Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Antivir Fund gefährlich ? Lohnt eine Suche oder eher das System neu aufspielen ? (https://www.trojaner-board.de/112738-antivir-fund-gefaehrlich-lohnt-suche-eher-system-neu-aufspielen.html)

muffin0815 07.04.2012 17:16
Zitat:
Sagmal gehörst du auch zur der Fraktion, die sich Serien und Kinofilme über dubiose Portale anschaut?
Mit nichten !!! Dieser Erscheinung der Neuzeit habe ich schon lange abgedankt !
Auf dem Laptop liefen noch nie Serien oder Kino Filme oder irgend welche Streams auser Youtoub und Facebook!

das Divx kommt zu 100 Prozent von Youtoub oder Facebook ! oder habe ich mir über Mail eingefangen das zeug anders kann ich mir das nicht erklähren.
Da ich eigentlich mit dem Laptop nur Mails und meine Einkauftätigkeiten erledig.
Daher dachte ich eigentlich ist Sicher mein Laptopp bis zum Avirafund !
Auf jeden fall werd ich schauen das ich diesen Player los bekomme !
Muss ich da Mozilla deinstallieren und neu aufspielen ??? !

Gruß und schöne Ostern auch noch

cosinus 07.04.2012 18:29
Nein ist schon, war nur eine Warnung für den Fall der Fälle, weil ich DivX bei dir gesehen habe :pfeiff: entspann dich ;)

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:
:OTL
IE - HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
IE - HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q="
[2012.04.03 16:38:43 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fässi Nutzer\AppData\Roaming\mozilla\Firefox\Profiles\7c6jnqz6.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.04.05 20:27:15 | 000,000,950 | ---- | M] () -- C:\Users\Fässi Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7c6jnqz6.default\searchplugins\icqplugin.xml
[2009.10.13 10:45:12 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0
O32 - Unable to read "AutoRun" value or value not present!
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:B1E5544A
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:A8ADE5D8
:Files
C:\Programme\ICQ6Toolbar
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

muffin0815 07.04.2012 18:54
So hier der log :
Code:
All processes killed
========== OTL ==========
HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1895092649-2944749539-1579830581-1006\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1895092649-2944749539-1579830581-1006\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Programme\ICQ6Toolbar\ICQToolBar.dll moved successfully.
Registry key HKEY_USERS\S-1-5-21-1895092649-2944749539-1579830581-1006\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q=" removed from keyword.URL
Folder C:\Users\Fässi Nutzer\AppData\Roaming\mozilla\Firefox\Profiles\7c6jnqz6.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\ not found.
C:\Users\Fässi Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7c6jnqz6.default\searchplugins\icqplugin.xml moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\NoHotStart deleted successfully.
File  not found.
C:\autoexec.bat moved successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
ADS C:\ProgramData\TEMP:B1E5544A deleted successfully.
ADS C:\ProgramData\TEMP:A8ADE5D8 deleted successfully.
========== FILES ==========
File\Folder C:\Programme\ICQ6Toolbar not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Fässi
->Temp folder emptied: 1554374586 bytes
->Temporary Internet Files folder emptied: 75858324 bytes
->Java cache emptied: 35594022 bytes
->FireFox cache emptied: 227636292 bytes
->Flash cache emptied: 93768 bytes
 
User: Fässi Nutzer
->Temp folder emptied: 5149215 bytes
->Temporary Internet Files folder emptied: 2710639 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 60843704 bytes
->Flash cache emptied: 707 bytes
 
User: Public
 
User: Sandra
->Temp folder emptied: 8662303 bytes
->Temporary Internet Files folder emptied: 49074119 bytes
->Java cache emptied: 31492502 bytes
->FireFox cache emptied: 482041770 bytes
->Flash cache emptied: 8951 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 24 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 230347144 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 2.636,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Fässi
->Flash cache emptied: 0 bytes
 
User: Fässi Nutzer
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Sandra
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.2 log created on 04072012_193946

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus 07.04.2012 19:02
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

