Zurück   Trojaner-Board > Malware entfernen > Log-Analyse und Auswertung

Log-Analyse und Auswertung: CryptXXX 3.0: Alle Files auf .crypz verschlüsselt

Windows 7 Wenn Du Dir einen Trojaner eingefangen hast oder ständig Viren Warnungen bekommst, kannst Du hier die Logs unserer Diagnose Tools zwecks Auswertung durch unsere Experten posten. Um Viren und Trojaner entfernen zu können, muss das infizierte System zuerst untersucht werden: Erste Schritte zur Hilfe. Beachte dass ein infiziertes System nicht vertrauenswürdig ist und bis zur vollständigen Entfernung der Malware nicht verwendet werden sollte.

Antwort
Alt 30.06.2016, 21:55   #1
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Hallo zusammen,

auch ich habe mir offensichtlich den Trojaner CryptXXX 3.0 eingefangen, der mir alle Dateien mit RSA-4096 verschlüsselt hat. Dateiendung <Originalname>.crypt.

Habe bereits mehrere Maßnahmen unternommen, wobei Microsoft Security Essentials der Meinung ist, dass der Trojaner erfolgreich entfernt wurde. In der Tat habe ich bis auf die verschlüsselten Dateien keine Hinweise mehr entdecken können.

Mein Anliegen ist nun folgendes:
1. Ist mein Rechner wirklich sauber?
2. Wie kann ich die Dateien wieder entschlüsseln?

Zu 1. habe ich die Logfiles angehängt, die ihr immer anfordert (siehe unten).
Zu 2. konnte ich mit dem Tool Ransomware File Decryptor von Trendmicro zwar die Dateien entschlüsseln, leider sind sie jedoch unlesbar. Die Filegröße nach der Entschlüsselung ist identisch mit der originalen Datei (einer der wenigen Files, die ich gesichert habe), öffnen lassen sie sich aber nicht.


Werde die oftmals gewünschten Logs in den folgenden Beiträgen posten.

Ich hoffe ihr könnt mir helfen!!

Danke schon mal im Voraus,
Emroi

Verschlüsselungstrojaner: CryptXXX 3.0
Decryptor gibt es aktuell wohl noch nicht.


Output FRST.txt:

Code:
ATTFilter
Untersuchungsergebnis von Farbar Recovery Scan Tool (FRST) (x64) Version: 29-06-2016
durchgeführt von MEmroi (Administrator) auf Emroi (30-06-2016 21:19:59)
Gestartet von C:\Users\MEmroi\Desktop
Geladene Profile: MEmroi (Verfügbare Profile: MEmroi)
Platform: Windows 7 Home Premium Service Pack 1 (X64) Sprache: Deutsch (Deutschland)
Internet Explorer Version 11 (Standard-Browser: IE)
Start-Modus: Normal
Anleitung für Farbar Recovery Scan Tool: hxxp://www.geekstogo.com/forum/topic/335081-frst-tutorial-how-to-use-farbar-recovery-scan-tool/

==================== Prozesse (Nicht auf der Ausnahmeliste) =================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Prozess geschlossen. Die Datei wird nicht verschoben.)

(Microsoft Corporation) C:\Program Files\Microsoft Security Client\MsMpEng.exe
(AMD) C:\Windows\System32\atiesrxx.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\stacsv64.exe
(Microsoft Corporation) C:\Windows\System32\wlanext.exe
(Apple Inc.) C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
(Apple Inc.) C:\Program Files\Bonjour\mDNSResponder.exe
(Seiko Epson Corporation) C:\Windows\System32\escsvc64.exe
(EasyBits Software AS) C:\Windows\SysWOW64\ezSharedSvcHost.exe
(Symantec Corporation) C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
(Ralink Technology, Corp.) C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
(Microsoft Corp.) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVCM.EXE
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\NisSrv.exe
(AMD) C:\Windows\System32\atieclxx.exe
(Microsoft Corporation) C:\Windows\System32\GWX\GWX.exe
(IDT, Inc.) C:\Program Files\IDT\WDM\sttray64.exe
(Hewlett-Packard ) C:\Program Files\IDT\WDM\Beats64.exe
(Hewlett-Packard) C:\Program Files (x86)\Hewlett-Packard\HP Odometer\hpsysdrv.exe
(Apple Inc.) C:\Program Files\iTunes\iTunesHelper.exe
(Microsoft Corporation) C:\Program Files\Microsoft Security Client\msseces.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Samsung) C:\Program Files (x86)\Samsung\Kies\Kies.exe
() C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
(Samsung Electronics Co., Ltd.) C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
(Apple Inc.) C:\Program Files\iPod\bin\iPodService.exe
(Suunto Oy) C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\Moveslink.exe
(Ralink Technology, Inc.) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
(PIXELA CORPORATION) C:\Program Files (x86)\Canon Pixela VideoBrowser\CameraMonitor.exe
(Microsoft Corporation) C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE
(Microsoft Corporation) C:\Program Files\Internet Explorer\iexplore.exe
(Google) C:\Program Files (x86)\Google\Drive\googledrivesync.exe
(Adobe Systems Incorporated) C:\Windows\System32\Macromed\Flash\FlashUtil64_18_0_0_209_ActiveX.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Advanced Micro Devices Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\MOM.exe
(ATI Technologies Inc.) C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CCC.exe
(Intel Corporation) C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
(Microsoft Corporation) C:\Windows\System32\dllhost.exe
(Trend Micro Inc.) C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI\RansomwareFileDecryptor 1.0.1595 MUI.exe
(Trend Micro Inc.) C:\Users\MEmroi\AppData\Local\Temp\TMRDTSelfExtract\TMRDT.exe
(Microsoft Corporation) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE


==================== Registry (Nicht auf der Ausnahmeliste) ===========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt. Die Datei wird nicht verschoben.)

HKLM\...\Run: [SysTrayApp] => C:\Program Files\IDT\WDM\sttray64.exe [1425408 2012-03-30] (IDT, Inc.)
HKLM\...\Run: [BeatsOSDApp] => C:\Program Files\IDT\WDM\beats64.exe [37888 2012-03-30] (Hewlett-Packard )
HKLM\...\Run: [HPSYSDRV] => C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE [62768 2008-11-20] (Hewlett-Packard)
HKLM\...\Run: [iTunesHelper] => C:\Program Files\iTunes\iTunesHelper.exe [170256 2015-10-16] (Apple Inc.)
HKLM\...\Run: [MSC] => c:\Program Files\Microsoft Security Client\msseces.exe [1340192 2016-01-29] (Microsoft Corporation)
HKLM-x32\...\Run: [StartCCC] => C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe [641664 2012-04-08] (Advanced Micro Devices, Inc.)
HKLM-x32\...\Run: [AMD AVT] => C:\Program Files (x86)\AMD AVT\bin\kdbsync.exe [10752 2012-02-21] ()
HKLM-x32\...\Run: [Norton Online Backup] => C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe [1155928 2010-06-02] (Symantec Corporation)
HKLM-x32\...\Run: [Easybits Recovery] => C:\Program Files (x86)\EasyBits For Kids\ezRecover.exe
HKLM-x32\...\Run: [Adobe ARM] => C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe [926896 2012-09-23] (Adobe Systems Incorporated)
HKLM-x32\...\Run: [APSDaemon] => C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe [60688 2015-10-13] (Apple Inc.)
HKLM-x32\...\Run: [KiesTrayAgent] => C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe [3524536 2012-08-31] (Samsung Electronics Co., Ltd.)
HKLM-x32\...\Run: [Magic Desktop for HP notification] => C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe [1444880 2015-11-26] (Easybits)
HKLM\...\Policies\Explorer: [EnableShellExecuteHooks] 1
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [GoogleDriveSync] => C:\Program Files (x86)\Google\Drive\googledrivesync.exe [23496872 2016-05-17] (Google)
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesPreload] => C:\Program Files (x86)\Samsung\Kies\Kies.exe [964024 2012-08-31] (Samsung)
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesAirMessage] => C:\Program Files (x86)\Samsung\Kies\KiesAirMessage.exe -startup
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Run: [KiesPDLR] => C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe [21432 2012-08-31] ()
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Policies\system: [DisableLockWorkstation] 0
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Policies\system: [DisableChangePassword] 0
ShellIconOverlayIdentifiers: [  GoogleDriveBlacklisted] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D42} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSynced] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D40} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [  GoogleDriveSyncing] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D41} => C:\Program Files (x86)\Google\Drive\googledrivesync64.dll [2016-05-17] (Google)
ShellIconOverlayIdentifiers: [  OverlayExcluded] -> {4433A54A-1AC8-432F-90FC-85F045CF383C} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [  OverlayPending] -> {F17C0B1E-EF8E-4AD4-8E1B-7D7E8CB23225} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [  OverlayProtected] -> {476D0EA3-80F9-48B5-B70B-05E677C9C148} => C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\buShell.dll [2016-06-09] (Symantec Corporation)
ShellIconOverlayIdentifiers: [GDriveSharedOverlay] -> {81539FE6-33C7-4CE7-90C7-1C7B8F2F2D44} =>  Keine Datei
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Moveslink for Movestick Mini.lnk [2016-02-01]
ShortcutTarget: Moveslink for Movestick Mini.lnk -> C:\Windows\Installer\{4D036ACA-DFDF-41B2-A680-E0D736F3E947}\_22A9010B636AF7A61D8E03.exe ()
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\Ralink Wireless Utility.lnk [2014-11-18]
ShortcutTarget: Ralink Wireless Utility.lnk -> C:\Program Files (x86)\Ralink\Common\RaWiFi.exe (Ralink Technology, Inc.)
Startup: C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\VideoBrowser Camera Monitor.lnk [2015-09-11]
ShortcutTarget: VideoBrowser Camera Monitor.lnk -> C:\Program Files (x86)\Canon Pixela VideoBrowser\CameraMonitor.exe (PIXELA CORPORATION)
Startup: C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk [2016-05-23]
ShortcutTarget: OneNote 2010 Bildschirmausschnitt- und Startprogramm.lnk -> C:\Program Files (x86)\Microsoft Office\Office14\ONENOTEM.EXE (Microsoft Corporation)

==================== Internet (Nicht auf der Ausnahmeliste) ====================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Eintrag entfernt oder auf den Standardwert zurückgesetzt, wenn es sich um einen Registryeintrag handelt.)

Tcpip\Parameters: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{700E6166-4808-4F00-BEC5-94704CC93633}: [DhcpNameServer] 192.168.0.1 192.168.0.2
Tcpip\..\Interfaces\{9F1850AC-45C5-4E34-A0DF-938B166300BB}: [DhcpNameServer] 192.168.0.1 192.168.0.2

Internet Explorer:
==================
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://g.uk.msn.com/HPDSK/4
HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Software\Microsoft\Internet Explorer\Main,bProtector Start Page = hxxp://www.claro-search.com/?affID=114506&tt=0413_2&babsrc=HP_clro&mntrId=742bfa5200000000000074e543100086
SearchScopes: HKLM -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKLM-x32 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKLM-x32 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKLM-x32 -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKLM-x32 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKLM-x32 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKLM-x32 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
SearchScopes: HKU\.DEFAULT -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = 
SearchScopes: HKU\.DEFAULT -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = 
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> DefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> bProtectorDefaultScope {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {0633EE93-D776-472f-A0FF-E1416B8B2E3A} URL = hxxp://www.bing.com/search?q={searchTerms}&form=HPDTDF&pc=HPDTDF&src=IE-SearchBox
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9} URL = hxxp://www.claro-search.com/?q={searchTerms}&affID=114506&tt=0413_2&babsrc=SP_clro&mntrId=742bfa5200000000000074e543100086
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {2fa28606-de77-4029-af96-b231e3b8f827} URL = hxxp://eu.ask.com/web?q={searchterms}&l=dis&o=HPDTDF
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {9C119A54-6B53-4C54-B208-43352455E521} URL = hxxp://www.amazon.de/s/ref=azs_osd_ieade?ie=UTF-8&tag=hp-de1-vsb-21&link%5Fcode=qs&index=aps&field-keywords={searchTerms}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {b7fca997-d0fb-4fe0-8afd-255e89cf9671} URL = hxxp://de.search.yahoo.com/search?p={searchTerms}&ei={inputEncoding}&fr=chr-hp-psg&type=HPDTDF
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {d43b3890-80c7-4010-a95d-1e77b5924dc3} URL = hxxp://de.wikipedia.org/wiki/Special:Search?search={searchTerms}
SearchScopes: HKU\S-1-5-21-1078291597-1949154093-2174115440-1001 -> {D944BB61-2E34-4DBF-A683-47E505C587DC} URL = hxxp://rover.ebay.com/rover/1/707-111076-19270-2/4?mpre=hxxp://www.ebay.de/sch/i.html?_nkw={searchTerms}
BHO: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
BHO: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
BHO-x32: Adobe PDF Link Helper -> {18DF081C-E8AD-4283-A596-FA578C2EBDC3} -> C:\Program Files (x86)\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll [2012-09-23] (Adobe Systems Incorporated)
BHO-x32: Norton Identity Protection -> {602ADB0E-4AFF-4217-8AA1-95DAC4DFA408} -> C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
BHO-x32: Norton Vulnerability Protection -> {6D53EC84-6AAE-4787-AEEE-F4628F01010C} -> C:\Program Files (x86)\Norton Internet Security\Engine\21.7.0.11\IPS\IPSBHO.DLL => Keine Datei
BHO-x32: Windows Live ID Sign-in Helper -> {9030D464-4C02-4ABF-8ECC-5164760863C6} -> C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll [2011-03-29] (Microsoft Corp.)
BHO-x32: Office Document Cache Handler -> {B4F3A835-0E21-4959-BA22-42B3008E02FF} -> C:\Program Files (x86)\Microsoft Office\Office14\URLREDIR.DLL [2013-03-06] (Microsoft Corporation)
Toolbar: HKLM - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine64\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)
Toolbar: HKLM-x32 - Norton Toolbar - {7FEBEFE3-6B19-4349-98D2-FFB09D4B49CA} - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\coIEPlg.dll [2016-05-31] (Symantec Corporation)

FireFox:
========
FF ProfilePath: C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default
FF NewTab: hxxp://www.claro-search.com/?affID=114506&tt=0413_2&babsrc=NT_clro&mntrId=742bfa5200000000000074e543100086
FF SelectedSearchEngine: Claro Search
FF Homepage: hxxp://www.google.de/
FF Plugin: @adobe.com/FlashPlayer -> C:\windows\system32\Macromed\Flash\NPSWF64_11_5_502_135.dll [2013-01-03] ()
FF Plugin: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~1\MICROS~2\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @adobe.com/FlashPlayer -> C:\windows\SysWOW64\Macromed\Flash\NPSWF32_11_5_502_135.dll [2013-01-03] ()
FF Plugin-x32: @Apple.com/iTunes,version=1.0 -> C:\Program Files (x86)\iTunes\Mozilla Plugins\npitunes.dll [2015-10-08] ()
FF Plugin-x32: @Google.com/GoogleEarthPlugin -> C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll [2013-10-07] (Google)
FF Plugin-x32: @Microsoft.com/NpCtrl,version=1.0 -> c:\Program Files (x86)\Microsoft Silverlight\5.1.50428.0\npctrl.dll [2016-04-27] ( Microsoft Corporation)
FF Plugin-x32: @microsoft.com/OfficeAuthz,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPAUTHZ.DLL [2010-01-09] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/SharePoint,version=14.0 -> C:\PROGRA~2\MICROS~1\Office14\NPSPWRAP.DLL [2010-03-24] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3502.0922 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @microsoft.com/WLPG,version=15.4.3538.0513 -> C:\Program Files (x86)\Windows Live\Photo Gallery\NPWLPG.dll [2011-05-14] (Microsoft Corporation)
FF Plugin-x32: @tools.google.com/Google Update;version=3 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-21] (Google Inc.)
FF Plugin-x32: @tools.google.com/Google Update;version=9 -> C:\Program Files (x86)\Google\Update\1.3.30.3\npGoogleUpdate3.dll [2016-05-21] (Google Inc.)
FF Plugin-x32: Adobe Reader -> C:\Program Files (x86)\Adobe\Reader 11.0\Reader\AIR\nppdf32.dll [2012-09-23] (Adobe Systems Inc.)
FF user.js: detected! => C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\user.js [2013-01-21]
FF SearchPlugin: C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\searchplugins\claro.xml [2013-01-21]
FF Extension: Yahoo! Toolbar - C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\extensions\{635abd67-4fe9-1b23-4f01-e679fa7484c1} [2015-05-25] [ist nicht signiert]
FF Extension: SaveByclick - C:\Users\MEmroi\AppData\Roaming\Mozilla\Firefox\Profiles\vjtlm2h6.default\Extensions\50e5dde6b181e@50e5dde6b1857.com [2016-01-13] [ist nicht signiert]
FF HKLM\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon
FF Extension: Norton Identity Safe - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon [2016-06-27]
FF HKLM-x32\...\Firefox\Extensions: [{C1A2A613-35F1-4FCF-B27F-2840527B6556}] - C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_22.7.0.76\coFFAddon
FF HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\...\Firefox\Extensions: [{58bd07eb-0ee0-4df0-8121-dc9b693373df}] - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension => nicht gefunden

Chrome: 
=======
CHR Profile: C:\Users\MEmroi\AppData\Local\Google\Chrome\User Data\Default
CHR Extension: (SaveByclick) - C:\Users\MEmroi\AppData\Local\Google\Chrome\User Data\Default\Extensions\oakgcbilhdnlpcplelkckgfcfbhmpjoa [2013-01-03]
CHR HKLM\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\Exts\Chrome.crx [2016-06-27]
CHR HKLM\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [cjabmdjcfcfdmffimndhafhblfmpjdpe] - C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\Exts\Chrome.crx [2016-06-27]
CHR HKLM-x32\...\Chrome\Extension: [iikflkcanblccfahdhdonehdalibjnif] - hxxps://clients2.google.com/service/update2/crx
CHR HKLM-x32\...\Chrome\Extension: [pgafcinpmmpklohkojmllohdhomoefph] - C:\ProgramData\BrowserProtect\2.6.1095.52\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.crx <nicht gefunden>

==================== Dienste (Nicht auf der Ausnahmeliste) ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R2 Apple Mobile Device Service; C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe [77104 2015-10-07] (Apple Inc.)
R2 EpsonScanSvc; C:\windows\system32\EscSvc64.exe [144560 2012-05-17] (Seiko Epson Corporation)
R2 ezSharedSvc; C:\windows\SysWOW64\ezSharedSvcHost.exe [514232 2010-04-23] (EasyBits Software AS) [Datei ist nicht signiert]
R2 MsMpSvc; c:\Program Files\Microsoft Security Client\MsMpEng.exe [23808 2016-01-29] (Microsoft Corporation)
S2 NIS; C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\NIS.exe [289080 2016-06-17] (Symantec Corporation)
R3 NisSrv; c:\Program Files\Microsoft Security Client\NisSrv.exe [374344 2016-01-29] (Microsoft Corporation)
R2 NOBU; C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe [2804568 2010-06-02] (Symantec Corporation)
R2 RalinkRegistryWriter; C:\Program Files (x86)\Ralink\Common\RaRegistry.exe [372736 2012-01-13] (Ralink Technology, Corp.) [Datei ist nicht signiert]
R2 RalinkRegistryWriter64; C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe [447488 2012-01-13] (Ralink Technology, Corp.) [Datei ist nicht signiert]
S2 RaMediaServer; C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe [625728 2011-08-19] ()
R2 STacSV; C:\Program Files\IDT\WDM\STacSV64.exe [311296 2012-03-30] (IDT, Inc.) [Datei ist nicht signiert]
S3 WinDefend; C:\Program Files\Windows Defender\mpsvc.dll [1011712 2013-05-27] (Microsoft Corporation)
S2 HP Support Assistant Service; "C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\hpsa_service.exe" [X]
S3 hpqwmiex; "C:\Program Files (x86)\Hewlett-Packard\Shared\hpqWmiEx.exe" [X]

===================== Treiber (Nicht auf der Ausnahmeliste) ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

R1 BHDrvx64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\BASHDefs\20160621.003\BHDrvx64.sys [1832176 2016-06-02] (Symantec Corporation)
R1 ccSet_NIS; C:\Windows\system32\drivers\NISx64\1607000.04C\ccSetx64.sys [174328 2016-06-02] (Symantec Corporation)
S3 ebdrv; C:\Windows\system32\drivers\evbda.sys [3286016 2009-06-10] (Broadcom Corporation)
R1 eeCtrl; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys [497392 2016-06-11] (Symantec Corporation)
R3 EraserUtilRebootDrv; C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [156912 2016-06-11] (Symantec Corporation)
R1 IDSVia64; C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\IPSDefs\20160627.005\IDSvia64.sys [876248 2016-06-24] (Symantec Corporation)
S3 libusb0; C:\Windows\System32\DRIVERS\libusb0.sys [43456 2011-02-02] (hxxp://libusb-win32.sourceforge.net)
R0 MpFilter; C:\Windows\System32\DRIVERS\MpFilter.sys [289120 2015-11-13] (Microsoft Corporation)
R3 NisDrv; C:\Windows\System32\DRIVERS\NisDrvWFP.sys [133816 2015-11-13] (Microsoft Corporation)
R1 SRTSP; C:\Windows\System32\Drivers\NISx64\1607000.04C\SRTSP64.SYS [773360 2016-06-02] (Symantec Corporation)
R1 SRTSPX; C:\Windows\system32\drivers\NISx64\1607000.04C\SRTSPX64.SYS [48888 2016-06-02] (Symantec Corporation)
S1 StarOpen; C:\Windows\SysWow64\Drivers\StarOpen.sys [5632 2006-07-24] () [Datei ist nicht signiert]
R0 SymEFASI; C:\Windows\System32\drivers\NISx64\1607000.04C\SYMEFASI64.SYS [1627352 2016-06-02] (Symantec Corporation)
R3 SymEvent; C:\windows\system32\Drivers\SYMEVENT64x86.SYS [101112 2016-06-27] (Symantec Corporation)
R1 SymIRON; C:\Windows\system32\drivers\NISx64\1607000.04C\Ironx64.SYS [291056 2016-06-02] (Symantec Corporation)
R1 SymNetS; C:\Windows\System32\Drivers\NISx64\1607000.04C\SYMNETS.SYS [567536 2016-06-02] (Symantec Corporation)
S3 NAVENG; \??\C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\SDSDefs\20160626.018\ENG64.SYS [X]
S3 NAVEX15; \??\C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\SDSDefs\20160626.018\EX64.SYS [X]

