Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: Windows 7: Avira Antivir Live CD erkennt 27 Trojaner

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 26.05.2015, 15:12   #1
xter
 
Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



Hallo erstmal
Ich habe gerade eben meinen PC mit einer Live-CD von Avira Antivir gescannt und war ziemlich überrascht von den 27 Funden. Ich hoffe ihr könnt mir helfen diese loszuwerden.

Hier das Logfile von Avira:
Code:
ATTFilter
Scan Report

Start: 12:08:07 	End: 13:37:50
Detections: 	27
Files treated: 	27
Files scanned: 	204786
Engine version: 	8.3.30.38
VDF version: 	7.11.235.54
Scan status: 	Finished


Update Report

Update finished successfully!Updated files:
vbase021.vdf 7.11.233.14 -> 7.11.233.89
vbase022.vdf 7.11.233.15 -> 7.11.233.149
vbase023.vdf 7.11.233.16 -> 7.11.234.176
vbase024.vdf 7.11.233.17 -> 7.11.234.231
vbase025.vdf 7.11.233.18 -> 7.11.234.232
vbase026.vdf 7.11.233.19 -> 7.11.234.233
vbase027.vdf 7.11.233.20 -> 7.11.234.234
vbase028.vdf 7.11.233.21 -> 7.11.234.235
vbase029.vdf 7.11.233.22 -> 7.11.234.236
vbase030.vdf 7.11.233.23 -> 7.11.234.237
vbase031.vdf 7.11.233.78 -> 7.11.235.54
aevdf.dat 7.11.233.78 -> 7.11.235.54
aecore.so 8.3.4.0 -> 8.3.6.2
aeheur.so 8.1.4.1684 -> 8.1.4.1702
aepack.so 8.4.0.76 -> 8.4.0.80
aescript.so 8.2.2.64 -> 8.2.2.66
aesbx.so 8.2.20.34 -> 8.2.21.0
aeset.dat 8.3.30.34 -> 8.3.30.38
Update finished successfully


Details

Detection: 	/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/inbox.vir
Virus name: 	TR/Crypt.ZPACK.145794 	(File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/inbox.vir" was already renamed.)
Virus Type: 	trojan 	

Detection: 	/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/trash.vir
Virus name: 	TR/Crypt.Xpack.188403 	(File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.gmx.net/trash.vir" was already renamed.)
Virus Type: 	trojan 	

Detection: 	/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/inbox.vir
Virus name: 	TR/Kryptik.gtap 	(File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/inbox.vir" was already renamed.)
Virus Type: 	trojan 	

Detection: 	/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/trash.vir
Virus name: 	TR/Kryptik.gtap 	(File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web-1.de/trash.vir" was already renamed.)
Virus Type: 	trojan 	

Detection: 	/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/inbox.vir
Virus name: 	TR/Kryptik.gtap 	(File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/inbox.vir" was already renamed.)
Virus Type: 	trojan 	

Detection: 	/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/trash.vir
Virus name: 	TR/Kryptik.gtap 	(File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/imap.web.de/trash.vir" was already renamed.)
Virus Type: 	trojan 	

Detection: 	/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox.vir
Virus name: 	TR/Dldr.JRAF 	(File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox.vir" was already renamed.)
Virus Type: 	trojan 	

Detection: 	/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/trash.vir
Virus name: 	TR/Dldr.JRAF 	(File "/target/C:/users/thomas/appdata/roaming/thunderbird/profiles/thunderb.default/imapmail/vwl.uni-freiburg.de/trash.vir" was already renamed.)
Virus Type: 	trojan 	

Detection: 	/target/E:/profile/thunderb.default/imapmail/imap.gmx.net/inbox
Virus name: 	TR/Matsnu.A.113 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/profile/thunderb.default/imapmail/imap.gmx.net/trash
Virus name: 	TR/Matsnu.A.113 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/profile/thunderb.default/imapmail/imap.web-1.de/inbox
Virus name: 	TR/Downloader.Gen7 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/profile/thunderb.default/imapmail/imap.web-1.de/trash
Virus name: 	TR/Matsnu.A.166 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/profile/thunderb.default/imapmail/imap.web.de/inbox
Virus name: 	TR/Crypt.Xpack.87566 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/profile/thunderb.default/imapmail/imap.web.de/trash
Virus name: 	TR/Crypt.ZPACK.Gen7 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/profile/thunderb.default/imapmail/vwl.uni-freiburg.de/inbox
Virus name: 	TR/Dldr.JRAF 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/profile/thunderb.default/imapmail/vwl.uni-freiburg.de/trash
Virus name: 	TR/Dldr.JRAF 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-05 235354/backup files 2.zip
Virus name: 	TR/Dldr.JRAF 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 1.zip
Virus name: 	TR/Yakes.ceky 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 15.zip
Virus name: 	TR/Crypt.EPACK.33213 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 18.zip
Virus name: 	TR/Downloader.Gen7 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-12 224719/backup files 19.zip
Virus name: 	TR/Yakes.ceky 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 1.zip
Virus name: 	TR/Yakes.ceky 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 6.zip
Virus name: 	TR/Cabhot.vuze 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-19 190000/backup files 7.zip
Virus name: 	TR/Matsnu.A.260 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 1.zip
Virus name: 	TR/Matsnu.A.260 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 4.zip
Virus name: 	TR/Cabhot.vuze 	file renamed
Virus Type: 	trojan 	

Detection: 	/target/E:/thomas-pc/backup set 2015-04-05 235354/backup files 2015-04-25 161112/backup files 5.zip
Virus name: 	TR/Crypt.EPACK.33697 	file renamed
Virus Type: 	trojan
         
Defogger gab keine Fehlermeldung aus:
Code:
ATTFilter
defogger_disable by jpshortstuff (23.02.10.1)
Log created at 15:47 on 26/05/2015 (Thomas)

Checking for autostart values...
HKCU\~\Run values retrieved.
HKLM\~\Run values retrieved.

Checking for services/drivers...


-=E.O.F=-
         
FRST.txt
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015
Ran by Thomas (administrator) on THOMAS-PC on 26-05-2015 15:51:14
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(AMD) C:\Windows\System32\atiesrxx.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Cisco Systems, Inc.) C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
(GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(VIA Technologies, Inc.) C:\Windows\System32\ViakaraokeSrv.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(AddGadgets) C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
() C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
(VIA) C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe
(Spotify Ltd) C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
(Lavasoft) C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCtrlCntr.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\Browny02\BrYNSvc.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Brother Industries, Ltd.) C:\Program Files (x86)\ControlCenter4\BrCcUxSys.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
(GIGABYTE Technology Co.,Ltd.) C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe
(Oracle Corporation) C:\Program Files (x86)\PCremote\mojjre\bin\javaw.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Thunderbird\thunderbird.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Oracle Corporation) C:\Program Files (x86)\Common Files\Java\Java Update\jucheck.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4689072 2013-12-26] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Ad-Aware Browsing Protection] => C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe [558672 2013-09-11] (Lavasoft)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [EasyTuneVI] => C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] ()
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [OneDrive] => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-21] (Microsoft Corporation)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [Spotify Web Helper] => C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2022968 2015-05-25] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-26]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2014-12-21]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ET6.lnk [2015-02-22]
ShortcutTarget: ET6.lnk -> C:\Program Files (x86)\GIGABYTE\ET6\ET6SC.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-27]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Windows\Installer\{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}\OC_GURU.exe1_5588D686D23B4C9DBDFA2A7875CD3722.exe (Macrovision Corporation)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCMeterV0.4.lnk [2014-11-26]
ShortcutTarget: PCMeterV0.4.lnk -> C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe (AddGadgets)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCremote.lnk [2015-01-04]
ShortcutTarget: PCremote.lnk -> C:\Program Files (x86)\PCremote\PCremote.exe (JakuSoft)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660
FF DefaultSearchEngine: dict.cc DE-EN
FF SelectedSearchEngine: LEO Eng-Deu
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-18] ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-18] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-11-26] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\searchplugins\dictcc-de-en.xml [2015-01-29]
FF Extension: WOT - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-12]
FF Extension: Pushbullet - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\jid1-BYcQOfYfmBMd9A@jetpack.xpi [2015-04-14]
FF Extension: Dict.cc Translation - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\searchdictcc@roughael.xpi [2015-01-03]
FF Extension: Tile Tabs - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\tiletabs@DW-dev.xpi [2015-04-09]
FF Extension: Adblock Plus - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-27]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-02-07]

Chrome: 
=======
CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-26]
CHR Extension: (Google Docs) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-26]
CHR Extension: (Google Drive) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-26]
CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-26]
CHR Extension: (Google Sheets) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-26]
CHR Extension: (Avira Browser Safety) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-26]
CHR Extension: (Google Wallet) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-26]
CHR Extension: (Lavasoft NewTab) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole [2015-01-21]
CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-26]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [oejkcgajlodefenbbjdnaiahmbnnoole] - C:\Program Files (x86)\Lavasoft\AdAware SecureSearch Toolbar\chrome-newtab-search.crx [2013-09-03]
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
R3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) []
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) []
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) []
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
R2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
R2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 GPCIDrv; C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [14376 2014-08-28] ()
R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-05-26] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 WinRing0_1_2_0; \??\C:\Users\Thomas\AppData\Local\Temp\tmp4F57.tmp [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-26 15:51 - 2015-05-26 15:51 - 00020694 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-05-26 15:50 - 2015-05-26 15:51 - 00000000 ____D () C:\FRST
2015-05-26 15:50 - 2015-05-26 15:50 - 02108928 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-05-26 15:47 - 2015-05-26 15:47 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-05-26 15:43 - 2015-05-26 15:43 - 00000000 ___HD () C:\OneDriveTemp
2015-05-25 17:17 - 2015-05-25 17:17 - 00011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2015-05-25 16:58 - 2015-05-25 16:58 - 00000000 ____D () C:\Users\Thomas\Desktop\Neuer Ordner (3)
2015-05-25 14:20 - 2015-05-25 14:20 - 00003172 _____ () C:\Windows\System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90}
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\Program Files\Oracle
2015-05-25 14:20 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-25 14:20 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-25 14:18 - 2015-05-25 14:19 - 111273672 _____ (Oracle Corporation) C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe
2015-05-22 18:49 - 2015-05-25 16:56 - 00000000 ____D () C:\Users\Thomas\Desktop\Bilder mit Séverine
2015-05-19 23:29 - 2015-05-20 15:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-19 16:54 - 2015-05-19 16:54 - 00949621 _____ () C:\Users\Thomas\Desktop\WhatsApp Chat mit Séverine Sandmann.txt
2015-05-19 16:24 - 2015-05-19 16:30 - 659742720 _____ () C:\Users\Thomas\Desktop\rescue-system.iso
2015-05-18 15:15 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-16 02:39 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 02:39 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-15 12:47 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-15 12:47 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-15 12:47 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-15 12:47 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-15 12:47 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-15 12:47 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-15 12:47 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-15 12:47 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-15 12:47 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-15 12:47 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-15 12:47 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-15 12:47 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-15 12:47 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-15 12:47 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-15 12:47 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-15 12:47 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-15 12:47 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-15 12:47 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-15 12:47 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-15 12:47 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-15 12:47 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-15 12:47 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-15 12:47 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-15 12:47 - 2015-04-04 05:29 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-15 12:47 - 2015-04-04 05:29 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-15 12:47 - 2015-04-04 05:22 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:20 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:20 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-15 12:47 - 2015-04-04 05:17 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:17 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-15 12:47 - 2015-04-04 05:15 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-15 12:47 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-15 12:46 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-15 12:46 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-15 12:46 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-15 12:46 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-15 12:46 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-15 12:46 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-15 12:46 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-15 12:46 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 17:10 - 2015-05-13 17:10 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-06 23:06 - 2015-05-06 23:12 - 00000000 ____D () C:\Users\Thomas\Desktop\06.05.2015 - Yannick Garten
2015-04-28 00:34 - 2015-04-28 00:34 - 06479272 _____ (Neat Image team, ABSoft ) C:\Users\Thomas\Downloads\NeatSetup3274.exe
2015-04-28 00:34 - 2015-04-28 00:34 - 00001103 _____ () C:\Users\Thomas\Desktop\Neat Image (32-bit).lnk
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\NeatImage SL 32
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neat Image Standalone (32-bit)
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Program Files (x86)\Neat Image Standalone

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-26 15:51 - 2011-04-12 09:43 - 00698688 _____ () C:\Windows\system32\perfh007.dat
2015-05-26 15:51 - 2011-04-12 09:43 - 00148828 _____ () C:\Windows\system32\perfc007.dat
2015-05-26 15:51 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-26 15:50 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-26 15:50 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-26 15:47 - 2014-11-26 16:23 - 00000000 ____D () C:\Users\Thomas
2015-05-26 15:46 - 2014-11-26 16:23 - 02046586 _____ () C:\Windows\WindowsUpdate.log
2015-05-26 15:43 - 2015-03-04 12:00 - 00005144 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC
2015-05-26 15:43 - 2015-02-22 18:41 - 00030528 _____ () C:\Windows\GVTDrv64.sys
2015-05-26 15:43 - 2015-02-22 18:41 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref
2015-05-26 15:43 - 2015-02-22 18:40 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-05-26 15:43 - 2015-01-07 20:25 - 00000000 ____D () C:\ProgramData\Ad-Aware Browsing Protection
2015-05-26 15:43 - 2014-11-26 21:00 - 00047064 _____ () C:\Users\Thomas\Network_Meter_Data.js
2015-05-26 15:43 - 2014-11-26 20:31 - 00020607 _____ () C:\Users\Thomas\IP_Log_Data.js
2015-05-26 15:43 - 2014-11-26 20:12 - 00000000 ___RD () C:\Users\Thomas\OneDrive
2015-05-26 15:43 - 2014-11-26 16:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-26 15:43 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-26 15:43 - 2009-07-14 06:51 - 00069284 _____ () C:\Windows\setupact.log
2015-05-26 14:04 - 2014-11-27 01:32 - 00000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-26 13:24 - 2014-11-26 16:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-25 23:15 - 2014-11-28 18:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-25 22:14 - 2014-11-26 17:02 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Spotify
2015-05-25 17:17 - 2014-11-26 16:53 - 00000000 ____D () C:\Users\Thomas\.gimp-2.8
2015-05-25 16:56 - 2014-12-04 13:36 - 00000000 ____D () C:\Users\Thomas\AppData\Local\gtk-2.0
2015-05-25 15:49 - 2014-11-26 17:05 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Spotify
2015-05-25 14:41 - 2014-11-26 19:46 - 00000000 ____D () C:\Users\Thomas\.VirtualBox
2015-05-25 14:20 - 2014-11-26 19:46 - 00001076 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-05-21 22:05 - 2014-11-26 20:12 - 00002141 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-21 14:39 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-20 15:00 - 2010-11-21 05:47 - 00361018 _____ () C:\Windows\PFRO.log
2015-05-19 14:00 - 2014-11-26 20:01 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-18 14:17 - 2014-11-26 16:59 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-18 14:17 - 2014-11-26 16:59 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-18 14:14 - 2014-11-28 18:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-18 14:14 - 2014-11-28 18:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-18 14:14 - 2014-11-28 18:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-18 14:14 - 2014-11-26 20:34 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe
2015-05-17 22:05 - 2014-11-26 17:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-17 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-17 21:18 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 21:18 - 2009-07-14 06:45 - 00502448 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-16 02:42 - 2014-11-26 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-16 02:40 - 2014-11-26 18:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-15 22:51 - 2014-11-26 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 17:10 - 2014-11-24 13:06 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 13:18 - 2014-11-26 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-05-04 20:47 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-04-27 16:39 - 2015-02-06 16:27 - 00000000 ____D () C:\Users\Thomas\Desktop\Bachelorarbeit

==================== Files in the root of some directories =======

2014-11-26 20:31 - 2014-12-02 00:11 - 0000626 _____ () C:\Users\Thomas\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-11-26 20:34 - 2014-11-26 20:47 - 0000841 _____ () C:\Users\Thomas\AppData\Roaming\Drives Meter_Settings.ini
2014-11-26 20:32 - 2015-01-13 16:02 - 0000292 _____ () C:\Users\Thomas\AppData\Roaming\GPU MeterV2_Settings.ini
2014-11-26 20:32 - 2014-11-26 20:33 - 0001328 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Settings.ini
2014-11-27 01:32 - 2015-05-26 14:04 - 0000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-25 17:17 - 2015-05-25 17:17 - 0011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2014-11-26 21:24 - 2015-04-06 00:04 - 0007604 _____ () C:\Users\Thomas\AppData\Local\Resmon.ResmonCfg

Files to move or delete:
====================
C:\Users\Thomas\IP_Log_Data.js
C:\Users\Thomas\Network_Meter_Data.js


Some files in TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
C:\Users\Thomas\AppData\Local\Temp\DelayInst.exe
C:\Users\Thomas\AppData\Local\Temp\gkey.exe
C:\Users\Thomas\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.5.575.exe
C:\Users\Thomas\AppData\Local\Temp\installservice.exe
C:\Users\Thomas\AppData\Local\Temp\pkeyui.exe
C:\Users\Thomas\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Thomas\AppData\Local\Temp\sfextra.dll
C:\Users\Thomas\AppData\Local\Temp\sp-downloader.exe
C:\Users\Thomas\AppData\Local\Temp\sqlite3.dll
C:\Users\Thomas\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Thomas\AppData\Local\Temp\wabk.exe
C:\Users\Thomas\AppData\Local\Temp\_is8E1B.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-25 17:46

==================== End of log ============================
         
Addition.txt
Code:
ATTFilter
Additional scan result of Farbar Recovery Scan Tool (x64) Version: 25-05-2015
Ran by Thomas at 2015-05-26 15:51:39
Running from C:\Users\Thomas\Desktop
Boot Mode: Normal
==========================================================


==================== Accounts: =============================

Administrator (S-1-5-21-1093152027-101576897-1014639688-500 - Administrator - Disabled)
Gast (S-1-5-21-1093152027-101576897-1014639688-501 - Limited - Disabled)
Thomas (S-1-5-21-1093152027-101576897-1014639688-1000 - Administrator - Enabled) => C:\Users\Thomas

==================== Security Center ========================

(If an entry is included in the fixlist, it will be removed.)

AV: Avira Antivirus (Enabled - Up to date) {4D041356-F94D-285F-8768-AAE50FA36859}
AS: Avira Antivirus (Enabled - Up to date) {F665F2B2-DF77-27D1-BDD8-9197742422E4}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

==================== Installed Programs ======================

(Only the adware programs with "hidden" flag could be added to the fixlist to unhide them. The adware programs should be uninstalled manually.)

7-Zip 9.20 (x64 edition) (HKLM\...\{23170F69-40C1-2702-0920-000001000000}) (Version: 9.20.00.0 - Igor Pavlov)
Ad-Aware Browsing Protection (HKLM-x32\...\Ad-Aware Browsing Protection) (Version: 1.0.1.110 - Lavasoft)
Adobe Flash Player 17 NPAPI (HKLM-x32\...\Adobe Flash Player NPAPI) (Version: 17.0.0.188 - Adobe Systems Incorporated)
Adobe Reader XI (11.0.11) - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.11 - Adobe Systems Incorporated)
Ahnenblatt 2.83 (HKLM-x32\...\Ahnenblatt_is1) (Version: 2.83.0.1 - Dirk Böttcher)
AMD Catalyst Install Manager (HKLM\...\{AF88A32E-BC54-2AA3-2FC8-D63D86DF4A7A}) (Version: 8.0.881.0 - Advanced Micro Devices, Inc.)
Audacity 2.0.6 (HKLM-x32\...\Audacity_is1) (Version: 2.0.6 - Audacity Team)
Avira (HKLM-x32\...\{b5675cc4-ab8b-4945-8c1d-4c5479556d6a}) (Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG)
Avira (x32 Version: 1.1.34.19732 - Avira Operations GmbH & Co. KG) Hidden
Avira Antivirus (HKLM-x32\...\Avira Antivirus) (Version: 15.0.10.434 - Avira Operations GmbH & Co. KG)
BioShock Infinite (HKLM-x32\...\Steam App 8870) (Version:  - Irrational Games)
Brother MFL-Pro Suite MFC-J4410DW (HKLM-x32\...\{DD98C438-D769-4677-AA87-3481FA32D20C}) (Version: 2.0.0.0 - Brother Industries, Ltd.)
Capture One 6.4 (HKLM\...\CaptureOne6_is1) (Version: 6.4.65508.156 - Phase One A/S)
CDBurnerXP (HKLM\...\{7E265513-8CDA-4631-B696-F40D983F3B07}_is1) (Version: 4.5.4.5143 - CDBurnerXP)
Cisco Systems VPN Client 5.0.07.0440 (HKLM\...\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}) (Version: 5.0.7 - Cisco Systems, Inc.)
Citavi 4 (HKLM-x32\...\{CC0A85B2-734A-45B3-B678-05F6A6499AC7}) (Version: 4.5.0.11 - Swiss Academic Software)
Cities: Skylines (HKLM-x32\...\Steam App 255710) (Version:  - Colossal Order Ltd.)
CrystalDiskInfo 6.2.1 (HKLM-x32\...\CrystalDiskInfo_is1) (Version: 6.2.1 - Crystal Dew World)
Easy Tune 6 B12.1121.1 (HKLM-x32\...\InstallShield_{457D7505-D665-4F95-91C3-ECB8C56E9ACA}) (Version: 1.00.0000 - GIGABYTE)
Easy Tune 6 B12.1121.1 (x32 Version: 1.00.0000 - GIGABYTE) Hidden
Etron USB3.0 Host Controller (HKLM-x32\...\InstallShield_{DFBB738C-71D8-4DC5-B8D2-D65C37680E27}) (Version: 0.118 - Etron Technology)
Etron USB3.0 Host Controller (x32 Version: 0.118 - Etron Technology) Hidden
foobar2000 v1.3.5 (HKLM-x32\...\foobar2000) (Version: 1.3.5 - Peter Pawlowski)
GIGABYTE OC_GURU II (HKLM-x32\...\InstallShield_{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}) (Version: 1.74.0000 - GIGABYTE Technology Co.,Ltd.)
GIGABYTE OC_GURU II (x32 Version: 1.74.0000 - GIGABYTE Technology Co.,Ltd.) Hidden
GIMP 2.8.14 (HKLM\...\GIMP-2_is1) (Version: 2.8.14 - The GIMP Team)
Google Chrome (HKLM-x32\...\{DDCA236C-A28B-3979-8855-B7475BCAD806}) (Version: 66.30.49223 - Google, Inc.)
Google Earth (HKLM-x32\...\{4D2A6330-2F8B-11E3-9C40-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.27.5 - Google Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 9.5.15.1730 - Intel Corporation)
Intel(R) USB 3.0 eXtensible Host Controller Driver (HKLM-x32\...\{240C3DDD-C5E9-4029-9DF7-95650D040CF2}) (Version: 1.0.4.225 - Intel Corporation)
Java 8 Update 25 (64-bit) (HKLM\...\{26A24AE4-039D-4CA4-87B4-2F86418025F0}) (Version: 8.0.250 - Oracle Corporation)
Java 8 Update 25 (HKLM-x32\...\{26A24AE4-039D-4CA4-87B4-2F83218025F0}) (Version: 8.0.250 - Oracle Corporation)
LibreOffice 4.3.4.1 (HKLM-x32\...\{7D983A32-F645-48AB-8E38-4ACD234F40BC}) (Version: 4.3.4.1 - The Document Foundation)
Logon Screen (HKLM\...\{1730D13B-7517-4321-A88B-64627CF67CDC}_is1) (Version:  - Daniel Rebelo)
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office 365 - de-de (HKLM\...\O365HomePremRetail - de-de) (Version: 15.0.4719.1002 - Microsoft Corporation)
Microsoft OneDrive (HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\OneDriveSetup.exe) (Version: 17.3.5860.0512 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.40416.0 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729 (HKLM\...\{14297226-E0A0-3781-8911-E9D529552663}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Minecraft (HKLM-x32\...\{1C16BCA3-EBC1-49F6-8623-8FBFB9CCC872}) (Version: 1.0.3.0 - Mojang)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 31.2.0 - Mozilla)
Mozilla Thunderbird 31.7.0 (x86 de) (HKLM-x32\...\Mozilla Thunderbird 31.7.0 (x86 de)) (Version: 31.7.0 - Mozilla)
Neat Image v7.4.0 Demo Standalone (32-bit) (HKLM-x32\...\Neat Image Standalone (32-bit)_is1) (Version:  - Neat Image team, ABSoft)
Office 15 Click-to-Run Extensibility Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Licensing Component (Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Office 15 Click-to-Run Localization Component (x32 Version: 15.0.4719.1002 - Microsoft Corporation) Hidden
Oracle VM VirtualBox 4.3.28 (HKLM\...\{E8BB81BC-E67C-4750-84EE-128DA5A7ADA5}) (Version: 4.3.28 - Oracle Corporation)
PCremote (HKLM-x32\...\PCremote) (Version: 1.4 - JakuSoft)
PDF Split And Merge Basic (HKLM\...\{9A40D2F8-9458-458B-95E3-B57797C574E1}) (Version: 2.2.4 - Andrea Vacondio)
PDF-Viewer (HKLM\...\{A278382D-4F1B-4D47-9885-8523F7261E8D}_is1) (Version: 2.5.311.0 - Tracker Software Products Ltd)
Platform (x32 Version: 1.42 - VIA Technologies, Inc.) Hidden
Qualcomm Atheros Inc.(R) AR81Family Gigabit/Fast Ethernet Driver (HKLM-x32\...\{3108C217-BE83-42E4-AE9E-A56A2A92E549}) (Version: 2.1.0.21 - Qualcomm Atheros Inc.)
Revo Uninstaller 1.95 (HKLM-x32\...\Revo Uninstaller) (Version: 1.95 - VS Revo Group)
Skype™ 6.21 (HKLM-x32\...\{1845470B-EB14-4ABC-835B-E36C693DC07D}) (Version: 6.21.104 - Skype Technologies S.A.)
Spotify (HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Spotify) (Version: 1.0.5.186.ga9c24d6a - Spotify AB)
Steam (HKLM-x32\...\Steam) (Version: 2.10.91.91 - Valve Corporation)
TeamSpeak 3 Client (HKLM\...\TeamSpeak 3 Client) (Version: 3.0.16 - TeamSpeak Systems GmbH)
TeamViewer 9 (HKLM-x32\...\TeamViewer 9) (Version: 9.0.32494 - TeamViewer)
VIA Plattform-Geräte-Manager (HKLM-x32\...\InstallShield_{20D4A895-748C-4D88-871C-FDB1695B0169}) (Version: 1.42 - VIA Technologies, Inc.)
VLC media player (HKLM-x32\...\VLC media player) (Version: 2.1.5 - VideoLAN)
Windows 7 USB/DVD Download Tool (HKLM-x32\...\{CCF298AF-9CE1-4B26-B251-486E98A34789}) (Version: 1.0.30 - Microsoft Corporation)
Windows-Treiberpaket - Leaf Imaging Ltd. Image  (02/11/2010 ) (HKLM\...\A35BD68D4A1B3E191138E3C9AA417190A9468F7E) (Version: 02/11/2010  - Leaf Imaging Ltd.)

