Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Windows wurde blockiert - 50 Euro Virus (https://www.trojaner-board.de/112693-windows-wurde-blockiert-50-euro-virus.html)

cosinus 04.04.2012 12:31
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten, Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Hackel 04.04.2012 14:40
Hier das log.

Code:
15:32:53.0918 3748        TDSS rootkit removing tool 2.7.25.0 Apr  3 2012 13:42:32
15:32:55.0918 3748        ============================================================
15:32:55.0918 3748        Current date / time: 2012/04/04 15:32:55.0918
15:32:55.0918 3748        SystemInfo:
15:32:55.0918 3748       
15:32:55.0918 3748        OS Version: 6.1.7601 ServicePack: 1.0
15:32:55.0918 3748        Product type: Workstation
15:32:55.0918 3748        ComputerName: ADMIN-PC
15:32:55.0918 3748        UserName: Admin
15:32:55.0918 3748        Windows directory: C:\Windows
15:32:55.0918 3748        System windows directory: C:\Windows
15:32:55.0918 3748        Running under WOW64
15:32:55.0918 3748        Processor architecture: Intel x64
15:32:55.0918 3748        Number of processors: 2
15:32:55.0918 3748        Page size: 0x1000
15:32:55.0918 3748        Boot type: Normal boot
15:32:55.0918 3748        ============================================================
15:32:56.0822 3748        Drive \Device\Harddisk0\DR0 - Size: 0x4A85D56000 (298.09 Gb), SectorSize: 0x200, Cylinders: 0x9801, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
15:32:56.0832 3748        \Device\Harddisk0\DR0:
15:32:56.0832 3748        MBR used
15:32:56.0832 3748        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1770800, BlocksNum 0x32000
15:32:56.0832 3748        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x17A2800, BlocksNum 0x12A9F2B0
15:32:56.0852 3748        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x14242800, BlocksNum 0x111EB800
15:32:56.0922 3748        Initialize success
15:32:56.0922 3748        ============================================================
15:34:32.0308 6336        ============================================================
15:34:32.0308 6336        Scan started
15:34:32.0308 6336        Mode: Manual; SigCheck; TDLFS;
15:34:32.0308 6336        ============================================================
15:34:33.0556 6336        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
15:34:33.0837 6336        1394ohci - ok
15:34:34.0196 6336        acedrv07        (6e9c8b324980afe454c6f7762e2b4478) C:\Windows\system32\drivers\acedrv07.sys
15:34:34.0274 6336        acedrv07 ( UnsignedFile.Multi.Generic ) - warning
15:34:34.0274 6336        acedrv07 - detected UnsignedFile.Multi.Generic (1)
15:34:34.0570 6336        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
15:34:34.0602 6336        ACPI - ok
15:34:34.0882 6336        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
15:34:35.0506 6336        AcpiPmi - ok
15:34:36.0021 6336        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
15:34:36.0068 6336        adp94xx - ok
15:34:36.0411 6336        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
15:34:36.0458 6336        adpahci - ok
15:34:36.0770 6336        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
15:34:36.0817 6336        adpu320 - ok
15:34:37.0051 6336        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
15:34:38.0002 6336        AeLookupSvc - ok
15:34:38.0314 6336        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
15:34:38.0502 6336        AFD - ok
15:34:38.0642 6336        AgereModemAudio (b65f8dba54f251906bbe8611b5a0e7ab) C:\Program Files\LSI SoftModem\agr64svc.exe
15:34:38.0798 6336        AgereModemAudio - ok
15:34:39.0001 6336        AgereSoftModem  (2173e070647ac68c16b8214fe5c05ec3) C:\Windows\system32\DRIVERS\agrsm64.sys
15:34:39.0110 6336        AgereSoftModem - ok
15:34:39.0313 6336        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
15:34:39.0328 6336        agp440 - ok
15:34:39.0484 6336        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
15:34:39.0687 6336        ALG - ok
15:34:39.0859 6336        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
15:34:39.0890 6336        aliide - ok
15:34:40.0108 6336        AMD External Events Utility (f238be4fa4e55eb67f17281fadf69851) C:\Windows\system32\atiesrxx.exe
15:34:40.0202 6336        AMD External Events Utility - ok
15:34:40.0342 6336        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
15:34:40.0358 6336        amdide - ok
15:34:40.0498 6336        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
15:34:40.0608 6336        AmdK8 - ok
15:34:40.0732 6336        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
15:34:40.0810 6336        AmdPPM - ok
15:34:40.0935 6336        amdsata        (12a5062c06e03ff70db47800f91c7a13) C:\Windows\system32\DRIVERS\amdsata.sys
15:34:41.0060 6336        amdsata - ok
15:34:41.0185 6336        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
15:34:41.0216 6336        amdsbs - ok
15:34:41.0341 6336        amdxata        (8a7f289b45ceacac761e14d5fac59eb9) C:\Windows\system32\DRIVERS\amdxata.sys
15:34:41.0356 6336        amdxata - ok
15:34:41.0403 6336        amd_sata        (f9d46b6b322708bd5afcc8767ebdc901) C:\Windows\system32\DRIVERS\amd_sata.sys
15:34:41.0419 6336        amd_sata - ok
15:34:41.0466 6336        amd_xata        (329cc9c7e20deebcd4cd10816193ef14) C:\Windows\system32\DRIVERS\amd_xata.sys
15:34:41.0466 6336        amd_xata - ok
15:34:41.0559 6336        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
15:34:41.0902 6336        AppID - ok
15:34:42.0012 6336        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
15:34:42.0136 6336        AppIDSvc - ok
15:34:42.0199 6336        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
15:34:42.0308 6336        Appinfo - ok
15:34:42.0448 6336        Apple Mobile Device (3debbecf665dcdde3a95d9b902010817) C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
15:34:42.0480 6336        Apple Mobile Device - ok
15:34:42.0604 6336        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
15:34:42.0636 6336        arc - ok
15:34:42.0651 6336        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
15:34:42.0667 6336        arcsas - ok
15:34:42.0823 6336        aspnet_state    (9217d874131ae6ff8f642f124f00a555) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
15:34:42.0979 6336        aspnet_state - ok
15:34:43.0119 6336        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
15:34:43.0228 6336        AsyncMac - ok
15:34:43.0494 6336        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
15:34:43.0525 6336        atapi - ok
15:34:43.0665 6336        athr            (0acc06fcf46f64ed4f11e57ee461c1f4) C:\Windows\system32\DRIVERS\athrx.sys
15:34:43.0806 6336        athr - ok
15:34:43.0993 6336        AtiHdmiService  (3b9014fb7ce9e20fd726321c7db7d8b0) C:\Windows\system32\drivers\AtiHdmi.sys
15:34:44.0024 6336        AtiHdmiService - ok
15:34:44.0305 6336        atikmdag        (2db9047aac9d981f59ce06d04d70c4d8) C:\Windows\system32\DRIVERS\atikmdag.sys
15:34:44.0554 6336        atikmdag - ok
15:34:44.0695 6336        AtiPcie        (7c5d273e29dcc5505469b299c6f29163) C:\Windows\system32\DRIVERS\AtiPcie.sys
15:34:44.0710 6336        AtiPcie - ok
15:34:44.0788 6336        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
15:34:44.0913 6336        AudioEndpointBuilder - ok
15:34:44.0960 6336        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
15:34:45.0054 6336        AudioSrv - ok
15:34:45.0116 6336        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
15:34:45.0241 6336        AxInstSV - ok
15:34:45.0319 6336        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
15:34:45.0412 6336        b06bdrv - ok
15:34:45.0475 6336        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
15:34:45.0568 6336        b57nd60a - ok
15:34:45.0631 6336        BCM43XX        (9e84a931dbee0292e38ed672f6293a99) C:\Windows\system32\DRIVERS\bcmwl664.sys
15:34:45.0802 6336        BCM43XX - ok
15:34:45.0927 6336        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
15:34:46.0005 6336        BDESVC - ok
15:34:46.0099 6336        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
15:34:46.0192 6336        Beep - ok
15:34:46.0255 6336        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
15:34:46.0364 6336        BFE - ok
15:34:46.0598 6336        BHDrvx64        (6c64fa457c200874faa87d74152e0d84) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\BASHDefs\20120317.002\BHDrvx64.sys
15:34:46.0692 6336        BHDrvx64 - ok
15:34:46.0816 6336        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
15:34:46.0926 6336        BITS - ok
15:34:47.0004 6336        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
15:34:47.0050 6336        blbdrive - ok
15:34:47.0175 6336        Bonjour Service (ebbcd5dfbb1de70e8f4af8fa59e401fd) C:\Program Files\Bonjour\mDNSResponder.exe
15:34:47.0206 6336        Bonjour Service - ok
15:34:47.0331 6336        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
15:34:47.0378 6336        bowser - ok
15:34:47.0440 6336        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
15:34:47.0487 6336        BrFiltLo - ok
15:34:47.0503 6336        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
15:34:47.0518 6336        BrFiltUp - ok
15:34:47.0565 6336        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
15:34:47.0612 6336        Browser - ok
15:34:47.0659 6336        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
15:34:47.0737 6336        Brserid - ok
15:34:47.0768 6336        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
15:34:47.0799 6336        BrSerWdm - ok
15:34:47.0815 6336        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
15:34:47.0862 6336        BrUsbMdm - ok
15:34:47.0877 6336        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
15:34:47.0893 6336        BrUsbSer - ok
15:34:47.0908 6336        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
15:34:47.0940 6336        BTHMODEM - ok
15:34:47.0971 6336        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
15:34:48.0049 6336        bthserv - ok
15:34:48.0174 6336        ccHP            (37f1baec39b505b3b51893a35c8337ea) C:\Windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys
15:34:48.0220 6336        ccHP - ok
15:34:48.0283 6336        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
15:34:48.0376 6336        cdfs - ok
15:34:48.0439 6336        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
15:34:48.0486 6336        cdrom - ok
15:34:48.0564 6336        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
15:34:48.0657 6336        CertPropSvc - ok
15:34:48.0704 6336        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
15:34:48.0766 6336        circlass - ok
15:34:48.0829 6336        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
15:34:48.0844 6336        CLFS - ok
15:34:48.0938 6336        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
15:34:48.0969 6336        clr_optimization_v2.0.50727_32 - ok
15:34:49.0016 6336        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
15:34:49.0016 6336        clr_optimization_v2.0.50727_64 - ok
15:34:49.0125 6336        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
15:34:49.0203 6336        clr_optimization_v4.0.30319_32 - ok
15:34:49.0266 6336        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
15:34:49.0312 6336        clr_optimization_v4.0.30319_64 - ok
15:34:49.0422 6336        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
15:34:49.0468 6336        CmBatt - ok
15:34:49.0500 6336        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
15:34:49.0515 6336        cmdide - ok
15:34:49.0562 6336        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
15:34:49.0609 6336        CNG - ok
15:34:49.0656 6336        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
15:34:49.0687 6336        Compbatt - ok
15:34:49.0749 6336        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
15:34:49.0827 6336        CompositeBus - ok
15:34:49.0858 6336        COMSysApp - ok
15:34:49.0874 6336        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
15:34:49.0905 6336        crcdisk - ok
15:34:49.0968 6336        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
15:34:50.0061 6336        CryptSvc - ok
15:34:50.0124 6336        dc3d            (26c9db5fb11aa1c90ca4b7a986cca4f3) C:\Windows\system32\DRIVERS\dc3d.sys
15:34:50.0155 6336        dc3d - ok
15:34:50.0233 6336        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
15:34:50.0311 6336        DcomLaunch - ok
15:34:50.0358 6336        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
