Trojaner-Board
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)
-   -   Browser Hijack, Windows 7 (https://www.trojaner-board.de/124808-browser-hijack-windows-7-a.html)

cosinus 01.10.2012 10:13
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
FF - user.js - File not found
O3:64bit: - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O4 - HKU\S-1-5-21-3604425780-3961754136-3952538482-1001..\Run: [SpybotSD TeaTimer] C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk =  File not found
O4 - Startup: C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk =  File not found
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk =  File not found
O4 - Startup: C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk =  File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: PromptOnSecureDesktop = 0
O7 - HKU\S-1-5-21-3604425780-3961754136-3952538482-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145
O32 - HKLM CDRom: AutoRun - 1
:Files
C:\Users\Lisa\Programme\essentials\Office\PDFCreator-1_2_3_setup.exe
C:\Users\Lisa\Programme\essentials\Sicherheit\gusetup.exe
ipconfig /flushdns /c
:Commands
[purity]
[emptytemp]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

yruwhatur 01.10.2012 10:52
Code:
All processes killed
========== OTL ==========
64bit-Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3604425780-3961754136-3952538482-1001\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
C:\Program Files (x86)\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk moved successfully.
C:\Users\Default\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk moved successfully.
File move failed. C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk scheduled to be moved on reboot.
File move failed. C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk scheduled to be moved on reboot.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop deleted successfully.
Registry value HKEY_USERS\S-1-5-21-3604425780-3961754136-3952538482-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
========== FILES ==========
C:\Users\Lisa\Programme\essentials\Office\PDFCreator-1_2_3_setup.exe moved successfully.
C:\Users\Lisa\Programme\essentials\Sicherheit\gusetup.exe moved successfully.
< ipconfig /flushdns /c >
Windows-IP-Konfiguration
Der DNS-Aufl”sungscache wurde geleert.
C:\Users\Lisa\Desktop\cmd.bat deleted successfully.
C:\Users\Lisa\Desktop\cmd.txt deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Leapforce
->Temp folder emptied: 28429896 bytes
->Temporary Internet Files folder emptied: 6253249 bytes
->FireFox cache emptied: 1138600779 bytes
->Flash cache emptied: 27762 bytes
 
User: Lisa
->Temp folder emptied: 15141260 bytes
->Temporary Internet Files folder emptied: 3625692 bytes
->FireFox cache emptied: 60641987 bytes
->Flash cache emptied: 1218 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 17697540 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 80622 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 67765 bytes
RecycleBin emptied: 32920704 bytes
 
Total Files Cleaned = 1.243,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.69.0 log created on 10012012_022500

Files\Folders moved on Reboot...
File\Folder C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\LaunchCenter.lnk not found!
File\Folder C:\Users\Default User\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\newreminderdialog.lnk not found!
C:\Users\Lisa\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

PendingFileRenameOperations files...

Registry entries deleted on Reboot...
Also, ich habe grad mal 5 Minuten rumgesurft und bisher kein Redirect. :singsing: Meine Stimmung hebt sich - aber ich jubel mal noch nicht und meld' in einer Stunde nochmal zurück.

Also bisher kein einziger Redirect und ich hab's herausgefordert mit lauter Shopping-Seiten. Kann ich anfangen zu jubeln? :applaus:? Und ich wüsste gern, was es war und wo und wie ich mich in Zukunft davor schütze.

Kleiner nachschub: Wie schon oben beschrieben ist der Computer meines Mannes auch im Heimnetzwerk und der hatte vor 5 Tagen auch das tracking999.com Problem mit den ersten 3 google Suchergebnissen. Aber seit da nicht mehr und auch ohne die redirects, die ich hatte. Sollte er sich auch Hilfe holen und was machen wir mit dem Netzwerk?

cosinus 01.10.2012 13:37
Zitat:
Kleiner nachschub: Wie schon oben beschrieben ist der Computer meines Mannes auch im Heimnetzwerk und der hatte vor 5 Tagen auch das tracking999.com Problem mit den ersten 3 google Suchergebnissen. Aber seit da nicht mehr und auch ohne die redirects, die ich hatte. Sollte er sich auch Hilfe holen und was machen wir mit dem Netzwerk?
Für jeden Rechner bitte einen eigenen Strang erstellen! Es wäre chaotisch Logs von verschiedenen Rechnern in einem Strang zu posten, falls du das vor hast


Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.

Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition ( meistens Laufwerk C: ) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtg4nzy0ywy5/settings_2012-09-04.png

yruwhatur 01.10.2012 15:41
Code:
07:34:24.0209 5564  TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24
07:34:24.0345 5564  ============================================================
07:34:24.0345 5564  Current date / time: 2012/10/01 07:34:24.0345
07:34:24.0345 5564  SystemInfo:
07:34:24.0345 5564 
07:34:24.0346 5564  OS Version: 6.1.7601 ServicePack: 1.0
07:34:24.0346 5564  Product type: Workstation
07:34:24.0346 5564  ComputerName: LISASLAPTOP
07:34:24.0346 5564  UserName: Lisa
07:34:24.0346 5564  Windows directory: C:\Windows
07:34:24.0346 5564  System windows directory: C:\Windows
07:34:24.0346 5564  Running under WOW64
07:34:24.0346 5564  Processor architecture: Intel x64
07:34:24.0346 5564  Number of processors: 4
07:34:24.0346 5564  Page size: 0x1000
07:34:24.0346 5564  Boot type: Normal boot
07:34:24.0346 5564  ============================================================
07:34:24.0857 5564  Drive \Device\Harddisk0\DR0 - Size: 0xAEA8CDE000 (698.64 Gb), SectorSize: 0x200, Cylinders: 0x16441, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
07:34:24.0862 5564  ============================================================
07:34:24.0862 5564  \Device\Harddisk0\DR0:
07:34:24.0862 5564  MBR partitions:
07:34:24.0877 5564  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x401800, BlocksNum 0x55342800
07:34:24.0912 5564  ============================================================
07:34:24.0946 5564  C: <-> \Device\Harddisk0\DR0\Partition1
07:34:24.0946 5564  ============================================================
07:34:24.0946 5564  Initialize success
07:34:24.0946 5564  ============================================================
07:34:55.0086 5372  ============================================================
07:34:55.0086 5372  Scan started
07:34:55.0086 5372  Mode: Manual; SigCheck; TDLFS;
07:34:55.0086 5372  ============================================================
07:34:55.0371 5372  ================ Scan system memory ========================
07:34:55.0371 5372  System memory - ok
07:34:55.0373 5372  ================ Scan services =============================
07:34:55.0590 5372  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys
07:34:55.0688 5372  1394ohci - ok
07:34:55.0716 5372  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys
07:34:55.0741 5372  ACPI - ok
07:34:55.0773 5372  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi        C:\Windows\system32\drivers\acpipmi.sys
07:34:55.0854 5372  AcpiPmi - ok
07:34:55.0905 5372  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\drivers\adp94xx.sys
07:34:55.0942 5372  adp94xx - ok
07:34:55.0969 5372  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\drivers\adpahci.sys
07:34:55.0997 5372  adpahci - ok
07:34:56.0023 5372  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\drivers\adpu320.sys
07:34:56.0044 5372  adpu320 - ok
07:34:56.0079 5372  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
07:34:56.0226 5372  AeLookupSvc - ok
07:34:56.0276 5372  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD            C:\Windows\system32\drivers\afd.sys
07:34:56.0350 5372  AFD - ok
07:34:56.0412 5372  [ 98022774D9930ECBB292E70DB7601DF6 ] AgereSoftModem  C:\Windows\system32\DRIVERS\agrsm64.sys
07:34:56.0467 5372  AgereSoftModem - ok
07:34:56.0493 5372  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys
07:34:56.0510 5372  agp440 - ok
07:34:56.0554 5372  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
07:34:56.0599 5372  ALG - ok
07:34:56.0626 5372  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys
07:34:56.0643 5372  aliide - ok
07:34:56.0670 5372  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys
07:34:56.0686 5372  amdide - ok
07:34:56.0716 5372  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\drivers\amdk8.sys
07:34:56.0751 5372  AmdK8 - ok
07:34:56.0757 5372  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\drivers\amdppm.sys
07:34:56.0790 5372  AmdPPM - ok
07:34:56.0812 5372  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
07:34:56.0830 5372  amdsata - ok
07:34:56.0855 5372  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\drivers\amdsbs.sys
07:34:56.0876 5372  amdsbs - ok
07:34:56.0891 5372  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata        C:\Windows\system32\drivers\amdxata.sys
07:34:56.0906 5372  amdxata - ok
07:34:56.0941 5372  [ 449D90F1FB6402773C2F1ECCEAE15F74 ] AMPPAL          C:\Windows\system32\DRIVERS\AMPPAL.sys
07:34:56.0981 5372  AMPPAL - ok
07:34:56.0989 5372  [ 449D90F1FB6402773C2F1ECCEAE15F74 ] AMPPALP        C:\Windows\system32\DRIVERS\amppal.sys
07:34:57.0007 5372  AMPPALP - ok
07:34:57.0109 5372  [ AB6E5B9333101E414D8F04BC570064F1 ] AMPPALR3        C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
07:34:57.0144 5372  AMPPALR3 - ok
07:34:57.0241 5372  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
07:34:57.0258 5372  AntiVirSchedulerService - ok
07:34:57.0305 5372  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
07:34:57.0319 5372  AntiVirService - ok
07:34:57.0377 5372  [ 30D30599C487D691BD705868F709E375 ] ApfiltrService  C:\Windows\system32\DRIVERS\Apfiltr.sys
07:34:57.0401 5372  ApfiltrService - ok
07:34:57.0448 5372  [ 89A69C3F2F319B43379399547526D952 ] AppID          C:\Windows\system32\drivers\appid.sys
07:34:57.0625 5372  AppID - ok
07:34:57.0672 5372  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
07:34:57.0743 5372  AppIDSvc - ok
07:34:57.0772 5372  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo        C:\Windows\System32\appinfo.dll
07:34:57.0830 5372  Appinfo - ok
07:34:57.0853 5372  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\drivers\arc.sys
07:34:57.0870 5372  arc - ok
07:34:57.0900 5372  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\drivers\arcsas.sys
07:34:57.0917 5372  arcsas - ok
07:34:58.0005 5372  [ 9217D874131AE6FF8F642F124F00A555 ] aspnet_state    C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
07:34:58.0032 5372  aspnet_state - ok
07:34:58.0062 5372  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
07:34:58.0135 5372  AsyncMac - ok
07:34:58.0165 5372  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\drivers\atapi.sys
07:34:58.0180 5372  atapi - ok
07:34:58.0232 5372  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
07:34:58.0317 5372  AudioEndpointBuilder - ok
07:34:58.0330 5372  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll
07:34:58.0397 5372  AudioSrv - ok
07:34:58.0452 5372  [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
07:34:58.0468 5372  avgntflt - ok
07:34:58.0497 5372  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
07:34:58.0517 5372  avipbb - ok
07:34:58.0547 5372  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
07:34:58.0563 5372  avkmgr - ok
07:34:58.0614 5372  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll
07:34:58.0665 5372  AxInstSV - ok
07:34:58.0711 5372  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\drivers\bxvbda.sys
07:34:58.0751 5372  b06bdrv - ok
07:34:58.0771 5372  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
07:34:58.0806 5372  b57nd60a - ok
07:34:58.0844 5372  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
07:34:58.0876 5372  BDESVC - ok
07:34:58.0894 5372  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
07:34:58.0955 5372  Beep - ok
07:34:59.0010 5372  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE            C:\Windows\System32\bfe.dll
07:34:59.0088 5372  BFE - ok
