Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Musik kommt automatisch unter "Name nicht Verfügbar" im Audiomixer (Windows 7) (https://www.trojaner-board.de/121438-musik-kommt-automatisch-name-verfuegbar-audiomixer-windows-7-a.html)

cosinus 10.09.2012 22:15
Diesen Eintrag => Virus.Win32.ZAccess.m <= bitte mit dem TDSS-Killer fixen. Aber bitte nur diesen Eintrag!
Starte Windows danach neu und mach wieder ein komplett neues Log mit dem TDSS-Killer. Wie immer wieder in CODE-Tags posten.

aypstyle 10.09.2012 22:34
Code:
23:32:02.0374 1112  TDSS rootkit removing tool 2.8.8.0 Aug 24 2012 13:27:48
23:32:02.0545 1112  ============================================================
23:32:02.0545 1112  Current date / time: 2012/09/10 23:32:02.0545
23:32:02.0545 1112  SystemInfo:
23:32:02.0545 1112 
23:32:02.0545 1112  OS Version: 6.1.7601 ServicePack: 1.0
23:32:02.0545 1112  Product type: Workstation
23:32:02.0545 1112  ComputerName: AYPSTYLE-PC
23:32:02.0545 1112  UserName: aYpStyle
23:32:02.0545 1112  Windows directory: C:\Windows
23:32:02.0545 1112  System windows directory: C:\Windows
23:32:02.0545 1112  Processor architecture: Intel x86
23:32:02.0545 1112  Number of processors: 2
23:32:02.0545 1112  Page size: 0x1000
23:32:02.0545 1112  Boot type: Normal boot
23:32:02.0545 1112  ============================================================
23:32:04.0976 1112  BG loaded
23:32:05.0538 1112  Drive \Device\Harddisk1\DR1 - Size: 0x3A38A25E00 (232.88 Gb), SectorSize: 0x200, Cylinders: 0x7E2D, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000050
23:32:05.0553 1112  Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
23:32:05.0569 1112  ============================================================
23:32:05.0569 1112  \Device\Harddisk1\DR1:
23:32:05.0584 1112  MBR partitions:
23:32:05.0584 1112  \Device\Harddisk1\DR1\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
23:32:05.0584 1112  \Device\Harddisk1\DR1\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x2ACA800
23:32:05.0584 1112  \Device\Harddisk1\DR1\Partition3: MBR, Type 0x7, StartLBA 0xD0FDA48, BlocksNum 0x100C2C78
23:32:05.0584 1112  \Device\Harddisk0\DR0:
23:32:05.0600 1112  MBR partitions:
23:32:05.0600 1112  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x9C40000
23:32:05.0600 1112  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x9C40800, BlocksNum 0x8DD8800
23:32:05.0600 1112  ============================================================
23:32:05.0725 1112  C: <-> \Device\Harddisk0\DR0\Partition1
23:32:05.0725 1112  D: <-> \Device\Harddisk1\DR1\Partition3
23:32:05.0740 1112  E: <-> \Device\Harddisk1\DR1\Partition2
23:32:05.0850 1112  F: <-> \Device\Harddisk0\DR0\Partition2
23:32:05.0850 1112  ============================================================
23:32:05.0850 1112  Initialize success
23:32:05.0850 1112  ============================================================
23:33:23.0211 3244  ============================================================
23:33:23.0211 3244  Scan started
23:33:23.0211 3244  Mode: Manual; SigCheck; TDLFS;
23:33:23.0211 3244  ============================================================
23:33:24.0178 3244  ================ Scan system memory ========================
23:33:24.0178 3244  System memory - ok
23:33:24.0178 3244  ================ Scan services =============================
23:33:24.0366 3244  [ 1B133875B8AA8AC48969BD3458AFE9F5 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
23:33:24.0490 3244  1394ohci - ok
23:33:24.0522 3244  [ CEA80C80BED809AA0DA6FEBC04733349 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
23:33:24.0537 3244  ACPI - ok
23:33:24.0553 3244  [ 1EFBC664ABFF416D1D07DB115DCB264F ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
23:33:24.0615 3244  AcpiPmi - ok
23:33:24.0724 3244  [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
23:33:24.0756 3244  AdobeARMservice - ok
23:33:24.0802 3244  [ 21E785EBD7DC90A06391141AAC7892FB ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
23:33:24.0834 3244  adp94xx - ok
23:33:24.0849 3244  [ 0C676BC278D5B59FF5ABD57BBE9123F2 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
23:33:24.0880 3244  adpahci - ok
23:33:24.0896 3244  [ 7C7B5EE4B7B822EC85321FE23A27DB33 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
23:33:24.0912 3244  adpu320 - ok
23:33:24.0943 3244  [ 8B5EEFEEC1E6D1A72A06C526628AD161 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
23:33:25.0005 3244  AeLookupSvc - ok
23:33:25.0052 3244  [ 9EBBBA55060F786F0FCAA3893BFA2806 ] AFD            C:\Windows\system32\drivers\afd.sys
23:33:25.0099 3244  AFD - ok
23:33:25.0130 3244  [ 507812C3054C21CEF746B6EE3D04DD6E ] agp440          C:\Windows\system32\drivers\agp440.sys
23:33:25.0146 3244  agp440 - ok
23:33:25.0177 3244  [ 8B30250D573A8F6B4BD23195160D8707 ] aic78xx        C:\Windows\system32\DRIVERS\djsvs.sys
23:33:25.0192 3244  aic78xx - ok
23:33:25.0192 3244  [ 18A54E132947CD98FEA9ACCC57F98F13 ] ALG            C:\Windows\System32\alg.exe
23:33:25.0239 3244  ALG - ok
23:33:25.0255 3244  [ 0D40BCF52EA90FC7DF2AEAB6503DEA44 ] aliide          C:\Windows\system32\drivers\aliide.sys
23:33:25.0255 3244  aliide - ok
23:33:25.0302 3244  [ B19505648F033393E907E2E419FDE8B3 ] AMD External Events Utility C:\Windows\system32\atiesrxx.exe
23:33:25.0333 3244  AMD External Events Utility - ok
23:33:25.0348 3244  [ 3C6600A0696E90A463771C7422E23AB5 ] amdagp          C:\Windows\system32\drivers\amdagp.sys
23:33:25.0364 3244  amdagp - ok
23:33:25.0380 3244  [ CD5914170297126B6266860198D1D4F0 ] amdide          C:\Windows\system32\drivers\amdide.sys
23:33:25.0395 3244  amdide - ok
23:33:25.0442 3244  [ 00DDA200D71BAC534BF56A9DB5DFD666 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
23:33:25.0473 3244  AmdK8 - ok
23:33:25.0504 3244  [ 3CBF30F5370FDA40DD3E87DF38EA53B6 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
23:33:25.0551 3244  AmdPPM - ok
23:33:25.0598 3244  [ D320BF87125326F996D4904FE24300FC ] amdsata        C:\Windows\system32\drivers\amdsata.sys
23:33:25.0629 3244  amdsata - ok
23:33:25.0645 3244  [ EA43AF0C423FF267355F74E7A53BDABA ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
23:33:25.0660 3244  amdsbs - ok
23:33:25.0676 3244  [ 46387FB17B086D16DEA267D5BE23A2F2 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
23:33:25.0692 3244  amdxata - ok
23:33:25.0723 3244  [ AEA177F783E20150ACE5383EE368DA19 ] AppID          C:\Windows\system32\drivers\appid.sys
23:33:25.0816 3244  AppID - ok
23:33:25.0863 3244  [ 62A9C86CB6085E20DB4823E4E97826F5 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
23:33:25.0910 3244  AppIDSvc - ok
23:33:25.0941 3244  [ FB1959012294D6AD43E5304DF65E3C26 ] Appinfo        C:\Windows\System32\appinfo.dll
23:33:25.0988 3244  Appinfo - ok
23:33:26.0019 3244  [ A45D184DF6A8803DA13A0B329517A64A ] AppMgmt        C:\Windows\System32\appmgmts.dll
23:33:26.0082 3244  AppMgmt - ok
23:33:26.0113 3244  [ 2932004F49677BD84DBC72EDB754FFB3 ] arc            C:\Windows\system32\DRIVERS\arc.sys
23:33:26.0144 3244  arc - ok
23:33:26.0160 3244  [ 5D6F36C46FD283AE1B57BD2E9FEB0BC7 ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
23:33:26.0160 3244  arcsas - ok
23:33:26.0191 3244  [ ADD2ADE1C2B285AB8378D2DAAF991481 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
23:33:26.0300 3244  AsyncMac - ok
23:33:26.0331 3244  [ 338C86357871C167A96AB976519BF59E ] atapi          C:\Windows\system32\drivers\atapi.sys
23:33:26.0331 3244  atapi - ok
23:33:26.0534 3244  [ 04F09923A393E4E0E8453A8F78361E73 ] atikmdag        C:\Windows\system32\DRIVERS\atikmdag.sys
23:33:26.0612 3244  atikmdag - ok
23:33:26.0659 3244  [ CE3B4E731638D2EF62FCB419BE0D39F0 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
23:33:26.0690 3244  AudioEndpointBuilder - ok
23:33:26.0706 3244  [ CE3B4E731638D2EF62FCB419BE0D39F0 ] Audiosrv        C:\Windows\System32\Audiosrv.dll
23:33:26.0737 3244  Audiosrv - ok
23:33:26.0768 3244  [ 6E30D02AAC9CAC84F421622E3A2F6178 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
23:33:26.0830 3244  AxInstSV - ok
23:33:26.0877 3244  [ 1A231ABEC60FD316EC54C66715543CEC ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbdx.sys
23:33:26.0924 3244  b06bdrv - ok
23:33:26.0971 3244  [ BD8869EB9CDE6BBE4508D869929869EE ] b57nd60x        C:\Windows\system32\DRIVERS\b57nd60x.sys
23:33:27.0002 3244  b57nd60x - ok
23:33:27.0033 3244  [ EE1E9C3BB8228AE423DD38DB69128E71 ] BDESVC          C:\Windows\System32\bdesvc.dll
23:33:27.0080 3244  BDESVC - ok
23:33:27.0096 3244  [ 505506526A9D467307B3C393DEDAF858 ] Beep            C:\Windows\system32\drivers\Beep.sys
23:33:27.0127 3244  Beep - ok
23:33:27.0142 3244  [ 2287078ED48FCFC477B05B20CF38F36F ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
23:33:27.0158 3244  blbdrive - ok
23:33:27.0205 3244  [ 8F2DA3028D5FCBD1A060A3DE64CD6506 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
23:33:27.0236 3244  bowser - ok
23:33:27.0252 3244  [ 9F9ACC7F7CCDE8A15C282D3F88B43309 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
23:33:27.0298 3244  BrFiltLo - ok
23:33:27.0314 3244  [ 56801AD62213A41F6497F96DEE83755A ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
23:33:27.0345 3244  BrFiltUp - ok
23:33:27.0376 3244  [ 6E11F33D14D020F58D5E02E4D67DFA19 ] Browser        C:\Windows\System32\browser.dll
23:33:27.0423 3244  Browser - ok
23:33:27.0454 3244  [ 845B8CE732E67F3B4133164868C666EA ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
23:33:27.0486 3244  Brserid - ok
23:33:27.0501 3244  [ 203F0B1E73ADADBBB7B7B1FABD901F6B ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
23:33:27.0532 3244  BrSerWdm - ok
23:33:27.0548 3244  [ BD456606156BA17E60A04E18016AE54B ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
23:33:27.0564 3244  BrUsbMdm - ok
23:33:27.0579 3244  [ AF72ED54503F717A43268B3CC5FAEC2E ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
23:33:27.0610 3244  BrUsbSer - ok
23:33:27.0626 3244  [ ED3DF7C56CE0084EB2034432FC56565A ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
23:33:27.0657 3244  BTHMODEM - ok
23:33:27.0688 3244  [ 1DF19C96EEF6C29D1C3E1A8678E07190 ] bthserv        C:\Windows\system32\bthserv.dll
23:33:27.0751 3244  bthserv - ok
23:33:27.0766 3244  [ 77EA11B065E0A8AB902D78145CA51E10 ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
23:33:27.0829 3244  cdfs - ok
23:33:27.0876 3244  [ BE167ED0FDB9C1FA1133953C18D5A6C9 ] cdrom          C:\Windows\system32\drivers\cdrom.sys
23:33:27.0891 3244  cdrom - ok
23:33:27.0938 3244  [ 319C6B309773D063541D01DF8AC6F55F ] CertPropSvc    C:\Windows\System32\certprop.dll
23:33:27.0969 3244  CertPropSvc - ok
23:33:27.0985 3244  [ 3FE3FE94A34DF6FB06E6418D0F6A0060 ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
23:33:28.0000 3244  circlass - ok
23:33:28.0032 3244  [ 635181E0E9BBF16871BF5380D71DB02D ] CLFS            C:\Windows\system32\CLFS.sys
23:33:28.0047 3244  CLFS - ok
23:33:28.0110 3244  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
23:33:28.0125 3244  clr_optimization_v2.0.50727_32 - ok
23:33:28.0203 3244  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
23:33:28.0250 3244  clr_optimization_v4.0.30319_32 - ok
23:33:28.0266 3244  [ DEA805815E587DAD1DD2C502220B5616 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
23:33:28.0281 3244  CmBatt - ok
23:33:28.0312 3244  [ C537B1DB64D495B9B4717B4D6D9EDBF2 ] cmdide          C:\Windows\system32\drivers\cmdide.sys
23:33:28.0312 3244  cmdide - ok
23:33:28.0359 3244  [ 6427525D76F61D0C519B008D3680E8E7 ] CNG            C:\Windows\system32\Drivers\cng.sys
23:33:28.0375 3244  CNG - ok
23:33:28.0406 3244  [ A6023D3823C37043986713F118A89BEE ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
23:33:28.0422 3244  Compbatt - ok