15:34:50.0436 6336        defragsvc - ok
15:34:50.0514 6336        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
15:34:50.0607 6336        DfsC - ok
15:34:50.0638 6336        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
15:34:50.0701 6336        Dhcp - ok
15:34:50.0732 6336        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
15:34:50.0826 6336        discache - ok
15:34:50.0904 6336        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
15:34:50.0919 6336        Disk - ok
15:34:51.0028 6336        DKbFltr        (d5bcb77be83cf99f508943945d46343d) C:\Windows\syswow64\Drivers\DKbFltr.sys
15:34:51.0060 6336        DKbFltr - ok
15:34:51.0091 6336        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
15:34:51.0169 6336        Dnscache - ok
15:34:51.0231 6336        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
15:34:51.0340 6336        dot3svc - ok
15:34:51.0403 6336        Dot4            (b42ed0320c6e41102fde0005154849bb) C:\Windows\system32\DRIVERS\Dot4.sys
15:34:51.0450 6336        Dot4 - ok
15:34:51.0496 6336        Dot4Print      (e9f5969233c5d89f3c35e3a66a52a361) C:\Windows\system32\drivers\Dot4Prt.sys
15:34:51.0559 6336        Dot4Print - ok
15:34:51.0606 6336        dot4usb        (fd05a02b0370bc3000f402e543ca5814) C:\Windows\system32\DRIVERS\dot4usb.sys
15:34:51.0652 6336        dot4usb - ok
15:34:51.0699 6336        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
15:34:51.0762 6336        DPS - ok
15:34:51.0808 6336        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
15:34:51.0871 6336        drmkaud - ok
15:34:51.0933 6336        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
15:34:51.0996 6336        DXGKrnl - ok
15:34:52.0058 6336        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
15:34:52.0136 6336        EapHost - ok
15:34:52.0261 6336        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
15:34:52.0432 6336        ebdrv - ok
15:34:52.0557 6336        eeCtrl          (0c3f9eff8ddd9f9eb56d754b4620155f) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\eeCtrl64.sys
15:34:52.0588 6336        eeCtrl - ok
15:34:52.0682 6336        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
15:34:52.0760 6336        EFS - ok
15:34:52.0885 6336        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
15:34:52.0994 6336        ehRecvr - ok
15:34:53.0025 6336        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
15:34:53.0088 6336        ehSched - ok
15:34:53.0212 6336        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
15:34:53.0259 6336        elxstor - ok
15:34:53.0400 6336        ePowerSvc      (fb67aa8ac61b9365add546139a21bed6) C:\Program Files\Acer\Acer ePower Management\ePowerSvc.exe
15:34:53.0462 6336        ePowerSvc - ok
15:34:53.0587 6336        EraserUtilRebootDrv (8c0f9b877bc0b7ffd327ef55f9efb642) C:\Program Files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys
15:34:53.0618 6336        EraserUtilRebootDrv - ok
15:34:53.0727 6336        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
15:34:53.0774 6336        ErrDev - ok
15:34:53.0852 6336        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
15:34:53.0946 6336        EventSystem - ok
15:34:54.0055 6336        ewusbnet        (8adacffad67394c711698ea074ce3bab) C:\Windows\system32\DRIVERS\ewusbnet.sys
15:34:54.0148 6336        ewusbnet - ok
15:34:54.0180 6336        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
15:34:54.0242 6336        exfat - ok
15:34:54.0258 6336        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
15:34:54.0304 6336        fastfat - ok
15:34:54.0382 6336        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
15:34:54.0476 6336        Fax - ok
15:34:54.0507 6336        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
15:34:54.0554 6336        fdc - ok
15:34:54.0616 6336        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
15:34:54.0710 6336        fdPHost - ok
15:34:54.0726 6336        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
15:34:54.0772 6336        FDResPub - ok
15:34:54.0835 6336        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
15:34:54.0866 6336        FileInfo - ok
15:34:54.0882 6336        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
15:34:54.0944 6336        Filetrace - ok
15:34:54.0960 6336        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
15:34:54.0991 6336        flpydisk - ok
15:34:55.0038 6336        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
15:34:55.0053 6336        FltMgr - ok
15:34:55.0116 6336        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
15:34:55.0225 6336        FontCache - ok
15:34:55.0303 6336        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
15:34:55.0334 6336        FontCache3.0.0.0 - ok
15:34:55.0396 6336        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
15:34:55.0428 6336        FsDepends - ok
15:34:55.0443 6336        Fs_Rec          (e95ef8547de20cf0603557c0cf7a9462) C:\Windows\system32\drivers\Fs_Rec.sys
15:34:55.0459 6336        Fs_Rec - ok
15:34:55.0521 6336        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
15:34:55.0568 6336        fvevol - ok
15:34:55.0615 6336        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
15:34:55.0646 6336        gagp30kx - ok
15:34:55.0724 6336        GEARAspiWDM    (e403aacf8c7bb11375122d2464560311) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
15:34:55.0740 6336        GEARAspiWDM - ok
15:34:55.0818 6336        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
15:34:55.0927 6336        gpsvc - ok
15:34:56.0052 6336        Greg_Service    (816fd5a6f3c2f3d600900096632fc60e) C:\Program Files (x86)\Acer\Registration\GregHSRW.exe
15:34:56.0114 6336        Greg_Service - ok
15:34:56.0223 6336        gupdate        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
15:34:56.0239 6336        gupdate - ok
15:34:56.0270 6336        gupdatem        (8f0de4fef8201e306f9938b0905ac96a) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
15:34:56.0286 6336        gupdatem - ok
15:34:56.0332 6336        gusvc          (cc839e8d766cc31a7710c9f38cf3e375) C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
15:34:56.0364 6336        gusvc - ok
15:34:56.0457 6336        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
15:34:56.0504 6336        hcw85cir - ok
15:34:56.0582 6336        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
15:34:56.0629 6336        HdAudAddService - ok
15:34:56.0676 6336        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
15:34:56.0738 6336        HDAudBus - ok
15:34:56.0785 6336        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
15:34:56.0847 6336        HidBatt - ok
15:34:56.0863 6336        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
15:34:56.0894 6336        HidBth - ok
15:34:56.0925 6336        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
15:34:56.0941 6336        HidIr - ok
15:34:56.0988 6336        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
15:34:57.0034 6336        hidserv - ok
15:34:57.0112 6336        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\DRIVERS\hidusb.sys
15:34:57.0144 6336        HidUsb - ok
15:34:57.0190 6336        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
15:34:57.0253 6336        hkmsvc - ok
15:34:57.0284 6336        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
15:34:57.0378 6336        HomeGroupListener - ok
15:34:57.0424 6336        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
15:34:57.0471 6336        HomeGroupProvider - ok
15:34:57.0596 6336        hpqcxs08        (0a3c6aa4a9fc38c20ba4eac2c3351c05) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
15:34:57.0643 6336        hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
15:34:57.0643 6336        hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
15:34:57.0690 6336        hpqddsvc        (75cc8c5146a3fb76221a7606628778d5) C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
15:34:57.0721 6336        hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
15:34:57.0721 6336        hpqddsvc - detected UnsignedFile.Multi.Generic (1)
15:34:57.0846 6336        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
15:34:57.0877 6336        HpSAMD - ok
15:34:58.0002 6336        HPSLPSVC        (f37882f128efacefe353e0bae2766909) C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
15:34:58.0095 6336        HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
15:34:58.0095 6336        HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
15:34:58.0220 6336        HtcVCom32      (12dd535008af8e55b13336d76e80f7f3) C:\Windows\system32\DRIVERS\HtcVComV64.sys
15:34:58.0267 6336        HtcVCom32 ( UnsignedFile.Multi.Generic ) - warning
15:34:58.0267 6336        HtcVCom32 - detected UnsignedFile.Multi.Generic (1)
15:34:58.0345 6336        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
15:34:58.0454 6336        HTTP - ok
15:34:58.0548 6336        hwdatacard      (d969d0e26c5b1e813b17066a8318d5d4) C:\Windows\system32\DRIVERS\ewusbmdm.sys
15:34:58.0594 6336        hwdatacard - ok
15:34:58.0657 6336        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
15:34:58.0672 6336        hwpolicy - ok
15:34:58.0719 6336        hwusbdev        (b45b3647ba32749b94fa689175ec8c26) C:\Windows\system32\DRIVERS\ewusbdev.sys
15:34:58.0782 6336        hwusbdev - ok
15:34:58.0860 6336        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
15:34:58.0891 6336        i8042prt - ok
15:34:58.0953 6336        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
15:34:58.0984 6336        iaStorV - ok
15:34:59.0094 6336        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
15:34:59.0156 6336        idsvc - ok
15:34:59.0390 6336        IDSVia64        (18c40c3f368323b203ace403cb430db1) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\IPSDefs\20120403.002\IDSvia64.sys
15:34:59.0421 6336        IDSVia64 - ok
15:34:59.0718 6336        igfx            (a87261ef1546325b559374f5689cf5bc) C:\Windows\system32\DRIVERS\igdkmd64.sys
15:34:59.0920 6336        igfx - ok
15:34:59.0952 6336        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
15:34:59.0967 6336        iirsp - ok
15:35:00.0014 6336        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
15:35:00.0154 6336        IKEEXT - ok
15:35:00.0295 6336        IntcAzAudAddService (9aa6a93852e36fe76c3f7fc2904f3b01) C:\Windows\system32\drivers\RTKVHD64.sys
15:35:00.0404 6336        IntcAzAudAddService - ok
15:35:00.0435 6336        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
15:35:00.0451 6336        intelide - ok
15:35:00.0498 6336        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
15:35:00.0560 6336        intelppm - ok
15:35:00.0607 6336        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
15:35:00.0654 6336        IPBusEnum - ok
15:35:00.0716 6336        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
15:35:00.0794 6336        IpFilterDriver - ok
15:35:00.0856 6336        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
15:35:00.0950 6336        iphlpsvc - ok
15:35:00.0981 6336        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
15:35:01.0012 6336        IPMIDRV - ok
15:35:01.0059 6336        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
15:35:01.0106 6336        IPNAT - ok
15:35:01.0215 6336        iPod Service    (ee4c2a137c7088911a8919effc9812e7) C:\Program Files\iPod\bin\iPodService.exe
15:35:01.0293 6336        iPod Service - ok
15:35:01.0371 6336        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
15:35:01.0496 6336        IRENUM - ok
15:35:01.0543 6336        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
15:35:01.0543 6336        isapnp - ok
15:35:01.0574 6336        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
15:35:01.0621 6336        iScsiPrt - ok
15:35:01.0699 6336        k57nd60a        (249ee2d26cb1530f3bede0ac8b9e3099) C:\Windows\system32\DRIVERS\k57nd60a.sys
15:35:01.0730 6336        k57nd60a - ok
15:35:01.0792 6336        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\DRIVERS\kbdclass.sys
15:35:01.0808 6336        kbdclass - ok
15:35:01.0855 6336        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\DRIVERS\kbdhid.sys
15:35:01.0886 6336        kbdhid - ok
15:35:01.0933 6336        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
15:35:01.0964 6336        KeyIso - ok
15:35:01.0995 6336        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
15:35:01.0995 6336        KSecDD - ok
15:35:02.0026 6336        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
15:35:02.0042 6336        KSecPkg - ok