muffin0815 07.04.2012 19:25
Code:
20:19:13.0790 1408        TDSS rootkit removing tool 2.7.26.0 Apr  4 2012 19:52:02
20:19:14.0211 1408        ============================================================
20:19:14.0211 1408        Current date / time: 2012/04/07 20:19:14.0211
20:19:14.0211 1408        SystemInfo:
20:19:14.0211 1408       
20:19:14.0227 1408        OS Version: 6.0.6002 ServicePack: 2.0
20:19:14.0227 1408        Product type: Workstation
20:19:14.0227 1408        ComputerName: FÄSSI-LP
20:19:14.0227 1408        UserName: Fässi Nutzer
20:19:14.0227 1408        Windows directory: C:\Windows
20:19:14.0227 1408        System windows directory: C:\Windows
20:19:14.0227 1408        Processor architecture: Intel x86
20:19:14.0227 1408        Number of processors: 2
20:19:14.0227 1408        Page size: 0x1000
20:19:14.0227 1408        Boot type: Normal boot
20:19:14.0227 1408        ============================================================
20:19:15.0475 1408        Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:19:15.0475 1408        Drive \Device\Harddisk1\DR1 - Size: 0x1DD800000 (7.46 Gb), SectorSize: 0x200, Cylinders: 0x3CD, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:19:15.0475 1408        Drive \Device\Harddisk2\DR2 - Size: 0x1DD800000 (7.46 Gb), SectorSize: 0x200, Cylinders: 0x3CD, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:19:15.0475 1408        \Device\Harddisk0\DR0:
20:19:15.0475 1408        MBR used
20:19:15.0475 1408        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1400800, BlocksNum 0xA0F7924
20:19:15.0475 1408        \Device\Harddisk1\DR1:
20:19:15.0475 1408        MBR used
20:19:15.0475 1408        \Device\Harddisk1\DR1\Partition0: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0xEEBFE0
20:19:15.0475 1408        \Device\Harddisk2\DR2:
20:19:15.0491 1408        MBR used
20:19:15.0491 1408        \Device\Harddisk2\DR2\Partition0: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0xEEBFE0
20:19:15.0506 1408        Initialize success
20:19:15.0506 1408        ============================================================
20:20:07.0891 0796        ============================================================
20:20:07.0891 0796        Scan started
20:20:07.0891 0796        Mode: Manual; SigCheck; TDLFS;
20:20:07.0891 0796        ============================================================
20:20:08.0952 0796        AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
20:20:09.0077 0796        AAV UpdateService - ok
20:20:09.0186 0796        ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
20:20:09.0201 0796        ACPI - ok
20:20:09.0264 0796        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
20:20:09.0264 0796        AdobeARMservice - ok
20:20:09.0404 0796        AdobeFlashPlayerUpdateSvc (0d4c486a24a711a45fd83acdf4d18506) C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
20:20:09.0420 0796        AdobeFlashPlayerUpdateSvc - ok
20:20:09.0529 0796        adp94xx        (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
20:20:09.0576 0796        adp94xx - ok
20:20:09.0669 0796        adpahci        (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
20:20:09.0685 0796        adpahci - ok
20:20:09.0747 0796        adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
20:20:09.0763 0796        adpu160m - ok
20:20:09.0825 0796        adpu320        (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
20:20:09.0841 0796        adpu320 - ok
20:20:09.0935 0796        AeLookupSvc    (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
20:20:10.0106 0796        AeLookupSvc - ok
20:20:10.0231 0796        AFD            (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
20:20:10.0309 0796        AFD - ok
20:20:10.0356 0796        AgereModemAudio (39e435c90c9c4f780fa0ed05ca3c3a1b) C:\Windows\system32\agrsmsvc.exe
20:20:10.0434 0796        AgereModemAudio - ok
20:20:10.0621 0796        AgereSoftModem  (ce91b158fa490cf4c4d487a4130f4660) C:\Windows\system32\DRIVERS\AGRSM.sys
20:20:10.0777 0796        AgereSoftModem - ok
20:20:10.0871 0796        agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
20:20:10.0886 0796        agp440 - ok
20:20:10.0995 0796        aic78xx        (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
20:20:11.0011 0796        aic78xx - ok
20:20:11.0058 0796        ALG            (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe
20:20:11.0183 0796        ALG - ok
20:20:11.0323 0796        aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
20:20:11.0323 0796        aliide - ok
20:20:11.0417 0796        amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
20:20:11.0432 0796        amdagp - ok
20:20:11.0495 0796        amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
20:20:11.0510 0796        amdide - ok
20:20:11.0635 0796        AmdK7          (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
20:20:11.0838 0796        AmdK7 - ok
20:20:11.0900 0796        AmdK8          (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
20:20:11.0963 0796        AmdK8 - ok
20:20:12.0056 0796        AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Program Files\Avira\AntiVir Desktop\sched.exe
20:20:12.0072 0796        AntiVirSchedulerService - ok
20:20:12.0119 0796        AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
20:20:12.0134 0796        AntiVirService - ok
20:20:12.0228 0796        Appinfo        (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll
20:20:12.0306 0796        Appinfo - ok
20:20:12.0399 0796        arc            (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
20:20:12.0415 0796        arc - ok
20:20:12.0540 0796        arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
20:20:12.0555 0796        arcsas - ok
20:20:12.0680 0796        AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
20:20:12.0727 0796        AsyncMac - ok
20:20:12.0805 0796        atapi          (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
20:20:12.0821 0796        atapi - ok
20:20:12.0914 0796        athr            (f32fee7cb2ee32c1f808409bc8019701) C:\Windows\system32\DRIVERS\athr.sys
20:20:13.0039 0796        athr - ok
20:20:13.0148 0796        Ati External Event Utility (d29cae8aa91e405a569892fa3d97aa64) C:\Windows\system32\Ati2evxx.exe
20:20:13.0242 0796        Ati External Event Utility - ok
20:20:13.0398 0796        atikmdag        (e46f2fb11cfe13187a4e3ef512c0d226) C:\Windows\system32\DRIVERS\atikmdag.sys
20:20:13.0757 0796        atikmdag - ok
20:20:13.0850 0796        AtiPcie        (4aa1eb65481c392955939e735d27118b) C:\Windows\system32\DRIVERS\AtiPcie.sys
20:20:13.0897 0796        AtiPcie - ok
20:20:13.0975 0796        AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
20:20:14.0022 0796        AudioEndpointBuilder - ok
20:20:14.0037 0796        Audiosrv        (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
20:20:14.0069 0796        Audiosrv - ok
20:20:14.0209 0796        avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys
20:20:14.0240 0796        avgntflt - ok
20:20:14.0303 0796        avipbb          (13b02b9b969dde270cd7c351203dad3c) C:\Windows\system32\DRIVERS\avipbb.sys
20:20:14.0349 0796        avipbb - ok
20:20:14.0396 0796        avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys
20:20:14.0412 0796        avkmgr - ok
20:20:14.0490 0796        Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
20:20:14.0521 0796        Beep - ok
20:20:14.0661 0796        BFE            (c789af0f724fda5852fb9a7d3a432381) C:\Windows\System32\bfe.dll
20:20:14.0708 0796        BFE - ok
20:20:14.0786 0796        BITS            (93952506c6d67330367f7e7934b6a02f) C:\Windows\System32\qmgr.dll
20:20:14.0927 0796        BITS - ok
20:20:15.0005 0796        blbdrive - ok
20:20:15.0067 0796        bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
20:20:15.0114 0796        bowser - ok
20:20:15.0254 0796        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
20:20:15.0285 0796        BrFiltLo - ok
20:20:15.0363 0796        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
20:20:15.0395 0796        BrFiltUp - ok
20:20:15.0457 0796        Browser        (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll
20:20:15.0504 0796        Browser - ok
20:20:15.0644 0796        Brserid        (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
20:20:15.0722 0796        Brserid - ok
20:20:15.0785 0796        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
20:20:15.0847 0796        BrSerWdm - ok
20:20:15.0909 0796        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
20:20:15.0987 0796        BrUsbMdm - ok
20:20:16.0112 0796        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
20:20:16.0190 0796        BrUsbSer - ok
20:20:16.0268 0796        BthEnum        (064fbc56921051de1075495d628b815f) C:\Windows\system32\DRIVERS\BthEnum.sys
20:20:16.0331 0796        BthEnum - ok
20:20:16.0393 0796        BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
20:20:16.0471 0796        BTHMODEM - ok
20:20:16.0565 0796        BthPan          (b8c3d9ddf85fd197c3e5f849fef71144) C:\Windows\system32\DRIVERS\bthpan.sys
20:20:16.0627 0796        BthPan - ok
20:20:16.0705 0796        BTHPORT        (b24757d9154cca035e1bbd3db92966d7) C:\Windows\system32\Drivers\BTHport.sys
20:20:16.0736 0796        BTHPORT - ok
20:20:16.0799 0796        BthServ        (a4c8377fa4a994e07075107dbe2e3dce) C:\Windows\System32\bthserv.dll
20:20:16.0845 0796        BthServ - ok
20:20:16.0955 0796        BTHUSB          (d42cf5f0c7635b3f1578810fe34d9e41) C:\Windows\system32\Drivers\BTHUSB.sys
20:20:16.0970 0796        BTHUSB - ok
20:20:17.0048 0796        btwaudio        (636f45a8500c1438cfa7dee15fc5c184) C:\Windows\system32\drivers\btwaudio.sys
20:20:17.0048 0796        btwaudio - ok
20:20:17.0111 0796        btwavdt        (bf9256ff01b093a5d90bb7a35ec90410) C:\Windows\system32\drivers\btwavdt.sys
20:20:17.0111 0796        btwavdt - ok
20:20:17.0220 0796        btwrchid        (0ab8c1ac177afb27309e1072faf34a37) C:\Windows\system32\DRIVERS\btwrchid.sys
20:20:17.0235 0796        btwrchid - ok
20:20:17.0360 0796        cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
20:20:17.0423 0796        cdfs - ok
20:20:17.0501 0796        cdrom          (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
20:20:17.0532 0796        cdrom - ok
20:20:17.0672 0796        CertPropSvc    (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
20:20:17.0719 0796        CertPropSvc - ok
20:20:17.0781 0796        circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
20:20:17.0844 0796        circlass - ok
20:20:17.0906 0796        CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
20:20:17.0937 0796        CLFS - ok
20:20:18.0000 0796        clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:20:18.0015 0796        clr_optimization_v2.0.50727_32 - ok
20:20:18.0125 0796        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:20:18.0140 0796        clr_optimization_v4.0.30319_32 - ok
20:20:18.0249 0796        CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
20:20:18.0296 0796        CmBatt - ok
20:20:18.0343 0796        cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
20:20:18.0359 0796        cmdide - ok
20:20:18.0421 0796        Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
20:20:18.0437 0796        Compbatt - ok
20:20:18.0468 0796        COMSysApp - ok
20:20:18.0515 0796        crcdisk        (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
20:20:18.0515 0796        crcdisk - ok
20:20:18.0593 0796        Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
20:20:18.0671 0796        Crusoe - ok
20:20:18.0749 0796        CryptSvc        (fb27772beaf8e1d28ccd825c09da939b) C:\Windows\system32\cryptsvc.dll
20:20:18.0795 0796        CryptSvc - ok