==================== Custom CLSID (Whitelisted): ==========================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{083f5ae0-2b0a-11dd-bd0b-0800200c9a66}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{25815CC0-43F4-3C75-8C3A-A139D9ADE740}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{5AB7172C-9C11-405C-8DD5-AF20F3606282}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{5b55a44a-d008-49aa-9234-86fb7709bc0a}\InprocServer32 -> C:\Windows\system32\mscoree.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{A78ED123-AB77-406B-9962-2A5D9D2F7F30}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{BBACC218-34EA-4666-9D7A-C78F2274A524}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{CB3D0F55-BC2C-4C1A-85ED-23ED75B5106B}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{F241C880-6982-4CE5-8CF7-7085BA96DA5A}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll (Microsoft Corporation)
CustomCLSID: HKU\S-1-5-21-1093152027-101576897-1014639688-1000_Classes\CLSID\{F8071786-1FD0-4A66-81A1-3CBE29274458}\InprocServer32 -> C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncApi64.dll (Microsoft Corporation)

==================== Restore Points =========================

ATTENTION: System Restore is disabled

==================== Hosts content: ===============================

(If needed Hosts: directive could be included in the fixlist to reset Hosts.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____A C:\Windows\system32\Drivers\etc\hosts

==================== Scheduled Tasks (Whitelisted) =============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

Task: {18493AC0-8A63-4389-B336-1D92ED6135B7} - System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90} => pcalua.exe -a C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe -d C:\Users\Thomas\Downloads
Task: {1E95EF8B-B3CF-48DA-ACAE-76E088C853E8} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-26] (Google Inc.)
Task: {5F2736EE-ED71-4488-BF62-BD100C3C84C7} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2014-11-26] (Google Inc.)
Task: {62093B6E-3116-4B9C-8035-0F588B18822C} - System32\Tasks\{C40D0927-D71A-45F4-8600-AE005A2E4FF8} => pcalua.exe -a "C:\Users\Thomas\Downloads\Eraser 6.0.10.2620.exe" -d C:\Users\Thomas\Downloads
Task: {6ECFD5BE-A3DC-4D73-AAAB-1962EC749502} - System32\Tasks\Adobe Flash Player Updater => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2015-05-18] (Adobe Systems Incorporated)
Task: {7F4CE648-3226-437E-9028-5CD75C4117BD} - System32\Tasks\Microsoft\Office\Office Subscription Maintenance => C:\Program Files\Microsoft Office 15\root\vfs\ProgramFilesCommonx86\Microsoft Shared\OFFICE15\OLicenseHeartbeat.exe [2015-05-19] (Microsoft Corporation)
Task: {A770A092-9852-44CD-A276-4BC7B2D2E0CE} - System32\Tasks\Microsoft\Office\Office Automatic Updates => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-14] (Microsoft Corporation)
Task: {AAF9D9C9-A304-47D2-8F54-2F8BD97217B7} - System32\Tasks\Microsoft\Windows\OC GURU => C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe [2014-10-28] (GIGABYTE Technology Co.,Ltd.)
Task: {C4E76C96-AD0D-4135-A27B-DD96E19A86A9} - System32\Tasks\Microsoft\Office\Office ClickToRun Service Monitor => C:\Program Files\Microsoft Office 15\ClientX64\OfficeC2RClient.exe [2015-04-14] (Microsoft Corporation)
Task: {D8161A5C-DBD7-4F97-8A79-605882FA8881} - System32\Tasks\PCMeter\Startup => C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe [2014-11-26] (AddGadgets)
Task: {D913D2E1-85D4-452F-A0EF-E6793C82C497} - System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC => C:\Program Files\Microsoft Office 15\Root\Office15\MsoSync.exe [2015-03-10] (Microsoft Corporation)
Task: C:\Windows\Tasks\Adobe Flash Player Updater.job => C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Loaded Modules (Whitelisted) ==============

2014-11-26 20:01 - 2014-05-20 09:19 - 00105640 _____ () C:\Program Files\Microsoft Office 15\ClientX64\ApiClient.dll
2014-11-26 18:58 - 2005-04-22 06:36 - 00143360 _____ () C:\Windows\system32\BrSNMP64.dll
2012-01-13 15:04 - 2012-01-13 15:04 - 00219760 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe
2014-11-26 16:41 - 2012-11-14 09:22 - 00078456 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\QsApoApi64.dll
2014-11-26 16:41 - 2012-11-14 09:22 - 00386168 ____R () C:\Program Files (x86)\VIA\VIAudioi\VDeck\Dts2ApoApi64.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00012520 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\CoreTempReader.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00015080 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\GetCoreTempInfoNET.dll
2014-11-26 20:30 - 2014-11-26 20:30 - 00014056 _____ () C:\Users\Thomas\AppData\Local\Microsoft\Windows Sidebar\Gadgets\All_CPU_Meter_V4.7.3.gadget\SystemInfo.dll
2012-08-06 13:07 - 2012-08-06 13:07 - 00369152 _____ () C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLI.Aspect.CrossDisplay.Graphics.Dashboard.dll
2011-03-04 13:49 - 2011-03-04 13:49 - 00202752 _____ () C:\Program Files (x86)\Cisco Systems\VPN Client\vpnapi.dll
2012-11-14 15:44 - 2012-11-14 15:44 - 02875463 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Normal.dll
2012-11-14 11:42 - 2012-11-14 11:42 - 00651331 _____ () C:\Program Files (x86)\GIGABYTE\ET6\work.dll
2012-09-17 17:25 - 2012-09-17 17:25 - 00106496 _____ () C:\Program Files (x86)\GIGABYTE\ET6\SF.dll
2008-05-07 16:22 - 2008-05-07 16:22 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\CIAMIB.dll
2012-05-08 16:01 - 2012-05-08 16:01 - 00069632 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GPTT.dll
2011-09-14 18:12 - 2011-09-14 18:12 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\ycc.dll
2010-06-24 16:50 - 2010-06-24 16:50 - 00094208 _____ () C:\Program Files (x86)\GIGABYTE\ET6\IccLibDll.dll
2011-03-01 20:00 - 2011-03-01 20:00 - 00126976 _____ () C:\Program Files (x86)\GIGABYTE\ET6\StabilityLib.dll
2011-10-18 10:26 - 2011-10-18 10:26 - 00024576 _____ () C:\Program Files (x86)\GIGABYTE\ET6\STT.dll
2012-11-14 15:00 - 2012-11-14 15:00 - 01499204 _____ () C:\Program Files (x86)\GIGABYTE\ET6\OCK.dll
2012-09-18 15:45 - 2012-09-18 15:45 - 01335362 _____ () C:\Program Files (x86)\GIGABYTE\ET6\HM.dll
2012-11-09 17:51 - 2012-11-09 17:51 - 01429582 _____ () C:\Program Files (x86)\GIGABYTE\ET6\GVTunner.dll
2003-02-14 15:11 - 2003-02-14 15:11 - 00102400 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Sound.dll
2010-06-10 16:52 - 2010-06-10 16:52 - 00110592 _____ () C:\Program Files (x86)\GIGABYTE\ET6\AMD8.dll
2010-03-12 06:40 - 2010-03-12 06:40 - 04449632 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Platform.dll
2010-03-12 06:40 - 2010-03-12 06:40 - 00423256 _____ () C:\Program Files (x86)\GIGABYTE\ET6\Device.dll
2012-11-20 18:38 - 2012-11-20 18:38 - 00311296 _____ () C:\Program Files (x86)\GIGABYTE\ET6\MFCCPU.DLL
2014-11-26 18:58 - 2009-02-27 17:38 - 00139264 ____R () C:\Program Files (x86)\Brother\BrUtilities\BrLogAPI.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 03350640 _____ () C:\Program Files (x86)\Mozilla Thunderbird\mozjs.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 00158832 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAP32V60.dll
2015-05-19 23:29 - 2015-05-19 23:29 - 00023152 _____ () C:\Program Files (x86)\Mozilla Thunderbird\NSLDAPPR32V60.dll
2014-11-26 16:36 - 2013-09-16 13:17 - 01242584 _____ () C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\ACE.dll

==================== Alternate Data Streams (Whitelisted) =========

(If an entry is included in the fixlist, only the ADS will be removed.)


==================== Safe Mode (Whitelisted) ===================

(If an item is included in the fixlist, it will be removed from the registry. The "AlternateShell" will be restored.)


==================== EXE Association (Whitelisted) ===============

(If an entry is included in the fixlist, the registry item will be restored to default or removed.)


==================== Internet Explorer trusted/restricted ===============

(If an entry is included in the fixlist, it will be removed from the registry.)


==================== Other Areas ============================

(Currently there is no automatic fix for this section.)

HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Control Panel\Desktop\\Wallpaper -> C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.2.1

==================== MSCONFIG/TASK MANAGER Error getting ==

(Currently there is no automatic fix for this section.)

MSCONFIG\startupreg: Spotify => "C:\Users\Thomas\AppData\Roaming\Spotify\Spotify.exe" -autostart
MSCONFIG\startupreg: Spotify Web Helper => "C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe"

==================== FirewallRules (Whitelisted) ===============

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

FirewallRules: [SPPSVC-In-TCP] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [SPPSVC-In-TCP-NoScope] => (Allow) %SystemRoot%\system32\sppsvc.exe
FirewallRules: [{868C0CDC-65DA-49AC-A1F2-6BFDDA2C89C3}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{1BD1A2B2-A869-4EF7-8E3B-D7EDB93AE82A}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer.exe
FirewallRules: [{23CEE1FD-936A-4506-98EA-5E99C37A376F}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{F306B483-0C4E-4FF2-BD80-74C5F1308B97}] => (Allow) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
FirewallRules: [{38FC26EE-E98A-4F73-97E2-4411B432EE9A}] => (Allow) C:\Program Files (x86)\Skype\Phone\Skype.exe
FirewallRules: [TCP Query User{2C908DCC-349F-4DE1-A735-D4342075F8A1}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{858FAFD6-071B-4747-918E-B7216F59DD7E}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [{B46A5642-828F-4332-95F7-F2DA44D54F15}] => (Allow) C:\Program Files (x86)\Brother\Brmfl12b\FAXRX.exe
FirewallRules: [{CD6C1ABC-B2F5-45AB-A118-D780458897E4}] => (Allow) C:\Program Files (x86)\Brother\Brmfl12b\FAXRX.exe
FirewallRules: [{4415A1CA-2A15-4FB4-8FC2-AABAF4289610}] => (Allow) LPort=54925
FirewallRules: [{9876341E-0FD3-493B-A3D9-FE17E2B4C5A0}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{123B2200-788A-4F2F-8145-102BEDCEFEF7}] => (Allow) C:\Program Files (x86)\Steam\Steam.exe
FirewallRules: [{FAB2983B-0E34-481C-927A-A37F369778A0}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{4000D441-7151-4E3E-A21D-5F0F0FBB4387}] => (Allow) C:\Program Files (x86)\Steam\bin\steamwebhelper.exe
FirewallRules: [{37485AC4-EFED-46D7-861A-89EAE634B670}] => (Allow) C:\Program Files\Microsoft Office 15\root\Office15\outlook.exe
FirewallRules: [{4AC3ED3E-14E5-4FDD-AB67-45D300398043}] => (Allow) C:\Users\Thomas\AppData\Local\Microsoft\SkyDrive\SkyDrive.exe
FirewallRules: [TCP Query User{99B295D4-B8AA-416E-ABA2-64B44CB6E71D}C:\program files (x86)\pc remote\pc remote\pcremote.exe] => (Allow) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [UDP Query User{0104D30B-0C24-410C-B9BD-6BB96605A62B}C:\program files (x86)\pc remote\pc remote\pcremote.exe] => (Allow) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [{E78A5DAA-7DA4-4FF7-A704-D57DF575717C}] => (Block) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [{033682DD-EB38-4EE5-B3B3-27DAECDB7146}] => (Block) C:\program files (x86)\pc remote\pc remote\pcremote.exe
FirewallRules: [TCP Query User{935720BD-85C1-4E6B-97D3-BB32EE4E5A16}C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe] => (Block) C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe
FirewallRules: [UDP Query User{75D46140-7539-43FB-A209-64BC0DDB3503}C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe] => (Block) C:\users\thomas\appdata\local\hola\firefox\app\hola_plugin.exe
FirewallRules: [TCP Query User{753A2F2A-4632-4D29-91CD-085B1093243F}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [UDP Query User{19FF9810-C30E-4BB5-AD4B-931AF788F2F1}C:\users\thomas\appdata\roaming\spotify\spotify.exe] => (Allow) C:\users\thomas\appdata\roaming\spotify\spotify.exe
FirewallRules: [TCP Query User{D5EB4939-26EE-4A68-9C38-688CBCA91483}C:\program files (x86)\pcremote\mojjre\bin\javaw.exe] => (Allow) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [UDP Query User{620ED441-6F2C-44CB-ABB6-CA2E62106FEB}C:\program files (x86)\pcremote\mojjre\bin\javaw.exe] => (Allow) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{1686B007-6F2A-4D11-BE1A-1C023CDF9EA0}] => (Block) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{9E566A22-31D9-43B4-B910-15F7D5F4B50F}] => (Block) C:\program files (x86)\pcremote\mojjre\bin\javaw.exe
FirewallRules: [{7B93A4F7-8817-4069-B342-F87046567E0E}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{5647E22E-EE4A-44E9-8E02-4EFBA294A997}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [TCP Query User{AAC701D3-A708-4DA7-9EE1-5AE17BC6859F}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [UDP Query User{B1EF69DD-51A0-4595-B586-FD80D90D50D3}C:\program files (x86)\mozilla firefox\firefox.exe] => (Allow) C:\program files (x86)\mozilla firefox\firefox.exe
FirewallRules: [TCP Query User{CA3FDC85-CCC6-4E0A-B41B-7AF5D365F013}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{DE1D455A-49AB-438B-A038-22B5FD24EA79}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [TCP Query User{A6CE0C0A-401A-4494-8537-63BE8FA0A718}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [UDP Query User{FC283BB9-E760-4735-AE9D-1D003822E500}C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe] => (Allow) C:\program files (x86)\minecraft\runtime\jre-x64\1.8.0_25\bin\javaw.exe
FirewallRules: [{6D451505-D915-4EFA-8C15-8C0DAA1B4BCD}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{3671EBD3-F019-440B-814A-406EBC73A18C}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\BioShock Infinite\Binaries\Win32\BioShockInfinite.exe
FirewallRules: [{3C113845-913E-494A-875D-92392CE2E4E8}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{806A2F9B-08A4-48B9-84A9-DE297F5320DB}] => (Allow) C:\Program Files (x86)\Steam\steamapps\common\Cities_Skylines\Cities.exe
FirewallRules: [{C2645181-F524-4335-877D-75BF4581A73F}] => (Allow) C:\Program Files (x86)\Google\Chrome\Application\chrome.exe

==================== Faulty Device Manager Devices =============

Name: Cisco Systems VPN Adapter for 64-bit Windows
Description: Cisco Systems VPN Adapter for 64-bit Windows
Class Guid: {4d36e972-e325-11ce-bfc1-08002be10318}
Manufacturer: Cisco Systems
Service: CVirtA
Problem: : This device is disabled. (Code 22)
Resolution: In Device Manager, click "Action", and then click "Enable Device". This starts the Enable Device wizard. Follow the instructions.


==================== Event log errors: =========================

Application errors:
==================
Error: (05/26/2015 03:44:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2015 01:18:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2015 01:17:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6a8
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3

Error: (05/26/2015 00:32:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2015 00:30:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6b0
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3

Error: (05/25/2015 11:21:46 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933

Error: (05/25/2015 11:21:46 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x5; CorrelationId: {DE97D441-3E5D-4AE9-A1FC-CEF5590E90C3}

Error: (05/25/2015 11:54:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/25/2015 11:52:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: Name der fehlerhaften Anwendung: OC_GURU.exe, Version: 1.7.4.1, Zeitstempel: 0x544dee07
Name des fehlerhaften Moduls: GVDisplay.dll, Version: 2.9.7.0, Zeitstempel: 0x5444cead
Ausnahmecode: 0xc0000005
Fehleroffset: 0x00003ac5
ID des fehlerhaften Prozesses: 0x6b0
Startzeit der fehlerhaften Anwendung: 0xOC_GURU.exe0
Pfad der fehlerhaften Anwendung: OC_GURU.exe1
Pfad des fehlerhaften Moduls: OC_GURU.exe2
Berichtskennung: OC_GURU.exe3

Error: (05/24/2015 11:21:37 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933


System errors:
=============
Error: (05/26/2015 03:43:17 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (05/26/2015 01:17:19 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (05/26/2015 00:30:57 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (05/25/2015 11:52:19 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (05/24/2015 10:15:56 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "WinRing0_1_2_0" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2

Error: (05/23/2015 11:56:45 PM) (Source: DCOM) (EventID: 10010) (User: )
Description: {F9717507-6651-4EDB-BFF7-AE615179BCCF}

Error: (05/22/2015 04:04:19 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.

Error: (05/22/2015 04:04:18 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.

Error: (05/22/2015 04:04:18 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.

Error: (05/22/2015 04:04:17 PM) (Source: Disk) (EventID: 11) (User: )
Description: Der Treiber hat einen Controllerfehler auf \Device\Harddisk6\DR7 gefunden.


Microsoft Office:
=========================
Error: (05/26/2015 03:44:56 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2015 01:18:57 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2015 01:17:13 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56a801d097a57e42f680C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dllc1d526bf-0398-11e5-9f3d-94de8027c9ce

Error: (05/26/2015 00:32:32 PM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/26/2015 00:30:49 PM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56b001d0979f02baff4eC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dll463f932a-0392-11e5-ba73-94de8027c9ce

Error: (05/25/2015 11:21:46 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933

Error: (05/25/2015 11:21:46 PM) (Source: Microsoft Office 15) (EventID: 2011) (User: )
Description: Office Subscription licensing exception: Error Code: 0x5; CorrelationId: {DE97D441-3E5D-4AE9-A1FC-CEF5590E90C3}

Error: (05/25/2015 11:54:02 AM) (Source: WinMgmt) (EventID: 10) (User: )
Description: //./root/CIMV2SELECT * FROM __InstanceModificationEvent WITHIN 60 WHERE TargetInstance ISA "Win32_Processor" AND TargetInstance.LoadPercentage > 990x80041003

Error: (05/25/2015 11:52:19 AM) (Source: Application Error) (EventID: 1000) (User: )
Description: OC_GURU.exe1.7.4.1544dee07GVDisplay.dll2.9.7.05444ceadc000000500003ac56b001d096d077332206C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exeC:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GVDisplay.dllbade77c8-02c3-11e5-a1db-94de8027c9ce

Error: (05/24/2015 11:21:37 PM) (Source: Office 2013 Licensing Service) (EventID: 0) (User: )
Description: Subscription licensing service failed: -2143485933


==================== Memory info =========================== 

Processor: Intel(R) Core(TM) i5-3450 CPU @ 3.10GHz
Percentage of memory in use: 30%
Total physical RAM: 8150.18 MB
Available physical RAM: 5703.33 MB
Total Pagefile: 16298.55 MB
Available Pagefile: 13267.79 MB
Total Virtual: 8192 MB
Available Virtual: 8191.81 MB

==================== Drives ================================

Drive c: () (Fixed) (Total:238.47 GB) (Free:113.38 GB) NTFS
Drive d: (UUI) (Removable) (Total:3.91 GB) (Free:3.91 GB) FAT32
Drive e: (Daten) (Fixed) (Total:481.41 GB) (Free:328.42 GB) NTFS

==================== MBR & Partition Table ==================

========================================================
Disk: 0 (MBR Code: Windows 7 or 8) (Size: 238.5 GB) (Disk ID: 1265228A)
Partition 1: (Not Active) - (Size=238.5 GB) - (Type=07 NTFS)

========================================================
Disk: 1 (MBR Code: Windows 7 or 8) (Size: 931.5 GB) (Disk ID: E7E83165)
Partition 1: (Active) - (Size=100 MB) - (Type=07 NTFS)
Partition 2: (Not Active) - (Size=481.4 GB) - (Type=07 NTFS)

========================================================
Disk: 2 (Size: 3.9 GB) (Disk ID: 6E652072)
No partition Table on disk 2.

==================== End of log ============================
         
GMER.txt
Code:
ATTFilter
GMER 2.1.19357 - hxxp://www.gmer.net
Rootkit scan 2015-05-26 15:57:16
Windows 6.1.7601 Service Pack 1 x64 \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 Crucial_CT256MX100SSD1 rev.MU01 238,47GB
Running: Gmer-19357.exe; Driver: C:\Users\Thomas\AppData\Local\Temp\uwdiipoc.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExW + 17             00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumProcessModules + 17               00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 17             00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleInformation + 42             00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                * 9
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumDeviceDrivers + 17                00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameA + 17         00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!QueryWorkingSetEx + 17                00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetDeviceDriverBaseNameW + 17         00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameW + 17               00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!EnumProcesses + 17                    00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessMemoryInfo + 17             00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetPerformanceInfo + 17               00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!QueryWorkingSet + 17                  00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleBaseNameA + 17               00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetModuleFileNameExA + 17             00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 20         00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe[1664] C:\Windows\syswow64\psapi.dll!GetProcessImageFileNameW + 31         00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                * 9
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[1808] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17                          00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17                            00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17                          00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42                          00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                * 9
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17                             00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17                      00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17                             00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17                      00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17                            00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17                                 00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17                          00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17                            00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17                               00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17                            00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17                          00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20                      00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\ET6\GUI.exe[3284] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31                      00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17        00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17          00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17        00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42        00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                * 9
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17           00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17    00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17           00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17    00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17          00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17               00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17        00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17          00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17             00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17          00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17        00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20    00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe[3448] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31    00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExW + 17      00000000772e1401 2 bytes JMP 7661b1ef C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumProcessModules + 17        00000000772e1419 2 bytes JMP 7661b31a C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 17      00000000772e1431 2 bytes JMP 76698f09 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 42      00000000772e144a 2 bytes CALL 765f4885 C:\Windows\syswow64\kernel32.dll
.text  ...                                                                                                                                * 9
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumDeviceDrivers + 17         00000000772e14dd 2 bytes JMP 76698802 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameA + 17  00000000772e14f5 2 bytes JMP 766989d8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSetEx + 17         00000000772e150d 2 bytes JMP 766986f8 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetDeviceDriverBaseNameW + 17  00000000772e1525 2 bytes JMP 76698ac2 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameW + 17        00000000772e153d 2 bytes JMP 7660fc78 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!EnumProcesses + 17             00000000772e1555 2 bytes JMP 766168bf C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessMemoryInfo + 17      00000000772e156d 2 bytes JMP 76698fc1 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetPerformanceInfo + 17        00000000772e1585 2 bytes JMP 76698b22 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!QueryWorkingSet + 17           00000000772e159d 2 bytes JMP 766986bc C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleBaseNameA + 17        00000000772e15b5 2 bytes JMP 7660fd11 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetModuleFileNameExA + 17      00000000772e15cd 2 bytes JMP 7661b2b0 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 20  00000000772e16b2 2 bytes JMP 76698e84 C:\Windows\syswow64\kernel32.dll
.text  C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe[4908] C:\Windows\syswow64\PSAPI.DLL!GetProcessImageFileNameW + 31  00000000772e16bd 2 bytes JMP 76698651 C:\Windows\syswow64\kernel32.dll

---- EOF - GMER 2.1 ----
         

Alt 26.05.2015, 15:16   #2
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



hi,

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.
__________________

__________________

Alt 26.05.2015, 15:36   #3
xter
 
Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



Mbar hat nichts gefunden:

Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.09.1.1004
www.malwarebytes.org

Database version:
  main:    v2015.05.26.04
  rootkit: v2015.05.24.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.17801
Thomas :: THOMAS-PC [administrator]