15:35:02.0104 6336        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
15:35:02.0198 6336        ksthunk - ok
15:35:02.0245 6336        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
15:35:02.0307 6336        KtmRm - ok
15:35:02.0354 6336        L1E            (2ac603c3188c704cfce353659aa7ad71) C:\Windows\system32\DRIVERS\L1E62x64.sys
15:35:02.0385 6336        L1E - ok
15:35:02.0448 6336        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
15:35:02.0557 6336        LanmanServer - ok
15:35:02.0604 6336        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
15:35:02.0650 6336        LanmanWorkstation - ok
15:35:02.0806 6336        LBTServ        (19eff704cd16dd0429e128431f1dd631) C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe
15:35:02.0838 6336        LBTServ - ok
15:35:02.0978 6336        LHidFilt        (1074c77a47835e03c15bf92452f9a750) C:\Windows\system32\DRIVERS\LHidFilt.Sys
15:35:03.0009 6336        LHidFilt - ok
15:35:03.0072 6336        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
15:35:03.0134 6336        lltdio - ok
15:35:03.0196 6336        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
15:35:03.0290 6336        lltdsvc - ok
15:35:03.0306 6336        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
15:35:03.0352 6336        lmhosts - ok
15:35:03.0384 6336        LMouFilt        (96999c364c649e2866a268f7420a304a) C:\Windows\system32\DRIVERS\LMouFilt.Sys
15:35:03.0415 6336        LMouFilt - ok
15:35:03.0477 6336        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
15:35:03.0508 6336        LSI_FC - ok
15:35:03.0524 6336        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
15:35:03.0540 6336        LSI_SAS - ok
15:35:03.0555 6336        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
15:35:03.0555 6336        LSI_SAS2 - ok
15:35:03.0586 6336        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
15:35:03.0602 6336        LSI_SCSI - ok
15:35:03.0618 6336        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
15:35:03.0711 6336        luafv - ok
15:35:03.0758 6336        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
15:35:03.0820 6336        Mcx2Svc - ok
15:35:03.0836 6336        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
15:35:03.0852 6336        megasas - ok
15:35:03.0883 6336        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
15:35:03.0930 6336        MegaSR - ok
15:35:03.0976 6336        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
15:35:04.0070 6336        MMCSS - ok
15:35:04.0086 6336        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
15:35:04.0117 6336        Modem - ok
15:35:04.0132 6336        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
15:35:04.0164 6336        monitor - ok
15:35:04.0226 6336        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\DRIVERS\mouclass.sys
15:35:04.0242 6336        mouclass - ok
15:35:04.0288 6336        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
15:35:04.0335 6336        mouhid - ok
15:35:04.0382 6336        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
15:35:04.0413 6336        mountmgr - ok
15:35:04.0460 6336        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
15:35:04.0491 6336        mpio - ok
15:35:04.0507 6336        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
15:35:04.0554 6336        mpsdrv - ok
15:35:04.0616 6336        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
15:35:04.0710 6336        MpsSvc - ok
15:35:04.0756 6336        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
15:35:04.0819 6336        MRxDAV - ok
15:35:04.0881 6336        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
15:35:04.0912 6336        mrxsmb - ok
15:35:04.0975 6336        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
15:35:05.0037 6336        mrxsmb10 - ok
15:35:05.0068 6336        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
15:35:05.0100 6336        mrxsmb20 - ok
15:35:05.0146 6336        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
15:35:05.0162 6336        msahci - ok
15:35:05.0193 6336        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
15:35:05.0209 6336        msdsm - ok
15:35:05.0240 6336        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
15:35:05.0318 6336        MSDTC - ok
15:35:05.0349 6336        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
15:35:05.0412 6336        Msfs - ok
15:35:05.0427 6336        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
15:35:05.0505 6336        mshidkmdf - ok
15:35:05.0536 6336        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
15:35:05.0568 6336        msisadrv - ok
15:35:05.0614 6336        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
15:35:05.0708 6336        MSiSCSI - ok
15:35:05.0724 6336        msiserver - ok
15:35:05.0770 6336        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
15:35:05.0864 6336        MSKSSRV - ok
15:35:05.0880 6336        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
15:35:05.0926 6336        MSPCLOCK - ok
15:35:05.0942 6336        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
15:35:05.0989 6336        MSPQM - ok
15:35:06.0036 6336        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
15:35:06.0082 6336        MsRPC - ok
15:35:06.0114 6336        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
15:35:06.0145 6336        mssmbios - ok
15:35:06.0207 6336        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
15:35:06.0285 6336        MSTEE - ok
15:35:06.0301 6336        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
15:35:06.0316 6336        MTConfig - ok
15:35:06.0348 6336        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
15:35:06.0363 6336        Mup - ok
15:35:06.0426 6336        mwlPSDFilter    (6ffecc25b39dc7652a0cec0ada9db589) C:\Windows\system32\DRIVERS\mwlPSDFilter.sys
15:35:06.0441 6336        mwlPSDFilter - ok
15:35:06.0472 6336        mwlPSDNServ    (0befe32ca56d6ee89d58175725596a85) C:\Windows\system32\DRIVERS\mwlPSDNServ.sys
15:35:06.0504 6336        mwlPSDNServ - ok
15:35:06.0519 6336        mwlPSDVDisk    (d43bc633b8660463e446e28e14a51262) C:\Windows\system32\DRIVERS\mwlPSDVDisk.sys
15:35:06.0535 6336        mwlPSDVDisk - ok
15:35:06.0644 6336        MWLService      (2f139207f618ec2933830227eeffddb4) C:\Program Files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe
15:35:06.0675 6336        MWLService - ok
15:35:06.0769 6336        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
15:35:06.0862 6336        napagent - ok
15:35:06.0940 6336        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
15:35:07.0003 6336        NativeWifiP - ok
15:35:07.0237 6336        NAVENG          (2dbe90210de76be6e1653bb20ec70ec2) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\VirusDefs\20120403.041\ENG64.SYS
15:35:07.0268 6336        NAVENG - ok
15:35:07.0362 6336        NAVEX15        (346da70e203b8e2c850277713de8f71b) C:\ProgramData\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\VirusDefs\20120403.041\EX64.SYS
15:35:07.0455 6336        NAVEX15 - ok
15:35:07.0627 6336        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
15:35:07.0689 6336        NDIS - ok
15:35:07.0752 6336        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
15:35:07.0861 6336        NdisCap - ok
15:35:07.0876 6336        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
15:35:07.0923 6336        NdisTapi - ok
15:35:07.0986 6336        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
15:35:08.0079 6336        Ndisuio - ok
15:35:08.0110 6336        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
15:35:08.0173 6336        NdisWan - ok
15:35:08.0220 6336        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
15:35:08.0298 6336        NDProxy - ok
15:35:08.0360 6336        Net Driver HPZ12 (2334dc48997ba203b794df3ee70521db) C:\Windows\system32\HPZinw12.dll
15:35:08.0391 6336        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
15:35:08.0391 6336        Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
15:35:08.0454 6336        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
15:35:08.0547 6336        NetBIOS - ok
15:35:08.0578 6336        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
15:35:08.0641 6336        NetBT - ok
15:35:08.0688 6336        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
15:35:08.0703 6336        Netlogon - ok
15:35:08.0766 6336        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
15:35:08.0844 6336        Netman - ok
15:35:08.0937 6336        NetMsmqActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:35:08.0968 6336        NetMsmqActivator - ok
15:35:08.0968 6336        NetPipeActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:35:08.0984 6336        NetPipeActivator - ok
15:35:09.0046 6336        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
15:35:09.0140 6336        netprofm - ok
15:35:09.0156 6336        NetTcpActivator (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:35:09.0156 6336        NetTcpActivator - ok
15:35:09.0171 6336        NetTcpPortSharing (d22cd77d4f0d63d1169bb35911bff12d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
15:35:09.0171 6336        NetTcpPortSharing - ok
15:35:09.0280 6336        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
15:35:09.0312 6336        nfrd960 - ok
15:35:09.0421 6336        NIS            (b4187346f54e362daffe647b25a58d50) C:\Program Files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe
15:35:09.0436 6336        NIS - ok
15:35:09.0546 6336        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
15:35:09.0639 6336        NlaSvc - ok
15:35:09.0702 6336        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
15:35:09.0764 6336        Npfs - ok
15:35:09.0780 6336        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
15:35:09.0842 6336        nsi - ok
15:35:09.0858 6336        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
15:35:09.0904 6336        nsiproxy - ok
15:35:09.0998 6336        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
15:35:10.0107 6336        Ntfs - ok
15:35:10.0201 6336        NTI IScheduleSvc (14e66f603fb187713aeb02ad3b0390cf) C:\Program Files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe
15:35:10.0248 6336        NTI IScheduleSvc - ok
15:35:10.0279 6336        NTIBackupSvc    (fd324cce1d4d5bb5af65f8e55b462c7e) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe
15:35:10.0310 6336        NTIBackupSvc - ok
15:35:10.0404 6336        NTIDrvr        (64ddd0dee976302f4bd93e5efcc2f013) C:\Windows\system32\drivers\NTIDrvr.sys
15:35:10.0419 6336        NTIDrvr - ok
15:35:10.0466 6336        NTISchedulerSvc (3f6268a2ec33cd38cf75c880af8ded42) C:\Program Files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe
15:35:10.0497 6336        NTISchedulerSvc - ok
15:35:10.0528 6336        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
15:35:10.0575 6336        Null - ok
15:35:10.0622 6336        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
15:35:10.0653 6336        nvraid - ok
15:35:10.0700 6336        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
15:35:10.0716 6336        nvstor - ok
15:35:10.0778 6336        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
15:35:10.0794 6336        nv_agp - ok
15:35:10.0903 6336        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
15:35:10.0950 6336        odserv - ok
15:35:11.0043 6336        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
15:35:11.0090 6336        ohci1394 - ok
15:35:11.0184 6336        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
15:35:11.0215 6336        ose - ok
15:35:11.0262 6336        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
15:35:11.0308 6336        p2pimsvc - ok
15:35:11.0355 6336        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
15:35:11.0371 6336        p2psvc - ok
15:35:11.0433 6336        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
15:35:11.0464 6336        Parport - ok
15:35:11.0511 6336        partmgr        (871eadac56b0a4c6512bbe32753ccf79) C:\Windows\system32\drivers\partmgr.sys
15:35:11.0527 6336        partmgr - ok
15:35:11.0527 6336        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
15:35:11.0574 6336        PcaSvc - ok
15:35:11.0620 6336        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
15:35:11.0636 6336        pci - ok
15:35:11.0667 6336        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
15:35:11.0683 6336        pciide - ok
15:35:11.0714 6336        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
15:35:11.0730 6336        pcmcia - ok
15:35:11.0745 6336        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