23:33:28.0437 3244  [ CBE8C58A8579CFE5FCCF809E6F114E89 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
23:33:28.0468 3244  CompositeBus - ok
23:33:28.0484 3244  COMSysApp - ok
23:33:28.0500 3244  [ 2C4EBCFC84A9B44F209DFF6C6E6C61D1 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
23:33:28.0515 3244  crcdisk - ok
23:33:28.0562 3244  [ 06E771AA596B8761107AB57E99F128D7 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
23:33:28.0593 3244  CryptSvc - ok
23:33:28.0624 3244  [ 3C2177A897B4CA2788C6FB0C3FD81D4B ] CSC            C:\Windows\system32\drivers\csc.sys
23:33:28.0687 3244  CSC - ok
23:33:28.0734 3244  [ 15F93B37F6801943360D9EB42485D5D3 ] CscService      C:\Windows\System32\cscsvc.dll
23:33:28.0765 3244  CscService - ok
23:33:28.0796 3244  [ 7660F01D3B38ACA1747E397D21D790AF ] DcomLaunch      C:\Windows\system32\rpcss.dll
23:33:28.0843 3244  DcomLaunch - ok
23:33:28.0874 3244  [ 8D6E10A2D9A5EED59562D9B82CF804E1 ] defragsvc      C:\Windows\System32\defragsvc.dll
23:33:28.0905 3244  defragsvc - ok
23:33:28.0952 3244  [ F024449C97EC1E464AAFFDA18593DB88 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
23:33:28.0983 3244  DfsC - ok
23:33:28.0999 3244  [ E9E01EB683C132F7FA27CD607B8A2B63 ] Dhcp            C:\Windows\system32\dhcpcore.dll
23:33:29.0046 3244  Dhcp - ok
23:33:29.0077 3244  [ 1A050B0274BFB3890703D490F330C0DA ] discache        C:\Windows\system32\drivers\discache.sys
23:33:29.0108 3244  discache - ok
23:33:29.0155 3244  [ 565003F326F99802E68CA78F2A68E9FF ] Disk            C:\Windows\system32\DRIVERS\disk.sys
23:33:29.0170 3244  Disk - ok
23:33:29.0202 3244  [ 33EF4861F19A0736B11314AAD9AE28D0 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
23:33:29.0248 3244  Dnscache - ok
23:33:29.0280 3244  [ 366BA8FB4B7BB7435E3B9EACB3843F67 ] dot3svc        C:\Windows\System32\dot3svc.dll
23:33:29.0326 3244  dot3svc - ok
23:33:29.0342 3244  [ 8EC04CA86F1D68DA9E11952EB85973D6 ] DPS            C:\Windows\system32\dps.dll
23:33:29.0389 3244  DPS - ok
23:33:29.0436 3244  [ B918E7C5F9BF77202F89E1A9539F2EB4 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
23:33:29.0451 3244  drmkaud - ok
23:33:29.0482 3244  [ 23F5D28378A160352BA8F817BD8C71CB ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
23:33:29.0514 3244  DXGKrnl - ok
23:33:29.0545 3244  [ 8600142FA91C1B96367D3300AD0F3F3A ] EapHost        C:\Windows\System32\eapsvc.dll
23:33:29.0576 3244  EapHost - ok
23:33:29.0701 3244  [ 024E1B5CAC09731E4D868E64DBFB4AB0 ] ebdrv          C:\Windows\system32\DRIVERS\evbdx.sys
23:33:29.0810 3244  ebdrv - ok
23:33:29.0841 3244  [ 81951F51E318AECC2D68559E47485CC4 ] EFS            C:\Windows\System32\lsass.exe
23:33:29.0872 3244  EFS - ok
23:33:29.0919 3244  [ A8C362018EFC87BEB013EE28F29C0863 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
23:33:29.0966 3244  ehRecvr - ok
23:33:29.0997 3244  [ D389BFF34F80CAEDE417BF9D1507996A ] ehSched        C:\Windows\ehome\ehsched.exe
23:33:30.0028 3244  ehSched - ok
23:33:30.0091 3244  [ 0ED67910C8C326796FAA00B2BF6D9D3C ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
23:33:30.0122 3244  elxstor - ok
23:33:30.0153 3244  [ 8FC3208352DD3912C94367A206AB3F11 ] ErrDev          C:\Windows\system32\drivers\errdev.sys
23:33:30.0184 3244  ErrDev - ok
23:33:30.0231 3244  [ F6916EFC29D9953D5D0DF06882AE8E16 ] EventSystem    C:\Windows\system32\es.dll
23:33:30.0278 3244  EventSystem - ok
23:33:30.0309 3244  [ 2DC9108D74081149CC8B651D3A26207F ] exfat          C:\Windows\system32\drivers\exfat.sys
23:33:30.0340 3244  exfat - ok
23:33:30.0356 3244  [ 7E0AB74553476622FB6AE36F73D97D35 ] fastfat        C:\Windows\system32\drivers\fastfat.sys
23:33:30.0387 3244  fastfat - ok
23:33:30.0434 3244  [ 967EA5B213E9984CBE270205DF37755B ] Fax            C:\Windows\system32\fxssvc.exe
23:33:30.0465 3244  Fax - ok
23:33:30.0496 3244  [ E817A017F82DF2A1F8CFDBDA29388B29 ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
23:33:30.0512 3244  fdc - ok
23:33:30.0512 3244  [ F3222C893BD2F5821A0179E5C71E88FB ] fdPHost        C:\Windows\system32\fdPHost.dll
23:33:30.0559 3244  fdPHost - ok
23:33:30.0574 3244  [ 7DBE8CBFE79EFBDEB98C9FB08D3A9A5B ] FDResPub        C:\Windows\system32\fdrespub.dll
23:33:30.0621 3244  FDResPub - ok
23:33:30.0637 3244  [ 6CF00369C97F3CF563BE99BE983D13D8 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
23:33:30.0652 3244  FileInfo - ok
23:33:30.0668 3244  [ 42C51DC94C91DA21CB9196EB64C45DB9 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
23:33:30.0715 3244  Filetrace - ok
23:33:30.0730 3244  [ 87907AA70CB3C56600F1C2FB8841579B ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
23:33:30.0746 3244  flpydisk - ok
23:33:30.0762 3244  [ 7520EC808E0C35E0EE6F841294316653 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
23:33:30.0777 3244  FltMgr - ok
23:33:30.0808 3244  [ B3A5EC6B6B6673DB7E87C2BCDBDDC074 ] FontCache      C:\Windows\system32\FntCache.dll
23:33:30.0855 3244  FontCache - ok
23:33:30.0902 3244  [ E56F39F6B7FDA0AC77A79B0FD3DE1A2F ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
23:33:30.0918 3244  FontCache3.0.0.0 - ok
23:33:30.0918 3244  [ 1A16B57943853E598CFF37FE2B8CBF1D ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
23:33:30.0933 3244  FsDepends - ok
23:33:30.0964 3244  [ 7DAE5EBCC80E45D3253F4923DC424D05 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
23:33:30.0964 3244  Fs_Rec - ok
23:33:31.0011 3244  [ 8A73E79089B282100B9393B644CB853B ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
23:33:31.0027 3244  fvevol - ok
23:33:31.0058 3244  [ 65EE0C7A58B65E74AE05637418153938 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
23:33:31.0089 3244  gagp30kx - ok
23:33:31.0136 3244  [ E897EAF5ED6BA41E081060C9B447A673 ] gpsvc          C:\Windows\System32\gpsvc.dll
23:33:31.0198 3244  gpsvc - ok
23:33:31.0214 3244  [ C44E3C2BAB6837DB337DDEE7544736DB ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
23:33:31.0245 3244  hcw85cir - ok
23:33:31.0292 3244  [ A5EF29D5315111C80A5C1ABAD14C8972 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
23:33:31.0323 3244  HdAudAddService - ok
23:33:31.0354 3244  [ 9036377B8A6C15DC2EEC53E489D159B5 ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
23:33:31.0370 3244  HDAudBus - ok
23:33:31.0386 3244  [ 1D58A7F3E11A9731D0EAAAA8405ACC36 ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
23:33:31.0417 3244  HidBatt - ok
23:33:31.0432 3244  [ 89448F40E6DF260C206A193A4683BA78 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
23:33:31.0448 3244  HidBth - ok
23:33:31.0479 3244  [ CF50B4CF4A4F229B9F3C08351F99CA5E ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
23:33:31.0495 3244  HidIr - ok
23:33:31.0526 3244  [ 2BC6F6A1992B3A77F5F41432CA6B3B6B ] hidserv        C:\Windows\system32\hidserv.dll
23:33:31.0557 3244  hidserv - ok
23:33:31.0588 3244  [ 10C19F8290891AF023EAEC0832E1EB4D ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
23:33:31.0588 3244  HidUsb - ok
23:33:31.0620 3244  [ 196B4E3F4CCCC24AF836CE58FACBB699 ] hkmsvc          C:\Windows\system32\kmsvc.dll
23:33:31.0666 3244  hkmsvc - ok
23:33:31.0698 3244  [ 6658F4404DE03D75FE3BA09F7ABA6A30 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
23:33:31.0729 3244  HomeGroupListener - ok
23:33:31.0760 3244  [ DBC02D918FFF1CAD628ACBE0C0EAA8E8 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
23:33:31.0776 3244  HomeGroupProvider - ok
23:33:31.0822 3244  [ 295FDC419039090EB8B49FFDBB374549 ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
23:33:31.0822 3244  HpSAMD - ok
23:33:31.0885 3244  [ 871917B07A141BFF43D76D8844D48106 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
23:33:31.0947 3244  HTTP - ok
23:33:31.0978 3244  [ 0C4E035C7F105F1299258C90886C64C5 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
23:33:31.0994 3244  hwpolicy - ok
23:33:32.0025 3244  [ F151F0BDC47F4A28B1B20A0818EA36D6 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys
23:33:32.0041 3244  i8042prt - ok
23:33:32.0056 3244  [ 5CD5F9A5444E6CDCB0AC89BD62D8B76E ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
23:33:32.0088 3244  iaStorV - ok
23:33:32.0134 3244  [ C521D7EB6497BB1AF6AFA89E322FB43C ] idsvc          C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
23:33:32.0166 3244  idsvc - ok
23:33:32.0197 3244  [ 4173FF5708F3236CF25195FECD742915 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
23:33:32.0212 3244  iirsp - ok
23:33:32.0228 3244  [ F95622F161474511B8D80D6B093AA610 ] IKEEXT          C:\Windows\System32\ikeext.dll
23:33:32.0275 3244  IKEEXT - ok
23:33:32.0290 3244  [ A0F12F2C9BA6C72F3987CE780E77C130 ] intelide        C:\Windows\system32\drivers\intelide.sys
23:33:32.0306 3244  intelide - ok
23:33:32.0322 3244  [ 3B514D27BFC4ACCB4037BC6685F766E0 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
23:33:32.0337 3244  intelppm - ok
23:33:32.0368 3244  [ ACB364B9075A45C0736E5C47BE5CAE19 ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
23:33:32.0400 3244  IPBusEnum - ok
23:33:32.0415 3244  [ 709D1761D3B19A932FF0238EA6D50200 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
23:33:32.0462 3244  IpFilterDriver - ok
23:33:32.0493 3244  [ 4BD7134618C1D2A27466A099062547BF ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
23:33:32.0524 3244  IPMIDRV - ok
23:33:32.0540 3244  [ A5FA468D67ABCDAA36264E463A7BB0CD ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
23:33:32.0571 3244  IPNAT - ok
23:33:32.0602 3244  [ 42996CFF20A3084A56017B7902307E9F ] IRENUM          C:\Windows\system32\drivers\irenum.sys
23:33:32.0649 3244  IRENUM - ok
23:33:32.0680 3244  [ 1F32BB6B38F62F7DF1A7AB7292638A35 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
23:33:32.0712 3244  isapnp - ok
23:33:32.0743 3244  [ CB7A9ABB12B8415BCE5D74994C7BA3AE ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
23:33:32.0758 3244  iScsiPrt - ok
23:33:32.0790 3244  [ ADEF52CA1AEAE82B50DF86B56413107E ] kbdclass        C:\Windows\system32\drivers\kbdclass.sys
23:33:32.0805 3244  kbdclass - ok
23:33:32.0821 3244  [ 9E3CED91863E6EE98C24794D05E27A71 ] kbdhid          C:\Windows\system32\drivers\kbdhid.sys
23:33:32.0852 3244  kbdhid - ok
23:33:32.0868 3244  [ 81951F51E318AECC2D68559E47485CC4 ] KeyIso          C:\Windows\system32\lsass.exe
23:33:32.0868 3244  KeyIso - ok
23:33:32.0899 3244  [ F4647BB23DB9038A7536CF6B68F4207F ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
23:33:32.0914 3244  KSecDD - ok
23:33:32.0930 3244  [ E73CAE53BBB72BA26918492C6B4C229D ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
23:33:32.0946 3244  KSecPkg - ok
23:33:32.0977 3244  [ 89A7B9CC98D0D80C6F31B91C0A310FCD ] KtmRm          C:\Windows\system32\msdtckrm.dll
23:33:33.0008 3244  KtmRm - ok
23:33:33.0039 3244  [ D64AF876D53ECA3668BB97B51B4E70AB ] LanmanServer    C:\Windows\system32\srvsvc.dll
23:33:33.0055 3244  LanmanServer - ok
23:33:33.0086 3244  [ 58405E4F68BA8E4057C6E914F326ABA2 ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
23:33:33.0133 3244  LanmanWorkstation - ok
23:33:33.0180 3244  [ F7611EC07349979DA9B0AE1F18CCC7A6 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
23:33:33.0226 3244  lltdio - ok
23:33:33.0258 3244  [ 5700673E13A2117FA3B9020C852C01E2 ] lltdsvc        C:\Windows\System32\lltdsvc.dll
23:33:33.0289 3244  lltdsvc - ok
23:33:33.0304 3244  [ 55CA01BA19D0006C8F2639B6C045E08B ] lmhosts        C:\Windows\System32\lmhsvc.dll
23:33:33.0336 3244  lmhosts - ok
23:33:33.0351 3244  [ EB119A53CCF2ACC000AC71B065B78FEF ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
23:33:33.0367 3244  LSI_FC - ok
23:33:33.0382 3244  [ 8ADE1C877256A22E49B75D1CC9161F9C ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
23:33:33.0398 3244  LSI_SAS - ok
23:33:33.0398 3244  [ DC9DC3D3DAA0E276FD2EC262E38B11E9 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
23:33:33.0414 3244  LSI_SAS2 - ok