==================== NetSvcs (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Ein Monat: Erstellte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-06-30 21:19 - 2016-06-30 21:20 - 00025374 _____ C:\Users\MEmroi\Desktop\FRST.txt
2016-06-30 21:19 - 2016-06-30 21:19 - 02390016 _____ (Farbar) C:\Users\MEmroi\Desktop\FRST64.exe
2016-06-30 21:19 - 2016-06-30 21:19 - 00000000 ____D C:\FRST
2016-06-30 20:34 - 2016-06-30 20:34 - 01496971 _____ C:\Users\MEmroi\Desktop\jpegsnoop-1-7-5-en-win.zip
2016-06-30 20:34 - 2016-06-30 20:34 - 00000000 ____D C:\Users\MEmroi\AppData\Roaming\JPEGsnoop
2016-06-30 20:30 - 2016-06-30 20:30 - 00000000 ____D C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI
2016-06-30 20:28 - 2016-06-30 20:28 - 08820004 _____ C:\Users\MEmroi\Desktop\RansomwareFileDecryptor 1.0.1595 MUI.zip
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\ParetoLogic
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\ProgramData\ParetoLogic
2016-06-29 21:26 - 2016-06-30 21:08 - 00000000 ____D C:\Program Files (x86)\ParetoLogic
2016-06-27 17:24 - 2016-06-27 17:24 - 00002242 _____ C:\ScraperDecryptor.1.0.0.2_27.06.2016_17.24.01_log.txt
2016-06-27 17:22 - 2016-06-27 17:23 - 00002502 _____ C:\RakhniDecryptor.1.15.10.0_27.06.2016_17.22.05_log.txt
2016-06-27 16:40 - 2016-06-27 17:04 - 63037856 _____ C:\RectorDecryptor.2.7.0.0_27.06.2016_16.40.51_log.txt
2016-06-27 16:32 - 2016-06-27 16:40 - 11183508 _____ C:\XoristDecryptor.2.4.0.0_27.06.2016_16.32.28_log.txt
2016-06-27 16:28 - 2016-06-27 16:28 - 00002222 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.28.04_log.txt
2016-06-27 16:25 - 2016-06-27 16:27 - 00002416 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.25.40_log.txt
2016-06-27 16:19 - 2016-06-27 16:22 - 00002310 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.19.29_log.txt
2016-06-27 16:16 - 2016-06-27 16:18 - 00002494 _____ C:\RannohDecryptor.1.9.1.1_27.06.2016_16.16.26_log.txt
2016-06-27 16:05 - 2016-06-06 18:58 - 00041704 _____ (Microsoft Corporation) C:\windows\system32\CompatTelRunner.exe
2016-06-27 16:05 - 2016-06-06 18:50 - 01204224 _____ (Microsoft Corporation) C:\windows\system32\aeinv.dll
2016-06-27 16:05 - 2016-06-03 15:05 - 01413120 _____ (Microsoft Corporation) C:\windows\system32\appraiser.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00569856 _____ (Microsoft Corporation) C:\windows\system32\generaltel.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00544256 _____ (Microsoft Corporation) C:\windows\system32\devinv.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00276480 _____ (Microsoft Corporation) C:\windows\system32\invagent.dll
2016-06-27 16:05 - 2016-05-27 15:06 - 00265216 _____ (Microsoft Corporation) C:\windows\system32\centel.dll
2016-06-27 16:05 - 2016-05-22 15:06 - 00076800 _____ (Microsoft Corporation) C:\windows\system32\acmigration.dll
2016-06-27 16:05 - 2016-05-20 23:59 - 00034304 _____ (Microsoft Corporation) C:\windows\system32\iernonce.dll
2016-06-27 16:05 - 2016-05-20 23:57 - 00047616 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieetwproxystub.dll
2016-06-27 16:05 - 2016-05-20 23:54 - 00114688 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollector.exe
2016-06-27 16:05 - 2016-05-20 23:48 - 00030720 _____ (Microsoft Corporation) C:\windows\SysWOW64\iernonce.dll
2016-06-27 16:05 - 2016-05-20 23:26 - 00091136 _____ (Microsoft Corporation) C:\windows\SysWOW64\inseng.dll
2016-06-27 16:05 - 2016-05-18 18:10 - 00312832 _____ (Microsoft Corporation) C:\windows\SysWOW64\gdi32.dll
2016-06-27 16:05 - 2016-05-18 18:09 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\gdi32.dll
2016-06-27 16:05 - 2016-05-14 00:15 - 00382184 _____ (Adobe Systems Incorporated) C:\windows\system32\atmfd.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00100864 _____ (Microsoft Corporation) C:\windows\system32\fontsub.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00046080 _____ (Adobe Systems) C:\windows\system32\atmlib.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00041472 _____ (Microsoft Corporation) C:\windows\system32\lpk.dll
2016-06-27 16:05 - 2016-05-14 00:09 - 00014336 _____ (Microsoft Corporation) C:\windows\system32\dciman32.dll
2016-06-27 16:05 - 2016-05-13 23:54 - 00308456 _____ (Adobe Systems Incorporated) C:\windows\SysWOW64\atmfd.dll
2016-06-27 16:05 - 2016-05-13 23:50 - 00025600 _____ (Microsoft Corporation) C:\windows\SysWOW64\lpk.dll
2016-06-27 16:05 - 2016-05-13 23:49 - 00070656 _____ (Microsoft Corporation) C:\windows\SysWOW64\fontsub.dll
2016-06-27 16:05 - 2016-05-13 23:49 - 00010240 _____ (Microsoft Corporation) C:\windows\SysWOW64\dciman32.dll
2016-06-27 16:05 - 2016-05-13 23:27 - 00034304 _____ (Adobe Systems) C:\windows\SysWOW64\atmlib.dll
2016-06-27 16:05 - 2016-05-12 19:20 - 00154856 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecpkg.sys
2016-06-27 16:05 - 2016-05-12 19:20 - 00095464 _____ (Microsoft Corporation) C:\windows\system32\Drivers\ksecdd.sys
2016-06-27 16:05 - 2016-05-12 19:15 - 00210432 _____ (Microsoft Corporation) C:\windows\system32\wdigest.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00135680 _____ (Microsoft Corporation) C:\windows\system32\sspicli.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00105472 _____ (Microsoft Corporation) C:\windows\system32\winipsec.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00086528 _____ (Microsoft Corporation) C:\windows\system32\TSpkg.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00028672 _____ (Microsoft Corporation) C:\windows\system32\sspisrv.dll
2016-06-27 16:05 - 2016-05-12 19:15 - 00002048 _____ (Microsoft Corporation) C:\windows\system32\tzres.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 01464320 _____ (Microsoft Corporation) C:\windows\system32\lsasrv.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 01212928 _____ (Microsoft Corporation) C:\windows\system32\rpcrt4.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00794624 _____ (Microsoft Corporation) C:\windows\system32\gpsvc.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00730624 _____ (Microsoft Corporation) C:\windows\system32\kerberos.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00690688 _____ (Microsoft Corporation) C:\windows\system32\adtschema.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00502272 _____ (Microsoft Corporation) C:\windows\system32\IPSECSVC.DLL
2016-06-27 16:05 - 2016-05-12 19:14 - 00463872 _____ (Microsoft Corporation) C:\windows\system32\certcli.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00373760 _____ (Microsoft Corporation) C:\windows\system32\polstore.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00344064 _____ (Microsoft Corporation) C:\windows\system32\schannel.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00316416 _____ (Microsoft Corporation) C:\windows\system32\msv1_0.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00312320 _____ (Microsoft Corporation) C:\windows\system32\ncrypt.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00190464 _____ (Microsoft Corporation) C:\windows\system32\rpchttp.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00146432 _____ (Microsoft Corporation) C:\windows\system32\msaudite.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00096256 _____ (Microsoft Corporation) C:\windows\system32\gpapi.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00075776 _____ (Microsoft Corporation) C:\windows\system32\FwRemoteSvr.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00060416 _____ (Microsoft Corporation) C:\windows\system32\msobjs.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00043520 _____ (Microsoft Corporation) C:\windows\system32\cryptbase.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00028160 _____ (Microsoft Corporation) C:\windows\system32\secur32.dll
2016-06-27 16:05 - 2016-05-12 19:14 - 00022016 _____ (Microsoft Corporation) C:\windows\system32\credssp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00690688 _____ (Microsoft Corporation) C:\windows\SysWOW64\adtschema.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00666112 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpcrt4.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00553472 _____ (Microsoft Corporation) C:\windows\SysWOW64\kerberos.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00342528 _____ (Microsoft Corporation) C:\windows\SysWOW64\certcli.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00274944 _____ (Microsoft Corporation) C:\windows\SysWOW64\polstore.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00260608 _____ (Microsoft Corporation) C:\windows\SysWOW64\msv1_0.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00251392 _____ (Microsoft Corporation) C:\windows\SysWOW64\schannel.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00223232 _____ (Microsoft Corporation) C:\windows\SysWOW64\ncrypt.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00172032 _____ (Microsoft Corporation) C:\windows\SysWOW64\wdigest.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00146432 _____ (Microsoft Corporation) C:\windows\SysWOW64\msaudite.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00141312 _____ (Microsoft Corporation) C:\windows\SysWOW64\rpchttp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00096768 _____ (Microsoft Corporation) C:\windows\SysWOW64\sspicli.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00079360 _____ (Microsoft Corporation) C:\windows\SysWOW64\gpapi.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00070144 _____ (Microsoft Corporation) C:\windows\SysWOW64\winipsec.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00065536 _____ (Microsoft Corporation) C:\windows\SysWOW64\TSpkg.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\msobjs.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00044032 _____ (Microsoft Corporation) C:\windows\SysWOW64\FwRemoteSvr.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00022016 _____ (Microsoft Corporation) C:\windows\SysWOW64\secur32.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00017408 _____ (Microsoft Corporation) C:\windows\SysWOW64\credssp.dll
2016-06-27 16:05 - 2016-05-12 17:18 - 00002048 _____ (Microsoft Corporation) C:\windows\SysWOW64\tzres.dll
2016-06-27 16:05 - 2016-05-12 17:05 - 00064000 _____ (Microsoft Corporation) C:\windows\system32\auditpol.exe
2016-06-27 16:05 - 2016-05-12 17:03 - 03217408 _____ (Microsoft Corporation) C:\windows\system32\win32k.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00464896 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00405504 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srv2.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00291328 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb10.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00168960 _____ (Microsoft Corporation) C:\windows\system32\Drivers\srvnet.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00159744 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb.sys
2016-06-27 16:05 - 2016-05-12 16:58 - 00129536 _____ (Microsoft Corporation) C:\windows\system32\Drivers\mrxsmb20.sys
2016-06-27 16:05 - 2016-05-12 16:57 - 00030720 _____ (Microsoft Corporation) C:\windows\system32\lsass.exe
2016-06-27 16:05 - 2016-05-12 16:56 - 00050176 _____ (Microsoft Corporation) C:\windows\SysWOW64\auditpol.exe
2016-06-27 16:05 - 2016-05-12 16:51 - 00036352 _____ (Microsoft Corporation) C:\windows\SysWOW64\cryptbase.dll
2016-06-27 16:05 - 2016-05-12 15:05 - 00459640 _____ (Microsoft Corporation) C:\windows\system32\Drivers\cng.sys
2016-06-27 16:05 - 2016-05-12 15:05 - 00297984 _____ (Microsoft Corporation) C:\windows\system32\bcryptprimitives.dll
2016-06-27 16:05 - 2016-05-12 15:04 - 00249352 _____ (Microsoft Corporation) C:\windows\SysWOW64\bcryptprimitives.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00483840 _____ (Microsoft Corporation) C:\windows\system32\StructuredQuery.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00444928 _____ (Microsoft Corporation) C:\windows\system32\winhttp.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00327168 _____ (Microsoft Corporation) C:\windows\system32\mswsock.dll
2016-06-27 16:05 - 2016-05-11 19:02 - 00296448 _____ (Microsoft Corporation) C:\windows\system32\ws2_32.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00363520 _____ (Microsoft Corporation) C:\windows\SysWOW64\StructuredQuery.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00351744 _____ (Microsoft Corporation) C:\windows\SysWOW64\winhttp.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00231424 _____ (Microsoft Corporation) C:\windows\SysWOW64\mswsock.dll
2016-06-27 16:05 - 2016-05-11 17:19 - 00206336 _____ (Microsoft Corporation) C:\windows\SysWOW64\ws2_32.dll
2016-06-27 16:05 - 2016-05-11 17:11 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\netbtugc.exe
2016-06-27 16:05 - 2016-05-11 17:01 - 00026624 _____ (Microsoft Corporation) C:\windows\SysWOW64\netbtugc.exe
2016-06-27 16:05 - 2016-05-11 16:58 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\Drivers\netbt.sys
2016-06-27 16:05 - 2016-04-14 18:46 - 00114408 _____ (Microsoft Corporation) C:\windows\system32\consent.exe
2016-06-27 16:05 - 2016-04-14 18:42 - 03243520 _____ (Microsoft Corporation) C:\windows\system32\msi.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 01941504 _____ (Microsoft Corporation) C:\windows\system32\authui.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00504320 _____ (Microsoft Corporation) C:\windows\system32\msihnd.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00070144 _____ (Microsoft Corporation) C:\windows\system32\appinfo.dll
2016-06-27 16:05 - 2016-04-14 18:42 - 00025088 _____ (Microsoft Corporation) C:\windows\system32\msimsg.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 02365440 _____ (Microsoft Corporation) C:\windows\SysWOW64\msi.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 01806848 _____ (Microsoft Corporation) C:\windows\SysWOW64\authui.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 00337408 _____ (Microsoft Corporation) C:\windows\SysWOW64\msihnd.dll
2016-06-27 16:05 - 2016-04-14 17:33 - 00025088 _____ (Microsoft Corporation) C:\windows\SysWOW64\msimsg.dll
2016-06-27 16:05 - 2016-04-14 17:19 - 00128000 _____ (Microsoft Corporation) C:\windows\system32\msiexec.exe
2016-06-27 16:05 - 2016-04-14 17:11 - 00073216 _____ (Microsoft Corporation) C:\windows\SysWOW64\msiexec.exe
2016-06-27 16:05 - 2016-04-09 08:58 - 14186496 _____ (Microsoft Corporation) C:\windows\system32\shell32.dll
2016-06-27 16:05 - 2016-04-09 08:57 - 01867776 _____ (Microsoft Corporation) C:\windows\system32\ExplorerFrame.dll
2016-06-27 16:05 - 2016-04-09 08:54 - 12881408 _____ (Microsoft Corporation) C:\windows\SysWOW64\shell32.dll
2016-06-27 16:05 - 2016-04-09 08:54 - 01499648 _____ (Microsoft Corporation) C:\windows\SysWOW64\ExplorerFrame.dll
2016-06-27 16:05 - 2016-04-09 07:53 - 03231232 _____ (Microsoft Corporation) C:\windows\explorer.exe
2016-06-27 16:05 - 2016-04-09 07:44 - 02973184 _____ (Microsoft Corporation) C:\windows\SysWOW64\explorer.exe
2016-06-27 16:05 - 2016-03-09 21:00 - 00396800 _____ (Microsoft Corporation) C:\windows\system32\webio.dll
2016-06-27 16:05 - 2016-03-09 20:40 - 00316416 _____ (Microsoft Corporation) C:\windows\SysWOW64\webio.dll
2016-06-27 16:04 - 2016-05-24 01:37 - 00394960 _____ (Microsoft Corporation) C:\windows\system32\iedkcs32.dll
2016-06-27 16:04 - 2016-05-24 00:54 - 00346312 _____ (Microsoft Corporation) C:\windows\SysWOW64\iedkcs32.dll
2016-06-27 16:04 - 2016-05-21 19:28 - 25802752 _____ (Microsoft Corporation) C:\windows\system32\mshtml.dll
2016-06-27 16:04 - 2016-05-21 18:57 - 20341248 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.dll
2016-06-27 16:04 - 2016-05-21 00:27 - 02724864 _____ (Microsoft Corporation) C:\windows\system32\mshtml.tlb
2016-06-27 16:04 - 2016-05-21 00:27 - 00004096 _____ (Microsoft Corporation) C:\windows\system32\ieetwcollectorres.dll
2016-06-27 16:04 - 2016-05-21 00:14 - 02724864 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtml.tlb
2016-06-27 16:04 - 2016-05-21 00:10 - 00066560 _____ (Microsoft Corporation) C:\windows\system32\iesetup.dll
2016-06-27 16:04 - 2016-05-21 00:09 - 00572416 _____ (Microsoft Corporation) C:\windows\system32\vbscript.dll
2016-06-27 16:04 - 2016-05-21 00:09 - 00417792 _____ (Microsoft Corporation) C:\windows\system32\html.iec
2016-06-27 16:04 - 2016-05-21 00:09 - 00048640 _____ (Microsoft Corporation) C:\windows\system32\ieetwproxystub.dll
2016-06-27 16:04 - 2016-05-21 00:08 - 02895360 _____ (Microsoft Corporation) C:\windows\system32\iertutil.dll
2016-06-27 16:04 - 2016-05-21 00:08 - 00088064 _____ (Microsoft Corporation) C:\windows\system32\MshtmlDac.dll
2016-06-27 16:04 - 2016-05-21 00:02 - 06051328 _____ (Microsoft Corporation) C:\windows\system32\jscript9.dll
2016-06-27 16:04 - 2016-05-21 00:00 - 00054784 _____ (Microsoft Corporation) C:\windows\system32\jsproxy.dll
2016-06-27 16:04 - 2016-05-20 23:57 - 00497664 _____ (Microsoft Corporation) C:\windows\SysWOW64\vbscript.dll
2016-06-27 16:04 - 2016-05-20 23:57 - 00062464 _____ (Microsoft Corporation) C:\windows\SysWOW64\iesetup.dll
2016-06-27 16:04 - 2016-05-20 23:56 - 00615936 _____ (Microsoft Corporation) C:\windows\system32\ieui.dll
2016-06-27 16:04 - 2016-05-20 23:56 - 00341504 _____ (Microsoft Corporation) C:\windows\SysWOW64\html.iec
2016-06-27 16:04 - 2016-05-20 23:55 - 00064000 _____ (Microsoft Corporation) C:\windows\SysWOW64\MshtmlDac.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00817664 _____ (Microsoft Corporation) C:\windows\system32\jscript.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00814080 _____ (Microsoft Corporation) C:\windows\system32\jscript9diag.dll
2016-06-27 16:04 - 2016-05-20 23:54 - 00144384 _____ (Microsoft Corporation) C:\windows\system32\ieUnatt.exe
2016-06-27 16:04 - 2016-05-20 23:50 - 02287104 _____ (Microsoft Corporation) C:\windows\SysWOW64\iertutil.dll
2016-06-27 16:04 - 2016-05-20 23:49 - 00047104 _____ (Microsoft Corporation) C:\windows\SysWOW64\jsproxy.dll
2016-06-27 16:04 - 2016-05-20 23:45 - 00968704 _____ (Microsoft Corporation) C:\windows\system32\MsSpellCheckingFacility.exe
2016-06-27 16:04 - 2016-05-20 23:45 - 00476160 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieui.dll
2016-06-27 16:04 - 2016-05-20 23:44 - 00663552 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript.dll
2016-06-27 16:04 - 2016-05-20 23:44 - 00115712 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieUnatt.exe
2016-06-27 16:04 - 2016-05-20 23:43 - 00620032 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9diag.dll
2016-06-27 16:04 - 2016-05-20 23:41 - 00489984 _____ (Microsoft Corporation) C:\windows\system32\dxtmsft.dll
2016-06-27 16:04 - 2016-05-20 23:33 - 00416256 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtmsft.dll
2016-06-27 16:04 - 2016-05-20 23:33 - 00077824 _____ (Microsoft Corporation) C:\windows\system32\JavaScriptCollectionAgent.dll
2016-06-27 16:04 - 2016-05-20 23:32 - 00107520 _____ (Microsoft Corporation) C:\windows\system32\inseng.dll
2016-06-27 16:04 - 2016-05-20 23:29 - 13815808 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieframe.dll
2016-06-27 16:04 - 2016-05-20 23:28 - 00199680 _____ (Microsoft Corporation) C:\windows\system32\msrating.dll
2016-06-27 16:04 - 2016-05-20 23:27 - 00092160 _____ (Microsoft Corporation) C:\windows\system32\mshtmled.dll
2016-06-27 16:04 - 2016-05-20 23:27 - 00060416 _____ (Microsoft Corporation) C:\windows\SysWOW64\JavaScriptCollectionAgent.dll
2016-06-27 16:04 - 2016-05-20 23:25 - 00315392 _____ (Microsoft Corporation) C:\windows\system32\dxtrans.dll
2016-06-27 16:04 - 2016-05-20 23:23 - 00168960 _____ (Microsoft Corporation) C:\windows\SysWOW64\msrating.dll
2016-06-27 16:04 - 2016-05-20 23:23 - 00076288 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmled.dll
2016-06-27 16:04 - 2016-05-20 23:22 - 00152064 _____ (Microsoft Corporation) C:\windows\system32\occache.dll
2016-06-27 16:04 - 2016-05-20 23:21 - 00279040 _____ (Microsoft Corporation) C:\windows\SysWOW64\dxtrans.dll
2016-06-27 16:04 - 2016-05-20 23:19 - 00130048 _____ (Microsoft Corporation) C:\windows\SysWOW64\occache.dll
2016-06-27 16:04 - 2016-05-20 23:14 - 04610048 _____ (Microsoft Corporation) C:\windows\SysWOW64\jscript9.dll
2016-06-27 16:04 - 2016-05-20 23:12 - 00230400 _____ (Microsoft Corporation) C:\windows\SysWOW64\webcheck.dll
2016-06-27 16:04 - 2016-05-20 23:11 - 15420928 _____ (Microsoft Corporation) C:\windows\system32\ieframe.dll
2016-06-27 16:04 - 2016-05-20 23:11 - 00262144 _____ (Microsoft Corporation) C:\windows\system32\webcheck.dll
2016-06-27 16:04 - 2016-05-20 23:09 - 00725504 _____ (Microsoft Corporation) C:\windows\system32\ie4uinit.exe
2016-06-27 16:04 - 2016-05-20 23:09 - 00693248 _____ (Microsoft Corporation) C:\windows\SysWOW64\msfeeds.dll
2016-06-27 16:04 - 2016-05-20 23:08 - 02055680 _____ (Microsoft Corporation) C:\windows\SysWOW64\inetcpl.cpl
2016-06-27 16:04 - 2016-05-20 23:08 - 00806400 _____ (Microsoft Corporation) C:\windows\system32\msfeeds.dll
2016-06-27 16:04 - 2016-05-20 23:07 - 01359360 _____ (Microsoft Corporation) C:\windows\system32\mshtmlmedia.dll
2016-06-27 16:04 - 2016-05-20 23:07 - 01155072 _____ (Microsoft Corporation) C:\windows\SysWOW64\mshtmlmedia.dll
2016-06-27 16:04 - 2016-05-20 23:06 - 02131968 _____ (Microsoft Corporation) C:\windows\system32\inetcpl.cpl
2016-06-27 16:04 - 2016-05-20 22:46 - 02597888 _____ (Microsoft Corporation) C:\windows\system32\wininet.dll
2016-06-27 16:04 - 2016-05-20 22:42 - 02121216 _____ (Microsoft Corporation) C:\windows\SysWOW64\wininet.dll
2016-06-27 16:04 - 2016-05-20 22:38 - 01310208 _____ (Microsoft Corporation) C:\windows\SysWOW64\urlmon.dll
2016-06-27 16:04 - 2016-05-20 22:38 - 00710144 _____ (Microsoft Corporation) C:\windows\SysWOW64\ieapfltr.dll
2016-06-27 16:04 - 2016-05-20 22:34 - 01544192 _____ (Microsoft Corporation) C:\windows\system32\urlmon.dll
2016-06-27 16:04 - 2016-05-20 22:23 - 00800768 _____ (Microsoft Corporation) C:\windows\system32\ieapfltr.dll
2016-06-27 15:53 - 2016-06-30 20:54 - 00000000 ____D C:\Users\MEmroi\Desktop\Test
2016-06-27 15:13 - 2016-06-27 15:13 - 00000000 ____D C:\windows\System32\Tasks\Norton Internet Security
2016-06-27 15:06 - 2016-06-27 15:06 - 00003234 _____ C:\windows\System32\Tasks\Norton WSC Integration
2016-06-27 15:06 - 2016-06-27 15:06 - 00000000 ___RD C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton Internet Security
2016-06-27 14:31 - 2016-06-27 14:54 - 00000000 ____D C:\windows\pss
2016-06-27 14:30 - 2016-06-27 16:22 - 00000109 _____ C:\Users\MEmroi\Desktop\todo.txt
2016-06-12 17:10 - 2016-06-12 17:11 - 00000000 ____D C:\Program Files\Microsoft Security Client
2016-06-12 17:10 - 2016-06-12 17:10 - 00002119 _____ C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Security Essentials.lnk
2016-06-12 17:10 - 2016-06-12 17:10 - 00000000 ____D C:\Program Files (x86)\Microsoft Security Client
2016-06-12 17:05 - 2016-06-12 17:11 - 00001912 _____ C:\windows\epplauncher.mif
2016-06-12 16:51 - 2016-06-12 16:52 - 00081278 _____ C:\windows\ntbtlog.txt
2016-06-12 09:52 - 2016-06-12 09:52 - 01078896 ____R C:\Users\MEmroi\Desktop\BoardingPassWAGNERGERLINDE.pdf.crypz
2016-06-12 09:44 - 2016-06-12 09:44 - 01127162 ____R C:\Users\MEmroi\Desktop\BoardingPassEmroiSILKE.pdf.crypz
2016-06-06 21:04 - 2016-06-06 21:27 - 00524995 ____R C:\Users\MEmroi\Desktop\Bild_FamEmroi_Traktor_sepia.jpg.crypz
2016-06-06 21:03 - 2016-06-06 21:25 - 01358425 ____R C:\Users\MEmroi\Desktop\Bild_Juliane+Daniel_Traktor_sepia.jpg.crypz
2016-06-06 20:51 - 2016-06-06 20:51 - 01426406 ____R C:\Users\MEmroi\Desktop\Bild_Juliane+Daniel_Traktor.jpg.crypz
2016-06-02 17:22 - 2016-06-30 20:48 - 00000000 ____D C:\Users\MEmroi\Desktop\Reini

==================== Ein Monat: Geänderte Dateien und Ordner ========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Datei/der Ordner verschoben.)

2016-06-30 20:52 - 2013-05-01 11:40 - 00001110 _____ C:\windows\Tasks\GoogleUpdateTaskMachineUA.job
2016-06-30 20:47 - 2012-06-29 13:10 - 00000000 ____D C:\ProgramData\Temp
2016-06-30 20:38 - 2015-05-25 14:38 - 00000911 _____ C:\windows\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9}.job
2016-06-30 20:32 - 2016-05-23 20:22 - 00000000 ____D C:\Users\MEmroi\Desktop\Michaela 40
2016-06-30 20:29 - 2013-05-01 11:40 - 00001106 _____ C:\windows\Tasks\GoogleUpdateTaskMachineCore.job
2016-06-30 20:28 - 2009-07-14 06:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
2016-06-30 20:28 - 2009-07-14 06:45 - 00024400 ____H C:\windows\system32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
2016-06-30 20:24 - 2009-07-14 05:20 - 00000000 ____D C:\windows\rescache
2016-06-28 03:30 - 2013-06-20 13:02 - 00000000 ___RD C:\Users\MEmroi\Google Drive
2016-06-28 03:28 - 2009-07-14 07:08 - 00000006 ____H C:\windows\Tasks\SA.DAT
2016-06-28 03:28 - 2009-07-14 06:45 - 00409864 _____ C:\windows\system32\FNTCACHE.DAT
2016-06-28 03:27 - 2016-02-25 22:54 - 00000000 ____D C:\Program Files\Microsoft Silverlight
2016-06-28 03:27 - 2016-02-25 22:54 - 00000000 ____D C:\Program Files (x86)\Microsoft Silverlight
2016-06-28 03:25 - 2015-04-15 09:04 - 00000000 ____D C:\windows\system32\appraiser
2016-06-28 03:09 - 2013-08-18 03:01 - 00000000 ____D C:\windows\system32\MRT
2016-06-28 03:07 - 2012-11-02 17:20 - 142482544 _____ (Microsoft Corporation) C:\windows\system32\MRT.exe
2016-06-28 03:06 - 2016-02-25 22:54 - 00000000 ____D C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Microsoft Silverlight
2016-06-27 15:53 - 2012-06-29 12:49 - 00661764 _____ C:\windows\system32\perfh007.dat
2016-06-27 15:53 - 2012-06-29 12:49 - 00141776 _____ C:\windows\system32\perfc007.dat
2016-06-27 15:53 - 2009-07-14 07:13 - 01529844 _____ C:\windows\system32\PerfStringBackup.INI
2016-06-27 15:53 - 2009-07-14 05:20 - 00000000 ____D C:\windows\inf
2016-06-27 15:19 - 2015-08-03 10:29 - 00000000 ____D C:\windows\System32\Tasks\Remediation
2016-06-27 15:06 - 2012-11-02 10:49 - 00002369 _____ C:\Users\Public\Desktop\Norton Internet Security.lnk
2016-06-27 15:06 - 2012-06-29 13:25 - 00000000 ____D C:\windows\system32\Drivers\NISx64
2016-06-27 14:54 - 2016-04-25 13:10 - 00000000 ____D C:\Users\MEmroi\Desktop\Bilderbestellung
2016-06-27 14:54 - 2016-02-15 13:58 - 00000000 ____D C:\Users\MEmroi\Desktop\Essensplan
2016-06-27 14:54 - 2015-09-02 21:19 - 00000000 ____D C:\Users\MEmroi\Desktop\Silke
2016-06-27 14:54 - 2015-04-10 21:30 - 00000000 ____D C:\Users\MEmroi\Desktop\Annika
2016-06-27 14:54 - 2015-03-05 21:31 - 00000000 ____D C:\Users\MEmroi\Desktop\Haus & Garten
2016-06-27 14:54 - 2014-05-29 13:40 - 00000000 ____D C:\Users\MEmroi\Documents\Silke
2016-06-27 14:54 - 2013-04-20 23:51 - 00000000 ____D C:\Users\MEmroi\Desktop\Sebastian
2016-06-27 14:54 - 2013-04-06 11:24 - 00000000 ____D C:\Users\MEmroi\Downloads\Hotel
2016-06-27 14:54 - 2013-01-21 21:15 - 00000000 ___HD C:\Users\MEmroi\Desktop\[Originaldateien]
2016-06-27 14:54 - 2012-11-09 21:51 - 00000000 ____D C:\Users\MEmroi\Documents\Symantec
2016-06-27 14:54 - 2012-11-04 15:41 - 00000000 ____D C:\Users\MEmroi\Documents\Eigene Scans
2016-06-27 14:31 - 2012-06-29 13:25 - 00000000 ____D C:\ProgramData\Norton
2016-06-27 14:30 - 2012-06-29 13:26 - 00101112 _____ (Symantec Corporation) C:\windows\system32\Drivers\SYMEVENT64x86.SYS
2016-06-27 14:30 - 2012-06-29 13:26 - 00008270 _____ C:\windows\system32\Drivers\SYMEVENT64x86.CAT
2016-06-27 14:28 - 2013-05-11 17:43 - 00000000 ____D C:\Users\Public\Downloads\Norton
2016-06-27 14:23 - 2012-11-02 11:08 - 00000000 ____D C:\e16e42fe9f9fdd8cd9ef
2016-06-27 14:23 - 2011-02-11 18:32 - 00000000 __RHD C:\SYSTEM.SAV
2016-06-27 14:23 - 2011-02-11 18:32 - 00000000 ____D C:\SWSETUP
2016-06-15 22:40 - 2010-11-21 05:27 - 00484008 ____N (Microsoft Corporation) C:\windows\system32\MpSigStub.exe
2016-06-12 23:27 - 2012-11-04 15:27 - 00000000 ____D C:\Users\MEmroi\AppData\Local\CrashDumps
2016-06-12 22:00 - 2013-04-23 20:57 - 00000000 ____D C:\windows\KJ
2016-06-12 10:16 - 2014-07-04 15:40 - 00000000 ____D C:\Users\MEmroi\Documents\WISO Mein Geld
2016-06-12 10:03 - 2012-12-02 14:14 - 00000000 ____D C:\Users\MEmroi\Documents\Outlook-Dateien
2016-06-07 14:12 - 2016-05-29 20:37 - 00013169 ____R C:\Users\MEmroi\Desktop\PACKLISTE MALLORCA.xlsx.crypz

==================== Dateien im Wurzelverzeichnis einiger Verzeichnisse =======

2013-01-21 16:01 - 2016-05-23 22:21 - 0014848 _____ () C:\Users\MEmroi\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
2012-11-02 11:05 - 2013-09-08 13:12 - 0005439 _____ () C:\ProgramData\hpzinstall.log
2014-05-21 21:24 - 2014-05-25 14:32 - 0000000 _____ () C:\ProgramData\LauncherAccess.dt

==================== Bamital & volsnap =================

(Es ist kein automatischer Fix für Dateien vorhanden, die an der Verifikation gescheitert sind.)

C:\windows\system32\winlogon.exe => Datei ist digital signiert
C:\windows\system32\wininit.exe => Datei ist digital signiert
C:\windows\SysWOW64\wininit.exe => Datei ist digital signiert
C:\windows\explorer.exe => Datei ist digital signiert
C:\windows\SysWOW64\explorer.exe => Datei ist digital signiert
C:\windows\system32\svchost.exe => Datei ist digital signiert
C:\windows\SysWOW64\svchost.exe => Datei ist digital signiert
C:\windows\system32\services.exe => Datei ist digital signiert
C:\windows\system32\User32.dll => Datei ist digital signiert
C:\windows\SysWOW64\User32.dll => Datei ist digital signiert
C:\windows\system32\userinit.exe => Datei ist digital signiert
C:\windows\SysWOW64\userinit.exe => Datei ist digital signiert
C:\windows\system32\rpcss.dll => Datei ist digital signiert
C:\windows\system32\dnsapi.dll => Datei ist digital signiert
C:\windows\SysWOW64\dnsapi.dll => Datei ist digital signiert
C:\windows\system32\Drivers\volsnap.sys => Datei ist digital signiert


LastRegBack: 2016-06-29 23:19

==================== Ende von FRST.txt ============================
         
Output Addition.txt:

Code:
ATTFilter
Zusätzliches Untersuchungsergebnis von Farbar Recovery Scan Tool (x64) Version: 29-06-2016
durchgeführt von MEmroi (2016-06-30 21:24:31)
Gestartet von C:\Users\MEmroi\Desktop
Windows 7 Home Premium Service Pack 1 (X64) (2012-10-27 13:00:04)
Start-Modus: Normal
==========================================================


==================== Konten: =============================

Administrator (S-1-5-21-1078291597-1949154093-2174115440-500 - Administrator - Disabled)
Gast (S-1-5-21-1078291597-1949154093-2174115440-501 - Limited - Disabled)
HomeGroupUser$ (S-1-5-21-1078291597-1949154093-2174115440-1002 - Limited - Enabled)
MEmroi (S-1-5-21-1078291597-1949154093-2174115440-1001 - Administrator - Enabled) => C:\Users\MEmroi

==================== Sicherheits-Center ========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er entfernt.)

AV: Norton Internet Security (Enabled - Up to date) {53C7D717-52E2-B95E-FA61-6F32ECC805DB}
AV: Microsoft Security Essentials (Enabled - Up to date) {768124D7-F5F7-6D2F-DDC2-94DFA4017C95}
AS: Microsoft Security Essentials (Enabled - Up to date) {CDE0C533-D3CD-62A1-E772-AFADDF863628}
AS: Windows Defender (Disabled - Up to date) {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
AS: Norton Internet Security (Enabled - Up to date) {E8A636F3-74D8-B6D0-C0D1-5440974F4F66}
FW: Norton Internet Security (Enabled) {6BFC5632-188D-B806-D13E-C607121B42A0}

==================== Installierte Programme ======================

(Nur Adware-Programme mit dem Zusatz "Hidden" können in die Fixlist aufgenommen werden, um sie sichtbar zu machen. Die Adware-Programme sollten manuell deinstalliert werden.)