26.05.2015 16:19:22
mbar-log-2015-05-26 (16-19-22).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 363694
Time elapsed: 6 minute(s), 43 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         
TDSSKiller auch nicht:
Code:
ATTFilter
16:33:21.0078 0x0388  TDSS rootkit removing tool 3.0.0.44 Jan 22 2015 08:27:04
16:33:24.0697 0x0388  ============================================================
16:33:24.0697 0x0388  Current date / time: 2015/05/26 16:33:24.0697
16:33:24.0697 0x0388  SystemInfo:
16:33:24.0697 0x0388  
16:33:24.0697 0x0388  OS Version: 6.1.7601 ServicePack: 1.0
16:33:24.0697 0x0388  Product type: Workstation
16:33:24.0697 0x0388  ComputerName: THOMAS-PC
16:33:24.0697 0x0388  UserName: Thomas
16:33:24.0697 0x0388  Windows directory: C:\Windows
16:33:24.0697 0x0388  System windows directory: C:\Windows
16:33:24.0697 0x0388  Running under WOW64
16:33:24.0697 0x0388  Processor architecture: Intel x64
16:33:24.0697 0x0388  Number of processors: 4
16:33:24.0697 0x0388  Page size: 0x1000
16:33:24.0697 0x0388  Boot type: Normal boot
16:33:24.0698 0x0388  ============================================================
16:33:24.0989 0x0388  KLMD registered as C:\Windows\system32\drivers\27990223.sys
16:33:25.0220 0x0388  System UUID: {7E23A272-A7B0-491E-3234-B66A7D1BCB63}
16:33:28.0488 0x0388  Drive \Device\Harddisk1\DR1 - Size: 0xE8E0DB6000 ( 931.51 Gb ), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:33:28.0489 0x0388  Drive \Device\Harddisk0\DR0 - Size: 0x3B9E656000 ( 238.47 Gb ), SectorSize: 0x200, Cylinders: 0x799A, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
16:33:28.0492 0x0388  Drive \Device\Harddisk2\DR2 - Size: 0xFB500000 ( 3.93 Gb ), SectorSize: 0x200, Cylinders: 0x200, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
16:33:28.0506 0x0388  ============================================================
16:33:28.0506 0x0388  \Device\Harddisk1\DR1:
16:33:28.0506 0x0388  MBR partitions:
16:33:28.0506 0x0388  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
16:33:28.0506 0x0388  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x38432800, BlocksNum 0x3C2D3000
16:33:28.0506 0x0388  \Device\Harddisk0\DR0:
16:33:28.0506 0x0388  MBR partitions:
16:33:28.0506 0x0388  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x1DCF2000
16:33:28.0506 0x0388  \Device\Harddisk2\DR2:
16:33:28.0507 0x0388  MBR partitions:
16:33:28.0507 0x0388  ============================================================
16:33:28.0508 0x0388  C: <-> \Device\Harddisk0\DR0\Partition1
16:33:28.0509 0x0388  E: <-> \Device\Harddisk1\DR1\Partition2
16:33:28.0509 0x0388  ============================================================
16:33:28.0509 0x0388  Initialize success
16:33:28.0509 0x0388  ============================================================
16:33:43.0127 0x12cc  ============================================================
16:33:43.0127 0x12cc  Scan started
16:33:43.0127 0x12cc  Mode: Manual; SigCheck; TDLFS; 
16:33:43.0127 0x12cc  ============================================================
16:33:43.0127 0x12cc  KSN ping started
16:33:47.0583 0x12cc  KSN ping finished: true
16:33:47.0880 0x12cc  ================ Scan system memory ========================
16:33:47.0880 0x12cc  System memory - ok
16:33:47.0880 0x12cc  ================ Scan services =============================
16:33:47.0914 0x12cc  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
16:33:47.0949 0x12cc  1394ohci - ok
16:33:47.0959 0x12cc  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
16:33:47.0971 0x12cc  ACPI - ok
16:33:47.0974 0x12cc  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys
16:33:47.0987 0x12cc  AcpiPmi - ok
16:33:47.0992 0x12cc  [ FC5B75CA6A1DA31EDD4F8D53F5540B98, CDC445F2790ADFC4C5568C40D4DA8BB95CD71991665B38AEC3D84571C99C3520 ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
16:33:47.0999 0x12cc  AdobeARMservice - ok
16:33:48.0028 0x12cc  [ 00CC35F515079F5F94FABC3AC5C7D363, 7CE8B1715009602059DEDD6CBCA9C18EF079EDA344E7809813D6C0A395622B82 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
16:33:48.0038 0x12cc  AdobeFlashPlayerUpdateSvc - ok
16:33:48.0048 0x12cc  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\Windows\system32\drivers\adp94xx.sys
16:33:48.0063 0x12cc  adp94xx - ok
16:33:48.0070 0x12cc  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\Windows\system32\drivers\adpahci.sys
16:33:48.0082 0x12cc  adpahci - ok
16:33:48.0087 0x12cc  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\Windows\system32\drivers\adpu320.sys
16:33:48.0096 0x12cc  adpu320 - ok
16:33:48.0101 0x12cc  [ 4B78B431F225FD8624C5655CB1DE7B61, 198A5AF2125C7C41F531A652D200C083A55A97DC541E3C0B5B253C7329949156 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll
16:33:48.0146 0x12cc  AeLookupSvc - ok
16:33:48.0156 0x12cc  [ FA886682CFC5D36718D3E436AACF10B9, F80AB4F91AA6B5C7ECCB000D8E1BC2CF776DC3D69B3D9EBC2558C19035A6B3AB ] AFD             C:\Windows\system32\drivers\afd.sys
16:33:48.0172 0x12cc  AFD - ok
16:33:48.0176 0x12cc  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\Windows\system32\drivers\agp440.sys
16:33:48.0183 0x12cc  agp440 - ok
16:33:48.0186 0x12cc  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\Windows\System32\alg.exe
16:33:48.0197 0x12cc  ALG - ok
16:33:48.0199 0x12cc  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\Windows\system32\drivers\aliide.sys
16:33:48.0205 0x12cc  aliide - ok
16:33:48.0211 0x12cc  [ B3B263B419FC9E7B1D41E61FDAE45BD9, AB4BA2472BB56B4BEB8B18D95B9F44BBF0B7FBF3C3914F5549CD24C5E4428664 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
16:33:48.0230 0x12cc  AMD External Events Utility - ok
16:33:48.0233 0x12cc  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\Windows\system32\drivers\amdide.sys
16:33:48.0239 0x12cc  amdide - ok
16:33:48.0243 0x12cc  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\Windows\system32\drivers\amdk8.sys
16:33:48.0251 0x12cc  AmdK8 - ok
16:33:48.0408 0x12cc  [ 9A6E9363F7A5E5A06629D9DDC76EE6B5, F97553FF6D79CDA5A1B445E4A8F8799D9F5EE8BF31B11869DE0294C562845F7E ] amdkmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
16:33:48.0586 0x12cc  amdkmdag - ok
16:33:48.0601 0x12cc  [ 957A4C13E1981B1701E600EF1E823C68, F8760C09F09F347D607FBE8A4F67E8B35CB82B5168954B04E8EB10B73412A609 ] amdkmdap        C:\Windows\system32\DRIVERS\atikmpag.sys
16:33:48.0615 0x12cc  amdkmdap - ok
16:33:48.0619 0x12cc  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
16:33:48.0627 0x12cc  AmdPPM - ok
16:33:48.0631 0x12cc  [ 6EC6D772EAE38DC17C14AED9B178D24B, B4FB936B31B1265B8CC6B426C64965C34D0CCF1638E645ACD65E88F4AFFC57A6 ] amdsata         C:\Windows\system32\drivers\amdsata.sys
16:33:48.0639 0x12cc  amdsata - ok
16:33:48.0644 0x12cc  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
16:33:48.0653 0x12cc  amdsbs - ok
16:33:48.0655 0x12cc  [ 1142A21DB581A84EA5597B03A26EBAA0, F94EB140D0CD068760D7EB081FF75154C75DAC75E5E24B6DE4E4F9CE65A70343 ] amdxata         C:\Windows\system32\drivers\amdxata.sys
16:33:48.0662 0x12cc  amdxata - ok
16:33:48.0682 0x12cc  [ D908096B873B940BB438CE63BA35BD1E, F1C79C907E6CDBC2770C16AFFAE0D6F9B9B7DA21F5074D602AC5FE1597975748 ] AntiVirMailService C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe
16:33:48.0701 0x12cc  AntiVirMailService - ok
16:33:48.0710 0x12cc  [ EC705D6ED3A7F3D9AE42F6239707D9FE, B50F6BB0FC308E7403B1807DF2AAF87BEDE0B044128C580970A26801CCABC43F ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
16:33:48.0721 0x12cc  AntiVirSchedulerService - ok
16:33:48.0730 0x12cc  [ EC705D6ED3A7F3D9AE42F6239707D9FE, B50F6BB0FC308E7403B1807DF2AAF87BEDE0B044128C580970A26801CCABC43F ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
16:33:48.0740 0x12cc  AntiVirService - ok
16:33:48.0760 0x12cc  [ 0F3D12E5FAE0082DB3F306095CA6B027, 726D054357031F45B43C87D798E84FA93439ECA6C691EB8C76FE524B50C25B32 ] AntiVirWebService C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe
16:33:48.0783 0x12cc  AntiVirWebService - ok
16:33:48.0787 0x12cc  [ 90C53BD47979FB8814F465A08B885102, 5EDFC1909FC1FF9133A534DFCC5408CF3A777AC41FB21FAD375436E3D86C02EC ] AppID           C:\Windows\system32\drivers\appid.sys
16:33:48.0797 0x12cc  AppID - ok
16:33:48.0800 0x12cc  [ 72D4757510FDA69D729169C00AFC211E, FB9686D0D94EE7C19A3994C29E8331A6EC3020B2980B2CC75F72F3AB25512C15 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
16:33:48.0807 0x12cc  AppIDSvc - ok
16:33:48.0810 0x12cc  [ 9D2A2369AB4B08A4905FE72DB104498F, D6FA1705018BABABFA2362E05691A0D6408D14DE7B76129B16D0A1DAD6378E58 ] Appinfo         C:\Windows\System32\appinfo.dll
16:33:48.0819 0x12cc  Appinfo - ok
16:33:48.0824 0x12cc  [ 4ABA3E75A76195A3E38ED2766C962899, E2001ACD44DA270B8289DA362D26416676301773AB22616C211F31CF2E7869AA ] AppMgmt         C:\Windows\System32\appmgmts.dll
16:33:48.0834 0x12cc  AppMgmt - ok
16:33:48.0838 0x12cc  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\Windows\system32\drivers\arc.sys
16:33:48.0845 0x12cc  arc - ok
16:33:48.0849 0x12cc  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\Windows\system32\drivers\arcsas.sys
16:33:48.0856 0x12cc  arcsas - ok
16:33:48.0867 0x12cc  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
16:33:48.0875 0x12cc  aspnet_state - ok
16:33:48.0878 0x12cc  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
16:33:48.0898 0x12cc  AsyncMac - ok
16:33:48.0901 0x12cc  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\Windows\system32\drivers\atapi.sys
16:33:48.0907 0x12cc  atapi - ok
16:33:48.0911 0x12cc  [ B0790FF0E25B7A2674296052F2162C1A, 930D1A09E93117E081C532D6EDB1E870736AE3806D13AE7F0C7748FD4EAB3D89 ] AtiHDAudioService C:\Windows\system32\drivers\AtihdW76.sys
16:33:48.0963 0x12cc  AtiHDAudioService - ok
16:33:48.0976 0x12cc  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
16:33:48.0995 0x12cc  AudioEndpointBuilder - ok
16:33:49.0008 0x12cc  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\Windows\System32\Audiosrv.dll
16:33:49.0024 0x12cc  AudioSrv - ok
16:33:49.0029 0x12cc  [ 43B6D229C7DBA9F0FC0FC0C318DB5350, F5A525DBD71FC4A323E92839C6D27F323FB304B7E9FFA35E89E9B419570AA4C8 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
16:33:49.0037 0x12cc  avgntflt - ok
16:33:49.0042 0x12cc  [ 626D1BAD7A1975A8FEE8876A8AD0EEA7, 59772746A2DF3B7E8D021756B8A64569AC8468CA1C802EB594494224354F1E60 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
16:33:49.0049 0x12cc  avipbb - ok
16:33:49.0055 0x12cc  [ 0D32033DCB359FD98B4C3513EF849FE6, 5870D67526BC29D888DAF8DBAB04B1E97ED5C7C51484ED400A5E65D0EB61576A ] Avira.OE.ServiceHost C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
16:33:49.0062 0x12cc  Avira.OE.ServiceHost - ok
16:33:49.0065 0x12cc  [ 390184FAD8FCC1B6DA25AEBAE928C3B6, 537B0E0FAE080B55D70E990BBA0F7F22903CA340F6A42039BAD617A8ECF59119 ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
16:33:49.0072 0x12cc  avkmgr - ok
16:33:49.0075 0x12cc  [ 13253E5E3B6BDF945B63B336A8C9489B, 671C716E43F89D4BDDAA2BE045CDEBBB569C85BC2BA334E1F550187B79A7740D ] avnetflt        C:\Windows\system32\DRIVERS\avnetflt.sys
16:33:49.0081 0x12cc  avnetflt - ok
16:33:49.0085 0x12cc  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\Windows\System32\AxInstSV.dll
16:33:49.0103 0x12cc  AxInstSV - ok
16:33:49.0112 0x12cc  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\Windows\system32\drivers\bxvbda.sys
16:33:49.0127 0x12cc  b06bdrv - ok
16:33:49.0134 0x12cc  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
16:33:49.0145 0x12cc  b57nd60a - ok
16:33:49.0150 0x12cc  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\Windows\System32\bdesvc.dll
16:33:49.0159 0x12cc  BDESVC - ok
16:33:49.0162 0x12cc  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\Windows\system32\drivers\Beep.sys
16:33:49.0182 0x12cc  Beep - ok
16:33:49.0196 0x12cc  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\Windows\System32\bfe.dll
16:33:49.0215 0x12cc  BFE - ok
16:33:49.0231 0x12cc  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\Windows\System32\qmgr.dll
16:33:49.0295 0x12cc  BITS - ok
16:33:49.0298 0x12cc  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
16:33:49.0306 0x12cc  blbdrive - ok
16:33:49.0309 0x12cc  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
16:33:49.0318 0x12cc  bowser - ok
16:33:49.0320 0x12cc  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
16:33:49.0329 0x12cc  BrFiltLo - ok
16:33:49.0331 0x12cc  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
16:33:49.0340 0x12cc  BrFiltUp - ok
16:33:49.0345 0x12cc  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\Windows\System32\browser.dll
16:33:49.0355 0x12cc  Browser - ok
16:33:49.0361 0x12cc  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\Windows\System32\Drivers\Brserid.sys
16:33:49.0374 0x12cc  Brserid - ok
16:33:49.0377 0x12cc  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
16:33:49.0386 0x12cc  BrSerWdm - ok
16:33:49.0389 0x12cc  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
16:33:49.0398 0x12cc  BrUsbMdm - ok
16:33:49.0400 0x12cc  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
16:33:49.0407 0x12cc  BrUsbSer - ok
16:33:49.0413 0x12cc  [ DB109DA005B6FE2A350C5DD7CA768DFD, 241A0BFAEFB1B165C00EE75E8CA382B5935F5DF447DAD5AE9022B2B78317668E ] BrYNSvc         C:\Program Files (x86)\Browny02\BrYNSvc.exe
16:33:49.0420 0x12cc  BrYNSvc - detected UnsignedFile.Multi.Generic ( 1 )
16:33:51.0956 0x12cc  Detect skipped due to KSN trusted
16:33:51.0956 0x12cc  BrYNSvc - ok
16:33:51.0960 0x12cc  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
16:33:51.0971 0x12cc  BTHMODEM - ok
16:33:51.0975 0x12cc  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\Windows\system32\bthserv.dll
16:33:51.0997 0x12cc  bthserv - ok
16:33:52.0001 0x12cc  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
16:33:52.0022 0x12cc  cdfs - ok
16:33:52.0027 0x12cc  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys
16:33:52.0036 0x12cc  cdrom - ok
16:33:52.0039 0x12cc  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\Windows\System32\certprop.dll
16:33:52.0060 0x12cc  CertPropSvc - ok
16:33:52.0063 0x12cc  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\Windows\system32\drivers\circlass.sys
16:33:52.0072 0x12cc  circlass - ok
16:33:52.0080 0x12cc  [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS            C:\Windows\system32\CLFS.sys
16:33:52.0093 0x12cc  CLFS - ok
16:33:52.0140 0x12cc  [ 42C5B8010D47EF3F4BAE6D1B427E80F4, 721C24522C43D50081EA01FD521D68EB365B91561CCF2E7AD1F091FBD61E67FB ] ClickToRunSvc   C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe
16:33:52.0186 0x12cc  ClickToRunSvc - ok
16:33:52.0193 0x12cc  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
16:33:52.0200 0x12cc  clr_optimization_v2.0.50727_32 - ok
16:33:52.0205 0x12cc  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
16:33:52.0213 0x12cc  clr_optimization_v2.0.50727_64 - ok
16:33:52.0221 0x12cc  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
16:33:52.0230 0x12cc  clr_optimization_v4.0.30319_32 - ok
16:33:52.0234 0x12cc  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
16:33:52.0244 0x12cc  clr_optimization_v4.0.30319_64 - ok
16:33:52.0246 0x12cc  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
16:33:52.0254 0x12cc  CmBatt - ok
16:33:52.0256 0x12cc  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\Windows\system32\drivers\cmdide.sys
16:33:52.0263 0x12cc  cmdide - ok
16:33:52.0272 0x12cc  [ 27667A788130A7F7A5858DE27572E6D7, 5501D80BCCB7A811ECCED3828DFD0A5D948BBED8504E9BCC4A3BFB840DD41CBC ] CNG             C:\Windows\system32\Drivers\cng.sys
16:33:52.0288 0x12cc  CNG - ok
16:33:52.0291 0x12cc  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
16:33:52.0298 0x12cc  Compbatt - ok
16:33:52.0300 0x12cc  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
16:33:52.0309 0x12cc  CompositeBus - ok
16:33:52.0311 0x12cc  COMSysApp - ok
16:33:52.0314 0x12cc  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\Windows\system32\drivers\crcdisk.sys
16:33:52.0320 0x12cc  crcdisk - ok
16:33:52.0326 0x12cc  [ 1CD76A83B9E8E9A5A3519B39E28354D9, F9931743B99820FFBFB13136DFFD92F86802D543F9D8478648CDC554FB38899D ] CryptSvc        C:\Windows\system32\cryptsvc.dll
16:33:52.0337 0x12cc  CryptSvc - ok
16:33:52.0347 0x12cc  [ 54DA3DFD29ED9F1619B6F53F3CE55E49, 9177C6907A983296BF188892A894B668A09FFA058FD56B50FE12940D54B0FA5E ] CSC             C:\Windows\system32\drivers\csc.sys
16:33:52.0363 0x12cc  CSC - ok
16:33:52.0376 0x12cc  [ 3AB183AB4D2C79DCF459CD2C1266B043, 72B0187EBA9DC74E61EC5CB3DC24058DDB768843E865801894AAEAA211610C56 ] CscService      C:\Windows\System32\cscsvc.dll
16:33:52.0395 0x12cc  CscService - ok
16:33:52.0398 0x12cc  [ 44BDDEB03C84A1C993C992FFB5700357, 29080E9A434BB2A932783B0B5104BC9E3C514A0FFB387123B75F4F4045E353BC ] CVirtA          C:\Windows\system32\DRIVERS\CVirtA64.sys
16:33:52.0403 0x12cc  CVirtA - ok
16:33:52.0428 0x12cc  [ 98C413E1A2FB6E5A4C101C25B3D0B275, 86C02211285F1807A6B276F07C56DE1A54BD5947E513884D8D971A22F4362849 ] CVPND           C:\Program Files (x86)\Cisco Systems\VPN Client\cvpnd.exe
16:33:52.0455 0x12cc  CVPND - ok
16:33:52.0463 0x12cc  [ 79AF0E203D089AF442A3F70ED00A37FB, BF28BF9AEE23A3052D5ADA6C1B4C255C5F09DED69BB88D2CA3C011D2C3CFA8C1 ] CVPNDRVA        C:\Windows\system32\Drivers\CVPNDRVA.sys
16:33:52.0473 0x12cc  CVPNDRVA - ok
16:33:52.0486 0x12cc  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] DcomLaunch      C:\Windows\system32\rpcss.dll
16:33:52.0514 0x12cc  DcomLaunch - ok
16:33:52.0521 0x12cc  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\Windows\System32\defragsvc.dll
16:33:52.0546 0x12cc  defragsvc - ok
16:33:52.0550 0x12cc  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
16:33:52.0573 0x12cc  DfsC - ok
16:33:52.0580 0x12cc  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\Windows\system32\dhcpcore.dll
16:33:52.0605 0x12cc  Dhcp - ok
16:33:52.0608 0x12cc  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\Windows\system32\drivers\discache.sys
16:33:52.0630 0x12cc  discache - ok
16:33:52.0633 0x12cc  [ 9819EEE8B5EA3784EC4AF3B137A5244C, 571BC886E87C888DA96282E381A746D273B58B9074E84D4CA91275E26056D427 ] Disk            C:\Windows\system32\drivers\disk.sys
16:33:52.0640 0x12cc  Disk - ok
16:33:52.0643 0x12cc  [ 5DB085A8A6600BE6401F2B24EECB5415, 5FC5C7C1B4DB7BF6EFD0992E91DB41FD047E90D1ABA0B8F868CB72557F88FB13 ] dmvsc           C:\Windows\system32\drivers\dmvsc.sys
16:33:52.0652 0x12cc  dmvsc - ok
16:33:52.0656 0x12cc  [ 05CB5910B3CA6019FC3CCA815EE06FFB, 8FA532ED500BB1F08E8034A6125BDD53B74D5E6AB0A83A6185B07AAFCD90AA82 ] DNE             C:\Windows\system32\DRIVERS\dne64x.sys
16:33:52.0663 0x12cc  DNE - ok
16:33:52.0669 0x12cc  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
16:33:52.0680 0x12cc  Dnscache - ok
16:33:52.0687 0x12cc  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\Windows\System32\dot3svc.dll
16:33:52.0711 0x12cc  dot3svc - ok
16:33:52.0716 0x12cc  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\Windows\system32\dps.dll
16:33:52.0738 0x12cc  DPS - ok
16:33:52.0740 0x12cc  [ 9B19F34400D24DF84C858A421C205754, 967AF267B4124BADA8F507CEBF25F2192D146A4D63BE71B45BFC03C5DA7F21A7 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys
16:33:52.0747 0x12cc  drmkaud - ok
16:33:52.0764 0x12cc  [ 87CE5C8965E101CCCED1F4675557E868, 077D98F0F130B2FC710208BA34016EF2B2506EE2BD71740B228145E34A3046F1 ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys
16:33:52.0787 0x12cc  DXGKrnl - ok
16:33:52.0791 0x12cc  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\Windows\System32\eapsvc.dll
16:33:52.0813 0x12cc  EapHost - ok
16:33:52.0865 0x12cc  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\Windows\system32\drivers\evbda.sys
16:33:52.0925 0x12cc  ebdrv - ok
16:33:52.0930 0x12cc  [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] EFS             C:\Windows\System32\lsass.exe
16:33:52.0938 0x12cc  EFS - ok
16:33:52.0952 0x12cc  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe
16:33:52.0973 0x12cc  ehRecvr - ok
16:33:52.0977 0x12cc  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\Windows\ehome\ehsched.exe
16:33:52.0986 0x12cc  ehSched - ok
16:33:52.0996 0x12cc  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\Windows\system32\drivers\elxstor.sys
16:33:53.0010 0x12cc  elxstor - ok
16:33:53.0013 0x12cc  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
16:33:53.0020 0x12cc  ErrDev - ok
16:33:53.0023 0x12cc  [ 84486624268E078255BC7AA47F0960BC, EC2540698B974572F0AC4A93D57C63295BAF66BF50F7416B9DFF5DE790EBDBE7 ] etdrv           C:\Windows\etdrv.sys
16:33:53.0029 0x12cc  etdrv - ok
16:33:53.0032 0x12cc  [ FD291A75ECAF197F07BD2040C2A7322A, B4DE1B8A75928C8E6DF870A7B6F286EAA0B9A5D9443E99B66633F8B60013AC67 ] EtronHub3       C:\Windows\system32\Drivers\EtronHub3.sys
16:33:53.0040 0x12cc  EtronHub3 - ok
16:33:53.0043 0x12cc  [ DDE9068F9BAC0210195F217AA39B9276, 3AE8CE03B0F93EF6006B46F8DFD5523F6C1951D98FB9A411EA90261C368A453F ] EtronXHCI       C:\Windows\system32\Drivers\EtronXHCI.sys
16:33:53.0051 0x12cc  EtronXHCI - ok
16:33:53.0061 0x12cc  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\Windows\system32\es.dll
16:33:53.0088 0x12cc  EventSystem - ok
16:33:53.0094 0x12cc  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\Windows\system32\drivers\exfat.sys
16:33:53.0117 0x12cc  exfat - ok
16:33:53.0123 0x12cc  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\Windows\system32\drivers\fastfat.sys
16:33:53.0146 0x12cc  fastfat - ok
16:33:53.0159 0x12cc  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\Windows\system32\fxssvc.exe
16:33:53.0177 0x12cc  Fax - ok
16:33:53.0181 0x12cc  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\Windows\system32\drivers\fdc.sys
16:33:53.0189 0x12cc  fdc - ok
16:33:53.0191 0x12cc  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\Windows\system32\fdPHost.dll
16:33:53.0212 0x12cc  fdPHost - ok
16:33:53.0215 0x12cc  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\Windows\system32\fdrespub.dll
16:33:53.0236 0x12cc  FDResPub - ok
16:33:53.0239 0x12cc  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
16:33:53.0246 0x12cc  FileInfo - ok
16:33:53.0249 0x12cc  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys
16:33:53.0269 0x12cc  Filetrace - ok
16:33:53.0272 0x12cc  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
16:33:53.0279 0x12cc  flpydisk - ok
16:33:53.0286 0x12cc  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
16:33:53.0296 0x12cc  FltMgr - ok
16:33:53.0316 0x12cc  [ E612E86FA15EA1EF9A52433A2743C447, 8A66164541D2EE2334B6DE3995C31138EA85E3A06BC7FD901E60D345E4E1E8A8 ] FontCache       C:\Windows\system32\FntCache.dll
16:33:53.0343 0x12cc  FontCache - ok
16:33:53.0347 0x12cc  [ A8B7F3818AB65695E3A0BB3279F6DCE6, 89FCF10F599767E67A1E011753E34DA44EAA311F105DBF69549009ED932A60F0 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
16:33:53.0353 0x12cc  FontCache3.0.0.0 - ok
16:33:53.0356 0x12cc  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys
16:33:53.0362 0x12cc  FsDepends - ok
16:33:53.0365 0x12cc  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
16:33:53.0371 0x12cc  Fs_Rec - ok
16:33:53.0377 0x12cc  [ 1F7B25B858FA27015169FE95E54108ED, 72DD12E924AA7273B3E4BDD2A2C581DECE304C8EF3D44EA79ABB032F3F95DCE5 ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
16:33:53.0388 0x12cc  fvevol - ok
16:33:53.0392 0x12cc  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
16:33:53.0399 0x12cc  gagp30kx - ok
16:33:53.0402 0x12cc  [ 7907E14F9BCF3A4689C9A74A1A873CB6, 17927B93B2D6AB4271C158F039CAE2D60591D6A14458F5A5690AEC86F5D54229 ] gdrv            C:\Windows\gdrv.sys
16:33:53.0407 0x12cc  gdrv - ok
16:33:53.0410 0x12cc  [ 5D4DF0BAC74E9AC62AF6BC99440B050B, 655110646BFF890C448C0951E11132DC3592BDA6E080696341B930D090224723 ] GPCIDrv         C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys
16:33:53.0414 0x12cc  GPCIDrv - ok
16:33:53.0428 0x12cc  [ 277BBC7E1AA1EE957F573A10ECA7EF3A, 2EE60B924E583E847CC24E78B401EF95C69DB777A5B74E1EC963E18D47B94D24 ] gpsvc           C:\Windows\System32\gpsvc.dll
16:33:53.0460 0x12cc  gpsvc - ok
16:33:53.0465 0x12cc  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:33:53.0471 0x12cc  gupdate - ok
16:33:53.0475 0x12cc  [ 506708142BC63DABA64F2D3AD1DCD5BF, 9C36A08D9E7932FF4DA7B5F24E6B42C92F28685B8ABE964C870E8D7670FD531A ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
16:33:53.0481 0x12cc  gupdatem - ok
16:33:53.0484 0x12cc  [ 8126331FBD4ED29EB3B356F9C905064D, A58BCE904591DD762410E99960FD956FB579C2CE78FA7BF1406075D29537EF82 ] GVTDrv64        C:\Windows\GVTDrv64.sys
16:33:53.0490 0x12cc  GVTDrv64 - ok
16:33:53.0492 0x12cc  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
16:33:53.0500 0x12cc  hcw85cir - ok
16:33:53.0507 0x12cc  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
16:33:53.0522 0x12cc  HdAudAddService - ok
16:33:53.0526 0x12cc  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
16:33:53.0536 0x12cc  HDAudBus - ok
16:33:53.0539 0x12cc  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\Windows\system32\drivers\HidBatt.sys
16:33:53.0546 0x12cc  HidBatt - ok
16:33:53.0550 0x12cc  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
16:33:53.0560 0x12cc  HidBth - ok
16:33:53.0563 0x12cc  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\Windows\system32\drivers\hidir.sys
16:33:53.0572 0x12cc  HidIr - ok
16:33:53.0575 0x12cc  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\Windows\system32\hidserv.dll
16:33:53.0595 0x12cc  hidserv - ok
16:33:53.0598 0x12cc  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
16:33:53.0606 0x12cc  HidUsb - ok