20:20:18.0873 0796        DcomLaunch      (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
20:20:18.0983 0796        DcomLaunch - ok
20:20:19.0061 0796        DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
20:20:19.0107 0796        DfsC - ok
20:20:19.0263 0796        DFSR            (2cc3dcfb533a1035b13dcab6160ab38b) C:\Windows\system32\DFSR.exe
20:20:19.0482 0796        DFSR - ok
20:20:19.0591 0796        dg_ssudbus      (919f338fd36f47d860775368d0748780) C:\Windows\system32\DRIVERS\ssudbus.sys
20:20:19.0607 0796        dg_ssudbus - ok
20:20:19.0731 0796        Dhcp            (9028559c132146fb75eb7acf384b086a) C:\Windows\System32\dhcpcsvc.dll
20:20:19.0763 0796        Dhcp - ok
20:20:19.0872 0796        disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
20:20:19.0887 0796        disk - ok
20:20:19.0950 0796        Dnscache        (57d762f6f5974af0da2be88a3349baaa) C:\Windows\System32\dnsrslvr.dll
20:20:19.0997 0796        Dnscache - ok
20:20:20.0075 0796        dot3svc        (324fd74686b1ef5e7c19a8af49e748f6) C:\Windows\System32\dot3svc.dll
20:20:20.0106 0796        dot3svc - ok
20:20:20.0215 0796        DPS            (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll
20:20:20.0262 0796        DPS - ok
20:20:20.0340 0796        drmkaud        (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
20:20:20.0371 0796        drmkaud - ok
20:20:20.0480 0796        DXGKrnl        (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
20:20:20.0527 0796        DXGKrnl - ok
20:20:20.0621 0796        E1G60          (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
20:20:20.0714 0796        E1G60 - ok
20:20:20.0777 0796        EapHost        (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll
20:20:20.0808 0796        EapHost - ok
20:20:20.0933 0796        Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
20:20:20.0964 0796        Ecache - ok
20:20:21.0026 0796        ehRecvr        (9be3744d295a7701eb425332014f0797) C:\Windows\ehome\ehRecvr.exe
20:20:21.0073 0796        ehRecvr - ok
20:20:21.0104 0796        ehSched        (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe
20:20:21.0167 0796        ehSched - ok
20:20:21.0182 0796        ehstart        (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll
20:20:21.0213 0796        ehstart - ok
20:20:21.0338 0796        elxstor        (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
20:20:21.0369 0796        elxstor - ok
20:20:21.0447 0796        EMDMgmt        (4e6b23dfc917ea39306b529b773950f4) C:\Windows\system32\emdmgmt.dll
20:20:21.0572 0796        EMDMgmt - ok
20:20:21.0697 0796        epmntdrv        (539ca34fbc74ec366a0d751028c32a08) C:\Windows\system32\epmntdrv.sys
20:20:21.0713 0796        epmntdrv ( UnsignedFile.Multi.Generic ) - warning
20:20:21.0713 0796        epmntdrv - detected UnsignedFile.Multi.Generic (1)
20:20:21.0775 0796        EuGdiDrv        (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\Windows\system32\EuGdiDrv.sys
20:20:21.0791 0796        EuGdiDrv ( UnsignedFile.Multi.Generic ) - warning
20:20:21.0791 0796        EuGdiDrv - detected UnsignedFile.Multi.Generic (1)
20:20:21.0869 0796        EventSystem    (67058c46504bc12d821f38cf99b7b28f) C:\Windows\system32\es.dll
20:20:21.0915 0796        EventSystem - ok
20:20:22.0040 0796        exfat          (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
20:20:22.0165 0796        exfat - ok
20:20:22.0227 0796        Fabs - ok
20:20:22.0290 0796        fastfat        (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
20:20:22.0321 0796        fastfat - ok
20:20:22.0430 0796        fdc            (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
20:20:22.0493 0796        fdc - ok
20:20:22.0571 0796        fdPHost        (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll
20:20:22.0617 0796        fdPHost - ok
20:20:22.0680 0796        FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
20:20:22.0742 0796        FDResPub - ok
20:20:22.0867 0796        FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
20:20:22.0883 0796        FileInfo - ok
20:20:22.0945 0796        Filetrace      (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
20:20:22.0992 0796        Filetrace - ok
20:20:23.0148 0796        FirebirdServerMAGIXInstance (fff1130f7c9fa01d093a1edfc5cce8fc) C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
20:20:23.0382 0796        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning
20:20:23.0382 0796        FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)
20:20:23.0491 0796        flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
20:20:23.0553 0796        flpydisk - ok
20:20:23.0631 0796        FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
20:20:23.0647 0796        FltMgr - ok
20:20:23.0756 0796        FontCache      (8ce364388c8eca59b14b539179276d44) C:\Windows\system32\FntCache.dll
20:20:23.0881 0796        FontCache - ok
20:20:23.0975 0796        FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:20:23.0990 0796        FontCache3.0.0.0 - ok
20:20:24.0068 0796        Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
20:20:24.0115 0796        Fs_Rec - ok
20:20:24.0162 0796        gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
20:20:24.0177 0796        gagp30kx - ok
20:20:24.0224 0796        gpsvc          (cd5d0aeee35dfd4e986a5aa1500a6e66) C:\Windows\System32\gpsvc.dll
20:20:24.0287 0796        gpsvc - ok
20:20:24.0411 0796        Guard.Mail.ru  (e859ca020ed61899f3c74a8d0032d05c) C:\Program Files\Guard-ICQ\GuardICQ.exe
20:20:24.0521 0796        Guard.Mail.ru - ok
20:20:24.0614 0796        gupdate        (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
20:20:24.0630 0796        gupdate - ok
20:20:24.0630 0796        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
20:20:24.0645 0796        gupdatem - ok
20:20:24.0770 0796        HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
20:20:24.0848 0796        HdAudAddService - ok
20:20:24.0942 0796        HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:20:25.0035 0796        HDAudBus - ok
20:20:25.0160 0796        HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
20:20:25.0223 0796        HidBth - ok
20:20:25.0285 0796        HidIr          (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
20:20:25.0347 0796        HidIr - ok
20:20:25.0457 0796        hidserv        (84067081f3318162797385e11a8f0582) C:\Windows\system32\hidserv.dll
20:20:25.0472 0796        hidserv - ok
20:20:25.0581 0796        HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
20:20:25.0628 0796        HidUsb - ok
20:20:25.0691 0796        hkmsvc          (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll
20:20:25.0769 0796        hkmsvc - ok
20:20:25.0878 0796        HpCISSs        (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
20:20:25.0893 0796        HpCISSs - ok
20:20:26.0003 0796        HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
20:20:26.0112 0796        HTTP - ok
20:20:26.0174 0796        i2omp          (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
20:20:26.0190 0796        i2omp - ok
20:20:26.0299 0796        i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
20:20:26.0346 0796        i8042prt - ok
20:20:26.0408 0796        iaStorV        (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
20:20:26.0424 0796        iaStorV - ok
20:20:26.0517 0796        ICQ Service    (58bd7551b0445f3673d96ca380f21822) C:\Program Files\ICQ6Toolbar\ICQ Service.exe
20:20:26.0533 0796        ICQ Service - ok
20:20:26.0642 0796        IDriverT        (daf66902f08796f9c694901660e5a64a) C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
20:20:26.0658 0796        IDriverT ( UnsignedFile.Multi.Generic ) - warning
20:20:26.0658 0796        IDriverT - detected UnsignedFile.Multi.Generic (1)
20:20:26.0751 0796        idsvc          (98477b08e61945f974ed9fdc4cb6bdab) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:20:26.0861 0796        idsvc - ok
20:20:26.0939 0796        iirsp          (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
20:20:26.0954 0796        iirsp - ok
20:20:27.0048 0796        IKEEXT          (9908d8a397b76cd8d31d0d383c5773c9) C:\Windows\System32\ikeext.dll
20:20:27.0079 0796        IKEEXT - ok
20:20:27.0329 0796        IntcAzAudAddService (b0878f280fa335ac67f056a9bfe06e04) C:\Windows\system32\drivers\RTKVHDA.sys
20:20:27.0469 0796        IntcAzAudAddService - ok
20:20:27.0563 0796        intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
20:20:27.0563 0796        intelide - ok
20:20:27.0687 0796        intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
20:20:27.0719 0796        intelppm - ok
20:20:27.0797 0796        IPBusEnum      (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll
20:20:27.0843 0796        IPBusEnum - ok
20:20:27.0937 0796        IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:20:27.0968 0796        IpFilterDriver - ok
20:20:28.0046 0796        iphlpsvc        (1998bd97f950680bb55f55a7244679c2) C:\Windows\System32\iphlpsvc.dll
20:20:28.0124 0796        iphlpsvc - ok
20:20:28.0155 0796        IpInIp - ok
20:20:28.0218 0796        IPMIDRV        (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
20:20:28.0296 0796        IPMIDRV - ok
20:20:28.0389 0796        IPNAT          (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
20:20:28.0436 0796        IPNAT - ok
20:20:28.0530 0796        IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
20:20:28.0577 0796        IRENUM - ok
20:20:28.0655 0796        isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
20:20:28.0670 0796        isapnp - ok
20:20:28.0748 0796        iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
20:20:28.0764 0796        iScsiPrt - ok
20:20:28.0826 0796        iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
20:20:28.0826 0796        iteatapi - ok
20:20:28.0935 0796        iteraid        (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
20:20:28.0951 0796        iteraid - ok
20:20:29.0029 0796        kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
20:20:29.0045 0796        kbdclass - ok
20:20:29.0123 0796        kbdhid          (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys
20:20:29.0169 0796        kbdhid - ok
20:20:29.0247 0796        KeyIso          (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:20:29.0294 0796        KeyIso - ok
20:20:29.0403 0796        KMDFMEMIO      (ebc507f129df8f0e0ca270dcfc0cf87f) C:\Windows\system32\DRIVERS\kmdfmemio.sys
20:20:29.0419 0796        KMDFMEMIO - ok
20:20:29.0544 0796        KSecDD          (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys
20:20:29.0591 0796        KSecDD - ok
20:20:29.0653 0796        KtmRm          (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll
20:20:29.0731 0796        KtmRm - ok
20:20:29.0825 0796        LanmanServer    (1bf5eebfd518dd7298434d8c862f825d) C:\Windows\system32\srvsvc.dll
20:20:29.0887 0796        LanmanServer - ok
20:20:29.0965 0796        LanmanWorkstation (1db69705b695b987082c8baec0c6b34f) C:\Windows\System32\wkssvc.dll
20:20:30.0012 0796        LanmanWorkstation - ok
20:20:30.0090 0796        lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
20:20:30.0137 0796        lltdio - ok
20:20:30.0230 0796        lltdsvc        (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll
20:20:30.0293 0796        lltdsvc - ok
20:20:30.0355 0796        lmhosts        (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
20:20:30.0417 0796        lmhosts - ok
20:20:30.0511 0796        LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
20:20:30.0527 0796        LSI_FC - ok
20:20:30.0558 0796        LSI_SAS        (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
20:20:30.0573 0796        LSI_SAS - ok