15:35:11.0761 6336        pcw - ok
15:35:11.0792 6336        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
15:35:11.0870 6336        PEAUTH - ok
15:35:11.0932 6336        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
15:35:11.0995 6336        PerfHost - ok
15:35:12.0120 6336        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
15:35:12.0213 6336        pla - ok
15:35:12.0291 6336        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
15:35:12.0354 6336        PlugPlay - ok
15:35:12.0447 6336        Pml Driver HPZ12 (ac78df349f0e4cfb8b667c0cfff83cce) C:\Windows\system32\HPZipm12.dll
15:35:12.0494 6336        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
15:35:12.0494 6336        Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
15:35:12.0541 6336        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
15:35:12.0588 6336        PNRPAutoReg - ok
15:35:12.0619 6336        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
15:35:12.0634 6336        PNRPsvc - ok
15:35:12.0697 6336        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
15:35:12.0775 6336        PolicyAgent - ok
15:35:12.0822 6336        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
15:35:12.0915 6336        Power - ok
15:35:12.0978 6336        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
15:35:13.0071 6336        PptpMiniport - ok
15:35:13.0118 6336        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
15:35:13.0180 6336        Processor - ok
15:35:13.0243 6336        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
15:35:13.0336 6336        ProfSvc - ok
15:35:13.0383 6336        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
15:35:13.0414 6336        ProtectedStorage - ok
15:35:13.0508 6336        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
15:35:13.0586 6336        Psched - ok
15:35:13.0695 6336        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
15:35:13.0789 6336        ql2300 - ok
15:35:13.0804 6336        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
15:35:13.0820 6336        ql40xx - ok
15:35:13.0851 6336        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
15:35:13.0898 6336        QWAVE - ok
15:35:13.0914 6336        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
15:35:13.0929 6336        QWAVEdrv - ok
15:35:13.0945 6336        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
15:35:14.0007 6336        RasAcd - ok
15:35:14.0054 6336        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
15:35:14.0116 6336        RasAgileVpn - ok
15:35:14.0132 6336        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
15:35:14.0179 6336        RasAuto - ok
15:35:14.0226 6336        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
15:35:14.0304 6336        Rasl2tp - ok
15:35:14.0350 6336        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
15:35:14.0444 6336        RasMan - ok
15:35:14.0475 6336        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
15:35:14.0538 6336        RasPppoe - ok
15:35:14.0553 6336        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
15:35:14.0600 6336        RasSstp - ok
15:35:14.0662 6336        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
15:35:14.0756 6336        rdbss - ok
15:35:14.0787 6336        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
15:35:14.0834 6336        rdpbus - ok
15:35:14.0865 6336        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
15:35:14.0896 6336        RDPCDD - ok
15:35:14.0928 6336        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
15:35:14.0974 6336        RDPENCDD - ok
15:35:14.0990 6336        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
15:35:15.0037 6336        RDPREFMP - ok
15:35:15.0099 6336        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
15:35:15.0162 6336        RDPWD - ok
15:35:15.0224 6336        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
15:35:15.0255 6336        rdyboost - ok
15:35:15.0302 6336        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
15:35:15.0364 6336        RemoteAccess - ok
15:35:15.0411 6336        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
15:35:15.0474 6336        RemoteRegistry - ok
15:35:15.0505 6336        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
15:35:15.0552 6336        RpcEptMapper - ok
15:35:15.0583 6336        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
15:35:15.0614 6336        RpcLocator - ok
15:35:15.0661 6336        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
15:35:15.0708 6336        RpcSs - ok
15:35:15.0754 6336        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
15:35:15.0848 6336        rspndr - ok
15:35:15.0942 6336        RSUSBSTOR      (db30aa4daa0d492fa5d7717d8181ffa1) C:\Windows\system32\Drivers\RtsUStor.sys
15:35:16.0020 6336        RSUSBSTOR - ok
15:35:16.0051 6336        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
15:35:16.0082 6336        SamSs - ok
15:35:16.0129 6336        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
15:35:16.0144 6336        sbp2port - ok
15:35:16.0176 6336        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
15:35:16.0222 6336        SCardSvr - ok
15:35:16.0269 6336        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
15:35:16.0347 6336        scfilter - ok
15:35:16.0410 6336        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
15:35:16.0534 6336        Schedule - ok
15:35:16.0581 6336        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
15:35:16.0612 6336        SCPolicySvc - ok
15:35:16.0659 6336        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
15:35:16.0737 6336        SDRSVC - ok
15:35:16.0846 6336        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
15:35:16.0909 6336        secdrv - ok
15:35:16.0956 6336        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
15:35:17.0034 6336        seclogon - ok
15:35:17.0080 6336        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
15:35:17.0143 6336        SENS - ok
15:35:17.0174 6336        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
15:35:17.0252 6336        SensrSvc - ok
15:35:17.0299 6336        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
15:35:17.0330 6336        Serenum - ok
15:35:17.0377 6336        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
15:35:17.0424 6336        Serial - ok
15:35:17.0486 6336        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
15:35:17.0548 6336        sermouse - ok
15:35:17.0595 6336        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
15:35:17.0689 6336        SessionEnv - ok
15:35:17.0736 6336        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
15:35:17.0798 6336        sffdisk - ok
15:35:17.0829 6336        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
15:35:17.0876 6336        sffp_mmc - ok
15:35:17.0907 6336        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
15:35:17.0954 6336        sffp_sd - ok
15:35:18.0001 6336        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
15:35:18.0063 6336        sfloppy - ok
15:35:18.0126 6336        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
15:35:18.0204 6336        SharedAccess - ok
15:35:18.0266 6336        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
15:35:18.0344 6336        ShellHWDetection - ok
15:35:18.0406 6336        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
15:35:18.0438 6336        SiSRaid2 - ok
15:35:18.0453 6336        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
15:35:18.0469 6336        SiSRaid4 - ok
15:35:18.0500 6336        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
15:35:18.0531 6336        Smb - ok
15:35:18.0594 6336        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
15:35:18.0625 6336        SNMPTRAP - ok
15:35:18.0640 6336        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
15:35:18.0656 6336        spldr - ok
15:35:18.0703 6336        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
15:35:18.0781 6336        Spooler - ok
15:35:18.0906 6336        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
15:35:19.0140 6336        sppsvc - ok
15:35:19.0186 6336        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
15:35:19.0280 6336        sppuinotify - ok
15:35:19.0405 6336        sptd            (602884696850c86434530790b110e8eb) C:\Windows\System32\Drivers\sptd.sys
15:35:19.0483 6336        sptd - ok
15:35:19.0608 6336        SRTSP          (96babc4906ecdb1c69d1176f8647ad8e) C:\Windows\System32\Drivers\NISx64\1109000.00C\SRTSP64.SYS
15:35:19.0654 6336        SRTSP - ok
15:35:19.0686 6336        SRTSPX          (c7f491a290e0e4222f5cdcd50eeb8167) C:\Windows\system32\drivers\NISx64\1109000.00C\SRTSPX64.SYS
15:35:19.0701 6336        SRTSPX - ok
15:35:19.0764 6336        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
15:35:19.0842 6336        srv - ok
15:35:19.0873 6336        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
15:35:19.0920 6336        srv2 - ok
15:35:20.0013 6336        SrvHsfHDA      (0c4540311e11664b245a263e1154cef8) C:\Windows\system32\DRIVERS\VSTAZL6.SYS
15:35:20.0044 6336        SrvHsfHDA - ok
15:35:20.0091 6336        SrvHsfV92      (02071d207a9858fbe3a48cbfd59c4a04) C:\Windows\system32\DRIVERS\VSTDPV6.SYS
15:35:20.0185 6336        SrvHsfV92 - ok
15:35:20.0232 6336        SrvHsfWinac    (18e40c245dbfaf36fd0134a7ef2df396) C:\Windows\system32\DRIVERS\VSTCNXT6.SYS
15:35:20.0278 6336        SrvHsfWinac - ok
15:35:20.0325 6336        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
15:35:20.0341 6336        srvnet - ok
15:35:20.0403 6336        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
15:35:20.0497 6336        SSDPSRV - ok
15:35:20.0528 6336        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
15:35:20.0575 6336        SstpSvc - ok
15:35:20.0622 6336        StarOpen - ok
15:35:20.0668 6336        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
15:35:20.0700 6336        stexstor - ok
15:35:20.0762 6336        StillCam        (decacb6921ded1a38642642685d77dac) C:\Windows\system32\DRIVERS\serscan.sys
15:35:20.0809 6336        StillCam - ok
15:35:20.0871 6336        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
15:35:20.0918 6336        stisvc - ok
15:35:20.0965 6336        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
15:35:20.0965 6336        swenum - ok
15:35:21.0012 6336        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
15:35:21.0090 6336        swprv - ok
15:35:21.0183 6336        SymDS          (659b227a72b76115975a6a9491b2fe1f) C:\Windows\system32\drivers\NISx64\1109000.00C\SYMDS64.SYS
15:35:21.0214 6336        SymDS - ok
15:35:21.0292 6336        SymEFA          (9f5783a4a03d0091cdbdaa858b566926) C:\Windows\system32\drivers\NISx64\1109000.00C\SYMEFA64.SYS
15:35:21.0324 6336        SymEFA - ok
15:35:21.0386 6336        SymEvent        (3f9d5fe52585e2653e59fdbfdf09a94c) C:\Windows\system32\Drivers\SYMEVENT64x86.SYS
15:35:21.0402 6336        SymEvent - ok
15:35:21.0448 6336        SymIRON        (f57588546e738db1583981d8f44e9bc2) C:\Windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS
15:35:21.0464 6336        SymIRON - ok
15:35:21.0526 6336        SYMTDIv        (3adfb72f0797ae3832509fe030755e21) C:\Windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS
15:35:21.0558 6336        SYMTDIv - ok
15:35:21.0636 6336        SynTP          (ed6d1424e5b0c21a57b28dd8508d6843) C:\Windows\system32\DRIVERS\SynTP.sys
15:35:21.0667 6336        SynTP - ok
15:35:21.0745 6336        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
15:35:21.0870 6336        SysMain - ok
15:35:21.0901 6336        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
15:35:21.0948 6336        TabletInputService - ok
15:35:21.0994 6336        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
15:35:22.0057 6336        TapiSrv - ok
15:35:22.0088 6336        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
15:35:22.0135 6336        TBS - ok
15:35:22.0275 6336        Tcpip          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\drivers\tcpip.sys
15:35:22.0384 6336        Tcpip - ok
15:35:22.0447 6336        TCPIP6          (fc62769e7bff2896035aeed399108162) C:\Windows\system32\DRIVERS\tcpip.sys
15:35:22.0478 6336        TCPIP6 - ok
15:35:22.0540 6336        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
15:35:22.0618 6336        tcpipreg - ok
15:35:22.0665 6336        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
15:35:22.0681 6336        TDPIPE - ok
15:35:22.0728 6336        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
15:35:22.0759 6336        TDTCP - ok