16:33:53.0609 0x12cc  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\Windows\system32\kmsvc.dll
16:33:53.0631 0x12cc  hkmsvc - ok
16:33:53.0636 0x12cc  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
16:33:53.0648 0x12cc  HomeGroupListener - ok
16:33:53.0654 0x12cc  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
16:33:53.0664 0x12cc  HomeGroupProvider - ok
16:33:53.0667 0x12cc  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
16:33:53.0674 0x12cc  HpSAMD - ok
16:33:53.0689 0x12cc  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
16:33:53.0709 0x12cc  HTTP - ok
16:33:53.0712 0x12cc  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
16:33:53.0718 0x12cc  hwpolicy - ok
16:33:53.0722 0x12cc  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
16:33:53.0730 0x12cc  i8042prt - ok
16:33:53.0739 0x12cc  [ 3DF4395A7CF8B7A72A5F4606366B8C2D, 483588B8FC6E05488ED631C4E1CFC398553FEBFA2CD2BB527B4DF12D19774F80 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys
16:33:53.0752 0x12cc  iaStorV - ok
16:33:53.0757 0x12cc  [ 33D4D4A24791587E83F7EE05A446FB7E, 081E48AF76D7D3A71850A4C910EFBB0B280235E2A5303178B0338230F4BA2DE2 ] ICCS            C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe
16:33:53.0763 0x12cc  ICCS - detected UnsignedFile.Multi.Generic ( 1 )
16:33:56.0304 0x12cc  Detect skipped due to KSN trusted
16:33:56.0304 0x12cc  ICCS - ok
16:33:56.0308 0x12cc  [ 1CF03C69B49ACB70C722DF92755C0C8C, C227850C133F29BB9DED91A26A22AE077FD69629CEF35B67D305F016C4BDAA81 ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe
16:33:56.0314 0x12cc  IDriverT - detected UnsignedFile.Multi.Generic ( 1 )
16:33:58.0861 0x12cc  Detect skipped due to KSN trusted
16:33:58.0861 0x12cc  IDriverT - ok
16:33:58.0876 0x12cc  [ C98A5B9D932430AD8EEBD3EF73756EF7, DF7E1D391A0F3345AD61154363922C27BD557DEEACE395A6A8A8A16BFD1BB9A8 ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
16:33:58.0897 0x12cc  idsvc - ok
16:33:58.0899 0x12cc  IEEtwCollectorService - ok
16:33:58.0902 0x12cc  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\Windows\system32\drivers\iirsp.sys
16:33:58.0909 0x12cc  iirsp - ok
16:33:58.0924 0x12cc  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\Windows\System32\ikeext.dll
16:33:58.0945 0x12cc  IKEEXT - ok
16:33:58.0960 0x12cc  [ DAE6C3099D291EED8922A65C29ABCF52, AD0A932345382824122F84AF97A8609BAE1B916A3B9FD608779A1411E37D3643 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
16:33:58.0976 0x12cc  Intel(R) Capability Licensing Service Interface - detected UnsignedFile.Multi.Generic ( 1 )
16:34:01.0527 0x12cc  Detect skipped due to KSN trusted
16:34:01.0528 0x12cc  Intel(R) Capability Licensing Service Interface - ok
16:34:01.0542 0x12cc  [ D45226E3E7A25F1E7CE8DF8FD0A2A098, 7BD74E9E3CB0A83D26BA3FD8177C6B9BA46A8695B6569CF7887FDC87947DA2D6 ] Intel(R) Capability Licensing Service TCP IP Interface C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe
16:34:01.0561 0x12cc  Intel(R) Capability Licensing Service TCP IP Interface - ok
16:34:01.0564 0x12cc  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\Windows\system32\drivers\intelide.sys
16:34:01.0571 0x12cc  intelide - ok
16:34:01.0574 0x12cc  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
16:34:01.0582 0x12cc  intelppm - ok
16:34:01.0586 0x12cc  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\Windows\system32\ipbusenum.dll
16:34:01.0608 0x12cc  IPBusEnum - ok
16:34:01.0612 0x12cc  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
16:34:01.0632 0x12cc  IpFilterDriver - ok
16:34:01.0643 0x12cc  [ A34A587FFFD45FA649FBA6D03784D257, C9A2BCD4E2A5EB6E320092A3AFD5737ECDCDA0B83EE42314A23C4978F2974767 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
16:34:01.0671 0x12cc  iphlpsvc - ok
16:34:01.0675 0x12cc  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys
16:34:01.0683 0x12cc  IPMIDRV - ok
16:34:01.0687 0x12cc  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\Windows\system32\drivers\ipnat.sys
16:34:01.0709 0x12cc  IPNAT - ok
16:34:01.0712 0x12cc  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\Windows\system32\drivers\irenum.sys
16:34:01.0722 0x12cc  IRENUM - ok
16:34:01.0724 0x12cc  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
16:34:01.0730 0x12cc  isapnp - ok
16:34:01.0736 0x12cc  [ D931D7309DEB2317035B07C9F9E6B0BD, 13AD84172ED8C6153F8A98499C01733B74E48464CE07D099508E38D409913ED3 ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
16:34:01.0747 0x12cc  iScsiPrt - ok
16:34:01.0749 0x12cc  [ B2381712638B0B714D0EEAB9A1F7C640, 113BCA8868057156EFDC7C079171308C1EBA4F979C85EB1265F42F95A499B086 ] iusb3hcs        C:\Windows\system32\DRIVERS\iusb3hcs.sys
16:34:01.0755 0x12cc  iusb3hcs - ok
16:34:01.0762 0x12cc  [ FD2C6457232E95C014DAD21DEBC64867, 4CC4F488A2555761208D8401265788281B6EC76A8F16C8E115778E571450B90B ] iusb3hub        C:\Windows\system32\DRIVERS\iusb3hub.sys
16:34:01.0772 0x12cc  iusb3hub - ok
16:34:01.0787 0x12cc  [ F6A2B5D030BE7EDF8ADC12C9A40825A8, 03EFAFD6B7801D83D7689435DED8DC321D153AAC4FD69D46ED8C9D7E7F56B44A ] iusb3xhc        C:\Windows\system32\DRIVERS\iusb3xhc.sys
16:34:01.0805 0x12cc  iusb3xhc - ok
16:34:01.0810 0x12cc  [ 52069AEB42D3D0F97CBCA1085EBF55E6, ADB2EFFF563B3FE113FCD156FD1E469BC24FC1D68AFEDCA21306F76592C9FF88 ] jhi_service     C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
16:34:01.0818 0x12cc  jhi_service - ok
16:34:01.0821 0x12cc  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
16:34:01.0827 0x12cc  kbdclass - ok
16:34:01.0830 0x12cc  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
16:34:01.0838 0x12cc  kbdhid - ok
16:34:01.0840 0x12cc  [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] KeyIso          C:\Windows\system32\lsass.exe
16:34:01.0847 0x12cc  KeyIso - ok
16:34:01.0850 0x12cc  [ C93EB3A92540830168F2057ECA7DE49A, 91DAEAD52B517E1E7CE9AAAE478493732156AA3122E6D16F7E8BD37116BB501C ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
16:34:01.0858 0x12cc  KSecDD - ok
16:34:01.0862 0x12cc  [ 43F45C59A472993E5063F2DB2D22C509, E21B48733619B49272F46E01432D76072AC9241F55CDF08E84AF6277E3BF972A ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys
16:34:01.0870 0x12cc  KSecPkg - ok
16:34:01.0873 0x12cc  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys
16:34:01.0893 0x12cc  ksthunk - ok
16:34:01.0901 0x12cc  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\Windows\system32\msdtckrm.dll
16:34:01.0927 0x12cc  KtmRm - ok
16:34:01.0931 0x12cc  [ 7867CACBF7B23AD04F5D18657BF15FA2, 153763A0C4A347526BCC2A502B5B0BC323AEC4035F1D7A8C85479FEDA0AD8A0C ] L1C             C:\Windows\system32\DRIVERS\L1C62x64.sys
16:34:01.0939 0x12cc  L1C - ok
16:34:01.0944 0x12cc  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\Windows\system32\srvsvc.dll
16:34:01.0968 0x12cc  LanmanServer - ok
16:34:01.0972 0x12cc  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
16:34:01.0994 0x12cc  LanmanWorkstation - ok
16:34:01.0998 0x12cc  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
16:34:02.0019 0x12cc  lltdio - ok
16:34:02.0026 0x12cc  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\Windows\System32\lltdsvc.dll
16:34:02.0053 0x12cc  lltdsvc - ok
16:34:02.0055 0x12cc  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\Windows\System32\lmhsvc.dll
16:34:02.0077 0x12cc  lmhosts - ok
16:34:02.0085 0x12cc  [ 3DE66F47365AA8CEB18B1EE272F4FEBA, 8DDD6AB4AEDE3B2FEA0D3B63DD24E3F3422D6ADE067756A3919FCED53C349167 ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
16:34:02.0096 0x12cc  LMS - ok
16:34:02.0101 0x12cc  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
16:34:02.0108 0x12cc  LSI_FC - ok
16:34:02.0112 0x12cc  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\Windows\system32\drivers\lsi_sas.sys
16:34:02.0119 0x12cc  LSI_SAS - ok
16:34:02.0122 0x12cc  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
16:34:02.0129 0x12cc  LSI_SAS2 - ok
16:34:02.0133 0x12cc  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
16:34:02.0140 0x12cc  LSI_SCSI - ok
16:34:02.0144 0x12cc  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\Windows\system32\drivers\luafv.sys
16:34:02.0166 0x12cc  luafv - ok
16:34:02.0169 0x12cc  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll
16:34:02.0178 0x12cc  Mcx2Svc - ok
16:34:02.0181 0x12cc  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\Windows\system32\drivers\megasas.sys
16:34:02.0187 0x12cc  megasas - ok
16:34:02.0193 0x12cc  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
16:34:02.0204 0x12cc  MegaSR - ok
16:34:02.0208 0x12cc  [ E0EF6C1399A9B1AAA0B28590411BED04, 10C193D1ED434A6DC2AD8C450012B9AF1C848A0A0B3B775F13495648FB77E009 ] MEIx64          C:\Windows\system32\DRIVERS\TeeDriverx64.sys
16:34:02.0214 0x12cc  MEIx64 - ok
16:34:02.0218 0x12cc  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\Windows\system32\mmcss.dll
16:34:02.0239 0x12cc  MMCSS - ok
16:34:02.0242 0x12cc  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\Windows\system32\drivers\modem.sys
16:34:02.0263 0x12cc  Modem - ok
16:34:02.0265 0x12cc  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\Windows\system32\DRIVERS\monitor.sys
16:34:02.0274 0x12cc  monitor - ok
16:34:02.0277 0x12cc  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
16:34:02.0284 0x12cc  mouclass - ok
16:34:02.0286 0x12cc  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
16:34:02.0294 0x12cc  mouhid - ok
16:34:02.0298 0x12cc  [ 87BCD1034CBF33537D4D4C251D39BA26, CB9DD235B62B79383F99873D75E26EEA5EE7914CA89E4B75992207F83420437F ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
16:34:02.0305 0x12cc  mountmgr - ok
16:34:02.0310 0x12cc  [ DD370A8148862150BA81A3F5C56A1E40, F56B84297BDC32266CB69D10FB2D66B8B332D60CAB7E64E4E3AC2BB749BBD31B ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
16:34:02.0318 0x12cc  MozillaMaintenance - ok
16:34:02.0323 0x12cc  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\Windows\system32\drivers\mpio.sys
16:34:02.0331 0x12cc  mpio - ok
16:34:02.0335 0x12cc  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
16:34:02.0357 0x12cc  mpsdrv - ok
16:34:02.0372 0x12cc  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\Windows\system32\mpssvc.dll
16:34:02.0405 0x12cc  MpsSvc - ok
16:34:02.0410 0x12cc  [ AE3334958D8F631FF14A0AEB3D7EFB3A, F5FD6B61F896104C20DFC43FEE2FCE6930B73F78DF876BD19A333EABB9139C6D ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
16:34:02.0419 0x12cc  MRxDAV - ok
16:34:02.0424 0x12cc  [ A5D9106A73DC88564C825D317CAC68AC, 0457B2AEA4E05A91D0E43F317894A614434D8CEBE35020785387F307E231FBE4 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
16:34:02.0433 0x12cc  mrxsmb - ok
16:34:02.0440 0x12cc  [ D711B3C1D5F42C0C2415687BE09FC163, 9B3013AC60BD2D0FF52086658BA5FF486ADE15954A552D7DD590580E8BAE3EFF ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
16:34:02.0452 0x12cc  mrxsmb10 - ok
16:34:02.0456 0x12cc  [ 9423E9D355C8D303E76B8CFBD8A5C30C, 220B33F120C2DD937FE4D5664F4B581DC0ACF78D62EB56B7720888F67B9644CC ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
16:34:02.0464 0x12cc  mrxsmb20 - ok
16:34:02.0467 0x12cc  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\Windows\system32\DRIVERS\msahci.sys
16:34:02.0473 0x12cc  msahci - ok
16:34:02.0478 0x12cc  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\Windows\system32\drivers\msdsm.sys
16:34:02.0486 0x12cc  msdsm - ok
16:34:02.0490 0x12cc  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\Windows\System32\msdtc.exe
16:34:02.0500 0x12cc  MSDTC - ok
16:34:02.0505 0x12cc  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
16:34:02.0526 0x12cc  Msfs - ok
16:34:02.0529 0x12cc  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys
16:34:02.0549 0x12cc  mshidkmdf - ok
16:34:02.0552 0x12cc  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
16:34:02.0558 0x12cc  msisadrv - ok
16:34:02.0562 0x12cc  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll
16:34:02.0585 0x12cc  MSiSCSI - ok
16:34:02.0587 0x12cc  msiserver - ok
16:34:02.0589 0x12cc  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys
16:34:02.0609 0x12cc  MSKSSRV - ok
16:34:02.0612 0x12cc  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
16:34:02.0632 0x12cc  MSPCLOCK - ok
16:34:02.0634 0x12cc  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys
16:34:02.0654 0x12cc  MSPQM - ok
16:34:02.0662 0x12cc  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys
16:34:02.0674 0x12cc  MsRPC - ok
16:34:02.0678 0x12cc  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
16:34:02.0684 0x12cc  mssmbios - ok
16:34:02.0686 0x12cc  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys
16:34:02.0706 0x12cc  MSTEE - ok
16:34:02.0709 0x12cc  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
16:34:02.0716 0x12cc  MTConfig - ok
16:34:02.0719 0x12cc  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\Windows\system32\Drivers\mup.sys
16:34:02.0726 0x12cc  Mup - ok
16:34:02.0735 0x12cc  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\Windows\system32\qagentRT.dll
16:34:02.0763 0x12cc  napagent - ok
16:34:02.0770 0x12cc  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys
16:34:02.0785 0x12cc  NativeWifiP - ok
16:34:02.0802 0x12cc  [ 79B47FD40D9A817E932F9D26FAC0A81C, 53E260B8BFC50BA45FA73BFCF4E58C233890D0EAA9DEFDCCBB55FD3EB992FF2D ] NDIS            C:\Windows\system32\drivers\ndis.sys
16:34:02.0826 0x12cc  NDIS - ok
16:34:02.0829 0x12cc  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys
16:34:02.0849 0x12cc  NdisCap - ok
16:34:02.0852 0x12cc  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
16:34:02.0872 0x12cc  NdisTapi - ok
16:34:02.0875 0x12cc  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys
16:34:02.0896 0x12cc  Ndisuio - ok
16:34:02.0900 0x12cc  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys
16:34:02.0923 0x12cc  NdisWan - ok
16:34:02.0926 0x12cc  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys
16:34:02.0946 0x12cc  NDProxy - ok
16:34:02.0949 0x12cc  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys
16:34:02.0970 0x12cc  NetBIOS - ok
16:34:02.0977 0x12cc  [ 09594D1089C523423B32A4229263F068, 7426A9B8BA27D3225928DDEFBD399650ABB90798212F56B7D12158AC22CCCE37 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys
16:34:03.0000 0x12cc  NetBT - ok
16:34:03.0003 0x12cc  [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] Netlogon        C:\Windows\system32\lsass.exe
16:34:03.0010 0x12cc  Netlogon - ok
16:34:03.0017 0x12cc  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\Windows\System32\netman.dll
16:34:03.0043 0x12cc  Netman - ok
16:34:03.0048 0x12cc  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:34:03.0058 0x12cc  NetMsmqActivator - ok
16:34:03.0061 0x12cc  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:34:03.0070 0x12cc  NetPipeActivator - ok
16:34:03.0079 0x12cc  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\Windows\System32\netprofm.dll
16:34:03.0107 0x12cc  netprofm - ok
16:34:03.0111 0x12cc  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:34:03.0119 0x12cc  NetTcpActivator - ok
16:34:03.0123 0x12cc  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
16:34:03.0132 0x12cc  NetTcpPortSharing - ok
16:34:03.0134 0x12cc  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\Windows\system32\drivers\nfrd960.sys
16:34:03.0141 0x12cc  nfrd960 - ok
16:34:03.0148 0x12cc  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\Windows\System32\nlasvc.dll
16:34:03.0160 0x12cc  NlaSvc - ok
16:34:03.0163 0x12cc  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
16:34:03.0183 0x12cc  Npfs - ok
16:34:03.0186 0x12cc  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\Windows\system32\nsisvc.dll
16:34:03.0207 0x12cc  nsi - ok
16:34:03.0210 0x12cc  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
16:34:03.0230 0x12cc  nsiproxy - ok
16:34:03.0258 0x12cc  [ B98F8C6E31CD07B2E6F71F7F648E38C0, 2FEA100B80680FBBF644CB6763738804155DF1E94A6542CAE2B2786D770D554E ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
16:34:03.0292 0x12cc  Ntfs - ok
16:34:03.0295 0x12cc  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\Windows\system32\drivers\Null.sys
16:34:03.0316 0x12cc  Null - ok
16:34:03.0320 0x12cc  [ 5D9FD91F3D38DC9DA01E3CB5FA89CD48, 7738785DE8B50D69993F4408498B812D0283FEE5C04FF5B89C20F149B44E9737 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
16:34:03.0329 0x12cc  nvraid - ok
16:34:03.0333 0x12cc  [ F7CD50FE7139F07E77DA8AC8033D1832, DA96F4B15C8165E6AE1D00E03A062C66CA3A3089E4FF0E9E11CE00B154DD12EC ] nvstor          C:\Windows\system32\drivers\nvstor.sys
16:34:03.0342 0x12cc  nvstor - ok
16:34:03.0346 0x12cc  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
16:34:03.0354 0x12cc  nv_agp - ok
16:34:03.0357 0x12cc  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
16:34:03.0365 0x12cc  ohci1394 - ok
16:34:03.0369 0x12cc  [ 30B5F9FB0C35AE6B4A0851D24CE2EE8B, 0340E77E8EC2ADC21B8DDD9C9CC95B3F4BCAFD54618A333C72D7D9587D593B83 ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
16:34:03.0378 0x12cc  ose - ok
16:34:03.0458 0x12cc  [ FE9C0029E1AF26350D9985D00520E5C8, 967079CCF7B2CBD4B48C9F076675C26AF93A1CEC26C96811F279414E34004EE6 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
16:34:03.0550 0x12cc  osppsvc - ok
16:34:03.0561 0x12cc  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
16:34:03.0575 0x12cc  p2pimsvc - ok
16:34:03.0584 0x12cc  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\Windows\system32\p2psvc.dll
16:34:03.0598 0x12cc  p2psvc - ok
16:34:03.0602 0x12cc  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\Windows\system32\drivers\parport.sys
16:34:03.0610 0x12cc  Parport - ok
16:34:03.0614 0x12cc  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\Windows\system32\drivers\partmgr.sys
16:34:03.0621 0x12cc  partmgr - ok
16:34:03.0626 0x12cc  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\Windows\System32\pcasvc.dll
16:34:03.0637 0x12cc  PcaSvc - ok
16:34:03.0642 0x12cc  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\Windows\system32\drivers\pci.sys
16:34:03.0650 0x12cc  pci - ok
16:34:03.0652 0x12cc  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\Windows\system32\drivers\pciide.sys
16:34:03.0658 0x12cc  pciide - ok
16:34:03.0664 0x12cc  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
16:34:03.0673 0x12cc  pcmcia - ok
16:34:03.0676 0x12cc  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\Windows\system32\drivers\pcw.sys
16:34:03.0682 0x12cc  pcw - ok
16:34:03.0694 0x12cc  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
16:34:03.0712 0x12cc  PEAUTH - ok
16:34:03.0735 0x12cc  [ B9B0A4299DD2D76A4243F75FD54DC680, BBF62E9628131FA396EB08D63B76D2D5FBDD61339E92B759125A066470D1C039 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll
16:34:03.0765 0x12cc  PeerDistSvc - ok
16:34:03.0788 0x12cc  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\Windows\SysWow64\perfhost.exe
16:34:03.0796 0x12cc  PerfHost - ok
16:34:03.0822 0x12cc  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\Windows\system32\pla.dll
16:34:03.0865 0x12cc  pla - ok
16:34:03.0875 0x12cc  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
16:34:03.0889 0x12cc  PlugPlay - ok
16:34:03.0892 0x12cc  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll
16:34:03.0900 0x12cc  PNRPAutoReg - ok
16:34:03.0907 0x12cc  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll
16:34:03.0918 0x12cc  PNRPsvc - ok
16:34:03.0928 0x12cc  [ 4F15D75ADF6156BF56ECED6D4A55C389, 2ADA3EA69A5D7EC2A4D2DD89178DB94EAFDDF95F07B0070D654D9F7A5C12A044 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll
16:34:03.0956 0x12cc  PolicyAgent - ok
16:34:03.0962 0x12cc  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\Windows\system32\umpo.dll
16:34:03.0986 0x12cc  Power - ok
16:34:03.0990 0x12cc  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
16:34:04.0011 0x12cc  PptpMiniport - ok
16:34:04.0014 0x12cc  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\Windows\system32\drivers\processr.sys
16:34:04.0022 0x12cc  Processor - ok
16:34:04.0027 0x12cc  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\Windows\system32\profsvc.dll
16:34:04.0038 0x12cc  ProfSvc - ok
16:34:04.0041 0x12cc  [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] ProtectedStorage C:\Windows\system32\lsass.exe
16:34:04.0048 0x12cc  ProtectedStorage - ok
16:34:04.0052 0x12cc  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
16:34:04.0073 0x12cc  Psched - ok
16:34:04.0098 0x12cc  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
16:34:04.0130 0x12cc  ql2300 - ok
16:34:04.0135 0x12cc  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
16:34:04.0143 0x12cc  ql40xx - ok
16:34:04.0149 0x12cc  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\Windows\system32\qwave.dll
16:34:04.0163 0x12cc  QWAVE - ok
16:34:04.0166 0x12cc  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
16:34:04.0176 0x12cc  QWAVEdrv - ok
16:34:04.0178 0x12cc  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
16:34:04.0199 0x12cc  RasAcd - ok
16:34:04.0202 0x12cc  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys
16:34:04.0223 0x12cc  RasAgileVpn - ok
16:34:04.0227 0x12cc  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\Windows\System32\rasauto.dll
16:34:04.0249 0x12cc  RasAuto - ok
16:34:04.0253 0x12cc  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys
16:34:04.0275 0x12cc  Rasl2tp - ok
16:34:04.0282 0x12cc  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\Windows\System32\rasmans.dll
16:34:04.0308 0x12cc  RasMan - ok
16:34:04.0312 0x12cc  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
16:34:04.0333 0x12cc  RasPppoe - ok
16:34:04.0337 0x12cc  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys
16:34:04.0358 0x12cc  RasSstp - ok
16:34:04.0365 0x12cc  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys
16:34:04.0390 0x12cc  rdbss - ok
16:34:04.0393 0x12cc  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
16:34:04.0402 0x12cc  rdpbus - ok
16:34:04.0404 0x12cc  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
16:34:04.0423 0x12cc  RDPCDD - ok
16:34:04.0429 0x12cc  [ 1B6163C503398B23FF8B939C67747683, 339A5AA7970FF34FAAB213B655860C5B0DEC5F983A4A11A088017D849F320ACE ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys
16:34:04.0439 0x12cc  RDPDR - ok
16:34:04.0442 0x12cc  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
16:34:04.0461 0x12cc  RDPENCDD - ok
16:34:04.0465 0x12cc  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
16:34:04.0485 0x12cc  RDPREFMP - ok
16:34:04.0490 0x12cc  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys
16:34:04.0501 0x12cc  RDPWD - ok
16:34:04.0506 0x12cc  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
16:34:04.0515 0x12cc  rdyboost - ok
16:34:04.0522 0x12cc  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\Windows\System32\mprdim.dll
16:34:04.0544 0x12cc  RemoteAccess - ok
16:34:04.0549 0x12cc  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
16:34:04.0573 0x12cc  RemoteRegistry - ok
16:34:04.0576 0x12cc  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
16:34:04.0598 0x12cc  RpcEptMapper - ok
16:34:04.0600 0x12cc  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\Windows\system32\locator.exe
16:34:04.0608 0x12cc  RpcLocator - ok
16:34:04.0618 0x12cc  [ 5C627D1B1138676C0A7AB2C2C190D123, C5003F2C912C5CA990E634818D3B4FD72F871900AF2948BD6C4D6400B354B401 ] RpcSs           C:\Windows\system32\rpcss.dll
16:34:04.0645 0x12cc  RpcSs - ok
16:34:04.0648 0x12cc  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
16:34:04.0670 0x12cc  rspndr - ok
16:34:04.0673 0x12cc  [ E60C0A09F997826C7627B244195AB581, E8630ED74B38B98BF584E353D992C1311BC36AB7F20A1BB66C9CD65CE1E46F8D ] s3cap           C:\Windows\system32\drivers\vms3cap.sys
16:34:04.0680 0x12cc  s3cap - ok
16:34:04.0682 0x12cc  [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] SamSs           C:\Windows\system32\lsass.exe
16:34:04.0689 0x12cc  SamSs - ok
16:34:04.0692 0x12cc  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
16:34:04.0700 0x12cc  sbp2port - ok
16:34:04.0705 0x12cc  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
16:34:04.0729 0x12cc  SCardSvr - ok
16:34:04.0731 0x12cc  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
16:34:04.0751 0x12cc  scfilter - ok
16:34:04.0769 0x12cc  [ 262F6592C3299C005FD6BEC90FC4463A, 54095E37F0B6CC677A3E9BDD40F4647C713273D197DB341063AA7F342A60C4A7 ] Schedule        C:\Windows\system32\schedsvc.dll
16:34:04.0813 0x12cc  Schedule - ok
16:34:04.0817 0x12cc  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\Windows\System32\certprop.dll
16:34:04.0838 0x12cc  SCPolicySvc - ok
16:34:04.0843 0x12cc  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
16:34:04.0854 0x12cc  SDRSVC - ok
16:34:04.0857 0x12cc  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\Windows\system32\drivers\secdrv.sys
16:34:04.0877 0x12cc  secdrv - ok
16:34:04.0880 0x12cc  [ BC617A4E1B4FA8DF523A061739A0BD87, 10C4057F6B321EB5237FF619747B74F5401BC17D15A8C7060829E8204A2297F9 ] seclogon        C:\Windows\system32\seclogon.dll
16:34:04.0901 0x12cc  seclogon - ok
16:34:04.0904 0x12cc  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\Windows\System32\sens.dll
16:34:04.0926 0x12cc  SENS - ok
16:34:04.0929 0x12cc  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\Windows\system32\sensrsvc.dll
16:34:04.0937 0x12cc  SensrSvc - ok
16:34:04.0939 0x12cc  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys
16:34:04.0946 0x12cc  Serenum - ok
16:34:04.0950 0x12cc  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\Windows\system32\DRIVERS\serial.sys
16:34:04.0958 0x12cc  Serial - ok