23:33:33.0429 3244  [ 0A036C7D7CAB643A7F07135AC47E0524 ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
23:33:33.0429 3244  LSI_SCSI - ok
23:33:33.0460 3244  [ 6703E366CC18D3B6E534F5CF7DF39CEE ] luafv          C:\Windows\system32\drivers\luafv.sys
23:33:33.0476 3244  luafv - ok
23:33:33.0492 3244  [ BFB9EE8EE977EFE85D1A3105ABEF6DD1 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
23:33:33.0507 3244  Mcx2Svc - ok
23:33:33.0523 3244  [ 0FFF5B045293002AB38EB1FD1FC2FB74 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
23:33:33.0538 3244  megasas - ok
23:33:33.0554 3244  [ DCBAB2920C75F390CAF1D29F675D03D6 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
23:33:33.0570 3244  MegaSR - ok
23:33:33.0585 3244  [ 146B6F43A673379A3C670E86D89BE5EA ] MMCSS          C:\Windows\system32\mmcss.dll
23:33:33.0632 3244  MMCSS - ok
23:33:33.0648 3244  [ F001861E5700EE84E2D4E52C712F4964 ] Modem          C:\Windows\system32\drivers\modem.sys
23:33:33.0663 3244  Modem - ok
23:33:33.0694 3244  [ 79D10964DE86B292320E9DFE02282A23 ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
23:33:33.0726 3244  monitor - ok
23:33:33.0757 3244  [ FB18CC1D4C2E716B6B903B0AC0CC0609 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
23:33:33.0772 3244  mouclass - ok
23:33:33.0804 3244  [ 2C388D2CD01C9042596CF3C8F3C7B24D ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
23:33:33.0819 3244  mouhid - ok
23:33:33.0850 3244  [ FC8771F45ECCCFD89684E38842539B9B ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
23:33:33.0866 3244  mountmgr - ok
23:33:33.0928 3244  [ 15D5398EED42C2504BB3D4FC875C15D1 ] MozillaMaintenance C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
23:33:33.0944 3244  MozillaMaintenance - ok
23:33:33.0975 3244  [ 2D699FB6E89CE0D8DA14ECC03B3EDFE0 ] mpio            C:\Windows\system32\drivers\mpio.sys
23:33:34.0006 3244  mpio - ok
23:33:34.0022 3244  [ AD2723A7B53DD1AACAE6AD8C0BFBF4D0 ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
23:33:34.0069 3244  mpsdrv - ok
23:33:34.0100 3244  [ CEB46AB7C01C9F825F8CC6BABC18166A ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
23:33:34.0131 3244  MRxDAV - ok
23:33:34.0162 3244  [ 5D16C921E3671636C0EBA3BBAAC5FD25 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
23:33:34.0194 3244  mrxsmb - ok
23:33:34.0225 3244  [ 6D17A4791ACA19328C685D256349FEFC ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
23:33:34.0240 3244  mrxsmb10 - ok
23:33:34.0256 3244  [ B81F204D146000BE76651A50670A5E9E ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
23:33:34.0287 3244  mrxsmb20 - ok
23:33:34.0303 3244  [ 012C5F4E9349E711E11E0F19A8589F0A ] msahci          C:\Windows\system32\drivers\msahci.sys
23:33:34.0318 3244  msahci - ok
23:33:34.0334 3244  [ 55055F8AD8BE27A64C831322A780A228 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
23:33:34.0334 3244  msdsm - ok
23:33:34.0350 3244  [ E1BCE74A3BD9902B72599C0192A07E27 ] MSDTC          C:\Windows\System32\msdtc.exe
23:33:34.0381 3244  MSDTC - ok
23:33:34.0412 3244  [ DAEFB28E3AF5A76ABCC2C3078C07327F ] Msfs            C:\Windows\system32\drivers\Msfs.sys
23:33:34.0443 3244  Msfs - ok
23:33:34.0459 3244  [ 3E1E5767043C5AF9367F0056295E9F84 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
23:33:34.0490 3244  mshidkmdf - ok
23:33:34.0521 3244  [ 0A4E5757AE09FA9622E3158CC1AEF114 ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
23:33:34.0521 3244  msisadrv - ok
23:33:34.0552 3244  [ 90F7D9E6B6F27E1A707D4A297F077828 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
23:33:34.0630 3244  MSiSCSI - ok
23:33:34.0630 3244  msiserver - ok
23:33:34.0662 3244  [ 8C0860D6366AAFFB6C5BB9DF9448E631 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
23:33:34.0724 3244  MSKSSRV - ok
23:33:34.0755 3244  [ 3EA8B949F963562CEDBB549EAC0C11CE ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
23:33:34.0786 3244  MSPCLOCK - ok
23:33:34.0802 3244  [ F456E973590D663B1073E9C463B40932 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
23:33:34.0833 3244  MSPQM - ok
23:33:34.0864 3244  [ 0E008FC4819D238C51D7C93E7B41E560 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
23:33:34.0880 3244  MsRPC - ok
23:33:34.0896 3244  [ FC6B9FF600CC585EA38B12589BD4E246 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
23:33:34.0896 3244  mssmbios - ok
23:33:34.0911 3244  [ B42C6B921F61A6E55159B8BE6CD54A36 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
23:33:34.0942 3244  MSTEE - ok
23:33:34.0958 3244  [ 33599130F44E1F34631CEA241DE8AC84 ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
23:33:34.0974 3244  MTConfig - ok
23:33:34.0974 3244  [ 159FAD02F64E6381758C990F753BCC80 ] Mup            C:\Windows\system32\Drivers\mup.sys
23:33:34.0989 3244  Mup - ok
23:33:35.0020 3244  [ 61D57A5D7C6D9AFE10E77DAE6E1B445E ] napagent        C:\Windows\system32\qagentRT.dll
23:33:35.0067 3244  napagent - ok
23:33:35.0114 3244  [ 26384429FCD85D83746F63E798AB1480 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
23:33:35.0145 3244  NativeWifiP - ok
23:33:35.0192 3244  [ E7C54812A2AAF43316EB6930C1FFA108 ] NDIS            C:\Windows\system32\drivers\ndis.sys
23:33:35.0208 3244  NDIS - ok
23:33:35.0223 3244  [ 0E1787AA6C9191D3D319E8BAFE86F80C ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
23:33:35.0254 3244  NdisCap - ok
23:33:35.0270 3244  [ E4A8AEC125A2E43A9E32AFEEA7C9C888 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
23:33:35.0317 3244  NdisTapi - ok
23:33:35.0332 3244  [ D8A65DAFB3EB41CBB622745676FCD072 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
23:33:35.0364 3244  Ndisuio - ok
23:33:35.0395 3244  [ 38FBE267E7E6983311179230FACB1017 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
23:33:35.0426 3244  NdisWan - ok
23:33:35.0442 3244  [ A4BDC541E69674FBFF1A8FF00BE913F2 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
23:33:35.0473 3244  NDProxy - ok
23:33:35.0504 3244  [ 80B275B1CE3B0E79909DB7B39AF74D51 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
23:33:35.0582 3244  NetBIOS - ok
23:33:35.0613 3244  [ 280122DDCF04B378EDD1AD54D71C1E54 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
23:33:35.0691 3244  NetBT - ok
23:33:35.0707 3244  [ 81951F51E318AECC2D68559E47485CC4 ] Netlogon        C:\Windows\system32\lsass.exe
23:33:35.0707 3244  Netlogon - ok
23:33:35.0754 3244  [ 7CCCFCA7510684768DA22092D1FA4DB2 ] Netman          C:\Windows\System32\netman.dll
23:33:35.0785 3244  Netman - ok
23:33:35.0800 3244  [ 8C338238C16777A802D6A9211EB2BA50 ] netprofm        C:\Windows\System32\netprofm.dll
23:33:35.0832 3244  netprofm - ok
23:33:35.0847 3244  [ F476EC40033CDB91EFBE73EB99B8362D ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
23:33:35.0863 3244  NetTcpPortSharing - ok
23:33:35.0878 3244  [ 1D85C4B390B0EE09C7A46B91EFB2C097 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
23:33:35.0894 3244  nfrd960 - ok
23:33:35.0925 3244  [ 912084381D30D8B89EC4E293053F4710 ] NlaSvc          C:\Windows\System32\nlasvc.dll
23:33:35.0972 3244  NlaSvc - ok
23:33:35.0988 3244  [ 1DB262A9F8C087E8153D89BEF3D2235F ] Npfs            C:\Windows\system32\drivers\Npfs.sys
23:33:36.0019 3244  Npfs - ok
23:33:36.0034 3244  [ BA387E955E890C8A88306D9B8D06BF17 ] nsi            C:\Windows\system32\nsisvc.dll
23:33:36.0066 3244  nsi - ok
23:33:36.0066 3244  [ E9A0A4D07E53D8FEA2BB8387A3293C58 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
23:33:36.0112 3244  nsiproxy - ok
23:33:36.0159 3244  [ 81189C3D7763838E55C397759D49007A ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
23:33:36.0206 3244  Ntfs - ok
23:33:36.0222 3244  [ F9756A98D69098DCA8945D62858A812C ] Null            C:\Windows\system32\drivers\Null.sys
23:33:36.0253 3244  Null - ok
23:33:36.0284 3244  [ B3E25EE28883877076E0E1FF877D02E0 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
23:33:36.0300 3244  nvraid - ok
23:33:36.0331 3244  [ 4380E59A170D88C4F1022EFF6719A8A4 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
23:33:36.0331 3244  nvstor - ok
23:33:36.0362 3244  [ 5A0983915F02BAE73267CC2A041F717D ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
23:33:36.0378 3244  nv_agp - ok
23:33:36.0393 3244  [ 08A70A1F2CDDE9BB49B885CB817A66EB ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
23:33:36.0424 3244  ohci1394 - ok
23:33:36.0456 3244  [ 82A8521DDC60710C3D3D3E7325209BEC ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
23:33:36.0518 3244  p2pimsvc - ok
23:33:36.0549 3244  [ 59C3DDD501E39E006DAC31BF55150D91 ] p2psvc          C:\Windows\system32\p2psvc.dll
23:33:36.0596 3244  p2psvc - ok
23:33:36.0612 3244  [ 2EA877ED5DD9713C5AC74E8EA7348D14 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
23:33:36.0627 3244  Parport - ok
23:33:36.0658 3244  [ 3F34A1B4C5F6475F320C275E63AFCE9B ] partmgr        C:\Windows\system32\drivers\partmgr.sys
23:33:36.0674 3244  partmgr - ok
23:33:36.0674 3244  [ EB0A59F29C19B86479D36B35983DAADC ] Parvdm          C:\Windows\system32\DRIVERS\parvdm.sys
23:33:36.0705 3244  Parvdm - ok
23:33:36.0721 3244  [ 358AB7956D3160000726574083DFC8A6 ] PcaSvc          C:\Windows\System32\pcasvc.dll
23:33:36.0736 3244  PcaSvc - ok
23:33:36.0752 3244  [ 673E55C3498EB970088E812EA820AA8F ] pci            C:\Windows\system32\drivers\pci.sys
23:33:36.0768 3244  pci - ok
23:33:36.0783 3244  [ AFE86F419014DB4E5593F69FFE26CE0A ] pciide          C:\Windows\system32\drivers\pciide.sys
23:33:36.0783 3244  pciide - ok
23:33:36.0814 3244  [ F396431B31693E71E8A80687EF523506 ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
23:33:36.0814 3244  pcmcia - ok
23:33:36.0846 3244  [ 250F6B43D2B613172035C6747AEEB19F ] pcw            C:\Windows\system32\drivers\pcw.sys
23:33:36.0846 3244  pcw - ok
23:33:36.0877 3244  [ 9E0104BA49F4E6973749A02BF41344ED ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
23:33:36.0924 3244  PEAUTH - ok
23:33:36.0970 3244  [ AF4D64D2A57B9772CF3801950B8058A6 ] PeerDistSvc    C:\Windows\system32\peerdistsvc.dll
23:33:37.0002 3244  PeerDistSvc - ok
23:33:37.0080 3244  [ 414BBA67A3DED1D28437EB66AEB8A720 ] pla            C:\Windows\system32\pla.dll
23:33:37.0142 3244  pla - ok
23:33:37.0204 3244  [ EC7BC28D207DA09E79B3E9FAF8B232CA ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
23:33:37.0251 3244  PlugPlay - ok
23:33:37.0282 3244  [ 63FF8572611249931EB16BB8EED6AFC8 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
23:33:37.0314 3244  PNRPAutoReg - ok
23:33:37.0345 3244  [ 82A8521DDC60710C3D3D3E7325209BEC ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
23:33:37.0360 3244  PNRPsvc - ok
23:33:37.0392 3244  [ 53946B69BA0836BD95B03759530C81EC ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
23:33:37.0438 3244  PolicyAgent - ok
23:33:37.0470 3244  [ F87D30E72E03D579A5199CCB3831D6EA ] Power          C:\Windows\system32\umpo.dll
23:33:37.0501 3244  Power - ok
23:33:37.0532 3244  [ 631E3E205AD6D86F2AED6A4A8E69F2DB ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
23:33:37.0563 3244  PptpMiniport - ok
23:33:37.0579 3244  [ 85B1E3A0C7585BC4AAE6899EC6FCF011 ] Processor      C:\Windows\system32\DRIVERS\processr.sys
23:33:37.0594 3244  Processor - ok
23:33:37.0641 3244  [ CADEFAC453040E370A1BDFF3973BE00D ] ProfSvc        C:\Windows\system32\profsvc.dll
23:33:37.0672 3244  ProfSvc - ok
23:33:37.0688 3244  [ 81951F51E318AECC2D68559E47485CC4 ] ProtectedStorage C:\Windows\system32\lsass.exe
23:33:37.0704 3244  ProtectedStorage - ok
23:33:37.0719 3244  [ 6270CCAE2A86DE6D146529FE55B3246A ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
23:33:37.0766 3244  Psched - ok
23:33:37.0828 3244  [ AB95ECF1F6659A60DDC166D8315B0751 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
23:33:37.0906 3244  ql2300 - ok
23:33:37.0922 3244  [ B4DD51DD25182244B86737DC51AF2270 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