ACDSee Pro 4 (HKLM-x32\...\{88D4FE78-6EA6-4DFB-9FC2-8BC316F0C2FD}) (Version: 4.0.237 - ACD Systems International Inc.)
Adobe Flash Player 11 Plugin (HKLM-x32\...\Adobe Flash Player Plugin) (Version: 11.5.502.135 - Adobe Systems Incorporated)
Adobe Flash Player 18 ActiveX (HKLM-x32\...\Adobe Flash Player ActiveX) (Version: 18.0.0.209 - Adobe Systems Incorporated)
Adobe Reader XI - Deutsch (HKLM-x32\...\{AC76BA86-7AD7-1031-7B44-AB0000000001}) (Version: 11.0.00 - Adobe Systems Incorporated)
AMD Catalyst Install Manager (HKLM\...\{FEAA5D71-B0FB-4EF9-729F-8AE42500AF41}) (Version: 8.0.873.0 - Advanced Micro Devices, Inc.)
Apple Application Support (32-Bit) (HKLM-x32\...\{649A1FD9-5892-46AD-8DF0-C4A43FF61CB7}) (Version: 4.1 - Apple Inc.)
Apple Application Support (64-Bit) (HKLM\...\{0DE0A178-AC7B-4650-806C-CF226DE03766}) (Version: 4.1 - Apple Inc.)
Apple Mobile Device Support (HKLM\...\{3540181E-340A-4E7A-B409-31663472B2F7}) (Version: 9.1.0.6 - Apple Inc.)
Apple Software Update (HKLM-x32\...\{FFD1F7F1-1AC9-4BC4-A908-0686D635ABAF}) (Version: 2.1.4.131 - Apple Inc.)
Bonjour (HKLM\...\{56DDDFB8-7F79-4480-89D5-25E1F52AB28F}) (Version: 3.1.0.1 - Apple Inc.)
BrowserProtect (HKLM-x32\...\{15D2D75C-9CB2-4efd-BAD7-B9B4CB4BC693}) (Version:  - Bit89 Inc) <==== ACHTUNG
BufferChm (x32 Version: 140.0.298.000 - Hewlett-Packard) Hidden
Canon Utilities EOS Utility (HKLM-x32\...\EOS Utility) (Version: 2.9.0.0 - Canon Inc.)
Canon Utilities PhotoStitch (HKLM-x32\...\PhotoStitch) (Version: 3.1.18.42 - )
D3DX10 (x32 Version: 15.4.2368.0902 - Microsoft) Hidden
Destinations (x32 Version: 140.0.0.0 - Hewlett-Packard) Hidden
DirectX for Managed Code Update (Summer 2004) (x32 Version: 9.02.2904 - Microsoft) Hidden
dm-Fotowelt (HKLM-x32\...\dm-Fotowelt) (Version: 6.1.3 - CEWE Stiftung u Co. KGaA)
DocProc (x32 Version: 140.0.185.000 - Hewlett-Packard) Hidden
ElsterFormular (HKLM-x32\...\ElsterFormular) (Version: 17.2.19144 - Landesfinanzdirektion Thüringen)
EPSON Scan (HKLM-x32\...\EPSON Scanner) (Version:  - Seiko Epson Corporation)
EPSON XP-520 Series Printer Uninstall (HKLM\...\EPSON XP-520 Series) (Version:  - SEIKO EPSON Corporation)
EpsonNet Print (HKLM\...\{DF5200AB-5AE6-4598-846B-8ABC3AE121B1}) (Version: 3.0.2.0 - SEIKO EPSON Corporation)
FileZilla Client 3.7.0.2 (HKLM-x32\...\FileZilla Client) (Version: 3.7.0.2 - FileZilla Project)
Google Drive (HKLM-x32\...\{709316AD-161C-4D5C-9AE7-0B3A822DA271}) (Version: 1.30.2170.0459 - Google, Inc.)
Google Earth Plug-in (HKLM-x32\...\{4AB54F11-2F8C-11E3-B09F-B8AC6F97B88E}) (Version: 7.1.2.2041 - Google)
Google Update Helper (x32 Version: 1.3.25.11 - Google Inc.) Hidden
Google Update Helper (x32 Version: 1.3.30.3 - Google Inc.) Hidden
Hewlett-Packard ACLM.NET v1.1.2.0 (x32 Version: 1.00.0000 - Hewlett-Packard) Hidden
HP Imaging Device Functions 14.5 (HKLM\...\HP Imaging Device Functions) (Version: 14.5 - HP)
HP Odometer (HKLM-x32\...\{B8AC1A89-FFD1-4F97-8051-E505A160F562}) (Version: 2.10.0000 - Hewlett-Packard)
HP Scanjet G4050 (HKLM\...\{0A9FC1DA-46F7-4305-A4EF-FDCA8D9B1A5A}) (Version: 14.5 - HP)
HP Support Information (HKLM-x32\...\{B2B7B1C8-7C8B-476C-BE2C-049731C55992}) (Version: 11.00.0001 - Hewlett-Packard)
hpg4050 (x32 Version: 140.000.000.000 - Ihr Firmenname) Hidden
HydraVision (x32 Version: 4.2.236.0 - Advanced Micro Devices, Inc.) Hidden
Intel(R) Management Engine Components (HKLM-x32\...\{65153EA5-8B6E-43B6-857B-C6E4FC25798A}) (Version: 8.0.0.1351 - Intel Corporation)
iTunes (HKLM\...\{E690A491-702F-4DEC-9977-C015D1DBB57C}) (Version: 12.3.1.23 - Apple Inc.)
Junk Mail filter update (x32 Version: 15.4.3502.0922 - Microsoft Corporation) Hidden
Mesh Runtime (x32 Version: 15.4.5722.2 - Microsoft Corporation) Hidden
Microsoft .NET Framework 4.5.2 (HKLM\...\{92FB6C44-E685-45AD-9B20-CADF4CABA132} - 1033) (Version: 4.5.51209 - Microsoft Corporation)
Microsoft Office Professional 2010 (HKLM-x32\...\Office14.SingleImage) (Version: 14.0.7015.1000 - Microsoft Corporation)
Microsoft Security Essentials (HKLM\...\Microsoft Security Client) (Version: 4.9.218.0 - Microsoft Corporation)
Microsoft Silverlight (HKLM\...\{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}) (Version: 5.1.50428.0 - Microsoft Corporation)
Microsoft SQL Server 2005 Compact Edition [ENU] (HKLM-x32\...\{F0B430D1-B6AA-473D-9B06-AA3DD01FD0B8}) (Version: 3.1.0000 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (HKLM-x32\...\{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}) (Version: 8.0.61001 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{071c9b48-7c32-4621-a0ac-3f809523288f}) (Version: 8.0.56336 - Microsoft Corporation)
Microsoft Visual C++ 2005 Redistributable (x64) (HKLM\...\{ad8a2fa1-06e7-4b0d-927d-6e54b3d31028}) (Version: 8.0.61000 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 (HKLM\...\{8220EEFE-38CD-377E-8595-13398D740ACE}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.4148 (HKLM\...\{4B6C7001-C7D6-3710-913E-5BC23FCE91E6}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 (HKLM\...\{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 (HKLM-x32\...\{9A25302D-30C0-39D9-BD6F-21E6EC160475}) (Version: 9.0.30729 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148 (HKLM-x32\...\{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}) (Version: 9.0.30729.4148 - Microsoft Corporation)
Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 (HKLM-x32\...\{9BE518E6-ECC6-35A9-88E4-87755C07200F}) (Version: 9.0.30729.6161 - Microsoft Corporation)
Microsoft Visual C++ 2010  x64 Redistributable - 10.0.40219 (HKLM\...\{1D8E6291-B0D5-35EC-8441-6616F567A0F7}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2010  x86 Redistributable - 10.0.40219 (HKLM-x32\...\{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}) (Version: 10.0.40219 - Microsoft Corporation)
Microsoft Visual C++ 2013 Redistributable (x86) - 12.0.30501 (HKLM-x32\...\{e6e75766-da0f-4ba2-9788-6ea593ce702d}) (Version: 12.0.30501.0 - Microsoft Corporation)
Microsoft Visual Studio 2010 Tools for Office Runtime (x64) (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64)) (Version: 10.0.50903 - Microsoft Corporation)
Microsoft Visual Studio 2010-Tools für Office-Laufzeit (x64) Language Pack - DEU (HKLM\...\Microsoft Visual Studio 2010 Tools for Office Runtime (x64) Language Pack - DEU) (Version: 10.0.50903 - Microsoft Corporation)
Moveslink for Movestick Mini (HKLM-x32\...\{4D036ACA-DFDF-41B2-A680-E0D736F3E947}) (Version: 1.2.40 - Suunto)
Mozilla Firefox 38.0.1 (x86 de) (HKLM-x32\...\Mozilla Firefox 38.0.1 (x86 de)) (Version: 38.0.1 - Mozilla)
Mozilla Maintenance Service (HKLM-x32\...\MozillaMaintenanceService) (Version: 33.1.1 - Mozilla)
MSXML 4.0 SP2 (KB954430) (HKLM-x32\...\{86493ADD-824D-4B8E-BD72-8C5DCDC52A71}) (Version: 4.20.9870.0 - Microsoft Corporation)
MSXML 4.0 SP2 (KB973688) (HKLM-x32\...\{F662A8E6-F4DC-41A2-901E-8C11F044BDEC}) (Version: 4.20.9876.0 - Microsoft Corporation)
Norton Internet Security (HKLM-x32\...\NIS) (Version: 22.7.0.76 - Symantec Corporation)
Norton Online Backup (HKLM-x32\...\{40A66DF6-22D3-44B5-A7D3-83B118A2C0DC}) (Version: 2.1.17869 - Symantec Corporation)
opensource (x32 Version: 1.0.14960.3876 - Your Company Name) Hidden
PDFCreator (HKLM-x32\...\{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}) (Version: 1.6.1 - pdfforge)
PlayReady PC Runtime amd64 (HKLM\...\{BCA9334F-B6C9-4F65-9A73-AC5A329A4D04}) (Version: 1.3.0 - Microsoft Corporation)
Power2Go (HKLM-x32\...\InstallShield_{40BF1E83-20EB-11D8-97C5-0009C5020658}) (Version: 6.1.6207 - CyberLink Corp.)
Power2Go (x32 Version: 6.1.6207 - CyberLink Corp.) Hidden
Ralink 802.11n Wireless LAN Card (HKLM-x32\...\{8FC4F1DD-F7FD-4766-804D-3C8FF1D309AF}) (Version: 3.2.12.0 - Ralink)
Recovery Manager (x32 Version: 5.5.0.5119 - CyberLink Corp.) Hidden
Samsung Kies (HKLM-x32\...\InstallShield_{758C8301-2696-4855-AF45-534B1200980A}) (Version: 2.3.3.12085_7 - Samsung Electronics Co., Ltd.)
Samsung Kies (x32 Version: 2.3.3.12085_7 - Samsung Electronics Co., Ltd.) Hidden
Samsung Mobile phone USB driver Drive Software (HKLM\...\Samsung Mobile phone USB driver Drive) (Version:  - )
SAMSUNG USB Driver for Mobile Phones (HKLM\...\{D0795B21-0CDA-4a92-AB9E-6E92D8111E44}) (Version: 1.5.9.0 - SAMSUNG Electronics Co., Ltd.)
Scan (x32 Version: 14.0.1.0 - Hewlett-Packard) Hidden
Service Pack 2 for Microsoft Office 2010 (KB2687455) 32-Bit Edition (HKLM-x32\...\{90140000-003D-0000-0000-0000000FF1CE}_Office14.SingleImage_{DE28B448-32E8-4E8F-84F0-A52B21A49B5B}) (Version:  - Microsoft)
Software Updater (HKLM-x32\...\{FA7EE274-7370-43B7-9A45-A39B17CCCDC5}) (Version: 4.3.3 - SEIKO EPSON CORPORATION)
TI USB 3.0 Host Controller Driver (HKLM-x32\...\InstallShield_{355FBD67-5A4F-44DA-86A1-56EEC4C20EC0}) (Version: 1.12.18.0 - Texas Instruments Inc.)
TI USB3 Host Driver (x32 Version: 1.12.18.0 - Texas Instruments Inc.) Hidden
Tinypic 3.18 (HKLM-x32\...\{E3723A04-A894-4036-A78E-282E18F43C0A}_is1) (Version: Tinypic 3.18 - E. Fiedler)
Total Commander 64-bit (Remove or Repair) (HKLM\...\Totalcmd64) (Version: 8.01 - Ghisler Software GmbH)
TSHostedAppLauncher (x32 Version: 5.1.15.0 - Hewlett-Packard) Hidden
VideoBrowser (HKLM-x32\...\{D79DC615-EC9F-4EFA-9482-5911168D8F32}) (Version: 2.07.272 - PIXELA)
WebReg (x32 Version: 140.0.297.017 - Hewlett-Packard) Hidden
Windows Live Essentials (HKLM-x32\...\WinLiveSuite) (Version: 15.4.3538.0513 - Microsoft Corporation)
Windows Live Mesh ActiveX Control for Remote Connections (HKLM-x32\...\{2902F983-B4C1-44BA-B85D-5C6D52E2C441}) (Version: 15.4.5722.2 - Microsoft Corporation)
Windows Live Mesh ActiveX control for remote connections (HKLM-x32\...\{C5398A89-516C-4DAF-BA07-EE7949090E56}) (Version: 15.4.5722.2 - Microsoft Corporation)
WinRAR 4.20 (64-Bit) (HKLM\...\WinRAR archiver) (Version: 4.20.0 - win.rar GmbH)
WISO Mein Geld 2014 Professional (HKLM-x32\...\WISO Mein Geld 2014 Professional) (Version:  - Buhl Data Service GmbH)
WISO Mein Geld 2014 Professional (x32 Version: 16.0.1.0 - Buhl Data Service GmbH) Hidden

==================== Benutzerdefinierte CLSID (Nicht auf der Ausnahmeliste): ==========================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)


==================== Geplante Aufgaben (Nicht auf der Ausnahmeliste) =============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

Task: {12FC4FF9-7B70-4E8E-9742-842DAF7AD37F} - System32\Tasks\GoogleUpdateTaskMachineUA => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {25173BAD-AE80-429D-80AC-0581EAB29E86} - System32\Tasks\Norton Internet Security\Norton Error Analyzer => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {29FD5682-D083-447D-B032-DC706A78BE25} - System32\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9} => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSNPE.EXE [2013-11-22] (SEIKO EPSON CORPORATION)
Task: {2DD1EF97-2BD9-4192-8C6D-F79C41CD6A67} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Tuneup => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {2E00554E-F38D-4F5D-BC96-F49828EA272D} - System32\Tasks\{4A40F400-9FC1-4E56-A9D4-FDC1DD28E72A} => Iexplore.exe hxxp://ui.skype.com/ui/0/5.6.0.110.396/de/abandoninstall?page=tsMain&amp;installinfo=google-toolbar:notoffered;notincluded,google-chrome:notoffered;disabled
Task: {4B843D9F-15C7-473E-8BAB-E273B201086F} - System32\Tasks\GoogleUpdateTaskMachineCore => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe [2015-09-01] (Google Inc.)
Task: {68EAB01E-F3C7-47A5-B624-2A3FFF84E611} - System32\Tasks\Hewlett-Packard\HP Support Assistant\PC Health Analysis => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\HPSF.exe
Task: {7BF535D5-1045-40EB-B5A9-B65337A20757} - System32\Tasks\Hewlett-Packard\HP Support Assistant\HP Support Assistant Quick Start => C:\Program Files (x86)\Hewlett-Packard\HP Support Framework\Resources\HPSFMessenger\HPSFMsgr.exe
Task: {946DEF4B-1EDE-473F-8F51-B9B734B51B8A} - System32\Tasks\Apple\AppleSoftwareUpdate => C:\Program Files (x86)\Apple Software Update\SoftwareUpdate.exe [2015-08-27] (Apple Inc.)
Task: {99883B5A-C2B3-43A6-9D03-A72EDED1ACF7} - System32\Tasks\Hewlett-Packard\HP Support Assistant\Update Check => C:\ProgramData\Hewlett-Packard\HP Support Framework\Resources\Updater\HPSFUpdater.exe [2011-06-14] (Hewlett-Packard)
Task: {A2883FB2-7EC3-4E31-935A-D23C4AF25EB0} - System32\Tasks\Norton Internet Security\Norton Error Processor => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\SymErr.exe [2016-05-23] (Symantec Corporation)
Task: {CEB31460-73CF-4356-BB91-B1A3415CA158} - System32\Tasks\Norton WSC Integration => C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\WSCStub.exe [2016-06-17] (Symantec Corporation)
Task: {DD93F5F7-9E53-4001-B178-A4685C8E7315} - System32\Tasks\Remediation\AntimalwareMigrationTask => C:\Program Files\Common Files\AV\Norton Internet Security\Upgrade.exe [2016-06-17] (Symantec Corporation)

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird die Aufgabe verschoben. Die Datei, die durch die Aufgabe gestartet wird, wird nicht verschoben.)

Task: C:\windows\Tasks\EPSON XP-520 Series Update {D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9}.job => C:\windows\system32\spool\DRIVERS\x64\3\E_YTSNPE.EXE:/EXE:{D51EDB2A-D3B9-41AC-A8C8-FD1D1F045EF9} /F:UpdateSYSTEMĊSearches for EPSON software updates, and notifies you when updates are available.If this task is disabled or stopped, your EPSON software will not be automatically kept up to date.Thi
Task: C:\windows\Tasks\GoogleUpdateTaskMachineCore.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
Task: C:\windows\Tasks\GoogleUpdateTaskMachineUA.job => C:\Program Files (x86)\Google\Update\GoogleUpdate.exe

==================== Verknüpfungen =============================

(Die Einträge können gelistet werden, um sie zurückzusetzen oder zu entfernen.)

==================== Geladene Module (Nicht auf der Ausnahmeliste) ==============

2015-09-23 16:47 - 2015-09-23 16:47 - 00085800 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\zlib1.dll
2015-10-13 06:45 - 2015-10-13 06:45 - 01328912 _____ () C:\Program Files\Common Files\Apple\Apple Application Support\libxml2.dll
2012-03-19 19:36 - 2012-03-19 19:36 - 00452472 ____N () C:\Program Files (x86)\Hewlett-Packard\Recovery\Protect.dll
2010-01-02 16:42 - 2010-01-02 16:42 - 00098304 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext_64.dll
2012-08-31 10:52 - 2012-08-31 10:52 - 00021432 _____ () C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
2016-06-27 15:07 - 2016-06-27 15:07 - 00115137 _____ () C:\Users\MEmroi\AppData\Local\Temp\fbe2808e-2380-4f14-a1fa-3fa9c3a364e8\CliSecureRT.dll
2013-05-26 17:53 - 2013-05-26 17:53 - 00093696 _____ () C:\Program Files (x86)\FileZilla FTP Client\fzshellext.dll
2009-12-08 16:54 - 2009-12-08 16:54 - 02011648 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtCore4.dll
2009-09-29 14:43 - 2009-09-29 14:43 - 07462912 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtGui4.dll
2009-09-29 14:31 - 2009-09-29 14:31 - 00337408 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtXml4.dll
2009-09-29 14:32 - 2009-09-29 14:32 - 00877056 _____ () C:\Program Files (x86)\Suunto\Moveslink for Movestick Mini\QtNetwork4.dll
2012-06-29 13:10 - 2012-02-10 05:42 - 01087336 _____ () C:\Program Files (x86)\Ralink\Common\RaWLAPI.dll
2012-12-09 18:33 - 2010-07-01 21:27 - 00364544 ____N () C:\Program Files (x86)\Canon Pixela VideoBrowser\pxl_m17n_tool.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00098816 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32api.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00110080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pywintypes27.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00364544 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pythoncom27.dll
2016-06-28 03:30 - 2016-06-28 03:30 - 00320512 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32com.shell.shell.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00776704 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_hashlib.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 01176576 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._core_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00806400 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._gdi_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00816128 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._windows_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 01067008 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._controls_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00733184 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._misc_.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00682496 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pysqlite2._sqlite.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00088064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_ctypes.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00119808 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32file.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00108544 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32security.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00007168 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\hashobjs_ext.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00017920 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\thumbnails_ext.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00088064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\usb_ext.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00012288 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\common.time34.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00018432 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32event.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00167936 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32gui.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00046080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_socket.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 01208320 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_ssl.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00128512 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_elementtree.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00127488 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\pyexpat.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00038912 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32inet.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00036864 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_psutil_windows.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00525208 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\windows._lib_cacheinvalidation.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00011264 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32crypt.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00077312 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._html2.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00027136 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_multiprocessing.pyd
2016-06-28 03:29 - 2016-06-28 03:29 - 00020480 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\_yappi.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00035840 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32process.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00686080 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\unicodedata.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00078848 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._animate.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00123392 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\wx._wizard.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00024064 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32pipe.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00010240 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\select.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00025600 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32pdh.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00017408 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32profile.pyd
2016-06-28 03:30 - 2016-06-28 03:30 - 00022528 ____R () C:\Users\MEmroi\AppData\Local\Temp\_MEI38282\win32ts.pyd

==================== Alternate Data Streams (Nicht auf der Ausnahmeliste) =========

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird nur der ADS entfernt.)

AlternateDataStreams: C:\ProgramData\Temp:21071F2D [140]

==================== Abgesicherter Modus (Nicht auf der Ausnahmeliste) ===================

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Der Wert "AlternateShell" wird wiederhergestellt.)


==================== Verknüpfungen (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird der Registryeintrag auf den Standardwert zurückgesetzt oder entfernt.)


==================== Internet Explorer Vertrauenswürdig/Eingeschränkt ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt.)


==================== Hosts Inhalt: ===============================

(Wenn benötigt kann der Hosts: Schalter in die Fixlist aufgenommen werden um die Hosts Datei zurückzusetzen.)

2009-07-14 04:34 - 2009-06-10 23:00 - 00000824 ____N C:\windows\system32\Drivers\etc\hosts


==================== Andere Bereiche ============================

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)

HKU\S-1-5-21-1078291597-1949154093-2174115440-1001\Control Panel\Desktop\\Wallpaper -> C:\Users\MEmroi\AppData\Roaming\Microsoft\Windows\Themes\TranscodedWallpaper.jpg
DNS Servers: 192.168.0.1 - 192.168.0.2
HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Policies\System => (ConsentPromptBehaviorAdmin: 5) (ConsentPromptBehaviorUser: 3) (EnableLUA: 1)
Windows Firewall ist aktiviert.

==================== MSCONFIG/TASK MANAGER Deaktivierte Einträge ==

(Aktuell gibt es keinen automatisierten Fix für diesen Bereich.)


==================== Firewall Regeln (Nicht auf der Ausnahmeliste) ===============

(Wenn ein Eintrag in die Fixlist aufgenommen wird, wird er aus der Registry entfernt. Die Datei wird nicht verschoben solange sie nicht separat aufgelistet wird.)

FirewallRules: [{711178F2-CB02-4399-8AE6-E515DF5491DC}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
FirewallRules: [{BA299467-B3FB-4D47-9F02-E22DAD8C5106}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
FirewallRules: [{2886F0B2-6822-4A0C-A47B-60B46116023D}] => (Allow) C:\windows\system32\ezSharedSvcHost.exe
FirewallRules: [{D8D0A7A4-8042-422D-9DE1-4B0306765DAF}] => (Allow) C:\Program Files (x86)\EasyBits For Kids\ezDesktop.exe
FirewallRules: [{5A679B34-8ED8-4DD9-860E-B77131F013B9}] => (Allow) C:\Program Files (x86)\Windows Live\Contacts\wlcomm.exe
FirewallRules: [{6F82E790-AC0E-401C-A9BA-FCC6E36D2E1A}] => (Allow) LPort=2869
FirewallRules: [{AD1F6958-00B5-4018-8B50-421E9371CF5F}] => (Allow) LPort=1900
FirewallRules: [{3C78D814-3EF4-4468-BB33-442DF3836289}] => (Allow) C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe
FirewallRules: [{6059852C-72E0-46B9-8D40-F307DB9B2738}] => (Allow) C:\Program Files (x86)\Windows Live\Mesh\MOE.exe
FirewallRules: [{A383014E-086F-4A34-8BD5-C83ABD516AB2}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
FirewallRules: [{6DD9BBB1-554D-4174-839E-DDB97B1D2EBE}] => (Allow) C:\Program Files (x86)\Ralink\Common\RaWiFi.exe
FirewallRules: [{45CA9F59-F8F6-40BB-92DD-27079B7A186A}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqkygrp.exe
FirewallRules: [{77E5BE83-4657-45C8-B680-94D36C87EB54}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpfccopy.exe
FirewallRules: [{C9E64346-40C2-4C4C-9A23-6DDE5F9DF1F5}] => (Allow) C:\Program Files (x86)\HP\Digital Imaging\bin\hpiscnapp.exe
FirewallRules: [{76F311C1-DBE3-4D14-9947-E70D67B45B19}] => (Allow) C:\Program Files (x86)\HP\hp software update\hpwucli.exe
FirewallRules: [{416F2F70-C941-4448-AC46-7820FAAAF5B7}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{9F5449E9-13DF-43EB-9BCD-5DB9A4035580}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{0109FDA5-9A78-41C3-A6A1-C323D98AE6E3}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{522A3FFA-5FDA-409F-BE72-1C7FC37EB6CE}] => (Allow) C:\Users\MEmroi\AppData\Local\Temp\EpInsNav\DL\3013\Network\EpsonNetSetup\EpsonNetSetup\Data\ENEasyApp.exe
FirewallRules: [{68044D01-5D4C-4FAE-AC05-DEBB599EC6E3}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{249F4ACA-B295-4345-912E-5063A4EFBCEB}] => (Allow) C:\Windows\SysWOW64\muzapp.exe
FirewallRules: [{EEADD94E-F4AA-476D-A529-2FF1034F1F30}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{F184F795-85DB-4DDB-B73B-70B4AD92DC30}] => (Allow) C:\Program Files\Bonjour\mDNSResponder.exe
FirewallRules: [{814D2F67-0195-4661-921F-AC9365CF5CDD}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{0E65461E-9799-47A9-AD7D-627BD40CB666}] => (Allow) C:\Program Files (x86)\Bonjour\mDNSResponder.exe
FirewallRules: [{CCFFC58E-7C19-4FB1-BD00-0B9DE2F8695B}] => (Allow) C:\Program Files\iTunes\iTunes.exe
FirewallRules: [{038F1115-72A9-4266-B250-0F83406E6B35}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe
FirewallRules: [{759BF5F2-99E5-4629-AA90-CF199D8FC1AC}] => (Allow) C:\Program Files (x86)\Mozilla Firefox\firefox.exe

==================== Wiederherstellungspunkte =========================

12-06-2016 17:12:27 Windows Update
27-06-2016 14:07:57 Windows Update
28-06-2016 03:00:51 Windows Update

==================== Fehlerhafte Geräte im Gerätemanager =============


==================== Fehlereinträge in der Ereignisanzeige: =========================

Applikationsfehler:
==================
Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31184

Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 31184

Error: (06/29/2016 11:23:30 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 15584

Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 15584

Error: (06/29/2016 11:23:15 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 46785

Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledEvent 46785

Error: (06/29/2016 10:03:31 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: Continuously busy for more than a second

Error: (06/29/2016 10:03:16 PM) (Source: Bonjour Service) (EventID: 100) (User: )
Description: Task Scheduling Error: m->NextScheduledSPRetry 31185


Systemfehler:
=============
Error: (06/30/2016 08:36:43 PM) (Source: Schannel) (EventID: 4119) (User: NT-AUTORITÄT)
Description: Es wurde eine schwerwiegende Warnung empfangen: 20.

Error: (06/30/2016 08:26:52 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)

Error: (06/30/2016 08:26:52 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)

Error: (06/28/2016 03:31:25 AM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2 = Das System kann die angegebene Datei nicht finden.


Error: (06/28/2016 03:29:23 AM) (Source: Service Control Manager) (EventID: 7026) (User: )
Description: Das Laden folgender Boot- oder Systemstarttreiber ist fehlgeschlagen: 
StarOpen

Error: (06/28/2016 03:29:22 AM) (Source: Service Control Manager) (EventID: 7009) (User: )
Description: Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Ralink UPnP Media Server erreicht.

Error: (06/28/2016 03:27:43 AM) (Source: Application Popup) (EventID: 1060) (User: )
Description: Aufgrund der Inkompatibilität mit diesem System wurde \SystemRoot\SysWow64\Drivers\StarOpen.SYS nicht geladen. Wenden Sie sich an den Softwarehersteller, um eine kompatible Version des Treibers zu erhalten.

Error: (06/27/2016 06:29:21 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{D3DCB472-7261-43CE-924B-0704BD730D5F}{D3DCB472-7261-43CE-924B-0704BD730D5F}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)

Error: (06/27/2016 06:29:21 PM) (Source: DCOM) (EventID: 10016) (User: Emroi)
Description: AnwendungsspezifischLokalAktivierung{145B4335-FE2A-4927-A040-7C35AD3180EF}{145B4335-FE2A-4927-A040-7C35AD3180EF}EmroiMEmroiS-1-5-21-1078291597-1949154093-2174115440-1001LocalHost (unter Verwendung von LRPC)

Error: (06/27/2016 04:27:02 PM) (Source: Service Control Manager) (EventID: 7000) (User: )
Description: Der Dienst "HP Support Assistant Service" wurde aufgrund folgenden Fehlers nicht gestartet: 
%%2 = Das System kann die angegebene Datei nicht finden.



==================== Speicherinformationen =========================== 

Prozessor: Intel(R) Core(TM) i7-3770 CPU @ 3.40GHz
Prozentuale Nutzung des RAM: 36%
Installierter physikalischer RAM: 8148.01 MB
Verfügbarer physikalischer RAM: 5198.3 MB
Summe virtueller Speicher: 16294.21 MB
Verfügbarer virtueller Speicher: 12200.49 MB

==================== Laufwerke ================================

Drive c: (OS) (Fixed) (Total:935.96 GB) (Free:779.71 GB) NTFS ==>[System mit Startkomponenten (eingeholt von Laufwerk)]
Drive d: (HP_RECOVERY) (Fixed) (Total:16.74 GB) (Free:2.09 GB) NTFS
Drive l: (Bilder und Videos) (Fixed) (Total:910.09 GB) (Free:692.84 GB) NTFS

==================== MBR & Partitionstabelle ==================

========================================================
Disk: 0 (Size: 1863 GB) (Disk ID: C55D8423)

Partition: GPT.

==================== Ende von Addition.txt ============================
         

Alt 30.06.2016, 21:56   #2
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Output TDSSKiller: keine Rootkits:

Code:
ATTFilter
21:43:26.0659 0x0394  TDSS rootkit removing tool 3.1.0.9 Dec 11 2015 22:49:12
21:43:26.0659 0x0394  UEFI system
21:43:46.0691 0x0394  ============================================================
21:43:46.0691 0x0394  Current date / time: 2016/06/30 21:43:46.0691
21:43:46.0691 0x0394  SystemInfo:
21:43:46.0691 0x0394  
21:43:46.0691 0x0394  OS Version: 6.1.7601 ServicePack: 1.0
21:43:46.0691 0x0394  Product type: Workstation
21:43:46.0691 0x0394  ComputerName: Emroi
21:43:46.0691 0x0394  UserName: MEmroi
21:43:46.0691 0x0394  Windows directory: C:\windows
21:43:46.0691 0x0394  System windows directory: C:\windows
21:43:46.0691 0x0394  Running under WOW64
21:43:46.0691 0x0394  Processor architecture: Intel x64
21:43:46.0691 0x0394  Number of processors: 8
21:43:46.0691 0x0394  Page size: 0x1000
21:43:46.0691 0x0394  Boot type: Normal boot
21:43:46.0691 0x0394  ============================================================
21:43:48.0121 0x0394  KLMD registered as C:\windows\system32\drivers\88143396.sys
21:43:48.0751 0x0394  System UUID: {1E9863B0-9611-6E4F-DC16-9763D5925415}
21:43:49.0412 0x0394  Drive \Device\Harddisk0\DR0 - Size: 0x1D1C1116000 ( 1863.02 Gb ), SectorSize: 0x200, Cylinders: 0x3B601, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
21:43:49.0442 0x0394  ============================================================
21:43:49.0442 0x0394  \Device\Harddisk0\DR0:
21:43:49.0442 0x0394  GPT partitions:
21:43:49.0442 0x0394  \Device\Harddisk0\DR0\Partition1: GPT, TypeGUID: {C12A7328-F81F-11D2-BA4B-00A0C93EC93B}, UniqueGUID: {FBC59852-7725-4D48-A545-0BFC5951B189}, Name: EFI system partition, StartLBA 0x800, BlocksNum 0x32000
21:43:49.0442 0x0394  \Device\Harddisk0\DR0\Partition2: GPT, TypeGUID: {E3C9E316-0B5C-4DB8-817D-F92DF00215AE}, UniqueGUID: {C7BB0541-90B9-42BC-B5C9-D14F31FDAF86}, Name: Microsoft reserved partition, StartLBA 0x32800, BlocksNum 0x40000
21:43:49.0442 0x0394  \Device\Harddisk0\DR0\Partition3: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {03CC4A9B-6E24-4FE6-91D1-5DDBA24B2191}, Name: Basic data partition, StartLBA 0x72800, BlocksNum 0x74FE9800
21:43:49.0442 0x0394  \Device\Harddisk0\DR0\Partition4: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {DC5FD122-A930-46D3-B08E-186A2B15F958}, Name: Basic data partition, StartLBA 0x7505C000, BlocksNum 0x71C2F000
21:43:49.0442 0x0394  \Device\Harddisk0\DR0\Partition5: GPT, TypeGUID: {EBD0A0A2-B9E5-4433-87C0-68B6B72699C7}, UniqueGUID: {E6E2A852-094E-4922-8F0A-0970F30DB8D3}, Name: Basic data partition, StartLBA 0xE6C8B800, BlocksNum 0x217D000
21:43:49.0442 0x0394  MBR partitions:
21:43:49.0442 0x0394  ============================================================
21:43:49.0472 0x0394  C: <-> \Device\Harddisk0\DR0\Partition3
21:43:49.0522 0x0394  D: <-> \Device\Harddisk0\DR0\Partition5
21:43:49.0542 0x0394  L: <-> \Device\Harddisk0\DR0\Partition4
21:43:49.0542 0x0394  ============================================================
21:43:49.0542 0x0394  Initialize success
21:43:49.0542 0x0394  ============================================================
21:44:31.0997 0x0c60  ============================================================
21:44:31.0997 0x0c60  Scan started
21:44:31.0997 0x0c60  Mode: Manual; SigCheck; TDLFS; 
21:44:31.0997 0x0c60  ============================================================
21:44:31.0997 0x0c60  KSN ping started
21:44:32.0107 0x0c60  KSN ping finished: true
21:44:33.0107 0x0c60  ================ Scan system memory ========================
21:44:33.0107 0x0c60  System memory - ok
21:44:33.0107 0x0c60  ================ Scan services =============================
21:44:33.0277 0x0c60  [ A87D604AEA360176311474C87A63BB88, B1507868C382CD5D2DBC0D62114FCFBF7A780904A2E3CA7C7C1DD0844ADA9A8F ] 1394ohci        C:\windows\system32\drivers\1394ohci.sys
21:44:33.0367 0x0c60  1394ohci - ok
21:44:33.0387 0x0c60  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2, FDAAB7E23012B4D31537C5BDEF245BB0A12FA060A072C250E21C68E18B22E002 ] ACPI            C:\windows\system32\drivers\ACPI.sys
21:44:33.0397 0x0c60  ACPI - ok
21:44:33.0407 0x0c60  [ 99F8E788246D495CE3794D7E7821D2CA, F91615463270AD2601F882CAED43B88E7EDA115B9FD03FC56320E48119F15F76 ] AcpiPmi         C:\windows\system32\drivers\acpipmi.sys
21:44:33.0427 0x0c60  AcpiPmi - ok
21:44:33.0497 0x0c60  [ B1EA9681502EE57F87DB71D726288A5B, D17BD2CFAE72E92C77D183331D5CBA0FEA893BF54875920870E271940F40A8BB ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
21:44:33.0507 0x0c60  AdobeARMservice - ok
21:44:33.0537 0x0c60  [ 2F6B34B83843F0C5118B63AC634F5BF4, 43E3F5FBFB5D33981AC503DEE476868EC029815D459E7C36C4ABC2D2F75B5735 ] adp94xx         C:\windows\system32\drivers\adp94xx.sys
21:44:33.0557 0x0c60  adp94xx - ok
21:44:33.0587 0x0c60  [ 597F78224EE9224EA1A13D6350CED962, DA7FD99BE5E3B7B98605BF5C13BF3F1A286C0DE1240617570B46FE4605E59BDC ] adpahci         C:\windows\system32\drivers\adpahci.sys
21:44:33.0607 0x0c60  adpahci - ok
21:44:33.0627 0x0c60  [ E109549C90F62FB570B9540C4B148E54, E804563735153EA00A00641814244BC8A347B578E7D63A16F43FB17566EE5559 ] adpu320         C:\windows\system32\drivers\adpu320.sys
21:44:33.0637 0x0c60  adpu320 - ok
21:44:33.0657 0x0c60  [ 262D7C87D0AC20B96EF9877D3CA478A0, 54F7E5A5F8991C5525500C1ECCF3D3135D13F48866C366E52DF1D052DB2EE15B ] AeLookupSvc     C:\windows\System32\aelupsvc.dll
21:44:33.0677 0x0c60  AeLookupSvc - ok
21:44:33.0697 0x0c60  [ 9A4A1EEE802BF2F878EE8EAB407B21B7, 177EB7DF4B35FE4C0E45E775A0FD5D48D39B410052E3EE18BDEEC809E152D9D8 ] AFD             C:\windows\system32\drivers\afd.sys
21:44:33.0717 0x0c60  AFD - ok
21:44:33.0737 0x0c60  [ 608C14DBA7299D8CB6ED035A68A15799, 45360F89640BF1127C82A32393BD76205E4FA067889C40C491602F370C09282A ] agp440          C:\windows\system32\drivers\agp440.sys
21:44:33.0747 0x0c60  agp440 - ok
21:44:33.0767 0x0c60  [ 3290D6946B5E30E70414990574883DDB, 0E9294E1991572256B3CDA6B031DB9F39CA601385515EE59F1F601725B889663 ] ALG             C:\windows\System32\alg.exe
21:44:33.0787 0x0c60  ALG - ok
21:44:33.0807 0x0c60  [ 5812713A477A3AD7363C7438CA2EE038, A7316299470D2E57A11499C752A711BF4A71EB11C9CBA731ED0945FF6A966721 ] aliide          C:\windows\system32\drivers\aliide.sys
21:44:33.0817 0x0c60  aliide - ok
21:44:33.0857 0x0c60  [ D4E34B0ED7292E6E424FABCB485937B9, 6384BDFD74D2F40B388221ABFF031E98A7B80A2FF80024951F878B24E8AF0D50 ] AMD External Events Utility C:\windows\system32\atiesrxx.exe
21:44:33.0887 0x0c60  AMD External Events Utility - ok
21:44:33.0897 0x0c60  [ 1FF8B4431C353CE385C875F194924C0C, 3EA3A7F426B0FFC2461EDF4FDB4B58ACC9D0730EDA5B728D1EA1346EA0A02720 ] amdide          C:\windows\system32\drivers\amdide.sys
21:44:33.0907 0x0c60  amdide - ok
21:44:33.0927 0x0c60  [ 7024F087CFF1833A806193EF9D22CDA9, E7F27E488C38338388103D3B7EEDD61D05E14FB140992AEE6F492FFC821BF529 ] AmdK8           C:\windows\system32\drivers\amdk8.sys
21:44:33.0947 0x0c60  AmdK8 - ok
21:44:34.0177 0x0c60  [ A34D82F86C2D95E613343BD272B83A85, 494F83E895B13E285B5009CA5702AF169B9EA5D469B0AA7595AA309C6D53E3AF ] amdkmdag        C:\windows\system32\DRIVERS\atikmdag.sys
21:44:34.0337 0x0c60  amdkmdag - ok
21:44:34.0367 0x0c60  [ 301D1B0CBA2A5E2AE2C05E7CFA0ADF8E, 32567C244DFFA2CA2A50D5441A81153D091236187B36E7EE626589C29F36182D ] amdkmdap        C:\windows\system32\DRIVERS\atikmpag.sys
21:44:34.0387 0x0c60  amdkmdap - ok
21:44:34.0407 0x0c60  [ 1E56388B3FE0D031C44144EB8C4D6217, E88CA76FD47BA0EB427D59CB9BE040DE133D89D4E62D03A8D622624531D27487 ] AmdPPM          C:\windows\system32\drivers\amdppm.sys
21:44:34.0417 0x0c60  AmdPPM - ok
21:44:34.0437 0x0c60  [ D4121AE6D0C0E7E13AA221AA57EF2D49, 626F43C099BD197BE56648C367B711143C2BCCE96496BBDEF19F391D52FA01D0 ] amdsata         C:\windows\system32\drivers\amdsata.sys
21:44:34.0457 0x0c60  amdsata - ok
21:44:34.0477 0x0c60  [ F67F933E79241ED32FF46A4F29B5120B, D6EF539058F159CC4DD14CA9B1FD924998FEAC9D325C823C7A2DD21FEF1DC1A8 ] amdsbs          C:\windows\system32\drivers\amdsbs.sys
21:44:34.0487 0x0c60  amdsbs - ok
21:44:34.0507 0x0c60  [ 540DAF1CEA6094886D72126FD7C33048, 296578572A93F5B74E1AD443E000B79DC99D1CBD25082E02704800F886A3065F ] amdxata         C:\windows\system32\drivers\amdxata.sys
21:44:34.0517 0x0c60  amdxata - ok
21:44:34.0557 0x0c60  [ 6474F8823C7188D2DA579F01FB6CED6B, 81D4E9D026CA60FB8840D520D151B8C2F4745A75DF90A4D6C80641F1A23AB605 ] AppID           C:\windows\system32\drivers\appid.sys
21:44:34.0597 0x0c60  AppID - ok
21:44:34.0607 0x0c60  [ 8F58BA1F7772D6D7CE45F03309608001, CDB109E0DD241042C058F7D81A1BDEBC34435CB2DC4A7A7A3692193DD5806097 ] AppIDSvc        C:\windows\System32\appidsvc.dll
21:44:34.0617 0x0c60  AppIDSvc - ok
21:44:34.0647 0x0c60  [ B62867835B41BCD839D9896AB4D7DF09, 98036D0202DB6171E90485898175833AC44873A85E6453EBE928E433B364CE07 ] Appinfo         C:\windows\System32\appinfo.dll
21:44:34.0677 0x0c60  Appinfo - ok
21:44:34.0777 0x0c60  [ 2D564BB1C4559A517B390A031955714D, 3048C187FD107C958D43DD8B954AB55FDD1BC538D3E0066CBFCB428C7A8A87E1 ] Apple Mobile Device Service C:\Program Files\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
21:44:34.0797 0x0c60  Apple Mobile Device Service - ok
21:44:34.0817 0x0c60  [ C484F8CEB1717C540242531DB7845C4E, C507CE26716EB923B864ED85E8FA0B24591E2784A2F4F0E78AEED7E9953311F6 ] arc             C:\windows\system32\drivers\arc.sys
21:44:34.0827 0x0c60  arc - ok
21:44:34.0847 0x0c60  [ 019AF6924AEFE7839F61C830227FE79C, 5926B9DDFC9198043CDD6EA0B384C83B001EC225A8125628C4A45A3E6C42C72A ] arcsas          C:\windows\system32\drivers\arcsas.sys
21:44:34.0867 0x0c60  arcsas - ok
21:44:34.0927 0x0c60  [ F15AB80B867D3332D5DDFB0A05B9CE04, 5A16577106246AB5DCC04FE0A0B00B7C5702557B75F958721E4C00383AB99809 ] aspnet_state    C:\windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
21:44:34.0957 0x0c60  aspnet_state - ok
21:44:34.0987 0x0c60  [ 769765CE2CC62867468CEA93969B2242, 0D8F19D49869DF93A3876B4C2E249D12E83F9CE11DAE8917D368E292043D4D26 ] AsyncMac        C:\windows\system32\DRIVERS\asyncmac.sys
21:44:35.0017 0x0c60  AsyncMac - ok
21:44:35.0027 0x0c60  [ 02062C0B390B7729EDC9E69C680A6F3C, 0261683C6DC2706DCE491A1CDC954AC9C9E649376EC30760BB4E225E18DC5273 ] atapi           C:\windows\system32\drivers\atapi.sys
21:44:35.0047 0x0c60  atapi - ok
21:44:35.0077 0x0c60  [ 24464B908E143D2561E9E452FEE97309, F5A24FEBAD1B1795A075130F7FFDD4EB76C8F1855FA1628A29CAFAF03C1C9183 ] AtiHDAudioService C:\windows\system32\drivers\AtihdW76.sys
21:44:35.0097 0x0c60  AtiHDAudioService - ok
21:44:35.0137 0x0c60  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioEndpointBuilder C:\windows\System32\Audiosrv.dll
21:44:35.0177 0x0c60  AudioEndpointBuilder - ok
21:44:35.0187 0x0c60  [ 6968D02DC38757C3FBE7ED7C2F9670AA, C8B3115DDB32EFBE8C56C5AA78EEA05BBB77DF3F75CC2A04532EB32327E4735A ] AudioSrv        C:\windows\System32\Audiosrv.dll
21:44:35.0207 0x0c60  AudioSrv - ok
21:44:35.0247 0x0c60  [ A6BF31A71B409DFA8CAC83159E1E2AFF, CBB83F73FFD3C3FB4F96605067739F8F7A4A40B2B05417FA49E575E95628753F ] AxInstSV        C:\windows\System32\AxInstSV.dll
21:44:35.0287 0x0c60  AxInstSV - ok
21:44:35.0307 0x0c60  [ 3E5B191307609F7514148C6832BB0842, DE011CB7AA4A2405FAF21575182E0793A1D83DFFC44E9A7864D59F3D51D8D580 ] b06bdrv         C:\windows\system32\drivers\bxvbda.sys
21:44:35.0337 0x0c60  b06bdrv - ok
21:44:35.0377 0x0c60  [ B5ACE6968304A3900EEB1EBFD9622DF2, 1DAA118D8CA3F97B34DF3D3CDA1C78EAB2ED225699FEABE89D331AE0CB7679FA ] b57nd60a        C:\windows\system32\DRIVERS\b57nd60a.sys
21:44:35.0407 0x0c60  b57nd60a - ok
21:44:35.0417 0x0c60  [ FDE360167101B4E45A96F939F388AEB0, 8D1457E866BBD645C4B9710DFBFF93405CC1193BF9AE42326F2382500B713B82 ] BDESVC          C:\windows\System32\bdesvc.dll
21:44:35.0447 0x0c60  BDESVC - ok
21:44:35.0457 0x0c60  [ 16A47CE2DECC9B099349A5F840654746, 77C008AEDB07FAC66413841D65C952DDB56FE7DCA5E9EF9C8F4130336B838024 ] Beep            C:\windows\system32\drivers\Beep.sys
21:44:35.0487 0x0c60  Beep - ok
21:44:35.0507 0x0c60  [ 82974D6A2FD19445CC5171FC378668A4, 075D25F47C0D2277E40AF8615571DAA5EB16B1824563632A9A7EC62505C29A4A ] BFE             C:\windows\System32\bfe.dll
21:44:35.0537 0x0c60  BFE - ok
21:44:35.0687 0x0c60  [ 4E8EF55692BDCB8BA97888877CD034AC, 050C73032D77D57E3B79D1BFB3F2D7F2E9CED1188F53576223FE10149D86AB6C ] BHDrvx64        C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\BASHDefs\20160621.003\BHDrvx64.sys
21:44:35.0737 0x0c60  BHDrvx64 - ok
21:44:35.0767 0x0c60  [ 1EA7969E3271CBC59E1730697DC74682, D511A34D63A6E0E6E7D1879068E2CD3D87ABEAF4936B2EA8CDDAD9F79D60FA04 ] BITS            C:\windows\System32\qmgr.dll
21:44:35.0807 0x0c60  BITS - ok
21:44:35.0827 0x0c60  [ 61583EE3C3A17003C4ACD0475646B4D3, 17E4BECC309C450E7E44F59A9C0BBC24D21BDC66DFBA65B8F198A00BB47A9811 ] blbdrive        C:\windows\system32\drivers\blbdrive.sys
21:44:35.0847 0x0c60  blbdrive - ok
21:44:35.0887 0x0c60  [ B5C2F92EE1106DFE7BB1CCE4D35B6037, E399C390687589194D8AAD385055F0CFA7D52AD9E837D8FF95008B8EB2B34E50 ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
21:44:35.0907 0x0c60  Bonjour Service - ok
21:44:35.0927 0x0c60  [ 6C02A83164F5CC0A262F4199F0871CF5, AD4632A6A203CB40970D848315D8ADB9C898349E20D8DF4107C2AE2703A2CF28 ] bowser          C:\windows\system32\DRIVERS\bowser.sys
21:44:35.0967 0x0c60  bowser - ok
21:44:35.0987 0x0c60  [ F09EEE9EDC320B5E1501F749FDE686C8, 66691114C42E12F4CC6DC4078D4D2FA4029759ACDAF1B59D17383487180E84E3 ] BrFiltLo        C:\windows\system32\drivers\BrFiltLo.sys
21:44:36.0007 0x0c60  BrFiltLo - ok
21:44:36.0017 0x0c60  [ B114D3098E9BDB8BEA8B053685831BE6, 0ED23C1897F35FA00B9C2848DE4ED200E18688AA7825674888054BBC3A3EB92C ] BrFiltUp        C:\windows\system32\drivers\BrFiltUp.sys
21:44:36.0037 0x0c60  BrFiltUp - ok
21:44:36.0057 0x0c60  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694, 40011138869F5496A3E78D38C9900B466B6F3877526AC22952DCD528173F4645 ] Browser         C:\windows\System32\browser.dll
21:44:36.0087 0x0c60  Browser - ok
21:44:36.0097 0x0c60  [ 43BEA8D483BF1870F018E2D02E06A5BD, 4E6F5A5FD8C796A110B0DC9FF29E31EA78C04518FC1C840EF61BABD58AB10272 ] Brserid         C:\windows\System32\Drivers\Brserid.sys
21:44:36.0117 0x0c60  Brserid - ok
21:44:36.0127 0x0c60  [ A6ECA2151B08A09CACECA35C07F05B42, E2875BB7768ABAF38C3377007AA0A3C281503474D1831E396FB6599721586B0C ] BrSerWdm        C:\windows\System32\Drivers\BrSerWdm.sys
21:44:36.0147 0x0c60  BrSerWdm - ok
21:44:36.0157 0x0c60  [ B79968002C277E869CF38BD22CD61524, 50631836502237AF4893ECDCEA43B9031C3DE97433F594D46AF7C3C77F331983 ] BrUsbMdm        C:\windows\System32\Drivers\BrUsbMdm.sys
21:44:36.0177 0x0c60  BrUsbMdm - ok
21:44:36.0187 0x0c60  [ A87528880231C54E75EA7A44943B38BF, 4C8BBB29FDA76A96840AA47A8613C15D4466F9273A13941C19507008629709C9 ] BrUsbSer        C:\windows\System32\Drivers\BrUsbSer.sys
21:44:36.0197 0x0c60  BrUsbSer - ok
21:44:36.0207 0x0c60  [ 9DA669F11D1F894AB4EB69BF546A42E8, B498B8B6CEF957B73179D1ADAF084BBB57BB3735D810F9BE2C7B1D58A4FD25A4 ] BTHMODEM        C:\windows\system32\drivers\bthmodem.sys
21:44:36.0227 0x0c60  BTHMODEM - ok
21:44:36.0267 0x0c60  [ 95F9C2976059462CBBF227F7AAB10DE9, 2797AE919FF7606B070FB039CECDB0707CD2131DCAC09C5DF14F443D881C9F34 ] bthserv         C:\windows\system32\bthserv.dll
21:44:36.0307 0x0c60  bthserv - ok
21:44:36.0387 0x0c60  [ 03427B8FF618BE50EB5027B4E549C0D8, 3C3815FE3C847B992E794B1BB0FDB87B8D18AEC95BA9E916591CF43EB8169D15 ] ccSet_NIS       C:\windows\system32\drivers\NISx64\1607000.04C\ccSetx64.sys
21:44:36.0417 0x0c60  ccSet_NIS - ok
21:44:36.0437 0x0c60  [ B8BD2BB284668C84865658C77574381A, 6C55BA288B626DF172FDFEA0BD7027FAEBA1F44EF20AB55160D7C7DC6E717D65 ] cdfs            C:\windows\system32\DRIVERS\cdfs.sys
21:44:36.0477 0x0c60  cdfs - ok
21:44:36.0517 0x0c60  [ F036CE71586E93D94DAB220D7BDF4416, BD07AAD9E20CEAF9FC84E4977C55EA2C45604A2C682AC70B9B9A2199B6713D5B ] cdrom           C:\windows\system32\DRIVERS\cdrom.sys
21:44:36.0547 0x0c60  cdrom - ok
21:44:36.0567 0x0c60  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] CertPropSvc     C:\windows\System32\certprop.dll
21:44:36.0597 0x0c60  CertPropSvc - ok
21:44:36.0627 0x0c60  [ D7CD5C4E1B71FA62050515314CFB52CF, 513B5A849899F379F0BC6AB3A8A05C3493C2393C95F036612B96EC6E252E1C64 ] circlass        C:\windows\system32\drivers\circlass.sys
21:44:36.0647 0x0c60  circlass - ok
21:44:36.0677 0x0c60  [ 404B7DF9CA4D1CB675045AF220FF3285, 91FFADE2ABE5C48849E63134D5FFD20671FE0D1720F7D486F904391B3D142C96 ] CLFS            C:\windows\system32\CLFS.sys
21:44:36.0697 0x0c60  CLFS - ok
21:44:36.0747 0x0c60  [ F13EC8A783E0CB0D6DC26A3CA848B7B8, 0809E3B71709F1343086EEB6C820543C1A7119E74EEF8AC1AEE1F81093ABEC66 ] clr_optimization_v2.0.50727_32 C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
21:44:36.0777 0x0c60  clr_optimization_v2.0.50727_32 - ok
21:44:36.0797 0x0c60  [ B4D73F04E9BC076F7CDAC4327DF636BB, 1ADED20D5A0D0A76E2F85CB778FD06BAB814868D35F8532E17D67045FF4770C2 ] clr_optimization_v2.0.50727_64 C:\windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
21:44:36.0817 0x0c60  clr_optimization_v2.0.50727_64 - ok
21:44:36.0877 0x0c60  [ F5AB4D2E36625F355E81539239765107, 48E6AD65EEFD6C54F938F5753EF58377CDA77ADBB41CD8635F0040D61EFB92A4 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
21:44:36.0907 0x0c60  clr_optimization_v4.0.30319_32 - ok
21:44:36.0917 0x0c60  [ 9ACBE5EC13C2CC95833BFB7636CA8B1A, 6224DA9FB335D2A8374C60B8DEA539DD3A0E43230DB888B137B71A56EC57D6AF ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
21:44:36.0937 0x0c60  clr_optimization_v4.0.30319_64 - ok
21:44:36.0947 0x0c60  [ 0840155D0BDDF1190F84A663C284BD33, 696039FA63CFEB33487FAA8FD7BBDB220141E9C6E529355D768DFC87999A9C3A ] CmBatt          C:\windows\system32\drivers\CmBatt.sys
21:44:36.0957 0x0c60  CmBatt - ok
21:44:36.0977 0x0c60  [ E19D3F095812725D88F9001985B94EDD, 46243C5CCC4981CAC6FA6452FFCEC33329BF172448F1852D52592C9342E0E18B ] cmdide          C:\windows\system32\drivers\cmdide.sys
21:44:36.0987 0x0c60  cmdide - ok
21:44:37.0017 0x0c60  [ 3323F76352B0AF14B2CDC4DFBF3E980A, F8E3C3508C37E647497B6889F26819B1DB30275F48A994D1BBFBAA9454E5FD70 ] CNG             C:\windows\system32\Drivers\cng.sys
21:44:37.0047 0x0c60  CNG - ok
21:44:37.0067 0x0c60  [ 102DE219C3F61415F964C88E9085AD14, CD74CB703381F1382C32CF892FF2F908F4C9412E1BC77234F8FEA5D4666E1BF1 ] Compbatt        C:\windows\system32\drivers\compbatt.sys
21:44:37.0077 0x0c60  Compbatt - ok
21:44:37.0107 0x0c60  [ 03EDB043586CCEBA243D689BDDA370A8, 0E4523AA332E242D5C2C61C5717DBA5AB6E42DADB5A7E512505FC2B6CC224959 ] CompositeBus    C:\windows\system32\drivers\CompositeBus.sys
21:44:37.0127 0x0c60  CompositeBus - ok
21:44:37.0127 0x0c60  COMSysApp - ok
21:44:37.0137 0x0c60  [ 1C827878A998C18847245FE1F34EE597, 41EF7443D8B2733AA35CAC64B4F5F74FAC8BB0DA7D3936B69EC38E2DC3972E60 ] crcdisk         C:\windows\system32\drivers\crcdisk.sys
21:44:37.0157 0x0c60  crcdisk - ok
21:44:37.0197 0x0c60  [ 7BC3E861F7E8EB543A630090FAE779E0, 52A538F25C853AAC9706CD0D4EBF80B1963391AA175895CFD9D44C8ABBFCFB74 ] CryptSvc        C:\windows\system32\cryptsvc.dll
21:44:37.0217 0x0c60  CryptSvc - ok
21:44:37.0247 0x0c60  [ 622C96AFB07BB82C8650B47172137AC4, B74CEA5A3F4945E5A3EAE7AF1B1FA75F611C65C6FACE393052A512FA81B0C17C ] DcomLaunch      C:\windows\system32\rpcss.dll
21:44:37.0277 0x0c60  DcomLaunch - ok
21:44:37.0297 0x0c60  [ 3CEC7631A84943677AA8FA8EE5B6B43D, 32061DAC9ED6C1EBA3B367B18D0E965AEEC2DF635DCF794EC39D086D32503AC5 ] defragsvc       C:\windows\System32\defragsvc.dll
21:44:37.0327 0x0c60  defragsvc - ok
21:44:37.0337 0x0c60  [ 9BB2EF44EAA163B29C4A4587887A0FE4, 03667BC3EA5003F4236929C10F23D8F108AFCB29DB5559E751FB26DFB318636F ] DfsC            C:\windows\system32\Drivers\dfsc.sys
21:44:37.0367 0x0c60  DfsC - ok
21:44:37.0417 0x0c60  [ 105373D52E71D2D1355AD3ACD18259C3, F11BDBF370DA30933003CA795A4F67F71681ED924D1A307A2976B4A476EDC6A2 ] dg_ssudbus      C:\windows\system32\DRIVERS\ssudbus.sys
21:44:37.0437 0x0c60  dg_ssudbus - ok
21:44:37.0467 0x0c60  [ 43D808F5D9E1A18E5EEB5EBC83969E4E, C10D1155D71EABE4ED44C656A8F13078A8A4E850C4A8FBB92D52D173430972B8 ] Dhcp            C:\windows\system32\dhcpcore.dll
21:44:37.0487 0x0c60  Dhcp - ok
21:44:37.0587 0x0c60  [ EC3F433D00365F1A9BC3411BCA7C7140, 0852D747359DE573504EBBDB99DA26D3BFA8B3C7A4836F8E3A5AD94B5571AD5C ] DiagTrack       C:\windows\system32\diagtrack.dll
21:44:37.0617 0x0c60  DiagTrack - ok
21:44:37.0637 0x0c60  [ 13096B05847EC78F0977F2C0F79E9AB3, 1E44981B684F3E56F5D2439BB7FA78BD1BC876BB2265AE089AEC68F241B05B26 ] discache        C:\windows\system32\drivers\discache.sys
21:44:37.0667 0x0c60  discache - ok
21:44:37.0697 0x0c60  [ 616387BBD83372220B09DE95F4E67BBC, 5E2D5280BB775576E7CDE3FA6BDE494E183123635E5908CF7EBF1FF52966D07D ] Disk            C:\windows\system32\drivers\disk.sys
21:44:37.0717 0x0c60  Disk - ok
21:44:37.0737 0x0c60  [ 16835866AAA693C7D7FCEBA8FFF706E4, 15891558F7C1F2BB57A98769601D447ED0D952354A8BB347312D034DC03E0242 ] Dnscache        C:\windows\System32\dnsrslvr.dll
21:44:37.0757 0x0c60  Dnscache - ok
21:44:37.0797 0x0c60  [ B1FB3DDCA0FDF408750D5843591AFBC6, AB6AD9C5E7BA2E3646D0115B67C4800D1CB43B4B12716397657C7ADEEE807304 ] dot3svc         C:\windows\System32\dot3svc.dll
21:44:37.0827 0x0c60  dot3svc - ok
21:44:37.0837 0x0c60  [ B26F4F737E8F9DF4F31AF6CF31D05820, 394BBBED4EC7FAD4110F62A43BFE0801D4AC56FFAC6C741C69407B26402311C7 ] DPS             C:\windows\system32\dps.dll
21:44:37.0867 0x0c60  DPS - ok
21:44:37.0897 0x0c60  [ 26FE888505E5A945B0536AF9A2A27A6F, A6B16ED498BAFE300E1F0E0A241E3D62F7A1C5973EE775904ED14F33A2BC08A6 ] drmkaud         C:\windows\system32\drivers\drmkaud.sys
21:44:37.0907 0x0c60  drmkaud - ok
21:44:37.0967 0x0c60  [ 3A9D7D464BDB3B70D7ECF689ADABBD4D, B4F5B23705EA1BA453FE30791CA245E1A5F7FBEABAD026E4A8A15A9FC44E8C9C ] DXGKrnl         C:\windows\System32\drivers\dxgkrnl.sys
21:44:37.0997 0x0c60  DXGKrnl - ok
21:44:38.0007 0x0c60  [ E2DDA8726DA9CB5B2C4000C9018A9633, 0C967DBC3636A76A696997192A158AA92A1AF19F01E3C66D5BF91818A8FAEA76 ] EapHost         C:\windows\System32\eapsvc.dll
21:44:38.0037 0x0c60  EapHost - ok
21:44:38.0107 0x0c60  [ DC5D737F51BE844D8C82C695EB17372F, 6D4022D9A46EDE89CEF0FAEADCC94C903234DFC460C0180D24FF9E38E8853017 ] ebdrv           C:\windows\system32\drivers\evbda.sys
21:44:38.0167 0x0c60  ebdrv - ok
21:44:38.0228 0x0c60  [ E5C10FCFA331D2BA13B211D0454FEA38, 9363545317C655EED282BA1FE7C71B26E2C3599F35E42E7496F413961303A24D ] eeCtrl          C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
21:44:38.0258 0x0c60  eeCtrl - ok
21:44:38.0278 0x0c60  [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] EFS             C:\windows\System32\lsass.exe
21:44:38.0298 0x0c60  EFS - ok
21:44:38.0338 0x0c60  [ C4002B6B41975F057D98C439030CEA07, 3D2484FBB832EFB90504DD406ED1CF3065139B1FE1646471811F3A5679EF75F1 ] ehRecvr         C:\windows\ehome\ehRecvr.exe
21:44:38.0368 0x0c60  ehRecvr - ok
21:44:38.0378 0x0c60  [ 4705E8EF9934482C5BB488CE28AFC681, 359E9EC5693CE0BE89082E1D5D8F5C5439A5B985010FF0CB45C11E3CFE30637D ] ehSched         C:\windows\ehome\ehsched.exe
21:44:38.0398 0x0c60  ehSched - ok
21:44:38.0438 0x0c60  [ 0E5DA5369A0FCAEA12456DD852545184, 9A64AC5396F978C3B92794EDCE84DCA938E4662868250F8C18FA7C2C172233F8 ] elxstor         C:\windows\system32\drivers\elxstor.sys
21:44:38.0468 0x0c60  elxstor - ok
21:44:38.0498 0x0c60  [ D315FF43E23DF424ECEC2F6C930203E4, 68940EDA34DC4945CDD0D8018D96A0DA8F99F16A930946D14E4FECEE033FCB80 ] EpsonScanSvc    C:\windows\system32\EscSvc64.exe
21:44:38.0518 0x0c60  EpsonScanSvc - ok
21:44:38.0558 0x0c60  [ 2BD3F1059975CE90F8D968DADD790DFF, 9FD4FA7DB54B0E1E4A48863435F728220978A271D2A28BB3E9E112C1A59B1D4C ] EraserUtilRebootDrv C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
21:44:38.0588 0x0c60  EraserUtilRebootDrv - ok
21:44:38.0598 0x0c60  [ 34A3C54752046E79A126E15C51DB409B, 7D5B5E150C7C73666F99CBAFF759029716C86F16B927E0078D77F8A696616D75 ] ErrDev          C:\windows\system32\drivers\errdev.sys
21:44:38.0618 0x0c60  ErrDev - ok
21:44:38.0648 0x0c60  [ 4166F82BE4D24938977DD1746BE9B8A0, 24121751B7306225AD1C808442D7B030DEF377E9316AA0A3C5C7460E87317881 ] EventSystem     C:\windows\system32\es.dll
21:44:38.0678 0x0c60  EventSystem - ok
21:44:38.0698 0x0c60  [ A510C654EC00C1E9BDD91EEB3A59823B, 76CD277730F7B08D375770CD373D786160F34D1481AF0536BA1A5D2727E255F5 ] exfat           C:\windows\system32\drivers\exfat.sys
21:44:38.0728 0x0c60  exfat - ok
21:44:38.0728 0x0c60  ezSharedSvc - ok
21:44:38.0738 0x0c60  [ 0ADC83218B66A6DB380C330836F3E36D, 798D6F83B5DBCC1656595E0A96CF12087FCCBE19D1982890D0CE5F629B328B29 ] fastfat         C:\windows\system32\drivers\fastfat.sys
21:44:38.0768 0x0c60  fastfat - ok
21:44:38.0808 0x0c60  [ DBEFD454F8318A0EF691FDD2EAAB44EB, 7F52AE222FF28503B6FC4A5852BD0CAEAF187BE69AF4B577D3DE474C24366099 ] Fax             C:\windows\system32\fxssvc.exe
21:44:38.0848 0x0c60  Fax - ok
21:44:38.0868 0x0c60  [ D765D19CD8EF61F650C384F62FAC00AB, 9F0A483A043D3BA873232AD3BA5F7BF9173832550A27AF3E8BD433905BD2A0EE ] fdc             C:\windows\system32\drivers\fdc.sys
21:44:38.0888 0x0c60  fdc - ok
21:44:38.0898 0x0c60  [ 0438CAB2E03F4FB61455A7956026FE86, 6D4DDC2973DB25CE0C7646BC85EFBCC004EBE35EA683F62162AE317C6F1D8DFE ] fdPHost         C:\windows\system32\fdPHost.dll
21:44:38.0928 0x0c60  fdPHost - ok
21:44:38.0938 0x0c60  [ 802496CB59A30349F9A6DD22D6947644, 52D59D3D628D5661F83F090F33F744F6916E0CC1F76E5A33983E06EB66AE19F8 ] FDResPub        C:\windows\system32\fdrespub.dll
21:44:38.0968 0x0c60  FDResPub - ok
21:44:38.0978 0x0c60  [ 655661BE46B5F5F3FD454E2C3095B930, 549C8E2A2A37757E560D55FFA6BFDD838205F17E40561E67F0124C934272CD1A ] FileInfo        C:\windows\system32\drivers\fileinfo.sys
21:44:38.0988 0x0c60  FileInfo - ok