07:34:59.0126 5372  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll
07:34:59.0231 5372  BITS - ok
07:34:59.0270 5372  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\drivers\blbdrive.sys
07:34:59.0307 5372  blbdrive - ok
07:34:59.0397 5372  [ 05981C3E51D827ED6B8101A54B05E392 ] Bluetooth Device Monitor C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
07:34:59.0431 5372  Bluetooth Device Monitor - ok
07:34:59.0471 5372  [ BBFAF63BF768047FE2441B4139E803E3 ] Bluetooth Media Service C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
07:34:59.0513 5372  Bluetooth Media Service - ok
07:34:59.0568 5372  [ 41D8F56E6BBE0111244D87BE2FA90374 ] Bluetooth OBEX Service C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
07:34:59.0607 5372  Bluetooth OBEX Service - ok
07:34:59.0631 5372  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
07:34:59.0666 5372  bowser - ok
07:34:59.0707 5372  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\drivers\BrFiltLo.sys
07:34:59.0742 5372  BrFiltLo - ok
07:34:59.0747 5372  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\drivers\BrFiltUp.sys
07:34:59.0784 5372  BrFiltUp - ok
07:34:59.0831 5372  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser        C:\Windows\System32\browser.dll
07:34:59.0866 5372  Browser - ok
07:34:59.0881 5372  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
07:34:59.0924 5372  Brserid - ok
07:34:59.0944 5372  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
07:34:59.0986 5372  BrSerWdm - ok
07:34:59.0991 5372  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
07:35:00.0022 5372  BrUsbMdm - ok
07:35:00.0037 5372  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
07:35:00.0059 5372  BrUsbSer - ok
07:35:00.0104 5372  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum        C:\Windows\system32\drivers\BthEnum.sys
07:35:00.0142 5372  BthEnum - ok
07:35:00.0174 5372  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\drivers\bthmodem.sys
07:35:00.0211 5372  BTHMODEM - ok
07:35:00.0244 5372  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys
07:35:00.0265 5372  BthPan - ok
07:35:00.0314 5372  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT        C:\Windows\System32\Drivers\BTHport.sys
07:35:00.0362 5372  BTHPORT - ok
07:35:00.0407 5372  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
07:35:00.0489 5372  bthserv - ok
07:35:00.0512 5372  [ 588762F716C2B7A2054AFBC3D58E5C21 ] BTHSSecurityMgr C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
07:35:00.0524 5372  BTHSSecurityMgr - ok
07:35:00.0549 5372  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\System32\Drivers\BTHUSB.sys
07:35:00.0594 5372  BTHUSB - ok
07:35:00.0626 5372  [ 988CC6CC49303665D3B2435C51505C3F ] btmaux          C:\Windows\system32\DRIVERS\btmaux.sys
07:35:00.0657 5372  btmaux - ok
07:35:00.0688 5372  [ 2B4B508AFAC2A563931AF1FE875A5B16 ] btmhsf          C:\Windows\system32\DRIVERS\btmhsf.sys
07:35:00.0719 5372  btmhsf - ok
07:35:00.0750 5372  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
07:35:00.0797 5372  cdfs - ok
07:35:00.0844 5372  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
07:35:00.0891 5372  cdrom - ok
07:35:00.0922 5372  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc    C:\Windows\System32\certprop.dll
07:35:00.0984 5372  CertPropSvc - ok
07:35:01.0000 5372  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\drivers\circlass.sys
07:35:01.0047 5372  circlass - ok
07:35:01.0062 5372  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
07:35:01.0078 5372  CLFS - ok
07:35:01.0140 5372  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
07:35:01.0156 5372  clr_optimization_v2.0.50727_32 - ok
07:35:01.0187 5372  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
07:35:01.0203 5372  clr_optimization_v2.0.50727_64 - ok