23:33:37.0938 3244  ql40xx - ok
23:33:37.0969 3244  [ 31AC809E7707EB580B2BDB760390765A ] QWAVE          C:\Windows\system32\qwave.dll
23:33:38.0000 3244  QWAVE - ok
23:33:38.0016 3244  [ 584078CA1B95CA72DF2A27C336F9719D ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
23:33:38.0031 3244  QWAVEdrv - ok
23:33:38.0047 3244  [ 30A81B53C766D0133BB86D234E5556AB ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
23:33:38.0078 3244  RasAcd - ok
23:33:38.0109 3244  [ 57EC4AEF73660166074D8F7F31C0D4FD ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
23:33:38.0156 3244  RasAgileVpn - ok
23:33:38.0187 3244  [ A60F1839849C0C00739787FD5EC03F13 ] RasAuto        C:\Windows\System32\rasauto.dll
23:33:38.0218 3244  RasAuto - ok
23:33:38.0234 3244  [ D9F91EAFEC2815365CBE6D167E4E332A ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
23:33:38.0265 3244  Rasl2tp - ok
23:33:38.0312 3244  [ CB9E04DC05EACF5B9A36CA276D475006 ] RasMan          C:\Windows\System32\rasmans.dll
23:33:38.0390 3244  RasMan - ok
23:33:38.0421 3244  [ 0FE8B15916307A6AC12BFB6A63E45507 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
23:33:38.0452 3244  RasPppoe - ok
23:33:38.0468 3244  [ 44101F495A83EA6401D886E7FD70096B ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
23:33:38.0499 3244  RasSstp - ok
23:33:38.0530 3244  [ D528BC58A489409BA40334EBF96A311B ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
23:33:38.0562 3244  rdbss - ok
23:33:38.0577 3244  [ 0D8F05481CB76E70E1DA06EE9F0DA9DF ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
23:33:38.0593 3244  rdpbus - ok
23:33:38.0624 3244  [ 23DAE03F29D253AE74C44F99E515F9A1 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
23:33:38.0655 3244  RDPCDD - ok
23:33:38.0686 3244  [ B973FCFC50DC1434E1970A146F7E3885 ] RDPDR          C:\Windows\system32\drivers\rdpdr.sys
23:33:38.0702 3244  RDPDR - ok
23:33:38.0749 3244  [ 5A53CA1598DD4156D44196D200C94B8A ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
23:33:38.0796 3244  RDPENCDD - ok
23:33:38.0811 3244  [ 44B0A53CD4F27D50ED461DAE0C0B4E1F ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
23:33:38.0842 3244  RDPREFMP - ok
23:33:38.0889 3244  [ F031683E6D1FEA157ABB2FF260B51E61 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
23:33:38.0920 3244  RDPWD - ok
23:33:38.0952 3244  [ 518395321DC96FE2C9F0E96AC743B656 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
23:33:38.0967 3244  rdyboost - ok
23:33:38.0998 3244  [ 7B5E1419717FAC363A31CC302895217A ] RemoteAccess    C:\Windows\System32\mprdim.dll
23:33:39.0045 3244  RemoteAccess - ok
23:33:39.0076 3244  [ CB9A8683F4EF2BF99E123D79950D7935 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
23:33:39.0108 3244  RemoteRegistry - ok
23:33:39.0139 3244  [ 78D072F35BC45D9E4E1B61895C152234 ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
23:33:39.0170 3244  RpcEptMapper - ok
23:33:39.0201 3244  [ 94D36C0E44677DD26981D2BFEEF2A29D ] RpcLocator      C:\Windows\system32\locator.exe
23:33:39.0248 3244  RpcLocator - ok
23:33:39.0279 3244  [ 7660F01D3B38ACA1747E397D21D790AF ] RpcSs          C:\Windows\system32\rpcss.dll
23:33:39.0326 3244  RpcSs - ok
23:33:39.0373 3244  [ 032B0D36AD92B582D869879F5AF5B928 ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
23:33:39.0404 3244  rspndr - ok
23:33:39.0435 3244  [ 7DFD48E24479B68B258D8770121155A0 ] RTL8167        C:\Windows\system32\DRIVERS\Rt86win7.sys
23:33:39.0451 3244  RTL8167 - ok
23:33:39.0466 3244  [ 7FA7F2E249A5DCBB7970630E15E1F482 ] s3cap          C:\Windows\system32\drivers\vms3cap.sys
23:33:39.0513 3244  s3cap - ok
23:33:39.0529 3244  [ 81951F51E318AECC2D68559E47485CC4 ] SamSs          C:\Windows\system32\lsass.exe
23:33:39.0529 3244  SamSs - ok
23:33:39.0576 3244  [ 05D860DA1040F111503AC416CCEF2BCA ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
23:33:39.0591 3244  sbp2port - ok
23:33:39.0622 3244  [ 8FC518FFE9519C2631D37515A68009C4 ] SCardSvr        C:\Windows\System32\SCardSvr.dll
23:33:39.0638 3244  SCardSvr - ok
23:33:39.0654 3244  [ 0693B5EC673E34DC147E195779A4DCF6 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
23:33:39.0685 3244  scfilter - ok
23:33:39.0716 3244  [ A04BB13F8A72F8B6E8B4071723E4E336 ] Schedule        C:\Windows\system32\schedsvc.dll
23:33:39.0763 3244  Schedule - ok
23:33:39.0778 3244  [ 319C6B309773D063541D01DF8AC6F55F ] SCPolicySvc    C:\Windows\System32\certprop.dll
23:33:39.0810 3244  SCPolicySvc - ok
23:33:39.0841 3244  [ 08236C4BCE5EDD0A0318A438AF28E0F7 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
23:33:39.0856 3244  SDRSVC - ok
23:33:39.0888 3244  [ 90A3935D05B494A5A39D37E71F09A677 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
23:33:39.0919 3244  secdrv - ok
23:33:39.0919 3244  [ A59B3A4442C52060CC7A85293AA3546F ] seclogon        C:\Windows\system32\seclogon.dll
23:33:39.0966 3244  seclogon - ok
23:33:39.0966 3244  [ DCB7FCDCC97F87360F75D77425B81737 ] SENS            C:\Windows\System32\sens.dll
23:33:39.0997 3244  SENS - ok
23:33:40.0028 3244  [ 50087FE1EE447009C9CC2997B90DE53F ] SensrSvc        C:\Windows\system32\sensrsvc.dll
23:33:40.0075 3244  SensrSvc - ok
23:33:40.0090 3244  [ 9AD8B8B515E3DF6ACD4212EF465DE2D1 ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
23:33:40.0122 3244  Serenum - ok
23:33:40.0137 3244  [ 5FB7FCEA0490D821F26F39CC5EA3D1E2 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
23:33:40.0153 3244  Serial - ok
23:33:40.0184 3244  [ 79BFFB520327FF916A582DFEA17AA813 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
23:33:40.0200 3244  sermouse - ok
23:33:40.0231 3244  [ 4AE380F39A0032EAB7DD953030B26D28 ] SessionEnv      C:\Windows\system32\sessenv.dll
23:33:40.0278 3244  SessionEnv - ok
23:33:40.0309 3244  [ 9F976E1EB233DF46FCE808D9DEA3EB9C ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
23:33:40.0340 3244  sffdisk - ok
23:33:40.0340 3244  [ 932A68EE27833CFD57C1639D375F2731 ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
23:33:40.0371 3244  sffp_mmc - ok
23:33:40.0387 3244  [ 6D4CCAEDC018F1CF52866BBBAA235982 ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
23:33:40.0402 3244  sffp_sd - ok
23:33:40.0418 3244  [ DB96666CC8312EBC45032F30B007A547 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
23:33:40.0449 3244  sfloppy - ok
23:33:40.0480 3244  [ 414DA952A35BF5D50192E28263B40577 ] ShellHWDetection C:\Windows\System32\shsvcs.dll
23:33:40.0543 3244  ShellHWDetection - ok
23:33:40.0543 3244  [ 2565CAC0DC9FE0371BDCE60832582B2E ] sisagp          C:\Windows\system32\drivers\sisagp.sys
23:33:40.0558 3244  sisagp - ok
23:33:40.0590 3244  [ A9F0486851BECB6DDA1D89D381E71055 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
23:33:40.0590 3244  SiSRaid2 - ok
23:33:40.0605 3244  [ 3727097B55738E2F554972C3BE5BC1AA ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
23:33:40.0621 3244  SiSRaid4 - ok
23:33:40.0652 3244  [ 3E21C083B8A01CB70BA1F09303010FCE ] Smb            C:\Windows\system32\DRIVERS\smb.sys
23:33:40.0668 3244  Smb - ok
23:33:40.0714 3244  [ 6A984831644ECA1A33FFEAE4126F4F37 ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
23:33:40.0730 3244  SNMPTRAP - ok
23:33:40.0746 3244  [ 95CF1AE7527FB70F7816563CBC09D942 ] spldr          C:\Windows\system32\drivers\spldr.sys
23:33:40.0746 3244  spldr - ok
23:33:40.0777 3244  [ 866A43013535DC8587C258E43579C764 ] Spooler        C:\Windows\System32\spoolsv.exe
23:33:40.0808 3244  Spooler - ok
23:33:40.0917 3244  [ CF87A1DE791347E75B98885214CED2B8 ] sppsvc          C:\Windows\system32\sppsvc.exe
23:33:40.0980 3244  sppsvc - ok
23:33:41.0011 3244  [ B0180B20B065D89232A78A40FE56EAA6 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
23:33:41.0042 3244  sppuinotify - ok
23:33:41.0073 3244  [ E4C2764065D66EA1D2D3EBC28FE99C46 ] srv            C:\Windows\system32\DRIVERS\srv.sys
23:33:41.0151 3244  srv - ok
23:33:41.0167 3244  [ 03F0545BD8D4C77FA0AE1CEEDFCC71AB ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
23:33:41.0198 3244  srv2 - ok
23:33:41.0214 3244  [ BE6BD660CAA6F291AE06A718A4FA8ABC ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
23:33:41.0229 3244  srvnet - ok
23:33:41.0260 3244  [ D887C9FD02AC9FA880F6E5027A43E118 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
23:33:41.0276 3244  SSDPSRV - ok
23:33:41.0292 3244  [ D318F23BE45D5E3A107469EB64815B50 ] SstpSvc        C:\Windows\system32\sstpsvc.dll
23:33:41.0323 3244  SstpSvc - ok
23:33:41.0354 3244  [ DB32D325C192B801DF274BFD12A7E72B ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
23:33:41.0354 3244  stexstor - ok
23:33:41.0401 3244  [ E1FB3706030FB4578A0D72C2FC3689E4 ] StiSvc          C:\Windows\System32\wiaservc.dll
23:33:41.0432 3244  StiSvc - ok
23:33:41.0463 3244  [ 472AF0311073DCECEAA8FA18BA2BDF89 ] storflt        C:\Windows\system32\drivers\vmstorfl.sys
23:33:41.0463 3244  storflt - ok
23:33:41.0494 3244  [ 0BF669F0A910BEDA4A32258D363AF2A5 ] StorSvc        C:\Windows\system32\storsvc.dll
23:33:41.0526 3244  StorSvc - ok
23:33:41.0541 3244  [ DCAFFD62259E0BDB433DD67B5BB37619 ] storvsc        C:\Windows\system32\drivers\storvsc.sys
23:33:41.0557 3244  storvsc - ok
23:33:41.0588 3244  [ E58C78A848ADD9610A4DB6D214AF5224 ] swenum          C:\Windows\system32\drivers\swenum.sys
23:33:41.0588 3244  swenum - ok
23:33:41.0619 3244  [ A28BD92DF340E57B024BA433165D34D7 ] swprv          C:\Windows\System32\swprv.dll
23:33:41.0650 3244  swprv - ok
23:33:41.0697 3244  [ 36650D618CA34C9D357DFD3D89B2C56F ] SysMain        C:\Windows\system32\sysmain.dll
23:33:41.0760 3244  SysMain - ok
23:33:41.0791 3244  [ 763FECDC3D30C815FE72DD57936C6CD1 ] TabletInputService C:\Windows\System32\TabSvc.dll
23:33:41.0806 3244  TabletInputService - ok
23:33:41.0853 3244  [ 613BF4820361543956909043A265C6AC ] TapiSrv        C:\Windows\System32\tapisrv.dll
23:33:41.0884 3244  TapiSrv - ok
23:33:41.0900 3244  [ B799D9FDB26111737F58288D8DC172D9 ] TBS            C:\Windows\System32\tbssvc.dll
23:33:41.0931 3244  TBS - ok
23:33:41.0978 3244  [ 7FA2E0F8B072BD04B77B421480B6CC22 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
23:33:42.0009 3244  Tcpip - ok
23:33:42.0040 3244  [ 7FA2E0F8B072BD04B77B421480B6CC22 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
23:33:42.0072 3244  TCPIP6 - ok
23:33:42.0087 3244  [ CCA24162E055C3714CE5A88B100C64ED ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
23:33:42.0118 3244  tcpipreg - ok
23:33:42.0150 3244  [ 1CB91B2BD8F6DD367DFC2EF26FD751B2 ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
23:33:42.0181 3244  TDPIPE - ok
23:33:42.0196 3244  [ 2C2C5AFE7EE4F620D69C23C0617651A8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
23:33:42.0212 3244  TDTCP - ok
23:33:42.0259 3244  [ B459575348C20E8121D6039DA063C704 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
23:33:42.0290 3244  tdx - ok
23:33:42.0306 3244  [ 04DBF4B01EA4BF25A9A3E84AFFAC9B20 ] TermDD          C:\Windows\system32\drivers\termdd.sys
23:33:42.0321 3244  TermDD - ok
23:33:42.0352 3244  [ 382C804C92811BE57829D8E550A900E2 ] TermService    C:\Windows\System32\termsrv.dll
23:33:42.0384 3244  TermService - ok
23:33:42.0399 3244  [ 42FB6AFD6B79D9FE07381609172E7CA4 ] Themes          C:\Windows\system32\themeservice.dll
23:33:42.0430 3244  Themes - ok
23:33:42.0446 3244  [ 146B6F43A673379A3C670E86D89BE5EA ] THREADORDER    C:\Windows\system32\mmcss.dll
23:33:42.0477 3244  THREADORDER - ok
23:33:42.0477 3244  [ 4792C0378DB99A9BC2AE2DE6CFFF0C3A ] TrkWks          C:\Windows\System32\trkwks.dll
23:33:42.0524 3244  TrkWks - ok
23:33:42.0555 3244  [ 2C49B175AEE1D4364B91B531417FE583 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
23:33:42.0618 3244  TrustedInstaller - ok
23:33:42.0649 3244  [ 254BB140EEE3C59D6114C1A86B636877 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