16:34:04.0961 0x12cc  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\Windows\system32\drivers\sermouse.sys
16:34:04.0968 0x12cc  sermouse - ok
16:34:04.0975 0x12cc  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\Windows\system32\sessenv.dll
16:34:04.0997 0x12cc  SessionEnv - ok
16:34:05.0000 0x12cc  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys
16:34:05.0000 0x12cc  sffdisk - ok
16:34:05.0000 0x12cc  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
16:34:05.0016 0x12cc  sffp_mmc - ok
16:34:05.0016 0x12cc  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys
16:34:05.0016 0x12cc  sffp_sd - ok
16:34:05.0031 0x12cc  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\Windows\system32\drivers\sfloppy.sys
16:34:05.0031 0x12cc  sfloppy - ok
16:34:05.0047 0x12cc  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\Windows\System32\ipnathlp.dll
16:34:05.0063 0x12cc  SharedAccess - ok
16:34:05.0078 0x12cc  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
16:34:05.0094 0x12cc  ShellHWDetection - ok
16:34:05.0109 0x12cc  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
16:34:05.0109 0x12cc  SiSRaid2 - ok
16:34:05.0109 0x12cc  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
16:34:05.0125 0x12cc  SiSRaid4 - ok
16:34:05.0125 0x12cc  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\Windows\system32\DRIVERS\smb.sys
16:34:05.0141 0x12cc  Smb - ok
16:34:05.0141 0x12cc  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
16:34:05.0156 0x12cc  SNMPTRAP - ok
16:34:05.0156 0x12cc  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\Windows\system32\drivers\spldr.sys
16:34:05.0172 0x12cc  spldr - ok
16:34:05.0172 0x12cc  [ B96C17B5DC1424D56EEA3A99E97428CD, AF0A85066A7983878DC1C663811CE61C6CA1912DC956184F878B7B82DB93C651 ] Spooler         C:\Windows\System32\spoolsv.exe
16:34:05.0203 0x12cc  Spooler - ok
16:34:05.0265 0x12cc  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\Windows\system32\sppsvc.exe
16:34:05.0343 0x12cc  sppsvc - ok
16:34:05.0343 0x12cc  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\Windows\system32\sppuinotify.dll
16:34:05.0375 0x12cc  sppuinotify - ok
16:34:05.0375 0x12cc  [ 441FBA48BFF01FDB9D5969EBC1838F0B, 306128F1AD489F87161A089D1BDC1542A4CB742D91A0C12A7CD1863FDB8932C0 ] srv             C:\Windows\system32\DRIVERS\srv.sys
16:34:05.0390 0x12cc  srv - ok
16:34:05.0406 0x12cc  [ B4ADEBBF5E3677CCE9651E0F01F7CC28, 726DB2283113AB2A9681E8E9F61132303D6D86E9CD034C40EE4A8C9DB29E87F7 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
16:34:05.0406 0x12cc  srv2 - ok
16:34:05.0421 0x12cc  [ 27E461F0BE5BFF5FC737328F749538C3, AFA4704ED8FFC1A0BAB40DFB81D3AE3F3D933A3C9BF54DDAF39FF9AF3646D9E6 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
16:34:05.0421 0x12cc  srvnet - ok
16:34:05.0437 0x12cc  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll
16:34:05.0453 0x12cc  SSDPSRV - ok
16:34:05.0453 0x12cc  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\Windows\system32\sstpsvc.dll
16:34:05.0484 0x12cc  SstpSvc - ok
16:34:05.0499 0x12cc  [ 5317D001B40EAF91ECA71644F1B984C6, 43F2D5E025527EE19483D0FCA1C8559740556B8F60EE1B4D6AC4BFB826F4162D ] Steam Client Service C:\Program Files (x86)\Common Files\Steam\SteamService.exe
16:34:05.0515 0x12cc  Steam Client Service - ok
16:34:05.0515 0x12cc  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\Windows\system32\drivers\stexstor.sys
16:34:05.0531 0x12cc  stexstor - ok
16:34:05.0531 0x12cc  [ DECACB6921DED1A38642642685D77DAC, 1633711CE973F818EBCCCA28538772431167C33ECDD44D1E846A9436598B52DC ] StillCam        C:\Windows\system32\DRIVERS\serscan.sys
16:34:05.0531 0x12cc  StillCam - ok
16:34:05.0546 0x12cc  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\Windows\System32\wiaservc.dll
16:34:05.0562 0x12cc  stisvc - ok
16:34:05.0562 0x12cc  [ 7785DC213270D2FC066538DAF94087E7, F09CB2895241719CA5147B2EE9F7ECBD0303AFFB5CD896F06D4D29BAAAFC207B ] storflt         C:\Windows\system32\drivers\vmstorfl.sys
16:34:05.0577 0x12cc  storflt - ok
16:34:05.0577 0x12cc  [ C40841817EF57D491F22EB103DA587CC, 5FAA2DE43BADC16A898C0C290C44C41E4411D919A95FE8C6FF45EA7A34495079 ] StorSvc         C:\Windows\system32\storsvc.dll
16:34:05.0577 0x12cc  StorSvc - ok
16:34:05.0593 0x12cc  [ D34E4943D5AC096C8EDEEBFD80D76E23, 1DD7F6F97060B5F763A04ACA1F75E59DAB09EF824FD09B83FC3C192837D006DE ] storvsc         C:\Windows\system32\drivers\storvsc.sys
16:34:05.0593 0x12cc  storvsc - ok
16:34:05.0593 0x12cc  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
16:34:05.0624 0x12cc  swenum - ok
16:34:05.0624 0x12cc  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\Windows\System32\swprv.dll
16:34:05.0655 0x12cc  swprv - ok
16:34:05.0687 0x12cc  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D, 3C13217548BE61F2BDB8BD41F77345CDDA1F97BF0AE17241C335B9807EB3DBB8 ] SysMain         C:\Windows\system32\sysmain.dll
16:34:05.0718 0x12cc  SysMain - ok
16:34:05.0733 0x12cc  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\Windows\System32\TabSvc.dll
16:34:05.0733 0x12cc  TabletInputService - ok
16:34:05.0749 0x12cc  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\Windows\System32\tapisrv.dll
16:34:05.0765 0x12cc  TapiSrv - ok
16:34:05.0780 0x12cc  [ 1BE03AC720F4D302EA01D40F588162F6, AB644862BF1D2E824FD846180DEC4E2C0FAFCC517451486DE5A92E5E78A952E4 ] TBS             C:\Windows\System32\tbssvc.dll
16:34:05.0796 0x12cc  TBS - ok
16:34:05.0827 0x12cc  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys
16:34:05.0858 0x12cc  Tcpip - ok
16:34:05.0889 0x12cc  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
16:34:05.0921 0x12cc  TCPIP6 - ok
16:34:05.0936 0x12cc  [ DF687E3D8836BFB04FCC0615BF15A519, 7C5B1E72673B4299DFC21E869F0FBB28198CA54DF4F4AF7080005F2D82467784 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
16:34:05.0952 0x12cc  tcpipreg - ok
16:34:05.0952 0x12cc  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
16:34:05.0967 0x12cc  TDPIPE - ok
16:34:05.0967 0x12cc  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys
16:34:05.0967 0x12cc  TDTCP - ok
16:34:05.0983 0x12cc  [ DDAD5A7AB24D8B65F8D724F5C20FD806, B71F2967A4EE7395E4416C1526CB85368AEA988BDD1F2C9719C48B08FAFA9661 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys
16:34:05.0999 0x12cc  tdx - ok
16:34:06.0077 0x12cc  [ 4ACFC5853A3F0C6C2F54E537C23EE90F, 47D81F471A250696A1A0D19294FC553EB88D813612A8351C89F65D7BF99C8532 ] TeamViewer9     C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
16:34:06.0155 0x12cc  TeamViewer9 - ok
16:34:06.0155 0x12cc  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
16:34:06.0170 0x12cc  TermDD - ok
16:34:06.0170 0x12cc  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\Windows\System32\termsrv.dll
16:34:06.0186 0x12cc  TermService - ok
16:34:06.0201 0x12cc  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\Windows\system32\themeservice.dll
16:34:06.0201 0x12cc  Themes - ok
16:34:06.0217 0x12cc  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\Windows\system32\mmcss.dll
16:34:06.0233 0x12cc  THREADORDER - ok
16:34:06.0233 0x12cc  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\Windows\System32\trkwks.dll
16:34:06.0264 0x12cc  TrkWks - ok
16:34:06.0264 0x12cc  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
16:34:06.0279 0x12cc  TrustedInstaller - ok
16:34:06.0295 0x12cc  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
16:34:06.0295 0x12cc  tssecsrv - ok
16:34:06.0295 0x12cc  [ D11C783E3EF9A3C52C0EBE83CC5000E9, A136C355D4C8945729163D15801364A614E23217B15F9313C85BA45BB71A74EB ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
16:34:06.0311 0x12cc  TsUsbFlt - ok
16:34:06.0311 0x12cc  [ 9CC2CCAE8A84820EAECB886D477CBCB8, 50D8AA2D7477A6618A0C31BB4D1C4887B457865FB1105E2E7B984EEFA337B804 ] TsUsbGD         C:\Windows\system32\drivers\TsUsbGD.sys
16:34:06.0326 0x12cc  TsUsbGD - ok
16:34:06.0326 0x12cc  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
16:34:06.0342 0x12cc  tunnel - ok
16:34:06.0342 0x12cc  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
16:34:06.0357 0x12cc  uagp35 - ok
16:34:06.0357 0x12cc  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
16:34:06.0389 0x12cc  udfs - ok
16:34:06.0389 0x12cc  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\Windows\system32\UI0Detect.exe
16:34:06.0404 0x12cc  UI0Detect - ok
16:34:06.0404 0x12cc  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
16:34:06.0404 0x12cc  uliagpkx - ok
16:34:06.0420 0x12cc  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\Windows\system32\DRIVERS\umbus.sys
16:34:06.0420 0x12cc  umbus - ok
16:34:06.0420 0x12cc  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\Windows\system32\drivers\umpass.sys
16:34:06.0435 0x12cc  UmPass - ok
16:34:06.0435 0x12cc  [ A293DCD756D04D8492A750D03B9A297C, 203600ED0B7F8BA4C6D6F4ED810F4DF5AB70928B06EC4131C5D8ADF628444ED1 ] UmRdpService    C:\Windows\System32\umrdp.dll
16:34:06.0451 0x12cc  UmRdpService - ok
16:34:06.0451 0x12cc  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\Windows\System32\upnphost.dll
16:34:06.0482 0x12cc  upnphost - ok
16:34:06.0482 0x12cc  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys
16:34:06.0498 0x12cc  usbccgp - ok
16:34:06.0498 0x12cc  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\Windows\system32\drivers\usbcir.sys
16:34:06.0513 0x12cc  usbcir - ok
16:34:06.0513 0x12cc  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\Windows\system32\drivers\usbehci.sys
16:34:06.0513 0x12cc  usbehci - ok
16:34:06.0529 0x12cc  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
16:34:06.0545 0x12cc  usbhub - ok
16:34:06.0545 0x12cc  [ 58E546BBAF87664FC57E0F6081E4F609, 1DD99D57369A0069654432AB5325AFD8F7D422D531E053EA05FF664BA6BDAEF9 ] usbohci         C:\Windows\system32\drivers\usbohci.sys
16:34:06.0545 0x12cc  usbohci - ok
16:34:06.0545 0x12cc  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\Windows\system32\drivers\usbprint.sys
16:34:06.0560 0x12cc  usbprint - ok
16:34:06.0560 0x12cc  [ D76510CFA0FC09023077F22C2F979D86, 5662281C6D515423255D3C262EA368DBAFC250235E535FBFA3E59D3487695439 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS
16:34:06.0576 0x12cc  USBSTOR - ok
16:34:06.0576 0x12cc  [ 81FB2216D3A60D1284455D511797DB3D, 121E52B18A1832E775EA0AE2E053BAA53E5A70E9754724B1449AE5992D63B13E ] usbuhci         C:\Windows\system32\drivers\usbuhci.sys
16:34:06.0576 0x12cc  usbuhci - ok
16:34:06.0591 0x12cc  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\Windows\System32\uxsms.dll
16:34:06.0607 0x12cc  UxSms - ok
16:34:06.0607 0x12cc  [ 4C3FAC816925F73A34AD52F1F7C0A7EA, 7E9B4F68E2ADABA3A9324DA16CF680D77CF2812D4BD0BFCFF0173CA61260A3FE ] VaultSvc        C:\Windows\system32\lsass.exe
16:34:06.0607 0x12cc  VaultSvc - ok
16:34:06.0638 0x12cc  [ 774E0B5708EC5F8FE3FAE063AD741D1E, 2392DF6EA79634F842B6B1E96988D58ECCE456361C03BB691D4002D5370D57F0 ] VBoxDrv         C:\Windows\system32\DRIVERS\VBoxDrv.sys
16:34:06.0654 0x12cc  VBoxDrv - ok
16:34:06.0654 0x12cc  [ 348A3A2F65CFF137440127A98C307102, 4152AAE06F4A992FBD57F7BB86D5ACFF3FA0A41AB0E68B0A457ECAAF83088D3E ] VBoxNetAdp      C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
16:34:06.0669 0x12cc  VBoxNetAdp - ok
16:34:06.0669 0x12cc  [ C9232E8BC7DE065C88586A6A8089C94E, DC1C7812F4D014B1106ED8E2FDBAC0D12622C75365B22E0D770F412265F52C77 ] VBoxNetFlt      C:\Windows\system32\DRIVERS\VBoxNetFlt.sys
16:34:06.0669 0x12cc  VBoxNetFlt - ok
16:34:06.0685 0x12cc  [ 79B223A37527EF773621F656310CE525, 8E0252CEC55F4D06849C13EBFA931D40C22BC3EB3D5092764F057C4DE77935E1 ] VBoxUSBMon      C:\Windows\system32\DRIVERS\VBoxUSBMon.sys
16:34:06.0685 0x12cc  VBoxUSBMon - ok
16:34:06.0685 0x12cc  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
16:34:06.0701 0x12cc  vdrvroot - ok
16:34:06.0701 0x12cc  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\Windows\System32\vds.exe
16:34:06.0732 0x12cc  vds - ok
16:34:06.0732 0x12cc  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys
16:34:06.0747 0x12cc  vga - ok
16:34:06.0747 0x12cc  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\Windows\System32\drivers\vga.sys
16:34:06.0779 0x12cc  VgaSave - ok
16:34:06.0779 0x12cc  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys
16:34:06.0779 0x12cc  vhdmp - ok
16:34:06.0794 0x12cc  [ EC1F539D72D07F42D4E72DD11B28DFDD, F1A52403D76968462D6A2C65D8D361DD75EA512579616B99D2D915F124D0FB36 ] VIAHdAudAddService C:\Windows\system32\drivers\viahduaa.sys
16:34:06.0810 0x12cc  VIAHdAudAddService - ok
16:34:06.0825 0x12cc  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\Windows\system32\drivers\viaide.sys
16:34:06.0825 0x12cc  viaide - ok
16:34:06.0825 0x12cc  [ 097A1A16F9F38715CEAA092DE626F517, 5D51D74C3264ADEA1A50F6620150B284E54C5294A548D1BC940B3B5FF5343998 ] VIAKaraokeService C:\Windows\system32\viakaraokesrv.exe
16:34:06.0841 0x12cc  VIAKaraokeService - ok
16:34:06.0841 0x12cc  [ 86EA3E79AE350FEA5331A1303054005F, 7E7D6027EB41E591633C7383A5D29A3BA8ECFC08C177D2BCF741EE27686B1691 ] vmbus           C:\Windows\system32\drivers\vmbus.sys
16:34:06.0857 0x12cc  vmbus - ok
16:34:06.0857 0x12cc  [ 7DE90B48F210D29649380545DB45A187, 09522F84285D62B961868DA98C40B82E746CA4D24A9780905673A2349D6B07F4 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
16:34:06.0857 0x12cc  VMBusHID - ok
16:34:06.0857 0x12cc  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
16:34:06.0872 0x12cc  volmgr - ok
16:34:06.0872 0x12cc  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys
16:34:06.0888 0x12cc  volmgrx - ok
16:34:06.0888 0x12cc  [ 0D08D2F3B3FF84E433346669B5E0F639, 3D6716CEC95B8861A7CC5778E91F310528DC6BEE0E57A3C8757FC675154EBDEC ] volsnap         C:\Windows\system32\drivers\volsnap.sys
16:34:06.0903 0x12cc  volsnap - ok
16:34:06.0903 0x12cc  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\Windows\system32\drivers\vsmraid.sys
16:34:06.0919 0x12cc  vsmraid - ok
16:34:06.0950 0x12cc  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\Windows\system32\vssvc.exe
16:34:06.0997 0x12cc  VSS - ok
16:34:06.0997 0x12cc  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
16:34:06.0997 0x12cc  vwifibus - ok
16:34:07.0013 0x12cc  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\Windows\system32\w32time.dll
16:34:07.0044 0x12cc  W32Time - ok
16:34:07.0044 0x12cc  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
16:34:07.0044 0x12cc  WacomPen - ok
16:34:07.0059 0x12cc  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
16:34:07.0075 0x12cc  WANARP - ok
16:34:07.0075 0x12cc  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
16:34:07.0091 0x12cc  Wanarpv6 - ok
16:34:07.0122 0x12cc  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\Windows\system32\wbengine.exe
16:34:07.0153 0x12cc  wbengine - ok
16:34:07.0153 0x12cc  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
16:34:07.0169 0x12cc  WbioSrvc - ok
16:34:07.0184 0x12cc  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\Windows\System32\wcncsvc.dll
16:34:07.0200 0x12cc  wcncsvc - ok
16:34:07.0200 0x12cc  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
16:34:07.0200 0x12cc  WcsPlugInService - ok
16:34:07.0215 0x12cc  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\Windows\system32\drivers\wd.sys
16:34:07.0215 0x12cc  Wd - ok
16:34:07.0231 0x12cc  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
16:34:07.0247 0x12cc  Wdf01000 - ok
16:34:07.0247 0x12cc  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiServiceHost  C:\Windows\system32\wdi.dll
16:34:07.0278 0x12cc  WdiServiceHost - ok
16:34:07.0278 0x12cc  [ BF1FC3F79B863C914687A737C2F3D681, B2DF47AC4931ACFB243775767B77065CC0D98778FC0243C793A3E219EB961209 ] WdiSystemHost   C:\Windows\system32\wdi.dll
16:34:07.0293 0x12cc  WdiSystemHost - ok
16:34:07.0293 0x12cc  [ 3DB6D04E1C64272F8B14EB8BC4616280, 9138642B1C19F895D4ECFD930160C80FBF15813CE63BBF4C899842C300FD3026 ] WebClient       C:\Windows\System32\webclnt.dll
16:34:07.0309 0x12cc  WebClient - ok
16:34:07.0309 0x12cc  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\Windows\system32\wecsvc.dll
16:34:07.0340 0x12cc  Wecsvc - ok
16:34:07.0340 0x12cc  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\Windows\System32\wercplsupport.dll
16:34:07.0371 0x12cc  wercplsupport - ok
16:34:07.0371 0x12cc  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\Windows\System32\WerSvc.dll
16:34:07.0387 0x12cc  WerSvc - ok
16:34:07.0403 0x12cc  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
16:34:07.0418 0x12cc  WfpLwf - ok
16:34:07.0418 0x12cc  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
16:34:07.0418 0x12cc  WIMMount - ok
16:34:07.0434 0x12cc  WinDefend - ok
16:34:07.0434 0x12cc  WinHttpAutoProxySvc - ok
16:34:07.0434 0x12cc  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll
16:34:07.0465 0x12cc  Winmgmt - ok
16:34:07.0481 0x12cc  WinRing0_1_2_0 - ok
16:34:07.0512 0x12cc  [ BCB1310604AA415C4508708975B3931E, 9D943F086D454345153A0DD426B4432532A44FD87950386B186E1CAD2AC70565 ] WinRM           C:\Windows\system32\WsmSvc.dll
16:34:07.0559 0x12cc  WinRM - ok
16:34:07.0574 0x12cc  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
16:34:07.0574 0x12cc  WinUsb - ok
16:34:07.0590 0x12cc  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\Windows\System32\wlansvc.dll
16:34:07.0621 0x12cc  Wlansvc - ok
16:34:07.0621 0x12cc  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys
16:34:07.0637 0x12cc  WmiAcpi - ok
16:34:07.0637 0x12cc  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
16:34:07.0652 0x12cc  wmiApSrv - ok
16:34:07.0652 0x12cc  WMPNetworkSvc - ok
16:34:07.0652 0x12cc  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\Windows\System32\wpcsvc.dll
16:34:07.0652 0x12cc  WPCSvc - ok
16:34:07.0668 0x12cc  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
16:34:07.0668 0x12cc  WPDBusEnum - ok
16:34:07.0683 0x12cc  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys
16:34:07.0699 0x12cc  ws2ifsl - ok
16:34:07.0699 0x12cc  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\Windows\System32\wscsvc.dll
16:34:07.0715 0x12cc  wscsvc - ok
16:34:07.0715 0x12cc  WSearch - ok
16:34:07.0761 0x12cc  [ 0814A74C853F50B354F08F83DDA9F7FB, 0A63BAA8DE451B8C2C71FEF961718E769B9BAC305C76D24048C664CB27D0DF28 ] wuauserv        C:\Windows\system32\wuaueng.dll
16:34:07.0808 0x12cc  wuauserv - ok
16:34:07.0808 0x12cc  [ D3381DC54C34D79B22CEE0D65BA91B7C, 70DC4ADCA4C0C28BB133287511E329D1B6B9B97F96CDE5B1D2F1F59FE1A965D9 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
16:34:07.0839 0x12cc  WudfPf - ok
16:34:07.0839 0x12cc  [ CF8D590BE3373029D57AF80914190682, FB9641777E90A58C063FBE95F081DC6D2F4770827DE19108A9DC3E3D6B17B4BF ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
16:34:07.0855 0x12cc  WUDFRd - ok
16:34:07.0871 0x12cc  [ 7A95C95B6C4CF292D689106BCAE49543, 9029F489E1E817CE12839B8C6656E46190497D445DC3F43C20CF96E5E6BD0691 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll
16:34:07.0886 0x12cc  wudfsvc - ok
16:34:07.0886 0x12cc  [ 9A3452B3C2A46C073166C5CF49FAD1AE, D6F95F51D8E37BA4CF403965EC08CCFEEA9EEFDBFC7752432EAEC19925BDA115 ] WwanSvc         C:\Windows\System32\wwansvc.dll
16:34:07.0902 0x12cc  WwanSvc - ok
16:34:07.0917 0x12cc  ================ Scan global ===============================
16:34:07.0917 0x12cc  [ BA0CD8C393E8C9F83354106093832C7B, 18D8A4780A2BAA6CEF7FBBBDA0EF6BF2DADF146E1E578A618DD5859E8ADBF1A8 ] C:\Windows\system32\basesrv.dll
16:34:07.0917 0x12cc  [ EA32F4EA3AE06EDD122FBCD5A489E457, C6E464170121D1714A367CFC80C5EA15D42AD34909039FDB114EAD3B878A47F6 ] C:\Windows\system32\winsrv.dll
16:34:07.0933 0x12cc  [ EA32F4EA3AE06EDD122FBCD5A489E457, C6E464170121D1714A367CFC80C5EA15D42AD34909039FDB114EAD3B878A47F6 ] C:\Windows\system32\winsrv.dll
16:34:07.0933 0x12cc  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\Windows\system32\sxssrv.dll
16:34:07.0933 0x12cc  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\Windows\system32\services.exe
16:34:07.0949 0x12cc  [ Global ] - ok
16:34:07.0949 0x12cc  ================ Scan MBR ==================================
16:34:07.0964 0x12cc  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
16:34:08.0198 0x12cc  \Device\Harddisk1\DR1 - ok
16:34:08.0198 0x12cc  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
16:34:08.0214 0x12cc  \Device\Harddisk0\DR0 - ok
16:34:08.0214 0x12cc  [ 9BD98C40DED6451F98D46C4304804C47 ] \Device\Harddisk2\DR2
16:34:08.0510 0x12cc  \Device\Harddisk2\DR2 - ok
16:34:08.0510 0x12cc  ================ Scan VBR ==================================
16:34:08.0510 0x12cc  [ 963A99C2092D8C88E38C6E054D964AA6 ] \Device\Harddisk1\DR1\Partition1
16:34:08.0541 0x12cc  \Device\Harddisk1\DR1\Partition1 - ok
16:34:08.0541 0x12cc  [ 1C6A1D5819A870B257901DC3C2D1AB13 ] \Device\Harddisk1\DR1\Partition2
16:34:08.0557 0x12cc  \Device\Harddisk1\DR1\Partition2 - ok
16:34:08.0557 0x12cc  [ E9061DDE0A5181BBD325F993B5D30DE4 ] \Device\Harddisk0\DR0\Partition1
16:34:08.0557 0x12cc  \Device\Harddisk0\DR0\Partition1 - ok
16:34:08.0557 0x12cc  ================ Scan generic autorun ======================
16:34:08.0619 0x12cc  [ 13FF4088A7D1C31C494BDEAF182D16CB, DF9015353D2C0CFF034AF240F5A1A24A606C10C17E3F024E11056AB238A6A8B8 ] C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe
16:34:08.0697 0x12cc  HDAudDeck - ok
16:34:08.0713 0x12cc  [ 8476E1C89C9D9834102EF86B651C6F39, 728D025B925FBACB45E31B4531CB05E5CA1662D99FFC97E237C2033030D8FDD7 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
16:34:08.0744 0x12cc  StartCCC - ok
16:34:08.0744 0x12cc  [ 6BA8D86746935498D64CB5CF6286F2EB, E47D1DEE39451428344233DB15412BCB486C4F6FE1D0426F20AA4C6245387926 ] C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe
16:34:08.0760 0x12cc  USB3MON - ok
16:34:08.0775 0x12cc  [ 66177D4C99FD8B578C7C56DE445E4D5D, 003D0254D7C693A72DE84CB76858F8D67D9FD62206F1B56DF7F5D0FA834C3BA7 ] C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
16:34:08.0791 0x12cc  avgnt - ok
16:34:08.0791 0x12cc  [ 887CAA31048EB8ED09A0CBD0E6F46F09, BBCED0BD4EB00C3FECFC9448223D4C441A868787877291F5489B07B43FAB65A4 ] C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe
16:34:08.0807 0x12cc  SunJavaUpdateSched - ok
16:34:08.0822 0x12cc  [ 3E04F1E482357B1FC8B088197C3D9FF8, 85524ADDC27ADC831EBBD24E079B412CFDC69E5F594BD153319087665A28D546 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
16:34:08.0853 0x12cc  Adobe ARM - ok
16:34:08.0853 0x12cc  [ 1DF3DCE54EDF5E85D15BA381ED98FAC3, 91CDEC8ADD48A40AB4D4E49B5AF0CEB01AA7A063B6C2103E16038D46C417868F ] C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe
16:34:08.0853 0x12cc  ControlCenter4 - detected UnsignedFile.Multi.Generic ( 1 )
16:34:11.0427 0x12cc  Detect skipped due to KSN trusted
16:34:11.0427 0x12cc  ControlCenter4 - ok
16:34:11.0474 0x12cc  [ 63E9C23A386FFFA84B5E03BFF9B628F0, A370962791EFC4B10548AAD31F89A2B288FBD5BDBF5749323C2D98C14DFB8B49 ] C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe
16:34:11.0537 0x12cc  BrStsMon00 - detected UnsignedFile.Multi.Generic ( 1 )
16:34:14.0111 0x12cc  Detect skipped due to KSN trusted
16:34:14.0111 0x12cc  BrStsMon00 - ok
16:34:14.0126 0x12cc  [ 38CF4E3316E7EF7329213F36D7F1C382, 61755B530DE4B4B51863F14B21E04786BB869690A9A8747D49DBBAC300F2B1B4 ] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
16:34:14.0142 0x12cc  Ad-Aware Browsing Protection - ok
16:34:14.0142 0x12cc  [ CB08561AB36857CCF74BF11475C9AEB2, 5F15F6868A719A0A84D3E0FE2BC4E76975C50FA99D642279DDA972269ADFDB8B ] C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe
16:34:14.0142 0x12cc  Avira Systray - ok
16:34:14.0157 0x12cc  [ 6A188ECFCA5A2A6F41CA145FC93F96A6, 48D70FAA4C4F6F1F6542E2C54085857CE6906A69C0412E8A08BF69010FDF07CF ] C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe
16:34:14.0157 0x12cc  EasyTuneVI - detected UnsignedFile.Multi.Generic ( 1 )
16:34:16.0731 0x12cc  Detect skipped due to KSN trusted
16:34:16.0731 0x12cc  EasyTuneVI - ok
16:34:16.0747 0x12cc  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
16:34:16.0778 0x12cc  Sidebar - ok
16:34:16.0778 0x12cc  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
16:34:16.0794 0x12cc  mctadmin - ok
16:34:16.0809 0x12cc  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
16:34:16.0841 0x12cc  Sidebar - ok
16:34:16.0841 0x12cc  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
16:34:16.0856 0x12cc  mctadmin - ok
16:34:16.0872 0x12cc  [ E3BF29CED96790CDAAFA981FFDDF53A3, 76CB27EF7B27E5636EDA9D95229519B2A2870729A0BB694F1FD11CD602BAC4DC ] C:\Program Files\Windows Sidebar\sidebar.exe
16:34:16.0903 0x12cc  Sidebar - ok
16:34:16.0919 0x12cc  [ 50E999CDFBCFEBC7B14452E35D1E4C83, 007EBBC78603F4C691FD65B60B93A0E4C0CDB5EB7D9555212E1C36B268C981D2 ] C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe
16:34:16.0934 0x12cc  OneDrive - ok
16:34:16.0965 0x12cc  [ F8C3E11AF9997093C7687B4940A73705, 5A751661AEBFCDB418D008B6F5F61DA10FCEDD50B2E461EBA2EE7960C05B3F8A ] C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe
16:34:16.0997 0x12cc  Spotify Web Helper - ok
16:34:16.0997 0x12cc  Waiting for KSN requests completion. In queue: 9
16:34:18.0011 0x12cc  Waiting for KSN requests completion. In queue: 9
16:34:19.0025 0x12cc  Waiting for KSN requests completion. In queue: 9
16:34:20.0039 0x12cc  AV detected via SS2: Avira Antivirus, C:\Program Files (x86)\Avira\AntiVir Desktop\wsctool.exe ( 15.0.10.414 ), 0x40000 ( disabled : updated )
16:34:20.0054 0x12cc  Win FW state via NFP2: enabled
16:34:22.0550 0x12cc  ============================================================
16:34:22.0550 0x12cc  Scan finished
16:34:22.0550 0x12cc  ============================================================
16:34:22.0550 0x030c  Detected object count: 0
16:34:22.0550 0x030c  Actual detected object count: 0
         