07:35:01.0281 5372  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
07:35:01.0296 5372  clr_optimization_v4.0.30319_32 - ok
07:35:01.0312 5372  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
07:35:01.0328 5372  clr_optimization_v4.0.30319_64 - ok
07:35:01.0359 5372  clwvd - ok
07:35:01.0390 5372  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\drivers\CmBatt.sys
07:35:01.0421 5372  CmBatt - ok
07:35:01.0437 5372  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys
07:35:01.0452 5372  cmdide - ok
07:35:01.0499 5372  [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG            C:\Windows\system32\Drivers\cng.sys
07:35:01.0546 5372  CNG - ok
07:35:01.0593 5372  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\drivers\compbatt.sys
07:35:01.0608 5372  Compbatt - ok
07:35:01.0624 5372  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys
07:35:01.0655 5372  CompositeBus - ok
07:35:01.0671 5372  COMSysApp - ok
07:35:01.0749 5372  [ DD5EBBE0210A9F751F6692B200EBC2B0 ] cphs            C:\Windows\SysWow64\IntelCpHeciSvc.exe
07:35:01.0764 5372  cphs - ok
07:35:01.0796 5372  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\drivers\crcdisk.sys
07:35:01.0811 5372  crcdisk - ok
07:35:01.0874 5372  [ 4F5414602E2544A4554D95517948B705 ] CryptSvc        C:\Windows\system32\cryptsvc.dll
07:35:01.0920 5372  CryptSvc - ok
07:35:02.0014 5372  [ 72794D112CBAFF3BC0C29BF7350D4741 ] cvhsvc          C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
07:35:02.0045 5372  cvhsvc - ok
07:35:02.0108 5372  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll
07:35:02.0186 5372  DcomLaunch - ok
07:35:02.0232 5372  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
07:35:02.0310 5372  defragsvc - ok
07:35:02.0326 5372  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
07:35:02.0404 5372  DfsC - ok
07:35:02.0435 5372  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll
07:35:02.0529 5372  Dhcp - ok
07:35:02.0544 5372  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
07:35:02.0622 5372  discache - ok
07:35:02.0638 5372  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\drivers\disk.sys
07:35:02.0654 5372  Disk - ok
07:35:02.0685 5372  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll
07:35:02.0716 5372  Dnscache - ok
07:35:02.0732 5372  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc        C:\Windows\System32\dot3svc.dll
07:35:02.0810 5372  dot3svc - ok
07:35:02.0825 5372  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS            C:\Windows\system32\dps.dll
07:35:02.0903 5372  DPS - ok
07:35:02.0934 5372  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
07:35:02.0950 5372  drmkaud - ok
07:35:03.0028 5372  [ 2BF965A3B9A525587589EBB270B68263 ] DTSAudioSvc    C:\Program Files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe
07:35:03.0106 5372  DTSAudioSvc - ok
07:35:03.0153 5372  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
07:35:03.0184 5372  DXGKrnl - ok
07:35:03.0231 5372  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
07:35:03.0293 5372  EapHost - ok
07:35:03.0371 5372  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\drivers\evbda.sys
07:35:03.0465 5372  ebdrv - ok
07:35:03.0496 5372  [ C118A82CD78818C29AB228366EBF81C3 ] EFS            C:\Windows\System32\lsass.exe
07:35:03.0527 5372  EFS - ok
07:35:03.0574 5372  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
07:35:03.0621 5372  ehRecvr - ok
07:35:03.0636 5372  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
07:35:03.0668 5372  ehSched - ok
07:35:03.0714 5372  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\drivers\elxstor.sys
07:35:03.0746 5372  elxstor - ok
07:35:03.0761 5372  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys
07:35:03.0792 5372  ErrDev - ok
07:35:03.0839 5372  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