23:33:42.0680 3244  tssecsrv - ok
23:33:42.0742 3244  [ FD1D6C73E6333BE727CBCC6054247654 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
23:33:42.0774 3244  TsUsbFlt - ok
23:33:42.0820 3244  [ B2FA25D9B17A68BB93D58B0556E8C90D ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
23:33:42.0852 3244  tunnel - ok
23:33:42.0867 3244  [ 750FBCB269F4D7DD2E420C56B795DB6D ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
23:33:42.0883 3244  uagp35 - ok
23:33:42.0914 3244  [ EE43346C7E4B5E63E54F927BABBB32FF ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
23:33:42.0945 3244  udfs - ok
23:33:42.0976 3244  [ 8344FD4FCE927880AA1AA7681D4927E5 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
23:33:42.0992 3244  UI0Detect - ok
23:33:43.0039 3244  [ 44E8048ACE47BEFBFDC2E9BE4CBC8880 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
23:33:43.0039 3244  uliagpkx - ok
23:33:43.0070 3244  [ D295BED4B898F0FD999FCFA9B32B071B ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
23:33:43.0101 3244  umbus - ok
23:33:43.0117 3244  [ 7550AD0C6998BA1CB4843E920EE0FEAC ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
23:33:43.0148 3244  UmPass - ok
23:33:43.0164 3244  [ 409994A8EACEEE4E328749C0353527A0 ] UmRdpService    C:\Windows\System32\umrdp.dll
23:33:43.0179 3244  UmRdpService - ok
23:33:43.0210 3244  [ 833FBB672460EFCE8011D262175FAD33 ] upnphost        C:\Windows\System32\upnphost.dll
23:33:43.0257 3244  upnphost - ok
23:33:43.0273 3244  [ BD9C55D7023C5DE374507ACC7A14E2AC ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
23:33:43.0304 3244  usbccgp - ok
23:33:43.0320 3244  [ 04EC7CEC62EC3B6D9354EEE93327FC82 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
23:33:43.0351 3244  usbcir - ok
23:33:43.0366 3244  [ F92DE757E4B7CE9C07C5E65423F3AE3B ] usbehci        C:\Windows\system32\DRIVERS\usbehci.sys
23:33:43.0366 3244  usbehci - ok
23:33:43.0398 3244  [ 8DC94AEC6A7E644A06135AE7506DC2E9 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
23:33:43.0413 3244  usbhub - ok
23:33:43.0429 3244  [ E185D44FAC515A18D9DEDDC23C2CDF44 ] usbohci        C:\Windows\system32\DRIVERS\usbohci.sys
23:33:43.0460 3244  usbohci - ok
23:33:43.0476 3244  [ 797D862FE0875E75C7CC4C1AD7B30252 ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
23:33:43.0476 3244  usbprint - ok
23:33:43.0507 3244  [ F991AB9CC6B908DB552166768176896A ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
23:33:43.0522 3244  USBSTOR - ok
23:33:43.0538 3244  [ 68DF884CF41CDADA664BEB01DAF67E3D ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
23:33:43.0554 3244  usbuhci - ok
23:33:43.0569 3244  [ 081E6E1C91AEC36758902A9F727CD23C ] UxSms          C:\Windows\System32\uxsms.dll
23:33:43.0600 3244  UxSms - ok
23:33:43.0616 3244  [ 81951F51E318AECC2D68559E47485CC4 ] VaultSvc        C:\Windows\system32\lsass.exe
23:33:43.0616 3244  VaultSvc - ok
23:33:43.0647 3244  [ A059C4C3EDB09E07D21A8E5C0AABD3CB ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
23:33:43.0647 3244  vdrvroot - ok
23:33:43.0694 3244  [ C3CD30495687C2A2F66A65CA6FD89BE9 ] vds            C:\Windows\System32\vds.exe
23:33:43.0741 3244  vds - ok
23:33:43.0756 3244  [ 17C408214EA61696CEC9C66E388B14F3 ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
23:33:43.0819 3244  vga - ok
23:33:43.0834 3244  [ 8E38096AD5C8570A6F1570A61E251561 ] VgaSave        C:\Windows\System32\drivers\vga.sys
23:33:43.0881 3244  VgaSave - ok
23:33:43.0912 3244  [ 5461686CCA2FDA57B024547733AB42E3 ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
23:33:43.0912 3244  vhdmp - ok
23:33:43.0944 3244  [ C829317A37B4BEA8F39735D4B076E923 ] viaagp          C:\Windows\system32\drivers\viaagp.sys
23:33:43.0959 3244  viaagp - ok
23:33:43.0975 3244  [ E02F079A6AA107F06B16549C6E5C7B74 ] ViaC7          C:\Windows\system32\DRIVERS\viac7.sys
23:33:44.0006 3244  ViaC7 - ok
23:33:44.0022 3244  [ E43574F6A56A0EE11809B48C09E4FD3C ] viaide          C:\Windows\system32\drivers\viaide.sys
23:33:44.0037 3244  viaide - ok
23:33:44.0053 3244  [ C2F2911156FDC7817C52829C86DA494E ] vmbus          C:\Windows\system32\drivers\vmbus.sys
23:33:44.0068 3244  vmbus - ok
23:33:44.0084 3244  [ D4D77455211E204F370D08F4963063CE ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys
23:33:44.0100 3244  VMBusHID - ok
23:33:44.0115 3244  [ 4C63E00F2F4B5F86AB48A58CD990F212 ] volmgr          C:\Windows\system32\drivers\volmgr.sys
23:33:44.0131 3244  volmgr - ok
23:33:44.0146 3244  [ B5BB72067DDDDBBFB04B2F89FF8C3C87 ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
23:33:44.0162 3244  volmgrx - ok
23:33:44.0178 3244  [ F497F67932C6FA693D7DE2780631CFE7 ] volsnap        C:\Windows\system32\drivers\volsnap.sys
23:33:44.0193 3244  volsnap - ok
23:33:44.0209 3244  [ 9DFA0CC2F8855A04816729651175B631 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
23:33:44.0224 3244  vsmraid - ok
23:33:44.0271 3244  [ 209A3B1901B83AEB8527ED211CCE9E4C ] VSS            C:\Windows\system32\vssvc.exe
23:33:44.0318 3244  VSS - ok
23:33:44.0334 3244  [ 90567B1E658001E79D7C8BBD3DDE5AA6 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys
23:33:44.0365 3244  vwifibus - ok
23:33:44.0396 3244  [ 55187FD710E27D5095D10A472C8BAF1C ] W32Time        C:\Windows\system32\w32time.dll
23:33:44.0427 3244  W32Time - ok
23:33:44.0458 3244  [ DE3721E89C653AA281428C8A69745D90 ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
23:33:44.0474 3244  WacomPen - ok
23:33:44.0521 3244  [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
23:33:44.0583 3244  WANARP - ok
23:33:44.0599 3244  [ 3C3C78515F5AB448B022BDF5B8FFDD2E ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
23:33:44.0630 3244  Wanarpv6 - ok
23:33:44.0677 3244  [ 691E3285E53DCA558E1A84667F13E15A ] wbengine        C:\Windows\system32\wbengine.exe
23:33:44.0739 3244  wbengine - ok
23:33:44.0755 3244  [ 9614B5D29DC76AC3C29F6D2D3AA70E67 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
23:33:44.0770 3244  WbioSrvc - ok
23:33:44.0817 3244  [ 34EEE0DFAADB4F691D6D5308A51315DC ] wcncsvc        C:\Windows\System32\wcncsvc.dll
23:33:44.0848 3244  wcncsvc - ok
23:33:44.0848 3244  [ 5D930B6357A6D2AF4D7653BDABBF352F ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
23:33:44.0895 3244  WcsPlugInService - ok
23:33:44.0911 3244  [ 1112A9BADACB47B7C0BB0392E3158DFF ] Wd              C:\Windows\system32\DRIVERS\wd.sys
23:33:44.0926 3244  Wd - ok
23:33:44.0958 3244  [ 9950E3D0F08141C7E89E64456AE7DC73 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
23:33:44.0973 3244  Wdf01000 - ok
23:33:44.0973 3244  [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiServiceHost  C:\Windows\system32\wdi.dll
23:33:45.0020 3244  WdiServiceHost - ok
23:33:45.0020 3244  [ 46EF9DC96265FD0B423DB72E7C38C2A5 ] WdiSystemHost  C:\Windows\system32\wdi.dll
23:33:45.0036 3244  WdiSystemHost - ok
23:33:45.0051 3244  [ A9D880F97530D5B8FEE278923349929D ] WebClient      C:\Windows\System32\webclnt.dll
23:33:45.0082 3244  WebClient - ok
23:33:45.0114 3244  [ 760F0AFE937A77CFF27153206534F275 ] Wecsvc          C:\Windows\system32\wecsvc.dll
23:33:45.0129 3244  Wecsvc - ok
23:33:45.0145 3244  [ AC804569BB2364FB6017370258A4091B ] wercplsupport  C:\Windows\System32\wercplsupport.dll
23:33:45.0176 3244  wercplsupport - ok
23:33:45.0192 3244  [ 08E420D873E4FD85241EE2421B02C4A4 ] WerSvc          C:\Windows\System32\WerSvc.dll
23:33:45.0223 3244  WerSvc - ok
23:33:45.0238 3244  [ 8B9A943F3B53861F2BFAF6C186168F79 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
23:33:45.0270 3244  WfpLwf - ok
23:33:45.0285 3244  [ 5CF95B35E59E2A38023836FFF31BE64C ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
23:33:45.0285 3244  WIMMount - ok
23:33:45.0301 3244  WinHttpAutoProxySvc - ok
23:33:45.0348 3244  [ F62E510B6AD4C21EB9FE8668ED251826 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
23:33:45.0410 3244  Winmgmt - ok
23:33:45.0472 3244  [ 1B91CD34EA3A90AB6A4EF0550174F4CC ] WinRM          C:\Windows\system32\WsmSvc.dll
23:33:45.0535 3244  WinRM - ok
23:33:45.0582 3244  [ A67E5F9A400F3BD1BE3D80613B45F708 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
23:33:45.0597 3244  WinUsb - ok
23:33:45.0644 3244  [ 16935C98FF639D185086A3529B1F2067 ] Wlansvc        C:\Windows\System32\wlansvc.dll
23:33:45.0675 3244  Wlansvc - ok
23:33:45.0706 3244  [ 0217679B8FCA58714C3BF2726D2CA84E ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
23:33:45.0722 3244  WmiAcpi - ok
23:33:45.0753 3244  [ 6EB6B66517B048D87DC1856DDF1F4C3F ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
23:33:45.0784 3244  wmiApSrv - ok
23:33:45.0862 3244  [ 3B40D3A61AA8C21B88AE57C58AB3122E ] WMPNetworkSvc  C:\Program Files\Windows Media Player\wmpnetwk.exe
23:33:45.0940 3244  WMPNetworkSvc - ok
23:33:45.0972 3244  [ A2F0EC770A92F2B3F9DE6D518E11409C ] WPCSvc          C:\Windows\System32\wpcsvc.dll
23:33:45.0987 3244  WPCSvc - ok
23:33:46.0018 3244  [ AA53356D60AF47EACC85BC617A4F3F66 ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
23:33:46.0050 3244  WPDBusEnum - ok
23:33:46.0081 3244  [ 6DB3276587B853BF886B69528FDB048C ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
23:33:46.0112 3244  ws2ifsl - ok
23:33:46.0128 3244  WSearch - ok
23:33:46.0159 3244  [ E714A1C0354636837E20CCBF00888EE7 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
23:33:46.0174 3244  WudfPf - ok
23:33:46.0221 3244  [ 1023EE888C9B47178C5293ED5336AB69 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
23:33:46.0252 3244  WUDFRd - ok
23:33:46.0284 3244  [ 8D1E1E529A2C9E9B6A85B55A345F7629 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
23:33:46.0299 3244  wudfsvc - ok
23:33:46.0330 3244  [ FF2D745B560F7C71B31F30F4D49F73D2 ] WwanSvc        C:\Windows\System32\wwansvc.dll
23:33:46.0362 3244  WwanSvc - ok
23:33:46.0362 3244  ================ Scan global ===============================
23:33:46.0393 3244  [ DAB748AE0439955ED2FA22357533DDDB ] C:\Windows\system32\basesrv.dll
23:33:46.0424 3244  [ 183B4188D5D91B271613EC3EFD1B3CEF ] C:\Windows\system32\winsrv.dll
23:33:46.0424 3244  [ 183B4188D5D91B271613EC3EFD1B3CEF ] C:\Windows\system32\winsrv.dll
23:33:46.0471 3244  [ 364455805E64882844EE9ACB72522830 ] C:\Windows\system32\sxssrv.dll
23:33:46.0502 3244  [ 5F1B6A9C35D3D5CA72D6D6FDEF9747D6 ] C:\Windows\system32\services.exe
23:33:46.0502 3244  [Global] - ok
23:33:46.0502 3244  ================ Scan MBR ==================================
23:33:46.0502 3244  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk1\DR1
23:33:46.0767 3244  \Device\Harddisk1\DR1 - ok
23:33:46.0783 3244  [ 587F1BF40479D66675A13B610E5E7F9E ] \Device\Harddisk0\DR0
23:33:46.0845 3244  \Device\Harddisk0\DR0 - ok
23:33:46.0845 3244  ================ Scan VBR ==================================
23:33:46.0876 3244  [ 4AA658609B119298D51249CA1C33007B ] \Device\Harddisk1\DR1\Partition1
23:33:46.0876 3244  \Device\Harddisk1\DR1\Partition1 - ok
23:33:46.0892 3244  [ 6AD97C3B7A8E62ED6D7D49DEDD175B2A ] \Device\Harddisk1\DR1\Partition2
23:33:46.0892 3244  \Device\Harddisk1\DR1\Partition2 - ok
23:33:46.0892 3244  [ 4209871E1686E761918260ED20859A67 ] \Device\Harddisk1\DR1\Partition3
23:33:46.0892 3244  \Device\Harddisk1\DR1\Partition3 - ok
23:33:46.0923 3244  [ E6ECB38C29FC9CEB1A2747D2F33B31EA ] \Device\Harddisk0\DR0\Partition1
23:33:46.0923 3244  \Device\Harddisk0\DR0\Partition1 - ok
23:33:46.0954 3244  [ 45A1797E620C57261C3B89C1B96A4416 ] \Device\Harddisk0\DR0\Partition2
23:33:46.0954 3244  \Device\Harddisk0\DR0\Partition2 - ok
23:33:46.0954 3244  ============================================================
23:33:46.0954 3244  Scan finished
23:33:46.0954 3244  ============================================================
23:33:46.0970 3236  Detected object count: 0
23:33:46.0970 3236  Actual detected object count: 0