__________________

Alt 27.05.2015, 06:57   #4
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



Downloade Dir bitte Malwarebytes Anti-Malware
  • Installiere das Programm in den vorgegebenen Pfad. (Bebilderte Anleitung zu MBAM)
  • Starte Malwarebytes' Anti-Malware (MBAM).
  • Klicke im Anschluss auf Scannen, wähle den Bedrohungssuchlauf aus und klicke auf Suchlauf starten.
  • Lass am Ende des Suchlaufs alle Funde (falls vorhanden) in die Quarantäne verschieben. Klicke dazu auf Auswahl entfernen.
  • Lass deinen Rechner ggf. neu starten, um die Bereinigung abzuschließen.
  • Starte MBAM, klicke auf Verlauf und dann auf Anwendungsprotokolle.
  • Wähle das neueste Scan-Protokoll aus und klicke auf Export. Wähle Textdatei (.txt) aus und speichere die Datei als mbam.txt auf dem Desktop ab. Das Logfile von MBAM findest du hier.
  • Füge den Inhalt der mbam.txt mit deiner nächsten Antwort hinzu.


Downloade Dir bitte AdwCleaner Logo Icon AdwCleaner auf deinen Desktop.
  • Schließe alle offenen Programme und Browser. Bebilderte Anleitung zu AdwCleaner.
  • Starte die AdwCleaner.exe mit einem Doppelklick.
  • Stimme den Nutzungsbedingungen zu.
  • Klicke auf Optionen und vergewissere dich, dass die folgenden Punkte ausgewählt sind:
    • "Tracing" Schlüssel löschen
    • Winsock Einstellungen zurücksetzen
    • Proxy Einstellungen zurücksetzen
    • Internet Explorer Richtlinien zurücksetzen
    • Chrome Richtlinien zurücksetzen
    • Stelle sicher, dass alle 5 Optionen wie hier dargestellt, ausgewählt sind
  • Klicke auf Suchlauf und warte bis dieser abgeschlossen ist.
  • Klicke nun auf Löschen und bestätige auftretende Hinweise mit Ok.
  • Dein Rechner wird automatisch neu gestartet. Nach dem Neustart öffnet sich eine Textdatei. Poste mir deren Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner\AdwCleaner[Cx].txt. (x = fortlaufende Nummer).

Beende bitte Deine Schutzsoftware um eventuelle Konflikte zu vermeiden.
Bitte lade Junkware Removal Tool auf Deinen Desktop

  • Starte das Tool mit Doppelklick. Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten.
  • Drücke eine beliebige Taste, um das Tool zu starten.
  • Je nach System kann der Scan eine Weile dauern.
  • Wenn das Tool fertig ist wird das Logfile (JRT.txt) auf dem Desktop gespeichert und automatisch geöffnet.
  • Bitte poste den Inhalt der JRT.txt in Deiner nächsten Antwort.


und ein frisches FRST log bitte.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 27.05.2015, 10:59   #5
xter
 
Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



mbam.txt
Code:
ATTFilter
 Malwarebytes Anti-Malware 
www.malwarebytes.org

Suchlauf Datum: 27.05.2015
Suchlauf-Zeit: 11:21:55
Logdatei: mbam.txt
Administrator: Ja

Version: 2.01.6.1022
Malware Datenbank: v2015.05.27.02
Rootkit Datenbank: v2015.05.24.01
Lizenz: Kostenlos
Malware Schutz: Deaktiviert
Bösartiger Webseiten Schutz: Deaktiviert
Selbstschutz: Deaktiviert

Betriebssystem: Windows 7 Service Pack 1
CPU: x64
Dateisystem: NTFS
Benutzer: Thomas

Suchlauf-Art: Bedrohungs-Suchlauf
Ergebnis: Abgeschlossen
Durchsuchte Objekte: 361266
Verstrichene Zeit: 6 Min, 19 Sek

Speicher: Aktiviert
Autostart: Aktiviert
Dateisystem: Aktiviert
Archive: Aktiviert
Rootkits: Deaktiviert
Heuristik: Aktiviert
PUP: Aktiviert
PUM: Aktiviert

Prozesse: 0
(Keine schädliche Elemente gefunden)

Module: 0
(Keine schädliche Elemente gefunden)

Registrierungsschlüssel: 0
(Keine schädliche Elemente gefunden)

Registrierungswerte: 0
(Keine schädliche Elemente gefunden)

Registrierungsdaten: 0
(Keine schädliche Elemente gefunden)

Ordner: 0
(Keine schädliche Elemente gefunden)

Dateien: 1
PUP.Optional.Conduit.A, C:\Users\Thomas\AppData\Local\Temp\sp-downloader.exe, In Quarantäne, [26789afe642634025387420fdf221ce4], 

Physische Sektoren: 0
(Keine schädliche Elemente gefunden)


(end)
         
AdwCleaner[S1].txt
Code:
ATTFilter
# AdwCleaner v4.205 - Bericht erstellt 27/05/2015 um 11:44:54
# Aktualisiert 21/05/2015 von Xplode
# Datenbank : 2015-05-21.2 [Lokal]
# Betriebssystem : Windows 7 Professional Service Pack 1 (x64)
# Benutzername : Thomas - THOMAS-PC
# Gestarted von : C:\Users\Thomas\Desktop\AdwCleaner_4.205.exe
# Option : Löschen

***** [ Dienste ] *****


***** [ Dateien / Ordner ] *****

Ordner Gelöscht : C:\ProgramData\blekko toolbars
Ordner Gelöscht : C:\Program Files (x86)\Toolbar Cleaner
Ordner Gelöscht : C:\Users\Thomas\AppData\Local\Hola
Ordner Gelöscht : C:\Users\Thomas\AppData\LocalLow\adawaretb
Ordner Gelöscht : C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole

***** [ Geplante Tasks ] *****


***** [ Verknüpfungen ] *****


***** [ Registrierungsdatenbank ] *****

Schlüssel Gelöscht : HKLM\SOFTWARE\Google\Chrome\Extensions\oejkcgajlodefenbbjdnaiahmbnnoole
Schlüssel Gelöscht : HKCU\Software\OCS
Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\adawarebp
Schlüssel Gelöscht : HKLM\SOFTWARE\adawaretb
Schlüssel Gelöscht : HKLM\SOFTWARE\Toolbar Cleaner
Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\Toolbar Cleaner

***** [ Internetbrowser ] *****

-\\ Internet Explorer v11.0.9600.17801


-\\ Mozilla Firefox v38.0.1 (x86 de)


-\\ Google Chrome v43.0.2357.81

[C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : booedmolknjekdopkepjjeckmjkdpfgl
[C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : flpcjncodpafbgdpnkljologafpionhb
[C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Secure Preferences] - Gelöscht [Extension] : oejkcgajlodefenbbjdnaiahmbnnoole

*************************

AdwCleaner[R0].txt - [1254 Bytes] - [27/11/2014 01:20:21]
AdwCleaner[R1].txt - [2165 Bytes] - [27/05/2015 11:44:27]
AdwCleaner[S0].txt - [1075 Bytes] - [27/11/2014 01:21:37]
AdwCleaner[S1].txt - [2039 Bytes] - [27/05/2015 11:44:54]

########## EOF - C:\AdwCleaner\AdwCleaner[S1].txt - [2098  Bytes] ##########
         
JRT.txt
Code:
ATTFilter
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Junkware Removal Tool (JRT) by Thisisu
Version: 6.8.0 (05.25.2015:1)
OS: Windows 7 Professional x64
Ran by Thomas on 27.05.2015 at 11:51:32,91
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~




~~~ Services



~~~ Tasks



~~~ Registry Values

Successfully deleted: [Registry Value] HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ad-aware browsing protection



~~~ Registry Keys



~~~ Files



~~~ Folders

Successfully deleted: [Folder] C:\ProgramData\ad-aware browsing protection
Successfully deleted: [Folder] C:\Users\Thomas\appdata\local\adawarebp



~~~ FireFox

Emptied folder: C:\Users\Thomas\AppData\Roaming\mozilla\firefox\profiles\a1q6opop.default-1417043911660\minidumps [22 files]



~~~ Chrome


[C:\Users\Thomas\appdata\local\Google\Chrome\User Data\Default\Preferences] - default search provider reset

[C:\Users\Thomas\appdata\local\Google\Chrome\User Data\Default\Preferences] - Extensions Deleted:

[C:\Users\Thomas\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - default search provider reset

[C:\Users\Thomas\appdata\local\Google\Chrome\User Data\Default\Secure Preferences] - Extensions Deleted:
[]





~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
Scan was completed on 27.05.2015 at 11:53:27,02
End of JRT log
~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~~
         
Und das frische FRST log:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015
Ran by Thomas (administrator) on THOMAS-PC on 27-05-2015 11:54:35
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\msiexec.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4689072 2013-12-26] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [EasyTuneVI] => C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] ()
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [OneDrive] => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-21] (Microsoft Corporation)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [Spotify Web Helper] => C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2022968 2015-05-25] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-26]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2014-12-21]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ET6.lnk [2015-02-22]
ShortcutTarget: ET6.lnk -> C:\Program Files (x86)\GIGABYTE\ET6\ET6SC.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-27]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Windows\Installer\{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}\OC_GURU.exe1_5588D686D23B4C9DBDFA2A7875CD3722.exe (Macrovision Corporation)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCMeterV0.4.lnk [2014-11-26]
ShortcutTarget: PCMeterV0.4.lnk -> C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe (AddGadgets)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCremote.lnk [2015-01-04]
ShortcutTarget: PCremote.lnk -> C:\Program Files (x86)\PCremote\PCremote.exe (JakuSoft)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660
FF DefaultSearchEngine: dict.cc DE-EN
FF SelectedSearchEngine: LEO Eng-Deu
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-18] ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-18] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-11-26] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\searchplugins\dictcc-de-en.xml [2015-01-29]
FF Extension: WOT - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-12]
FF Extension: Pushbullet - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\jid1-BYcQOfYfmBMd9A@jetpack.xpi [2015-04-14]
FF Extension: Dict.cc Translation - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\searchdictcc@roughael.xpi [2015-01-03]
FF Extension: Tile Tabs - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\tiletabs@DW-dev.xpi [2015-04-09]
FF Extension: Adblock Plus - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-27]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-02-07]

Chrome: 
=======
CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-26]
CHR Extension: (Google Docs) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-26]
CHR Extension: (Google Drive) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-26]
CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-26]
CHR Extension: (Google Sheets) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-26]
CHR Extension: (Avira Browser Safety) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-26]
CHR Extension: (Google Wallet) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-26]
CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-26]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) []
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) []
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) []
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 GPCIDrv; C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [14376 2014-08-28] ()
R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-05-27] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 WinRing0_1_2_0; \??\C:\Users\Thomas\AppData\Local\Temp\tmpBEBC.tmp [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-27 11:53 - 2015-05-27 11:53 - 00001497 _____ () C:\Users\Thomas\Desktop\JRT.txt
2015-05-27 11:51 - 2015-05-27 11:51 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-THOMAS-PC-Windows-7-Professional-(64-bit).dat
2015-05-27 11:51 - 2015-05-27 11:51 - 00000000 ____D () C:\RegBackup
2015-05-27 11:50 - 2015-05-27 11:50 - 02946703 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe
2015-05-27 11:49 - 2015-05-27 11:49 - 00002178 _____ () C:\Users\Thomas\Desktop\AdwCleaner[S1].txt
2015-05-27 11:43 - 2015-05-27 11:43 - 02222592 _____ () C:\Users\Thomas\Desktop\AdwCleaner_4.205.exe
2015-05-27 11:42 - 2015-05-27 11:42 - 00001304 _____ () C:\Users\Thomas\Desktop\mbam.txt
2015-05-27 11:30 - 2015-05-27 11:30 - 00000000 ___HD () C:\OneDriveTemp
2015-05-27 11:20 - 2015-05-27 11:20 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-27 11:20 - 2015-05-27 11:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-27 11:20 - 2015-05-27 11:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-27 11:20 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-27 11:20 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-27 11:19 - 2015-05-27 11:19 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Thomas\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-26 16:32 - 2015-05-26 16:32 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Thomas\Desktop\tdsskiller.exe
2015-05-26 16:19 - 2015-05-27 11:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-26 16:18 - 2015-05-27 11:30 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-26 16:18 - 2015-05-27 11:29 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-26 16:18 - 2015-05-26 16:31 - 00000000 ____D () C:\Users\Thomas\Desktop\mbar
2015-05-26 16:18 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-26 16:17 - 2015-05-26 16:17 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Thomas\Desktop\mbar-1.09.1.1004.exe
2015-05-26 15:57 - 2015-05-26 15:57 - 00018932 _____ () C:\Users\Thomas\Desktop\gmer.log
2015-05-26 15:52 - 2015-05-26 15:52 - 00380416 _____ () C:\Users\Thomas\Desktop\Gmer-19357.exe
2015-05-26 15:51 - 2015-05-27 11:54 - 00018910 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-05-26 15:51 - 2015-05-26 15:51 - 00035982 _____ () C:\Users\Thomas\Desktop\Addition.txt
2015-05-26 15:50 - 2015-05-27 11:54 - 00000000 ____D () C:\FRST
2015-05-26 15:50 - 2015-05-26 15:50 - 02108928 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-05-26 15:47 - 2015-05-26 15:47 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-05-25 17:17 - 2015-05-25 17:17 - 00011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2015-05-25 16:58 - 2015-05-25 16:58 - 00000000 ____D () C:\Users\Thomas\Desktop\Neuer Ordner (3)
2015-05-25 14:20 - 2015-05-25 14:20 - 00003172 _____ () C:\Windows\System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90}
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\Program Files\Oracle
2015-05-25 14:20 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-25 14:20 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-25 14:18 - 2015-05-25 14:19 - 111273672 _____ (Oracle Corporation) C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe
2015-05-22 18:49 - 2015-05-25 16:56 - 00000000 ____D () C:\Users\Thomas\Desktop\Bilder mit Séverine
2015-05-19 23:29 - 2015-05-20 15:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-19 16:54 - 2015-05-19 16:54 - 00949621 _____ () C:\Users\Thomas\Desktop\WhatsApp Chat mit Séverine Sandmann.txt
2015-05-19 16:24 - 2015-05-19 16:30 - 659742720 _____ () C:\Users\Thomas\Desktop\rescue-system.iso
2015-05-18 15:15 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-16 02:39 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 02:39 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-15 12:47 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-15 12:47 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-15 12:47 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-15 12:47 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-15 12:47 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-15 12:47 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-15 12:47 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-15 12:47 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-15 12:47 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-15 12:47 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-15 12:47 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-15 12:47 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-15 12:47 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-15 12:47 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-15 12:47 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-15 12:47 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-15 12:47 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-15 12:47 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-15 12:47 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-15 12:47 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-15 12:47 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-15 12:47 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-15 12:47 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-15 12:47 - 2015-04-04 05:29 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-15 12:47 - 2015-04-04 05:29 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-15 12:47 - 2015-04-04 05:22 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:20 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:20 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-15 12:47 - 2015-04-04 05:17 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:17 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-15 12:47 - 2015-04-04 05:15 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-15 12:47 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-15 12:46 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-15 12:46 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-15 12:46 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-15 12:46 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-15 12:46 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-15 12:46 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-15 12:46 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-15 12:46 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 17:10 - 2015-05-13 17:10 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-06 23:06 - 2015-05-06 23:12 - 00000000 ____D () C:\Users\Thomas\Desktop\06.05.2015 - Yannick Garten
2015-04-28 00:34 - 2015-04-28 00:34 - 06479272 _____ (Neat Image team, ABSoft ) C:\Users\Thomas\Downloads\NeatSetup3274.exe
2015-04-28 00:34 - 2015-04-28 00:34 - 00001103 _____ () C:\Users\Thomas\Desktop\Neat Image (32-bit).lnk
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\NeatImage SL 32
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neat Image Standalone (32-bit)
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Program Files (x86)\Neat Image Standalone

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-27 11:53 - 2014-11-26 20:31 - 00021081 _____ () C:\Users\Thomas\IP_Log_Data.js
2015-05-27 11:51 - 2014-11-26 20:12 - 00000000 ___RD () C:\Users\Thomas\OneDrive
2015-05-27 11:51 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-27 11:51 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-27 11:48 - 2014-11-26 16:23 - 02087129 _____ () C:\Windows\WindowsUpdate.log
2015-05-27 11:46 - 2015-03-04 12:00 - 00005144 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC
2015-05-27 11:46 - 2015-02-22 18:41 - 00030528 _____ () C:\Windows\GVTDrv64.sys
2015-05-27 11:46 - 2015-02-22 18:41 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref
2015-05-27 11:46 - 2015-02-22 18:40 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-05-27 11:46 - 2014-11-26 16:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-27 11:45 - 2010-11-21 05:47 - 00361994 _____ () C:\Windows\PFRO.log
2015-05-27 11:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-27 11:45 - 2009-07-14 06:51 - 00069564 _____ () C:\Windows\setupact.log
2015-05-27 11:44 - 2014-11-27 01:20 - 00000000 ____D () C:\AdwCleaner
2015-05-27 11:38 - 2011-04-12 09:43 - 00698688 _____ () C:\Windows\system32\perfh007.dat
2015-05-27 11:38 - 2011-04-12 09:43 - 00148828 _____ () C:\Windows\system32\perfc007.dat
2015-05-27 11:38 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-27 11:29 - 2014-11-27 01:32 - 00000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-27 11:22 - 2014-11-26 16:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-27 11:18 - 2014-11-28 18:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-27 11:18 - 2014-11-26 21:00 - 00047161 _____ () C:\Users\Thomas\Network_Meter_Data.js
2015-05-26 15:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-26 15:47 - 2014-11-26 16:23 - 00000000 ____D () C:\Users\Thomas
2015-05-25 22:14 - 2014-11-26 17:02 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Spotify
2015-05-25 17:17 - 2014-11-26 16:53 - 00000000 ____D () C:\Users\Thomas\.gimp-2.8
2015-05-25 16:56 - 2014-12-04 13:36 - 00000000 ____D () C:\Users\Thomas\AppData\Local\gtk-2.0
2015-05-25 15:49 - 2014-11-26 17:05 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Spotify
2015-05-25 14:41 - 2014-11-26 19:46 - 00000000 ____D () C:\Users\Thomas\.VirtualBox
2015-05-25 14:20 - 2014-11-26 19:46 - 00001076 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-05-21 22:05 - 2014-11-26 20:12 - 00002141 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-21 14:39 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-19 14:00 - 2014-11-26 20:01 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-18 14:17 - 2014-11-26 16:59 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-18 14:17 - 2014-11-26 16:59 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-18 14:15 - 2014-11-26 20:34 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe
2015-05-18 14:14 - 2014-11-28 18:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-18 14:14 - 2014-11-28 18:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-18 14:14 - 2014-11-28 18:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-17 22:05 - 2014-11-26 17:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-17 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-17 21:18 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 21:18 - 2009-07-14 06:45 - 00502448 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-16 02:42 - 2014-11-26 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-16 02:40 - 2014-11-26 18:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-15 22:51 - 2014-11-26 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 17:10 - 2014-11-24 13:06 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 13:18 - 2014-11-26 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-27 16:39 - 2015-02-06 16:27 - 00000000 ____D () C:\Users\Thomas\Desktop\Bachelorarbeit

==================== Files in the root of some directories =======

2014-11-26 20:31 - 2014-12-02 00:11 - 0000626 _____ () C:\Users\Thomas\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-11-26 20:34 - 2014-11-26 20:47 - 0000841 _____ () C:\Users\Thomas\AppData\Roaming\Drives Meter_Settings.ini
2014-11-26 20:32 - 2015-01-13 16:02 - 0000292 _____ () C:\Users\Thomas\AppData\Roaming\GPU MeterV2_Settings.ini
2014-11-26 20:32 - 2014-11-26 20:33 - 0001328 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Settings.ini
2014-11-27 01:32 - 2015-05-27 11:29 - 0000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-25 17:17 - 2015-05-25 17:17 - 0011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2014-11-26 21:24 - 2015-04-06 00:04 - 0007604 _____ () C:\Users\Thomas\AppData\Local\Resmon.ResmonCfg

Files to move or delete:
====================
C:\Users\Thomas\IP_Log_Data.js
C:\Users\Thomas\Network_Meter_Data.js


Some files in TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
C:\Users\Thomas\AppData\Local\Temp\DelayInst.exe
C:\Users\Thomas\AppData\Local\Temp\gkey.exe
C:\Users\Thomas\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.5.575.exe
C:\Users\Thomas\AppData\Local\Temp\installservice.exe
C:\Users\Thomas\AppData\Local\Temp\pkeyui.exe
C:\Users\Thomas\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Thomas\AppData\Local\Temp\sfextra.dll
C:\Users\Thomas\AppData\Local\Temp\sqlite3.dll
C:\Users\Thomas\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Thomas\AppData\Local\Temp\wabk.exe
C:\Users\Thomas\AppData\Local\Temp\_is8E1B.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-25 17:46

==================== End of log ============================
         


Alt 27.05.2015, 18:35   #6
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner




ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset


Downloade Dir bitte SecurityCheck und:

  • Speichere es auf dem Desktop.
  • Starte SecurityCheck.exe und folge den Anweisungen in der DOS-Box.
  • Wenn der Scan beendet wurde sollte sich ein Textdokument (checkup.txt) öffnen.
Poste den Inhalt bitte hier.

und ein frisches FRST log bitte. Noch Probleme?
__________________
--> Windows 7: Avira Antivir Live CD erkennt 27 Trojaner

Alt 28.05.2015, 13:54   #7
xter
 
Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



Also ESET hat ein paar Sachen gefunden:
Code:
ATTFilter
ESETSmartInstaller@High as downloader log:
all ok
# product=EOS
# version=8
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.7623
# api_version=3.0.2
# EOSSerial=e39492e9108fc142b97307f89450e586
# engine=24053
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2015-05-27 08:52:39
# local_time=2015-05-27 10:52:39 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1031
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode_1=''
# compatibility_mode=5893 16776574 100 94 15739626 184389809 0 0
# scanned=204405
# found=16
# cleaned=0
# scan_time=3725
sh=03869BB0869892FC0921F81E28552D272DE5940B ft=1 fh=cf7ab34c69aafc2e vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RBY29WX.exe"
sh=1109266C0C26D15BFA39C2C5E81950E55199F648 ft=1 fh=34da0040060a84ef vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RQ1WDEN.exe"
sh=CCAAB70797E9301638EC064311DA8F044F70BD1E ft=1 fh=b2e4f21594fcac64 vn="Variante von Win32/InstallIQ.A evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RR2JR8E.exe"
sh=DA59FE87209FF1B7CA0CFB5E785D7559DD1F770B ft=1 fh=2b2a087cb6cef33c vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RTU4O7F.exe"
sh=3352E361DD8343CF51747AE7DBF91C4BF8AA97F9 ft=1 fh=6f28b91a55eb2b29 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RU8D9JO.exe"
sh=D5ACB7BEB7448438BBACB9196EE4411C25D795FE ft=1 fh=4071dddff7b68764 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\ProgramData\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe"
sh=D5ACB7BEB7448438BBACB9196EE4411C25D795FE ft=1 fh=4071dddff7b68764 vn="Variante von Win32/Toolbar.Visicom.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\All Users\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe"
sh=29531FF34ED520FDEF40B88D1C27B77D4064C1B7 ft=1 fh=6f280fcdcbb1a73e vn="Variante von Win32/Conduit.SearchProtect.N evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\OrbiterInstaller[1].exe"
sh=DB886C9E352D1215548BA755F0892D6B5003E237 ft=1 fh=3cd5fe4d706a0e7c vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\SPSetup[1].exe"
sh=7028F239FAC673EE7DC7772ACC75D759EA73837D ft=1 fh=e769f095fe49f653 vn="Variante von Win32/ClientConnect.A evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDK5CYCI\spstub[1].exe"
sh=333BEB35A70772F1757E99F0154D59964B921D3F ft=1 fh=534a19fe0349cbc1 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="C:\Users\Thomas\AppData\Local\Temp\DMR\dmr_72.exe"
sh=709D0B68EBAA79E2909ADA8D39B7A0005BA4313D ft=1 fh=e602743e8780b8c5 vn="Win32/DownWare.W evtl. unerwünschte Anwendung" ac=I fn="E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RBE8SB6.exe"
sh=2742F4CAC385DF6CADD6A3B00CA56B19E564B9D1 ft=1 fh=cbfe148697ed1ab3 vn="Variante von Win32/SoftonicDownloader.F evtl. unerwünschte Anwendung" ac=I fn="E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RV1OHM3.exe"
sh=AEE1B69276F8425BAC609144396FFBB44C255F42 ft=1 fh=5aa20fb91b358fc3 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="E:\Downloads\Ahnenblatt - CHIP-Installer.exe"
sh=89A5058741E236FF90BB420BE223FABF487DCD82 ft=1 fh=a4db7c0e759c3e10 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="E:\Downloads\Magical Jelly Bean Keyfinder - CHIP-Installer.exe"
sh=A9CBFA723957A2D8FC7F99260BC431911137B94C ft=1 fh=02a112a6279a0639 vn="Variante von Win32/DownloadSponsor.C evtl. unerwünschte Anwendung" ac=I fn="E:\Downloads\VirtualBox Extension Pack - CHIP-Installer.exe"
         
