C:\Windows\system32\regsvc.dll
10:25:56.0159 0x14a4  RemoteRegistry - ok
10:25:56.0175 0x14a4  [ 78D072F35BC45D9E4E1B61895C152234, 80C924EE1156B4E3172E83DCB9C60817E87885FB9377647E0BF90153E415B1CA ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
10:25:56.0206 0x14a4  RpcEptMapper - ok
10:25:56.0222 0x14a4  [ 94D36C0E44677DD26981D2BFEEF2A29D, D77A93AC60536F3706E8A0154C0C2199E888B7748C84DB7437254FF175F4DF55 ] RpcLocator      C:\Windows\system32\locator.exe
10:25:56.0253 0x14a4  RpcLocator - ok
10:25:56.0284 0x14a4  [ 7660F01D3B38ACA1747E397D21D790AF, 04611B43705C064C2A8331F6D3F8E4530295694AE2C3E3EC3F62CFF4A5EFA88D ] RpcSs           C:\Windows\system32\rpcss.dll
10:25:56.0315 0x14a4  RpcSs - ok
10:25:56.0347 0x14a4  [ 032B0D36AD92B582D869879F5AF5B928, 0F8F18A6A0A689957B886D9368015889091094EDA18BE532093F06A70A7CE184 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
10:25:56.0409 0x14a4  rspndr - ok
10:25:56.0471 0x14a4  [ 5283B9A27FF230F2FF70D92451FF409A, B8BAC70E1DE4485C79CA7B47D4DCFE0223CECEA8ED75CE4F128D47051F95FE5D ] RTL8167         C:\Windows\system32\DRIVERS\Rt86win7.sys
10:25:56.0518 0x14a4  RTL8167 - ok
10:25:56.0596 0x14a4  [ 9CE8DEFFAFFCCBF473015D76AE8EE514, D2EC909865653C4CF56C379D60E10A607E28D69B00BF0EFE6181580C00EF5124 ] RTL8192su       C:\Windows\system32\DRIVERS\RTL8192su.sys
10:25:56.0643 0x14a4  RTL8192su - ok
10:25:56.0659 0x14a4  [ C2243FF9E9AAD0C30E8B1A0914DA15B6, CD01BD44659FDAA6FE8679D0F76748409680A4F4885905EA56F655C60DDEC01F ] SamSs           C:\Windows\system32\lsass.exe
10:25:56.0674 0x14a4  SamSs - ok
10:25:56.0690 0x14a4  [ 34EE0C44B724E3E4CE2EFF29126DE5B5, D27AAF77CB8830893558A600E19CDBF9A6AA7D69DE4B34F317ED4AFD38E8CAFB ] sbp2port        C:\Windows\system32\DRIVERS\sbp2port.sys
10:25:56.0705 0x14a4  sbp2port - ok
10:25:56.0752 0x14a4  [ 8FC518FFE9519C2631D37515A68009C4, 21E10585470CF9FC3BD1977F8A426686CD2FA6BD2094B9E3594B21C7C4541D25 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
10:25:56.0783 0x14a4  SCardSvr - ok
10:25:56.0815 0x14a4  [ A95C54B2AC3CC9C73FCDF9E51A1D6B51, 8C0189A6AF9AEC46CBA4DA422C52B2D3E4858B2F2658DB6CA7996B5F368D2503 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
10:25:56.0877 0x14a4  scfilter - ok
10:25:56.0939 0x14a4  [ DF1E5C82E4D09CF8105CC644980C4803, 36BB8402B29466CF1AE5BD56ED6CF6FE47DE162ADF04D44E2BCEA168CB0BD4D4 ] Schedule        C:\Windows\system32\schedsvc.dll
10:25:57.0002 0x14a4  Schedule - ok
10:25:57.0017 0x14a4  [ 628A9E30EC5E18DD5DE6BE4DBDC12198, DDA43DCCB195440D6BD5752BD00D984F45BD6D23DBE2A656C33E3CD1E5D17AD7 ] SCPolicySvc     C:\Windows\System32\certprop.dll
10:25:57.0033 0x14a4  SCPolicySvc - ok
10:25:57.0064 0x14a4  [ 5FD90ABDBFAEE85986802622CBB03446, 0A8D9DC09C2ACA9EAABED04737E9EBF6EFB92BB2B9E5F37F10BFDF47CBF7DEDB ] SDRSVC          C:\Windows\System32\SDRSVC.dll
10:25:57.0095 0x14a4  SDRSVC - ok
10:25:57.0127 0x14a4  [ 90A3935D05B494A5A39D37E71F09A677, F72733A69BC6E1A2BB91D7632FF3463C12563F60FDCC00A2CDD67FF20D479952 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
10:25:57.0158 0x14a4  secdrv - ok
10:25:57.0189 0x14a4  [ A59B3A4442C52060CC7A85293AA3546F, 1776D6DEE51991149265AAF39E17065E301C5FA1FF4068653DC0010B9B27185D ] seclogon        C:\Windows\system32\seclogon.dll
10:25:57.0251 0x14a4  seclogon - ok
10:25:57.0267 0x14a4  [ DCB7FCDCC97F87360F75D77425B81737, F8289AF2C458C167038EEFE613EE5E3D6D5B3308B8784168374BC81C47891CE5 ] SENS            C:\Windows\System32\sens.dll
10:25:57.0298 0x14a4  SENS - ok
10:25:57.0329 0x14a4  [ 50087FE1EE447009C9CC2997B90DE53F, B5E6CF1D991F87C29C5E28198E0962E31FFB499A46C3BD43FC20391693389959 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
10:25:57.0361 0x14a4  SensrSvc - ok
10:25:57.0392 0x14a4  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1, E2F019BCD1446236D078D46065DD151DD068778F33BE2F1E8A0CC1EA2F954E86 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
10:25:57.0423 0x14a4  Serenum - ok
10:25:57.0439 0x14a4  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2, A26DB2EB9F3E2509B4EBA949DB97595CC32332D9321DF68283BFC102E66D766F ] Serial          C:\Windows\system32\DRIVERS\serial.sys
10:25:57.0470 0x14a4  Serial - ok
10:25:57.0501 0x14a4  [ 79BFFB520327FF916A582DFEA17AA813, 7A2A9D69BE02228591186A9F4453D4B5FD98837CA422C873C48040170E8BD18C ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
10:25:57.0532 0x14a4  sermouse - ok
10:25:57.0610 0x14a4  [ 8F55CE568C543D5ADF45C409D16718FC, 64D45854A91B656C1AF36EB272FDC54E9B5FB0200CB93E20F7D997DDA109EF7F ] SessionEnv      C:\Windows\system32\sessenv.dll
10:25:57.0641 0x14a4  SessionEnv - ok
10:25:57.0673 0x14a4  [ 9F976E1EB233DF46FCE808D9DEA3EB9C, 6A5C53F27F8BCA85CE206EE7D196176F67EC6FFA5D4830373A20792C149B5E75 ] sffdisk         C:\Windows\system32\DRIVERS\sffdisk.sys
10:25:57.0766 0x14a4  sffdisk - ok
10:25:57.0797 0x14a4  [ 932A68EE27833CFD57C1639D375F2731, 11D6B98FBEEE2B9C7B06EF7091857BBD3B349077997D6261D66280668FD1B5C3 ] sffp_mmc        C:\Windows\system32\DRIVERS\sffp_mmc.sys
10:25:57.0829 0x14a4  sffp_mmc - ok
10:25:57.0860 0x14a4  [ A0708BBD07D245C06FF9DE549CA47185, 6A95ACD63A3E7CE6065D0A8B5C182C5B3F4540B8345AB5DCCBD3AC77E9D6CEAC ] sffp_sd         C:\Windows\system32\DRIVERS\sffp_sd.sys
10:25:57.0922 0x14a4  sffp_sd - ok
10:25:57.0938 0x14a4  [ DB96666CC8312EBC45032F30B007A547, C3AE60FC65A36E96E0D2CC6E184481D70F91A19DC3E2E17E2873DD670A592DD7 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys
10:25:57.0969 0x14a4  sfloppy - ok
10:25:58.0000 0x14a4  [ D1A079A0DE2EA524513B6930C24527A2, E2BC16DBCF38841EECD49C6FA1A9AC89C17F332F12606CA826F058E995E1B83D ] SharedAccess    C:\Windows\System32\ipnathlp.dll
10:25:58.0047 0x14a4  SharedAccess - ok
10:25:58.0094 0x14a4  [ CD2E48FA5B29EE2B3B5858056D246EF2, B743F92D0121CF3D827753C85F1F5A14C2DAA1CAFD42C7810C3BECB853DB6175 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
10:25:58.0141 0x14a4  ShellHWDetection - ok
10:25:58.0156 0x14a4  [ 2565CAC0DC9FE0371BDCE60832582B2E, 1A775214E86B83C2F1799F12D71077D81C89AD32734A248BA88787B7F104B79D ] sisagp          C:\Windows\system32\DRIVERS\sisagp.sys
10:25:58.0172 0x14a4  sisagp - ok
10:25:58.0203 0x14a4  [ A9F0486851BECB6DDA1D89D381E71055, 7E909538AB758C18AC2CCBFFEE17BA36FA6ED2E674AA70924AA87AC61375FF35 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
10:25:58.0219 0x14a4  SiSRaid2 - ok
10:25:58.0265 0x14a4  [ 3727097B55738E2F554972C3BE5BC1AA, 75D52A596A298C33EC79A3B0B80F25492C08A182ABC679401502DA9597687566 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
10:25:58.0312 0x14a4  SiSRaid4 - ok
10:25:58.0343 0x14a4  [ 3E21C083B8A01CB70BA1F09303010FCE, 803F8F91299C387110F34A49340E7136AAE91B418E2977A36285EA8F432FF197 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
10:25:58.0390 0x14a4  Smb - ok
10:25:58.0421 0x14a4  [ 6A984831644ECA1A33FFEAE4126F4F37, 753E23D2B33D47C52C05D892B052CFD96D93B97FB6E9FCB58EF1E4C4A125BF78 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
10:25:58.0453 0x14a4  SNMPTRAP - ok
10:25:58.0484 0x14a4  [ 95CF1AE7527FB70F7816563CBC09D942, CE8BACB91A5A86CBCE82619C6C1873B4D7593B00CED3B522E41B8F7F6258CC65 ] spldr           C:\Windows\system32\drivers\spldr.sys
10:25:58.0499 0x14a4  spldr - ok
10:25:58.0577 0x14a4  [ E17323B0AA9FB3FF9945731D736EDA2F, 65837FC6329A4B2B042B0CDB04F139CA14C2BD1EE0CDB2C7705431E9D97D0597 ] Spooler         C:\Windows\System32\spoolsv.exe
10:25:58.0640 0x14a4  Spooler - ok
10:25:58.0827 0x14a4  [ 4C287F9069FEDBD791178876EE9DE536, 6099E76FF6FBA002EBA2BA7BE4E3238D91332E077524D1DD402E0C9ADA22E852 ] sppsvc          C:\Windows\system32\sppsvc.exe
10:25:58.0905 0x14a4  sppsvc - ok
10:25:58.0967 0x14a4  [ D8E3E19EEBDAB49DD4A8D3062EAD4EC7, E7A8A5774C62DC12B56DC3E0A385ACA9069F3A5E6AC664AD0C383EF44DCF81B3 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
10:25:59.0030 0x14a4  sppuinotify - ok
10:25:59.0077 0x14a4  [ C4A027B8C0BD3FC0699F41FA5E9E0C87, A709BD7DDF0ACA5CF65B5A541FC6013FF86181138B86D1BF631E4BF5F4F2E266 ] srv             C:\Windows\system32\DRIVERS\srv.sys
10:25:59.0139 0x14a4  srv - ok
10:25:59.0170 0x14a4  [ 414BB592CAD8A79649D01F9D94318FB3, 093F52568B48E94B6C53F2E7F229416B8643DD9CEBB3E41601C64E932E3098F3 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
10:25:59.0233 0x14a4  srv2 - ok
10:25:59.0248 0x14a4  [ FF207D67700AA18242AAF985D3E7D8F4, CFB36B6AA3D6915D23654FB11E848EC47DA8346F47151BE66967E51101FD4222 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
10:25:59.0264 0x14a4  srvnet - ok