cosinus 10.09.2012 22:39
Ok :daumenhoc
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

aypstyle 10.09.2012 23:34
Code:
ComboFix 12-09-10.04 - aYpStyle 11.09.2012  0:24.1.2 - x86
Microsoft Windows 7 Professional  6.1.7601.1.1252.49.1031.18.2046.1595 [GMT 2:00]
ausgeführt von:: f:\downloadz\Antivirushilfe\ComboFix.exe
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
 * Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\program files\INSTALL.LOG
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-08-10 bis 2012-09-10  ))))))))))))))))))))))))))))))
.
.
2012-09-10 21:29 . 2012-09-10 21:29        --------        d-----w-        C:\TDSSKiller_Quarantine
2012-08-22 14:21 . 2012-08-22 14:21        --------        d-----w-        c:\users\aYpStyle\AppData\Local\DDMSettings
2012-08-22 13:10 . 2012-09-07 14:00        --------        d-----w-        c:\users\aYpStyle\AppData\Roaming\DivX
2012-08-22 13:10 . 2012-08-22 13:10        --------        d-----w-        c:\program files\Common Files\DivX Shared
2012-08-22 13:07 . 2012-08-22 13:11        --------        d-----w-        c:\program files\DivX
2012-08-22 12:00 . 2012-08-22 13:11        --------        d-----w-        c:\programdata\DivX
2012-08-22 09:21 . 2012-08-22 09:21        --------        d-----w-        c:\program files\searchplugins
2012-08-22 09:21 . 2012-08-22 09:21        --------        d-----w-        c:\program files\defaults
2012-08-22 09:21 . 2012-08-22 09:21        --------        d-----w-        c:\program files\components
2012-08-22 09:21 . 2012-06-14 22:17        2042848        ----a-w-        c:\program files\mozjs.dll
2012-08-22 07:16 . 2012-08-22 07:16        --------        d-----w-        c:\program files\ESET
2012-08-22 07:11 . 2012-08-22 13:40        --------        d-----w-        c:\program files\Mozilla Maintenance Service
2012-08-22 06:40 . 2012-08-22 06:40        --------        d-----w-        c:\users\aYpStyle\AppData\Roaming\Malwarebytes
2012-08-22 06:40 . 2012-08-22 06:40        --------        d-----w-        c:\programdata\Malwarebytes
2012-08-22 06:40 . 2012-07-03 11:46        22344        ----a-w-        c:\windows\system32\drivers\mbam.sys
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-09-10 21:31 . 2009-07-13 23:11        259072        ----a-w-        c:\windows\system32\services.exe
2012-08-07 07:28 . 2012-08-07 07:28        476976        ----a-w-        c:\windows\system32\npdeployJava1.dll
2012-08-07 07:28 . 2012-04-12 11:56        472880        ----a-w-        c:\windows\system32\deployJava1.dll
2012-07-08 10:32 . 2012-04-12 11:54        70344        ----a-w-        c:\windows\system32\FlashPlayerCPLApp.cpl
2012-07-08 10:32 . 2012-04-12 11:54        426184        ----a-w-        c:\windows\system32\FlashPlayerApp.exe
2012-06-14 22:19 . 2012-04-12 11:32        15757792        ----a-w-        c:\program files\xul.dll
2012-06-14 22:18 . 2012-04-12 11:32        19424        ----a-w-        c:\program files\xpcom.dll
2012-06-14 22:18 . 2012-04-12 11:32        265184        ----a-w-        c:\program files\updater.exe
2012-06-14 22:18 . 2012-04-12 11:32        145376        ----a-w-        c:\program files\ssl3.dll
2012-06-14 22:18 . 2012-04-12 11:32        155104        ----a-w-        c:\program files\softokn3.dll
2012-06-14 22:18 . 2012-04-12 11:32        91104        ----a-w-        c:\program files\smime3.dll
2012-06-14 22:18 . 2012-04-12 11:32        16864        ----a-w-        c:\program files\plugin-container.exe
2012-06-14 22:18 . 2012-04-12 11:32        20960        ----a-w-        c:\program files\plds4.dll
2012-06-14 22:18 . 2012-04-12 11:32        21472        ----a-w-        c:\program files\plc4.dll
2012-06-14 22:18 . 2012-04-12 11:32        92640        ----a-w-        c:\program files\nssutil3.dll
2012-06-14 22:18 . 2012-04-12 11:32        95712        ----a-w-        c:\program files\nssdbm3.dll
2012-06-14 22:18 . 2012-04-12 11:32        358368        ----a-w-        c:\program files\nssckbi.dll
2012-06-14 22:18 . 2012-04-12 11:32        637920        ----a-w-        c:\program files\nss3.dll
2012-06-14 22:17 . 2012-04-12 11:32        170464        ----a-w-        c:\program files\nspr4.dll
2012-06-14 22:17 . 2012-04-12 11:32        829920        ----a-w-        c:\program files\mozsqlite3.dll
2012-06-14 22:17 . 2012-04-12 11:32        43488        ----a-w-        c:\program files\mozglue.dll
2012-06-14 22:17 . 2012-04-12 11:32        16352        ----a-w-        c:\program files\mozalloc.dll
2012-06-14 22:17 . 2012-06-17 08:08        157608        ----a-w-        c:\program files\maintenanceservice_installer.exe
2012-06-14 22:17 . 2012-06-17 08:08        113120        ----a-w-        c:\program files\maintenanceservice.exe
2012-06-14 22:17 . 2012-04-12 11:32        418784        ----a-w-        c:\program files\libGLESv2.dll
2012-06-14 22:17 . 2012-04-12 11:32        79840        ----a-w-        c:\program files\libEGL.dll
2012-06-14 22:17 . 2012-04-12 11:32        624608        ----a-w-        c:\program files\gkmedias.dll
2012-06-14 22:17 . 2012-04-12 11:32        258528        ----a-w-        c:\program files\freebl3.dll
2012-06-14 22:17 . 2012-04-12 11:32        913888        ----a-w-        c:\program files\firefox.exe
2012-06-14 22:17 . 2012-04-12 11:32        117728        ----a-w-        c:\program files\crashreporter.exe
2012-06-14 22:17 . 2012-04-12 11:32        18912        ----a-w-        c:\program files\AccessibleMarshal.dll
2012-06-14 22:16 . 2012-04-12 11:32        2106216        ----a-w-        c:\program files\D3DCompiler_43.dll
2012-06-14 22:16 . 2012-04-12 11:32        1998168        ----a-w-        c:\program files\d3dx9_43.dll
2012-06-14 22:16 . 2012-06-17 08:08        770384        ----a-w-        c:\program files\msvcr100.dll
2012-06-14 22:16 . 2012-06-17 08:08        421200        ----a-w-        c:\program files\msvcp100.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Spotify"="c:\users\aYpStyle\AppData\Roaming\Spotify\spotify.exe" [2012-08-21 5576408]
"Spotify Web Helper"="c:\users\aYpStyle\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe" [2012-08-21 1193176]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"Adobe ARM"="c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe" [2012-01-18 254696]
"DivXUpdate"="c:\program files\DivX\DivX Update\DivXUpdate.exe" [2011-07-28 1259376]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Spotify Web Helper]
2012-08-21 18:54        1193176        ----a-w-        c:\users\aYpStyle\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
.
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files\Mozilla Maintenance Service\maintenanceservice.exe [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S3 RTL8167;Realtek 8167 NT-Treiber;c:\windows\system32\DRIVERS\Rt86win7.sys [x]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - WS2IFSL
.
.
------- Zusätzlicher Suchlauf -------
.
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\aYpStyle\AppData\Roaming\Mozilla\Firefox\Profiles\2jmqqn5z.default\
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
SafeBoot-95121349.sys
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\windows\system32\atieclxx.exe
c:\windows\system32\taskhost.exe
c:\windows\system32\conhost.exe
c:\windows\System32\rundll32.exe
c:\program files\Windows Media Player\wmpnetwk.exe
c:\windows\system32\sppsvc.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-09-11  00:32:52 - PC wurde neu gestartet
ComboFix-quarantined-files.txt  2012-09-10 22:32
.
Vor Suchlauf: 7 Verzeichnis(se), 53.708.873.728 Bytes frei
Nach Suchlauf: 11 Verzeichnis(se), 53.441.724.416 Bytes frei
.
- - End Of File - - FEEBBA99A02EA4B9E076246543BD3689