20:20:30.0651 0796        LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
20:20:30.0667 0796        LSI_SCSI - ok
20:20:30.0729 0796        luafv          (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
20:20:30.0776 0796        luafv - ok
20:20:30.0839 0796        Mcx2Svc        (aef9babb8a506bc4ce0451a64aaded46) C:\Windows\system32\Mcx2Svc.dll
20:20:30.0870 0796        Mcx2Svc - ok
20:20:30.0948 0796        megasas        (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
20:20:30.0963 0796        megasas - ok
20:20:31.0057 0796        MMCSS          (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
20:20:31.0088 0796        MMCSS - ok
20:20:31.0166 0796        Modem          (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
20:20:31.0213 0796        Modem - ok
20:20:31.0291 0796        monitor        (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
20:20:31.0338 0796        monitor - ok
20:20:31.0400 0796        mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
20:20:31.0416 0796        mouclass - ok
20:20:31.0478 0796        mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
20:20:31.0509 0796        mouhid - ok
20:20:31.0556 0796        MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
20:20:31.0572 0796        MountMgr - ok
20:20:31.0650 0796        mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
20:20:31.0665 0796        mpio - ok
20:20:31.0743 0796        mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
20:20:31.0775 0796        mpsdrv - ok
20:20:31.0837 0796        MpsSvc          (5de62c6e9108f14f6794060a9bdecaec) C:\Windows\system32\mpssvc.dll
20:20:31.0915 0796        MpsSvc - ok
20:20:32.0009 0796        Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
20:20:32.0024 0796        Mraid35x - ok
20:20:32.0102 0796        MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
20:20:32.0133 0796        MRxDAV - ok
20:20:32.0211 0796        mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:20:32.0258 0796        mrxsmb - ok
20:20:32.0352 0796        mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:20:32.0399 0796        mrxsmb10 - ok
20:20:32.0445 0796        mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:20:32.0461 0796        mrxsmb20 - ok
20:20:32.0523 0796        msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
20:20:32.0539 0796        msahci - ok
20:20:32.0601 0796        msdsm          (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
20:20:32.0617 0796        msdsm - ok
20:20:32.0726 0796        MSDTC          (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe
20:20:32.0773 0796        MSDTC - ok
20:20:32.0867 0796        Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
20:20:32.0913 0796        Msfs - ok
20:20:33.0007 0796        msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
20:20:33.0023 0796        msisadrv - ok
20:20:33.0116 0796        MSiSCSI        (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll
20:20:33.0163 0796        MSiSCSI - ok
20:20:33.0225 0796        msiserver - ok
20:20:33.0335 0796        MSKSSRV        (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
20:20:33.0381 0796        MSKSSRV - ok
20:20:33.0475 0796        MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
20:20:33.0522 0796        MSPCLOCK - ok
20:20:33.0584 0796        MSPQM          (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
20:20:33.0631 0796        MSPQM - ok
20:20:33.0725 0796        MsRPC          (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
20:20:33.0740 0796        MsRPC - ok
20:20:33.0849 0796        mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
20:20:33.0849 0796        mssmbios - ok
20:20:33.0912 0796        MSTEE          (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
20:20:33.0959 0796        MSTEE - ok
20:20:34.0021 0796        Mup            (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
20:20:34.0037 0796        Mup - ok
20:20:34.0130 0796        napagent        (e4eaf0c5c1b41b5c83386cf212ca9584) C:\Windows\system32\qagentRT.dll
20:20:34.0177 0796        napagent - ok
20:20:34.0286 0796        NativeWifiP    (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
20:20:34.0317 0796        NativeWifiP - ok
20:20:34.0427 0796        NAUpdate        (1bbbf640bc0e0b750537baece8d66c18) C:\Program Files\Nero\Update\NASvc.exe
20:20:34.0505 0796        NAUpdate - ok
20:20:34.0661 0796        NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
20:20:34.0723 0796        NDIS - ok
20:20:34.0801 0796        NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
20:20:34.0832 0796        NdisTapi - ok
20:20:34.0895 0796        Ndisuio        (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
20:20:34.0941 0796        Ndisuio - ok
20:20:35.0097 0796        NdisWan        (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
20:20:35.0144 0796        NdisWan - ok
20:20:35.0207 0796        NDProxy        (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
20:20:35.0238 0796        NDProxy - ok
20:20:35.0300 0796        NetBIOS        (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
20:20:35.0347 0796        NetBIOS - ok
20:20:35.0456 0796        netbt          (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
20:20:35.0487 0796        netbt - ok
20:20:35.0550 0796        Netlogon        (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:20:35.0565 0796        Netlogon - ok
20:20:35.0643 0796        Netman          (c8052711daecc48b982434c5116ca401) C:\Windows\System32\netman.dll
20:20:35.0706 0796        Netman - ok
20:20:35.0768 0796        netprofm        (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32\netprofm.dll
20:20:35.0831 0796        netprofm - ok
20:20:35.0909 0796        NetTcpPortSharing (d6c4e4a39a36029ac0813d476fbd0248) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:20:35.0924 0796        NetTcpPortSharing - ok
20:20:36.0096 0796        NETw2v32        (6e9edc1020b319e7676387b8cdf2398c) C:\Windows\system32\DRIVERS\NETw2v32.sys
20:20:36.0345 0796        NETw2v32 - ok
20:20:36.0392 0796        nfrd960        (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
20:20:36.0408 0796        nfrd960 - ok
20:20:36.0470 0796        NlaSvc          (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32\nlasvc.dll
20:20:36.0517 0796        NlaSvc - ok
20:20:36.0626 0796        Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
20:20:36.0689 0796        Npfs - ok
20:20:36.0751 0796        nsi            (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32\nsisvc.dll
20:20:36.0798 0796        nsi - ok
20:20:36.0876 0796        nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
20:20:36.0907 0796        nsiproxy - ok
20:20:37.0001 0796        Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
20:20:37.0094 0796        Ntfs - ok
20:20:37.0203 0796        ntrigdigi      (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
20:20:37.0266 0796        ntrigdigi - ok
20:20:37.0344 0796        Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
20:20:37.0375 0796        Null - ok
20:20:37.0437 0796        nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
20:20:37.0437 0796        nvraid - ok
20:20:37.0500 0796        nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
20:20:37.0515 0796        nvstor - ok
20:20:37.0578 0796        nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
20:20:37.0593 0796        nv_agp - ok
20:20:37.0671 0796        NwlnkFlt - ok
20:20:37.0703 0796        NwlnkFwd - ok
20:20:37.0827 0796        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:20:37.0843 0796        odserv - ok
20:20:37.0968 0796        ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\DRIVERS\ohci1394.sys
20:20:38.0046 0796        ohci1394 - ok
20:20:38.0124 0796        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:20:38.0139 0796        ose - ok
20:20:38.0233 0796        p2pimsvc        (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:20:38.0358 0796        p2pimsvc - ok
20:20:38.0405 0796        p2psvc          (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:20:38.0436 0796        p2psvc - ok
20:20:38.0576 0796        Parport        (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
20:20:38.0639 0796        Parport - ok
20:20:38.0763 0796        partmgr        (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
20:20:38.0779 0796        partmgr - ok
20:20:38.0826 0796        Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
20:20:38.0888 0796        Parvdm - ok
20:20:38.0951 0796        PcaSvc          (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll
20:20:39.0029 0796        PcaSvc - ok
20:20:39.0138 0796        pci            (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
20:20:39.0153 0796        pci - ok
20:20:39.0200 0796        pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
20:20:39.0216 0796        pciide - ok
20:20:39.0278 0796        pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\DRIVERS\pcmcia.sys
20:20:39.0309 0796        pcmcia - ok
20:20:39.0387 0796        PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
20:20:39.0559 0796        PEAUTH - ok
20:20:39.0777 0796        pla            (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll
20:20:39.0933 0796        pla - ok
20:20:39.0980 0796        PlugPlay        (c5e7f8a996ec0a82d508fd9064a5569e) C:\Windows\system32\umpnpmgr.dll
20:20:40.0027 0796        PlugPlay - ok
20:20:40.0136 0796        PMBDeviceInfoProvider (627fa58adc043704f9d14ca44340956f) C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
20:20:40.0167 0796        PMBDeviceInfoProvider - ok
20:20:40.0292 0796        PNRPAutoReg    (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:20:40.0323 0796        PNRPAutoReg - ok
20:20:40.0355 0796        PNRPsvc        (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:20:40.0401 0796        PNRPsvc - ok
20:20:40.0511 0796        PolicyAgent    (d0494460421a03cd5225cca0059aa146) C:\Windows\System32\ipsecsvc.dll
20:20:40.0589 0796        PolicyAgent - ok
20:20:40.0698 0796        PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
20:20:40.0745 0796        PptpMiniport - ok
20:20:40.0823 0796        Processor      (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
20:20:40.0885 0796        Processor - ok
20:20:40.0963 0796        ProfSvc        (0508faa222d28835310b7bfca7a77346) C:\Windows\system32\profsvc.dll
20:20:41.0010 0796        ProfSvc - ok
20:20:41.0103 0796        ProtectedStorage (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:20:41.0135 0796        ProtectedStorage - ok
20:20:41.0197 0796        PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
20:20:41.0244 0796        PSched - ok
20:20:41.0291 0796        PSI            (1df21f001f3a94eba4a2950c70cc358f) C:\Windows\system32\DRIVERS\psi_mf.sys
20:20:41.0306 0796        PSI - ok
20:20:41.0400 0796        ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
20:20:41.0462 0796        ql2300 - ok
20:20:41.0556 0796        ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
20:20:41.0571 0796        ql40xx - ok
20:20:41.0634 0796        QWAVE          (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll
20:20:41.0681 0796        QWAVE - ok
20:20:41.0743 0796        QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
20:20:41.0759 0796        QWAVEdrv - ok
20:20:41.0899 0796        R300            (e46f2fb11cfe13187a4e3ef512c0d226) C:\Windows\system32\DRIVERS\atikmdag.sys
20:20:42.0008 0796        R300 - ok
20:20:42.0133 0796        RapiMgr        (70dbdab246c18b78e2200d6401d038be) C:\Windows\WindowsMobile\rapimgr.dll
20:20:42.0180 0796        RapiMgr - ok
20:20:42.0258 0796        RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