10:25:59.0295 0x14a4  [ D887C9FD02AC9FA880F6E5027A43E118, F38BAD90EC791368C37C21090302708D2DFB83ECE9096609AD9AA667B2E5592E ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
10:25:59.0326 0x14a4  SSDPSRV - ok
10:25:59.0357 0x14a4  [ A36EE93698802CD899F98BFD553D8185, 224CFED921EA230FF8025D259E34968FD2C0FD34BB3A918FB4B9B8BA42BEA5D3 ] ssmdrv          C:\Windows\system32\DRIVERS\ssmdrv.sys
10:25:59.0389 0x14a4  ssmdrv - ok
10:25:59.0404 0x14a4  [ D318F23BE45D5E3A107469EB64815B50, D74355E6FF215AA8CE53BC9DF16AF2740F2FC2FD754939478A3608BDA8C6DDA0 ] SstpSvc         C:\Windows\system32\sstpsvc.dll
10:25:59.0467 0x14a4  SstpSvc - ok
10:25:59.0529 0x14a4  [ EBAA82F7C9B97C0E450449178E007340, D470927CC216C4E3EA23236E6C6464187CD3A49C3A4A456F488FEC8E713EA31B ] Steam Client Service C:\Program Files\Common Files\Steam\SteamService.exe
10:25:59.0591 0x14a4  Steam Client Service - ok
10:25:59.0623 0x14a4  [ DB32D325C192B801DF274BFD12A7E72B, F089DBA719E22BC269720A6B840B873A4AF5639745DB0C3DBC8BD2F2839A1ABA ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
10:25:59.0623 0x14a4  stexstor - ok
10:25:59.0669 0x14a4  [ A22825E7BB7018E8AF3E229A5AF17221, 5C97557F8BC6ABBB5BE624AE41AAC22C3D845F76C3E930337A4C07B2381086D7 ] StiSvc          C:\Windows\System32\wiaservc.dll
10:25:59.0716 0x14a4  StiSvc - ok
10:25:59.0732 0x14a4  [ E58C78A848ADD9610A4DB6D214AF5224, 1575A90EB22A4FB066459BDA00C6CAC10198C3C8C74493721EC6D34B51F50426 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
10:25:59.0747 0x14a4  swenum - ok
10:25:59.0779 0x14a4  [ A28BD92DF340E57B024BA433165D34D7, 889CC7FF143C3549982128473FF927CD80CF36485A347EF399C1271C8CE12CE4 ] swprv           C:\Windows\System32\swprv.dll
10:25:59.0825 0x14a4  swprv - ok
10:25:59.0872 0x14a4  [ 04105C8DA62353589C29BDAEB8D88BD8, CC7A3A779A143E09FE5C0AA6795A7B13496C4E121347949CB23F7946EE5E2DED ] SysMain         C:\Windows\system32\sysmain.dll
10:25:59.0919 0x14a4  SysMain - ok
10:25:59.0950 0x14a4  [ FCFB6C552FBC0DA299799CBD50AD9FD4, A2A90829087B1A7F9B57D6F184EB4AE38D10B2986B0DC8D2ACA5EE9412CA3976 ] TabletInputService C:\Windows\System32\TabSvc.dll
10:26:00.0028 0x14a4  TabletInputService - ok
10:26:00.0075 0x14a4  [ 2F46B0C70A4ADC8C90CF825DA3B4FEAF, FF66CBA014F3F8B721088F5AB3D004C1711E7F587CC8D4AC3DCFB45CDB746800 ] TapiSrv         C:\Windows\System32\tapisrv.dll
10:26:00.0122 0x14a4  TapiSrv - ok
10:26:00.0137 0x14a4  [ B799D9FDB26111737F58288D8DC172D9, 409A60819A4305699E2E492A6190637FAAEBD19E745A5DB2A5D6977106C86591 ] TBS             C:\Windows\System32\tbssvc.dll
10:26:00.0169 0x14a4  TBS - ok
10:26:00.0262 0x14a4  [ BBCEAEFF1FD72A026F827CBB2F4AA8AD, D06B2B340BFF9AB71E2EC1B808079A43A09358495CB583840D79454D4BB1654E ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
10:26:00.0403 0x14a4  Tcpip - ok
10:26:00.0465 0x14a4  [ BBCEAEFF1FD72A026F827CBB2F4AA8AD, D06B2B340BFF9AB71E2EC1B808079A43A09358495CB583840D79454D4BB1654E ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
10:26:00.0496 0x14a4  TCPIP6 - ok
10:26:00.0527 0x14a4  [ E64444523ADD154F86567C469BC0B17F, FBE8A1DC28C102068183754F6BF0D03F5D18FD24BEB7E4B57D1CFCEBB13B381F ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
10:26:00.0590 0x14a4  tcpipreg - ok
10:26:00.0605 0x14a4  [ 1875C1490D99E70E449E3AFAE9FCBADF, FFDF03826DAB748D51B53B648B632E79B3CD6238F684FDEA749B4D0F93BE5A77 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
10:26:00.0668 0x14a4  TDPIPE - ok
10:26:00.0699 0x14a4  [ 7156308896D34EA75A582F9A09E50C17, B5663B4035EE4D7957D2EDB4F9D3342806CB0E094D9661C6BD6AFC031160F176 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
10:26:00.0730 0x14a4  TDTCP - ok
10:26:00.0746 0x14a4  [ CB39E896A2A83702D1737BFD402B3542, FA77D98EA3606CA2FCEF0E0949FDE2C32A080B47CAFDE46CE903CA3CBFC5DF35 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
10:26:00.0793 0x14a4  tdx - ok
10:26:00.0808 0x14a4  [ C36F41EE20E6999DBF4B0425963268A5, 9DB789A17DF2C283D6E803EEA15F2BDFC56EE3BE342A5606DD5C179C3550ECA6 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
10:26:00.0824 0x14a4  TermDD - ok
10:26:00.0855 0x14a4  [ A01E50A04D7B1960B33E92B9080E6A94, 0512BF11F2FD62BDBD2B1AA34D509BE82AC374C37B925C8C0ED119C6331930FD ] TermService     C:\Windows\System32\termsrv.dll
10:26:00.0902 0x14a4  TermService - ok
10:26:00.0933 0x14a4  [ 42FB6AFD6B79D9FE07381609172E7CA4, B57C85091209A2FAD19ED490B8FA7FC98F12911F9C9CACE9AF1E540780CE6700 ] Themes          C:\Windows\system32\themeservice.dll
10:26:00.0949 0x14a4  Themes - ok
10:26:00.0964 0x14a4  [ 146B6F43A673379A3C670E86D89BE5EA, C4412DCF80DE6B55466F399413271364F14BC0819C224AA161EDDC31A9775440 ] THREADORDER     C:\Windows\system32\mmcss.dll
10:26:00.0980 0x14a4  THREADORDER - ok
10:26:01.0011 0x14a4  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A, 532A3A812578B2DFD83001DE66FC73689D79EC729409EB572E07E6D65B281712 ] TrkWks          C:\Windows\System32\trkwks.dll
10:26:01.0042 0x14a4  TrkWks - ok
10:26:01.0105 0x14a4  [ 41A4C781D2286208D397D72099304133, 447CAAD5589AA499EEE49FBA2CB53210359DB76AFF1DF2F0BD4D92A397037C1D ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
10:26:01.0136 0x14a4  TrustedInstaller - ok
10:26:01.0167 0x14a4  [ 98AE6FA07D12CB4EC5CF4A9BFA5F4242, 9606DACB8CBDAF520282BE8C8F064535767405F138D9E9A215D2C59183E93CC1 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
10:26:01.0276 0x14a4  tssecsrv - ok
10:26:01.0323 0x14a4  [ 3E461D890A97F9D4C168F5FDA36E1D00, 82A8778F404F7AC5102802CF46F279F1E58AC74244665D06FD0C68A8BD887536 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
10:26:01.0417 0x14a4  tunnel - ok
10:26:01.0432 0x14a4  [ 750FBCB269F4D7DD2E420C56B795DB6D, E1A95C59148FE463539C34336FD0E74B31A33B8AB2B8E34AA10349C3347471D7 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
10:26:01.0448 0x14a4  uagp35 - ok
10:26:01.0479 0x14a4  [ 09CC3E16F8E5EE7168E01CF8FCBE061A, 81EEAC72A7C4D72666C743DEFF8096FDB465AA1FA8076C60D19CC192846F01CA ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
10:26:01.0526 0x14a4  udfs - ok
10:26:01.0557 0x14a4  [ 8344FD4FCE927880AA1AA7681D4927E5, 1B54EFA60A221E2B9FFE59BB41C7E7D8B5AC6826F1C5577456D81371D464255A ] UI0Detect       C:\Windows\system32\UI0Detect.exe
10:26:01.0635 0x14a4  UI0Detect - ok
10:26:01.0682 0x14a4  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880, 5D96D90FDF68AE470CC92CA9DF9DA2C05A53EF455A5A109DBBF7C96F3238257C ] uliagpkx        C:\Windows\system32\DRIVERS\uliagpkx.sys
10:26:01.0729 0x14a4  uliagpkx - ok
10:26:01.0760 0x14a4  [ 049B3A50B3D646BAEEEE9EEC9B0668DC, 5774438BBD0976424C20559E14BA2AC158D9FF5D4E1FDC1C9C9F4D7A5CE8C377 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
10:26:01.0791 0x14a4  umbus - ok
10:26:01.0807 0x14a4  [ 7550AD0C6998BA1CB4843E920EE0FEAC, 24C001E422C3B3B920CDCF6003A3179CE464DE4284775403DD5122EF9780460D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
10:26:01.0822 0x14a4  UmPass - ok
10:26:01.0885 0x14a4  [ 833FBB672460EFCE8011D262175FAD33, C0C3067A305993CBF056C229771CB0593DD60C9C7AC5130FF1CA610BCA812AB5 ] upnphost        C:\Windows\System32\upnphost.dll
10:26:01.0931 0x14a4  upnphost - ok
10:26:01.0947 0x14a4  [ 8455C4ED038EFD09E99327F9D2D48FFA, D166F98EA3D85F7DD6B5258949C186714A17EF89B6FDC9804165F7B4FA811C30 ] usbccgp         C:\Windows\system32\drivers\usbccgp.sys
10:26:01.0978 0x14a4  usbccgp - ok
10:26:01.0994 0x14a4  [ 04EC7CEC62EC3B6D9354EEE93327FC82, 6CB41D8644618A5F701F6CA91FB65BB94AA83EA48992133B5262DC539B334B2E ] usbcir          C:\Windows\system32\DRIVERS\usbcir.sys
10:26:02.0025 0x14a4  usbcir - ok
10:26:02.0041 0x14a4  [ E4C436D914768CE965D5E659BA7EEBD8, 4FE0B360D2FE4C8B1D3FA5BD9A0E24CA6C186CD99B72EA58F6B669FABB0B1269 ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys
10:26:02.0087 0x14a4  usbehci - ok
10:26:02.0119 0x14a4  [ FB0E8B624D1F7E214EDB3D6E56B4EC88, 1B0E1909D282A7E25CF4CA01F135E86851836FF795E92636BAFD61ED432AB2CB ] usbfilter       C:\Windows\system32\DRIVERS\usbfilter.sys
10:26:02.0165 0x14a4  usbfilter - ok
10:26:02.0197 0x14a4  [ BDCD7156EC37448F08633FD899823620, 557A6E8B1CD43213FCCB247DEC9EEBC12F263DA13CFF72DEE724E830F7F22C33 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
10:26:02.0259 0x14a4  usbhub - ok
10:26:02.0275 0x14a4  [ EB2D819A639015253C871CDA09D91D58, E65757F3D162F26012BF9E16ECA0688BBCAE633AFFD1CE07083A3306376A4E82 ] usbohci         C:\Windows\system32\DRIVERS\usbohci.sys
10:26:02.0321 0x14a4  usbohci - ok