15:35:22.0837 6336        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
15:35:22.0884 6336        tdx - ok
15:35:22.0930 6336        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
15:35:22.0946 6336        TermDD - ok
15:35:22.0993 6336        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
15:35:23.0071 6336        TermService - ok
15:35:23.0102 6336        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
15:35:23.0133 6336        Themes - ok
15:35:23.0180 6336        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
15:35:23.0242 6336        THREADORDER - ok
15:35:23.0274 6336        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
15:35:23.0336 6336        TrkWks - ok
15:35:23.0398 6336        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
15:35:23.0476 6336        TrustedInstaller - ok
15:35:23.0539 6336        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
15:35:23.0601 6336        tssecsrv - ok
15:35:23.0679 6336        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
15:35:23.0726 6336        TsUsbFlt - ok
15:35:23.0788 6336        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
15:35:23.0866 6336        tunnel - ok
15:35:23.0898 6336        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
15:35:23.0929 6336        uagp35 - ok
15:35:23.0991 6336        UBHelper        (2e22c1fd397a5a9ffef55e9d1fc96c00) C:\Windows\system32\drivers\UBHelper.sys
15:35:24.0022 6336        UBHelper - ok
15:35:24.0069 6336        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
15:35:24.0147 6336        udfs - ok
15:35:24.0194 6336        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
15:35:24.0225 6336        UI0Detect - ok
15:35:24.0288 6336        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
15:35:24.0319 6336        uliagpkx - ok
15:35:24.0381 6336        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
15:35:24.0428 6336        umbus - ok
15:35:24.0490 6336        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
15:35:24.0537 6336        UmPass - ok
15:35:24.0631 6336        UnlockerDriver5 (9dc07e73a4abb9acf692113b36a5009f) C:\Program Files\Unlocker\UnlockerDriver5.sys
15:35:24.0646 6336        UnlockerDriver5 - ok
15:35:24.0709 6336        Updater Service (70dde3a86dbeb1d6c3c30ad687b1877a) C:\Program Files\Acer\Acer Updater\UpdaterService.exe
15:35:24.0740 6336        Updater Service - ok
15:35:24.0849 6336        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
15:35:24.0927 6336        upnphost - ok
15:35:24.0990 6336        USBAAPL64      (aa33fc47ed58c34e6e9261e4f850b7eb) C:\Windows\system32\Drivers\usbaapl64.sys
15:35:25.0068 6336        USBAAPL64 - ok
15:35:25.0130 6336        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
15:35:25.0161 6336        usbccgp - ok
15:35:25.0208 6336        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
15:35:25.0255 6336        usbcir - ok
15:35:25.0302 6336        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
15:35:25.0333 6336        usbehci - ok
15:35:25.0380 6336        usbfilter      (6648c6d7323a2ce0c4776c36cefbcb14) C:\Windows\system32\DRIVERS\usbfilter.sys
15:35:25.0395 6336        usbfilter - ok
15:35:25.0473 6336        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
15:35:25.0520 6336        usbhub - ok
15:35:25.0567 6336        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
15:35:25.0614 6336        usbohci - ok
15:35:25.0676 6336        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
15:35:25.0738 6336        usbprint - ok
15:35:25.0770 6336        usbscan        (aaa2513c8aed8b54b189fd0c6b1634c0) C:\Windows\system32\DRIVERS\usbscan.sys
15:35:25.0785 6336        usbscan - ok
15:35:25.0848 6336        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
15:35:25.0894 6336        USBSTOR - ok
15:35:25.0972 6336        usbuhci        (81fb2216d3a60d1284455d511797db3d) C:\Windows\system32\DRIVERS\usbuhci.sys
15:35:26.0019 6336        usbuhci - ok
15:35:26.0097 6336        usbvideo        (454800c2bc7f3927ce030141ee4f4c50) C:\Windows\system32\Drivers\usbvideo.sys
15:35:26.0128 6336        usbvideo - ok
15:35:26.0160 6336        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
15:35:26.0206 6336        UxSms - ok
15:35:26.0238 6336        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
15:35:26.0269 6336        VaultSvc - ok
15:35:26.0316 6336        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
15:35:26.0347 6336        vdrvroot - ok
15:35:26.0394 6336        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
15:35:26.0456 6336        vds - ok
15:35:26.0487 6336        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
15:35:26.0518 6336        vga - ok
15:35:26.0550 6336        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
15:35:26.0612 6336        VgaSave - ok
15:35:26.0643 6336        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
15:35:26.0659 6336        vhdmp - ok
15:35:26.0690 6336        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
15:35:26.0706 6336        viaide - ok
15:35:26.0721 6336        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
15:35:26.0737 6336        volmgr - ok
15:35:26.0784 6336        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
15:35:26.0830 6336        volmgrx - ok
15:35:26.0877 6336        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
15:35:26.0893 6336        volsnap - ok
15:35:26.0955 6336        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
15:35:26.0986 6336        vsmraid - ok
15:35:27.0080 6336        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
15:35:27.0220 6336        VSS - ok
15:35:27.0220 6336        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\system32\DRIVERS\vwifibus.sys
15:35:27.0267 6336        vwifibus - ok
15:35:27.0267 6336        vwififlt        (6a3d66263414ff0d6fa754c646612f3f) C:\Windows\system32\DRIVERS\vwififlt.sys
15:35:27.0298 6336        vwififlt - ok
15:35:27.0330 6336        vwifimp        (6a638fc4bfddc4d9b186c28c91bd1a01) C:\Windows\system32\DRIVERS\vwifimp.sys
15:35:27.0345 6336        vwifimp - ok
15:35:27.0408 6336        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
15:35:27.0470 6336        W32Time - ok
15:35:27.0486 6336        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
15:35:27.0532 6336        WacomPen - ok
15:35:27.0579 6336        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
15:35:27.0673 6336        WANARP - ok
15:35:27.0673 6336        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
15:35:27.0720 6336        Wanarpv6 - ok
15:35:27.0844 6336        WatAdminSvc    (3cec96de223e49eaae3651fcf8faea6c) C:\Windows\system32\Wat\WatAdminSvc.exe
15:35:27.0938 6336        WatAdminSvc - ok
15:35:28.0032 6336        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
15:35:28.0156 6336        wbengine - ok
15:35:28.0172 6336        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
15:35:28.0203 6336        WbioSrvc - ok
15:35:28.0250 6336        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
15:35:28.0281 6336        wcncsvc - ok
15:35:28.0297 6336        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
15:35:28.0328 6336        WcsPlugInService - ok
15:35:28.0375 6336        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
15:35:28.0390 6336        Wd - ok
15:35:28.0422 6336        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
15:35:28.0453 6336        Wdf01000 - ok
15:35:28.0468 6336        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
15:35:28.0593 6336        WdiServiceHost - ok
15:35:28.0609 6336        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
15:35:28.0640 6336        WdiSystemHost - ok
15:35:28.0687 6336        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
15:35:28.0749 6336        WebClient - ok
15:35:28.0780 6336        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
15:35:28.0843 6336        Wecsvc - ok
15:35:28.0874 6336        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
15:35:28.0905 6336        wercplsupport - ok
15:35:28.0952 6336        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
15:35:29.0014 6336        WerSvc - ok
15:35:29.0046 6336        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
15:35:29.0092 6336        WfpLwf - ok
15:35:29.0108 6336        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
15:35:29.0124 6336        WIMMount - ok
15:35:29.0155 6336        WinDefend - ok
15:35:29.0248 6336        WinDriver6      (62a3e830acc39ead6cbb69095001f7b0) C:\Windows\system32\drivers\windrvr6.sys
15:35:29.0295 6336        WinDriver6 - ok
15:35:29.0295 6336        WinHttpAutoProxySvc - ok
15:35:29.0373 6336        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
15:35:29.0451 6336        Winmgmt - ok
15:35:29.0560 6336        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
15:35:29.0685 6336        WinRM - ok
15:35:29.0779 6336        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
15:35:29.0826 6336        WinUsb - ok
15:35:29.0888 6336        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
15:35:29.0950 6336        Wlansvc - ok
15:35:29.0982 6336        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
15:35:30.0013 6336        WmiAcpi - ok
15:35:30.0075 6336        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
15:35:30.0091 6336        wmiApSrv - ok
15:35:30.0138 6336        WMPNetworkSvc - ok
15:35:30.0169 6336        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
15:35:30.0200 6336        WPCSvc - ok
15:35:30.0247 6336        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
15:35:30.0340 6336        WPDBusEnum - ok
15:35:30.0387 6336        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
15:35:30.0481 6336        ws2ifsl - ok
15:35:30.0528 6336        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
15:35:30.0574 6336        wscsvc - ok
15:35:30.0574 6336        WSearch - ok
15:35:30.0715 6336        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
15:35:30.0871 6336        wuauserv - ok
15:35:30.0964 6336        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
15:35:31.0074 6336        WudfPf - ok
15:35:31.0120 6336        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
15:35:31.0214 6336        WUDFRd - ok
15:35:31.0245 6336        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
15:35:31.0308 6336        wudfsvc - ok
15:35:31.0339 6336        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
15:35:31.0417 6336        WwanSvc - ok
15:35:31.0542 6336        MBR (0x1B8)    (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0
15:35:31.0838 6336        \Device\Harddisk0\DR0 - ok
15:35:31.0838 6336        Boot (0x1200)  (86c54d33a6998237ad4fc2fb54648ab4) \Device\Harddisk0\DR0\Partition0
15:35:31.0854 6336        \Device\Harddisk0\DR0\Partition0 - ok
15:35:31.0869 6336        Boot (0x1200)  (ecd6a9a7acc9e5d393d2840a2d02d068) \Device\Harddisk0\DR0\Partition1
15:35:31.0885 6336        \Device\Harddisk0\DR0\Partition1 - ok
15:35:31.0900 6336        Boot (0x1200)  (03c85e6f3b66ef780026ef4199573edd) \Device\Harddisk0\DR0\Partition2
15:35:31.0916 6336        \Device\Harddisk0\DR0\Partition2 - ok
15:35:31.0916 6336        ============================================================
15:35:31.0916 6336        Scan finished
15:35:31.0916 6336        ============================================================
15:35:31.0932 6496        Detected object count: 7
15:35:31.0932 6496        Actual detected object count: 7
15:35:53.0647 6496        acedrv07 ( UnsignedFile.Multi.Generic ) - skipped by user
15:35:53.0647 6496        acedrv07 ( UnsignedFile.Multi.Generic ) - User select action: Skip
15:35:53.0647 6496        hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
15:35:53.0647 6496        hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
15:35:53.0647 6496        hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
15:35:53.0647 6496        hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
15:35:53.0647 6496        HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
15:35:53.0647 6496        HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
15:35:53.0647 6496        HtcVCom32 ( UnsignedFile.Multi.Generic ) - skipped by user
15:35:53.0647 6496        HtcVCom32 ( UnsignedFile.Multi.Generic ) - User select action: Skip
15:35:53.0662 6496        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
15:35:53.0662 6496        Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
15:35:53.0662 6496        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
15:35:53.0662 6496        Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
Gruß Hackel