Security Check:
Code:
ATTFilter
 Results of screen317's Security Check version 1.002  
 Windows 7 Service Pack 1 x64 (UAC is enabled)  
 Internet Explorer 11  
``````````````Antivirus/Firewall Check:`````````````` 
Avira Antivirus   
 Antivirus up to date!   
`````````Anti-malware/Other Utilities Check:````````` 
 Ad-Aware 
 Java 8 Update 25  
 Java version 32-bit out of Date! 
 Adobe Flash Player 17.0.0.188  
 Adobe Reader XI  
 Mozilla Firefox (38.0.1) 
 Mozilla Thunderbird (31.7.0) 
 Google Chrome (43.0.2357.65) 
 Google Chrome (43.0.2357.81) 
````````Process Check: objlist.exe by Laurent````````  
 Ad-Aware AAWService.exe is disabled! 
 Ad-Aware AAWTray.exe is disabled! 
 Avira Antivir avgnt.exe 
 Avira Antivir avguard.exe 
`````````````````System Health check````````````````` 
 Total Fragmentation on Drive C:  
````````````````````End of Log``````````````````````
         
FRST:
Code:
ATTFilter
Scan result of Farbar Recovery Scan Tool (FRST) (x64) Version: 25-05-2015
Ran by Thomas (administrator) on THOMAS-PC on 27-05-2015 22:58:10
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Platform: Windows 7 Professional Service Pack 1 (X64) OS Language: Deutsch (Deutschland)
Internet Explorer Version 11 (Default browser: FF)
Boot Mode: Normal
Tutorial for Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Processes (Whitelisted) =================

(If an entry is included in the fixlist, the process will be closed. The file will not be moved.)

(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
(TeamViewer GmbH) C:\Program Files (x86)\TeamViewer\Version9\TeamViewer_Service.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avshadow.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Program Files\Microsoft Office 15\ClientX64\officeclicktorun.exe
(Intel(R) Corporation) C:\Program Files\Intel\iCLS Client\HeciServer.exe
(Microsoft Corporation) C:\Windows\Microsoft.NET\Framework64\v3.0\WPF\PresentationFontCache.exe
(Avira Operations GmbH & Co. KG) C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe
(Microsoft Corporation) C:\Program Files\Windows Sidebar\sidebar.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Mozilla Corporation) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler.exe
(Google Inc.) C:\Program Files (x86)\Google\Update\1.3.27.5\GoogleCrashHandler64.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe


==================== Registry (Whitelisted) ==================

(If an entry is included in the fixlist, the registry item will be restored to default or removed. The file will not be moved.)

HKLM\...\Run: [HDAudDeck] => C:\Program Files (x86)\VIA\VIAudioi\VDeck\VDeck.exe [4689072 2013-12-26] (VIA)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [642216 2012-08-06] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [USB3MON] => C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe [291608 2012-03-27] (Intel Corporation)
HKLM-x32\...\Run: [avgnt] => C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe [728312 2015-05-05] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\Run: [SunJavaUpdateSched] => C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe [507776 2014-10-07] (Oracle Corporation)
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [1022152 2014-12-19] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [ControlCenter4] => C:\Program Files (x86)\ControlCenter4\BrCcBoot.exe [143360 2012-08-28] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [BrStsMon00] => C:\Program Files (x86)\Browny02\Brother\BrStMonW.exe [3076096 2012-06-06] (Brother Industries, Ltd.)
HKLM-x32\...\Run: [Avira Systray] => C:\Program Files (x86)\Avira\My Avira\Avira.OE.Systray.exe [129272 2015-03-16] (Avira Operations GmbH & Co. KG)
HKLM-x32\...\RunOnce: [EasyTuneVI] => C:\Program Files (x86)\GIGABYTE\ET6\ETCall.exe [40960 2012-07-09] ()
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [OneDrive] => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\OneDrive.exe [382664 2015-05-21] (Microsoft Corporation)
HKU\S-1-5-21-1093152027-101576897-1014639688-1000\...\Run: [Spotify Web Helper] => C:\Users\Thomas\AppData\Roaming\Spotify\SpotifyWebHelper.exe [2022968 2015-05-25] (Spotify Ltd)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-26]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\OC_GURU.exe (GIGABYTE Technology Co.,Ltd.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\vpngui.exe.lnk [2014-12-21]
ShortcutTarget: vpngui.exe.lnk -> C:\Windows\Installer\{5FDC06BF-3D3D-4367-8FFB-4FAFCB61972D}\Icon09DB8A851.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\ET6.lnk [2015-02-22]
ShortcutTarget: ET6.lnk -> C:\Program Files (x86)\GIGABYTE\ET6\ET6SC.exe ()
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\GIGABYTE OC_GURU.lnk [2014-11-27]
ShortcutTarget: GIGABYTE OC_GURU.lnk -> C:\Windows\Installer\{EA298EC1-2B8F-4DA9-8C5B-BC1FCBBAD72F}\OC_GURU.exe1_5588D686D23B4C9DBDFA2A7875CD3722.exe (Macrovision Corporation)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCMeterV0.4.lnk [2014-11-26]
ShortcutTarget: PCMeterV0.4.lnk -> C:\Program Files (x86)\PCMeterV4\PCMeterV0.4.exe (AddGadgets)
Startup: C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\PCremote.lnk [2015-01-04]
ShortcutTarget: PCremote.lnk -> C:\Program Files (x86)\PCremote\PCremote.exe (JakuSoft)
ShellIconOverlayIdentifiers: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\amd64\FileSyncShell64.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive1] -> {F241C880-6982-4CE5-8CF7-7085BA96DA5A} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive2] -> {A0396A93-DC06-4AEF-BEE9-95FFCCAEF20E} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)
ShellIconOverlayIdentifiers-x32: [ SkyDrive3] -> {BBACC218-34EA-4666-9D7A-C78F2274A524} => C:\Users\Thomas\AppData\Local\Microsoft\OneDrive\17.3.5860.0512\FileSyncShell.dll [2015-05-21] (Microsoft Corporation)

==================== Internet (Whitelisted) ====================

(If an item is included in the fixlist, if it is a registry item it will be removed or restored to default.)

HKU\S-1-5-21-1093152027-101576897-1014639688-1000\Software\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://www.msn.com/de-de/?ocid=iehp
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-19 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\S-1-5-20 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
BHO: Skype for Business Browser Helper -> {31D09BA0-12F5-4CCE-BE8A-2923E76605DA} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\OCHelper.dll [2015-03-10] (Microsoft Corporation)
BHO: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\system32\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO: Microsoft SkyDrive Pro Browser Helper -> {D0498E0A-45B7-42AE-A9AA-ABA463DBD3BF} -> C:\Program Files\Microsoft Office 15\root\VFS\ProgramFilesX64\Microsoft Office\Office15\GROOVEEX.DLL [2015-04-14] (Microsoft Corporation)
BHO: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Citavi Picker -> {609D670F-B735-4da7-AC6D-F3BD358E325E} -> C:\Windows\SysWOW64\mscoree.dll [2010-11-21] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In SSV Helper -> {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\ssv.dll [2014-11-26] (Oracle Corporation)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office 15\root\Office15\URLREDIR.DLL [2015-04-14] (Microsoft Corporation)
BHO-x32: Java(tm) Plug-In 2 SSV Helper -> {DBC80044-A445-435b-BC74-9C25C1C588A9} -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\jp2ssv.dll [2014-11-26] (Oracle Corporation)
Handler-x32: osf - {D924BDC6-C83A-4BD5-90D0-095128A113D1} - C:\Program Files\Microsoft Office 15\root\Office15\MSOSB.DLL [2015-02-03] (Microsoft Corporation)
Tcpip\Parameters: [DhcpNameServer] 192.168.2.1

FireFox:
========
FF ProfilePath: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660
FF DefaultSearchEngine: dict.cc DE-EN
FF SelectedSearchEngine: LEO Eng-Deu
FF Homepage: https://www.google.de/
FF NetworkProxy: "type", 0
FF Plugin: @adobe.com/FlashPlayer -> C:\Windows\system32\Macromed\Flash\NPSWF64_17_0_0_188.dll [2015-05-18] ()
FF Plugin: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-16] ( Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_17_0_0_188.dll [2015-05-18] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI ipt;version=4.0.5 -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIIPT.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @intel-webapi.intel.com/Intel WebAPI updater -> C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\IPT\npIntelWebAPIUpdater.dll [2013-09-16] (Intel Corporation)
FF Plugin-x32: @java.com/DTPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\dtplugin\npDeployJava1.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @java.com/JavaPlugin,version=11.25.2 -> C:\Program Files (x86)\Java\jre1.8.0_25\bin\plugin2\npjp2.dll [2014-11-26] (Oracle Corporation)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> C:\Program Files (x86)\Microsoft Silverlight\5.1.40416.0\npctrl.dll [2015-04-15] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\Program Files\Microsoft Office 15\root\Office15\NPSPWRAP.DLL [2014-11-26] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.27.5\npGoogleUpdate3.dll [2015-05-18] (Google Inc.)
FF Plugin-x32: @videolan.org/vlc,version=2.1.5 -> C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll [2014-07-23] (VideoLAN)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2015-05-01] (Adobe Systems Inc.)
FF SearchPlugin: C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\searchplugins\dictcc-de-en.xml [2015-01-29]
FF Extension: WOT - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{a0d7ccb3-214d-498b-b4aa-0e8fda9a7bf7} [2015-03-12]
FF Extension: Pushbullet - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\jid1-BYcQOfYfmBMd9A@jetpack.xpi [2015-04-14]
FF Extension: Dict.cc Translation - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\searchdictcc@roughael.xpi [2015-01-03]
FF Extension: Tile Tabs - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\tiletabs@DW-dev.xpi [2015-04-09]
FF Extension: Adblock Plus - C:\Users\Thomas\AppData\Roaming\Mozilla\Firefox\Profiles\a1q6opop.default-1417043911660\Extensions\{d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}.xpi [2014-11-27]
FF HKLM-x32\...\Firefox\Extensions: [{8AA36F4F-6DC7-4c06-77AF-5035170634FE}] - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox
FF Extension: Citavi Picker - C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2015-02-07]

Chrome: 
=======
CHR Profile: C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (Google Slides) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aapocclcgogkmnckokdopfmhonfmgoek [2014-11-26]
CHR Extension: (Google Docs) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\aohghmighlieiainnegkcijnfilokake [2014-11-26]
CHR Extension: (Google Drive) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\apdfllckaahabafndbhieahigkjlhalf [2014-11-26]
CHR Extension: (Google Voice Search Hotword (Beta)) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\bepbmhgboaologfdajaanbcjmnhjmhfn [2015-01-21]
CHR Extension: (YouTube) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\blpcfgokakmgnkcojhhkbfbldkacnbeo [2014-11-26]
CHR Extension: (Google Search) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\coobgpohoikkiipiblmjeljniedjpjpf [2014-11-26]
CHR Extension: (Google Sheets) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\felcaaldnbdncclmgdcncolpebgiejap [2014-11-26]
CHR Extension: (Avira Browser Safety) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\flliilndjeohchalpbbcdekjklbdgfkk [2014-11-26]
CHR Extension: (Google Wallet) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\nmmhkkegccagdldgiimedpiccmgmieda [2014-11-26]
CHR Extension: (Gmail) - C:\Users\Thomas\AppData\Local\Google\Chrome\User Data\Default\Extensions\pjkljhegncpnkpknbcohdijeoejaedia [2014-11-26]
CHR HKLM\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [flliilndjeohchalpbbcdekjklbdgfkk] - https://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [ohgndokldibnndfnjnagojmheejlengn] - https://clients2.google.com/service/update2/crx

==================== Services (Whitelisted) =================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

S2 AntiVirMailService; C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc7.exe [827640 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirSchedulerService; C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 AntiVirService; C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe [434424 2015-05-05] (Avira Operations GmbH & Co. KG)
S2 AntiVirWebService; C:\Program Files (x86)\Avira\AntiVir Desktop\avwebg7.exe [1185584 2015-05-05] (Avira Operations GmbH & Co. KG)
R2 Avira.OE.ServiceHost; C:\Program Files (x86)\Avira\My Avira\Avira.OE.ServiceHost.exe [201008 2015-03-16] (Avira Operations GmbH & Co. KG)
S3 BrYNSvc; C:\Program Files (x86)\Browny02\BrYNSvc.exe [266240 2012-06-05] (Brother Industries, Ltd.) []
R2 ClickToRunSvc; C:\Program Files\Microsoft Office 15\ClientX64\OfficeClickToRun.exe [2736824 2015-04-07] (Microsoft Corporation)
S3 ICCS; C:\Program Files (x86)\Intel\Intel(R) Integrated Clock Controller Service\ICCProxy.exe [160256 2011-08-30] (Intel Corporation) []
S3 IDriverT; C:\Program Files (x86)\Common Files\InstallShield\Driver\11\Intel 32\IDriverT.exe [69632 2005-04-04] (Macrovision Corporation) []
R2 Intel(R) Capability Licensing Service Interface; C:\Program Files\Intel\iCLS Client\HeciServer.exe [747520 2013-08-27] (Intel(R) Corporation) []
S3 Intel(R) Capability Licensing Service TCP IP Interface; C:\Program Files\Intel\iCLS Client\SocketHeciServer.exe [828376 2013-08-27] (Intel(R) Corporation)
S2 jhi_service; C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [169432 2013-09-16] (Intel Corporation)
S2 MBAMService; C:\Program Files (x86)\ Malwarebytes Anti-Malware \mbamservice.exe [1080120 2015-04-14] (Malwarebytes Corporation)
S2 VIAKaraokeService; C:\Windows\system32\viakaraokesrv.exe [27768 2012-12-11] (VIA Technologies, Inc.)
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)

==================== Drivers (Whitelisted) ====================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)

R2 avgntflt; C:\Windows\System32\DRIVERS\avgntflt.sys [152744 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avipbb; C:\Windows\System32\DRIVERS\avipbb.sys [132120 2015-05-05] (Avira Operations GmbH & Co. KG)
R1 avkmgr; C:\Windows\System32\DRIVERS\avkmgr.sys [28600 2014-10-23] (Avira Operations GmbH & Co. KG)
R2 avnetflt; C:\Windows\System32\DRIVERS\avnetflt.sys [44088 2015-03-05] (Avira Operations GmbH & Co. KG)
R3 CVPNDRVA; C:\Windows\system32\Drivers\CVPNDRVA.sys [306536 2011-03-04] ()
R3 GPCIDrv; C:\Program Files (x86)\GIGABYTE\GIGABYTE OC_GURU II\GPCIDrv64.sys [14376 2014-08-28] ()
R3 GVTDrv64; C:\Windows\GVTDrv64.sys [30528 2015-05-27] ()
R3 L1C; C:\Windows\System32\DRIVERS\L1C62x64.sys [129224 2013-07-18] (Qualcomm Atheros Co., Ltd.)
R3 MBAMProtector; C:\Windows\system32\drivers\mbam.sys [25816 2015-04-14] (Malwarebytes Corporation)
S3 MBAMWebAccessControl; C:\Windows\system32\drivers\mwac.sys [63704 2015-04-14] (Malwarebytes Corporation)
R3 MEIx64; C:\Windows\System32\DRIVERS\TeeDriverx64.sys [99288 2013-09-16] (Intel Corporation)
R3 WinRing0_1_2_0; \??\C:\Users\Thomas\AppData\Local\Temp\tmpBEBC.tmp [X]

==================== NetSvcs (Whitelisted) ===================

(If an entry is included in the fixlist, it will be removed from the registry. The file will not be moved unless listed separately.)


==================== One Month Created files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-27 22:57 - 2015-05-27 22:57 - 00001022 _____ () C:\Users\Thomas\Desktop\checkup.txt
2015-05-27 22:55 - 2015-05-27 22:55 - 00852639 _____ () C:\Users\Thomas\Desktop\SecurityCheck.exe
2015-05-27 21:43 - 2015-05-27 21:43 - 02347384 _____ (ESET) C:\Users\Thomas\Desktop\esetsmartinstaller_deu.exe
2015-05-27 11:55 - 2015-05-27 11:55 - 00044452 _____ () C:\Users\Thomas\Desktop\FRST2.txt
2015-05-27 11:53 - 2015-05-27 11:53 - 00001497 _____ () C:\Users\Thomas\Desktop\JRT.txt
2015-05-27 11:51 - 2015-05-27 11:51 - 00000207 _____ () C:\Windows\tweaking.com-regbackup-THOMAS-PC-Windows-7-Professional-(64-bit).dat
2015-05-27 11:51 - 2015-05-27 11:51 - 00000000 ____D () C:\RegBackup
2015-05-27 11:50 - 2015-05-27 11:50 - 02946703 _____ (Thisisu) C:\Users\Thomas\Desktop\JRT.exe
2015-05-27 11:49 - 2015-05-27 11:49 - 00002178 _____ () C:\Users\Thomas\Desktop\AdwCleaner[S1].txt
2015-05-27 11:43 - 2015-05-27 11:43 - 02222592 _____ () C:\Users\Thomas\Desktop\AdwCleaner_4.205.exe
2015-05-27 11:42 - 2015-05-27 11:42 - 00001304 _____ () C:\Users\Thomas\Desktop\mbam.txt
2015-05-27 11:30 - 2015-05-27 11:30 - 00000000 ___HD () C:\OneDriveTemp
2015-05-27 11:20 - 2015-05-27 11:20 - 00001102 _____ () C:\Users\Public\Desktop\ Malwarebytes Anti-Malware .lnk
2015-05-27 11:20 - 2015-05-27 11:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\ Malwarebytes Anti-Malware 
2015-05-27 11:20 - 2015-05-27 11:20 - 00000000 ____D () C:\Program Files (x86)\ Malwarebytes Anti-Malware 
2015-05-27 11:20 - 2015-04-14 09:37 - 00063704 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mwac.sys
2015-05-27 11:20 - 2015-04-14 09:37 - 00025816 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbam.sys
2015-05-27 11:19 - 2015-05-27 11:19 - 21546080 _____ (Malwarebytes Corporation ) C:\Users\Thomas\Desktop\mbam-setup-2.1.6.1022.exe
2015-05-26 16:32 - 2015-05-26 16:32 - 04197016 _____ (Kaspersky Lab ZAO) C:\Users\Thomas\Desktop\tdsskiller.exe
2015-05-26 16:19 - 2015-05-27 11:20 - 00000000 ____D () C:\ProgramData\Malwarebytes
2015-05-26 16:18 - 2015-05-27 11:30 - 00136408 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\MBAMSwissArmy.sys
2015-05-26 16:18 - 2015-05-27 11:29 - 00000000 ____D () C:\ProgramData\Malwarebytes' Anti-Malware (portable)
2015-05-26 16:18 - 2015-05-26 16:31 - 00000000 ____D () C:\Users\Thomas\Desktop\mbar
2015-05-26 16:18 - 2015-04-14 09:37 - 00107736 _____ (Malwarebytes Corporation) C:\Windows\system32\Drivers\mbamchameleon.sys
2015-05-26 16:17 - 2015-05-26 16:17 - 16502728 _____ (Malwarebytes Corp.) C:\Users\Thomas\Desktop\mbar-1.09.1.1004.exe
2015-05-26 15:57 - 2015-05-26 15:57 - 00018932 _____ () C:\Users\Thomas\Desktop\gmer.log
2015-05-26 15:52 - 2015-05-26 15:52 - 00380416 _____ () C:\Users\Thomas\Desktop\Gmer-19357.exe
2015-05-26 15:51 - 2015-05-27 22:58 - 00019023 _____ () C:\Users\Thomas\Desktop\FRST.txt
2015-05-26 15:51 - 2015-05-26 15:51 - 00035982 _____ () C:\Users\Thomas\Desktop\Addition.txt
2015-05-26 15:50 - 2015-05-27 22:58 - 00000000 ____D () C:\FRST
2015-05-26 15:50 - 2015-05-26 15:50 - 02108928 _____ (Farbar) C:\Users\Thomas\Desktop\FRST64.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00050477 _____ () C:\Users\Thomas\Desktop\Defogger.exe
2015-05-26 15:47 - 2015-05-26 15:47 - 00000474 _____ () C:\Users\Thomas\Desktop\defogger_disable.log
2015-05-26 15:47 - 2015-05-26 15:47 - 00000000 _____ () C:\Users\Thomas\defogger_reenable
2015-05-25 17:17 - 2015-05-25 17:17 - 00011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2015-05-25 16:58 - 2015-05-25 16:58 - 00000000 ____D () C:\Users\Thomas\Desktop\Neuer Ordner (3)
2015-05-25 14:20 - 2015-05-25 14:20 - 00003172 _____ () C:\Windows\System32\Tasks\{D9AFFEAD-3E58-4A98-ABBB-B96CD6CB8B90}
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Oracle VM VirtualBox
2015-05-25 14:20 - 2015-05-25 14:20 - 00000000 ____D () C:\Program Files\Oracle
2015-05-25 14:20 - 2015-05-13 17:11 - 00922704 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxDrv.sys
2015-05-25 14:20 - 2015-05-13 17:10 - 00128592 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxUSBMon.sys
2015-05-25 14:18 - 2015-05-25 14:19 - 111273672 _____ (Oracle Corporation) C:\Users\Thomas\Downloads\VirtualBox-4.3.28-100309-Win.exe
2015-05-22 18:49 - 2015-05-25 16:56 - 00000000 ____D () C:\Users\Thomas\Desktop\Bilder mit Séverine
2015-05-19 23:29 - 2015-05-20 15:04 - 00000000 ____D () C:\Program Files (x86)\Mozilla Thunderbird
2015-05-19 16:54 - 2015-05-19 16:54 - 00949621 _____ () C:\Users\Thomas\Desktop\WhatsApp Chat mit Séverine Sandmann.txt
2015-05-19 16:24 - 2015-05-19 16:30 - 659742720 _____ () C:\Users\Thomas\Desktop\rescue-system.iso
2015-05-18 15:15 - 2015-05-18 15:15 - 00000000 ____D () C:\Program Files (x86)\Mozilla Firefox
2015-05-16 02:39 - 2015-05-01 15:17 - 00124112 _____ (Microsoft Corporation) C:\Windows\system32\PresentationCFFRasterizerNative_v0300.dll
2015-05-16 02:39 - 2015-05-01 15:16 - 00102608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\PresentationCFFRasterizerNative_v0300.dll
2015-05-15 12:47 - 2015-05-05 03:29 - 00342016 _____ (Microsoft Corporation) C:\Windows\system32\schannel.dll
2015-05-15 12:47 - 2015-05-05 03:12 - 00248832 _____ (Microsoft Corporation) C:\Windows\SysWOW64\schannel.dll
2015-05-15 12:47 - 2015-04-22 04:28 - 00389840 _____ (Microsoft Corporation) C:\Windows\system32\iedkcs32.dll
2015-05-15 12:47 - 2015-04-22 03:48 - 00342736 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iedkcs32.dll
2015-05-15 12:47 - 2015-04-21 19:14 - 24971776 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.dll
2015-05-15 12:47 - 2015-04-21 19:08 - 02724864 _____ (Microsoft Corporation) C:\Windows\system32\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 19:07 - 00004096 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollectorres.dll
2015-05-15 12:47 - 2015-04-21 18:51 - 00066560 _____ (Microsoft Corporation) C:\Windows\system32\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00584192 _____ (Microsoft Corporation) C:\Windows\system32\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:50 - 00417792 _____ (Microsoft Corporation) C:\Windows\system32\html.iec
2015-05-15 12:47 - 2015-04-21 18:50 - 00048640 _____ (Microsoft Corporation) C:\Windows\system32\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:49 - 02885120 _____ (Microsoft Corporation) C:\Windows\system32\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:48 - 00088064 _____ (Microsoft Corporation) C:\Windows\system32\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:41 - 00054784 _____ (Microsoft Corporation) C:\Windows\system32\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:40 - 00034304 _____ (Microsoft Corporation) C:\Windows\system32\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:37 - 00633856 _____ (Microsoft Corporation) C:\Windows\system32\ieui.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00816640 _____ (Microsoft Corporation) C:\Windows\system32\jscript.dll
2015-05-15 12:47 - 2015-04-21 18:35 - 00144384 _____ (Microsoft Corporation) C:\Windows\system32\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 18:35 - 00114688 _____ (Microsoft Corporation) C:\Windows\system32\ieetwcollector.exe
2015-05-15 12:47 - 2015-04-21 18:34 - 00814080 _____ (Microsoft Corporation) C:\Windows\system32\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 18:31 - 06025728 _____ (Microsoft Corporation) C:\Windows\system32\jscript9.dll
2015-05-15 12:47 - 2015-04-21 18:26 - 00968704 _____ (Microsoft Corporation) C:\Windows\system32\MsSpellCheckingFacility.exe
2015-05-15 12:47 - 2015-04-21 18:25 - 02724864 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.tlb
2015-05-15 12:47 - 2015-04-21 18:24 - 19691008 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtml.dll
2015-05-15 12:47 - 2015-04-21 18:22 - 00490496 _____ (Microsoft Corporation) C:\Windows\system32\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 18:14 - 00077824 _____ (Microsoft Corporation) C:\Windows\system32\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00504320 _____ (Microsoft Corporation) C:\Windows\SysWOW64\vbscript.dll
2015-05-15 12:47 - 2015-04-21 18:11 - 00062464 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iesetup.dll
2015-05-15 12:47 - 2015-04-21 18:10 - 00047616 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieetwproxystub.dll
2015-05-15 12:47 - 2015-04-21 18:09 - 00341504 _____ (Microsoft Corporation) C:\Windows\SysWOW64\html.iec
2015-05-15 12:47 - 2015-04-21 18:09 - 00199680 _____ (Microsoft Corporation) C:\Windows\system32\msrating.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00092160 _____ (Microsoft Corporation) C:\Windows\system32\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 18:08 - 00064000 _____ (Microsoft Corporation) C:\Windows\SysWOW64\MshtmlDac.dll
2015-05-15 12:47 - 2015-04-21 18:05 - 00316928 _____ (Microsoft Corporation) C:\Windows\system32\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 18:04 - 02278400 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iertutil.dll
2015-05-15 12:47 - 2015-04-21 18:03 - 00047104 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jsproxy.dll
2015-05-15 12:47 - 2015-04-21 18:02 - 00030720 _____ (Microsoft Corporation) C:\Windows\SysWOW64\iernonce.dll
2015-05-15 12:47 - 2015-04-21 18:00 - 00478208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieui.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00664576 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript.dll
2015-05-15 12:47 - 2015-04-21 17:58 - 00115712 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieUnatt.exe
2015-05-15 12:47 - 2015-04-21 17:57 - 00620032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9diag.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00801280 _____ (Microsoft Corporation) C:\Windows\system32\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:49 - 00720384 _____ (Microsoft Corporation) C:\Windows\system32\ie4uinit.exe
2015-05-15 12:47 - 2015-04-21 17:48 - 00418304 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtmsft.dll
2015-05-15 12:47 - 2015-04-21 17:47 - 01359360 _____ (Microsoft Corporation) C:\Windows\system32\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:46 - 02125824 _____ (Microsoft Corporation) C:\Windows\system32\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:43 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\JavaScriptCollectionAgent.dll
2015-05-15 12:47 - 2015-04-21 17:40 - 14401536 _____ (Microsoft Corporation) C:\Windows\system32\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:39 - 00168960 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msrating.dll
2015-05-15 12:47 - 2015-04-21 17:38 - 00076288 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmled.dll
2015-05-15 12:47 - 2015-04-21 17:36 - 00285696 _____ (Microsoft Corporation) C:\Windows\SysWOW64\dxtrans.dll