10:26:02.0337 0x14a4  [ 797D862FE0875E75C7CC4C1AD7B30252, 1BBE745E4C85F8911076F6032ACD7A35FAC048D3CB1500C64E08D8B2C70A1069 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
10:26:02.0368 0x14a4  usbprint - ok
10:26:02.0399 0x14a4  [ 694C991CD0B8138888F086DA6009ADBC, DAFF2F98FD5C52EA2B47BEEE4F2A7B9412251EE20CF80F1B6A3C4F2DA992BAD1 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
10:26:02.0462 0x14a4  USBSTOR - ok
10:26:02.0493 0x14a4  [ 22480BF4E5A09192E5E30BA4DDE79FA4, E5CB29CD419009AC0F641E50E8B0E0B7FF6AD68ADB48A959FFD07A37FCF7B9BE ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
10:26:02.0555 0x14a4  usbuhci - ok
10:26:02.0602 0x14a4  [ 081E6E1C91AEC36758902A9F727CD23C, 9FDAA17A3B99067E035E5D76305427F15FFDBC5D304B2BB78AFC6463EDDE1A75 ] UxSms           C:\Windows\System32\uxsms.dll
10:26:02.0649 0x14a4  UxSms - ok
10:26:02.0665 0x14a4  [ C2243FF9E9AAD0C30E8B1A0914DA15B6, CD01BD44659FDAA6FE8679D0F76748409680A4F4885905EA56F655C60DDEC01F ] VaultSvc        C:\Windows\system32\lsass.exe
10:26:02.0680 0x14a4  VaultSvc - ok
10:26:02.0711 0x14a4  [ A059C4C3EDB09E07D21A8E5C0AABD3CB, BDD3729B49DF2E2FC72FFEF9D10235B481A671DE5A721B6B9A80873B7A343F07 ] vdrvroot        C:\Windows\system32\DRIVERS\vdrvroot.sys
10:26:02.0727 0x14a4  vdrvroot - ok
10:26:02.0774 0x14a4  [ 8C4E7C49D3641BC9E299E466A7F8867D, 4F2E742EFE2DE47EE187B3BCDFDCB525FE484B74700A226D7894F9633F957AFA ] vds             C:\Windows\System32\vds.exe
10:26:02.0836 0x14a4  vds - ok
10:26:02.0852 0x14a4  [ 17C408214EA61696CEC9C66E388B14F3, 829C0416672E2B2DFABCFE641E7F281F41E8DBB3C0EF11C7784CB9BB94F87E97 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
10:26:02.0899 0x14a4  vga - ok
10:26:02.0930 0x14a4  [ 8E38096AD5C8570A6F1570A61E251561, 4DBA3C1397A2203548F45F006E66D99F837903F601ABBCE2304754F783CA8A39 ] VgaSave         C:\Windows\System32\drivers\vga.sys
10:26:02.0992 0x14a4  VgaSave - ok
10:26:03.0023 0x14a4  [ 3BE6E1F3A4F1AFEC8CEE0D7883F93583, 33DF8F7C9A3176175113CA10D69FAF17A5412C055943F14DDC9923531FADB82D ] vhdmp           C:\Windows\system32\DRIVERS\vhdmp.sys
10:26:03.0039 0x14a4  vhdmp - ok
10:26:03.0070 0x14a4  [ C829317A37B4BEA8F39735D4B076E923, 55D1796AE750071E1E05BD7702B6C355CCFFE27B4C00E93E7044C3184732B497 ] viaagp          C:\Windows\system32\DRIVERS\viaagp.sys
10:26:03.0117 0x14a4  viaagp - ok
10:26:03.0133 0x14a4  [ E02F079A6AA107F06B16549C6E5C7B74, B530DCE3EE4F285B3D5F69F7148D17E016D54F04E6F93706B829A34567748788 ] ViaC7           C:\Windows\system32\DRIVERS\viac7.sys
10:26:03.0148 0x14a4  ViaC7 - ok
10:26:03.0179 0x14a4  [ E43574F6A56A0EE11809B48C09E4FD3C, 3687BF638E21C00E62ABFED70D728B91ADA08F7164CA898E654F31DA196589E9 ] viaide          C:\Windows\system32\DRIVERS\viaide.sys
10:26:03.0211 0x14a4  viaide - ok
10:26:03.0226 0x14a4  [ 384E5A2AA49934295171E499F86BA6F3, C79271F98506392422325C075144F45436F9979FE1E002B57F9426F3DA96CEF0 ] volmgr          C:\Windows\system32\DRIVERS\volmgr.sys
10:26:03.0242 0x14a4  volmgr - ok
10:26:03.0273 0x14a4  [ B5BB72067DDDDBBFB04B2F89FF8C3C87, 65B9AD55F43940A5FDD88B6EC5034A7E375DF8E6F5F1AE6519A4BD6B7E992EBC ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
10:26:03.0304 0x14a4  volmgrx - ok
10:26:03.0335 0x14a4  [ 59F06B4968E58BC83DFC56CA4517960E, F0ACE8D5F30B8C81E4FDE0CEBDBA71A212A3198ED09D92B2B40C48FBB243D3F5 ] volsnap         C:\Windows\system32\drivers\volsnap.sys
10:26:03.0367 0x14a4  volsnap - ok
10:26:03.0382 0x14a4  [ 9DFA0CC2F8855A04816729651175B631, 37FD9E43A2A3F125E94A315FB4CD8A1B5499A5FD74806EB2D1E5DA88C070D3A3 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys
10:26:03.0398 0x14a4  vsmraid - ok
10:26:03.0491 0x14a4  [ 7EA2BCD94D9CFAF4C556F5CC94532A6C, 7CD6637BE0A08E3B0F9991D79751DCA8AEC9224B83301821DAA29C9F42B7A9E3 ] VSS             C:\Windows\system32\vssvc.exe
10:26:03.0601 0x14a4  VSS - ok
10:26:03.0616 0x14a4  [ 90567B1E658001E79D7C8BBD3DDE5AA6, EFC23BEEA7F54A2DC56CB523DAD1AF0358D904C5278BF08873910E2DB3F13557 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
10:26:03.0632 0x14a4  vwifibus - ok
10:26:03.0647 0x14a4  [ 7090D3436EEB4E7DA3373090A23448F7, 3A130B28F2BFA7DCEC8596C4CE4E187B019F5ECF1AAC8DD1BBDE9CBD2428FEC2 ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
10:26:03.0679 0x14a4  vwififlt - ok
10:26:03.0725 0x14a4  [ A3F04CBEA6C2A10E6CB01F8B47611882, 32AFE18B07FECA30BC95831A5DC94C784E543784DF16165334A777DC84E91EF3 ] vwifimp         C:\Windows\system32\DRIVERS\vwifimp.sys
10:26:03.0772 0x14a4  vwifimp - ok
10:26:03.0819 0x14a4  [ 55187FD710E27D5095D10A472C8BAF1C, AE298E2D3BA366BCBDC092C717214C181E8843FA564A6DFB07FC3238A5A68DC3 ] W32Time         C:\Windows\system32\w32time.dll
10:26:03.0866 0x14a4  W32Time - ok
10:26:03.0881 0x14a4  [ DE3721E89C653AA281428C8A69745D90, 501C78056ED4295625D8A5412025FD2F0CA24077044D3A5800BA79DF3D946516 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
10:26:03.0897 0x14a4  WacomPen - ok
10:26:03.0928 0x14a4  [ 692A712062146E96D28BA0B7D75DE31B, B6D260272330E0C8EBFAD8F09212F48F1EFED42E6BD3F29A5780D0B691D55B34 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
10:26:03.0975 0x14a4  WANARP - ok
10:26:03.0975 0x14a4  [ 692A712062146E96D28BA0B7D75DE31B, B6D260272330E0C8EBFAD8F09212F48F1EFED42E6BD3F29A5780D0B691D55B34 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
10:26:03.0991 0x14a4  Wanarpv6 - ok
10:26:04.0053 0x14a4  [ 353A04C273EC58475D8633E75CCD5604, FFAE53B6B53AEFC9E8A10BF27480E072D74430276BEB532FE1D473E9616D8CE0 ] WatAdminSvc     C:\Windows\system32\Wat\WatAdminSvc.exe
10:26:04.0131 0x14a4  WatAdminSvc - ok
10:26:04.0240 0x14a4  [ 7790B77FE1E5EE47DCC66247095BB4C9, FFB541F83CDE32E65007D41217C2F46CDDF68121E2846B638EAB620ACA940B05 ] wbengine        C:\Windows\system32\wbengine.exe
10:26:04.0396 0x14a4  wbengine - ok
10:26:04.0427 0x14a4  [ 9614B5D29DC76AC3C29F6D2D3AA70E67, A2FFB92F0030B4CD771E862DA575ECCF2F3A5B4B85858C1241A0C59262C0EC88 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
10:26:04.0459 0x14a4  WbioSrvc - ok
10:26:04.0474 0x14a4  [ 6D9B75275C3E3A5F51AEF81AFFADB2B6, 0805471A57DDF1974F3F7B36B0DD843731C608D10A1C00B01E6E9D0460098E1A ] wcncsvc         C:\Windows\System32\wcncsvc.dll
10:26:04.0505 0x14a4  wcncsvc - ok
10:26:04.0521 0x14a4  [ 5D930B6357A6D2AF4D7653BDABBF352F, 677FF2ED14EE0B0CAA710DA81556CC16D5971DAB10E7C7432D167A87CA6F0EAA ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
10:26:04.0615 0x14a4  WcsPlugInService - ok
10:26:04.0630 0x14a4  [ 1112A9BADACB47B7C0BB0392E3158DFF, 1AE2AFA125973571F91E6945FE8A735F63D76EBB250A0075D98C580167FD9ED4 ] Wd              C:\Windows\system32\DRIVERS\wd.sys
10:26:04.0646 0x14a4  Wd - ok
10:26:04.0739 0x14a4  [ A840213F1ACDCC175B4D1D5AAEAC0D7A, B20F7CAEEA790290072BC170EBEEADB4C19E1C40DB0B3FE0D4A640D0D82300D6 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
10:26:04.0802 0x14a4  Wdf01000 - ok
10:26:04.0833 0x14a4  [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiServiceHost  C:\Windows\system32\wdi.dll
10:26:04.0880 0x14a4  WdiServiceHost - ok
10:26:04.0895 0x14a4  [ 46EF9DC96265FD0B423DB72E7C38C2A5, 43801A51FB0E45CFFC73DF6441B54A75FC2FEAF5E0424DFE7AB04FC26CF6CD16 ] WdiSystemHost   C:\Windows\system32\wdi.dll
10:26:04.0911 0x14a4  WdiSystemHost - ok
10:26:04.0942 0x14a4  [ BB5EC38F8D4600119B4720BC5D4211F1, F04F823A9FE77704F38D773C7350C71727C5E3309CD1EC754519C826A4599476 ] WebClient       C:\Windows\System32\webclnt.dll
10:26:04.0989 0x14a4  WebClient - ok
10:26:05.0005 0x14a4  [ 760F0AFE937A77CFF27153206534F275, A53940BA28854486FF18F16B98A3314B36322B0B6EFB54D08B921315BEB0ADD5 ] Wecsvc          C:\Windows\system32\wecsvc.dll
10:26:05.0036 0x14a4  Wecsvc - ok
10:26:05.0051 0x14a4  [ AC804569BB2364FB6017370258A4091B, 1856F354146A5946F3E7D0DD09726FC8A3502B0F0776FEADDF10669C81CC28E2 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
10:26:05.0098 0x14a4  wercplsupport - ok
10:26:05.0129 0x14a4  [ 08E420D873E4FD85241EE2421B02C4A4, E1E9436EB096FF7DE9A76DA6217035257EF9FC7565DDB9016DCA3859E7F1EF0F ] WerSvc          C:\Windows\System32\WerSvc.dll
10:26:05.0176 0x14a4  WerSvc - ok
10:26:05.0192 0x14a4  [ 8B9A943F3B53861F2BFAF6C186168F79, 88E2F79F32AFBA17CB8377A508B83A1EC2315E9F3A365F591C87FE4525AA6713 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
10:26:05.0254 0x14a4  WfpLwf - ok
10:26:05.0270 0x14a4  [ 5CF95B35E59E2A38023836FFF31BE64C, CEA21302B3E855EE592810D4E0DE10E47A47A393064C435463CD54598735CD8D ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
10:26:05.0285 0x14a4  WIMMount - ok