07:35:03.0917 5372  EventSystem - ok
07:35:03.0995 5372  [ 64D25284A4E9D11CA0722AF3F30FD970 ] EvtEng          C:\Program Files\Intel\WiFi\bin\EvtEng.exe
07:35:04.0011 5372  EvtEng - ok
07:35:04.0042 5372  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
07:35:04.0120 5372  exfat - ok
07:35:04.0136 5372  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
07:35:04.0198 5372  fastfat - ok
07:35:04.0245 5372  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax            C:\Windows\system32\fxssvc.exe
07:35:04.0292 5372  Fax - ok
07:35:04.0307 5372  [ 9955BF48FD2FA8D481848CD3024EDD0B ] FBIOSDRV        C:\Windows\system32\Drivers\FBIOSDRV.sys
07:35:04.0323 5372  FBIOSDRV - ok
07:35:04.0354 5372  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\drivers\fdc.sys
07:35:04.0385 5372  fdc - ok
07:35:04.0432 5372  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
07:35:04.0494 5372  fdPHost - ok
07:35:04.0510 5372  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
07:35:04.0572 5372  FDResPub - ok
07:35:04.0619 5372  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
07:35:04.0635 5372  FileInfo - ok
07:35:04.0650 5372  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
07:35:04.0713 5372  Filetrace - ok
07:35:04.0713 5372  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\drivers\flpydisk.sys
07:35:04.0744 5372  flpydisk - ok
07:35:04.0760 5372  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
07:35:04.0775 5372  FltMgr - ok
07:35:04.0822 5372  [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache      C:\Windows\system32\FntCache.dll
07:35:04.0884 5372  FontCache - ok
07:35:04.0931 5372  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
07:35:04.0931 5372  FontCache3.0.0.0 - ok
07:35:04.0962 5372  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
07:35:04.0978 5372  FsDepends - ok
07:35:05.0009 5372  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
07:35:05.0025 5372  Fs_Rec - ok
07:35:05.0056 5372  [ BA0C1FFDA496D8BCBCAC63F8D98D20E3 ] FUJ02B1        C:\Windows\system32\drivers\FUJ02B1.sys
07:35:05.0087 5372  FUJ02B1 - ok
07:35:05.0087 5372  [ 7135030CBF87D724B6037BB023923730 ] FUJ02E3        C:\Windows\system32\drivers\FUJ02E3.sys
07:35:05.0134 5372  FUJ02E3 - ok
07:35:05.0181 5372  [ C22CBEFB9CEDAD798F8EFB60D8E7D330 ] FUJ02E3Service  C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
07:35:05.0196 5372  FUJ02E3Service - ok
07:35:05.0228 5372  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
07:35:05.0259 5372  fvevol - ok
07:35:05.0274 5372  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\drivers\gagp30kx.sys
07:35:05.0306 5372  gagp30kx - ok
07:35:05.0352 5372  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc          C:\Windows\System32\gpsvc.dll
07:35:05.0430 5372  gpsvc - ok
07:35:05.0430 5372  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
07:35:05.0462 5372  hcw85cir - ok
07:35:05.0508 5372  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
07:35:05.0555 5372  HdAudAddService - ok
07:35:05.0586 5372  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys
07:35:05.0633 5372  HDAudBus - ok
07:35:05.0633 5372  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\drivers\HidBatt.sys
07:35:05.0664 5372  HidBatt - ok
07:35:05.0696 5372  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\drivers\hidbth.sys
07:35:05.0727 5372  HidBth - ok
07:35:05.0742 5372  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\drivers\hidir.sys
07:35:05.0758 5372  HidIr - ok
07:35:05.0774 5372  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
07:35:05.0852 5372  hidserv - ok
07:35:05.0898 5372  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
07:35:05.0914 5372  HidUsb - ok
07:35:05.0945 5372  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll
07:35:06.0023 5372  hkmsvc - ok