cosinus 11.09.2012 15:43
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

aypstyle 12.09.2012 13:53
GMER Logfile:
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-09-12 14:52:20
Windows 6.1.7601 Service Pack 1 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1 SAMSUNG_HD160JJ rev.WU100-33
Running: fllqq74h.exe; Driver: C:\Users\aYpStyle\AppData\Local\Temp\fxlyqkoc.sys


---- Kernel code sections - GMER 1.0.15 ----

.text          ntkrnlpa.exe!ZwRollbackEnlistment + 140D                      828923C9 1 Byte  [06]
.text          ntkrnlpa.exe!KiDispatchInterrupt + 5A2                        828CBD52 19 Bytes  [E0, 0F, BA, F0, 07, 73, 09, ...] {LOOPNZ 0x11; MOV EDX, 0x97307f0; MOV CR4, EAX; OR AL, 0x80; MOV CR4, EAX; RET ; MOV ECX, CR3}
.text          C:\Windows\system32\DRIVERS\atikmdag.sys                      section is writeable [0x8E006000, 0x2D5378, 0xE8000020]
.text          autochk.exe                                                    004011D1 42 Bytes  [C4, 08, 5D, C3, CC, CC, CC, ...]
.text          autochk.exe                                                    004011FC 5 Bytes  [8B, E5, 5D, C2, 08]
.text          autochk.exe                                                    00401202 41 Bytes  [CC, CC, CC, CC, CC, CC, CC, ...]
.text          autochk.exe                                                    0040122C 5 Bytes  [8B, E5, 5D, C2, 08]
.text          autochk.exe                                                    00401232 47 Bytes  [CC, CC, CC, CC, CC, CC, CC, ...]
.text          ...                                                           

---- User code sections - GMER 1.0.15 ----

.text          C:\Program Files\firefox.exe[3016] ntdll.dll!LdrLoadDll        77AE223E 5 Bytes  JMP 6D2DFA35 C:\Program Files\xul.dll (Mozilla Foundation)
.text          C:\Program Files\firefox.exe[3016] kernel32.dll!MapViewOfFile  762A93DB 5 Bytes  JMP 6D58079E C:\Program Files\xul.dll (Mozilla Foundation)
.text          C:\Program Files\firefox.exe[3016] kernel32.dll!VirtualAlloc  762AC43A 5 Bytes  JMP 6D5807C5 C:\Program Files\xul.dll (Mozilla Foundation)
.text          C:\Program Files\firefox.exe[3016] GDI32.dll!CreateDIBSection  771C8850 5 Bytes  JMP 6D580728 C:\Program Files\xul.dll (Mozilla Foundation)

---- Devices - GMER 1.0.15 ----

Device          \Driver\ACPI_HAL \Device\00000043                              halmacpi.dll (Hardware Abstraction Layer DLL/Microsoft Corporation)

AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                        fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume1                        rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                        fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume2                        rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                        fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume3                        rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                        fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume4                        rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                        fvevol.sys (BitLocker Drive Encryption Driver/Microsoft Corporation)
AttachedDevice  \Driver\volmgr \Device\HarddiskVolume5                        rdyboost.sys (ReadyBoost Driver/Microsoft Corporation)

---- EOF - GMER 1.0.15 ----
--- --- ---


OSAM Logfile:
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 14:37:56 on 12.09.2012

OS: Windows 7  Service Pack 1 (Build 7601), 32-bit
Default Browser: Mozilla Corporation Firefox 13.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"DivXControlPanelApplet.cpl" - "DivX, Inc." - C:\Windows\system32\DivXControlPanelApplet.cpl
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"catchme" (catchme) - ? - C:\Users\aYpStyle\AppData\Local\Temp\catchme.sys  (File not found)
"fxlyqkoc" (fxlyqkoc) - ? - C:\Users\aYpStyle\AppData\Local\Temp\fxlyqkoc.sys  (Hidden registry entry, rootkit activity | File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{D8D1CE8C-B1EB-4E95-B63B-1531BA60E992} "DivX Property Handler" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXPropertyHandler.dll
{83238FAE-D346-4E12-8734-D42F7554B3E6} "DivX Thumbnail Provider" - "DivX, Inc." - C:\Program Files\DivX\DivX Plus Media Foundation Components\DivXThumbnailProvider.dll
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
{CAFEEFAC-0016-0000-0033-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.6.0_33" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\npjpi160_33.dll / hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_33-windows-i586.cab
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{326E768D-4182-46FD-9C16-1449A49795F4} "DivX Plus Web Player HTML5 <video>" - "DivX, LLC" - C:\Program Files\DivX\DivX Plus Web Player\ie\DivXHTML5\DivXHTML5.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Sun Microsystems, Inc." - C:\Program Files\Java\jre6\bin\ssv.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\aYpStyle\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"Spotify" - "Spotify Ltd" - "C:\Users\aYpStyle\AppData\Roaming\Spotify\spotify.exe" /uri spotify:autostart
"Spotify Web Helper" - ? - "C:\Users\aYpStyle\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe"  (File found, but it contains no detailed information)
"Steam" - "Valve Corporation" - "D:\Steam\Steam.exe" -silent
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"Adobe ARM" - "Adobe Systems Incorporated" - "C:\Program Files\Common Files\Adobe\ARM\1.0\AdobeARM.exe"
"DivXUpdate" - ? - "C:\Program Files\DivX\DivX Update\DivXUpdate.exe" /CHECKNOW
"SunJavaUpdateSched" - "Sun Microsystems, Inc." - "C:\Program Files\Common Files\Java\Java Update\jusched.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
"Steam Client Service" (Steam Client Service) - "Valve Corporation" - C:\Program Files\Common Files\Steam\SteamService.exe