10:26:05.0379 0x14a4  [ 3FAE8F94296001C32EAB62CD7D82E0FD, 180FAECC426CF8F46700C855022E5865D528B1A20686F96D11080AB2FE2E0430 ] WinDefend       C:\Program Files\Windows Defender\mpsvc.dll
10:26:05.0457 0x14a4  WinDefend - ok
10:26:05.0457 0x14a4  WinHttpAutoProxySvc - ok
10:26:05.0535 0x14a4  [ F62E510B6AD4C21EB9FE8668ED251826, FA3E5CAC3E67E49377320CFBE4646585E6B62168292768FEA81E4623F9166890 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
10:26:05.0644 0x14a4  Winmgmt - ok
10:26:05.0800 0x14a4  [ C4F5D3901D1B41D602DDC196E0B95B51, 20FF2A9DEE3ECBFB163DFA62A407E30ED49F609EF46936F286C2A08A24EA3E7C ] WinRM           C:\Windows\system32\WsmSvc.dll
10:26:05.0878 0x14a4  WinRM - ok
10:26:05.0972 0x14a4  [ 16935C98FF639D185086A3529B1F2067, E9C6B73A572A04FCE9B1B0E6815F941B10332D9A6D55B92927C2B1275F119091 ] Wlansvc         C:\Windows\System32\wlansvc.dll
10:26:06.0034 0x14a4  Wlansvc - ok
10:26:06.0081 0x14a4  [ 6067ACEF367E79914AF628FA1E9B5330, 491A705267B48C103E00B26BBD21FA8829DB03A88343CBC27264CEE5DE8C8DEF ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
10:26:06.0128 0x14a4  wlcrasvc - ok
10:26:06.0315 0x14a4  [ 0A70F4022EC2E14C159EFC4F69AA2477, FF248136576F9803762C54DE5439D3411B52DCBC95B93176A5DAB857967D9AC4 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
10:26:06.0362 0x14a4  wlidsvc - ok
10:26:06.0377 0x14a4  [ 0217679B8FCA58714C3BF2726D2CA84E, 4494984B922DCF24D37BCD0E6831CEBD07D1CA49235D04E821D17ED3DF84ED2A ] WmiAcpi         C:\Windows\system32\DRIVERS\wmiacpi.sys
10:26:06.0409 0x14a4  WmiAcpi - ok
10:26:06.0440 0x14a4  [ 6EB6B66517B048D87DC1856DDF1F4C3F, EBB534C4829477C70062ADBB5626236B02FE563A544C53FA255E79F3CA170FE8 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
10:26:06.0471 0x14a4  wmiApSrv - ok
10:26:06.0596 0x14a4  [ 77FBD400984CF72BA0FC4B3489D65F74, 9AA404F17177FEB43A9EA1A86061B452E7C4A93C873E61B68269047519CD433E ] WMPNetworkSvc   C:\Program Files\Windows Media Player\wmpnetwk.exe
10:26:06.0674 0x14a4  WMPNetworkSvc - ok
10:26:06.0705 0x14a4  [ A2F0EC770A92F2B3F9DE6D518E11409C, 6838F2148B11285E00DC449D51F8AD85AAE57694E89BA2C607B87AC1C650D845 ] WPCSvc          C:\Windows\System32\wpcsvc.dll
10:26:06.0736 0x14a4  WPCSvc - ok
10:26:06.0752 0x14a4  [ B7F658A2EBC07129538AD9AB35212637, 86774A760189E4B126C972A778F890C00C1C30EDD28044DD43B40644A8778B4D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
10:26:06.0783 0x14a4  WPDBusEnum - ok
10:26:06.0814 0x14a4  [ 6DB3276587B853BF886B69528FDB048C, 9972FF6DF0DF6F86D1E9BCEF4C29064748B217DA196B0633C30D3D580144951C ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
10:26:06.0845 0x14a4  ws2ifsl - ok
10:26:06.0877 0x14a4  [ A661A76333057B383A06E65F0073222F, B25AEC2B668C61F2E1C6F7AD27706EE10F8B04F09B5D069784131A6B8B5DF570 ] wscsvc          C:\Windows\System32\wscsvc.dll
10:26:06.0923 0x14a4  wscsvc - ok
10:26:06.0923 0x14a4  WSearch - ok
10:26:07.0157 0x14a4  [ FC3EC24FCE372C89423E015A2AC1A31E, 8D028182CF83667D3E4D148979972D208FA6D9B8540EE47A0A7831B770ECD257 ] wuauserv        C:\Windows\system32\wuaueng.dll
10:26:07.0235 0x14a4  wuauserv - ok
10:26:07.0282 0x14a4  [ 06E6F32C8D0A3F66D956F57B43A2E070, 9A6BD96A28294B0372F16E13D652FD603308F64B74A56E41E0C68C5E8011F943 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
10:26:07.0313 0x14a4  WudfPf - ok
10:26:07.0345 0x14a4  [ 867C301E8B790040AE9CF6486E8041DF, D867D6498C987944D99508B2FAD6D6B749FA1EDFE8124B0863D4A642352F0855 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
10:26:07.0391 0x14a4  WUDFRd - ok
10:26:07.0438 0x14a4  [ FE47B7BC8EA320C2D9B5E5BF6E303765, 34518DBD1E9EA6E5DA62273B18613761E1D9C6B4E074A93C6D639FBAF02222EA ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
10:26:07.0454 0x14a4  wudfsvc - ok
10:26:07.0469 0x14a4  [ FF2D745B560F7C71B31F30F4D49F73D2, B2FBF7E5F58E34AC64FE6CF65800F1F07939279203BDE89375FAC92B884A4F37 ] WwanSvc         C:\Windows\System32\wwansvc.dll
10:26:07.0516 0x14a4  WwanSvc - ok
10:26:07.0532 0x14a4  ================ Scan global ===============================
10:26:07.0547 0x14a4  [ 9A595DF601070DA78C40481120DD2C06, 4C2D6216F212DE9346339ED29152962A39E4435E70F18DD655156727E70818F6 ] C:\Windows\system32\basesrv.dll
10:26:07.0625 0x14a4  [ 8531AAF69394EFB93BC653916C46D245, 0DD9319AB0E4A714EB51989B2458E46D77F4776DBAD9F65CFA55662BAFB82CD9 ] C:\Windows\system32\winsrv.dll
10:26:07.0672 0x14a4  [ 8531AAF69394EFB93BC653916C46D245, 0DD9319AB0E4A714EB51989B2458E46D77F4776DBAD9F65CFA55662BAFB82CD9 ] C:\Windows\system32\winsrv.dll
10:26:07.0703 0x14a4  [ 364455805E64882844EE9ACB72522830, 906561DBBB33F744844CF27E456226044C85DF0FCFD26DE1FD11E09E2CFA6F8F ] C:\Windows\system32\sxssrv.dll
10:26:07.0766 0x14a4  [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6, D7BC4ED605B32274B45328FD9914FB0E7B90D869A38F0E6F94FB1BF4E9E2B407 ] C:\Windows\system32\services.exe
10:26:07.0766 0x14a4  [ Global ] - ok
10:26:07.0766 0x14a4  ================ Scan MBR ==================================
10:26:07.0781 0x14a4  [ 4624822E540EC83CD0819525C65846BA ] \Device\Harddisk0\DR0
10:26:10.0402 0x14a4  \Device\Harddisk0\DR0 - ok
10:26:10.0402 0x14a4  ================ Scan VBR ==================================
10:26:10.0449 0x14a4  [ 58DCE7F82636DB6C7E9DB6ECE2538B58 ] \Device\Harddisk0\DR0\Partition1
10:26:10.0558 0x14a4  \Device\Harddisk0\DR0\Partition1 - ok
10:26:10.0589 0x14a4  [ 97F7CF239436882D20A672EABE986F93 ] \Device\Harddisk0\DR0\Partition2
10:26:10.0667 0x14a4  \Device\Harddisk0\DR0\Partition2 - ok
10:26:10.0683 0x14a4  [ A549E879ECBF85AA75F70ED669E492C8 ] \Device\Harddisk0\DR0\Partition3
10:26:10.0699 0x14a4  \Device\Harddisk0\DR0\Partition3 - ok
10:26:10.0699 0x14a4  ================ Scan generic autorun ======================
10:26:10.0823 0x14a4  [ 57B4D34232852BFE4453BE571DF90D21, 3D329499D7BCACAE5F6377F988B90714F5A8301784CDB22D5B54A2266AC50D79 ] C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
10:26:10.0839 0x14a4  CLMLServer - ok
10:26:11.0229 0x14a4  [ DC4F85C97890899E706A2D9229D95D2B, B4BEF5E2CC4A060077F68DDDCB7AAFDB0D5C320CBDEEEAC8D754D48EB6FE5390 ] C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
10:26:11.0416 0x14a4  RtHDVCpl - ok
10:26:11.0510 0x14a4  [ 7F271833DF826333F8EFB1EB4DEB2F39, F790791269BC6941DC61686C623DD9477F3C6A56EFBAEC025ECF31431010B614 ] C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
10:26:11.0541 0x14a4  StartCCC - detected UnsignedFile.Multi.Generic ( 1 )
10:26:14.0162 0x14a4  Detect skipped due to KSN trusted
10:26:14.0162 0x14a4  StartCCC - ok
10:26:14.0255 0x14a4  [ A915E9E86853E86AAF0216675556B890, D0579457A225BFEE2740D3AE8C77AD853BD571D20203DF331EBBCF05214DCDDF ] C:\Eigene Programme\EMET\EMET_notifier.exe
10:26:14.0271 0x14a4  EMET Notifier - ok
10:26:14.0396 0x14a4  [ D182607751FD3E06FA27117626273701, A36900C489CE2BAD75DE126CB8D6E75C212CAB1EF07BD2B6FE036A09867C0D50 ] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
10:26:14.0411 0x14a4  avgnt - ok
10:26:14.0489 0x14a4  [ EA6EADF6314E43783BA8EEE79F93F73C, 1A4BC2D8DFBDC37AF85C73DEE76A6EE901EBA188D43856BD2FFA96B79A126F73 ] C:\Program Files\Windows Sidebar\Sidebar.exe
10:26:14.0630 0x14a4  Sidebar - ok
10:26:14.0661 0x14a4  [ BBA1A5B86134F496B926DDAF247DB871, 636990AE49C55189B7EF69C419787440B57EC0BAD98A9C280E1028F741BB222E ] C:\Windows\System32\mctadmin.exe
10:26:14.0692 0x14a4  mctadmin - ok
10:26:14.0801 0x14a4  [ EA6EADF6314E43783BA8EEE79F93F73C, 1A4BC2D8DFBDC37AF85C73DEE76A6EE901EBA188D43856BD2FFA96B79A126F73 ] C:\Program Files\Windows Sidebar\Sidebar.exe
10:26:14.0833 0x14a4  Sidebar - ok
10:26:14.0864 0x14a4  [ BBA1A5B86134F496B926DDAF247DB871, 636990AE49C55189B7EF69C419787440B57EC0BAD98A9C280E1028F741BB222E ] C:\Windows\System32\mctadmin.exe
10:26:14.0879 0x14a4  mctadmin - ok
10:26:14.0879 0x14a4  Waiting for KSN requests completion. In queue: 8
10:26:15.0893 0x14a4  Waiting for KSN requests completion. In queue: 8
10:26:16.0907 0x14a4  Waiting for KSN requests completion. In queue: 6
10:26:17.0968 0x14a4  AV detected via SS2: Avira Desktop, C:\Program Files\Avira\AntiVir Desktop\wsctool.exe ( 14.0.9.122 ), 0x41000 ( enabled : updated )
10:26:17.0984 0x14a4  Win FW state via NFP2: enabled
10:26:20.0495 0x14a4  ============================================================
10:26:20.0495 0x14a4  Scan finished
10:26:20.0495 0x14a4  ============================================================
10:26:20.0511 0x149c  Detected object count: 0
10:26:20.0511 0x149c  Actual detected object count: 0
         