cosinus 04.04.2012 15:01
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Hackel 04.04.2012 15:20
Habe Norton abgestellt meckert aber immer noch das Real-Time-Scanner aktive ist. was soll ich tun?

Gruß Hackel

cosinus 04.04.2012 20:50
Wenn Norton wirklich deaktiviert ist kannst du die Meldung ignorieren und weitermachen

Hackel 05.04.2012 08:01
Hat beim zweiten mal die meldung nicht mehr angezeigt.
Hier das Log.

Code:
ComboFix 12-04-04.02 - Admin 05.04.2012  8:00.1.2 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.4094.2748 [GMT 2:00]
ausgeführt von:: c:\users\Admin\Desktop\ComboFix.exe
AV: Norton Internet Security *Disabled/Updated* {63DF5164-9100-186D-2187-8DC619EFD8BF}
FW: Norton Internet Security *Disabled* {5BE4D041-DB6F-1935-0AD8-24F3E73C9FC4}
SP: Norton Internet Security *Disabled/Updated* {D8BEB080-B73A-17E3-1B37-B6B462689202}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files (x86)\Common Files\Acer GameZone online.ico
c:\windows\IsUn0407.exe
c:\windows\system32\bg.jpg
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-05 bis 2012-04-05  ))))))))))))))))))))))))))))))
.
.
2012-04-05 06:11 . 2012-04-05 06:11        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-04-04 05:43 . 2012-04-04 05:43        --------        d-----w-        C:\_OTL
2012-03-30 19:20 . 2012-03-30 19:20        --------        d-----w-        c:\program files (x86)\ESET
2012-03-30 12:05 . 2012-03-30 12:05        --------        d-----w-        c:\users\Admin\AppData\Roaming\Malwarebytes
2012-03-30 12:04 . 2012-03-30 12:04        --------        d-----w-        c:\programdata\Malwarebytes
2012-03-30 12:04 . 2012-03-30 12:05        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-03-30 12:04 . 2011-12-10 13:24        23152        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-03-16 06:44 . 2011-11-19 15:20        5559152        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-03-14 07:08 . 2012-02-03 04:34        3145728        ----a-w-        c:\windows\system32\win32k.sys
2012-03-14 07:08 . 2012-02-10 06:36        1544192        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-14 07:08 . 2012-02-10 05:38        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll
2012-03-14 07:07 . 2012-01-25 06:38        77312        ----a-w-        c:\windows\system32\rdpwsx.dll
2012-03-14 07:07 . 2012-01-25 06:38        149504        ----a-w-        c:\windows\system32\rdpcorekmts.dll
2012-03-14 07:07 . 2012-01-25 06:33        9216        ----a-w-        c:\windows\system32\rdrmemptylst.exe
2012-03-14 07:07 . 2012-02-17 06:38        1031680        ----a-w-        c:\windows\system32\rdpcore.dll
2012-03-14 07:07 . 2012-02-17 04:58        210944        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
2012-03-14 07:07 . 2012-02-17 04:57        23552        ----a-w-        c:\windows\system32\drivers\tdtcp.sys
2012-03-13 14:08 . 2005-03-12 00:07        87040        ----a-w-        c:\windows\system32\pdfcmnnt.dll
2012-03-13 14:08 . 2012-04-04 10:32        --------        d-----w-        c:\program files (x86)\PDFCreator
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-04-02 17:52 . 2011-02-11 08:35        125440        ----a-w-        c:\windows\system32\drivers\acedrv07.sys
2012-03-22 19:12 . 2012-03-22 19:12        4435968        ----a-w-        c:\windows\SysWow64\GPhotos.scr
2012-02-17 05:34 . 2012-03-14 07:07        826880        ----a-w-        c:\windows\SysWow64\rdpcore.dll
2012-01-23 12:28 . 2011-09-07 13:39        18960        ----a-w-        c:\windows\system32\drivers\LNonPnP.sys
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-11 05:41        120104        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x86\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2011-09-07 37296]
"BackupManagerTray"="c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\BackupManagerTray.exe" [2009-09-24 261888]
"EgisTecLiveUpdate"="c:\program files (x86)\EgisTec Egis Software Update\EgisUpdate.exe" [2009-08-04 199464]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2009-07-29 98304]
"LManager"="c:\program files (x86)\Launch Manager\LManager.exe" [2009-11-01 1094736]
"ArcadeDeluxeAgent"="c:\program files (x86)\Acer Arcade Deluxe\Acer Arcade Deluxe\ArcadeDeluxeAgent.exe" [2009-10-06 419112]
"PlayMovie"="c:\program files (x86)\Acer Arcade Deluxe\PlayMovie\PMVService.exe" [2009-10-05 181480]
"HP Software Update"="c:\program files (x86)\HP\HP Software Update\HPWuSchd2.exe" [2007-05-08 54840]
"AppleSyncNotifier"="c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleSyncNotifier.exe" [2011-09-27 59240]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-01-03 843712]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2011-11-01 59240]
"QuickTime Task"="c:\program files (x86)\QuickTime\QTTask.exe" [2011-10-24 421888]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2011-06-09 254696]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-01-16 421736]
.
c:\users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
OpenOffice.org 3.1.lnk - c:\program files (x86)\OpenOffice.org 3\program\quickstart.exe [2009-8-18 384000]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-9-23 270336]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableLUA"= 0 (0x0)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 gupdate;Google Update Service (gupdate);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-03 135664]
R3 dc3d;MS Hardware Device Detection Driver (HID);c:\windows\system32\DRIVERS\dc3d.sys [x]
R3 ewusbnet;HUAWEI USB-NDIS miniport;c:\windows\system32\DRIVERS\ewusbnet.sys [x]
R3 gupdatem;Google Update-Dienst (gupdatem);c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-03 135664]
R3 HtcVCom32;HTC Diagnostic Port;c:\windows\system32\DRIVERS\HtcVComV64.sys [x]
R3 hwusbdev;Huawei DataCard USB PNP Device;c:\windows\system32\DRIVERS\ewusbdev.sys [x]
R3 MWLService;MyWinLocker Service;c:\program files (x86)\EgisTec\MyWinLocker 3\x86\\MWLService.exe [2009-09-11 305448]
R3 NTIBackupSvc;NTI Backup Now 5 Backup Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\BackupSvc.exe [2009-06-18 50432]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\system32\Drivers\RtsUStor.sys [2009-09-02 225280]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R4 sptd;sptd;c:\windows\System32\Drivers\sptd.sys [x]
S0 amd_sata;amd_sata;c:\windows\system32\DRIVERS\amd_sata.sys [x]
S0 amd_xata;amd_xata;c:\windows\system32\DRIVERS\amd_xata.sys [x]
S0 SymDS;Symantec Data Store;c:\windows\system32\drivers\NISx64\1109000.00C\SYMDS64.SYS [x]
S0 SymEFA;Symantec Extended File Attributes;c:\windows\system32\drivers\NISx64\1109000.00C\SYMEFA64.SYS [x]
S1 BHDrvx64;BHDrvx64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\BASHDefs\20120317.002\BHDrvx64.sys [2012-03-02 1157240]
S1 ccHP;Symantec Hash Provider;c:\windows\system32\drivers\NISx64\1109000.00C\ccHPx64.sys [x]
S1 IDSVia64;IDSVia64;c:\programdata\Norton\{0C55C096-0F1D-4F28-AAA2-85EF591126E7}\NIS_17.5.0.127\Definitions\IPSDefs\20120404.002\IDSvia64.sys [2012-03-29 488568]
S1 mwlPSDFilter;mwlPSDFilter;c:\windows\system32\DRIVERS\mwlPSDFilter.sys [x]
S1 mwlPSDNServ;mwlPSDNServ;c:\windows\system32\DRIVERS\mwlPSDNServ.sys [x]
S1 mwlPSDVDisk;mwlPSDVDisk;c:\windows\system32\DRIVERS\mwlPSDVDisk.sys [x]
S1 SymIRON;Symantec Iron Driver;c:\windows\system32\drivers\NISx64\1109000.00C\Ironx64.SYS [x]
S1 SYMTDIv;Symantec Vista Network Dispatch Driver;c:\windows\System32\Drivers\NISx64\1109000.00C\SYMTDIV.SYS [x]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 ePowerSvc;Acer ePower Service;c:\program files\Acer\Acer ePower Management\ePowerSvc.exe [2009-09-30 844320]
S2 Greg_Service;GRegService;c:\program files (x86)\Acer\Registration\GregHSRW.exe [2009-08-28 1150496]
S2 NIS;Norton Internet Security;c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe [2011-08-04 126400]
S2 NTI IScheduleSvc;NTI IScheduleSvc;c:\program files (x86)\NewTech Infosystems\Acer Backup Manager\IScheduleSvc.exe [2009-09-24 62720]
S2 NTISchedulerSvc;NTI Backup Now 5 Scheduler Service;c:\program files (x86)\NewTech Infosystems\NTI Backup Now 5\SchedulerSvc.exe [2009-06-18 144640]
S2 Updater Service;Updater Service;c:\program files\Acer\Acer Updater\UpdaterService.exe [2009-07-04 240160]
S3 EraserUtilRebootDrv;EraserUtilRebootDrv;c:\program files (x86)\Common Files\Symantec Shared\EENGINE\EraserUtilRebootDrv.sys [2012-03-30 138360]
S3 k57nd60a;Broadcom NetLink (TM) Gigabit Ethernet - NDIS 6.0;c:\windows\system32\DRIVERS\k57nd60a.sys [x]
S3 usbfilter;AMD USB Filter Driver;c:\windows\system32\DRIVERS\usbfilter.sys [x]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [x]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-03 21:02]
.
2012-04-05 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-01-03 21:02]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\egisPSDP]
@="{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}"
[HKEY_CLASSES_ROOT\CLSID\{30A0A3F6-38AC-4C53-BB8B-0D95238E25BA}]
2009-09-11 05:44        137512        ----a-w-        c:\program files (x86)\EgisTec\MyWinLocker 3\x64\PSDProtect.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"mwlDaemon"="c:\program files (x86)\EgisTec\MyWinLocker 3\x86\mwlDaemon.exe" [2009-09-11 349480]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-08-06 8060960]
"PLFSetI"="c:\windows\PLFSetI.exe" [2009-11-20 200704]
"Acer ePower Management"="c:\program files\Acer\Acer ePower Management\ePowerTray.exe" [2009-09-30 823840]
"EvtMgr6"="c:\program files\Logitech\SetPointP\SetPoint.exe" [2011-06-23 1744152]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = hxxp://www.google.de/
uLocal Page = c:\windows\system32\blank.htm
mStart Page = hxxp://homepage.acer.com/rdr.aspx?b=ACAW&l=0407&m=aspire_7540&r=27360310i506l0498z1m5t55m1a728
mLocal Page = c:\windows\system32\blank.htm
uInternet Settings,ProxyOverride = *.local;<local>
uSearchAssistant = hxxp://www.google.com/ie
uSearchURL,(Default) = hxxp://www.google.com/search?q=%s
IE: Add to Google Photos Screensa&ver - c:\windows\system32\GPhotos.scr/200
TCP: DhcpNameServer = 192.168.2.1
TCP: Interfaces\{06F321CD-2996-4823-A2C8-2FD13427A844}: NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{1308AFD0-0397-4351-8DDD-60F0FDB2620F}: NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{4581B906-8D8E-4353-A084-87C6BDCBA0CF}: NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{78834A05-8E2A-4032-93EA-8B45F820CC36}: NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{81C5A6B8-D29D-4AE4-90AA-C1101AF87D42}: NameServer = 193.189.244.225 193.189.244.206
TCP: Interfaces\{823E2D78-E048-4C37-A7CE-ED38B51894EA}: NameServer = 193.189.244.225 193.189.244.206
DPF: {888078C6-70B2-4F88-8EE7-1F50DDEA6120} - hxxps://as.photoprintit.de/ips-opdata/activex/ImageUploader6.cab
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-mcmscsvc
SafeBoot-MCODS
WebBrowser-{D4027C7F-154A-4066-A1AD-4243D8127440} - (no file)
WebBrowser-{5CDCE9DA-CFA0-4218-ABF0-10EC96352CB3} - (no file)
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
.
.
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\services\NIS]
"ImagePath"="\"c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\ccSvcHst.exe\" /s \"NIS\" /m \"c:\program files (x86)\Norton Internet Security\Engine\17.9.0.12\diMaster.dll\" /prefetch:1"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:000000b5
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0005\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0006\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0007\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.exe
c:\program files (x86)\OpenOffice.org 3\program\soffice.bin
c:\program files (x86)\HP\Digital Imaging\bin\hpqSTE08.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqbam08.exe
c:\program files (x86)\HP\Digital Imaging\bin\hpqgpc01.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-04-05  08:38:49 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-04-05 06:38
.
Vor Suchlauf: 18 Verzeichnis(se), 42.780.147.712 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 42.495.995.904 Bytes frei
.
- - End Of File - - ABD090315E56DB1792C7DE6C3DB2EBBE
Gruß Hackel