21:44:39.0008 0x0c60  [ 5F671AB5BC87EEA04EC38A6CD5962A47, 6B61D3363FF3F9C439BD51102C284972EAE96ACC0683B9DC7E12D25D0ADC51B6 ] Filetrace       C:\windows\system32\drivers\filetrace.sys
21:44:39.0038 0x0c60  Filetrace - ok
21:44:39.0048 0x0c60  [ C172A0F53008EAEB8EA33FE10E177AF5, 9175A95B323696D1B35C9EFEB7790DD64E6EE0B7021E6C18E2F81009B169D77B ] flpydisk        C:\windows\system32\drivers\flpydisk.sys
21:44:39.0068 0x0c60  flpydisk - ok
21:44:39.0078 0x0c60  [ DA6B67270FD9DB3697B20FCE94950741, F621A4462C9F2904063578C427FAF22D7D66AE9967605C11C798099817CE5331 ] FltMgr          C:\windows\system32\drivers\fltmgr.sys
21:44:39.0098 0x0c60  FltMgr - ok
21:44:39.0138 0x0c60  [ BCB16AE33AA58E0042F3EF34CFB6396A, E8ADA10DE60A94E4BABE9FCA6D0AA83B11520C092D49057E17F6C6059D35A323 ] FontCache       C:\windows\system32\FntCache.dll
21:44:39.0188 0x0c60  FontCache - ok
21:44:39.0198 0x0c60  [ D43703496149971890703B4B1B723EAC, F06397B2EDCA61629249D2EF1CBB7827A8BEAB8488246BD85EF6AE1363C0DA6E ] FsDepends       C:\windows\system32\drivers\FsDepends.sys
21:44:39.0208 0x0c60  FsDepends - ok
21:44:39.0228 0x0c60  [ 6BD9295CC032DD3077C671FCCF579A7B, 83622FBB0CB923798E7E584BF53CAAF75B8C016E3FF7F0FA35880FF34D1DFE33 ] Fs_Rec          C:\windows\system32\drivers\Fs_Rec.sys
21:44:39.0238 0x0c60  Fs_Rec - ok
21:44:39.0278 0x0c60  [ 8F6322049018354F45F05A2FD2D4E5E0, 73BF0FB4EBD7887E992DDEBB79E906958D6678F8D1107E8C368F5A0514D80359 ] fvevol          C:\windows\system32\DRIVERS\fvevol.sys
21:44:39.0288 0x0c60  fvevol - ok
21:44:39.0318 0x0c60  [ 8C778D335C9D272CFD3298AB02ABE3B6, 85F0B13926B0F693FA9E70AA58DE47100E4B6F893772EBE4300C37D9A36E6005 ] gagp30kx        C:\windows\system32\drivers\gagp30kx.sys
21:44:39.0358 0x0c60  gagp30kx - ok
21:44:39.0418 0x0c60  [ 8E98D21EE06192492A5671A6144D092F, B8F656B34D361EA5AFB47F3A67AB2221580DADA59C8CD0CB83181E4AD8B562B4 ] GEARAspiWDM     C:\windows\system32\DRIVERS\GEARAspiWDM.sys
21:44:39.0448 0x0c60  GEARAspiWDM - ok
21:44:39.0488 0x0c60  [ E4AE497857409127ED57562AF913A903, 262ADD713B1FBF6200550967D1F8635B55D01BBD8FA2E753536E71A4EC87867B ] gpsvc           C:\windows\System32\gpsvc.dll
21:44:39.0538 0x0c60  gpsvc - ok
21:44:39.0608 0x0c60  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdate         C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:44:39.0638 0x0c60  gupdate - ok
21:44:39.0638 0x0c60  [ DD7423ABBE2913E70D50E9318AD57EE4, 74BC123808F3FA60ADDC51C1383F8250608D3DBA3A8DC175B3418A1CF0BC53E9 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
21:44:39.0658 0x0c60  gupdatem - ok
21:44:39.0678 0x0c60  [ F2523EF6460FC42405B12248338AB2F0, B2F3DE8DE1F512D871BC2BC2E8D0E33AB03335BFBC07627C5F88B65024928E19 ] hcw85cir        C:\windows\system32\drivers\hcw85cir.sys
21:44:39.0688 0x0c60  hcw85cir - ok
21:44:39.0708 0x0c60  [ 975761C778E33CD22498059B91E7373A, 8304E15FBE6876BE57263A03621365DA8C88005EAC532A770303C06799D915D9 ] HdAudAddService C:\windows\system32\drivers\HdAudio.sys
21:44:39.0728 0x0c60  HdAudAddService - ok
21:44:39.0748 0x0c60  [ 97BFED39B6B79EB12CDDBFEED51F56BB, 3CF981D668FB2381E52AF2E51E296C6CFB47B0D62249645278479D0111A47955 ] HDAudBus        C:\windows\system32\DRIVERS\HDAudBus.sys
21:44:39.0768 0x0c60  HDAudBus - ok
21:44:39.0788 0x0c60  [ 78E86380454A7B10A5EB255DC44A355F, 11F3ED7ACFFA3024B9BD504F81AC39F5B4CED5A8A425E8BADF7132EFEDB9BD64 ] HidBatt         C:\windows\system32\drivers\HidBatt.sys
21:44:39.0798 0x0c60  HidBatt - ok
21:44:39.0828 0x0c60  [ 7FD2A313F7AFE5C4DAB14798C48DD104, 94CBFD4506CBDE4162CEB3367BAB042D19ACA6785954DC0B554D4164B9FCD0D4 ] HidBth          C:\windows\system32\drivers\hidbth.sys
21:44:39.0868 0x0c60  HidBth - ok
21:44:39.0878 0x0c60  [ 0A77D29F311B88CFAE3B13F9C1A73825, 8615DC6CEFB591505CE16E054A71A4F371B827DDFD5E980777AB4233DCFDA01D ] HidIr           C:\windows\system32\drivers\hidir.sys
21:44:39.0898 0x0c60  HidIr - ok
21:44:39.0908 0x0c60  [ BD9EB3958F213F96B97B1D897DEE006D, 4D01CBF898B528B3A4E5A683DF2177300AFABD7D4CB51F1A7891B1B545499631 ] hidserv         C:\windows\system32\hidserv.dll
21:44:39.0938 0x0c60  hidserv - ok
21:44:39.0948 0x0c60  [ 9592090A7E2B61CD582B612B6DF70536, FD11D5E02C32D658B28FCC35688AB66CCB5D3A0A0D74C82AE0F0B6C67B568A0F ] HidUsb          C:\windows\system32\DRIVERS\hidusb.sys
21:44:39.0988 0x0c60  HidUsb - ok
21:44:40.0008 0x0c60  [ 387E72E739E15E3D37907A86D9FF98E2, 9935BE2E58788E79328293AF2F202CB0F6042441B176F75ACC5AEA93C8E05531 ] hkmsvc          C:\windows\system32\kmsvc.dll
21:44:40.0058 0x0c60  hkmsvc - ok
21:44:40.0078 0x0c60  [ EFDFB3DD38A4376F93E7985173813ABD, 70402FA73A5A2A8BB557AAC8F531E373077D28DE5F40A1F3F14B940BE01CD2E1 ] HomeGroupListener C:\windows\system32\ListSvc.dll
21:44:40.0118 0x0c60  HomeGroupListener - ok
21:44:40.0128 0x0c60  [ 908ACB1F594274965A53926B10C81E89, 7D34A742AC486294D82676F8465A3EF26C8AC3317C32B63F62031CB007CFC208 ] HomeGroupProvider C:\windows\system32\provsvc.dll
21:44:40.0148 0x0c60  HomeGroupProvider - ok
21:44:40.0188 0x0c60  HP Support Assistant Service - ok
21:44:40.0208 0x0c60  hpqwmiex - ok
21:44:40.0228 0x0c60  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC, E9E6A1665740CFBC2DD321010007EF42ABA2102AEB9772EE8AA3354664B1E205 ] HpSAMD          C:\windows\system32\drivers\HpSAMD.sys
21:44:40.0258 0x0c60  HpSAMD - ok
21:44:40.0308 0x0c60  [ F61634BEC53F73702A10DE69F6DCAF57, BBA7344CF3AB96A46D1A6F1D50F2758EA8D097FE558C38B4EF45C8C334AF96E1 ] HTTP            C:\windows\system32\drivers\HTTP.sys
21:44:40.0348 0x0c60  HTTP - ok
21:44:40.0358 0x0c60  [ A5462BD6884960C9DC85ED49D34FF392, 53E65841AF5B06A2844D0BB6FC4DD3923A323FFA0E4BFC89B3B5CAFB592A3D53 ] hwpolicy        C:\windows\system32\drivers\hwpolicy.sys
21:44:40.0378 0x0c60  hwpolicy - ok
21:44:40.0398 0x0c60  [ FA55C73D4AFFA7EE23AC4BE53B4592D3, 65CDDC62B89A60E942C5642C9D8B539EFB69DA8069B4A2E54978154B314531CD ] i8042prt        C:\windows\system32\drivers\i8042prt.sys
21:44:40.0438 0x0c60  i8042prt - ok
21:44:40.0458 0x0c60  [ AAAF44DB3BD0B9D1FB6969B23ECC8366, 805AA4A9464002D1AB3832E4106B2AAA1331F4281367E75956062AAE99699385 ] iaStorV         C:\windows\system32\drivers\iaStorV.sys
21:44:40.0478 0x0c60  iaStorV - ok
21:44:40.0578 0x0c60  [ BD14C02A9F388CB29620FF68AB6979AD, 1610C888002E1118DFEF86E27462FDBB1F625BD298FC4FCD033FBC76D54EC35E ] IDSVia64        C:\Program Files (x86)\Norton Internet Security\NortonData\22.7.0.76\Definitions\IPSDefs\20160627.005\IDSvia64.sys
21:44:40.0628 0x0c60  IDSVia64 - ok
21:44:40.0658 0x0c60  IEEtwCollectorService - ok
21:44:40.0798 0x0c60  [ A87261EF1546325B559374F5689CF5BC, 8DE48A8A13A32AAAC54CDDF58F3F61BE3E2802C1D9CA1CA98E57EB0D65FB6002 ] igfx            C:\windows\system32\DRIVERS\igdkmd64.sys
21:44:40.0938 0x0c60  igfx - ok
21:44:40.0968 0x0c60  [ 5C18831C61933628F5BB0EA2675B9D21, 5CD9DE2F8C0256623A417B5C55BF55BB2562BD7AB2C3C83BB3D9886C2FBDA4E4 ] iirsp           C:\windows\system32\drivers\iirsp.sys
21:44:40.0978 0x0c60  iirsp - ok
21:44:41.0018 0x0c60  [ 344789398EC3EE5A4E00C52B31847946, 3DA5F08E4B46F4E63456AA588D49E39A6A09A97D0509880C00F327623DB6122D ] IKEEXT          C:\windows\System32\ikeext.dll
21:44:41.0048 0x0c60  IKEEXT - ok
21:44:41.0058 0x0c60  [ F00F20E70C6EC3AA366910083A0518AA, E2F3E9FFD82C802C8BAC309893A3664ACF16A279959C0FDECCA64C3D3C60FD22 ] intelide        C:\windows\system32\drivers\intelide.sys
21:44:41.0078 0x0c60  intelide - ok
21:44:41.0088 0x0c60  [ ADA036632C664CAA754079041CF1F8C1, F2386CC09AC6DE4C54189154F7D91C1DB7AA120B13FAE8BA5B579ACF99FCC610 ] intelppm        C:\windows\system32\DRIVERS\intelppm.sys
21:44:41.0108 0x0c60  intelppm - ok
21:44:41.0148 0x0c60  [ 098A91C54546A3B878DAD6A7E90A455B, 044CCE2A0DF56EBE1EFD99B4F6F0A5B9EE12498CA358CF4B2E3A1CFD872823AA ] IPBusEnum       C:\windows\system32\ipbusenum.dll
21:44:41.0178 0x0c60  IPBusEnum - ok
21:44:41.0178 0x0c60  [ C9F0E1BD74365A8771590E9008D22AB6, 728BC5A6AAE499FDC50EB01577AF16D83C2A9F3B09936DD2A89C01E074BA8E51 ] IpFilterDriver  C:\windows\system32\DRIVERS\ipfltdrv.sys
21:44:41.0208 0x0c60  IpFilterDriver - ok
21:44:41.0248 0x0c60  [ 08C2957BB30058E663720C5606885653, E13EDF6701512E2A9977A531454932CA5023087CB50E1D2F416B8BCDD92B67BE ] iphlpsvc        C:\windows\System32\iphlpsvc.dll
21:44:41.0268 0x0c60  iphlpsvc - ok
21:44:41.0288 0x0c60  [ 0FC1AEA580957AA8817B8F305D18CA3A, 7161E4DE91AAFC3FA8BF24FAE4636390C2627DB931505247C0D52C75A31473D9 ] IPMIDRV         C:\windows\system32\drivers\IPMIDrv.sys
21:44:41.0298 0x0c60  IPMIDRV - ok
21:44:41.0308 0x0c60  [ AF9B39A7E7B6CAA203B3862582E9F2D0, 67128BE7EADBE6BD0205B050F96E268948E8660C4BAB259FB0BE03935153D04E ] IPNAT           C:\windows\system32\drivers\ipnat.sys
21:44:41.0338 0x0c60  IPNAT - ok
21:44:41.0378 0x0c60  [ 043A93A498B3C4A88CACA3BCBC9B54C7, C08C5A03940806C6CB75ADDCBE6183145AD2AFE84D77BC85E620E7C1542F0893 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
21:44:41.0408 0x0c60  iPod Service - ok
21:44:41.0418 0x0c60  [ 3ABF5E7213EB28966D55D58B515D5CE9, A352BCC5B6B9A28805B15CAFB235676F1FAFF0D2394F88C03089EB157D6188AE ] IRENUM          C:\windows\system32\drivers\irenum.sys
21:44:41.0438 0x0c60  IRENUM - ok
21:44:41.0468 0x0c60  [ 2F7B28DC3E1183E5EB418DF55C204F38, D40410A760965925D6F10959B2043F7BD4F68EAFCF5E743AF11AD860BD136548 ] isapnp          C:\windows\system32\drivers\isapnp.sys
21:44:41.0478 0x0c60  isapnp - ok
21:44:41.0518 0x0c60  [ 96BB922A0981BC7432C8CF52B5410FE6, 236C05509B1040059B15021CBBDBDAF3B9C0F00910142BE5887B2C7561BAAFBA ] iScsiPrt        C:\windows\system32\drivers\msiscsi.sys
21:44:41.0548 0x0c60  iScsiPrt - ok
21:44:41.0558 0x0c60  [ BC02336F1CBA7DCC7D1213BB588A68A5, 450C5BAD54CCE2AFCDFF1B6E7F8E1A8446D9D3255DF9D36C29A8F848048AAD93 ] kbdclass        C:\windows\system32\DRIVERS\kbdclass.sys
21:44:41.0578 0x0c60  kbdclass - ok
21:44:41.0588 0x0c60  [ 0705EFF5B42A9DB58548EEC3B26BB484, 86C6824ED7ED6FA8F306DB6319A0FD688AA91295AE571262F9D8E96A32225E99 ] kbdhid          C:\windows\system32\DRIVERS\kbdhid.sys
21:44:41.0608 0x0c60  kbdhid - ok
21:44:41.0628 0x0c60  [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] KeyIso          C:\windows\system32\lsass.exe
21:44:41.0638 0x0c60  KeyIso - ok
21:44:41.0668 0x0c60  [ 3974E5264A0481600370C5BEED061DDF, 6365DC2B3ECAF462F98481103F47B7550688D1A3AE96C88FDBCB3ED3BBB76EB6 ] KSecDD          C:\windows\system32\Drivers\ksecdd.sys
21:44:41.0688 0x0c60  KSecDD - ok
21:44:41.0698 0x0c60  [ 6E85615A86FE86E76DAE49BF9F227483, 825F9906910C33A36D04D805402A8C0C8E09232407E077B85282E3208A9BFC25 ] KSecPkg         C:\windows\system32\Drivers\ksecpkg.sys
21:44:41.0718 0x0c60  KSecPkg - ok
21:44:41.0728 0x0c60  [ 6869281E78CB31A43E969F06B57347C4, 866A23E69B32A78D378D6CB3B3DA3695FFDFF0FEC3C9F68C8C3F988DF417044B ] ksthunk         C:\windows\system32\drivers\ksthunk.sys
21:44:41.0758 0x0c60  ksthunk - ok
21:44:41.0778 0x0c60  [ 6AB66E16AA859232F64DEB66887A8C9C, 5F2B579BEA8098A2994B0DECECDAE7B396E7B5DC5F09645737B9F28BEEA77FFF ] KtmRm           C:\windows\system32\msdtckrm.dll
21:44:41.0818 0x0c60  KtmRm - ok
21:44:41.0848 0x0c60  [ D9F42719019740BAA6D1C6D536CBDAA6, 8757599D0AE5302C4CE50861BEBA3A8DD14D7B0DBD916FD5404133688CDFCC40 ] LanmanServer    C:\windows\system32\srvsvc.dll
21:44:41.0898 0x0c60  LanmanServer - ok
21:44:41.0898 0x0c60  [ 851A1382EED3E3A7476DB004F4EE3E1A, B1C67F47DD594D092E6E258F01DF5E7150227CE3131A908A244DEE9F8A1FABF9 ] LanmanWorkstation C:\windows\System32\wkssvc.dll
21:44:41.0928 0x0c60  LanmanWorkstation - ok
21:44:41.0958 0x0c60  [ 285954C6C6EF43B78AB84034750FAC6A, 1ED9090015B2A896EF44C072E9662DCF78F044FF05A6B0174F2933AF11B252D1 ] libusb0         C:\windows\system32\DRIVERS\libusb0.sys
21:44:41.0968 0x0c60  libusb0 - ok
21:44:41.0988 0x0c60  [ 1538831CF8AD2979A04C423779465827, E1729B0CC4CEEE494A0B8817A8E98FF232E3A32FB023566EF0BC71A090262C0C ] lltdio          C:\windows\system32\DRIVERS\lltdio.sys
21:44:42.0018 0x0c60  lltdio - ok
21:44:42.0038 0x0c60  [ C1185803384AB3FEED115F79F109427F, 0414FE73532DCAB17E906438A14711E928CECCD5F579255410C62984DD652700 ] lltdsvc         C:\windows\System32\lltdsvc.dll
21:44:42.0068 0x0c60  lltdsvc - ok
21:44:42.0088 0x0c60  [ F993A32249B66C9D622EA5592A8B76B8, EE64672A990C6145DC5601E2B8CDBE089272A72732F59AF9865DCBA8B1717E70 ] lmhosts         C:\windows\System32\lmhsvc.dll
21:44:42.0118 0x0c60  lmhosts - ok
21:44:42.0148 0x0c60  [ BF22ACF4CF3734D61357E67F0521BC03, EDDFBDC4BE29BF26904B2DF7074F471711238469CDDBED1CA253A49B993F53DF ] LMS             C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
21:44:42.0168 0x0c60  LMS - ok
21:44:42.0198 0x0c60  [ 1A93E54EB0ECE102495A51266DCDB6A6, DB6AA86AA36C3A7988BE96E87B5D3251BE7617C54EE8F894D9DC2E267FE3255B ] LSI_FC          C:\windows\system32\drivers\lsi_fc.sys
21:44:42.0208 0x0c60  LSI_FC - ok
21:44:42.0248 0x0c60  [ 1047184A9FDC8BDBFF857175875EE810, F2251EDB7736A26D388A0C5CC2FE5FB9C5E109CBB1E3800993554CB21D81AE4B ] LSI_SAS         C:\windows\system32\drivers\lsi_sas.sys
21:44:42.0258 0x0c60  LSI_SAS - ok
21:44:42.0268 0x0c60  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93, 88D5740A4E9CC3FA80FA18035DAB441BDC5A039622D666BFDAA525CC9686BD06 ] LSI_SAS2        C:\windows\system32\drivers\lsi_sas2.sys
21:44:42.0288 0x0c60  LSI_SAS2 - ok
21:44:42.0298 0x0c60  [ 0504EACAFF0D3C8AED161C4B0D369D4A, 4D272237C189646F5C80822FD3CBA7C2728E482E2DAAF7A09C8AEF811C89C54D ] LSI_SCSI        C:\windows\system32\drivers\lsi_scsi.sys
21:44:42.0318 0x0c60  LSI_SCSI - ok
21:44:42.0318 0x0c60  [ 43D0F98E1D56CCDDB0D5254CFF7B356E, 5BA498183B5C4996C694CB0A9A6B66CE6C7A460F6C91BEB9F305486FCC3B7B22 ] luafv           C:\windows\system32\drivers\luafv.sys
21:44:42.0348 0x0c60  luafv - ok
21:44:42.0368 0x0c60  [ 0BE09CD858ABF9DF6ED259D57A1A1663, 2FD28889B93C8E801F74C1D0769673A461671E0189D0A22C94509E3F0EEB7428 ] Mcx2Svc         C:\windows\system32\Mcx2Svc.dll
21:44:42.0378 0x0c60  Mcx2Svc - ok
21:44:42.0388 0x0c60  [ A55805F747C6EDB6A9080D7C633BD0F4, 2DA0E83BF3C8ADEF6F551B6CC1C0A3F6149CDBE6EC60413BA1767C4DE425A728 ] megasas         C:\windows\system32\drivers\megasas.sys
21:44:42.0408 0x0c60  megasas - ok
21:44:42.0418 0x0c60  [ BAF74CE0072480C3B6B7C13B2A94D6B3, 85CBB4949C090A904464F79713A3418338753D20D7FB811E68F287FDAC1DD834 ] MegaSR          C:\windows\system32\drivers\MegaSR.sys
21:44:42.0438 0x0c60  MegaSR - ok
21:44:42.0458 0x0c60  [ 6B01B7414A105B9E51652089A03027CF, 9B113DC22F7D0D0B376E577C6D7083F9EDC09BBFE47726393E16D4FDAAAE21FE ] MEIx64          C:\windows\system32\drivers\HECIx64.sys
21:44:42.0468 0x0c60  MEIx64 - ok
21:44:42.0488 0x0c60  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] MMCSS           C:\windows\system32\mmcss.dll
21:44:42.0518 0x0c60  MMCSS - ok
21:44:42.0528 0x0c60  [ 800BA92F7010378B09F9ED9270F07137, 94F9AF9E1BE80AE6AC39A2A74EF9FAB115DCAACC011D07DFA8D6A1DDC8A93342 ] Modem           C:\windows\system32\drivers\modem.sys
21:44:42.0558 0x0c60  Modem - ok
21:44:42.0578 0x0c60  [ B03D591DC7DA45ECE20B3B467E6AADAA, 701FB0CAD8138C58507BE28845D3E24CE269A040737C29885944A0D851238732 ] monitor         C:\windows\system32\DRIVERS\monitor.sys
21:44:42.0588 0x0c60  monitor - ok
21:44:42.0628 0x0c60  [ 7D27EA49F3C1F687D357E77A470AEA99, 7FE7CAF95959F127C6D932C01D539C06D80273C49A09761F6E8331C05B1A7EE7 ] mouclass        C:\windows\system32\DRIVERS\mouclass.sys
21:44:42.0658 0x0c60  mouclass - ok
21:44:42.0678 0x0c60  [ D3BF052C40B0C4166D9FD86A4288C1E6, 5E65264354CD94E844BF1838CA1B8E49080EFA34605A32CF2F6A47A2B97FC183 ] mouhid          C:\windows\system32\DRIVERS\mouhid.sys
21:44:42.0688 0x0c60  mouhid - ok
21:44:42.0728 0x0c60  [ 67050452C0118BAF2883928E6FCCFE47, 335FC0AEB7B47DCC7CE0CF3F424EB60ACB1327D2FF6515F04D9AC03A10FF1E31 ] mountmgr        C:\windows\system32\drivers\mountmgr.sys
21:44:42.0738 0x0c60  mountmgr - ok
21:44:42.0768 0x0c60  [ DD370A8148862150BA81A3F5C56A1E40, F56B84297BDC32266CB69D10FB2D66B8B332D60CAB7E64E4E3AC2BB749BBD31B ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
21:44:42.0808 0x0c60  MozillaMaintenance - ok
21:44:42.0848 0x0c60  [ DA0FAEE45D6F03D7647851A20977A7D0, AFB1EA053CD4BCA903868896D020205D4C207C85314E6C56C4663922A3F9BD6A ] MpFilter        C:\windows\system32\DRIVERS\MpFilter.sys
21:44:42.0898 0x0c60  MpFilter - ok
21:44:42.0908 0x0c60  [ A44B420D30BD56E145D6A2BC8768EC58, B1E4DCA5A1008FA7A0492DC091FB2B820406AE13FD3D44F124E89B1037AF09B8 ] mpio            C:\windows\system32\drivers\mpio.sys
21:44:42.0928 0x0c60  mpio - ok
21:44:42.0958 0x0c60  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F, 5A3FA2F110029CB4CC4384998EDB59203FDD65EC45E01B897FB684F8956EAD20 ] mpsdrv          C:\windows\system32\drivers\mpsdrv.sys
21:44:42.0988 0x0c60  mpsdrv - ok
21:44:43.0018 0x0c60  [ 54FFC9C8898113ACE189D4AA7199D2C1, 65F585C87F3F710FD5793FDFA96B740AD8D4317B0C120F4435CCF777300EA4F2 ] MpsSvc          C:\windows\system32\mpssvc.dll
21:44:43.0058 0x0c60  MpsSvc - ok
21:44:43.0088 0x0c60  [ D7ADC2B83CA0B0381F75A98351F72CEE, 05476B7CA0486DF770AE492B5A90C85E3D3E7485152EB2FA30A19EC9BE44ED81 ] MRxDAV          C:\windows\system32\drivers\mrxdav.sys
21:44:43.0118 0x0c60  MRxDAV - ok
21:44:43.0138 0x0c60  [ 10112D850C844606419C79EE24EE6016, 1668F47ED9C31D805542646A0AD6E572C3547FF822F5BCDF1BB3F521714F8B85 ] mrxsmb          C:\windows\system32\DRIVERS\mrxsmb.sys
21:44:43.0158 0x0c60  mrxsmb - ok
21:44:43.0188 0x0c60  [ DCC4343B422A13B42C7678998449CE8A, 9C143543DC9B21A15C5E86640464A3A78C5E820857D0A6BE05D4FBC20D0BF866 ] mrxsmb10        C:\windows\system32\DRIVERS\mrxsmb10.sys
21:44:43.0238 0x0c60  mrxsmb10 - ok
21:44:43.0288 0x0c60  [ 46C4F5BEE8D98BB1688752EAD0ABB7C0, C744F39E462798DC98D1C4603758AC43DB4A7961F3BAF9E5ABA22AD905E012F8 ] mrxsmb20        C:\windows\system32\DRIVERS\mrxsmb20.sys
21:44:43.0318 0x0c60  mrxsmb20 - ok
21:44:43.0338 0x0c60  [ C25F0BAFA182CBCA2DD3C851C2E75796, 643E158A0948DF331807AEAA391F23960362E46C0A0CF6D22A99020EAE7B10F8 ] msahci          C:\windows\system32\drivers\msahci.sys
21:44:43.0358 0x0c60  msahci - ok
21:44:43.0368 0x0c60  [ DB801A638D011B9633829EB6F663C900, B34FD33A215ACCF2905F4B7D061686CDB1CB9C652147AF56AE14686C1F6E3C74 ] msdsm           C:\windows\system32\drivers\msdsm.sys
21:44:43.0388 0x0c60  msdsm - ok
21:44:43.0388 0x0c60  [ DE0ECE52236CFA3ED2DBFC03F28253A8, 2FBBEC4CACB5161F68D7C2935852A5888945CA0F107CF8A1C01F4528CE407DE3 ] MSDTC           C:\windows\System32\msdtc.exe
21:44:43.0408 0x0c60  MSDTC - ok
21:44:43.0418 0x0c60  [ AA3FB40E17CE1388FA1BEDAB50EA8F96, 69F93E15536644C8FD679A20190CFE577F4985D3B1B4A4AA250A168615AE1E99 ] Msfs            C:\windows\system32\drivers\Msfs.sys
21:44:43.0458 0x0c60  Msfs - ok
21:44:43.0488 0x0c60  [ F9D215A46A8B9753F61767FA72A20326, 6F76642B45E0A7EF6BCAB8B37D55CCE2EAA310ED07B76D43FCB88987C2174141 ] mshidkmdf       C:\windows\System32\drivers\mshidkmdf.sys
21:44:43.0538 0x0c60  mshidkmdf - ok
21:44:43.0548 0x0c60  [ D916874BBD4F8B07BFB7FA9B3CCAE29D, B229DA150713DEDBC4F05386C9D9DC3BC095A74F44F3081E88311AB73BC992A1 ] msisadrv        C:\windows\system32\drivers\msisadrv.sys
21:44:43.0568 0x0c60  msisadrv - ok
21:44:43.0588 0x0c60  [ 808E98FF49B155C522E6400953177B08, F873F5BFF0984C5165DF67E92874D3F6EB8D86F9B5AD17013A0091CA33A1A3D5 ] MSiSCSI         C:\windows\system32\iscsiexe.dll
21:44:43.0618 0x0c60  MSiSCSI - ok
21:44:43.0618 0x0c60  msiserver - ok
21:44:43.0628 0x0c60  [ 49CCF2C4FEA34FFAD8B1B59D49439366, E5752EA57C7BDAD5F53E3BC441A415E909AC602CAE56234684FB8789A20396C7 ] MSKSSRV         C:\windows\system32\drivers\MSKSSRV.sys
21:44:43.0658 0x0c60  MSKSSRV - ok
21:44:43.0698 0x0c60  [ C66FE30BBA4604A06EE9E4180ABE4BD9, 43E60C15C05FF19082142BB9D1F29D1B3269AD4A7FB32AF109AE63FE5A6AA0A9 ] MsMpSvc         c:\Program Files\Microsoft Security Client\MsMpEng.exe
21:44:43.0718 0x0c60  MsMpSvc - ok
21:44:43.0728 0x0c60  [ BDD71ACE35A232104DDD349EE70E1AB3, 27464A66868513BE6A01B75D7FC5B0D6B71842E4E20CE3F76B15C071A0618BBB ] MSPCLOCK        C:\windows\system32\drivers\MSPCLOCK.sys
21:44:43.0748 0x0c60  MSPCLOCK - ok
21:44:43.0748 0x0c60  [ 4ED981241DB27C3383D72092B618A1D0, E12F121E641249DB3491141851B59E1496F4413EDF58E863388F1C229838DFCC ] MSPQM           C:\windows\system32\drivers\MSPQM.sys
21:44:43.0778 0x0c60  MSPQM - ok
21:44:43.0798 0x0c60  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D, 64E3BC613EC4872B1B344CBF71EE15BE195592E3244C1EE099C6F8B95A40F133 ] MsRPC           C:\windows\system32\drivers\MsRPC.sys
21:44:43.0818 0x0c60  MsRPC - ok
21:44:43.0838 0x0c60  [ 0EED230E37515A0EAEE3C2E1BC97B288, B1D8F8A75006B6E99214CA36D27A8594EF8D952F315BEB201E9BAC9DE3E64D42 ] mssmbios        C:\windows\system32\drivers\mssmbios.sys
21:44:43.0848 0x0c60  mssmbios - ok
21:44:43.0868 0x0c60  [ 2E66F9ECB30B4221A318C92AC2250779, DF175E1AB6962303E57F26DAE5C5C1E40B8640333F3E352A64F6A5F1301586CD ] MSTEE           C:\windows\system32\drivers\MSTEE.sys
21:44:43.0888 0x0c60  MSTEE - ok
21:44:43.0898 0x0c60  [ 7EA404308934E675BFFDE8EDF0757BCD, 306CD02D89CFCFE576242360ED5F9EEEDCAFC43CD43B7D2977AE960F9AEC3232 ] MTConfig        C:\windows\system32\drivers\MTConfig.sys
21:44:43.0918 0x0c60  MTConfig - ok
21:44:43.0928 0x0c60  [ F9A18612FD3526FE473C1BDA678D61C8, 32F7975B5BAA447917F832D9E3499B4B6D3E90D73F478375D0B70B36C524693A ] Mup             C:\windows\system32\Drivers\mup.sys
21:44:43.0948 0x0c60  Mup - ok
21:44:43.0968 0x0c60  [ 582AC6D9873E31DFA28A4547270862DD, BD540499F74E8F59A020D935D18E36A3A97C1A6EC59C8208436469A31B16B260 ] napagent        C:\windows\system32\qagentRT.dll
21:44:44.0008 0x0c60  napagent - ok
21:44:44.0028 0x0c60  [ 1EA3749C4114DB3E3161156FFFFA6B33, 54C2E77BCE1037711A11313AC25B8706109098C10A31AA03AEB7A185E97800D7 ] NativeWifiP     C:\windows\system32\DRIVERS\nwifi.sys
21:44:44.0048 0x0c60  NativeWifiP - ok
21:44:44.0118 0x0c60  NAVENG - ok
21:44:44.0118 0x0c60  NAVEX15 - ok
21:44:44.0188 0x0c60  [ F7309F42555F8AAB7144A51A1F2585B0, 065277A8AFAEE3888C997A76D2F751070F92DF4C3354D16B194860B4BDAFF937 ] NDIS            C:\windows\system32\drivers\ndis.sys
21:44:44.0228 0x0c60  NDIS - ok
21:44:44.0238 0x0c60  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC, D7E5446E83909AE25506BB98FBDD878A529C87963E3C1125C4ABAB25823572BC ] NdisCap         C:\windows\system32\DRIVERS\ndiscap.sys
21:44:44.0268 0x0c60  NdisCap - ok
21:44:44.0288 0x0c60  [ 30639C932D9FEF22B31268FE25A1B6E5, 32873D95339600F6EEFA51847D12C563FF01F320DC59055B242FA2887C99F9D6 ] NdisTapi        C:\windows\system32\DRIVERS\ndistapi.sys
21:44:44.0318 0x0c60  NdisTapi - ok
21:44:44.0328 0x0c60  [ 136185F9FB2CC61E573E676AA5402356, BA3AD0A33416DA913B4242C6BE8C3E5812AD2B20BA6C11DD3094F2E8EB56E683 ] Ndisuio         C:\windows\system32\DRIVERS\ndisuio.sys
21:44:44.0358 0x0c60  Ndisuio - ok
21:44:44.0368 0x0c60  [ 53F7305169863F0A2BDDC49E116C2E11, 881E9346D3C02405B7850ADC37E720990712EC9C666A0CE96E252A487FD2CE77 ] NdisWan         C:\windows\system32\DRIVERS\ndiswan.sys
21:44:44.0398 0x0c60  NdisWan - ok
21:44:44.0408 0x0c60  [ 015C0D8E0E0421B4CFD48CFFE2825879, 4242E2D42CCFC859B2C0275C5331798BC0BDA68E51CF4650B6E64B1332071023 ] NDProxy         C:\windows\system32\drivers\NDProxy.sys
21:44:44.0448 0x0c60  NDProxy - ok
21:44:44.0488 0x0c60  [ EE00C544C025958AF50C7B199F3C8595, D774DB020D9C46D1AA0B2DB9FA2C36C4A9C38D904CC6929695321D32ACA0D4D1 ] Netaapl         C:\windows\system32\DRIVERS\netaapl64.sys
21:44:44.0538 0x0c60  Netaapl - ok
21:44:44.0548 0x0c60  [ 86743D9F5D2B1048062B14B1D84501C4, DBF6D6A60AB774FCB0F464FF2D285A7521D0A24006687B243AB46B17D8032062 ] NetBIOS         C:\windows\system32\DRIVERS\netbios.sys
21:44:44.0598 0x0c60  NetBIOS - ok
21:44:44.0618 0x0c60  [ E47D571FEC2C76E867935109AB2A770C, F349D25890B6F476B106FD75BFB081DB737CA9B224D95E44927942FFF2DF82CD ] NetBT           C:\windows\system32\DRIVERS\netbt.sys
21:44:44.0638 0x0c60  NetBT - ok
21:44:44.0668 0x0c60  [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] Netlogon        C:\windows\system32\lsass.exe
21:44:44.0678 0x0c60  Netlogon - ok
21:44:44.0698 0x0c60  [ 847D3AE376C0817161A14A82C8922A9E, 37AE692B3481323134125EF58F2C3CBC20177371AF2F5874F53DD32A827CB936 ] Netman          C:\windows\System32\netman.dll
21:44:44.0728 0x0c60  Netman - ok
21:44:44.0768 0x0c60  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetMsmqActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:44:44.0788 0x0c60  NetMsmqActivator - ok
21:44:44.0788 0x0c60  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetPipeActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:44:44.0808 0x0c60  NetPipeActivator - ok
21:44:44.0838 0x0c60  [ 5F28111C648F1E24F7DBC87CDEB091B8, 2E8645285921EDB98BB2173E11E57459C888D52E80D85791D169C869DE8813B9 ] netprofm        C:\windows\System32\netprofm.dll
21:44:44.0868 0x0c60  netprofm - ok
21:44:44.0938 0x0c60  [ 9C745041E72576251BC93709633E89FF, 00CCA321546522E699884CC1C7B9466A7B73787CF9AE155C9032169D7B590701 ] netr28x         C:\windows\system32\DRIVERS\netr28x.sys
21:44:44.0988 0x0c60  netr28x - ok
21:44:44.0988 0x0c60  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpActivator C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:44:45.0008 0x0c60  NetTcpActivator - ok
21:44:45.0038 0x0c60  [ E58808846B62041BFB05395E1CED6499, 5387F2CE6B494337725D2BF3EB563912E6EE33918F2872C5FE07BEDBB0F761EE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
21:44:45.0048 0x0c60  NetTcpPortSharing - ok
21:44:45.0078 0x0c60  [ 77889813BE4D166CDAB78DDBA990DA92, 2EF531AE502B943632EEC66A309A8BFCDD36120A5E1473F4AAF3C2393AD0E6A3 ] nfrd960         C:\windows\system32\drivers\nfrd960.sys
21:44:45.0088 0x0c60  nfrd960 - ok
21:44:45.0258 0x0c60  [ 35DE4A8F863C173FA7EDDF3860FC7A77, 4EB472605B0FDA401A56F86BE3B2B118AE4BF512823235C0D6589E88538F288A ] NIS             C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\NIS.exe
21:44:45.0298 0x0c60  NIS - ok