Ich weiß nicht ob es ein Fehlalarm war. Dazu müsstest Du die Datei in Quarantäne bei MBAM mal online scannen:

Dateien online auf Viren prüfen - so geht&#039;s - Anleitungen

Bei Euch in der Anleitung stand, dass man die Funde löschen sollte. Das habe ich dann auch getan (Schritt 3).

http://www.trojaner-board.de/51187-a...-malware.html?

Ich kann also diese leider nicht mehr scannen.

Jetzt wo ich es noch einmal betrachte, habe ich wohl die Falsche Anleitung im Kopf gehabt (die Untere). Man soll nur die Datei von ihrer Stelle löschen und in die Quartäne verschieben, nicht in der Quarantäne löschen. Richtig?

Okay, dass ist jetzt zu dumm. Sieht so aus als hätte ich die Sache verkompliziert.

Bestehen jetzt keine Möglichkeiten mehr außer einer Neuinstallation zur Sicherheit?

Genau, nur in Quarantäne packen

Ist aber kein problem, wir machen weiter als wäre die Infektion auch da gewesen, dann brauchst Du nicht neuaufsetzen.


Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

• WICHTIG: Speichere Combofix auf deinem Desktop.
• Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
• Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
• Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
• Wenn Combofix fertig ist, wird es ein Logfile erstellen.
• Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

starte den Rechner einfach neu. Dies sollte das Problem beheben.

Wenn ich das fragen dürfte, was hat Combofix den nun im groben gemacht? Ich bemerkte ich musste Firefox hinterher wieder als Standardbrowser festlegen.

Irgend etwas anderes, dass ich vielleicht wieder anpassen muss?

Ansonsten hier ist der Log. Gemeckert hatte er während des prozesses nicht. Ich starte jetzt meinen Rechner neu.

ComboFix 15-04-19.01 - *Mein Name* 23.04.2015  20:21:46.1.3 - x86
Microsoft Windows 7 Home Premium   6.1.7600.0.1252.49.1031.18.3327.2316 [GMT 2:00]
ausgeführt von:: c:\users\*Mein Name*\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {4D041356-F94D-285F-8768-AAE50FA36859}
SP: Avira Desktop *Disabled/Updated* {F665F2B2-DF77-27D1-BDD8-9197742422E4}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
c:\windows\pkunzip.pif
c:\windows\pkzip.pif
c:\windows\unin0407.exe
.
.
(((((((((((((((((((((((   Dateien erstellt von 2015-03-23 bis 2015-04-23  ))))))))))))))))))))))))))))))
.
.
2015-04-23 18:27 . 2015-04-23 18:28	--------	d-----w-	c:\users\*Mein Name*\AppData\Local\temp
2015-04-23 18:27 . 2015-04-23 18:27	--------	d-----w-	c:\users\Default\AppData\Local\temp
2015-04-21 11:43 . 2015-04-21 11:44	--------	d-----w-	C:\FRST
2015-04-21 11:36 . 2015-04-22 19:28	114904	----a-w-	c:\windows\system32\drivers\MBAMSwissArmy.sys
2015-04-21 11:36 . 2014-11-21 04:14	51928	----a-w-	c:\windows\system32\drivers\mwac.sys
2015-04-21 11:36 . 2014-11-21 04:14	75480	----a-w-	c:\windows\system32\drivers\mbamchameleon.sys
2015-04-21 11:34 . 2014-11-21 04:14	23256	----a-w-	c:\windows\system32\drivers\mbam.sys
2015-04-10 09:37 . 2015-03-23 01:36	576000	----a-w-	c:\windows\system32\generaltel.dll
2015-04-10 09:37 . 2015-03-23 01:36	630784	----a-w-	c:\windows\system32\invagent.dll
2015-04-10 09:37 . 2015-03-23 01:36	331264	----a-w-	c:\windows\system32\devinv.dll
2015-04-10 09:37 . 2015-03-23 01:36	860160	----a-w-	c:\windows\system32\appraiser.dll
2015-04-10 09:37 . 2015-03-23 01:35	26112	----a-w-	c:\windows\system32\acmigration.dll
2015-04-10 09:37 . 2015-03-23 01:35	202752	----a-w-	c:\windows\system32\aepdu.dll
2015-04-10 09:37 . 2015-03-23 01:30	896000	----a-w-	c:\windows\system32\aeinv.dll
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2015-04-20 09:34 . 2014-10-27 18:29	96680	----a-w-	c:\windows\system32\WindowsAccessBridge.dll
2015-04-15 21:09 . 2011-12-09 01:20	347464	----a-w-	c:\windows\system32\PnkBstrB.xtr
2015-04-15 21:04 . 2011-12-09 01:18	138904	----a-w-	c:\users\*Mein Name*\AppData\Roaming\PnkBstrK.sys
2015-04-15 21:04 . 2011-12-09 01:18	281872	----a-w-	c:\windows\system32\PnkBstrB.ex0
2015-04-14 20:10 . 2012-07-15 10:41	778416	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2015-04-14 20:10 . 2011-07-29 14:36	142512	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2015-03-03 11:49 . 2013-07-29 11:54	37896	----a-w-	c:\windows\system32\drivers\avnetflt.sys
2015-03-03 11:49 . 2013-07-29 11:50	136216	----a-w-	c:\windows\system32\drivers\avipbb.sys
2015-03-03 11:49 . 2013-07-29 11:50	105864	----a-w-	c:\windows\system32\drivers\avgntflt.sys
2015-01-27 23:28 . 2015-02-12 00:09	1167520	----a-w-	c:\windows\system32\aitstatic.exe
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"CLMLServer"="c:\program files\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RtHDVCpl.exe" [2010-06-14 9288296]
"StartCCC"="c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2010-10-01 98304]
"EMET Notifier"="c:\eigene programme\EMET\EMET_notifier.exe" [2012-05-09 152152]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2015-03-31 704248]
.
[HKEY_USERS\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\RunOnce]
"SPReview"="c:\windows\System32\SPReview\SPReview.exe" [2013-10-20 280576]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
.
R3 mdxgthkn;mdxgthkn;c:\users\*Mein Name*\AppData\Local\Temp\mdxgthkn.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [2010-10-11 1343400]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 51040]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [2010-05-14 62592]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [2010-05-14 24192]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys [2013-07-29 113024]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2013-10-07 37352]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [2010-09-29 176128]
S2 AntiVirFirewallService;Avira FireWall;c:\program files\Avira\AntiVir Desktop\avfwsvc.exe [2015-03-31 1045960]
S2 AntiVirMailService;Avira Email Schutz;c:\program files\Avira\AntiVir Desktop\avmailc.exe [2015-03-31 804600]
S2 AntiVirSchedulerService;Avira Planer;c:\program files\Avira\AntiVir Desktop\sched.exe [2015-03-31 432888]
S2 AntiVirWebService;Avira Browser-Schutz;c:\program files\Avira\AntiVir Desktop\AVWEBGRD.EXE [2015-03-31 992504]
S3 AtiHDAudioService;ATI Function Driver for HD Audio Service;c:\windows\system32\drivers\AtihdW73.sys [2010-09-24 102416]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [2013-07-29 92448]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt86win7.sys [2011-06-10 394856]
S3 RTL8192su;Realtek RTL8192SU Wireless LAN 802.11n USB 2.0 Network Adapter;c:\windows\system32\DRIVERS\RTL8192su.sys [2010-11-25 603240]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [2010-06-14 30464]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
HPZ12	REG_MULTI_SZ   	Pml Driver HPZ12 Net Driver HPZ12
.
Inhalt des "geplante Tasks" Ordners
.
2015-04-23 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-07-15 20:10]
.
2015-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-21 01:07]
.
2015-04-23 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-04-21 01:07]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = about:blank
IE: Google Sidewiki... - c:\program files\Google\Google Toolbar\Component\GoogleToolbarDynamic_mui_en_96D6FF0C6D236BF8.dll/cmsidewiki.html
LSP: c:\program files\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.0.10
FF - ProfilePath - c:\users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\
FF - prefs.js: browser.startup.homepage - about:blank
FF - prefs.js: network.proxy.type - 0
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-BsScanner
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\S-1-5-21-648958566-201983947-700737179-1000\Software\SecuROM\!CAUTION! NEVER A OR CHANGE ANY KEY*]
@Allowed: (Read) (RestrictedCode)
"??"=hex:82,75,a7,af,e3,5b,89,6d,c3,bc,58,25,15,d2,1a,fb,a5,4f,ec,a5,ec,dd,bc,
   7a,7f,9d,a1,5b,04,e9,c2,e9,2c,ca,88,39,bd,02,35,28,cc,85,fc,c6,61,27,eb,48,\
"??"=hex:75,47,34,b4,0e,62,6e,a4,a5,a5,ce,4a,a0,2c,0d,4b
.
[HKEY_USERS\S-1-5-21-648958566-201983947-700737179-1000\Software\SecuROM\License information*]
"datasecu"=hex:00,40,b4,04,39,70,53,5e,2e,1c,12,0a,0e,1e,21,47,09,03,17,78,34,
   a5,48,c7,76,8a,6d,6c,45,fa,da,56,10,60,ae,0c,89,6e,f8,b6,38,cd,5b,c1,c9,0c,\
"rkeysecu"=hex:ff,80,60,8c,d4,02,11,0d,d3,c3,de,bb,c6,2c,15,fd
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2015-04-23  20:29:42
ComboFix-quarantined-files.txt  2015-04-23 18:29
.
Vor Suchlauf: 11 Verzeichnis(se), 753.984.897.024 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 755.736.489.984 Bytes frei
.
- - End Of File - - 2A7F800B92E1E64A6042B303685F166E
4624822E540EC83CD0819525C65846BA
         

Downloade Dir bitte Malwarebytes Anti-Malware

• Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
• Starte Malwarebytes' Anti-Malware (MBAM).
• Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
• Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
• Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
• Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
• Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
• Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.