20:20:42.0305 0796        RasAcd - ok
20:20:42.0351 0796        RasAuto        (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32\rasauto.dll
20:20:42.0383 0796        RasAuto - ok
20:20:42.0461 0796        Rasl2tp        (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:20:42.0507 0796        Rasl2tp - ok
20:20:42.0601 0796        RasMan          (75d47445d70ca6f9f894b032fbc64fcf) C:\Windows\System32\rasmans.dll
20:20:42.0648 0796        RasMan - ok
20:20:42.0726 0796        RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
20:20:42.0757 0796        RasPppoe - ok
20:20:42.0851 0796        RasSstp        (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
20:20:42.0897 0796        RasSstp - ok
20:20:42.0991 0796        rdbss          (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
20:20:43.0038 0796        rdbss - ok
20:20:43.0116 0796        RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
20:20:43.0147 0796        RDPCDD - ok
20:20:43.0241 0796        rdpdr          (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
20:20:43.0319 0796        rdpdr - ok
20:20:43.0365 0796        RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
20:20:43.0412 0796        RDPENCDD - ok
20:20:43.0537 0796        RDPWD          (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys
20:20:43.0584 0796        RDPWD - ok
20:20:43.0662 0796        RemoteAccess    (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll
20:20:43.0709 0796        RemoteAccess - ok
20:20:43.0787 0796        RemoteRegistry  (9e6894ea18daff37b63e1005f83ae4ab) C:\Windows\system32\regsvc.dll
20:20:43.0833 0796        RemoteRegistry - ok
20:20:43.0896 0796        RFCOMM          (7ec90c316177ba3f1bce92005264b447) C:\Windows\system32\DRIVERS\rfcomm.sys
20:20:43.0974 0796        RFCOMM - ok
20:20:44.0099 0796        RichVideo      (2af094b1ce4725e4551f38fda2348637) C:\Program Files\CyberLink\Shared Files\RichVideo.exe
20:20:44.0130 0796        RichVideo ( UnsignedFile.Multi.Generic ) - warning
20:20:44.0130 0796        RichVideo - detected UnsignedFile.Multi.Generic (1)
20:20:44.0208 0796        RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
20:20:44.0255 0796        RpcLocator - ok
20:20:44.0333 0796        RpcSs          (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
20:20:44.0411 0796        RpcSs - ok
20:20:44.0567 0796        rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
20:20:44.0598 0796        rspndr - ok
20:20:44.0660 0796        RTL8023xp      (959ef612d2ccfdb6d9e443f8e3655013) C:\Windows\system32\DRIVERS\Rtnicxp.sys
20:20:44.0754 0796        RTL8023xp - ok
20:20:44.0832 0796        SamSs          (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:20:44.0847 0796        SamSs - ok
20:20:44.0941 0796        SbFw            (9c9bcc79aef0aa97f16766c498002d36) C:\Windows\system32\drivers\SbFw.sys
20:20:44.0957 0796        SbFw - ok
20:20:45.0081 0796        SBFWIMCL        (f27b38d70b7621378161d6f48be04d2c) C:\Windows\system32\DRIVERS\sbfwim.sys
20:20:45.0081 0796        SBFWIMCL - ok
20:20:45.0128 0796        SBFWIMCLMP      (f27b38d70b7621378161d6f48be04d2c) C:\Windows\system32\DRIVERS\SBFWIM.sys
20:20:45.0144 0796        SBFWIMCLMP - ok
20:20:45.0191 0796        sbhips          (53e5e7dc26bb920b97f258bbd52abfdc) C:\Windows\system32\drivers\sbhips.sys
20:20:45.0206 0796        sbhips - ok
20:20:45.0269 0796        sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
20:20:45.0284 0796        sbp2port - ok
20:20:45.0331 0796        SBRE - ok
20:20:45.0471 0796        SbTis          (6468e2973e04525decc105947ddd0d34) C:\Windows\system32\drivers\sbtis.sys
20:20:45.0471 0796        SbTis - ok
20:20:45.0534 0796        SCardSvr        (77b7a11a0c3d78d3386398fbbea1b632) C:\Windows\System32\SCardSvr.dll
20:20:45.0581 0796        SCardSvr - ok
20:20:45.0643 0796        Schedule        (1a58069db21d05eb2ab58ee5753ebe8d) C:\Windows\system32\schedsvc.dll
20:20:45.0752 0796        Schedule - ok
20:20:45.0846 0796        SCPolicySvc    (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
20:20:45.0877 0796        SCPolicySvc - ok
20:20:45.0955 0796        sdbus          (4339a2585708c7d9b0c0ce5aad3dd6ff) C:\Windows\system32\DRIVERS\sdbus.sys
20:20:46.0033 0796        sdbus - ok
20:20:46.0095 0796        SDRSVC          (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll
20:20:46.0158 0796        SDRSVC - ok
20:20:46.0267 0796        SeaPort        (271077b91d7ad1b616f8afdfe8e3f981) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
20:20:46.0283 0796        SeaPort - ok
20:20:46.0407 0796        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
20:20:46.0485 0796        secdrv - ok
20:20:46.0548 0796        seclogon        (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll
20:20:46.0610 0796        seclogon - ok
20:20:46.0719 0796        Secunia Update Agent - ok
20:20:47.0000 0796        SENS            (a9bbab5759771e523f55563d6cbe140f) C:\Windows\System32\sens.dll
20:20:47.0047 0796        SENS - ok
20:20:47.0219 0796        Ser2pl          (b97e1d0e59a128394f24e9f31e227ef2) C:\Windows\system32\DRIVERS\ser2pl.sys
20:20:47.0281 0796        Ser2pl - ok
20:20:47.0359 0796        Serenum        (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys
20:20:47.0406 0796        Serenum - ok
20:20:47.0484 0796        Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
20:20:47.0546 0796        Serial - ok
20:20:47.0640 0796        sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
20:20:47.0671 0796        sermouse - ok
20:20:47.0733 0796        SessionEnv      (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll
20:20:47.0780 0796        SessionEnv - ok
20:20:47.0827 0796        sffdisk        (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
20:20:47.0905 0796        sffdisk - ok
20:20:47.0967 0796        sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
20:20:48.0045 0796        sffp_mmc - ok
20:20:48.0108 0796        sffp_sd        (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
20:20:48.0186 0796        sffp_sd - ok
20:20:48.0248 0796        sfloppy        (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
20:20:48.0326 0796        sfloppy - ok
20:20:48.0451 0796        SharedAccess    (e1499bd0ff76b1b2fbbf1af339d91165) C:\Windows\System32\ipnathlp.dll
20:20:48.0498 0796        SharedAccess - ok
20:20:48.0545 0796        ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:\Windows\System32\shsvcs.dll
20:20:48.0623 0796        ShellHWDetection - ok
20:20:48.0701 0796        sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
20:20:48.0716 0796        sisagp - ok
20:20:48.0779 0796        SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
20:20:48.0794 0796        SiSRaid2 - ok
20:20:48.0857 0796        SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
20:20:48.0872 0796        SiSRaid4 - ok
20:20:49.0075 0796        slsvc          (862bb4cbc05d80c5b45be430e5ef872f) C:\Windows\system32\SLsvc.exe
20:20:49.0356 0796        slsvc - ok
20:20:49.0449 0796        SLUINotify      (6edc422215cd78aa8a9cde6b30abbd35) C:\Windows\system32\SLUINotify.dll
20:20:49.0481 0796        SLUINotify - ok
20:20:49.0621 0796        Smb            (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
20:20:49.0730 0796        Smb - ok
20:20:49.0902 0796        SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
20:20:49.0933 0796        SNMPTRAP - ok
20:20:50.0011 0796        spldr          (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
20:20:50.0027 0796        spldr - ok
20:20:50.0089 0796        Spooler        (8554097e5136c3bf9f69fe578a1b35f4) C:\Windows\System32\spoolsv.exe
20:20:50.0151 0796        Spooler - ok
20:20:50.0214 0796        SQLWriter      (54902536aad0e9b99bc65f89c0caf93f) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
20:20:50.0229 0796        SQLWriter - ok
20:20:50.0339 0796        srv            (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
20:20:50.0385 0796        srv - ok
20:20:50.0432 0796        srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
20:20:50.0463 0796        srv2 - ok
20:20:50.0495 0796        srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
20:20:50.0526 0796        srvnet - ok
20:20:50.0588 0796        SSDPSRV        (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll
20:20:50.0635 0796        SSDPSRV - ok
20:20:50.0760 0796        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
20:20:50.0775 0796        ssmdrv - ok
20:20:50.0838 0796        SstpSvc        (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll
20:20:50.0869 0796        SstpSvc - ok
20:20:50.0931 0796        ssudmdm        (8f299012ef58246f1c98de7b7e48dbf0) C:\Windows\system32\DRIVERS\ssudmdm.sys
20:20:50.0947 0796        ssudmdm - ok
20:20:51.0025 0796        StarOpen - ok
20:20:51.0087 0796        StillCam        (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys
20:20:51.0119 0796        StillCam - ok
20:20:51.0197 0796        stisvc          (5de7d67e49b88f5f07f3e53c4b92a352) C:\Windows\System32\wiaservc.dll
20:20:51.0290 0796        stisvc - ok
20:20:51.0415 0796        swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
20:20:51.0431 0796        swenum - ok
20:20:51.0493 0796        swprv          (f21fd248040681cca1fb6c9a03aaa93d) C:\Windows\System32\swprv.dll
20:20:51.0524 0796        swprv - ok
20:20:51.0587 0796        Symc8xx        (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
20:20:51.0602 0796        Symc8xx - ok
20:20:51.0680 0796        Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
20:20:51.0696 0796        Sym_hi - ok
20:20:51.0758 0796        Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
20:20:51.0774 0796        Sym_u3 - ok
20:20:51.0883 0796        SynTP          (c1777074592bbb55b1f1a2fbc7a60498) C:\Windows\system32\DRIVERS\SynTP.sys
20:20:51.0899 0796        SynTP - ok
20:20:51.0977 0796        SysMain        (9a51b04e9886aa4ee90093586b0ba88d) C:\Windows\system32\sysmain.dll
20:20:52.0070 0796        SysMain - ok
20:20:52.0148 0796        TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
20:20:52.0211 0796        TabletInputService - ok
20:20:52.0320 0796        TapiSrv        (d7673e4b38ce21ee54c59eeeb65e2483) C:\Windows\System32\tapisrv.dll
20:20:52.0367 0796        TapiSrv - ok
20:20:52.0445 0796        TBS            (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32\tbssvc.dll
20:20:52.0491 0796        TBS - ok
20:20:52.0632 0796        Tcpip          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys
20:20:52.0725 0796        Tcpip - ok
20:20:52.0819 0796        Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys
20:20:52.0897 0796        Tcpip6 - ok
20:20:53.0006 0796        tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
20:20:53.0084 0796        tcpipreg - ok
20:20:53.0193 0796        TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
20:20:53.0256 0796        TDPIPE - ok
20:20:53.0303 0796        TDTCP          (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
20:20:53.0334 0796        TDTCP - ok
20:20:53.0459 0796        tdx            (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
20:20:53.0490 0796        tdx - ok
20:20:53.0583 0796        TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
20:20:53.0599 0796        TermDD - ok
20:20:53.0771 0796        TermService    (bb95da09bef6e7a131bff3ba5032090d) C:\Windows\System32\termsrv.dll
20:20:53.0880 0796        TermService - ok
20:20:53.0958 0796        Themes          (c7230fbee14437716701c15be02c27b8) C:\Windows\system32\shsvcs.dll
20:20:53.0989 0796        Themes - ok
20:20:54.0051 0796        THREADORDER    (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
20:20:54.0083 0796        THREADORDER - ok