2015-05-15 12:47 - 2015-04-21 17:31 - 04305920 _____ (Microsoft Corporation) C:\Windows\SysWOW64\jscript9.dll
2015-05-15 12:47 - 2015-04-21 17:27 - 02352128 _____ (Microsoft Corporation) C:\Windows\system32\wininet.dll
2015-05-15 12:47 - 2015-04-21 17:26 - 00688640 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msfeeds.dll
2015-05-15 12:47 - 2015-04-21 17:25 - 02052608 _____ (Microsoft Corporation) C:\Windows\SysWOW64\inetcpl.cpl
2015-05-15 12:47 - 2015-04-21 17:24 - 01155072 _____ (Microsoft Corporation) C:\Windows\SysWOW64\mshtmlmedia.dll
2015-05-15 12:47 - 2015-04-21 17:17 - 12828672 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieframe.dll
2015-05-15 12:47 - 2015-04-21 17:15 - 01547264 _____ (Microsoft Corporation) C:\Windows\system32\urlmon.dll
2015-05-15 12:47 - 2015-04-21 17:03 - 00800768 _____ (Microsoft Corporation) C:\Windows\system32\ieapfltr.dll
2015-05-15 12:47 - 2015-04-21 17:02 - 01882112 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wininet.dll
2015-05-15 12:47 - 2015-04-21 16:58 - 01310208 _____ (Microsoft Corporation) C:\Windows\SysWOW64\urlmon.dll
2015-05-15 12:47 - 2015-04-21 16:56 - 00710144 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ieapfltr.dll
2015-05-15 12:47 - 2015-04-18 05:10 - 00460800 _____ (Microsoft Corporation) C:\Windows\system32\certcli.dll
2015-05-15 12:47 - 2015-04-18 04:56 - 00342016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\certcli.dll
2015-05-15 12:47 - 2015-04-04 05:29 - 00155576 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecpkg.sys
2015-05-15 12:47 - 2015-04-04 05:29 - 00095680 _____ (Microsoft Corporation) C:\Windows\system32\Drivers\ksecdd.sys
2015-05-15 12:47 - 2015-04-04 05:22 - 01461760 _____ (Microsoft Corporation) C:\Windows\system32\lsasrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00728064 _____ (Microsoft Corporation) C:\Windows\system32\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00314880 _____ (Microsoft Corporation) C:\Windows\system32\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00309760 _____ (Microsoft Corporation) C:\Windows\system32\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00210944 _____ (Microsoft Corporation) C:\Windows\system32\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00136192 _____ (Microsoft Corporation) C:\Windows\system32\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00086528 _____ (Microsoft Corporation) C:\Windows\system32\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00029184 _____ (Microsoft Corporation) C:\Windows\system32\sspisrv.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00028160 _____ (Microsoft Corporation) C:\Windows\system32\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:22 - 00022016 _____ (Microsoft Corporation) C:\Windows\system32\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:20 - 00064000 _____ (Microsoft Corporation) C:\Windows\system32\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:20 - 00031232 _____ (Microsoft Corporation) C:\Windows\system32\lsass.exe
2015-05-15 12:47 - 2015-04-04 05:17 - 00146432 _____ (Microsoft Corporation) C:\Windows\system32\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:17 - 00060416 _____ (Microsoft Corporation) C:\Windows\system32\msobjs.dll
2015-05-15 12:47 - 2015-04-04 05:15 - 00686080 _____ (Microsoft Corporation) C:\Windows\system32\adtschema.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00550912 _____ (Microsoft Corporation) C:\Windows\SysWOW64\kerberos.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00259584 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msv1_0.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00221184 _____ (Microsoft Corporation) C:\Windows\SysWOW64\ncrypt.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00172032 _____ (Microsoft Corporation) C:\Windows\SysWOW64\wdigest.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00065536 _____ (Microsoft Corporation) C:\Windows\SysWOW64\TSpkg.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00022016 _____ (Microsoft Corporation) C:\Windows\SysWOW64\secur32.dll
2015-05-15 12:47 - 2015-04-04 05:05 - 00017408 _____ (Microsoft Corporation) C:\Windows\SysWOW64\credssp.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00096768 _____ (Microsoft Corporation) C:\Windows\SysWOW64\sspicli.dll
2015-05-15 12:47 - 2015-04-04 05:04 - 00050176 _____ (Microsoft Corporation) C:\Windows\SysWOW64\auditpol.exe
2015-05-15 12:47 - 2015-04-04 05:01 - 00146432 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msaudite.dll
2015-05-15 12:47 - 2015-04-04 05:01 - 00060416 _____ (Microsoft Corporation) C:\Windows\SysWOW64\msobjs.dll
2015-05-15 12:47 - 2015-04-04 04:59 - 00686080 _____ (Microsoft Corporation) C:\Windows\SysWOW64\adtschema.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01647104 _____ (Microsoft Corporation) C:\Windows\system32\DWrite.dll
2015-05-15 12:46 - 2015-04-20 05:17 - 01179136 _____ (Microsoft Corporation) C:\Windows\system32\FntCache.dll
2015-05-15 12:46 - 2015-04-20 04:56 - 01250816 _____ (Microsoft Corporation) C:\Windows\SysWOW64\DWrite.dll
2015-05-15 12:46 - 2015-04-20 04:11 - 03204608 _____ (Microsoft Corporation) C:\Windows\system32\win32k.sys
2015-05-15 12:46 - 2015-04-13 05:28 - 00328704 _____ (Microsoft Corporation) C:\Windows\system32\services.exe
2015-05-15 12:46 - 2015-04-08 05:29 - 00275456 _____ (Microsoft Corporation) C:\Windows\system32\InkEd.dll
2015-05-15 12:46 - 2015-04-08 05:29 - 00024576 _____ (Microsoft Corporation) C:\Windows\system32\jnwmon.dll
2015-05-15 12:46 - 2015-04-08 05:14 - 00216064 _____ (Microsoft Corporation) C:\Windows\SysWOW64\InkEd.dll
2015-05-15 12:46 - 2015-02-18 09:06 - 00123904 _____ (Microsoft Corporation) C:\Windows\SysWOW64\poqexec.exe
2015-05-15 12:46 - 2015-02-18 09:04 - 00142336 _____ (Microsoft Corporation) C:\Windows\system32\poqexec.exe
2015-05-13 17:10 - 2015-05-13 17:10 - 00204264 _____ (Oracle Corporation) C:\Windows\system32\VBoxNetFltNobj.dll
2015-05-13 17:10 - 2015-05-13 17:10 - 00141440 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetAdp.sys
2015-05-06 23:06 - 2015-05-06 23:12 - 00000000 ____D () C:\Users\Thomas\Desktop\06.05.2015 - Yannick Garten
2015-04-28 00:34 - 2015-04-28 00:34 - 06479272 _____ (Neat Image team, ABSoft ) C:\Users\Thomas\Downloads\NeatSetup3274.exe
2015-04-28 00:34 - 2015-04-28 00:34 - 00001103 _____ () C:\Users\Thomas\Desktop\Neat Image (32-bit).lnk
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\NeatImage SL 32
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Neat Image Standalone (32-bit)
2015-04-28 00:34 - 2015-04-28 00:34 - 00000000 ____D () C:\Program Files (x86)\Neat Image Standalone

==================== One Month Modified files and folders ========

(If an entry is included in the fixlist, the file/folder will be moved.)

2015-05-27 22:22 - 2014-11-26 16:59 - 00001110 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineUA.job
2015-05-27 22:15 - 2014-11-28 18:44 - 00000884 _____ () C:\Windows\Tasks\Adobe Flash Player Updater.job
2015-05-27 22:00 - 2014-11-26 21:00 - 00047493 _____ () C:\Users\Thomas\Network_Meter_Data.js
2015-05-27 21:53 - 2011-04-12 09:43 - 00698688 _____ () C:\Windows\system32\perfh007.dat
2015-05-27 21:53 - 2011-04-12 09:43 - 00148828 _____ () C:\Windows\system32\perfc007.dat
2015-05-27 21:53 - 2009-07-14 07:13 - 01618320 _____ () C:\Windows\system32\PerfStringBackup.INI
2015-05-27 16:07 - 2014-11-26 16:59 - 00001106 _____ () C:\Windows\Tasks\GoogleUpdateTaskMachineCore.job
2015-05-27 15:53 - 2009-07-14 06:51 - 00069676 _____ () C:\Windows\setupact.log
2015-05-27 12:42 - 2014-11-26 16:23 - 01061771 _____ () C:\Windows\WindowsUpdate.log
2015-05-27 11:58 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2015-05-27 11:58 - 2009-07-14 06:45 - 00021808 ____H () C:\Windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2015-05-27 11:53 - 2014-11-26 20:31 - 00021081 _____ () C:\Users\Thomas\IP_Log_Data.js
2015-05-27 11:51 - 2014-11-26 20:12 - 00000000 ___RD () C:\Users\Thomas\OneDrive
2015-05-27 11:46 - 2015-03-04 12:00 - 00005144 _____ () C:\Windows\System32\Tasks\Microsoft Office 15 Sync Maintenance for Thomas-PC-Thomas Thomas-PC
2015-05-27 11:46 - 2015-02-22 18:41 - 00030528 _____ () C:\Windows\GVTDrv64.sys
2015-05-27 11:46 - 2015-02-22 18:41 - 00000004 _____ () C:\Windows\SysWOW64\GVTunner.ref
2015-05-27 11:46 - 2015-02-22 18:40 - 00025640 _____ (Windows (R) Server 2003 DDK provider) C:\Windows\gdrv.sys
2015-05-27 11:45 - 2010-11-21 05:47 - 00361994 _____ () C:\Windows\PFRO.log
2015-05-27 11:45 - 2009-07-14 07:08 - 00000006 ____H () C:\Windows\Tasks\SA.DAT
2015-05-27 11:44 - 2014-11-27 01:20 - 00000000 ____D () C:\AdwCleaner
2015-05-27 11:29 - 2014-11-27 01:32 - 00000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-26 15:58 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\system32\NDF
2015-05-26 15:47 - 2014-11-26 16:23 - 00000000 ____D () C:\Users\Thomas
2015-05-25 22:14 - 2014-11-26 17:02 - 00000000 ____D () C:\Users\Thomas\AppData\Roaming\Spotify
2015-05-25 17:17 - 2014-11-26 16:53 - 00000000 ____D () C:\Users\Thomas\.gimp-2.8
2015-05-25 16:56 - 2014-12-04 13:36 - 00000000 ____D () C:\Users\Thomas\AppData\Local\gtk-2.0
2015-05-25 15:49 - 2014-11-26 17:05 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Spotify
2015-05-25 14:41 - 2014-11-26 19:46 - 00000000 ____D () C:\Users\Thomas\.VirtualBox
2015-05-25 14:20 - 2014-11-26 19:46 - 00001076 _____ () C:\Users\Public\Desktop\Oracle VM VirtualBox.lnk
2015-05-21 22:05 - 2014-11-26 20:12 - 00002141 _____ () C:\Users\Thomas\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Microsoft OneDrive.lnk
2015-05-21 14:39 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Mozilla Maintenance Service
2015-05-19 14:00 - 2014-11-26 20:01 - 00000000 ____D () C:\Program Files\Microsoft Office 15
2015-05-18 14:17 - 2014-11-26 16:59 - 00004106 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineUA
2015-05-18 14:17 - 2014-11-26 16:59 - 00003854 _____ () C:\Windows\System32\Tasks\GoogleUpdateTaskMachineCore
2015-05-18 14:15 - 2014-11-26 20:34 - 00000000 ____D () C:\Users\Thomas\AppData\Local\Adobe
2015-05-18 14:14 - 2014-11-28 18:44 - 00778416 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerApp.exe
2015-05-18 14:14 - 2014-11-28 18:44 - 00142512 _____ (Adobe Systems Incorporated) C:\Windows\SysWOW64\FlashPlayerCPLApp.cpl
2015-05-18 14:14 - 2014-11-28 18:44 - 00003822 _____ () C:\Windows\System32\Tasks\Adobe Flash Player Updater
2015-05-17 22:05 - 2014-11-26 17:03 - 00002441 _____ () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Adobe Reader XI.lnk
2015-05-17 21:43 - 2009-07-14 05:20 - 00000000 ____D () C:\Windows\rescache
2015-05-17 21:18 - 2011-04-12 09:55 - 00000000 ____D () C:\Program Files\Windows Journal
2015-05-17 21:18 - 2009-07-14 06:45 - 00502448 _____ () C:\Windows\system32\FNTCACHE.DAT
2015-05-16 02:42 - 2014-11-26 18:18 - 00000000 ____D () C:\Windows\system32\MRT
2015-05-16 02:40 - 2014-11-26 18:18 - 140425016 _____ (Microsoft Corporation) C:\Windows\system32\MRT.exe
2015-05-15 22:51 - 2014-11-26 17:00 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files\Microsoft Silverlight
2015-05-15 22:51 - 2014-11-26 16:59 - 00000000 ____D () C:\Program Files (x86)\Microsoft Silverlight
2015-05-13 17:10 - 2014-11-24 13:06 - 00156360 _____ (Oracle Corporation) C:\Windows\system32\Drivers\VBoxNetFlt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00152744 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avgntflt.sys
2015-05-05 13:18 - 2014-11-26 16:48 - 00132120 _____ (Avira Operations GmbH & Co. KG) C:\Windows\system32\Drivers\avipbb.sys
2015-05-05 13:18 - 2014-11-26 16:46 - 00000000 ____D () C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira
2015-04-27 16:39 - 2015-02-06 16:27 - 00000000 ____D () C:\Users\Thomas\Desktop\Bachelorarbeit

==================== Files in the root of some directories =======

2014-11-26 20:31 - 2014-12-02 00:11 - 0000626 _____ () C:\Users\Thomas\AppData\Roaming\All CPU MeterV3_Settings.ini
2014-11-26 20:34 - 2014-11-26 20:47 - 0000841 _____ () C:\Users\Thomas\AppData\Roaming\Drives Meter_Settings.ini
2014-11-26 20:32 - 2015-01-13 16:02 - 0000292 _____ () C:\Users\Thomas\AppData\Roaming\GPU MeterV2_Settings.ini
2014-11-26 20:32 - 2014-11-26 20:33 - 0001328 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Settings.ini
2014-11-27 01:32 - 2015-05-27 11:29 - 0000027 _____ () C:\Users\Thomas\AppData\Roaming\Network Meter_Usage.ini
2015-05-25 17:17 - 2015-05-25 17:17 - 0011492 _____ () C:\Users\Thomas\AppData\Local\recently-used.xbel
2014-11-26 21:24 - 2015-04-06 00:04 - 0007604 _____ () C:\Users\Thomas\AppData\Local\Resmon.ResmonCfg

Files to move or delete:
====================
C:\Users\Thomas\IP_Log_Data.js
C:\Users\Thomas\Network_Meter_Data.js


Some files in TEMP:
====================
C:\Users\Thomas\AppData\Local\Temp\avgnt.exe
C:\Users\Thomas\AppData\Local\Temp\DelayInst.exe
C:\Users\Thomas\AppData\Local\Temp\gkey.exe
C:\Users\Thomas\AppData\Local\Temp\Hola-Setup-Plugin-x64-1.5.575.exe
C:\Users\Thomas\AppData\Local\Temp\installservice.exe
C:\Users\Thomas\AppData\Local\Temp\pkeyui.exe
C:\Users\Thomas\AppData\Local\Temp\Quarantine.exe
C:\Users\Thomas\AppData\Local\Temp\sfamcc00001.dll
C:\Users\Thomas\AppData\Local\Temp\sfextra.dll
C:\Users\Thomas\AppData\Local\Temp\sqlite3.dll
C:\Users\Thomas\AppData\Local\Temp\vpnclient_setup.exe
C:\Users\Thomas\AppData\Local\Temp\wabk.exe
C:\Users\Thomas\AppData\Local\Temp\_is8E1B.exe


==================== Bamital & volsnap Check =================

(There is no automatic fix for files that do not pass verification.)

C:\Windows\System32\winlogon.exe => File is digitally signed
C:\Windows\System32\wininit.exe => File is digitally signed
C:\Windows\SysWOW64\wininit.exe => File is digitally signed
C:\Windows\explorer.exe => File is digitally signed
C:\Windows\SysWOW64\explorer.exe => File is digitally signed
C:\Windows\System32\svchost.exe => File is digitally signed
C:\Windows\SysWOW64\svchost.exe => File is digitally signed
C:\Windows\System32\services.exe => File is digitally signed
C:\Windows\System32\User32.dll => File is digitally signed
C:\Windows\SysWOW64\User32.dll => File is digitally signed
C:\Windows\System32\userinit.exe => File is digitally signed
C:\Windows\SysWOW64\userinit.exe => File is digitally signed
C:\Windows\System32\rpcss.dll => File is digitally signed
C:\Windows\System32\Drivers\volsnap.sys => File is digitally signed


LastRegBack: 2015-05-25 17:46

==================== End of log ============================
         
Probleme hatte ich ja mit dem System an sich keine. Ich war nur etwas geschockt, dass ich 27 Trojaner auf meinem PC hatte, der eigentlich erst vor kurzem neu aufgesetzt wurde.
Wie lässt sich das denn in Zukunft am besten vermeiden? Avira Antivir scheint mir jetzt nicht grade so zuverlässig zu sein, denn das war ja installiert Gibts da eine bessere Lösung für?

EDIT: Heute wollte ich zum ersten Mal nach den ganzen Scans Spotify starten, was jedoch nicht ging. Nach einer Neuinstallation gehts jetzt wieder. Wollte ich nur kurz sagen, da es etwas merkwürdig ist.

Alt 29.05.2015, 06:39   #8
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



Java updaten.

Drücke bitte die Windowstaste + R Taste und schreibe notepad in das Ausführen Fenster.

Kopiere nun folgenden Text aus der Code-Box in das leere Textdokument

Code:
ATTFilter
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RBY29WX.exe

C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RQ1WDEN.exe

C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RR2JR8E.exe

C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RTU4O7F.exe

C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RU8D9JO.exe

C:\ProgramData\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe

C:\Users\All Users\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe

C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\OrbiterInstaller[1].exe

C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\SPSetup[1].exe

C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDK5CYCI\spstub[1].exe

C:\Users\Thomas\AppData\Local\Temp\DMR\dmr_72.exe

E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RBE8SB6.exe

E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RV1OHM3.exe

E:\Downloads\Ahnenblatt - CHIP-Installer.exe

E:\Downloads\Magical Jelly Bean Keyfinder - CHIP-Installer.exe

E:\Downloads\VirtualBox Extension Pack - CHIP-Installer.exe
Emptytemp:
         

Speichere diese bitte als Fixlist.txt auf deinem Desktop (oder dem Verzeichnis in dem sich FRST befindet).
  • Starte nun FRST erneut und klicke den Entfernen Button.
  • Das Tool erstellt eine Fixlog.txt.
  • Poste mir deren Inhalt.





Cleanup:
(Die Reihenfolge ist hier entscheidend)

Falls Defogger verwendet wurde: Erneut starten und auf Re-enable klicken.

Falls Combofix verwendet wurde:
Combofix deinstallieren
  • Wichtig: Bitte Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren.
  • Drücke bitte die + R Taste und schreibe Combofix /Uninstall in das Ausführen-Fenster.
  • Klicke auf OK.
    Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert.
  • Nun die eben deaktivierten Programme wieder aktivieren.

Alle Logs gepostet? Dann lade Dir bitte DelFix herunter.
  • Schließe alle offenen Programme.
  • Starte die delfix.exe mit einem Doppelklick.
  • Setze vor jede Funktion ein Häkchen.
  • Klicke auf Start.

Hinweis: DelFix entfernt u.a. alle verwendeten Programme, die Quarantäne unserer Scanner, den Java-Cache und löscht sich abschließend selbst.
Starte Deinen Rechner abschließend neu. Sollten jetzt noch Programme aus unserer Bereinigung übrig sein, kannst Du diese bedenkenlos löschen.

Wenn Du möchtest, kannst Du hier sagen, ob Du mit mir und meiner Hilfe zufrieden warst...und/oder das Forum mit einer kleinen Spende unterstützen.


Absicherung:
Beim Betriebsystem Windows die automatischen Updates aktivieren. Auch die sicherheitsrelevante Software sollte immer nur in der aktuellsten Version vorliegen:

Browser
Java
Flash-Player
PDF-Reader

Sicherheitslücken in deren alten Versionen werden dazu ausgenutzt, um beim einfachen Besuch einer manipulierten Website per "Drive-by" Malware zu installieren.
Ich empfehle z.B. die Verwendung von Mozilla Firefox statt des Internet Explorers. Zudem lassen sich mit dem Firefox auch PDF-Dokumente öffnen.

Aktiviere eine Firewall. Die in Windows integrierte genügt im Normalfall völlig.

Verwende ein Antivirusprogramm mit Echtzeitscanner und stets aktueller Signaturendatenbank.
Meine Empfehlung:

Emsisoft

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und ESET scannen.

Optional:
NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen.
Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.


Lade Software von einem sauberen Portal wie .
Wähle beim Installieren von Software immer die benutzerdefinierte Option und entferne den Haken bei allen optional angebotenen Toolbars oder sonstigen, fürs Programm, irrelevanten Ergänzungen.
Um Adware wieder los zu werden, empfiehlt sich zunächst die Deinstallation sowie die anschließende Resteentfernung mit Adwcleaner .


Abschließend noch ein paar grundsätzliche Bemerkungen:
Ändere regelmäßig Deine wichtigen Online-Passwörter und erstelle regelmäßig Backups Deiner wichtigen Dateien oder des Systems.
Der Nutzen von Registry-Cleanern, Optimizern usw. zur Performancesteigerung ist umstritten. Ich empfehle deshalb, die Finger von der Registry zu lassen und lieber die windowseigene Datenträgerbereinigung zu verwenden.
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Alt 29.05.2015, 11:02   #9
xter
 
Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



Vielen Dank für die Ausführliche Antwort und die tolle Hilfe. Die Tipps zur Absicherung werde ich anwenden und hoffen, dass ich mir damit weniger einhandle als bisher.

Hier ist noch das Fixlog.txt

Code:
ATTFilter
Fix result of Farbar Recovery Scan Tool (x64) Version: 25-05-2015
Ran by Thomas at 2015-05-29 11:57:02 Run:1
Running from C:\Users\Thomas\Desktop
Loaded Profiles: Thomas (Available Profiles: Thomas)
Boot Mode: Normal
==============================================

fixlist content:
*****************
C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RBY29WX.exe

C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RQ1WDEN.exe

C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RR2JR8E.exe

C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RTU4O7F.exe

C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RU8D9JO.exe

C:\ProgramData\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe

C:\Users\All Users\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe

C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\OrbiterInstaller[1].exe

C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\SPSetup[1].exe

C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDK5CYCI\spstub[1].exe

C:\Users\Thomas\AppData\Local\Temp\DMR\dmr_72.exe

E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RBE8SB6.exe

E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RV1OHM3.exe

E:\Downloads\Ahnenblatt - CHIP-Installer.exe

E:\Downloads\Magical Jelly Bean Keyfinder - CHIP-Installer.exe

E:\Downloads\VirtualBox Extension Pack - CHIP-Installer.exe
Emptytemp:
         
*****************

"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RBY29WX.exe" => File/Folder not found.
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RQ1WDEN.exe" => File/Folder not found.
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RR2JR8E.exe" => File/Folder not found.
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RTU4O7F.exe" => File/Folder not found.
"C:\$Recycle.Bin\S-1-5-21-1093152027-101576897-1014639688-1000\$RU8D9JO.exe" => File/Folder not found.
C:\ProgramData\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe => Moved successfully.
"C:\Users\All Users\Soda PDF 6\Installation\adawareTb_3.4.0.3_Lav01.exe" => File/Folder not found.
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\OrbiterInstaller[1].exe => Moved successfully.
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\UCAHT12S\SPSetup[1].exe => Moved successfully.
C:\Users\Thomas\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\YDK5CYCI\spstub[1].exe => Moved successfully.
C:\Users\Thomas\AppData\Local\Temp\DMR\dmr_72.exe => Moved successfully.
E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RBE8SB6.exe => Moved successfully.
E:\$RECYCLE.BIN\S-1-5-21-1465379200-1138453121-3922794703-1000\$RV1OHM3.exe => Moved successfully.
E:\Downloads\Ahnenblatt - CHIP-Installer.exe => Moved successfully.
E:\Downloads\Magical Jelly Bean Keyfinder - CHIP-Installer.exe => Moved successfully.
E:\Downloads\VirtualBox Extension Pack - CHIP-Installer.exe => Moved successfully.
EmptyTemp: => Removed 1.1 GB temporary data.


The system needed a reboot. 

==== End of Fixlog 11:57:20 ====
         

Alt 30.05.2015, 08:53   #10
schrauber
/// the machine
/// TB-Ausbilder
 

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Standard

Windows 7: Avira Antivir Live CD erkennt 27 Trojaner



Gern Geschehen
__________________
gruß,
schrauber

Proud Member of UNITE and ASAP since 2009

Spenden
Anleitungen und Hilfestellungen
Trojaner-Board Facebook-Seite

Keine Hilfestellung via PM!

Antwort

Themen zu Windows 7: Avira Antivir Live CD erkennt 27 Trojaner
ad-aware, böttcher, fehlercode 0x5;, fehlercode 0xc0000005, fehlercode 22, fehlercode windows, flash player, newtab, onedrive, pup.optional.conduit.a, svchost.exe, this device is disabled. (code 22), tr/cabhot.vuze, tr/crypt.epack.33213, tr/crypt.epack.33697, tr/crypt.xpack.188403, tr/crypt.xpack.87566, tr/crypt.zpack.145794, tr/crypt.zpack.gen7, tr/dldr.jraf, tr/downloader.gen7, tr/kryptik.gtap, tr/matsnu.a.113, tr/matsnu.a.166, tr/matsnu.a.260, tr/yakes.ceky, tracker, trojaner, whatsapp



Ähnliche Themen: Windows 7: Avira Antivir Live CD erkennt 27 Trojaner


  1. Avira erkennt mehr als 30 Funde
    Log-Analyse und Auswertung - 27.10.2015 (24)
  2. Avira Antivir (free) erkennt C# erstellte *.exe als Angriff -> TR/Spy.Gen
    Plagegeister aller Art und deren Bekämpfung - 23.12.2014 (5)
  3. Windows XP: Avira erkennt wiederholt TR/Symmi.44590 - Trojaner
    Log-Analyse und Auswertung - 21.08.2014 (21)
  4. Windows 7: Avira erkennt JAVA/Dldr.Kara.AR.1 ; EXP/CVE-2012-1723.A.312 und weitere
    Log-Analyse und Auswertung - 09.04.2014 (12)
  5. Avira erkennt Trojaner/Viren
    Log-Analyse und Auswertung - 05.09.2013 (1)
  6. GVU Trojaner gefangen am 9.10.2013 (Betriebssystem: Windows XP, Antivir: Avira)
    Log-Analyse und Auswertung - 03.03.2013 (4)
  7. (2x) Windows und Avira Antivir Guard starten langsam
    Mülltonne - 13.12.2012 (1)
  8. Avira findet ADWARE/CiDHelp.A.4 im Messenger Live Plug-in - ein Virus/Trojaner?
    Plagegeister aller Art und deren Bekämpfung - 14.11.2012 (7)
  9. Ad-Aware erkennt: Win32.Trojan.Agent / c:\program files (x86)\avira\antivir desktop\failsafe\aeexp.dll
    Plagegeister aller Art und deren Bekämpfung - 21.10.2012 (6)
  10. LIVE SECURITY PLATINUM Trojaner entfernt. Avira Antivir startet aber keinen Suchlauf!
    Plagegeister aller Art und deren Bekämpfung - 06.09.2012 (16)
  11. Live Security eingefangen - Firefox leitet zu Windows Live um - immer noch Viren auf meinem PC?
    Plagegeister aller Art und deren Bekämpfung - 26.07.2012 (27)
  12. Welche aktuelle Live CD erkennt Bootsektor Viren
    Plagegeister aller Art und deren Bekämpfung - 05.04.2011 (4)
  13. AntiVir erkennt Spyeye
    Plagegeister aller Art und deren Bekämpfung - 14.03.2011 (5)
  14. Windows Vista / 7 Kombatibilität Avira Antivir?
    Antiviren-, Firewall- und andere Schutzprogramme - 25.11.2010 (4)
  15. Avira Antivir meldet BDS\Papras.QN in C:\WINDOWS\cidamapi.dll
    Plagegeister aller Art und deren Bekämpfung - 25.09.2010 (10)
  16. Avira Antivir 10: Keine Verhaltenserkennung unter 64-Bit-Windows
    Nachrichten - 29.03.2010 (0)
  17. kleines BS live oder parallel mit windows xp gesucht das einen WLAN Drucker erkennt
    Alles rund um Windows - 30.01.2009 (12)

Zum Thema Windows 7: Avira Antivir Live CD erkennt 27 Trojaner - Hallo erstmal Ich habe gerade eben meinen PC mit einer Live-CD von Avira Antivir gescannt und war ziemlich überrascht von den 27 Funden. Ich hoffe ihr könnt mir helfen diese - Windows 7: Avira Antivir Live CD erkennt 27 Trojaner...
Archiv
Du betrachtest: Windows 7: Avira Antivir Live CD erkennt 27 Trojaner auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.