Downloade Dir bitte AdwCleaner auf deinen Desktop.

• Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
• Starte die AdwCleaner.exe mit einem Doppelklick.
• Stimme den Nutzungsbedingungen zu.
• Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
  • "Tracing" Schlüssel löschen
  • Winsock Einstellungen zurücksetzen
  • Proxy Einstellungen zurücksetzen
  • Internet Explorer Richtlinien zurücksetzen
  • Chrome Richtlinien zurücksetzen
  • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
• Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
• Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
• Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
• Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

• Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
• Drücke eine beliebige Taste, um das Tool zu starten.
• Je nach System kann der Scan eine Weile dauern.
• Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
• Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.

und ein frisches FRST log bitte.

Ich will mich ja nicht beschweren aber nach AdwCleaner scheint mein Avira nicht mehr ordentlich zu laufen. Fühle mich jetzt wesentlicher unsicherer als vorher. Bin also leicht in Panik.

Da jetzt das Wochenende kommt wäre es nett wenn ich das wieder voll Funktionsfähig haben könnte. Irgendwelche Ratschläge?

Ach ja. Und kann ich wenn wir fertig sind alle genutzten Scan Programme einfach wieder löschen (zusammen mit deren Ordnern) oder muss ich da wichtiges beachten?

Bis dahin. Hier sind die Logfiles.

 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 24.04.2015
Suchlauf-Zeit: 14:11:38
Logdatei: mbam.txt
Administrator: Ja

Version: 2.00.4.1028
Malware Datenbank: v2015.04.24.02
Rootkit Datenbank: v2015.04.21.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7
CPU: x86
Dateisystem: NTFS
Benutzer: *Mein Name*

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 323927
Verstrichene Zeit: 22 Min, 32 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Aktiviert
Heuristik: Aktiviert
PUP: Warnen
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente erkannt)

Module: 0
(Keine schädliche Elemente erkannt)

Registrierungsschlüssel: 0
(Keine schädliche Elemente erkannt)

Registrierungswerte: 0
(Keine schädliche Elemente erkannt)

Registrierungsdaten: 0
(Keine schädliche Elemente erkannt)

Ordner: 0
(Keine schädliche Elemente erkannt)

Dateien: 0
(Keine schädliche Elemente erkannt)

Physische Sektoren: 0
(Keine schädliche Elemente erkannt)


(end)
         

# AdwCleaner v4.202 - Bericht erstellt 24/04/2015 um 14:42:22
# Aktualisiert 23/04/2015 von Xplode
# Datenbank : 2015-04-23.2 [Server]
# Betriebssystem : Windows 7 Home Premium  (x86)
# Benutzername : *Mein Name* - *Mein PC*
# Gestarted von : C:\Users\*Mein Name*\Desktop\AdwCleaner_4.202.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\Partner

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKCU\Software\Conduit
Schlüssel Gelöscht : HKCU\Software\YahooPartnerToolbar
Schlüssel Gelöscht : HKLM\SOFTWARE\systweak

***** [ Internetbrowser ] *****

-\\ Internet Explorer v9.0.8112.16476


-\\ Mozilla Firefox v4.0 (de)


-\\ Google Chrome v5.0.375.125


*************************

AdwCleaner[R0].txt - [1009 Bytes] - [24/04/2015 14:41:36]
AdwCleaner[S0].txt - [931 Bytes] - [24/04/2015 14:42:22]

########## EOF - C:\AdwCleaner\AdwCleaner[S0].txt - [989  Bytes] ##########
         

~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.6.2 (04.24.2015:1)
OS: Windows 7 Home Premium x86
Ran by *Mein Name* on 24.04.2015 at 14:53:37,35
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values



~~~ Registry Keys