21:44:45.0338 0x0c60  [ 6D79C8CB73187FBEAAD1F680FADF98D3, 0075B2CCC4FFF929023F95686D7BBE32C0FCE05DEB2159C0784AF85D64E1B66E ] NisDrv          C:\windows\system32\DRIVERS\NisDrvWFP.sys
21:44:45.0358 0x0c60  NisDrv - ok
21:44:45.0388 0x0c60  [ B8F4F580638373FBF72F2B572446D294, A5CD9ABCA5CDC335D2C6FDCB81327B600150E45BB867B88859A00AF974B42F85 ] NisSrv          c:\Program Files\Microsoft Security Client\NisSrv.exe
21:44:45.0408 0x0c60  NisSrv - ok
21:44:45.0438 0x0c60  [ 8B301D474B478E9A92823BAB50A7BC49, 8181816035F41B1DABEC05E65E4F67BCD785F56760A61F1049E91BA39D42F01D ] NlaSvc          C:\windows\System32\nlasvc.dll
21:44:45.0468 0x0c60  NlaSvc - ok
21:44:45.0538 0x0c60  [ 5839A8027D6D324A7CD494051A96628C, 474F2D0BB463ABE68D7C4D2C630860AED4B722EC62C616C91EE00AA965378382 ] NOBU            C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuAgent.exe
21:44:45.0598 0x0c60  NOBU - ok
21:44:45.0618 0x0c60  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7, D8957EF7060A69DBB3CD6B2C45B1E4143592AB8D018471E17AC04668157DC67F ] Npfs            C:\windows\system32\drivers\Npfs.sys
21:44:45.0648 0x0c60  Npfs - ok
21:44:45.0668 0x0c60  [ D54BFDF3E0C953F823B3D0BFE4732528, 497A1DCC5646EC22119273216DF10D5442D16F83E4363770F507518CF6EAA53A ] nsi             C:\windows\system32\nsisvc.dll
21:44:45.0688 0x0c60  nsi - ok
21:44:45.0698 0x0c60  [ E7F5AE18AF4168178A642A9247C63001, 133023B7E4BA8049C4CAED3282BDD25571D1CC25FAC3B820C7F981D292689D76 ] nsiproxy        C:\windows\system32\drivers\nsiproxy.sys
21:44:45.0728 0x0c60  nsiproxy - ok
21:44:45.0778 0x0c60  [ 47B2D0B31BDC3EBE6090228E2BA3764D, 984A4B38300954164BCBF57EC1A09C18B53779E60A26E9618B50E26016735787 ] Ntfs            C:\windows\system32\drivers\Ntfs.sys
21:44:45.0818 0x0c60  Ntfs - ok
21:44:45.0828 0x0c60  [ 9899284589F75FA8724FF3D16AED75C1, 181188599FD5D4DE33B97010D9E0CAEABAB9A3EF50712FE7F9AA0735CD0666D6 ] Null            C:\windows\system32\drivers\Null.sys
21:44:45.0858 0x0c60  Null - ok
21:44:45.0868 0x0c60  [ 0A92CB65770442ED0DC44834632F66AD, 581327F07A68DBD5CC749214BE5F1211FC2CE41C7A4F0656B680AFB51A35ACE7 ] nvraid          C:\windows\system32\drivers\nvraid.sys
21:44:45.0888 0x0c60  nvraid - ok
21:44:45.0918 0x0c60  [ DAB0E87525C10052BF65F06152F37E4A, AD9BFF0D5FD3FFB95C758B478E1F6A9FE45E7B37AEC71EB5070D292FEAAEDF37 ] nvstor          C:\windows\system32\drivers\nvstor.sys
21:44:45.0928 0x0c60  nvstor - ok
21:44:45.0948 0x0c60  [ 270D7CD42D6E3979F6DD0146650F0E05, 752489E54C9004EDCBE1F1F208FFD864DA5C83E59A2DDE6B3E0D63ECA996F76F ] nv_agp          C:\windows\system32\drivers\nv_agp.sys
21:44:45.0968 0x0c60  nv_agp - ok
21:44:45.0988 0x0c60  [ 3589478E4B22CE21B41FA1BFC0B8B8A0, AD2469FC753FE552CB809FF405A9AB23E7561292FE89117E3B3B62057EFF0203 ] ohci1394        C:\windows\system32\drivers\ohci1394.sys
21:44:45.0998 0x0c60  ohci1394 - ok
21:44:46.0038 0x0c60  [ 9D10F99A6712E28F8ACD5641E3A7EA6B, 70964A0ED9011EA94044E15FA77EDD9CF535CC79ED8E03A3721FF007E69595CC ] ose             C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
21:44:46.0058 0x0c60  ose - ok
21:44:46.0198 0x0c60  [ 61BFFB5F57AD12F83AB64B7181829B34, 1DD0DD35E4158F95765EE6639F217DF03A0A19E624E020DBA609268C08A13846 ] osppsvc         C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
21:44:46.0308 0x0c60  osppsvc - ok
21:44:46.0338 0x0c60  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] p2pimsvc        C:\windows\system32\pnrpsvc.dll
21:44:46.0378 0x0c60  p2pimsvc - ok
21:44:46.0388 0x0c60  [ 927463ECB02179F88E4B9A17568C63C3, FEFD3447692C277D59EEC7BF218552C8BB6B8C98C26E973675549628408B94CE ] p2psvc          C:\windows\system32\p2psvc.dll
21:44:46.0418 0x0c60  p2psvc - ok
21:44:46.0428 0x0c60  [ 0086431C29C35BE1DBC43F52CC273887, 0D116D49EF9ABB57DA005764F25E692622210627FC2048F06A989B12FA8D0A80 ] Parport         C:\windows\system32\drivers\parport.sys
21:44:46.0448 0x0c60  Parport - ok
21:44:46.0468 0x0c60  [ E9766131EEADE40A27DC27D2D68FBA9C, 63C295EC96DBD25F1A8B908295CCB86B54F2A77A02AAA11E5D9160C2C1A492B6 ] partmgr         C:\windows\system32\drivers\partmgr.sys
21:44:46.0488 0x0c60  partmgr - ok
21:44:46.0518 0x0c60  [ DB2D62AA2DF6B1F3D690A9EC9701AA2C, BEAC55E1AA0494565F1547DF5E6FE20FCEA66461764C016FCB68D8BFF0F0C375 ] PcaSvc          C:\windows\System32\pcasvc.dll
21:44:46.0568 0x0c60  PcaSvc - ok
21:44:46.0578 0x0c60  [ 94575C0571D1462A0F70BDE6BD6EE6B3, 7139BAC653EA94A3DD3821CAB35FC5E22F4CCA5ACC2BAABDAA27E4C3C8B27FC9 ] pci             C:\windows\system32\drivers\pci.sys
21:44:46.0598 0x0c60  pci - ok
21:44:46.0618 0x0c60  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA, F2A7CC645B96946CC65BF60E14E70DC09C848D27C7943CE5DEA0C01A6B863480 ] pciide          C:\windows\system32\drivers\pciide.sys
21:44:46.0628 0x0c60  pciide - ok
21:44:46.0648 0x0c60  [ B2E81D4E87CE48589F98CB8C05B01F2F, 6763BEE7270A4873B3E131BFB92313E2750FCBD0AD73C23D1C4F98F7DF73DE14 ] pcmcia          C:\windows\system32\drivers\pcmcia.sys
21:44:46.0668 0x0c60  pcmcia - ok
21:44:46.0678 0x0c60  [ D6B9C2E1A11A3A4B26A182FFEF18F603, BBA5FE08B1DDD6243118E11358FD61B10E850F090F061711C3CB207CE5FBBD36 ] pcw             C:\windows\system32\drivers\pcw.sys
21:44:46.0688 0x0c60  pcw - ok
21:44:46.0708 0x0c60  [ ED6E75158D28D33A2E2A020AC5B2B59D, 0F364D9A88304C45F31318605C417A70A9D0E4CF087D73E949B42C12CC76CD6C ] PEAUTH          C:\windows\system32\drivers\peauth.sys
21:44:46.0738 0x0c60  PEAUTH - ok
21:44:46.0818 0x0c60  [ E495E408C93141E8FC72DC0C6046DDFA, 489B957DADA0DC128A09468F1AD082DCC657E86053208EA06A12937BE86FB919 ] PerfHost        C:\windows\SysWow64\perfhost.exe
21:44:46.0838 0x0c60  PerfHost - ok
21:44:46.0878 0x0c60  [ C7CF6A6E137463219E1259E3F0F0DD6C, 08D7244F52AA17DD669AA6F77C291DAC88E7B2D1887DE422509C1F83EC85F3DD ] pla             C:\windows\system32\pla.dll
21:44:46.0928 0x0c60  pla - ok
21:44:46.0988 0x0c60  [ 25FBDEF06C4D92815B353F6E792C8129, 57D9764AE6BCE33B242C399CDFC10DD405975BD6411CA8C75FBCD06EEB8442A9 ] PlugPlay        C:\windows\system32\umpnpmgr.dll
21:44:47.0028 0x0c60  PlugPlay - ok
21:44:47.0028 0x0c60  [ 7195581CEC9BB7D12ABE54036ACC2E38, 9C4E5D6EA984148F2663DC529083408B2248DFF6DAAC85D9195F80A722782315 ] PNRPAutoReg     C:\windows\system32\pnrpauto.dll
21:44:47.0048 0x0c60  PNRPAutoReg - ok
21:44:47.0068 0x0c60  [ 3EAC4455472CC2C97107B5291E0DCAFE, E51F373F2DBEAEE516B42BAE8C1B5BB68D00B881323E842CB6EDEC0A183CFFC3 ] PNRPsvc         C:\windows\system32\pnrpsvc.dll
21:44:47.0088 0x0c60  PNRPsvc - ok
21:44:47.0118 0x0c60  [ 80D6B0563ED2BF10656B1D4748331082, B7E6B5E1148B7EE537E8D5C3A65450876B61CD45A395267D08699746E98AD574 ] PolicyAgent     C:\windows\System32\ipsecsvc.dll
21:44:47.0148 0x0c60  PolicyAgent - ok
21:44:47.0168 0x0c60  [ 6BA9D927DDED70BD1A9CADED45F8B184, 66203CE70A5EDE053929A940F38924C6792239CCCE10DD2C1D90D5B4D6748B55 ] Power           C:\windows\system32\umpo.dll
21:44:47.0198 0x0c60  Power - ok
21:44:47.0218 0x0c60  [ F92A2C41117A11A00BE01CA01A7FCDE9, 38ADC6052696D110CA5F393BC586791920663F5DA66934C2A824DDA9CD89C763 ] PptpMiniport    C:\windows\system32\DRIVERS\raspptp.sys
21:44:47.0248 0x0c60  PptpMiniport - ok
21:44:47.0258 0x0c60  [ 0D922E23C041EFB1C3FAC2A6F943C9BF, 855418A6A58DCAFB181A1A68613B3E203AFB0A9B3D9D26D0C521F9F613B4EAD5 ] Processor       C:\windows\system32\drivers\processr.sys
21:44:47.0278 0x0c60  Processor - ok
21:44:47.0298 0x0c60  [ B6A58491307B4CADA572583D863DC602, 5C44936605E52C9533E4CE22F18FAB8211475877F71EFD88DA4D02FD608C90A3 ] ProfSvc         C:\windows\system32\profsvc.dll
21:44:47.0358 0x0c60  ProfSvc - ok
21:44:47.0368 0x0c60  [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] ProtectedStorage C:\windows\system32\lsass.exe
21:44:47.0378 0x0c60  ProtectedStorage - ok
21:44:47.0398 0x0c60  [ 0557CF5A2556BD58E26384169D72438D, F6F83A616B1F1C6C0DF6D2EC2513E6C23FD4FAA6D36518B8676C619AB74957B4 ] Psched          C:\windows\system32\DRIVERS\pacer.sys
21:44:47.0428 0x0c60  Psched - ok
21:44:47.0468 0x0c60  [ A53A15A11EBFD21077463EE2C7AFEEF0, 6002B012A75045DEA62640A864A8721EADE2F8B65BEB5F5BA76D8CD819774489 ] ql2300          C:\windows\system32\drivers\ql2300.sys
21:44:47.0518 0x0c60  ql2300 - ok
21:44:47.0528 0x0c60  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8, FB6ABAB741CED66A79E31A45111649F2FA3E26CEE77209B5296F789F6F7D08DE ] ql40xx          C:\windows\system32\drivers\ql40xx.sys
21:44:47.0538 0x0c60  ql40xx - ok
21:44:47.0558 0x0c60  [ 906191634E99AEA92C4816150BDA3732, A0305436384104C3B559F9C73902DA19B96B518413379E397C5CDAB0B2B9418F ] QWAVE           C:\windows\system32\qwave.dll
21:44:47.0578 0x0c60  QWAVE - ok
21:44:47.0588 0x0c60  [ 76707BB36430888D9CE9D705398ADB6C, 35C1D1D05F98AC29A33D3781F497A0B40A3CB9CDF25FE1F28F574E40DDF70535 ] QWAVEdrv        C:\windows\system32\drivers\qwavedrv.sys
21:44:47.0608 0x0c60  QWAVEdrv - ok
21:44:47.0638 0x0c60  [ F4C083E290BCBC8DA05C6E2C7F8053B9, 968103B2F49A05B1DE99FA38CEB7B2F5E90B60901B9AF802A908F819DA64822E ] RalinkRegistryWriter C:\Program Files (x86)\Ralink\Common\RaRegistry.exe
21:44:47.0658 0x0c60  RalinkRegistryWriter - detected UnsignedFile.Multi.Generic ( 1 )
21:44:50.0128 0x0c60  Detect skipped due to KSN trusted
21:44:50.0128 0x0c60  RalinkRegistryWriter - ok
21:44:50.0148 0x0c60  [ C3B515559046A89BB0E0F2CEEF73CABC, EC967620BADCA66BEE5DE0A44EC858AE2FB08BED6774673CDB3C1F53B7C7E22B ] RalinkRegistryWriter64 C:\Program Files (x86)\Ralink\Common\RaRegistry64.exe
21:44:50.0168 0x0c60  RalinkRegistryWriter64 - detected UnsignedFile.Multi.Generic ( 1 )
21:44:50.0269 0x0c60  Detect skipped due to KSN trusted
21:44:50.0269 0x0c60  RalinkRegistryWriter64 - ok
21:44:50.0289 0x0c60  [ ACCFA0846D9C7BD6A9F506982B812A5C, FE48D5016C2EBDB95A594D359E9F7873A1EF5C927E109F59755C892B6C3C5506 ] RaMediaServer   C:\Program Files (x86)\Ralink\Common\RaMediaServer.exe
21:44:50.0309 0x0c60  RaMediaServer - ok
21:44:50.0329 0x0c60  [ 5A0DA8AD5762FA2D91678A8A01311704, 8A64EB5DBAB7048A9E42A21CEB62CCD5B007A80C199892D7F8C69B48E8A255EF ] RasAcd          C:\windows\system32\DRIVERS\rasacd.sys
21:44:50.0349 0x0c60  RasAcd - ok
21:44:50.0379 0x0c60  [ 7ECFF9B22276B73F43A99A15A6094E90, 62C70DA127F48F796F8897BBFA23AB6EB080CC923F0F091DFA384A93F5C90CA1 ] RasAgileVpn     C:\windows\system32\DRIVERS\AgileVpn.sys
21:44:50.0399 0x0c60  RasAgileVpn - ok
21:44:50.0419 0x0c60  [ 8F26510C5383B8DBE976DE1CD00FC8C7, 60E618C010E8A723960636415573FA17EA0BBEF79647196B3BC0B8DEE680E090 ] RasAuto         C:\windows\System32\rasauto.dll
21:44:50.0449 0x0c60  RasAuto - ok
21:44:50.0459 0x0c60  [ 471815800AE33E6F1C32FB1B97C490CA, 27307265F743DE3A3A3EC1B2C472A3D85FDD0AEC458E0B1177593141EE072698 ] Rasl2tp         C:\windows\system32\DRIVERS\rasl2tp.sys
21:44:50.0489 0x0c60  Rasl2tp - ok
21:44:50.0509 0x0c60  [ EE867A0870FC9E4972BA9EAAD35651E2, 1B848D81705081FD2E18AC762DA7F51455657DAF860BF363DC15925A148BCADA ] RasMan          C:\windows\System32\rasmans.dll
21:44:50.0559 0x0c60  RasMan - ok
21:44:50.0579 0x0c60  [ 855C9B1CD4756C5E9A2AA58A15F58C25, A514F8A9C304D54BDA8DC60F5A64259B057EC83A1CAAF6D2B58CFD55E9561F72 ] RasPppoe        C:\windows\system32\DRIVERS\raspppoe.sys
21:44:50.0629 0x0c60  RasPppoe - ok
21:44:50.0709 0x0c60  [ E8B1E447B008D07FF47D016C2B0EEECB, FEC789F82B912F3E14E49524D40FEAA4373B221156F14045E645D7C37859258C ] RasSstp         C:\windows\system32\DRIVERS\rassstp.sys
21:44:50.0749 0x0c60  RasSstp - ok
21:44:50.0769 0x0c60  [ 77F665941019A1594D887A74F301FA2F, 1FDC6F6853400190C086042933F157814D915C54F26793CAD36CD2607D8810DA ] rdbss           C:\windows\system32\DRIVERS\rdbss.sys
21:44:50.0799 0x0c60  rdbss - ok
21:44:50.0809 0x0c60  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D, 1DF3501BBFFB56C3ECC39DBCC4287D3302216C2208CE22428B8C4967E5DE9D17 ] rdpbus          C:\windows\system32\drivers\rdpbus.sys
21:44:50.0829 0x0c60  rdpbus - ok
21:44:50.0839 0x0c60  [ CEA6CC257FC9B7715F1C2B4849286D24, A78144D18352EA802C39D9D42921CF97A3E0211766B2169B6755C6FC2D77A804 ] RDPCDD          C:\windows\system32\DRIVERS\RDPCDD.sys
21:44:50.0869 0x0c60  RDPCDD - ok
21:44:50.0879 0x0c60  [ BB5971A4F00659529A5C44831AF22365, 9AAA5C0D448E821FD85589505D99DF7749715A046BBD211F139E4E652ADDE41F ] RDPENCDD        C:\windows\system32\drivers\rdpencdd.sys
21:44:50.0909 0x0c60  RDPENCDD - ok
21:44:50.0919 0x0c60  [ 216F3FA57533D98E1F74DED70113177A, 60C126A1409D1E9C39F1C9E95F70115BF4AF07780AB499F6E10A612540F173F4 ] RDPREFMP        C:\windows\system32\drivers\rdprefmp.sys
21:44:50.0949 0x0c60  RDPREFMP - ok
21:44:51.0019 0x0c60  [ 313F68E1A3E6345A4F47A36B07062F34, B8318A0AE06BDE278931CA52F960B9FE226FD9894B076858DDB755AE26E1E66F ] RdpVideoMiniport C:\windows\system32\drivers\rdpvideominiport.sys
21:44:51.0059 0x0c60  RdpVideoMiniport - ok
21:44:51.0109 0x0c60  [ FE571E088C2D83619D2D48D4E961BF41, 88C5A2FCB1D0E528657842E39963471A6E42FCA3FCDF37955AEC8258AB4C48EA ] RDPWD           C:\windows\system32\drivers\RDPWD.sys
21:44:51.0119 0x0c60  RDPWD - ok
21:44:51.0149 0x0c60  [ 34ED295FA0121C241BFEF24764FC4520, AAEE5F00CAA763A5BA51CF56BD7262C03409CD72BD5601490E3EC3FFF929BB5F ] rdyboost        C:\windows\system32\drivers\rdyboost.sys
21:44:51.0169 0x0c60  rdyboost - ok
21:44:51.0179 0x0c60  [ 254FB7A22D74E5511C73A3F6D802F192, 3D0FB5840364200DE394F8CC28DA0E334C2B5FA8FF28A41656EE72287F3D3836 ] RemoteAccess    C:\windows\System32\mprdim.dll
21:44:51.0209 0x0c60  RemoteAccess - ok
21:44:51.0219 0x0c60  [ E4D94F24081440B5FC5AA556C7C62702, 147CAA03568DC480F9506E30B84891AB7E433B5EBC05F34FF10F72B00E1C6B22 ] RemoteRegistry  C:\windows\system32\regsvc.dll
21:44:51.0249 0x0c60  RemoteRegistry - ok
21:44:51.0259 0x0c60  [ E4DC58CF7B3EA515AE917FF0D402A7BB, 665B5CD9FE905B0EE3F59A7B1A94760F5393EBEE729877D8584349754C2867E8 ] RpcEptMapper    C:\windows\System32\RpcEpMap.dll
21:44:51.0289 0x0c60  RpcEptMapper - ok
21:44:51.0299 0x0c60  [ D5BA242D4CF8E384DB90E6A8ED850B8C, CB4CB2608B5E31B55FB1A2CF4051E6D08A0C2A5FB231B2116F95938D7577334E ] RpcLocator      C:\windows\system32\locator.exe
21:44:51.0319 0x0c60  RpcLocator - ok
21:44:51.0349 0x0c60  [ 622C96AFB07BB82C8650B47172137AC4, B74CEA5A3F4945E5A3EAE7AF1B1FA75F611C65C6FACE393052A512FA81B0C17C ] RpcSs           C:\windows\system32\rpcss.dll
21:44:51.0369 0x0c60  RpcSs - ok
21:44:51.0399 0x0c60  [ DDC86E4F8E7456261E637E3552E804FF, D250C69CCC75F2D88E7E624FCC51300E75637333317D53908CCA7E0F117173DD ] rspndr          C:\windows\system32\DRIVERS\rspndr.sys
21:44:51.0419 0x0c60  rspndr - ok
21:44:51.0449 0x0c60  [ 39A719875F572241C585A629EE62EB14, EE42DB11710374A2A97ED5B58A9DA0AECC8AB0DF4DEEAC5970F33046255CE2F9 ] RTL8167         C:\windows\system32\DRIVERS\Rt64win7.sys
21:44:51.0479 0x0c60  RTL8167 - ok
21:44:51.0489 0x0c60  [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] SamSs           C:\windows\system32\lsass.exe
21:44:51.0509 0x0c60  SamSs - ok
21:44:51.0509 0x0c60  [ AC03AF3329579FFFB455AA2DAABBE22B, 7AD3B62ADFEC166F9E256F9FF8BAA0568B2ED7308142BF8F5269E6EAA5E0A656 ] sbp2port        C:\windows\system32\drivers\sbp2port.sys
21:44:51.0529 0x0c60  sbp2port - ok
21:44:51.0549 0x0c60  [ 9B7395789E3791A3B6D000FE6F8B131E, E5F067F3F212BF5481668BE1779CBEF053F511F8967589BE2E865ACB9A620024 ] SCardSvr        C:\windows\System32\SCardSvr.dll
21:44:51.0579 0x0c60  SCardSvr - ok
21:44:51.0599 0x0c60  [ 253F38D0D7074C02FF8DEB9836C97D2B, CB5CAFCB8628BB22877F74ACF1DED0BBAED8F4573A74DA7FE94BBBA584889116 ] scfilter        C:\windows\system32\DRIVERS\scfilter.sys
21:44:51.0629 0x0c60  scfilter - ok
21:44:51.0659 0x0c60  [ 40686B59C127F0C93B4234E4A1E3472A, B2DD61CB796C6AA8AFD285D43472B94646CA6D331D282818E0FDC9DE28DDE9CF ] Schedule        C:\windows\system32\schedsvc.dll
21:44:51.0709 0x0c60  Schedule - ok
21:44:51.0729 0x0c60  [ F17D1D393BBC69C5322FBFAFACA28C7F, 62A1A92B3C52ADFD0B808D7F69DD50238B5F202421F1786F7EAEAA63F274B3E8 ] SCPolicySvc     C:\windows\System32\certprop.dll
21:44:51.0759 0x0c60  SCPolicySvc - ok
21:44:51.0769 0x0c60  [ 6EA4234DC55346E0709560FE7C2C1972, 64011E044C16E2F92689E5F7E4666A075E27BBFA61F3264E5D51CE1656C1D5B8 ] SDRSVC          C:\windows\System32\SDRSVC.dll
21:44:51.0799 0x0c60  SDRSVC - ok
21:44:51.0819 0x0c60  [ 3EA8A16169C26AFBEB544E0E48421186, 34BBB0459C96B3DE94CCB0D73461562935C583D7BF93828DA4E20A6BC9B7301D ] secdrv          C:\windows\system32\drivers\secdrv.sys
21:44:51.0879 0x0c60  secdrv - ok
21:44:51.0909 0x0c60  [ A19623BDD61E66A12AB53992002B4F3A, E351CEEC086084A417BA3BD0EEF46114D3147EC38E3EF8BE49B724F9D028CC56 ] seclogon        C:\windows\system32\seclogon.dll
21:44:51.0939 0x0c60  seclogon - ok
21:44:51.0949 0x0c60  [ C32AB8FA018EF34C0F113BD501436D21, E0EB8E80B51E45CA7EB061E705DA0BC07878759418A8519AE6E12326FE79E7C7 ] SENS            C:\windows\System32\sens.dll
21:44:51.0979 0x0c60  SENS - ok
21:44:51.0989 0x0c60  [ 0336CFFAFAAB87A11541F1CF1594B2B2, 8B8A6A33E78A12FB05E29B2E2775850626574AFD2EF88748D65E690A07B10B8D ] SensrSvc        C:\windows\system32\sensrsvc.dll
21:44:52.0009 0x0c60  SensrSvc - ok
21:44:52.0029 0x0c60  [ CB624C0035412AF0DEBEC78C41F5CA1B, A4D937F11E06CAE914347CA1362F4C98EC5EE0C0C80321E360EA1ABD6726F8D4 ] Serenum         C:\windows\system32\drivers\serenum.sys
21:44:52.0049 0x0c60  Serenum - ok
21:44:52.0079 0x0c60  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6, 8F9776FB84C5D11068EAF1FF1D1A46466C655D64D256A8B1E31DC0C23B5DD22D ] Serial          C:\windows\system32\drivers\serial.sys
21:44:52.0099 0x0c60  Serial - ok
21:44:52.0109 0x0c60  [ 1C545A7D0691CC4A027396535691C3E3, 065C30BE598FF4DC55C37E0BBE0CEDF10A370AE2BF5404B42EBBB867A3FFED6D ] sermouse        C:\windows\system32\drivers\sermouse.sys
21:44:52.0129 0x0c60  sermouse - ok
21:44:52.0139 0x0c60  [ 0B6231BF38174A1628C4AC812CC75804, E569BF1F7F5689E2E917FA6516DB53388A5B8B1C6699DEE030147E853218811D ] SessionEnv      C:\windows\system32\sessenv.dll
21:44:52.0169 0x0c60  SessionEnv - ok
21:44:52.0179 0x0c60  [ A554811BCD09279536440C964AE35BBF, DA8F893722F803E189D7D4D6C6232ED34505B63A64ED3A0132A5BB7A2BABDE55 ] sffdisk         C:\windows\system32\drivers\sffdisk.sys
21:44:52.0199 0x0c60  sffdisk - ok
21:44:52.0199 0x0c60  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF, B81EF5D26AEB572CAB590F7AD7CA8C89F296420089EF5E6148E972F2DBCA1042 ] sffp_mmc        C:\windows\system32\drivers\sffp_mmc.sys
21:44:52.0219 0x0c60  sffp_mmc - ok
21:44:52.0229 0x0c60  [ DD85B78243A19B59F0637DCF284DA63C, 6730D4F2BAE7E24615746ACC41B42D01DB6068D6504982008ADA1890DE900197 ] sffp_sd         C:\windows\system32\drivers\sffp_sd.sys
21:44:52.0249 0x0c60  sffp_sd - ok
21:44:52.0259 0x0c60  [ A9D601643A1647211A1EE2EC4E433FF4, 7AC60B4AB48D4BBF1F9681C12EC2A75C72E6E12D30FABC564A24394310E9A5F9 ] sfloppy         C:\windows\system32\drivers\sfloppy.sys
21:44:52.0279 0x0c60  sfloppy - ok
21:44:52.0309 0x0c60  [ B95F6501A2F8B2E78C697FEC401970CE, 758B73A32902299A313348CE7EC189B20EB4CB398D0180E4EE24B84DAD55F291 ] SharedAccess    C:\windows\System32\ipnathlp.dll
21:44:52.0339 0x0c60  SharedAccess - ok
21:44:52.0359 0x0c60  [ AAF932B4011D14052955D4B212A4DA8D, 2A3BFD0FA9569288E91AE3E72CA1EC39E1450D01E6473CE51157E0F138257923 ] ShellHWDetection C:\windows\System32\shsvcs.dll
21:44:52.0389 0x0c60  ShellHWDetection - ok
21:44:52.0409 0x0c60  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1, 89CA9F516E42A6B905474D738CDA2C121020A07DBD4E66CFE569DD77D79D7820 ] SiSRaid2        C:\windows\system32\drivers\SiSRaid2.sys
21:44:52.0419 0x0c60  SiSRaid2 - ok
21:44:52.0429 0x0c60  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4, 87B85C66DF7EB6FDB8A2341D05FAA5261FF68A90CCFC63F0E4A03824F1E33E5E ] SiSRaid4        C:\windows\system32\drivers\sisraid4.sys
21:44:52.0449 0x0c60  SiSRaid4 - ok
21:44:52.0459 0x0c60  [ 548260A7B8654E024DC30BF8A7C5BAA4, 4A7E58331D7765A12F53DC2371739DC9A463940B13E16157CE10DB80E958D740 ] Smb             C:\windows\system32\DRIVERS\smb.sys
21:44:52.0479 0x0c60  Smb - ok
21:44:52.0499 0x0c60  [ 6313F223E817CC09AA41811DAA7F541D, D787061043BEEDB9386B048CB9E680E6A88A1CBAE9BD4A8C0209155BFB76C630 ] SNMPTRAP        C:\windows\System32\snmptrap.exe
21:44:52.0519 0x0c60  SNMPTRAP - ok
21:44:52.0529 0x0c60  [ B9E31E5CACDFE584F34F730A677803F9, 21A5130BD00089C609522A372018A719F8E37103D2DD22C59EACB393BE35A063 ] spldr           C:\windows\system32\drivers\spldr.sys
21:44:52.0539 0x0c60  spldr - ok
21:44:52.0569 0x0c60  [ 85DAA09A98C9286D4EA2BA8D0E644377, F9C324E2EF81193FE831C7EECC44A100CA06F82FA731BF555D9EA4D91DA13329 ] Spooler         C:\windows\System32\spoolsv.exe
21:44:52.0609 0x0c60  Spooler - ok
21:44:52.0679 0x0c60  [ E17E0188BB90FAE42D83E98707EFA59C, FC075F7B39E86CC8EF6DA4E339FE946917E319C347AC70FB0C50AAF36F97E27F ] sppsvc          C:\windows\system32\sppsvc.exe
21:44:52.0769 0x0c60  sppsvc - ok
21:44:52.0779 0x0c60  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45, 36D48B23B8243BE5229707375FCD11C2DCAC96983199345365F065A0CBF33314 ] sppuinotify     C:\windows\system32\sppuinotify.dll
21:44:52.0809 0x0c60  sppuinotify - ok
21:44:52.0939 0x0c60  [ 60C7A67F1C1689C54B24940D2B6B8E24, EF9F0BC030ED933650A0CE556D0B3B4DDD759496B973E9AB73CD7796BDBDB367 ] SRTSP           C:\windows\System32\Drivers\NISx64\1607000.04C\SRTSP64.SYS
21:44:52.0979 0x0c60  SRTSP - ok
21:44:52.0989 0x0c60  [ 27382B6CF36D08783212FCF8B3691649, 83ECFBE280BBA8A4073A34F1B36D57952543F1A9B31E13EF8A40D8A2F12C2F73 ] SRTSPX          C:\windows\system32\drivers\NISx64\1607000.04C\SRTSPX64.SYS
21:44:53.0009 0x0c60  SRTSPX - ok
21:44:53.0039 0x0c60  [ F2F4B895296EE3ECCE781CC2A296A5D1, 126321EDDA8141A42DBE7C90675948433063E6D5B6DEFD805AA0797C95A461EE ] srv             C:\windows\system32\DRIVERS\srv.sys
21:44:53.0069 0x0c60  srv - ok
21:44:53.0109 0x0c60  [ FD0008BEDD2723170CCA7D61837DFD52, F9F576FA7B84CAB5180B9080D62B8A00B3E5D5BC73199B11C63193742529227D ] srv2            C:\windows\system32\DRIVERS\srv2.sys
21:44:53.0139 0x0c60  srv2 - ok
21:44:53.0149 0x0c60  [ 63B5845D9379262083655D5C6AB8DFC5, 1813D2FC41ADCDAC6E3A522373B9DB934CC27B89E7185E0E4FC26E30CDAF1523 ] srvnet          C:\windows\system32\DRIVERS\srvnet.sys
21:44:53.0169 0x0c60  srvnet - ok
21:44:53.0199 0x0c60  [ 51B52FBD583CDE8AA9BA62B8B4298F33, 2E2403F8AA39E79D1281CA006B51B43139C32A5FDD64BD34DAA4B935338BD740 ] SSDPSRV         C:\windows\System32\ssdpsrv.dll
21:44:53.0229 0x0c60  SSDPSRV - ok
21:44:53.0239 0x0c60  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB, D21CDBC4C2AA0DB5B4455D5108B0CAF4282A2E664B9035708F212CC094569D9D ] SstpSvc         C:\windows\system32\sstpsvc.dll
21:44:53.0259 0x0c60  SstpSvc - ok
21:44:53.0299 0x0c60  [ 74425FFA11C133D045E1C3BE2EAD481D, 183D16FD6D7724CB6283A6794F159EA4122B4C6EDA11DA2F80DB8B69D672BF19 ] ssudmdm         C:\windows\system32\DRIVERS\ssudmdm.sys
21:44:53.0339 0x0c60  ssudmdm - ok
21:44:53.0389 0x0c60  [ 4B1D0B5B6D043AAF45AE89EABAB7B865, 1340A8FD2A6DB77A1EB7502F3C40B3125613CE63BCEA969F5593404229926E7C ] STacSV          C:\Program Files\IDT\WDM\STacSV64.exe
21:44:53.0419 0x0c60  STacSV - detected UnsignedFile.Multi.Generic ( 1 )
21:44:53.0529 0x0c60  Detect skipped due to KSN trusted
21:44:53.0529 0x0c60  STacSV - ok
21:44:53.0559 0x0c60  StarOpen - ok
21:44:53.0569 0x0c60  [ F3817967ED533D08327DC73BC4D5542A, 1B204454408A690C0A86447F3E4AA9E7C58A9CFB567C94C17C21920BA648B4D5 ] stexstor        C:\windows\system32\drivers\stexstor.sys
21:44:53.0599 0x0c60  stexstor - ok
21:44:53.0619 0x0c60  [ 542BDF7E9256189ABBC68935FA8116A4, 657617A37E41D0F8870C98CA38826DE7AC2C399B290D307D2DB4AAF6C103BF14 ] STHDA           C:\windows\system32\DRIVERS\stwrt64.sys
21:44:53.0649 0x0c60  STHDA - ok
21:44:53.0679 0x0c60  [ 8DD52E8E6128F4B2DA92CE27402871C1, 1101C38BE8FC383B5F2F9FA402F9652B23B88A764DE2B584DFE62B88B11DEF92 ] stisvc          C:\windows\System32\wiaservc.dll
21:44:53.0709 0x0c60  stisvc - ok
21:44:53.0719 0x0c60  [ D01EC09B6711A5F8E7E6564A4D0FBC90, 3CB922291DBADC92B46B9E28CCB6810CD8CCDA3E74518EC9522B58B998E1F969 ] swenum          C:\windows\system32\drivers\swenum.sys
21:44:53.0739 0x0c60  swenum - ok
21:44:53.0769 0x0c60  [ E08E46FDD841B7184194011CA1955A0B, 9C3725BB1F08F92744C980A22ED5C874007D3B5863C7E1F140F50061052AC418 ] swprv           C:\windows\System32\swprv.dll
21:44:53.0809 0x0c60  swprv - ok
21:44:53.0929 0x0c60  [ 6ADFA39058484ADECCCF159627DC987E, FF8376D3441ABA6742773F83BF4DE46A0DB05FD9BA29902454E0E4C05ABC7E58 ] SymEFASI        C:\windows\system32\drivers\NISx64\1607000.04C\SYMEFASI64.SYS
21:44:53.0979 0x0c60  SymEFASI - ok
21:44:54.0019 0x0c60  [ F612740A892E8F9E789A85DD92B51150, 67F43FC6CE7A2238DA875657F2223787829316B410EB9A1481C4DF92258C7804 ] SymEvent        C:\windows\system32\Drivers\SYMEVENT64x86.SYS
21:44:54.0029 0x0c60  SymEvent - ok
21:44:54.0079 0x0c60  [ 9458A37D3A38597FBF62F97E05B3170A, 22724BBCC4426978B656F614B68FB1A80E0E14B56128122A29DAB33266C0E88C ] SymIRON         C:\windows\system32\drivers\NISx64\1607000.04C\Ironx64.SYS
21:44:54.0099 0x0c60  SymIRON - ok
21:44:54.0149 0x0c60  [ 5A185256AE1689912B5EC53F69D53820, D692B735AF2764CE29C6182A5C496994AD3A9EF9D5FB600EE9CE8B664F39D0FA ] SymNetS         C:\windows\System32\Drivers\NISx64\1607000.04C\SYMNETS.SYS
21:44:54.0169 0x0c60  SymNetS - ok
21:44:54.0249 0x0c60  [ 2E730941CC5BF6200A4F56D1E9C24AAD, 758836D55DC84F3EBE9917DC6FAB8E6170A5B238FEDBCFDB6D7C5C6EA98E08B2 ] SysMain         C:\windows\system32\sysmain.dll
21:44:54.0309 0x0c60  SysMain - ok
21:44:54.0329 0x0c60  [ E3C61FD7B7C2557E1F1B0B4CEC713585, 01F0E116606D185BF93B540868075BFB1A398197F6AABD994983DBFF56B3A8A0 ] TabletInputService C:\windows\System32\TabSvc.dll
21:44:54.0349 0x0c60  TabletInputService - ok
21:44:54.0369 0x0c60  [ 40F0849F65D13EE87B9A9AE3C1DD6823, E251A7EF3D0FD2973AF33A62FC457A7E8D5E8694208F811F52455F7C2426121F ] TapiSrv         C:\windows\System32\tapisrv.dll
21:44:54.0399 0x0c60  TapiSrv - ok
21:44:54.0489 0x0c60  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] Tcpip           C:\windows\system32\drivers\tcpip.sys
21:44:54.0549 0x0c60  Tcpip - ok