cosinus 05.04.2012 13:00
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr", dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Hackel 05.04.2012 14:03
Das log.

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-05 14:27:45
-----------------------------
14:27:45.577    OS Version: Windows x64 6.1.7601 Service Pack 1
14:27:45.577    Number of processors: 2 586 0x602
14:27:45.577    ComputerName: ADMIN-PC  UserName: Admin
14:27:48.198    Initialize success
14:30:41.504    AVAST engine defs: 12040500
14:31:14.015    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\0000006a
14:31:14.015    Disk 0 Vendor: WDC_WD32 11.0 Size: 305245MB BusType: 11
14:31:14.062    Disk 0 MBR read successfully
14:31:14.077    Disk 0 MBR scan
14:31:14.077    Disk 0 Windows VISTA default MBR code
14:31:14.108    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        12000 MB offset 2048
14:31:14.155    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 24578048
14:31:14.202    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      152894 MB offset 24782848
14:31:14.202    Disk 0 Partition - 00    0F Extended LBA            140248 MB offset 337911808
14:31:14.264    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      140247 MB offset 337913856
14:31:14.311    Disk 0 scanning C:\Windows\system32\drivers
14:31:30.769    Service scanning
14:32:03.701    Modules scanning
14:32:03.716    Disk 0 trace - called modules:
14:32:03.763    ntoskrnl.exe CLASSPNP.SYS disk.sys amd_xata.sys ACPI.sys storport.sys hal.dll amd_sata.sys
14:32:03.779    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8004241060]
14:32:03.794    3 CLASSPNP.SYS[fffff8800180143f] -> nt!IofCallDriver -> [0xfffffa8004230040]
14:32:03.810    5 amd_xata.sys[fffff880010eca1d] -> nt!IofCallDriver -> [0xfffffa800422f710]
14:32:03.826    7 ACPI.sys[fffff88000edf7a1] -> nt!IofCallDriver -> \Device\0000006a[0xfffffa800422c060]
14:32:05.401    AVAST engine scan C:\Windows
14:32:12.548    AVAST engine scan C:\Windows\system32
14:36:21.074    AVAST engine scan C:\Windows\system32\drivers
14:36:41.697    AVAST engine scan C:\Users\Admin
14:44:14.387    File: C:\Users\Admin\Documents\cdscherz\cdScherz.exe  **INFECTED** Win32:CDopen-D [Joke]
14:52:05.619    AVAST engine scan C:\ProgramData
14:59:51.451    Scan finished successfully
15:00:52.432    Disk 0 MBR has been saved successfully to "C:\Users\Admin\Desktop\MBR.dat"
15:00:52.447    The log file has been saved successfully to "C:\Users\Admin\Desktop\aswMBR.txt"
Gruß Hackel

cosinus 05.04.2012 14:30
Zitat:
File: C:\Users\Admin\Documents\cdscherz\cdScherz.exe **INFECTED** Win32:CDopen-D [Joke]
Ein Scherzprogramm...

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Hackel 05.04.2012 19:44
Hi
habe beide durchlaufen lassen. Bei Malwarebytes war alles ok, aber SUPERAnitSpyware hat noch was gefunden.
Schon mal zwischendurch Danke für deine Hilfe!
Hier die Logs.

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 04/05/2012 at 06:56 PM

Application Version : 5.0.1146

Core Rules Database Version : 8418
Trace Rules Database Version: 6230

Scan type      : Complete Scan
Total Scan Time : 01:35:37

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC Off - Administrator

Memory items scanned      : 807
Memory threats detected  : 0
Registry items scanned    : 68506
Registry threats detected : 0
File items scanned        : 72037
File threats detected    : 118