~~~ Files



~~~ Folders





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 24.04.2015 at 14:55:01,93
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         

Und fast vergessen die FRST log:


FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-04-2015
Ran by *Mein Name* (administrator) on *Mein Name* on 24-04-2015 15:27:01
Running from C:\Users\*Mein Name*\Desktop
Loaded Profiles: *Mein Name* (Available profiles: *Mein Name*)
Platform: Microsoft Windows 7 Home Premium  (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebgrd.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Eigene Programme\EMET\EMET_notifier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Mozilla Corporation) C:\Eigene Programme\Mozilla Firefox\firefox.exe
(Ghisler Software GmbH) C:\Eigene Programme\totalcmd\TOTALCMD.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\usrreq.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9288296 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-01] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [EMET Notifier] => C:\Eigene Programme\EMET\EMET_notifier.exe [152152 2012-05-09] (Microsoft Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [704248 2015-03-31] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-648958566-201983947-700737179-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [220672 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-10-20] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-20] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-20] (Oracle Corporation)
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.10

FireFox:
========
FF ProfilePath: C:\Users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default
FF Homepage: about:blank
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-20] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2010-10-11] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll [2010-09-17] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-648958566-201983947-700737179-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Extension: WOT - C:\Users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: 瀏覽頁組管理員 - C:\Users*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2011-07-22]
FF Extension: Adblock Plus - C:\Users*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-07-25]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirFirewallService; C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe [1045960 2015-03-31] (Avira Operations GmbH & Co. KG)
S2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc.exe [804600 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\AVWEBGRD.EXE [992504 2015-03-31] (Avira Operations GmbH & Co. KG)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 ACEDRV05; C:\Windows\system32\drivers\ACEDRV05.sys [97792 2012-02-07] (Protect Software GmbH) [File not signed]
R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [62592 2010-05-15] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [24192 2010-05-15] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-09-24] (ATI Technologies, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [92448 2013-07-29] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [113024 2013-07-29] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-29] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\*Mein Name*\AppData\Local\Temp\catchme.sys [X]
S3 mdxgthkn; \??\C:\Users\*Mein Name*\AppData\Local\Temp\mdxgthkn.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-24 14:55 - 2015-04-24 15:03 - 00000606 _____ () C:\Users\*Mein Name*\Desktop\JRT.txt
2015-04-24 14:53 - 2015-04-24 14:53 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-*Mein Name*-Windows-7-Home-Premium-(32-bit).dat
2015-04-24 14:53 - 2015-04-24 14:53 - 00000000 ____D () C:\RegBackup
2015-04-24 14:52 - 2015-04-24 14:53 - 02685461 _____ (Thisisu) C:\Users\*Mein Name*\Desktop\JRT.exe
2015-04-24 14:45 - 2015-04-24 14:45 - 00001065 _____ () C:\Users\*Mein Name*\Desktop\AdwCleaner[S0].txt
2015-04-24 14:41 - 2015-04-24 14:42 - 00000000 ____D () C:\AdwCleaner
2015-04-24 14:39 - 2015-04-24 14:39 - 02224640 _____ () C:\Users\*Mein Name*\Desktop\AdwCleaner_4.202.exe
2015-04-24 14:38 - 2015-04-24 14:38 - 00001189 _____ () C:\Users\*Mein Name*\Desktop\mbam.txt
2015-04-23 20:29 - 2015-04-23 20:29 - 00009202 _____ () C:\ComboFix.txt
2015-04-23 20:20 - 2015-04-23 20:29 - 00000000 ____D () C:\Windows\erdnt
2015-04-23 20:20 - 2015-04-23 20:29 - 00000000 ____D () C:\Qoobox
2015-04-23 20:20 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-23 20:20 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-23 20:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-23 20:18 - 2015-04-23 20:18 - 05619466 ____R (Swearware) C:\Users\*Mein Name*\Desktop\ComboFix.exe
2015-04-22 10:21 - 2015-04-22 10:22 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\*Mein Name*\Desktop\tdsskiller.exe
2015-04-21 13:44 - 2015-04-21 13:58 - 00035283 _____ () C:\Users\*Mein Name*\Desktop\Addition.txt
2015-04-21 13:43 - 2015-04-24 15:27 - 00010741 _____ () C:\Users\*Mein Name*\Desktop\FRST.txt
2015-04-21 13:43 - 2015-04-24 15:27 - 00000000 ____D () C:\FRST
2015-04-21 13:40 - 2015-04-21 13:40 - 01139200 _____ (Farbar) C:\Users\*Mein Name*\Desktop\FRST.exe
2015-04-21 13:36 - 2015-04-24 14:11 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-21 13:36 - 2015-04-21 13:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-21 13:36 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-21 13:36 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-21 13:34 - 2015-04-21 13:36 - 00000892 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-21 13:34 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-14 20:36 - 2015-04-14 20:36 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-04-10 11:37 - 2015-03-23 03:36 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00331264 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-10 11:37 - 2015-03-23 03:35 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-10 11:37 - 2015-03-23 03:35 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-10 11:37 - 2015-03-23 03:30 - 00896000 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-09 22:58 - 2015-04-09 23:00 - 00000341 _____ () C:\Users\*Mein Name*\AppData\Local\Hinweis GPDI...txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-24 15:26 - 2011-04-21 14:29 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-24 15:21 - 2009-07-14 06:34 - 00015984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-24 15:21 - 2009-07-14 06:34 - 00015984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-24 15:17 - 2011-04-21 14:29 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-24 15:14 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-24 15:14 - 2009-07-14 06:39 - 00202267 _____ () C:\Windows\setupact.log
2015-04-24 15:13 - 2011-04-21 14:25 - 01500537 _____ () C:\Windows\WindowsUpdate.log
2015-04-24 15:09 - 2012-10-23 18:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-24 10:06 - 2010-07-06 22:23 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-23 20:48 - 2010-07-07 20:31 - 00139328 _____ () C:\Windows\PFRO.log
2015-04-23 20:29 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2015-04-23 20:29 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-04-23 20:28 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-04-22 22:29 - 2011-04-22 10:47 - 00000000 ____D () C:\Eigene Programme
2015-04-21 13:36 - 2011-07-25 13:34 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Roaming\Malwarebytes
2015-04-20 12:18 - 2013-04-23 21:24 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Local\Warframe
2015-04-20 11:35 - 2014-10-27 20:28 - 00000000 ____D () C:\Program Files\Java
2015-04-20 11:34 - 2014-10-27 20:29 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-04-20 00:20 - 2011-07-21 14:31 - 00000000 ____D () C:\Games
2015-04-19 14:59 - 2012-02-11 00:14 - 00000000 ____D () C:\ProgramData\PopCap Games
2015-04-15 23:09 - 2011-12-09 03:20 - 00347464 _____ () C:\Windows\system32\PnkBstrB.xtr
2015-04-15 23:04 - 2011-12-09 03:18 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2015-04-15 23:04 - 2011-12-09 03:18 - 00138904 _____ () C:\Users\*Mein Name*\AppData\Roaming\PnkBstrK.sys
2015-04-15 21:48 - 2011-07-21 15:22 - 00000000 ____D () C:\Program Files\Common Files\Steam
2015-04-15 20:37 - 2013-10-20 21:41 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 20:34 - 2010-07-06 23:03 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-14 22:10 - 2012-07-15 12:41 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-14 22:10 - 2011-07-29 16:36 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-14 20:43 - 2014-09-21 17:43 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Local\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\ProgramData\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\Program Files\Adobe
2015-04-11 13:10 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-10 11:38 - 2014-12-13 00:20 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-10 11:38 - 2014-07-30 12:28 - 00000000 ___SD () C:\Windows\system32\CompatTel

==================== Files in the root of some directories =======

2011-12-09 03:18 - 2015-04-15 23:04 - 0138904 _____ () C:\Users\*Mein Name*\AppData\Roaming\PnkBstrK.sys
2015-04-09 22:58 - 2015-04-09 23:00 - 0000341 _____ () C:\Users\*Mein Name*\AppData\Local\Hinweis GPDI...txt
2011-07-30 17:21 - 2015-03-01 17:16 - 0007601 _____ () C:\Users\*Mein Name*\AppData\Local\Resmon.ResmonCfg
2014-01-04 15:35 - 2014-01-04 15:37 - 0000142 _____ () C:\ProgramData\Einige Securom Elemente noch vorhanden.txt

Some content of TEMP:
====================
C:\Users\*Mein Name*\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-24 12:38

==================== End Of Log ============================
         

--- --- ---

Das kommt weil die Avira-eigene Adware gelöscht wurde. Ist halt ne Adwareschleuder. Avira einfach neu installieren, oder gleich was anständiges.

Programme entfernen wir am Schluss.




ESET Online Scanner

• Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
• Lade und starte Eset Online Scanner
• Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
• Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
• Klicke auf Starten.
• Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
• Klicke am Ende des Suchlaufs auf Fertig stellen.
• Schließe das Fenster von ESET.
• Explorer öffnen.
• C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
• Logfile hier posten.
• Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
• Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset

Downloade Dir bitte SecurityCheck und:

• Speichere es auf dem Desktop.
• Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
• Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.

Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?

Ja, von eurer Meinung zu Avira hatte ich während der Suche nach der Problemlösung schon gelesen. Auf jeden Fall danke für den Tip.

Zu "Noch Probleme?". Stehen noch viele Scans an? Ich weiß man soll nicht hetzen aber es wäre gut zu wissen wie lange ich ungefähr nicht mit dem PC rechnen kann. Ich brauche den bald wieder und wenn es länger dauern könnte, kann ich mich vorbereiten.

Ansonsten hier sind die neusten Logs.

ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=b200f29f0e317a488102ee69bd47d76f
# engine=23555
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-04-25 01:44:23
# local_time=2015-04-25 03:44:23 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7600 NT 
# compatibility_mode_1='Avira Desktop'
# compatibility_mode=1805 16777213 100 100 20343 155807869 0 0
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 117836187 181600654 0 0
# scanned=261887
# found=0
# cleaned=0
# scan_time=8532
         

Beim Secruity Check hatte ich die Schutzmaßnahmen abgestellt wie beim Eset. Ich hoffe das war nicht falsch ?

Results of screen317's Security Check version 1.00  
 Windows 7  x86 (UAC is enabled)  
 Out of date service pack!! 
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Desktop   
 Antivirus up to date!  (On Access scanning disabled!) 
`````````Anti-malware/Other Utilities Check:````````` 
 Java 8 Update 45  
 Java version 32-bit out of Date! 
 Adobe Flash Player 	17.0.0.169  
 Adobe Reader 9 Adobe Reader out of Date! 
 Mozilla Firefox 4.0 Firefox out of Date!  
 Google Chrome 5.0.375.125  Google Chrome out of date!  
````````Process Check: objlist.exe by Laurent````````  
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         

FRST Logfile:

FRST Logfile:

Scan result of Farbar Recovery Scan Tool (FRST) (x86) Version: 20-04-2015
Ran by *Mein Name* (administrator) on *Mein Name* on 25-04-2015 15:52:09
Running from C:\Users\*Mein Name*\Desktop
Loaded Profiles: *Mein Name* (Available profiles: *Mein Name*)
Platform: Microsoft Windows 7 Home Premium  (X86) OS Language: Deutsch (Deutschland)
Internet Explorer Version 9 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
(Protexis Inc.) C:\Program Files\Common Files\Protexis\License Service\PsiService_2.exe
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\microsoft shared\Windows Live\WLIDSVCM.EXE
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe
(CyberLink) C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe
(Realtek Semiconductor) C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe
(Microsoft Corporation) C:\Eigene Programme\EMET\EMET_notifier.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
(Advanced Micro Devices Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Microsoft Corporation) C:\Windows\System32\wuauclt.exe
(Avira Operations GmbH & Co. KG) C:\Program Files\Avira\AntiVir Desktop\avcenter.exe
(Ghisler Software GmbH) C:\Eigene Programme\totalcmd\TOTALCMD.EXE


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [CLMLServer] => C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe [103720 2009-11-02] (CyberLink)
HKLM\...\Run: [RtHDVCpl] => C:\Program Files\Realtek\Audio\HDA\RtHDVCpl.exe [9288296 2010-06-14] (Realtek Semiconductor)
HKLM\...\Run: [StartCCC] => C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [98304 2010-10-01] (Advanced Micro Devices, Inc.)
HKLM\...\Run: [EMET Notifier] => C:\Eigene Programme\EMET\EMET_notifier.exe [152152 2012-05-09] (Microsoft Corporation)
HKLM\...\Run: [avgnt] => C:\Program Files\Avira\AntiVir Desktop\avgnt.exe [704248 2015-03-31] (Avira Operations GmbH & Co. KG)
HKU\S-1-5-21-648958566-201983947-700737179-1000\Control Panel\Desktop\\SCRNSAVE.EXE -> C:\Windows\system32\Ribbons.scr [220672 2009-07-14] (Microsoft Corporation)
HKU\S-1-5-18\...\RunOnce: [SPReview] => C:\Windows\System32\SPReview\SPReview.exe [280576 2013-10-20] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-648958566-201983947-700737179-1000\SOFTWARE\Policies\Microsoft\Internet Explorer: Policy restriction <======= ATTENTION
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\.DEFAULT\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=msnhome
HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.microsoft.com/isapi/redir.dll?prd=ie&ar=iesearch
HKU\S-1-5-21-648958566-201983947-700737179-1000\Software\Microsoft\Internet Explorer\Main,Start Page = about:blank