21:44:54.0599 0x0c60  [ 04ADD18EE5CC9FBEDAEC1DD1CD0CB45E, F05C0C4CA3DD234AD5D60CF1EF763C9A1D9EC3C157E180C2D75CC07E6B02A611 ] TCPIP6          C:\windows\system32\DRIVERS\tcpip.sys
21:44:54.0639 0x0c60  TCPIP6 - ok
21:44:54.0649 0x0c60  [ 1B16D0BD9841794A6E0CDE0CEF744ABC, 7EB8BA97339199EEE7F2B09DA2DA6279DA64A510D4598D42CF86415D67CD674C ] tcpipreg        C:\windows\system32\drivers\tcpipreg.sys
21:44:54.0669 0x0c60  tcpipreg - ok
21:44:54.0679 0x0c60  [ 3371D21011695B16333A3934340C4E7C, 7416F9BBFC1BA9D875EA7D1C7A0D912FC6977B49A865D67E3F9C4E18A965082D ] TDPIPE          C:\windows\system32\drivers\tdpipe.sys
21:44:54.0709 0x0c60  TDPIPE - ok
21:44:54.0719 0x0c60  [ 51C5ECEB1CDEE2468A1748BE550CFBC8, 4E8F83877330B421F7B5D8393D34BC44C6450E69209DAA95B29CB298166A5DF9 ] TDTCP           C:\windows\system32\drivers\tdtcp.sys
21:44:54.0739 0x0c60  TDTCP - ok
21:44:54.0759 0x0c60  [ AA77EB517D2F07A947294F260E3ACA83, B7A5DF3066830C0C2302B059778A67419792058A0D300C471DE40AB245EA7E58 ] tdx             C:\windows\system32\DRIVERS\tdx.sys
21:44:54.0779 0x0c60  tdx - ok
21:44:54.0799 0x0c60  [ 561E7E1F06895D78DE991E01DD0FB6E5, 83BFA50A528762EC52A011302AC3874636FB7E26628CD7ACFBF2BDC9FAA8110D ] TermDD          C:\windows\system32\drivers\termdd.sys
21:44:54.0809 0x0c60  TermDD - ok
21:44:54.0879 0x0c60  [ 008CD4EBFABCF78D0F19B3778492648C, 9050490EEE0AD86E73F0A82D83E4FC29DF84F6B6FDB389AE135FD712B5F425BE ] TermService     C:\windows\System32\termsrv.dll
21:44:54.0919 0x0c60  TermService - ok
21:44:54.0939 0x0c60  [ F0344071948D1A1FA732231785A0664C, DB9886C2C858FAF45AEA15F8E42860343F73EB8685C53EC2E8CCC10586CB0832 ] Themes          C:\windows\system32\themeservice.dll
21:44:54.0959 0x0c60  Themes - ok
21:44:54.0979 0x0c60  [ E40E80D0304A73E8D269F7141D77250B, 0DB4AC13A264F19A84DC0BCED54E8E404014CC09C993B172002B1561EC7E265A ] THREADORDER     C:\windows\system32\mmcss.dll
21:44:55.0009 0x0c60  THREADORDER - ok
21:44:55.0029 0x0c60  [ BDFC55C2389D23C7E36A627BD580EE98, E25CF1C01CF90B348333A0CBAF26F8F5751AE725E6059C35C492E00479105B70 ] tihub3          C:\windows\system32\DRIVERS\tihub3.sys
21:44:55.0049 0x0c60  tihub3 - ok
21:44:55.0089 0x0c60  [ EBEDBC08C2E5EB4EC8E3DA4BF3D827B1, FC465EAF5C2E44F279B54B13C88ACCE565B1C9C6DDEB8D87FD0CD6CD3AA1AABC ] tixhci          C:\windows\system32\drivers\tixhci.sys
21:44:55.0109 0x0c60  tixhci - ok
21:44:55.0129 0x0c60  [ 7E7AFD841694F6AC397E99D75CEAD49D, DE87F203FD8E6BDCCFCA1860A85F283301A365846FB703D9BB86278D8AC96B07 ] TrkWks          C:\windows\System32\trkwks.dll
21:44:55.0159 0x0c60  TrkWks - ok
21:44:55.0189 0x0c60  [ 773212B2AAA24C1E31F10246B15B276C, F2EF85F5ABA307976D9C649D710B408952089458DDE97D4DEF321DF14E46A046 ] TrustedInstaller C:\windows\servicing\TrustedInstaller.exe
21:44:55.0239 0x0c60  TrustedInstaller - ok
21:44:55.0279 0x0c60  [ E232A3B43A894BB327FC161529BD9ED1, F2673DA8C920F21ACCECC25F7C59A05822E5E577D47F126EDF9C94FEB4B30C5F ] tssecsrv        C:\windows\system32\DRIVERS\tssecsrv.sys
21:44:55.0299 0x0c60  tssecsrv - ok
21:44:55.0329 0x0c60  [ 17C6B51CBCCDED95B3CC14E22791F85E, EE417C19E9B2C258D62A74F1F2421AFFBAC67ACD62481CAA08F5B6A3439C1D7C ] TsUsbFlt        C:\windows\system32\drivers\tsusbflt.sys
21:44:55.0349 0x0c60  TsUsbFlt - ok
21:44:55.0359 0x0c60  [ AD64450A4ABE076F5CB34CC08EEACB07, B5C386635441A19178E7FEEE299BA430C8D72F9110866C13A216B12A1080AD12 ] TsUsbGD         C:\windows\system32\drivers\TsUsbGD.sys
21:44:55.0379 0x0c60  TsUsbGD - ok
21:44:55.0409 0x0c60  [ 3566A8DAAFA27AF944F5D705EAA64894, AE9D8B648DA08AF667B9456C3FE315489859C157510A258559F18238F2CC92B8 ] tunnel          C:\windows\system32\DRIVERS\tunnel.sys
21:44:55.0439 0x0c60  tunnel - ok
21:44:55.0449 0x0c60  [ B4DD609BD7E282BFC683CEC7EAAAAD67, EF131DB6F6411CAD36A989A421AF93F89DD61601AC524D2FF11C10FF6E3E9123 ] uagp35          C:\windows\system32\drivers\uagp35.sys
21:44:55.0469 0x0c60  uagp35 - ok
21:44:55.0489 0x0c60  [ FF4232A1A64012BAA1FD97C7B67DF593, D8591B4EB056899C7B604E4DD852D82D4D9809F508ABCED4A03E1BE6D5D456E3 ] udfs            C:\windows\system32\DRIVERS\udfs.sys
21:44:55.0519 0x0c60  udfs - ok
21:44:55.0539 0x0c60  [ 3CBDEC8D06B9968ABA702EBA076364A1, B8DAB8AA804FC23021BFEBD7AE4D40FBE648D6C6BA21CC008E26D1C084972F9B ] UI0Detect       C:\windows\system32\UI0Detect.exe
21:44:55.0559 0x0c60  UI0Detect - ok
21:44:55.0579 0x0c60  [ 4BFE1BC28391222894CBF1E7D0E42320, 5918B1ED2030600DF77BDACF1C808DF6EADDD8BF3E7003AF1D72050D8B102B3A ] uliagpkx        C:\windows\system32\drivers\uliagpkx.sys
21:44:55.0589 0x0c60  uliagpkx - ok
21:44:55.0619 0x0c60  [ DC54A574663A895C8763AF0FA1FF7561, 09A3F3597E91CBEB2F38E96E75134312B60CAE5574B2AD4606C2D3E992AEDDFE ] umbus           C:\windows\system32\DRIVERS\umbus.sys
21:44:55.0639 0x0c60  umbus - ok
21:44:55.0659 0x0c60  [ B2E8E8CB557B156DA5493BBDDCC1474D, F547509A08C0679ACB843E20C9C0CF51BED1B06530BBC529DFB0944504564A43 ] UmPass          C:\windows\system32\DRIVERS\umpass.sys
21:44:55.0679 0x0c60  UmPass - ok
21:44:55.0699 0x0c60  [ D47EC6A8E81633DD18D2436B19BAF6DE, 0FB461E2D5E0B75BB5958F6362F4880BFA4C36AD930542609BCAF574941AA7AE ] upnphost        C:\windows\System32\upnphost.dll
21:44:55.0739 0x0c60  upnphost - ok
21:44:55.0769 0x0c60  [ F957092C63CD71D85903CA0D8370F473, 4DEC2FC20329F248135DA24CB6694FD972DCCE8B1BBEA8D872FDE41939E96AAF ] USBAAPL64       C:\windows\system32\Drivers\usbaapl64.sys
21:44:55.0839 0x0c60  USBAAPL64 - ok
21:44:55.0879 0x0c60  [ DCA68B0943D6FA415F0C56C92158A83A, BEE5A5B33B22D1DF50B884D46D89FC3B8286EB16E38AD5A20F0A49E5C6766C57 ] usbccgp         C:\windows\system32\DRIVERS\usbccgp.sys
21:44:55.0909 0x0c60  usbccgp - ok
21:44:55.0929 0x0c60  [ 80B0F7D5CCF86CEB5D402EAAF61FEC31, 140C62116A425DEAD25FE8D82DE283BC92C482A9F643658D512F9F67061F28AD ] usbcir          C:\windows\system32\drivers\usbcir.sys
21:44:55.0949 0x0c60  usbcir - ok
21:44:55.0979 0x0c60  [ 18A85013A3E0F7E1755365D287443965, 811C5EDF38C765BCF71BCE25CB6626FF6988C3699F5EF1846240EA0052F34C33 ] usbehci         C:\windows\system32\drivers\usbehci.sys
21:44:55.0999 0x0c60  usbehci - ok
21:44:56.0029 0x0c60  [ 8D1196CFBB223621F2C67D45710F25BA, B5D7AFE51833B24FC9576F3AED3D8A2B290E5846060E73F9FFFAC1890A8B6003 ] usbhub          C:\windows\system32\DRIVERS\usbhub.sys
21:44:56.0069 0x0c60  usbhub - ok
21:44:56.0089 0x0c60  [ 765A92D428A8DB88B960DA5A8D6089DC, 56DE8A2ED58E53B202C399CA7BACB1551136303C2EE0AB426BDBBF880E3C542C ] usbohci         C:\windows\system32\drivers\usbohci.sys
21:44:56.0109 0x0c60  usbohci - ok
21:44:56.0139 0x0c60  [ 73188F58FB384E75C4063D29413CEE3D, B485463933306036B1D490722CB1674DC85670753D79FA0EF7EBCA7BBAAD9F7C ] usbprint        C:\windows\system32\DRIVERS\usbprint.sys
21:44:56.0159 0x0c60  usbprint - ok
21:44:56.0179 0x0c60  [ 9661DA76B4531B2DA272ECCE25A8AF24, FEA93254A21E71A7EB8AD35FCCAD2C1E41F7329EC33B1734F5B41307A34D8637 ] usbscan         C:\windows\system32\DRIVERS\usbscan.sys
21:44:56.0199 0x0c60  usbscan - ok
21:44:56.0229 0x0c60  [ D029DD09E22EB24318A8FC3D8138BA43, C95805E8BF75ECB939520AE86420B16467B0771C161C51C9F1A37649ADFADCD0 ] USBSTOR         C:\windows\system32\drivers\USBSTOR.SYS
21:44:56.0250 0x0c60  USBSTOR - ok
21:44:56.0270 0x0c60  [ DD253AFC3BC6CBA412342DE60C3647F3, 146F8613F1057AC054DC3593E84BC52899DA27EA33B0E72ACFB78C3699ADCDE7 ] usbuhci         C:\windows\system32\drivers\usbuhci.sys
21:44:56.0280 0x0c60  usbuhci - ok
21:44:56.0300 0x0c60  [ EDBB23CBCF2CDF727D64FF9B51A6070E, 7202484C8E1BFB2AFD64D8C81668F3EDE0E3BF5EB27572877A0A7B337AE5AE42 ] UxSms           C:\windows\System32\uxsms.dll
21:44:56.0330 0x0c60  UxSms - ok
21:44:56.0340 0x0c60  [ C8A7F80DB5C193DD67747A1BA4B1782E, B216FC5A07C643868AD7C58F931F6327A21695E1734A62875F6E2909139F30B8 ] VaultSvc        C:\windows\system32\lsass.exe
21:44:56.0360 0x0c60  VaultSvc - ok
21:44:56.0380 0x0c60  [ C5C876CCFC083FF3B128F933823E87BD, 6FE0FBB6C3207E09300E0789E2168F76668D87C317FE9F263E733827ADCFBE0D ] vdrvroot        C:\windows\system32\drivers\vdrvroot.sys
21:44:56.0390 0x0c60  vdrvroot - ok
21:44:56.0410 0x0c60  [ 8D6B481601D01A456E75C3210F1830BE, A2CEF483F4231367138EEF7E67FD5BE5364FC0780C44CA1368E36CE4AA3D0633 ] vds             C:\windows\System32\vds.exe
21:44:56.0450 0x0c60  vds - ok
21:44:56.0470 0x0c60  [ DA4DA3F5E02943C2DC8C6ED875DE68DD, EDE604536DB78C512D68C92B26DA77C8811AC109D1F0A473673F0A82D15A2838 ] vga             C:\windows\system32\DRIVERS\vgapnp.sys
21:44:56.0480 0x0c60  vga - ok
21:44:56.0500 0x0c60  [ 53E92A310193CB3C03BEA963DE7D9CFC, 45898604375B42EB1246C17A22D91C2440F11C746FF6459AD38027C1BC2E3125 ] VgaSave         C:\windows\System32\drivers\vga.sys
21:44:56.0530 0x0c60  VgaSave - ok
21:44:56.0550 0x0c60  [ 2CE2DF28C83AEAF30084E1B1EB253CBB, D1946816A1CB89F825CBEA58F94A4C9D0CE7249355CD3915563F54054EE564BF ] vhdmp           C:\windows\system32\drivers\vhdmp.sys
21:44:56.0570 0x0c60  vhdmp - ok
21:44:56.0590 0x0c60  [ E5689D93FFE4E5D66C0178761240DD54, 6D35CED80681B12AAF63BFA0DA1C386E71D3838839B68A686990AA8031949D27 ] viaide          C:\windows\system32\drivers\viaide.sys
21:44:56.0600 0x0c60  viaide - ok
21:44:56.0620 0x0c60  [ D2AAFD421940F640B407AEFAAEBD91B0, 31EF342A60AF04F4108759A71F8FB7B8C8819216CF3D16A95B2BA0E33A8A9161 ] volmgr          C:\windows\system32\drivers\volmgr.sys
21:44:56.0630 0x0c60  volmgr - ok
21:44:56.0650 0x0c60  [ A255814907C89BE58B79EF2F189B843B, 463DB771851352185B6AC323BD93B9084D47291E53C1F7B628B65D6918B2E28F ] volmgrx         C:\windows\system32\drivers\volmgrx.sys
21:44:56.0670 0x0c60  volmgrx - ok
21:44:56.0680 0x0c60  [ DF8126BD41180351A093A3AD2FC8903B, AEFF4AA89CDDAAAD43CDE17C6B6EB2A397A0AC1651CBD51B889161EC2BC6527A ] volsnap         C:\windows\system32\drivers\volsnap.sys
21:44:56.0700 0x0c60  volsnap - ok
21:44:56.0730 0x0c60  [ 5E2016EA6EBACA03C04FEAC5F330D997, 53106EB877459FE55A459111F7AB0EE320BB3B4C954D3DB6FA1642396001F2AC ] vsmraid         C:\windows\system32\drivers\vsmraid.sys
21:44:56.0740 0x0c60  vsmraid - ok
21:44:56.0790 0x0c60  [ B60BA0BC31B0CB414593E169F6F21CC2, 47B801E623254CF0202B3591CB5C019CABFB52F123C7D47E29D19B32F1F2B915 ] VSS             C:\windows\system32\vssvc.exe
21:44:56.0840 0x0c60  VSS - ok
21:44:56.0860 0x0c60  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1, 3254523C85C70EBA2DBAC05DB2DBA89EDF8E9195F390F7C21F96458FB6B2E3D7 ] vwifibus        C:\windows\system32\DRIVERS\vwifibus.sys
21:44:56.0870 0x0c60  vwifibus - ok
21:44:56.0880 0x0c60  [ 6A3D66263414FF0D6FA754C646612F3F, 30F6BA594B0D3B94113064015A16D97811CD989DF1715CCE21CEAB9894C1B4FB ] vwififlt        C:\windows\system32\DRIVERS\vwififlt.sys
21:44:56.0900 0x0c60  vwififlt - ok
21:44:56.0910 0x0c60  [ 6A638FC4BFDDC4D9B186C28C91BD1A01, 5521F1DC515586777EC4837E0AEAA3E613CC178AF1074031C4D0D0C695A93168 ] vwifimp         C:\windows\system32\DRIVERS\vwifimp.sys
21:44:56.0930 0x0c60  vwifimp - ok
21:44:56.0950 0x0c60  [ 1C9D80CC3849B3788048078C26486E1A, 34A89F31E53F6B6C209B286F580CC2257AE6D057E4E20741F241C9C167947962 ] W32Time         C:\windows\system32\w32time.dll
21:44:56.0980 0x0c60  W32Time - ok
21:44:57.0000 0x0c60  [ 4E9440F4F152A7B944CB1663D3935A3E, 8FE04EBD3BC612EE943A21A3E56F37E5C9B578CDACA6044048181DAD81816D53 ] WacomPen        C:\windows\system32\drivers\wacompen.sys
21:44:57.0020 0x0c60  WacomPen - ok
21:44:57.0040 0x0c60  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] WANARP          C:\windows\system32\DRIVERS\wanarp.sys
21:44:57.0060 0x0c60  WANARP - ok
21:44:57.0070 0x0c60  [ 356AFD78A6ED4457169241AC3965230C, CE4D1EE3525C10AC658B20776C3E444DE44874C837713DC5311386EDFCB18399 ] Wanarpv6        C:\windows\system32\DRIVERS\wanarp.sys
21:44:57.0100 0x0c60  Wanarpv6 - ok
21:44:57.0130 0x0c60  [ 78F4E7F5C56CB9716238EB57DA4B6A75, 46A4E78CE5F2A4B26F4E9C3FF04A99D9B727A82AC2E390A82A1611C3F6E0C9AF ] wbengine        C:\windows\system32\wbengine.exe
21:44:57.0180 0x0c60  wbengine - ok
21:44:57.0200 0x0c60  [ 3AA101E8EDAB2DB4131333F4325C76A3, 4F7BD3DA5E58B18BFF106CFF7B45E75FD13EE556D433C695BA23EC80827E49DE ] WbioSrvc        C:\windows\System32\wbiosrvc.dll
21:44:57.0230 0x0c60  WbioSrvc - ok
21:44:57.0250 0x0c60  [ 7368A2AFD46E5A4481D1DE9D14848EDD, 8039C478FC2D9F095F5883A4FA47F9E6EDF57CC88A4AA74F07C88445F90DED57 ] wcncsvc         C:\windows\System32\wcncsvc.dll
21:44:57.0270 0x0c60  wcncsvc - ok
21:44:57.0290 0x0c60  [ 20F7441334B18CEE52027661DF4A6129, 7B8E0247234B740FED2BE9B833E9CE8DD7453340123AB43F6B495A7E6A27B0DD ] WcsPlugInService C:\windows\System32\WcsPlugInService.dll
21:44:57.0310 0x0c60  WcsPlugInService - ok
21:44:57.0320 0x0c60  [ 72889E16FF12BA0F235467D6091B17DC, F2FD0BBD075E33608D93F350D216F97442AB89ABD540513C2D568C78096E12A8 ] Wd              C:\windows\system32\drivers\wd.sys
21:44:57.0340 0x0c60  Wd - ok
21:44:57.0370 0x0c60  [ E2C933EDBC389386EBE6D2BA953F43D8, AF1DEADD5F1267CCEBD226E8EEB971D1946EA6A5A9645A36F5D111F758AF2F07 ] Wdf01000        C:\windows\system32\drivers\Wdf01000.sys
21:44:57.0400 0x0c60  Wdf01000 - ok
21:44:57.0430 0x0c60  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiServiceHost  C:\windows\system32\wdi.dll
21:44:57.0460 0x0c60  WdiServiceHost - ok
21:44:57.0460 0x0c60  [ C6F7473B55510F0B93961DA03D8E3B38, 4BAB9274DED8F7AC4A52B8739F501323FFFA0367CAA24BFAFDB5523812E0CE39 ] WdiSystemHost   C:\windows\system32\wdi.dll
21:44:57.0480 0x0c60  WdiSystemHost - ok
21:44:57.0510 0x0c60  [ 4E89FC53493704BF835F0300DC201C34, FB3080725E144D93512DED81047D21C0582BC3412250EFF37E039108D7351F53 ] WebClient       C:\windows\System32\webclnt.dll
21:44:57.0540 0x0c60  WebClient - ok
21:44:57.0550 0x0c60  [ C749025A679C5103E575E3B48E092C43, B71171D07EE7AB085A24BF3A1072FF2CE7EA021AAE695F6A90640E6EE8EB55C1 ] Wecsvc          C:\windows\system32\wecsvc.dll
21:44:57.0580 0x0c60  Wecsvc - ok
21:44:57.0590 0x0c60  [ 7E591867422DC788B9E5BD337A669A08, 484E6BCCDF7ADCE9A1AACAD1BC7C7D7694B9E40FA90D94B14D80C607784F6C75 ] wercplsupport   C:\windows\System32\wercplsupport.dll
21:44:57.0620 0x0c60  wercplsupport - ok
21:44:57.0630 0x0c60  [ 6D137963730144698CBD10F202E9F251, A9F522A125158D94F540544CCD4DBF47B9DCE2EA878C33675AFE40F80E8F4979 ] WerSvc          C:\windows\System32\WerSvc.dll
21:44:57.0660 0x0c60  WerSvc - ok
21:44:57.0680 0x0c60  [ 611B23304BF067451A9FDEE01FBDD725, 0AF2734B978165FC6FD22B64862132CCE32528A21C698A49D176129446E099C8 ] WfpLwf          C:\windows\system32\DRIVERS\wfplwf.sys
21:44:57.0710 0x0c60  WfpLwf - ok
21:44:57.0720 0x0c60  [ 05ECAEC3E4529A7153B3136CEB49F0EC, 9995CB2CEC70A633EA33CBB0DEAD2BB28CB67132B41E9444BDAB9E75744C9A50 ] WIMMount        C:\windows\system32\drivers\wimmount.sys
21:44:57.0730 0x0c60  WIMMount - ok
21:44:57.0750 0x0c60  WinDefend - ok
21:44:57.0750 0x0c60  WinHttpAutoProxySvc - ok
21:44:57.0810 0x0c60  [ 19B07E7E8915D701225DA41CB3877306, D6555E8D276DBB11358246E0FE215F76F1FB358791C76B88D82C2A66A42DA19F ] Winmgmt         C:\windows\system32\wbem\WMIsvc.dll
21:44:57.0840 0x0c60  Winmgmt - ok
21:44:57.0900 0x0c60  [ D929ABD465A2DED963DA8B30946A8D5C, DE8DBFB01C11D2AE903CBD6A974D6F995E9813CE2D6484B7DA06EAE4C545842A ] WinRM           C:\windows\system32\WsmSvc.dll
21:44:57.0970 0x0c60  WinRM - ok
21:44:58.0010 0x0c60  [ FE88B288356E7B47B74B13372ADD906D, A16B166F6BB32EF9D2A142F27B9EC54CBC7B3AC915799783CF4C40E525BC9E03 ] WinUsb          C:\windows\system32\drivers\WinUsb.sys
21:44:58.0050 0x0c60  WinUsb - ok
21:44:58.0090 0x0c60  [ 4FADA86E62F18A1B2F42BA18AE24E6AA, CE1683386886BF34862681A46199EA7E7FB4232A186047DA7FBD8EC240AF6726 ] Wlansvc         C:\windows\System32\wlansvc.dll
21:44:58.0120 0x0c60  Wlansvc - ok
21:44:58.0150 0x0c60  [ 06C8FA1CF39DE6A735B54D906BA791C6, D8FEC7DE227781CDA876904701B2AA995268F74DCD6CB34AA0296C557FC283B6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
21:44:58.0170 0x0c60  wlcrasvc - ok
21:44:58.0270 0x0c60  [ 2BACD71123F42CEA603F4E205E1AE337, 1FEF20554110371D738F462ECFFA999158EFEED02062414C58C1B61C422BF0B9 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
21:44:58.0320 0x0c60  wlidsvc - ok
21:44:58.0330 0x0c60  [ F6FF8944478594D0E414D3F048F0D778, 6F75E0AE6127B33A92A88E59D4B048FD4C15F997807BE7BF0EFE76F95235B1D9 ] WmiAcpi         C:\windows\system32\drivers\wmiacpi.sys
21:44:58.0340 0x0c60  WmiAcpi - ok
21:44:58.0360 0x0c60  [ 38B84C94C5A8AF291ADFEA478AE54F93, 1AC267AC73670BEA5F3785C9AD9DB146F8E993A862C843742B21FDB90D102B2A ] wmiApSrv        C:\windows\system32\wbem\WmiApSrv.exe
21:44:58.0380 0x0c60  wmiApSrv - ok
21:44:58.0410 0x0c60  WMPNetworkSvc - ok
21:44:58.0430 0x0c60  [ 96C6E7100D724C69FCF9E7BF590D1DCA, 2E63C9B0893B4FC03B7A71BAEA6202D3D3DB1B52F3643467829B5A573FD7655B ] WPCSvc          C:\windows\System32\wpcsvc.dll
21:44:58.0450 0x0c60  WPCSvc - ok
21:44:58.0460 0x0c60  [ 93221146D4EBBF314C29B23CD6CC391D, C0750858A65BF51E210CD244C825C121D67E025CD2D2455139991AAC289A90FE ] WPDBusEnum      C:\windows\system32\wpdbusenum.dll
21:44:58.0480 0x0c60  WPDBusEnum - ok
21:44:58.0500 0x0c60  [ 6BCC1D7D2FD2453957C5479A32364E52, E48554D31FBDCF8F985C1C72524CAA9106F5B7CC2B79064F8F5E2562D517F090 ] ws2ifsl         C:\windows\system32\drivers\ws2ifsl.sys
21:44:58.0530 0x0c60  ws2ifsl - ok
21:44:58.0540 0x0c60  [ E8B1FE6669397D1772D8196DF0E57A9E, 39FE0819360719F756BD31A1884A0508A1E2371ACC723E25E005CBEC0A7B02FA ] wscsvc          C:\windows\System32\wscsvc.dll
21:44:58.0560 0x0c60  wscsvc - ok
21:44:58.0590 0x0c60  [ 8D918B1DB190A4D9B1753A66FA8C96E8, DB7D2714DC04D2D6999A207D7399A5647C8653E5A1AD80856A65C5B6065AEDFE ] WSDPrintDevice  C:\windows\system32\DRIVERS\WSDPrint.sys
21:44:58.0610 0x0c60  WSDPrintDevice - ok
21:44:58.0640 0x0c60  [ 4A2A5C50DD1A63577D3ACA94269FBC7F, F75C1906D431CF871AD954218DF32A0F206E45FF49332DEF9F13C0A36A407047 ] WSDScan         C:\windows\system32\DRIVERS\WSDScan.sys
21:44:58.0660 0x0c60  WSDScan - ok
21:44:58.0660 0x0c60  WSearch - ok
21:44:58.0750 0x0c60  [ 86F11B85102AFA6A1A6101DCE2F09386, 68A0F0E628C8F33FDAC114876DA8ED14776DD74E80AC5A6A52257E19DE011091 ] wuauserv        C:\windows\system32\wuaueng.dll
21:44:58.0820 0x0c60  wuauserv - ok
21:44:58.0840 0x0c60  [ AB886378EEB55C6C75B4F2D14B6C869F, D6C4602EB8F291DADEDF3CD211013D4AC752DDE7E799C2D8D74AA4F5477CAED6 ] WudfPf          C:\windows\system32\drivers\WudfPf.sys
21:44:58.0880 0x0c60  WudfPf - ok
21:44:58.0900 0x0c60  [ DDA4CAF29D8C0A297F886BFE561E6659, 94E5DD649B5D86FA1A7C7D30FCF9644D0EE048D312E626111458ADF66BFBE978 ] WUDFRd          C:\windows\system32\DRIVERS\WUDFRd.sys
21:44:58.0920 0x0c60  WUDFRd - ok
21:44:58.0940 0x0c60  [ B20F051B03A966392364C83F009F7D17, 88ECEB55AE91F58F592B96EBC10B572747D5A2F9B7629E8F371761E4F7408A65 ] wudfsvc         C:\windows\System32\WUDFSvc.dll
21:44:58.0960 0x0c60  wudfsvc - ok
21:44:58.0980 0x0c60  [ 04F82965C09CBDF646B487E145060301, 2CD8533EDBE24C3E42EB7550E20F8A2EB9E5E345B165DEF543163A6BC1FDD18B ] WwanSvc         C:\windows\System32\wwansvc.dll
21:44:59.0010 0x0c60  WwanSvc - ok
21:44:59.0030 0x0c60  ================ Scan global ===============================
21:44:59.0060 0x0c60  [ 168EA9CD9BD6056BB6F60B57D5304BBE, 5A2F98754F042A7D80E7483842967EB362F01D57CE9720B24C7EDAA047F24C6F ] C:\windows\system32\basesrv.dll
21:44:59.0090 0x0c60  [ E0E4D286839FC27F56A85B4710E16B6B, 6BBBADB8904D6159E6171A339E0BF30A41D14E885D560BFB8BB73B1FF7239E1A ] C:\windows\system32\winsrv.dll
21:44:59.0100 0x0c60  [ E0E4D286839FC27F56A85B4710E16B6B, 6BBBADB8904D6159E6171A339E0BF30A41D14E885D560BFB8BB73B1FF7239E1A ] C:\windows\system32\winsrv.dll
21:44:59.0120 0x0c60  [ D6160F9D869BA3AF0B787F971DB56368, 0033E6212DD8683E4EE611B290931FDB227B4795F0B17C309DC686C696790529 ] C:\windows\system32\sxssrv.dll
21:44:59.0140 0x0c60  [ 71C85477DF9347FE8E7BC55768473FCA, A86D6A6D1F5A0EFCD649792A06F3AE9B37158D48493D2ECA7F52DCC1CB9B6536 ] C:\windows\system32\services.exe
21:44:59.0150 0x0c60  [ Global ] - ok
21:44:59.0150 0x0c60  ================ Scan MBR ==================================
21:44:59.0150 0x0c60  [ 5FB38429D5D77768867C76DCBDB35194 ] \Device\Harddisk0\DR0
21:44:59.0230 0x0c60  \Device\Harddisk0\DR0 - ok
21:44:59.0230 0x0c60  ================ Scan VBR ==================================
21:44:59.0230 0x0c60  [ 5A272DD397B57E5C22DDC4202909A4E8 ] \Device\Harddisk0\DR0\Partition1
21:44:59.0300 0x0c60  \Device\Harddisk0\DR0\Partition1 - ok
21:44:59.0320 0x0c60  [ B1E27AA018409DE6BFD73F8AFB883A65 ] \Device\Harddisk0\DR0\Partition2
21:44:59.0320 0x0c60  \Device\Harddisk0\DR0\Partition2 - ok
21:44:59.0330 0x0c60  [ 887CEC3786FA57ED98F3A2DA19A727FA ] \Device\Harddisk0\DR0\Partition3
21:44:59.0380 0x0c60  \Device\Harddisk0\DR0\Partition3 - ok
21:44:59.0400 0x0c60  [ 3F76AA1810779CB094C95DB4BDFCC95A ] \Device\Harddisk0\DR0\Partition4
21:44:59.0440 0x0c60  \Device\Harddisk0\DR0\Partition4 - ok
21:44:59.0460 0x0c60  [ 862B798EA82B0F1B43F96DC8E6E79CD5 ] \Device\Harddisk0\DR0\Partition5
21:44:59.0460 0x0c60  \Device\Harddisk0\DR0\Partition5 - ok
21:44:59.0460 0x0c60  ================ Scan generic autorun ======================
21:44:59.0540 0x0c60  [ 47F36E94A5A6A1592E27CB44901B4DA4, BF8F79147C6DAA64D2400FE0606B3CF041F2F97C4B4A6356AF7AE9FD053687EA ] C:\Program Files\IDT\WDM\sttray64.exe
21:44:59.0580 0x0c60  SysTrayApp - detected UnsignedFile.Multi.Generic ( 1 )
21:44:59.0680 0x0c60  Detect skipped due to KSN trusted
21:44:59.0680 0x0c60  SysTrayApp - ok
21:44:59.0690 0x0c60  [ 0D997D69A624B2A04EED0B64F2092642, 67B34F6EDF0BA7C2C2BD11D6F8423FAB7AE6D7672220AACE31B632081EA25E35 ] C:\Program Files\IDT\WDM\beats64.exe
21:44:59.0700 0x0c60  BeatsOSDApp - detected UnsignedFile.Multi.Generic ( 1 )
21:44:59.0800 0x0c60  Detect skipped due to KSN trusted
21:44:59.0800 0x0c60  BeatsOSDApp - ok
21:44:59.0830 0x0c60  [ 554A50B5310E702029D3A675459108FF, 4757D5FFFAC7E73D4A3D931DB1399DDFDBD5811639BDA4517F886C21CC7F2574 ] C:\Program Files (x86)\Hewlett-Packard\HP Odometer\HPSYSDRV.EXE
21:44:59.0860 0x0c60  HPSYSDRV - ok
21:44:59.0900 0x0c60  [ 1BF113E377E570DB915EE7D228E594D6, FF4D198D412CA21C49E0A3E6FE52EAD69786B305429095B5BD25CB4FAFD33B51 ] C:\Program Files\iTunes\iTunesHelper.exe
21:44:59.0930 0x0c60  iTunesHelper - ok
21:45:00.0000 0x0c60  [ DD7B4F9E6B71A599FEF4BD9DA0AE57C2, 6B22356F74F7ED069A3FC39C62326AA98A70D0E860A2EB29A6C46F4077FB567A ] c:\Program Files\Microsoft Security Client\msseces.exe
21:45:00.0050 0x0c60  MSC - ok
21:45:00.0110 0x0c60  [ 680ABE0FF3AF74DE9856174DB6A2C497, ACD949B63FFCCB7E06ADB835209B684EE89F9D28A02CAD2B1768BCA2D2AC21E0 ] C:\Program Files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
21:45:00.0150 0x0c60  StartCCC - ok
21:45:00.0160 0x0c60  AMD AVT - ok
21:45:00.0200 0x0c60  [ D3E69D500466C17498AAF7F83D12FFF0, F5723FC28396489EADDDCAD67A0E46B56D859590823E3CFA7254BA6709DC5AE6 ] C:\Program Files (x86)\Symantec\Norton Online Backup\NOBuClient.exe
21:45:00.0250 0x0c60  Norton Online Backup - ok
21:45:00.0250 0x0c60  Easybits Recovery - ok
21:45:00.0290 0x0c60  [ FE821F6FA60E9DF9FDEE69A23488BBAB, 98D9926152FDA45705F5E208D7236E467CAEEF83D756A14B4104EBF804644B29 ] C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe
21:45:00.0320 0x0c60  Adobe ARM - ok
21:45:00.0350 0x0c60  [ 9F3B239443E7AF5840454D8D3A0772CF, 82E135AA844B3170D030CE27259BF7BACBA1FA18670C10B74BD3F402CA9AD29E ] C:\Program Files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe
21:45:00.0360 0x0c60  APSDaemon - ok
21:45:00.0480 0x0c60  [ 6B115CE521D96900373775ECAC975D59, 9E915F95AFBAABA418B30AAEEEEDA8A127AFD0C2EBD899AACF7AC9A8013F8413 ] C:\Program Files (x86)\Samsung\Kies\KiesTrayAgent.exe
21:45:00.0550 0x0c60  KiesTrayAgent - ok
21:45:00.0650 0x0c60  [ 1F628583C0F01E214AE45C8791B55010, 9544F1241F802D5F75D19D07886E8A93E6280F6E87415E6E0A0C1F420A433763 ] C:\ProgramData\Easybits Magic Desktop for HP\mdhpSUN.exe
21:45:00.0690 0x0c60  Magic Desktop for HP notification - ok
21:45:00.0740 0x0c60  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
21:45:00.0800 0x0c60  Sidebar - ok
21:45:00.0820 0x0c60  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
21:45:00.0870 0x0c60  mctadmin - ok
21:45:00.0890 0x0c60  [ DCCA4B04AF87E52EF9EAA2190E06CBAC, 8858CFD159BB32AE9FCCA1A79EA83C876D481A286E914071D48F42FCA5B343D8 ] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe
21:45:00.0920 0x0c60  Sidebar - ok
21:45:00.0920 0x0c60  [ 0FA760BF380B08D0B67B5507CD8B32AA, 0F73A7F64C4FDAB98CD3A865CC54B3A7195761530FCB115B725CC5A9FB738739 ] C:\Windows\System32\mctadmin.exe
21:45:00.0940 0x0c60  mctadmin - ok
21:45:00.0980 0x0c60  GoogleDriveSync - ok
21:45:01.0040 0x0c60  [ 70C305067B3D543870597C57F74D9EC3, CF25EB4D61A387E61B6C301AEEBD5B8EBF8AFC372A7001F53979521AA4758098 ] C:\Program Files (x86)\Samsung\Kies\Kies.exe
21:45:01.0070 0x0c60  KiesPreload - ok
21:45:01.0070 0x0c60  KiesAirMessage - ok
21:45:01.0110 0x0c60  [ 8E689D83B243C229A683559FF98CF047, DC3D08CDD5EFF7EF81CB75AF4F354878CDC78CAE8FC8A2CFD143EE4F26DA1D3E ] C:\Program Files (x86)\Samsung\Kies\External\FirmwareUpdate\KiesPDLR.exe
21:45:01.0140 0x0c60  KiesPDLR - ok
21:45:01.0140 0x0c60  Waiting for KSN requests completion. In queue: 95
21:45:02.0150 0x0c60  AV detected via SS2: Norton Internet Security, C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\WSCStub.exe ( 22.7.0.0 ), 0x51000 ( enabled : updated )
21:45:02.0150 0x0c60  AV detected via SS2: Microsoft Security Essentials, C:\Program Files\Microsoft Security Client\msseces.exe ( 4.9.218.0 ), 0x61000 ( enabled : updated )
21:45:02.0160 0x0c60  FW detected via SS2: Norton Internet Security, C:\Program Files (x86)\Norton Internet Security\Engine\22.7.0.76\WSCStub.exe ( 22.7.0.0 ), 0x51010 ( enabled )
21:45:02.0341 0x0c60  ============================================================
21:45:02.0341 0x0c60  Scan finished
21:45:02.0341 0x0c60  ============================================================
21:45:02.0341 0x22b8  Detected object count: 0
21:45:02.0341 0x22b8  Actual detected object count: 0
         