20:20:54.0223 0796        TlntSvr        (5e1bc006cb4a26507d4512795cf08373) C:\Windows\System32\tlntsvr.exe
20:20:54.0285 0796        TlntSvr - ok
20:20:54.0348 0796        TrkWks          (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32\trkwks.dll
20:20:54.0395 0796        TrkWks - ok
20:20:54.0426 0796        TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:\Windows\servicing\TrustedInstaller.exe
20:20:54.0473 0796        TrustedInstaller - ok
20:20:54.0551 0796        tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:20:54.0597 0796        tssecsrv - ok
20:20:54.0675 0796        tunmp          (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
20:20:54.0691 0796        tunmp - ok
20:20:54.0785 0796        tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
20:20:54.0800 0796        tunnel - ok
20:20:54.0878 0796        uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
20:20:54.0894 0796        uagp35 - ok
20:20:55.0019 0796        udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
20:20:55.0050 0796        udfs - ok
20:20:55.0097 0796        UI0Detect      (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe
20:20:55.0159 0796        UI0Detect - ok
20:20:55.0221 0796        uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
20:20:55.0221 0796        uliagpkx - ok
20:20:55.0315 0796        uliahci        (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
20:20:55.0331 0796        uliahci - ok
20:20:55.0393 0796        UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
20:20:55.0409 0796        UlSata - ok
20:20:55.0471 0796        ulsata2        (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
20:20:55.0487 0796        ulsata2 - ok
20:20:55.0565 0796        umbus          (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
20:20:55.0611 0796        umbus - ok
20:20:55.0689 0796        upnphost        (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll
20:20:55.0736 0796        upnphost - ok
20:20:55.0845 0796        usbccgp        (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
20:20:55.0861 0796        usbccgp - ok
20:20:55.0939 0796        usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
20:20:56.0017 0796        usbcir - ok
20:20:56.0095 0796        usbehci        (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
20:20:56.0126 0796        usbehci - ok
20:20:56.0204 0796        usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
20:20:56.0251 0796        usbhub - ok
20:20:56.0345 0796        usbohci        (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
20:20:56.0376 0796        usbohci - ok
20:20:56.0438 0796        usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
20:20:56.0501 0796        usbprint - ok
20:20:56.0579 0796        USBSTOR        (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:20:56.0594 0796        USBSTOR - ok
20:20:56.0672 0796        usbuhci        (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
20:20:56.0750 0796        usbuhci - ok
20:20:56.0813 0796        UxSms          (1509e705f3ac1d474c92454a5c2dd81f) C:\Windows\System32\uxsms.dll
20:20:56.0844 0796        UxSms - ok
20:20:56.0922 0796        vds            (cd88d1b7776dc17a119049742ec07eb4) C:\Windows\System32\vds.exe
20:20:57.0031 0796        vds - ok
20:20:57.0187 0796        vga            (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
20:20:57.0249 0796        vga - ok
20:20:57.0312 0796        VgaSave        (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
20:20:57.0343 0796        VgaSave - ok
20:20:57.0390 0796        viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
20:20:57.0405 0796        viaagp - ok
20:20:57.0468 0796        ViaC7          (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
20:20:57.0530 0796        ViaC7 - ok
20:20:57.0608 0796        viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
20:20:57.0624 0796        viaide - ok
20:20:57.0717 0796        volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
20:20:57.0733 0796        volmgr - ok
20:20:57.0811 0796        volmgrx        (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
20:20:57.0842 0796        volmgrx - ok
20:20:57.0873 0796        volsnap        (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
20:20:57.0905 0796        volsnap - ok
20:20:57.0967 0796        vsmraid        (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
20:20:57.0983 0796        vsmraid - ok
20:20:58.0107 0796        VSS            (db3d19f850c6eb32bdcb9bc0836acddb) C:\Windows\system32\vssvc.exe
20:20:58.0248 0796        VSS - ok
20:20:58.0326 0796        W32Time        (96ea68b9eb310a69c25ebb0282b2b9de) C:\Windows\system32\w32time.dll
20:20:58.0373 0796        W32Time - ok
20:20:58.0482 0796        WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
20:20:58.0544 0796        WacomPen - ok
20:20:58.0622 0796        Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:20:58.0638 0796        Wanarp - ok
20:20:58.0653 0796        Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:20:58.0669 0796        Wanarpv6 - ok
20:20:58.0747 0796        WcesComm        (779f9c90d3fe9c70b6ffd8ef035f3e83) C:\Windows\WindowsMobile\wcescomm.dll
20:20:58.0809 0796        WcesComm - ok
20:20:58.0903 0796        wcncsvc        (a3cd60fd826381b49f03832590e069af) C:\Windows\System32\wcncsvc.dll
20:20:58.0934 0796        wcncsvc - ok
20:20:59.0028 0796        WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
20:20:59.0075 0796        WcsPlugInService - ok
20:20:59.0153 0796        Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
20:20:59.0168 0796        Wd - ok
20:20:59.0277 0796        Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
20:20:59.0324 0796        Wdf01000 - ok
20:20:59.0402 0796        WdiServiceHost  (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
20:20:59.0449 0796        WdiServiceHost - ok
20:20:59.0449 0796        WdiSystemHost  (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
20:20:59.0496 0796        WdiSystemHost - ok
20:20:59.0543 0796        WebClient      (04c37d8107320312fbae09926103d5e2) C:\Windows\System32\webclnt.dll
20:20:59.0574 0796        WebClient - ok
20:20:59.0636 0796        Wecsvc          (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll
20:20:59.0730 0796        Wecsvc - ok
20:20:59.0808 0796        wercplsupport  (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll
20:20:59.0839 0796        wercplsupport - ok
20:20:59.0870 0796        WerSvc          (32b88481d3b326da6deb07b1d03481e7) C:\Windows\System32\WerSvc.dll
20:20:59.0917 0796        WerSvc - ok
20:20:59.0979 0796        WinDefend      (4575aa12561c5648483403541d0d7f2b) C:\Program Files\Windows Defender\mpsvc.dll
20:20:59.0995 0796        WinDefend - ok
20:21:00.0120 0796        WinDriver6      (94e4312d546048bf31604a8b2ad13fc0) C:\Windows\system32\drivers\windrvr6.sys
20:21:00.0182 0796        WinDriver6 - ok
20:21:00.0198 0796        WinHttpAutoProxySvc - ok
20:21:00.0213 0796        WINIO - ok
20:21:00.0338 0796        Winmgmt        (6b2a1d0e80110e3d04e6863c6e62fd8a) C:\Windows\system32\wbem\WMIsvc.dll
20:21:00.0354 0796        Winmgmt - ok
20:21:00.0463 0796        WinRM          (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll
20:21:00.0557 0796        WinRM - ok
20:21:00.0666 0796        winusb          (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\winusb.sys
20:21:00.0713 0796        winusb - ok
20:21:00.0822 0796        Wlansvc        (c008405e4feeb069e30da1d823910234) C:\Windows\System32\wlansvc.dll
20:21:00.0915 0796        Wlansvc - ok
20:21:01.0025 0796        wlidsvc        (5144ae67d60ec653f97ddf3feed29e77) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:21:01.0149 0796        wlidsvc - ok
20:21:01.0305 0796        WmiAcpi        (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
20:21:01.0368 0796        WmiAcpi - ok
20:21:01.0477 0796        wmiApSrv        (43be3875207dcb62a85c8c49970b66cc) C:\Windows\system32\wbem\WmiApSrv.exe
20:21:01.0508 0796        wmiApSrv - ok
20:21:01.0602 0796        WMPNetworkSvc  (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe
20:21:01.0695 0796        WMPNetworkSvc - ok
20:21:01.0867 0796        WPCSvc          (cfc5a04558f5070cee3e3a7809f3ff52) C:\Windows\System32\wpcsvc.dll
20:21:01.0914 0796        WPCSvc - ok
20:21:01.0992 0796        WPDBusEnum      (801fbdb89d472b3c467eb112a0fc9246) C:\Windows\system32\wpdbusenum.dll
20:21:02.0023 0796        WPDBusEnum - ok
20:21:02.0132 0796        WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
20:21:02.0148 0796        WpdUsb - ok
20:21:02.0304 0796        WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:21:02.0335 0796        WPFFontCache_v0400 - ok
20:21:02.0413 0796        ws2ifsl        (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
20:21:02.0444 0796        ws2ifsl - ok
20:21:02.0522 0796        wscsvc          (1ca6c40261ddc0425987980d0cd2aaab) C:\Windows\System32\wscsvc.dll
20:21:02.0569 0796        wscsvc - ok
20:21:02.0678 0796        WSDPrintDevice  (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys
20:21:02.0709 0796        WSDPrintDevice - ok
20:21:02.0756 0796        WSearch - ok
20:21:02.0897 0796        wuauserv        (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
20:21:03.0084 0796        wuauserv - ok
20:21:03.0209 0796        WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:21:03.0255 0796        WUDFRd - ok
20:21:03.0489 0796        wudfsvc        (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll
20:21:03.0521 0796        wudfsvc - ok
20:21:03.0614 0796        yukonwlh        (04e268adfc81964c49dc0c082d520f7e) C:\Windows\system32\DRIVERS\yk60x86.sys
20:21:03.0661 0796        yukonwlh - ok
20:21:03.0677 0796        MBR (0x1B8)    (61a349592c4728853f4a90ff78f7628e) \Device\Harddisk0\DR0
20:21:04.0176 0796        \Device\Harddisk0\DR0 - ok
20:21:04.0176 0796        MBR (0x1B8)    (65e858a8a0293be11a920b0bc99d695e) \Device\Harddisk1\DR1
20:21:05.0237 0796        \Device\Harddisk1\DR1 - ok
20:21:05.0237 0796        MBR (0x1B8)    (65e858a8a0293be11a920b0bc99d695e) \Device\Harddisk2\DR2
20:21:09.0683 0796        \Device\Harddisk2\DR2 - ok
20:21:09.0683 0796        Boot (0x1200)  (d1e2cd8194e7965c77b404912505b2bf) \Device\Harddisk0\DR0\Partition0
20:21:09.0683 0796        \Device\Harddisk0\DR0\Partition0 - ok
20:21:09.0698 0796        Boot (0x1200)  (09a87539c4d9481f7c6a37f44a13f2a3) \Device\Harddisk1\DR1\Partition0
20:21:09.0698 0796        \Device\Harddisk1\DR1\Partition0 - ok
20:21:09.0698 0796        Boot (0x1200)  (ce330dc435a261a08fc1df4061628af4) \Device\Harddisk2\DR2\Partition0
20:21:09.0714 0796        \Device\Harddisk2\DR2\Partition0 - ok
20:21:09.0714 0796        ============================================================
20:21:09.0714 0796        Scan finished
20:21:09.0714 0796        ============================================================
20:21:09.0714 3808        Detected object count: 5
20:21:09.0714 3808        Actual detected object count: 5
20:21:51.0563 3808        epmntdrv ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808        epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:21:51.0563 3808        EuGdiDrv ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808        EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:21:51.0563 3808        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808        FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:21:51.0563 3808        IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808        IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:21:51.0563 3808        RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808        RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 08.04.2012 15:45
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