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_45\bin\ssv.dll [2015-04-20] (Oracle Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2010-09-22] (Microsoft Corp.)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_45\bin\jp2ssv.dll [2015-04-20] (Oracle Corporation)
DPF: {05CA9FB0-3E3E-4B36-BF41-0E3A5CAA8CD8} hxxp://download.microsoft.com/download/C/B/F/CBF23A2C-3E55-4664-BC5C-762780D79BA0/OGAControl.cab
DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-0017-0000-0045-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_45-windows-i586.cab
Tcpip\Parameters: [DhcpNameServer] 192.168.0.10

FireFox:
========
FF ProfilePath: C:\Users*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default
FF Homepage: about:blank
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF32_17_0_0_169.dll [2015-04-14] ()
FF Plugin: @adobe.com/ShockwavePlayer -> C:\Windows\system32\Adobe\Director\np32dsw_1213153.dll [2014-06-24] (Adobe Systems, Inc.)
FF Plugin: @java.com/DTPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\dtplugin\npDeployJava1.dll [2015-04-20] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.45.2 -> C:\Program Files\Java\jre1.8.0_45\bin\plugin2\npjp2.dll [2015-04-20] (Oracle Corporation)
FF Plugin: @microsoft.com/GENUINE -> C:\Windows\system32\Wat\npWatWeb.dll [2010-10-11] (Microsoft Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\4.0.50917.0\npctrl.dll [2010-09-17] ( Microsoft Corporation)
FF Plugin: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll [2010-09-23] (Microsoft Corporation)
FF Plugin: @tools.google.com/Google Update;version=3 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: @tools.google.com/Google Update;version=9 -> C:\Program Files\Google\Update\1.3.26.9\npGoogleUpdate3.dll [2015-02-06] (Google Inc.)
FF Plugin: Adobe Reader -> C:\Program Files\Adobe\Acrobat Reader DC\Reader\AIR\nppdf32.dll [2015-03-17] (Adobe Systems Inc.)
FF Plugin HKU\S-1-5-21-648958566-201983947-700737179-1000: ubisoft.com/uplaypc -> C:\Program Files\Ubisoft\Ubisoft Game Launcher\npuplaypc.dll No File
FF Extension: WOT - C:\Users*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2013-11-27]
FF Extension: 瀏覽頁組管理員 - C:\Users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{1280606b-2510-4fe0-97ef-9b5a22eafe30}.xpi [2011-07-22]
FF Extension: Adblock Plus - C:\Users\*Mein Name*\AppData\Roaming\Mozilla\Firefox\Profiles\o042joyq.default\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2011-07-25]

========================== Services (Whitelisted) =================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R2 AntiVirFirewallService; C:\Program Files\Avira\AntiVir Desktop\avfwsvc.exe [1045960 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirMailService; C:\Program Files\Avira\AntiVir Desktop\avmailc7.exe [807160 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files\Avira\AntiVir Desktop\sched.exe [432888 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files\Avira\AntiVir Desktop\avguard.exe [432888 2015-03-31] (Avira Operations GmbH & Co. KG)
R2 AntiVirWebService; C:\Program Files\Avira\AntiVir Desktop\avwebg7.exe [993528 2015-03-31] (Avira Operations GmbH & Co. KG)
S3 IDriverT; C:\Program Files\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) [File not signed]
R2 Net Driver HPZ12; C:\Windows\system32\HPZinw12.dll [44032 2010-08-06] (Hewlett-Packard) [File not signed]
R2 Pml Driver HPZ12; C:\Windows\system32\HPZipm12.dll [53760 2010-08-06] (Hewlett-Packard) [File not signed]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [680960 2009-07-14] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, the service will be removed from the registry. The file will not be moved unless listed separately.)

R1 ACEDRV05; C:\Windows\system32\drivers\ACEDRV05.sys [97792 2012-02-07] (Protect Software GmbH) [File not signed]
R0 amd_sata; C:\Windows\System32\DRIVERS\amd_sata.sys [62592 2010-05-15] (Advanced Micro Devices)
R0 amd_xata; C:\Windows\System32\DRIVERS\amd_xata.sys [24192 2010-05-15] (Advanced Micro Devices)
R3 AtiHDAudioService; C:\Windows\System32\drivers\AtihdW73.sys [102416 2010-09-24] (ATI Technologies, Inc.)
R3 avfwim; C:\Windows\System32\DRIVERS\avfwim.sys [92448 2013-07-29] (Avira GmbH)
R1 avfwot; C:\Windows\System32\DRIVERS\avfwot.sys [113024 2013-07-29] (Avira GmbH)
R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [105864 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [136216 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [37352 2013-10-07] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [37896 2015-03-03] (Avira Operations GmbH & Co. KG)
R1 ssmdrv; C:\Windows\System32\DRIVERS\ssmdrv.sys [28520 2013-07-29] (Avira GmbH)
U5 AppMgmt; C:\Windows\system32\svchost.exe [20992 2009-07-14] (Microsoft Corporation)
S3 catchme; \??\C:\Users\*Mein Name*\AppData\Local\Temp\catchme.sys [X]
S3 mdxgthkn; \??\C:\Users\*Mein Name*\AppData\Local\Temp\mdxgthkn.sys [X]

==================== NetSvcs (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. Any associated file could be listed separately to be moved.)


==================== One Month Created Files and Folders ========

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-25 15:51 - 2015-04-25 15:51 - 00001127 _____ () C:\Users\*Mein Name*\Desktop\checkup.txt
2015-04-25 15:46 - 2015-04-25 15:46 - 00852616 _____ () C:\Users\*Mein Name*\Desktop\SecurityCheck.exe
2015-04-25 13:17 - 2015-04-25 13:17 - 00000000 ____D () C:\Program Files\ESET
2015-04-25 12:46 - 2015-04-25 12:46 - 02347384 _____ (ESET) C:\Users\*Mein Name*\Desktop\esetsmartinstaller_deu.exe
2015-04-24 19:29 - 2015-04-24 19:29 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-24 14:55 - 2015-04-24 15:03 - 00000606 _____ () C:\Users\*Mein Name*\Desktop\JRT.txt
2015-04-24 14:53 - 2015-04-24 14:53 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-*Mein Name*-Windows-7-Home-Premium-(32-bit).dat
2015-04-24 14:53 - 2015-04-24 14:53 - 00000000 ____D () C:\RegBackup
2015-04-24 14:52 - 2015-04-24 14:53 - 02685461 _____ (Thisisu) C:\Users\*Mein Name*\Desktop\JRT.exe
2015-04-24 14:45 - 2015-04-24 14:45 - 00001065 _____ () C:\Users\*Mein Name*\Desktop\AdwCleaner[S0].txt
2015-04-24 14:41 - 2015-04-24 14:42 - 00000000 ____D () C:\AdwCleaner
2015-04-24 14:39 - 2015-04-24 14:39 - 02224640 _____ () C:\Users\*Mein Name*\Desktop\AdwCleaner_4.202.exe
2015-04-24 14:38 - 2015-04-24 14:38 - 00001189 _____ () C:\Users\*Mein Name*\Desktop\mbam.txt
2015-04-23 20:29 - 2015-04-23 20:29 - 00009202 _____ () C:\ComboFix.txt
2015-04-23 20:20 - 2015-04-23 20:29 - 00000000 ____D () C:\Windows\erdnt
2015-04-23 20:20 - 2015-04-23 20:29 - 00000000 ____D () C:\Qoobox
2015-04-23 20:20 - 2011-06-26 08:45 - 00256000 _____ () C:\Windows\PEV.exe
2015-04-23 20:20 - 2010-11-07 19:20 - 00208896 _____ () C:\Windows\MBR.exe
2015-04-23 20:20 - 2009-04-20 06:56 - 00060416 _____ (NirSoft) C:\Windows\NIRCMD.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00518144 _____ (SteelWerX) C:\Windows\SWREG.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00406528 _____ (SteelWerX) C:\Windows\SWSC.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00098816 _____ () C:\Windows\sed.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00080412 _____ () C:\Windows\grep.exe
2015-04-23 20:20 - 2000-08-31 02:00 - 00068096 _____ () C:\Windows\zip.exe
2015-04-23 20:18 - 2015-04-23 20:18 - 05619466 ____R (Swearware) C:\Users\*Mein Name*\Desktop\ComboFix.exe
2015-04-22 10:21 - 2015-04-22 10:22 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\*Mein Name*\Desktop\tdsskiller.exe
2015-04-21 13:44 - 2015-04-21 13:58 - 00035283 _____ () C:\Users\*Mein Name*\Desktop\Addition.txt
2015-04-21 13:43 - 2015-04-25 15:52 - 00010864 _____ () C:\Users\*Mein Name*\Desktop\FRST.txt
2015-04-21 13:43 - 2015-04-25 15:52 - 00000000 ____D () C:\FRST
2015-04-21 13:40 - 2015-04-21 13:40 - 01139200 _____ (Farbar) C:\Users\*Mein Name*\Desktop\FRST.exe
2015-04-21 13:36 - 2015-04-24 19:46 - 00114904 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-04-21 13:36 - 2015-04-21 13:36 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-04-21 13:36 - 2014-11-21 06:14 - 00075480 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-04-21 13:36 - 2014-11-21 06:14 - 00051928 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-04-21 13:34 - 2015-04-21 13:36 - 00000892 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-04-21 13:34 - 2014-11-21 06:14 - 00023256 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-04-14 20:36 - 2015-04-14 20:36 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Acrobat Reader DC.lnk
2015-04-10 11:37 - 2015-03-23 03:36 - 00860160 _____ (Microsoft Corporation) C:\Windows\system32\appraiser.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00630784 _____ (Microsoft Corporation) C:\Windows\system32\invagent.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00576000 _____ (Microsoft Corporation) C:\Windows\system32\generaltel.dll
2015-04-10 11:37 - 2015-03-23 03:36 - 00331264 _____ (Microsoft Corporation) C:\Windows\system32\devinv.dll
2015-04-10 11:37 - 2015-03-23 03:35 - 00202752 _____ (Microsoft Corporation) C:\Windows\system32\aepdu.dll
2015-04-10 11:37 - 2015-03-23 03:35 - 00026112 _____ (Microsoft Corporation) C:\Windows\system32\acmigration.dll
2015-04-10 11:37 - 2015-03-23 03:30 - 00896000 _____ (Microsoft Corporation) C:\Windows\system32\aeinv.dll
2015-04-09 22:58 - 2015-04-09 23:00 - 00000341 _____ () C:\Users\*Mein Name*\AppData\Local\Hinweis GPDI...txt

==================== One Month Modified Files and Folders =======

(If an entry is included in the fixlist, the file\folder will be moved.)

2015-04-25 15:38 - 2011-04-21 14:25 - 01527312 _____ () C:\Windows\WindowsUpdate.log
2015-04-25 15:27 - 2011-04-21 14:29 - 00001098 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-04-25 15:09 - 2012-10-23 18:06 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-04-25 11:26 - 2011-04-21 14:29 - 00001094 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-04-25 10:06 - 2009-07-14 06:34 - 00015984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-04-25 10:06 - 2009-07-14 06:34 - 00015984 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-04-25 09:58 - 2009-07-14 06:53 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-04-25 09:58 - 2009-07-14 06:39 - 00202547 _____ () C:\Windows\setupact.log
2015-04-25 01:18 - 2011-04-22 10:47 - 00000000 ____D () C:\Eigene Programme
2015-04-24 19:29 - 2013-07-29 13:50 - 00002012 _____ () C:\Users\Public\Desktop\Avira Control Center.lnk
2015-04-24 10:06 - 2010-07-06 22:23 - 01612484 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-04-23 20:48 - 2010-07-07 20:31 - 00139328 _____ () C:\Windows\PFRO.log
2015-04-23 20:29 - 2009-07-14 04:37 - 00000000 __RHD () C:\Users\Default
2015-04-23 20:29 - 2009-07-14 04:37 - 00000000 ___RD () C:\Users\Public
2015-04-23 20:28 - 2009-07-14 04:04 - 00000215 _____ () C:\Windows\system.ini
2015-04-21 13:36 - 2011-07-25 13:34 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Roaming\Malwarebytes
2015-04-20 12:18 - 2013-04-23 21:24 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Local\Warframe
2015-04-20 11:35 - 2014-10-27 20:28 - 00000000 ____D () C:\Program Files\Java
2015-04-20 11:34 - 2014-10-27 20:29 - 00096680 _____ (Oracle Corporation) C:\Windows\system32\WindowsAccessBridge.dll
2015-04-20 00:20 - 2011-07-21 14:31 - 00000000 ____D () C:\Games
2015-04-19 14:59 - 2012-02-11 00:14 - 00000000 ____D () C:\ProgramData\PopCap Games
2015-04-15 23:09 - 2011-12-09 03:20 - 00347464 _____ () C:\Windows\system32\PnkBstrB.xtr
2015-04-15 23:04 - 2011-12-09 03:18 - 00281872 _____ () C:\Windows\system32\PnkBstrB.ex0
2015-04-15 23:04 - 2011-12-09 03:18 - 00138904 _____ () C:\Users\*Mein Name*\AppData\Roaming\PnkBstrK.sys
2015-04-15 21:48 - 2011-07-21 15:22 - 00000000 ____D () C:\Program Files\Common Files\Steam
2015-04-15 20:37 - 2013-10-20 21:41 - 00000000 ____D () C:\Windows\system32\MRT
2015-04-15 20:34 - 2010-07-06 23:03 - 125832184 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-04-14 22:10 - 2012-07-15 12:41 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerApp.exe
2015-04-14 22:10 - 2011-07-29 16:36 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\system32\FlashPlayerCPLApp.cpl
2015-04-14 20:43 - 2014-09-21 17:43 - 00000000 ____D () C:\Users\*Mein Name*\AppData\Local\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\ProgramData\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\Program Files\Common Files\Adobe
2015-04-14 20:36 - 2010-07-06 23:27 - 00000000 ____D () C:\Program Files\Adobe
2015-04-11 13:10 - 2009-07-14 04:37 - 00000000 ____D () C:\Windows\AppCompat
2015-04-10 11:38 - 2014-12-13 00:20 - 00000000 ____D () C:\Windows\system32\appraiser
2015-04-10 11:38 - 2014-07-30 12:28 - 00000000 ___SD () C:\Windows\system32\CompatTel

==================== Files in the root of some directories =======

2011-12-09 03:18 - 2015-04-15 23:04 - 0138904 _____ () C:\Users\*Mein Name*\AppData\Roaming\PnkBstrK.sys
2015-04-09 22:58 - 2015-04-09 23:00 - 0000341 _____ () C:\Users\*Mein Name*\AppData\Local\Hinweis GPDI...txt
2011-07-30 17:21 - 2015-03-01 17:16 - 0007601 _____ () C:\Users\*Mein Name*\AppData\Local\Resmon.ResmonCfg
2014-01-04 15:35 - 2014-01-04 15:37 - 0000142 _____ () C:\ProgramData\Einige Securom Elemente noch vorhanden.txt

Some content of TEMP:
====================
C:\Users\*Mein Name*\AppData\Local\temp\avgnt.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\explorer.exe => File is digitally signed
C:\Windows\system32\winlogon.exe => File is digitally signed
C:\Windows\system32\wininit.exe => File is digitally signed
C:\Windows\system32\svchost.exe => File is digitally signed
C:\Windows\system32\services.exe => File is digitally signed
C:\Windows\system32\User32.dll => File is digitally signed
C:\Windows\system32\userinit.exe => File is digitally signed
C:\Windows\system32\rpcss.dll => File is digitally signed
C:\Windows\system32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-04-24 12:38

==================== End Of Log ============================
         

--- --- ---


--- --- ---

Fertig



Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren

• Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  
• Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
• Klicke auf OK.
  Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
• Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.

• Schließe alle offenen Programme.
• Starte die delfix.exe mit einem Doppelklick.
• Setze vor jede Funktion ein Häkchen.
• Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.


Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.

Huch. So weit waren wir schon? Und ich fing schon an zu hetzen. Sorry deswegen.

Okay.
Defogger hatten wir so weit ich weiß ja nicht verwendet. Also übersprang ich die Option.

Comboxfix entfernt wie es da stand. Scheint alles geklappt zu haben.

Delfix habe ich wie du beschrieben hast angewendet. Scheint auch alles geklappt zu haben.
Wird davon noch das Log benötigt?

Ansonsten hoffe ich, dass ich nicht irgendwo einen Fehler gemacht und somit meinen System geschadet habe.

Also dann vielen Dank für die Zeit und Mühe die du mir hier geschenkt hast. Vielen Dank ebenfalls für deine Tips.

Ich hoffe ich werde in nächster Zeit eure Dienste nicht wieder in Anspruch nehmen müssen, aus verständlichen Gründen, oder?