===[ Logfile end ]=========================================[ Logfile end ]===
--- --- ---
If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-12 14:54:45
-----------------------------
14:54:45.174    OS Version: Windows 6.1.7601 Service Pack 1
14:54:45.174    Number of processors: 2 586 0x6B02
14:54:45.174    ComputerName: AYPSTYLE-PC  UserName: aYpStyle
14:54:45.907    Initialize success
14:59:26.748    AVAST engine defs: 12091200
15:00:15.366    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
15:00:15.366    Disk 0 Vendor: SAMSUNG_HD160JJ WU100-33 Size: 152627MB BusType: 3
15:00:15.366    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T0L0-0
15:00:15.366    Disk 1 Vendor: SAMSUNG_HD250HJ FH100-05 Size: 238474MB BusType: 3
15:00:15.444    Disk 0 MBR read successfully
15:00:15.444    Disk 0 MBR scan
15:00:15.444    Disk 0 unknown MBR code
15:00:15.506    Disk 0 Partition 1 00    07    HPFS/NTFS NTFS        80000 MB offset 2048
15:00:15.522    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        72625 MB offset 163842048
15:00:15.568    Disk 0 scanning sectors +312578048
15:00:16.036    Disk 0 scanning C:\Windows\system32\drivers
15:01:39.403    Service scanning
15:01:57.733    Modules scanning
15:02:14.690    Disk 0 trace - called modules:
15:02:14.721    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
15:02:14.721    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8563b170]
15:02:14.721    3 CLASSPNP.SYS[88b9659e] -> nt!IofCallDriver -> [0x855618a8]
15:02:14.737    5 ACPI.sys[82fb73d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0x8518a030]
15:02:15.486    AVAST engine scan C:\Windows
15:02:21.679    AVAST engine scan C:\Windows\system32
15:11:06.315    AVAST engine scan C:\Windows\system32\drivers
15:11:18.625    AVAST engine scan C:\Users\aYpStyle
15:12:16.772    AVAST engine scan C:\ProgramData
15:12:27.587    Scan finished successfully
15:12:39.368    Disk 0 MBR has been saved successfully to "C:\Users\aYpStyle\Desktop\MBR.dat"
15:12:39.376    The log file has been saved successfully to "C:\Users\aYpStyle\Desktop\aswMBR.txt"

cosinus 12.09.2012 14:55
Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

aypstyle 12.09.2012 20:19
ich hoffe das hinterfragen macht keine Umstände
... die Datensicherung läuft... ... sollte der MBRfix fehlschlagen heißt das quasi... Windows neu aufsetzen ? richtig?
muss das wissen, da ich zur Zeit nur diesen einen Rechner hab und mir einen USB stick bootfähig machen müsste um das dann neu zu installieren, da ich keine CD zur Hand habe

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-12 14:54:45
-----------------------------
14:54:45.174    OS Version: Windows 6.1.7601 Service Pack 1
14:54:45.174    Number of processors: 2 586 0x6B02
14:54:45.174    ComputerName: AYPSTYLE-PC  UserName: aYpStyle
14:54:45.907    Initialize success
14:59:26.748    AVAST engine defs: 12091200
15:00:15.366    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP1T0L0-1
15:00:15.366    Disk 0 Vendor: SAMSUNG_HD160JJ WU100-33 Size: 152627MB BusType: 3
15:00:15.366    Disk 1  \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP0T0L0-0
15:00:15.366    Disk 1 Vendor: SAMSUNG_HD250HJ FH100-05 Size: 238474MB BusType: 3
15:00:15.444    Disk 0 MBR read successfully
15:00:15.444    Disk 0 MBR scan
15:00:15.444    Disk 0 unknown MBR code
15:00:15.506    Disk 0 Partition 1 00    07    HPFS/NTFS NTFS        80000 MB offset 2048
15:00:15.522    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS        72625 MB offset 163842048
15:00:15.568    Disk 0 scanning sectors +312578048
15:00:16.036    Disk 0 scanning C:\Windows\system32\drivers
15:01:39.403    Service scanning
15:01:57.733    Modules scanning
15:02:14.690    Disk 0 trace - called modules:
15:02:14.721    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
15:02:14.721    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x8563b170]
15:02:14.721    3 CLASSPNP.SYS[88b9659e] -> nt!IofCallDriver -> [0x855618a8]
15:02:14.737    5 ACPI.sys[82fb73d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0x8518a030]
15:02:15.486    AVAST engine scan C:\Windows
15:02:21.679    AVAST engine scan C:\Windows\system32
15:11:06.315    AVAST engine scan C:\Windows\system32\drivers
15:11:18.625    AVAST engine scan C:\Users\aYpStyle
15:12:16.772    AVAST engine scan C:\ProgramData
15:12:27.587    Scan finished successfully
15:12:39.368    Disk 0 MBR has been saved successfully to "C:\Users\aYpStyle\Desktop\MBR.dat"
15:12:39.376    The log file has been saved successfully to "C:\Users\aYpStyle\Desktop\aswMBR.txt"


aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-09-13 12:17:23
-----------------------------
12:17:23.189    OS Version: Windows 6.1.7601 Service Pack 1
12:17:23.189    Number of processors: 2 586 0x6B02
12:17:23.189    ComputerName: AYPSTYLE-PC  UserName: aYpStyle
12:17:23.594    Initialize success
12:17:32.486    AVAST engine defs: 12091200
12:17:39.616    Disk 0  \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
12:17:39.616    Disk 0 Vendor: SAMSUNG_HD250HJ FH100-05 Size: 238474MB BusType: 3
12:17:39.616    Disk 1 (boot) \Device\Harddisk1\DR1 -> \Device\Ide\IdeDeviceP1T0L0-1
12:17:39.616    Disk 1 Vendor: SAMSUNG_HD160JJ WU100-33 Size: 152627MB BusType: 3
12:17:39.631    Disk 1 MBR read successfully
12:17:39.631    Disk 1 MBR scan
12:17:39.631    Disk 1 Windows 7 default MBR code
12:17:39.647    Disk 1 Partition 1 00    07    HPFS/NTFS NTFS        80000 MB offset 2048
12:17:39.662    Disk 1 Partition 2 00    07    HPFS/NTFS NTFS        72625 MB offset 163842048
12:17:39.678    Disk 1 scanning sectors +312578048
12:17:39.725    Disk 1 scanning C:\Windows\system32\drivers
12:17:48.243    Service scanning
12:18:10.223    Modules scanning
12:18:17.118    Disk 1 trace - called modules:
12:18:17.134    ntkrnlpa.exe CLASSPNP.SYS disk.sys ACPI.sys halmacpi.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys
12:18:17.149    1 nt!IofCallDriver -> \Device\Harddisk1\DR1[0x8563c5b0]
12:18:17.149    3 CLASSPNP.SYS[88b9759e] -> nt!IofCallDriver -> [0x8517af08]
12:18:17.165    5 ACPI.sys[82fb83d4] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP1T0L0-1[0x8555a030]
12:18:17.571    AVAST engine scan C:\Windows
12:18:19.708    AVAST engine scan C:\Windows\system32
12:20:59.046    AVAST engine scan C:\Windows\system32\drivers
12:21:09.202    AVAST engine scan C:\Users\aYpStyle
12:22:06.882    AVAST engine scan C:\ProgramData
12:22:16.445    Scan finished successfully
12:24:26.533    Disk 1 MBR has been saved successfully to "C:\Users\aYpStyle\Desktop\MBR.dat"
12:24:26.533    The log file has been saved successfully to "C:\Users\aYpStyle\Desktop\aswMBR.txt"

cosinus 13.09.2012 13:10
Wenn richtig was schiefläuft würde das wohl eine Neuinstallation bedeuten, ja. Bisher hatte ich aber noch nie von Problemen nach aswMBR gehört. Es sei denn es wird überlesen, dass man den MBR nicht fixen soll wenn noch andere Systeme in einer Dualboot-Umgebung (Windows+Linux) oder Windows auf einer mit TrueCrypt vollverschlüsselten Partition liegt. Dann gibt es richtige Probleme :pfeiff: wenn man sowas hat und den MBR fixt.


Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

aypstyle 15.09.2012 08:54
Code:
Malwarebytes Anti-Malware 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.09.14.05

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
aYpStyle :: AYPSTYLE-PC [Administrator]

14.09.2012 23:43:17
mbam-log-2012-09-15 (02-40-08).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|E:\|F:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 286555
Laufzeit: 29 Minute(n), 24 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 3
F:\_OTL\MovedFiles\09102012_211836\C_Windows\Installer\{42a985b7-1f79-df30-1dda-9864dc9c0a96}\U\80000000.@ (Trojan.Small) -> Keine Aktion durchgeführt.
F:\_OTL\MovedFiles\09102012_211836\C_Windows\Installer\{42a985b7-1f79-df30-1dda-9864dc9c0a96}\U\800000cb.@ (Rootkit.0Access) -> Keine Aktion durchgeführt.
C:\Program Files\mozjs.dll (Spyware.OnlineGames) -> Keine Aktion durchgeführt.

(Ende)
SuperAntiSpyware hat 0 Erkannte Bedrohungen gefunden
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 09/15/2012 at 09:56 AM

Application Version : 5.5.1016

Core Rules Database Version : 9231
Trace Rules Database Version: 7043

Scan type      : Complete Scan
Total Scan Time : 00:23:20

Operating System Information
Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 490
Memory threats detected  : 0
Registry items scanned    : 33123
Registry threats detected : 0
File items scanned        : 29979
File threats detected    : 0

cosinus 15.09.2012 14:11
Malwarebytes hat nur zwei Elemente in der Quarantäne gefunden das ist dort in Ordnung - und einen Überrest. Bitte alles entfernen

Code:
UAC On - Limited User
Wie hast du sasw gestartet? Einfach per Doppelklick?

aypstyle 17.09.2012 19:32
da ich mir nicht sicher war... habe ich einen erneuten Durchlauf mit SUPERAntiSpyware gemacht per "rechtsklick -> als administrator ausführen"
Code:
SUPERAntiSpyware Scann-Protokoll
hxxp://www.superantispyware.com

Generiert 09/17/2012 bei 04:46 PM

Version der Applikation : 5.5.1016

Version der Kern-Datenbank : 9231
Version der Spur-Datenbank : 7043

Scan Art      : kompletter Scann
Totale Scann-Zeit : 00:24:13

Operating System Information
Windows 7 Professional 32-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Gescannte Speicherelemente  : 497
Erfasste Speicher-Bedrohungen  : 0
Gescannte Register-Elemente  : 33123
Erfasste Register-Bedrohungen  : 0
Gescannte Datei-Elemente    : 30038
Erfasste Datei-Elemente  : 0
... habe zusätzlich alles in der Quarantäne von Malwarebyte's gelöscht

cosinus 18.09.2012 14:37
Dann ist das ein Bug von sasw hab ich schon öfter gesehen

Jedenfalls keine Funde

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

aypstyle 18.09.2012 17:08
erstmal vielen dank für die Unterstützung... ich werde jetz die 2 Browserlösung auf jeden Fall benutzen ....
ansonsten habe ich jetz nichts mehr bemerkt...
vielen dank nochmal

cosinus 19.09.2012 13:26
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:
Prüfen => Adobe - Flash Player
Downloadlinks => Adobe Flash Player Distribution | Adobe

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.


Alle Zeitangaben in WEZ +1. Es ist jetzt 14:20 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131