muffin0815 08.04.2012 17:01
[code]
Combofix Logfile:
Code:
ComboFix 12-04-07.04 - Fässi Nutzer 08.04.2012  17:40:54.1.2 - x86
Microsoft® Windows Vista™ Home Premium  6.0.6002.2.1252.49.1031.18.1789.894 [GMT 2:00]
ausgeführt von:: c:\users\Fõssi Nutzer\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
c:\windows\system32\dv
c:\windows\system32\MSDCSC
c:\windows\system32\MSDCSC\winlogon.exe
c:\windows\system32\system32
c:\windows\system32\system32\3DAudio.ax
c:\windows\system32\system32\avrt.dll
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\mfplat.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-03-08 bis 2012-04-08  ))))))))))))))))))))))))))))))
.
.
2012-04-07 17:39 . 2012-04-07 17:39        --------        d-----w-        C:\_OTL
2012-04-07 15:19 . 2012-03-14 02:15        6582328        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D0EE6D8-4ED1-4AFD-BA67-A597BD181089}\mpengine.dll
2012-04-06 07:00 . 2012-04-06 07:00        --------        d-----w-        c:\users\Fässi\AppData\Roaming\NeroDigital
2012-04-02 18:27 . 2012-04-02 18:27        --------        d-----w-        c:\program files\ESET
2012-04-02 15:04 . 2012-04-02 15:04        --------        d-----w-        c:\users\Fässi\AppData\Roaming\Malwarebytes
2012-04-02 14:56 . 2012-04-02 14:56        --------        d-----w-        c:\programdata\Malwarebytes
2012-04-02 14:56 . 2011-12-10 13:24        20464        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-04-02 14:56 . 2012-04-02 14:56        --------        d-----w-        c:\program files\Malwarebytes' Anti-Malware
2012-03-31 20:06 . 2012-03-31 20:06        --------        d-----w-        c:\program files\icq
2012-03-31 20:06 . 2012-03-31 20:06        --------        d-----w-        c:\program files\Guard-ICQ
2012-03-31 20:04 . 2012-03-31 20:07        --------        d-----w-        c:\program files\ICQ7.7
2012-03-31 17:54 . 2012-03-31 17:53        637848        ----a-w-        c:\windows\system32\npdeployJava1.dll
2012-03-31 17:45 . 2012-03-31 17:45        --------        d-----w-        c:\program files\Secunia
2012-03-31 17:44 . 2012-03-31 17:44        --------        d-----w-        c:\program files\FileHippo.com
2012-03-31 15:12 . 2012-03-31 15:12        --------        d-----w-        c:\users\Fässi Nutzer
2012-03-30 19:08 . 2012-03-30 19:38        418464        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-03-30 19:07 . 2012-03-30 20:11        --------        d-----w-        c:\users\Sandra\AppData\Local\adaware
2012-03-30 19:05 . 2012-03-30 19:05        --------        d-----w-        c:\users\Sandra\AppData\Roaming\Ad-Aware Antivirus
2012-03-30 18:40 . 2012-03-30 18:40        --------        d-----w-        c:\users\Fässi\AppData\Local\adaware
2012-03-30 18:39 . 2011-04-05 15:35        94040        ----a-w-        c:\windows\system32\drivers\sbhips.sys
2012-03-30 18:39 . 2011-04-05 15:35        78936        ----a-w-        c:\windows\system32\drivers\sbtis.sys
2012-03-30 18:37 . 2011-02-08 07:14        69208        ----a-w-        c:\windows\system32\drivers\SbFwIm.sys
2012-03-30 18:37 . 2011-04-05 15:35        221784        ----a-w-        c:\windows\system32\drivers\SbFw.sys
2012-03-30 18:32 . 2012-03-30 18:32        --------        d-----w-        c:\program files\Toolbar Cleaner
2012-03-28 17:15 . 2012-03-28 17:15        --------        d-----w-        c:\users\Fässi\AppData\Roaming\Help
2012-03-28 17:11 . 2012-03-28 17:11        --------        d-----w-        c:\users\Fässi\AppData\Roaming\TeamViewer
2012-03-19 17:27 . 2012-03-19 17:27        592824        ----a-w-        c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-19 17:27 . 2012-03-19 17:27        44472        ----a-w-        c:\program files\Mozilla Firefox\mozglue.dll
2012-03-15 18:10 . 2012-03-15 18:10        --------        d-----w-        c:\users\Fässi\Ausbilder
2012-03-14 19:00 . 2012-02-02 15:16        2044416        ----a-w-        c:\windows\system32\win32k.sys
2012-03-14 19:00 . 2012-02-14 15:45        219648        ----a-w-        c:\windows\system32\d3d10_1core.dll
2012-03-14 19:00 . 2012-02-13 14:12        1172480        ----a-w-        c:\windows\system32\d3d10warp.dll
2012-03-14 19:00 . 2012-02-13 13:44        1068544        ----a-w-        c:\windows\system32\DWrite.dll
2012-03-14 19:00 . 2012-02-14 15:45        160768        ----a-w-        c:\windows\system32\d3d10_1.dll
2012-03-14 19:00 . 2012-02-13 13:47        683008        ----a-w-        c:\windows\system32\d2d1.dll
2012-03-14 18:59 . 2012-01-31 10:59        2409784        ----a-w-        c:\program files\Windows Mail\OESpamFilter.dat
2012-03-14 18:57 . 2012-01-09 15:54        613376        ----a-w-        c:\windows\system32\rdpencom.dll
2012-03-14 18:57 . 2012-01-09 13:58        180736        ----a-w-        c:\windows\system32\drivers\rdpwd.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-31 17:53 . 2010-05-18 09:48        567696        ----a-w-        c:\windows\system32\deployJava1.dll
2012-03-30 19:38 . 2011-06-29 16:36        70304        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-23 08:18 . 2009-10-03 08:58        237072        ------w-        c:\windows\system32\MpSigStub.exe
2012-02-15 17:31 . 2011-10-16 10:25        137416        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-01-13 17:47 . 2012-01-13 17:30        102400        ----a-w-        c:\windows\system32\Setup.dll
2009-08-07 12:57 . 2009-09-21 12:03        1456640        ----a-w-        c:\program files\Common Files\Falk Navi-Manager.msi
2009-09-25 16:41 . 2009-09-25 16:41        1044480        ----a-w-        c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41        200704        ----a-w-        c:\program files\mozilla firefox\plugins\ssldivx.dll
2012-03-19 17:27 . 2011-05-02 17:26        97208        ----a-w-        c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2012-03-26 306688]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-08 6273568]
"Iomega Home Storage Manager"="c:\program files\Iomega\Home Storage Manager\Iomega Discovery.exe" [2009-10-27 152936]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37        843712        ----a-w-        c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detection]
2011-11-30 05:46        788368        ----a-w-        c:\program files\Lidl_Fotos\dd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]
2011-02-23 20:19        371200        ----a-w-        c:\program files\FreePDF_XP\fpassist.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2011-12-16 11:54        220744        ----a-w-        c:\program files\pdf24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMBVolumeWatcher]
2009-11-04 16:20        597792        ----a-w-        c:\program files\Sony\PMB\PMBVolumeWatcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrayServer]
2008-08-07 14:18        90112        ----a-w-        c:\program files\MAGIX\Video_deluxe_16\Trayserver.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"StartCCC"=c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
"Windows Mobile-based device management"=%windir%\WindowsMobile\wmdSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1895092649-2944749539-1579830581-1003]
"EnableNotificationsRef"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 253600]
S2 AAV UpdateService;AAV UpdateService;c:\program files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs        REG_MULTI_SZ          BthServ
WindowsMobile        REG_MULTI_SZ          wcescomm rapimgr
LocalServiceRestricted        REG_MULTI_SZ          WcesComm RapiMgr
LocalServiceAndNoImpersonation        REG_MULTI_SZ          FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 19:38]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-25 18:28]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-25 18:28]
.
2012-04-08 c:\windows\Tasks\SupBackGroundTask.job
- c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe [2008-09-25 12:26]
.
2012-04-08 c:\windows\Tasks\User_Feed_Synchronization-{3936AE30-DAAA-4190-BAEA-92F1B6503585}.job
- c:\windows\system32\msfeedssync.exe [2008-05-15 07:33]
.
2012-04-07 c:\windows\Tasks\User_Feed_Synchronization-{92086986-0B9B-44CF-9687-C488A176B971}.job
- c:\windows\system32\msfeedssync.exe [2008-05-15 07:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page =
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Fässi Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7c6jnqz6.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-08 17:52
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse...
.
Scanne versteckte Autostarteinträge...
.
Scanne versteckte Dateien...
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000004
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-04-08  17:56:43
ComboFix-quarantined-files.txt  2012-04-08 15:56
.
Vor Suchlauf: 17 Verzeichnis(se), 31.392.206.848 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 31.088.861.184 Bytes frei
.
- - End Of File - - DA91E15E5EC4C091BE425CD4FCBC4AD4
--- --- ---