__________________


Alt 02.07.2016, 12:41   #3
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Hallo zusammen,

ich bin's nochmal.
Kann mir denn niemand helfen?
Interesse am Thema scheinen einige zu haben, mit Hilfe wird's dann schon schwieriger...

Bitte meldet euch wenn ihr Tipps oder die Lösung habt ;-)

Viele Grüße,
Emroi
__________________

Alt 02.07.2016, 15:36   #4
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Zitat:
Verschlüsselungstrojaner: CryptXXX 3.0
Decryptor gibt es aktuell wohl noch nicht.
Du hast diese Seite besucht und gecheckt mit welchem ransom du es zu tun hast? => https://id-ransomware.malwarehunterteam.com/

Wenn es keine decryptor gibt hast du Pech gehabt....mit etwas Glück gibt es dann vllt irgendwann einen decryptor. Dann musst du die verschlüsselten Dateien aufbewahren, also die "original" von diesem ransom verschlüsselten Dateien, nicht die Dateien, die durch deine ersten Versuche der Entschlüsselung entstanden sind.

Zitat:
Mein Anliegen ist nun folgendes:
1. Ist mein Rechner wirklich sauber?
2. Wie kann ich die Dateien wieder entschlüsseln?
Deinen Rechner kann man bereinigen, aber die Entschlüsselung hängt davon ab, ob es einen decryptor gibt. Besuch erstmal die o.g. Seite und prüf das nochmal.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 03.07.2016, 09:20   #5
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Hallo Cosinus,

danke dir für deine Rückmeldung.
Genau so ist es. Ich habe es (soeben ein weiteres mal) auf der id-ramsomware Seite gecheckt und daher auch den Namen des Trojaners erfahren.
Leider ist nach wie vor kein Decryptor bekannt.

Werde nun die Dateien sichern.
Allerdings wäre ich natürlich sehr daran interessiert zu wissen, ob das System mittlerweile vollständig sauber ist. Deshalb habe ich die Logs angehängt.

Danke dir & viele Grüße,
Emroi


Alt 04.07.2016, 10:01   #6
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Zuerst mal würde ich mich von diesem Schrott trennen:

Zitat:
AV: Norton Internet Security
Norton haben wir noch nie empfohlen. Sag Bescheid wenn es runter ist, dann gehts weiter. Wenn wir hier durch sind, kannst du ein anderes AV installieren/verwenden
__________________
--> CryptXXX 3.0: Alle Files auf .crypz verschlüsselt

Alt 04.07.2016, 10:05   #7
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Hi Cosinus,

OK, verstanden... Uninstall Norton Internet Security.
Mache ich heute Abend. Hast du gleich eine andere Empfehlung für mich, oder soll ich bis zur letztlichen Bereinigung des Systems im "Blindflug" unterwegs bleiben?

Danke dir für deine Unterstützung,
Emroi

Alt 04.07.2016, 10:10   #8
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Das Teil wird deinstalliert, dann analysieren wir und zum Schluss kommt erst ein AV wieder drauf.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 04.07.2016, 19:07   #9
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Super, danke dir. Ich melde mich heute Abend. Bis dahin

Hallo Cosinus,

Uninstall läuft...

... und ist erfolgreich durch.
Warte nun auf deine Instruktionen.

Viele Grüße,
Emroi

Alt 04.07.2016, 19:23   #10
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



dann weiter mit MBAR, Log bitte richtig in CODE-Tags posten


Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 04.07.2016, 20:03   #11
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



OK, der Scan läuft...
Ich nehme an der dauert eine Weile...

Hi Cosinus,

ist durch... keine Findings.

Hier die Logdatei:
Code:
ATTFilter
Malwarebytes Anti-Rootkit BETA 1.9.3.1001
www.malwarebytes.org

Database version:
  main:    v2016.07.04.06
  rootkit: v2016.05.27.01

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 11.0.9600.18349
MReuter :: REUTER [administrator]

04.07.2016 19:25:10
mbar-log-2016-07-04 (19-25-10).txt

Scan type: Quick scan
Scan options enabled: Anti-Rootkit | Drivers | MBR | Physical Sectors | Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken
Scan options disabled: 
Objects scanned: 337714
Time elapsed: 29 minute(s), 14 second(s)

Memory Processes Detected: 0
(No malicious items detected)

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 0
(No malicious items detected)

Registry Values Detected: 0
(No malicious items detected)

Registry Data Items Detected: 0
(No malicious items detected)

Folders Detected: 0
(No malicious items detected)

Files Detected: 0
(No malicious items detected)

Physical Sectors Detected: 0
(No malicious items detected)

(end)
         

Alt 04.07.2016, 22:37   #12
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Wir können scannen wie wir wollen...da wird nix mehr vom ransom sein. Das ist auch nicht die Intention von ransoms. Die haben ihr Werk bei dir schon verrichtet.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 05.07.2016, 11:10   #13
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Hallo Cosinus,

das ist ja zumindest ein Teilerfolg (sauberes System).
Bleiben "nur" noch zwei Fragen:
1. Empfehlung Alternative zu "Norton Internet Security".
2. Entschlüsselung der Dateien.

Ich habe gelernt, dass ich zu 2. zunächst alle verschlüsselten Files "archivieren" und auf eine Decrypt-Software warten soll... So werd ich es machen.
Wenn du mir zu 1. noch ein Statement liefern könntest wäre das klasse.

Danke dir & viele Grüße,
Emroi

Alt 05.07.2016, 11:43   #14
cosinus
/// Winkelfunktion
/// TB-Süch-Tiger™
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Lesestoff:
Virenscanner

Verwende ein einziges der folgenden Antivirusprogramme mit Echtzeitscanner und stets aktueller Signaturendatenbank:

   
 

Microsoft Security Essentials (MSE) ist ab Windows 8 fest eingebaut, wenn du also Windows 8, 8.1 oder 10 und dich für MSE entschieden hast, brauchst du nicht extra MSE zu installieren. Bei Windows 7 muss es aber manuell installiert oder über die Windows Updates als optionales Update bezogen werden. Selbstverständlich ist ein legales/aktiviertes Windows Voraussetzung dafür.

Zusätzlich kannst Du Deinen PC regelmäßig mit Malwarebytes Anti-Malware und/oder mit dem ESET Online Scanner scannen.

Optional:

NoScript verhindert das Ausführen von aktiven Inhalten (Java, JavaScript, Flash,...) für sämtliche Websites. Man kann aber nach dem Prinzip einer Whitelist festlegen, auf welchen Seiten Scripts erlaubt werden sollen. NoScript kann gerade bei technisch nicht allzu versierten Nutzern beim Surfen zum Nervfaktor werden; ob das Tool geeignet ist, muss jeder selbst mal ausprobieren und dann für sich entscheiden. Alternativen zu NoScript (wenn um das das Verhindern von Usertracking und Werbung auf Webseiten) geht wären da Ghostery oder uBlock. Ghostery ist eine sehr bekannte Erweiterung, die aber auch in Kritik geraten ist, vgl. dazu bitte diesen Thread => Ghostery schleift Werbung durch

Malwarebytes Anti Exploit: Schützt die Anwendungen des Computers vor der Ausnutzung bekannter Schwachstellen.
__________________
"Die Wahrheit ist normalerweise nur eine Entschuldigung für einen Mangel an Fantasie." (Elim Garak)

Das Trojaner-Board unterstützen
Warum Linux besser als Windows ist!

Alt 19.07.2016, 14:52   #15
Emroi
 
CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Standard

CryptXXX 3.0: Alle Files auf .crypz verschlüsselt



Hallo zusammen,

bin seit längerer Zeit mal wieder hier und habe zumindest für mich super Nachrichten...
Ich schreibe das hier, weil ich all denen, die ebenfalls von einer Verschlüsselung betroffen sind Mut machen und für Geduld werben möchte.

Meine Files sind mittlerweile wieder entschlüsselt, da ich das unglaubliche Glück hatte zu denen zu gehören, deren Keys fälschlicherweise ohne Bezahlung veröffentlicht wurde (siehe hier: Erpressungs-Trojaner CryptXXX rutscht Schlüssel kostenlos raus | heise Security)

Manchmal hat man eben auch mal Glück!

Deshalb: Sichert eure verschlüsselten Daten, schaut auf die "Erpresserseite" und mit etwas Glück gehört ihr auch dazu. Falls nicht bleibt nur Geduld zu haben und immer wieder die News zu verfolgen.

Viele Grüße,
Emroi

Antwort

Themen zu CryptXXX 3.0: Alle Files auf .crypz verschlüsselt
beiträge, dateien, dnsapi.dll, eingefangen, entfernt, entschlüsseln, erfolgreich, essen, files, folge, folgendes, fordert, gen, hallo zusammen, logfiles, meinung, microsoft, rechner, sauber, schlüsseln, security, tool, trojaner, wirklich, zusammen, öffnen



Ähnliche Themen: CryptXXX 3.0: Alle Files auf .crypz verschlüsselt


  1. CRYPTXXX Virus mit Endung crypz
    Plagegeister aller Art und deren Bekämpfung - 23.06.2016 (1)
  2. xipr.alle Word-dokumente verschlüsselt
    Log-Analyse und Auswertung - 22.06.2016 (1)
  3. CryptXXX 3.0 ransomware (.CRYPZ Files Encrypted) entfernen
    Anleitungen, FAQs & Links - 04.06.2016 (2)
  4. Verflixt Alle Plain Textdateien (html,htm,php,ini usw.) und rar-Files verschlüsselt aber ohne locked eintrag
    Diskussionsforum - 03.08.2015 (46)
  5. ROTO Virus verschlüsselt alle Dateien
    Plagegeister aller Art und deren Bekämpfung - 30.06.2015 (3)
  6. Alle Dokumente aufeinmal verschlüsselt?
    Alles rund um Windows - 07.01.2014 (4)
  7. DirtyDecrypt.exe auf ext. HDD - Files verschlüsselt
    Plagegeister aller Art und deren Bekämpfung - 11.06.2013 (2)
  8. alle Babybilder meines Sohnes verschlüsselt :-(
    Plagegeister aller Art und deren Bekämpfung - 05.02.2013 (1)
  9. Polizeitrojaner hat alle Bilder verschlüsselt
    Plagegeister aller Art und deren Bekämpfung - 21.01.2013 (1)
  10. Ucash Trojaner - alle Datein verschlüsselt
    Plagegeister aller Art und deren Bekämpfung - 13.09.2012 (2)
  11. BKA Trojaner - alle Dateien verschlüsselt
    Plagegeister aller Art und deren Bekämpfung - 23.07.2012 (1)
  12. Trojaner hat alle Daten verschlüsselt
    Plagegeister aller Art und deren Bekämpfung - 27.06.2012 (2)
  13. Trojaner Alle Dateien verschlüsselt
    Log-Analyse und Auswertung - 06.06.2012 (4)
  14. Trojaner 1.140.1, Alle Dateien verschlüsselt
    Log-Analyse und Auswertung - 02.06.2012 (1)
  15. Verschlüsselungstrojaner, alle Daten und Photos verschlüsselt
    Plagegeister aller Art und deren Bekämpfung - 24.05.2012 (1)
  16. alle doc-Dateien verschlüsselt
    Plagegeister aller Art und deren Bekämpfung - 22.05.2012 (7)
  17. Microsoft Windows Lizenzierung - Alle Dokumente verschlüsselt
    Plagegeister aller Art und deren Bekämpfung - 22.05.2012 (5)

Zum Thema CryptXXX 3.0: Alle Files auf .crypz verschlüsselt - Hallo zusammen, auch ich habe mir offensichtlich den Trojaner CryptXXX 3.0 eingefangen, der mir alle Dateien mit RSA-4096 verschlüsselt hat. Dateiendung <Originalname>.crypt. Habe bereits mehrere Maßnahmen unternommen, wobei Microsoft Security - CryptXXX 3.0: Alle Files auf .crypz verschlüsselt...
Archiv
Du betrachtest: CryptXXX 3.0: Alle Files auf .crypz verschlüsselt auf Trojaner-Board

Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.