Adware.Tracking Cookie
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\FNPXBQPD.txt [ /im.banner.t-online.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\288MZ45R.txt [ /revsci.net ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\E93XL90M.txt [ /adfarm1.adition.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K9Z322W5.txt [ /server.adform.net ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\G8N47VDO.txt [ /de.sitestat.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9OMLAAXQ.txt [ /adform.net ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\I7JPPJXO.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\XZ198G15.txt [ /komtrack.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OL9IPIUE.txt [ /www.mynortonaccount.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\HU5K7IGP.txt [ /ad.ad-srv.net ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\86C8J6BO.txt [ /webmasterplan.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CRVG9QHJ.txt [ /atdmt.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5IWVK0OO.txt [ /zanox.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\C64ST6LB.txt [ /tracking.quisma.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\KEQ2H9UB.txt [ /tracking.mindshare.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\YU3D96LV.txt [ /doubleclick.net ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OA73UWGC.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CM91G8M9.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Q685U1H6.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VIGPXTTX.txt [ /www.zanox-affiliate.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\VQX8RQ63.txt [ /invitemedia.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K2LUOCX5.txt [ /track.effiliation.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\K1CF8VYR.txt [ /clickfuse.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5TXKFEZL.txt [ /de.sitestat.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\F0F33J4L.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\AU7A8HA9.txt [ /adx.chip.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\Q4CG5Y33.txt [ /collective-media.net ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6X78MH08.txt [ /ads.sportwerk.net ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2NSQVVQ4.txt [ /ad.360yield.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\49M6GEE1.txt [ /smartadserver.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QRIX3919.txt [ /ad.dyntracker.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\D67GULA3.txt [ /fastclick.net ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\6XCUFXT5.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\CCU8052A.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JSTXG9BD.txt [ /komtrack.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\BPMKH438.txt [ /ads.fordaq.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\9P2ZRJ6R.txt [ /track.effiliation.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\NWU25YBC.txt [ /ad2.adfarm1.adition.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GBR0012W.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5L5ZSN47.txt [ /banner.testberichte.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\224T2QCR.txt [ /tradedoubler.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\5U38936M.txt [ /eas.apm.emediate.eu ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\LO1MC29Q.txt [ /quartermedia.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\81OQQADH.txt [ /ad.yieldmanager.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JKXARLSW.txt [ /apmebf.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\H6X6X0F3.txt [ /ad.adnet.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\JRAJ5OK0.txt [ /ww251.smartadserver.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\EDIXU5GZ.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\DAPTYAIQ.txt [ /adtech.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\2H6UB3E8.txt [ /zanox-affiliate.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\PZ0QZ4LN.txt [ /heizungsfinder.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\ODWNLCI9.txt [ /dc.tremormedia.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\OQWI90BR.txt [ /www.googleadservices.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\GGISCYNJ.txt [ /ad.zanox.com ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\7LXRQ2F3.txt [ /a.revenuemax.de ]
        C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\QMNOKOZF.txt [ /traffictrack.de ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\YN9QUIQX.txt [ Cookie:admin@www.vaillant.de/Heizung-finden/Technik-verstehen/Ratgeber-lueftung/ ]
        C:\USERS\ADMIN\AppData\Roaming\Microsoft\Windows\Cookies\SMJFMHQQ.txt [ Cookie:admin@wm.wiredminds.de/track/ ]
        C:\USERS\ADMIN\Cookies\YN9QUIQX.txt [ Cookie:admin@www.vaillant.de/Heizung-finden/Technik-verstehen/Ratgeber-lueftung/ ]
        C:\USERS\ADMIN\Cookies\288MZ45R.txt [ Cookie:admin@revsci.net/ ]
        C:\USERS\ADMIN\Cookies\E93XL90M.txt [ Cookie:admin@adfarm1.adition.com/ ]
        C:\USERS\ADMIN\Cookies\K9Z322W5.txt [ Cookie:admin@server.adform.net/ ]
        C:\USERS\ADMIN\Cookies\G8N47VDO.txt [ Cookie:admin@de.sitestat.com/sport1/sport1-de/ ]
        C:\USERS\ADMIN\Cookies\9OMLAAXQ.txt [ Cookie:admin@adform.net/ ]
        C:\USERS\ADMIN\Cookies\I7JPPJXO.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/1045614742/ ]
        C:\USERS\ADMIN\Cookies\XZ198G15.txt [ Cookie:admin@komtrack.com/tr/400030 ]
        C:\USERS\ADMIN\Cookies\5IWVK0OO.txt [ Cookie:admin@zanox.com/ ]
        C:\USERS\ADMIN\Cookies\C64ST6LB.txt [ Cookie:admin@tracking.quisma.com/ ]
        C:\USERS\ADMIN\Cookies\KEQ2H9UB.txt [ Cookie:admin@tracking.mindshare.de/ ]
        C:\USERS\ADMIN\Cookies\YU3D96LV.txt [ Cookie:admin@doubleclick.net/ ]
        C:\USERS\ADMIN\Cookies\OA73UWGC.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/1072441209/ ]
        C:\USERS\ADMIN\Cookies\CM91G8M9.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/996625378/ ]
        C:\USERS\ADMIN\Cookies\Q685U1H6.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/1011642611/ ]
        C:\USERS\ADMIN\Cookies\VIGPXTTX.txt [ Cookie:admin@www.zanox-affiliate.de/ ]
        C:\USERS\ADMIN\Cookies\VQX8RQ63.txt [ Cookie:admin@invitemedia.com/ ]
        C:\USERS\ADMIN\Cookies\K2LUOCX5.txt [ Cookie:admin@track.effiliation.com/servlet/ ]
        C:\USERS\ADMIN\Cookies\K1CF8VYR.txt [ Cookie:admin@clickfuse.com/ ]
        C:\USERS\ADMIN\Cookies\5TXKFEZL.txt [ Cookie:admin@de.sitestat.com/sport1/ ]
        C:\USERS\ADMIN\Cookies\F0F33J4L.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/1072675358/ ]
        C:\USERS\ADMIN\Cookies\AU7A8HA9.txt [ Cookie:admin@adx.chip.de/ ]
        C:\USERS\ADMIN\Cookies\Q4CG5Y33.txt [ Cookie:admin@collective-media.net/ ]
        C:\USERS\ADMIN\Cookies\49M6GEE1.txt [ Cookie:admin@smartadserver.com/ ]
        C:\USERS\ADMIN\Cookies\6XCUFXT5.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/1071933529/ ]
        C:\USERS\ADMIN\Cookies\CCU8052A.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/1030987357/ ]
        C:\USERS\ADMIN\Cookies\JSTXG9BD.txt [ Cookie:admin@komtrack.com/tr ]
        C:\USERS\ADMIN\Cookies\9P2ZRJ6R.txt [ Cookie:admin@track.effiliation.com/ ]
        C:\USERS\ADMIN\Cookies\SMJFMHQQ.txt [ Cookie:admin@wm.wiredminds.de/track/ ]
        C:\USERS\ADMIN\Cookies\NWU25YBC.txt [ Cookie:admin@ad2.adfarm1.adition.com/ ]
        C:\USERS\ADMIN\Cookies\GBR0012W.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/964178336/ ]
        C:\USERS\ADMIN\Cookies\5L5ZSN47.txt [ Cookie:admin@banner.testberichte.de/ ]
        C:\USERS\ADMIN\Cookies\5U38936M.txt [ Cookie:admin@eas.apm.emediate.eu/ ]
        C:\USERS\ADMIN\Cookies\81OQQADH.txt [ Cookie:admin@ad.yieldmanager.com/ ]
        C:\USERS\ADMIN\Cookies\JKXARLSW.txt [ Cookie:admin@apmebf.com/ ]
        C:\USERS\ADMIN\Cookies\H6X6X0F3.txt [ Cookie:admin@ad.adnet.de/ ]
        C:\USERS\ADMIN\Cookies\JRAJ5OK0.txt [ Cookie:admin@ww251.smartadserver.com/ ]
        C:\USERS\ADMIN\Cookies\EDIXU5GZ.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/1070967573/ ]
        C:\USERS\ADMIN\Cookies\DAPTYAIQ.txt [ Cookie:admin@adtech.de/ ]
        C:\USERS\ADMIN\Cookies\2H6UB3E8.txt [ Cookie:admin@zanox-affiliate.de/ ]
        C:\USERS\ADMIN\Cookies\ODWNLCI9.txt [ Cookie:admin@dc.tremormedia.com/ ]
        C:\USERS\ADMIN\Cookies\OQWI90BR.txt [ Cookie:admin@www.googleadservices.com/pagead/conversion/1029343824/ ]
        C:\USERS\ADMIN\Cookies\GGISCYNJ.txt [ Cookie:admin@ad.zanox.com/ ]
        C:\USERS\ADMIN\Cookies\7LXRQ2F3.txt [ Cookie:admin@a.revenuemax.de/ ]
        ad4.adfarm1.adition.com [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .adfarm1.adition.com [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        de.sitestat.com [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        de.sitestat.com [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .revsci.net [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        .doubleclick.net [ C:\USERS\ADMIN\APPDATA\LOCAL\GOOGLE\CHROME\USER DATA\DEFAULT\COOKIES ]
        delivery.ibanner.de [ C:\USERS\ADMIN\APPDATA\ROAMING\MACROMEDIA\FLASH PLAYER\#SHAREDOBJECTS\R3BZSK8Z ]

Trojan.Agent/Gen-Koobface[Bonkers]
        ZIP ARCHIVE( C:\USERS\ADMIN\DOCUMENTS\BNT SKRIPT\KLAUSUREN\SONSITGES\NICO TECHNIKERSCHULE\TECHNIKER AUSBLIDUNG\TECHNIKER CD\SCHULE\NEU 13 ABSCHLUßPROJEKT\CRACK\ANRUFZAEHLER.ZIP )/ANRUFZAEHLER.EXE
        C:\USERS\ADMIN\DOCUMENTS\BNT SKRIPT\KLAUSUREN\SONSITGES\NICO TECHNIKERSCHULE\TECHNIKER AUSBLIDUNG\TECHNIKER CD\SCHULE\NEU 13 ABSCHLUßPROJEKT\CRACK\ANRUFZAEHLER.ZIP

Trojan.Agent/Gen-SoftonicDownloader
        C:\USERS\ADMIN\DOCUMENTS\BNT SKRIPT\MOD 02\SOFTONICDOWNLOADER_FUER_TEACHMASTER.EXE
Code:
Malwarebytes Anti-Malware 1.60.1.1000
www.malwarebytes.org

Datenbank Version: v2012.04.05.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Admin :: ADMIN-PC [Administrator]

05.04.2012 18:59:28
mbam-log-2012-04-05 (18-59-28).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 382077
Laufzeit: 1 Stunde(n), 27 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Gruß Hackel

Sorry,
noch ne Frage. Ich hab SUPERAntiSpyware noch offen. Soll ich dann auf Remove Threats??

Gruß Hackel

cosinus 05.04.2012 20:27
Ne Menge Cookies. Die können weg. Dann kommen zwei Fehlalarme. Das letzte - Softonic :pfui: - weg damit und Finger weg von Softonic!!


Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Hackel 05.04.2012 20:47
Bis auf die Such-Funktion funktioniert wieder alles. Da vielleicht einen Tipp was ich da machen könnte? Und noch einen Tipp bezüglich einem Antivirenschutzprogramm oder kann mir das hier mit allen guten passieren?

Gruß Hackel

cosinus 05.04.2012 21:31
Was bei der Suchfunktion genau nicht geht - beschreiben bitte

Zitat:
Und noch einen Tipp bezüglich einem Antivirenschutzprogramm oder kann mir das hier mit allen guten passieren?

Die Frage - welcher Virenscanner oder ob der installierte reicht - taucht ständig auf.
Der Virenscanner - egal welcher - kann und wird niemals 100% Schutz bieten können. Neue/unbekannte Schädlinge können immer durch die Lappen gehen. Geld ausgeben muss man nicht für einen Scanner, sowas wie Avast oder Microsoft Security Essentials sind für die privaten Gebrauch völlig ausreichend.
Abgesehen davon nutzen verschiedene Virenscanner unterschiedliche Signaturen und Techniken, das führt dazu, dass zB Scanner1 Schädling X entdeckt, aber Schädling Y übersieht. Scanner2 erkennt Schädling Y, dafür aber Schädling X nicht...
Wichtiger ist, dass du dich an Regeln hälst. Der beste Virenscanner bringt nichts, wenn du dich falsch verhälst und fahrlässig/unvorsichtig bist. Airbag und Sicherheitsgurt im Auto sind ja auch keine Gründe dafür auf die Verkehrsregeln zu pfeifen.

Halte Dich am besten grob an diese Regeln:
  1. Sei misstrauisch im Internet und v.a. bei unbekannten E-Mails, sei vorsichtig bei der Herausgabe persönlicher Daten!!
  2. Halte Windows und alle verwendeten Programme immer aktuell - unterstützen kann dich dabei Secunia PSI
  3. Führe regelmäßig Backups auf externe Medien durch
  4. Arbeite mit eingeschränkten Rechten
  5. Nutze sicherere Programme wie zB Opera oder Firefox zum Surfen statt den IE, zum Mailen Thunderbird statt Outlook Express - E-Mails nur als reinen text anzeigen lassen
  6. automatische Wiedergabe von allen Laufwerken komplett deaktivieren, denn das ist ein unnötiges Sicherheitsrisiko
  7. Bei der Installation von Software möglichst darauf achten, dass die Setups aus offiziellen Quellen stammen und du bei der Installation nach Möglichkeit die benutzerdefinierte Methode wählst - dann hast du die Möglichkeit etwaigen Schrott (wie Toolbars oder sowas wie RegistryBooster) abzuwählen, welcher sonst einfach mitinstalliert wird.
  8. Bösartige bzw. ungewollte Sites von vornherein blockieren lassen mit Hilfe der MVPS Hosts File => Blocking Unwanted Parasites with a Hosts File
  9. Finger weg von: TuneUp, Registry-Cleanern aller Art, Softonic sowie illegalen Cracks/Keygens oder anderen "Tools" um ein kommerzielles Programm ohne Lizenz nutzen zu können
  10. dubiose Seiten bzw. Kinofilm-Streaming-Portale ebenfalls sein lassen, erstens handelt man sich dort schnell Malware ein oder kann in Abofallen geraten und zweitens bewegen sich diese Seiten in einer rechtlichen Grauzone.


Alles noch genauer erklärt steht hier => Kompromittierung unvermeidbar?

Hackel 05.04.2012 22:16
Ich habe die Windows-Search funktion deaktiviert dann neu gestartet. Danach nochmal aktiviert und nochmal neugestartet jetzt gehts wieder. Ich habe das seit dem Zwischenfall schon mal probiert hat aber nicht funktioniert. Jetzt ist wieder alles ok so mwie das sehe als Laie.
Vielen vielen Dank für deine Hilfe. Super hilfreiche Seite!

Gruß Hackel

cosinus 06.04.2012 13:37
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 02:05 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131