cosinus 08.04.2012 17:18
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

muffin0815 08.04.2012 19:04
[code]
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-04-08 18:56:55
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2160BH_PL rev.0000001C
Running: 2veo6f2m.exe; Driver: C:\Users\FSSINU~1\AppData\Local\Temp\pgliypoc.sys


---- Kernel code sections - GMER 1.0.15 ----

?              C:\Windows\system32\Drivers\PROCEXP113.SYS                                                      Das System kann die angegebene Datei nicht finden. !
?              C:\Users\FSSINU~1\AppData\Local\Temp\catchme.sys                                                Das System kann die angegebene Datei nicht finden. !

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\tdx \Device\Tcp                                                                          SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\Tcp                                                                          sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\Udp                                                                          SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\Udp                                                                          sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\RawIp                                                                        SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\RawIp                                                                        sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software, Inc.)
AttachedDevice  \FileSystem\fastfat \Fat                                                                        fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00027875488f                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00027875585f                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000278755861                     
Reg            HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000278755ef5                     
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00027875488f (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00027875585f (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000278755861 (not active ControlSet) 
Reg            HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000278755ef5 (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
--- --- ---


Code:


OSAM Logfile:

       
Code:

       
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:06:12 on 08.04.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 11.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"SupBackGroundTask.job" - ? - C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe  (File found, but it contains no detailed information)

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\FSSINU~1\AppData\Local\Temp\catchme.sys  (File not found)
"epmntdrv" (epmntdrv) - ? - C:\Windows\system32\epmntdrv.sys  (File found, but it contains no detailed information)
"EuGdiDrv" (EuGdiDrv) - ? - C:\Windows\system32\EuGdiDrv.sys  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"mbr" (mbr) - ? - C:\ComboFix\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"pgliypoc" (pgliypoc) - ? - C:\Users\FSSINU~1\AppData\Local\Temp\pgliypoc.sys  (Hidden registry entry, rootkit activity | File not found)
"PSI" (PSI) - "Secunia" - C:\Windows\System32\DRIVERS\psi_mf.sys
"SbFw" (SbFw) - "Sunbelt Software, Inc." - C:\Windows\System32\drivers\SbFw.sys
"sbhips" (sbhips) - "Sunbelt Software, Inc." - C:\Windows\System32\drivers\sbhips.sys
"SBRE" (SBRE) - ? - C:\Windows\system32\drivers\SBREdrv.sys  (File not found)
"SbTis" (SbTis) - "Sunbelt Software, Inc." - C:\Windows\System32\drivers\sbtis.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File not found)
"WINIO" (WINIO) - ? - C:\Program Files\MetaBench\winio.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B} "{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - ? - D:\Programme Treiber\Nero 9\Nero CoverDesigner\CoverEdExtension.dll  (File not found)
{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B} "NeroDigitalColumnHandler" - ? -   (File not found | COM-object registry key not found)
{1CA6BBC9-E9FA-4021-822B-075DF1837B63} "NeroDigitalIconHandler" - ? -   (File not found | COM-object registry key not found)
{4FBFFA8D-F390-471a-AE46-FEB93623AD63} "NeroDigitalInfoHandler" - ? -   (File not found | COM-object registry key not found)
{846083A4-BFC6-4447-985C-6578B466A7D7} "NeroDigitalPropSheetHandler" - ? -   (File not found | COM-object registry key not found)
{EDCC595A-F0EE-4d81-B554-D5D01C7AFB87} "NeroDigitalThumbnailHandler" - ? -   (File not found | COM-object registry key not found)
{F764812A-132C-4013-9960-5CBBEB408A0E} "NeroShellExt Class" - "Nero AG" - C:\Program Files\Common Files\Nero\NeroShellExt\NeroShellExt.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\npjpi170_03.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 10.3.0" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
"ICQ7.7" - "ICQ, LLC." - C:\Program Files\ICQ7.7\ICQ.exe
"PokerStars" - "PokerStars" - C:\Program Files\PokerStars\PokerStarsUpdate.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\ssv.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Fässi Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"FileHippo.com" - "FileHippo.com" - "C:\Program Files\FileHippo.com\UpdateChecker.exe" /background
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"Iomega Home Storage Manager" - "Iomega Corporation" - C:\Program Files\Iomega\Home Storage Manager\Iomega Discovery.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll
"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Program Files\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files\Nero\Update\NASvc.exe
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"AAV UpdateService" (AAV UpdateService) - ? - C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
"Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Guard.Mail.ru" (Guard.Mail.ru) - ? - C:\Program Files\Guard-ICQ\GuardICQ.exe
"ICQ Service" (ICQ Service) - ? - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PMBDeviceInfoProvider" (PMBDeviceInfoProvider) - "Sony Corporation" - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"Secunia Update Agent" (Secunia Update Agent) - ? - "C:\Program Files\Secunia\PSI\sua.exe" --start-service  (File not found)
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

===[ Logfile end ]=========================================[ Logfile end ]===

--- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-08 19:06:22
-----------------------------
19:06:22.040    OS Version: Windows 6.0.6002 Service Pack 2
19:06:22.041    Number of processors: 2 586 0xF0D
19:06:22.042    ComputerName: FÄSSI-LP  UserName:
19:06:23.316    Initialize success
19:16:32.041    AVAST engine defs: 12040800
19:16:40.670    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
19:16:40.674    Disk 0 Vendor: FUJITSU_MHW2160BH_PL 0000001C Size: 152627MB BusType: 3
19:16:40.972    Disk 0 MBR read successfully
19:16:40.976    Disk 0 MBR scan
19:16:41.041    Disk 0 unknown MBR code
19:16:41.170    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
19:16:41.291    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        82415 MB offset 20973568
19:16:41.485    Disk 0 scanning sectors +189759780
19:16:42.094    Disk 0 scanning C:\Windows\system32\drivers
19:18:31.064    Service scanning
19:19:01.071    Modules scanning
19:21:07.006    Disk 0 trace - called modules:
19:21:07.065    ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
19:21:07.071    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x852a8ac8]
19:21:07.077    3 CLASSPNP.SYS[87da18b3] -> nt!IofCallDriver -> [0x84d6f418]
19:21:07.083    5 acpi.sys[876486bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84d54800]
19:21:07.814    AVAST engine scan C:\Windows
19:22:07.474    AVAST engine scan C:\Windows\system32
19:35:43.831    AVAST engine scan C:\Windows\system32\drivers
19:36:03.969    AVAST engine scan C:\Users\Fässi Nutzer
19:36:30.979    AVAST engine scan C:\ProgramData
19:54:24.251    Scan finished successfully
19:57:18.919    Disk 0 MBR has been saved successfully to "C:\Users\Fässi Nutzer\Desktop\MBR.dat"
19:57:18.927    The log file has been saved successfully to "C:\Users\Fässi Nutzer\Desktop\aswMBR.txt"

cosinus 08.04.2012 19:51
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

muffin0815 08.04.2012 20:41
So der 2. te Log :

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-08 21:06:57
-----------------------------
21:06:57.691    OS Version: Windows 6.0.6002 Service Pack 2
21:06:57.691    Number of processors: 2 586 0xF0D
21:06:57.692    ComputerName: FÄSSI-LP  UserName:
21:07:25.143    Initialize success
21:07:32.347    AVAST engine defs: 12040800
21:07:38.213    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
21:07:38.216    Disk 0 Vendor: FUJITSU_MHW2160BH_PL 0000001C Size: 152627MB BusType: 3
21:07:38.228    Disk 0 MBR read successfully
21:07:38.231    Disk 0 MBR scan
21:07:38.249    Disk 0 Windows VISTA default MBR code
21:07:38.269    Disk 0 Partition 1 00    27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
21:07:38.290    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        82415 MB offset 20973568
21:07:38.298    Disk 0 scanning sectors +189759780
21:07:38.384    Disk 0 scanning C:\Windows\system32\drivers
21:08:01.465    Service scanning
21:09:02.781    Modules scanning
21:09:46.807    Disk 0 trace - called modules:
21:09:46.851    ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys
21:09:46.858    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84d748f0]
21:09:46.864    3 CLASSPNP.SYS[87dac8b3] -> nt!IofCallDriver -> [0x84d74388]
21:09:46.871    5 acpi.sys[876466bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84d55b98]
21:09:48.821    AVAST engine scan C:\Windows
21:09:57.757    AVAST engine scan C:\Windows\system32
21:17:22.938    AVAST engine scan C:\Windows\system32\drivers
21:17:59.960    AVAST engine scan C:\Users\Fässi Nutzer
21:18:31.061    AVAST engine scan C:\ProgramData
21:35:55.914    Scan finished successfully
21:39:44.230    Disk 0 MBR has been saved successfully to "C:\Users\Fässi Nutzer\Desktop\MBR.dat"
21:39:44.237    The log file has been saved successfully to "C:\Users\Fässi Nutzer\Desktop\aswMBR2.txt"

cosinus 08.04.2012 20:55
Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

muffin0815 09.04.2012 07:44
So anbei Die Logs ,

Wusste gar nicht wieviele Cookies da im Hindergrund gespeichert sind von denen man die Quelle gar nicht kennt !

Die Trojaner agent dateien Ame und Lidl sind mir bekannt!
AME ist eine Verwaltungssoftware und Lidl eben von Lidl !

cosinus 09.04.2012 16:41
Zitat:
Die Trojaner agent dateien Ame und Lidl sind mir bekannt!
AME ist eine Verwaltungssoftware und Lidl eben von Lidl !
Das sind Fehlalarme

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

muffin0815 09.04.2012 17:01
Ok Gut werd ich mir mal anschauen wegen den cookies !

Die 2 Dateien sind jetzt im Quarantene Ordner , muss ich die wieder frei geben ?

Wie sieht es jetzt mit meinem System aus ist wieder alles sauber oder ?
war das schlimme Malware die ich hatte ?

Gibt es noch etwas das ich beachten muss damit ich das zeug nicht wieder bekomme ? Hab mal den Thread " Anleitung zur Absicherung des Rechners"
gelesen reicht das aus wenn man sich daran haltet ?ODer was empfiehlst du ?

Ansonsten Denke ich ist alles Ok!Hoffe ich mal !


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:52 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131