07:35:06.0039 5372  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll
07:35:06.0086 5372  HomeGroupListener - ok
07:35:06.0117 5372  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll
07:35:06.0148 5372  HomeGroupProvider - ok
07:35:06.0179 5372  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys
07:35:06.0195 5372  HpSAMD - ok
07:35:06.0242 5372  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
07:35:06.0320 5372  HTTP - ok
07:35:06.0335 5372  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
07:35:06.0351 5372  hwpolicy - ok
07:35:06.0413 5372  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
07:35:06.0429 5372  i8042prt - ok
07:35:06.0460 5372  [ C224331A54571C8C9162F7714400BBBD ] iaStor          C:\Windows\system32\drivers\iaStor.sys
07:35:06.0491 5372  iaStor - ok
07:35:06.0522 5372  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
07:35:06.0538 5372  iaStorV - ok
07:35:06.0585 5372  [ 9E3D44CE737388F6BBBB6DD4A1C1847C ] ibtfltcoex      C:\Windows\system32\DRIVERS\iBtFltCoex.sys
07:35:06.0600 5372  ibtfltcoex - ok
07:35:06.0663 5372  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
07:35:06.0694 5372  idsvc - ok
07:35:07.0022 5372  [ 11BA677667432A99CA261A472A2C29B8 ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
07:35:07.0536 5372  igfx - ok
07:35:07.0568 5372  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\drivers\iirsp.sys
07:35:07.0583 5372  iirsp - ok
07:35:07.0630 5372  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll
07:35:07.0708 5372  IKEEXT - ok
07:35:07.0848 5372  [ 150AC23F21DBDBF8488408BA944B0D65 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
07:35:07.0989 5372  IntcAzAudAddService - ok
07:35:08.0036 5372  [ 6C9FFFECA9FED31347D211C5D1FFBD2D ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
07:35:08.0082 5372  IntcDAud - ok
07:35:08.0160 5372  [ 2D66067C7A8A0112156BCD1C0BAA7042 ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe
07:35:08.0176 5372  Intel(R) Capability Licensing Service Interface - ok
07:35:08.0207 5372  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys
07:35:08.0223 5372  intelide - ok
07:35:08.0238 5372  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
07:35:08.0270 5372  intelppm - ok
07:35:08.0301 5372  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
07:35:08.0379 5372  IPBusEnum - ok
07:35:08.0410 5372  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
07:35:08.0472 5372  IpFilterDriver - ok
07:35:08.0519 5372  [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
07:35:08.0613 5372  iphlpsvc - ok
07:35:08.0628 5372  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV        C:\Windows\system32\drivers\IPMIDrv.sys
07:35:08.0660 5372  IPMIDRV - ok
07:35:08.0660 5372  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
07:35:08.0722 5372  IPNAT - ok
07:35:08.0753 5372  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
07:35:08.0784 5372  IRENUM - ok
07:35:08.0784 5372  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys
07:35:08.0800 5372  isapnp - ok
07:35:08.0831 5372  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys
07:35:08.0847 5372  iScsiPrt - ok
07:35:08.0862 5372  [ 6BCEF45131C8B8E1C558BE540B190B3C ] iusb3hcs        C:\Windows\system32\drivers\iusb3hcs.sys
07:35:08.0878 5372  iusb3hcs - ok
07:35:08.0909 5372  [ F080EADA8715F811B58BD35BB774F2F9 ] iusb3hub        C:\Windows\system32\DRIVERS\iusb3hub.sys
07:35:08.0925 5372  iusb3hub - ok
07:35:08.0956 5372  [ 0F1756D9396740F053221FA6260FCE66 ] iusb3xhc        C:\Windows\system32\drivers\iusb3xhc.sys
07:35:08.0987 5372  iusb3xhc - ok
07:35:09.0065 5372  [ 3628933AF5305EAB8173949BFF912F04 ] jhi_service    C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
07:35:09.0081 5372  jhi_service - ok
07:35:09.0128 5372  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
07:35:09.0143 5372  kbdclass - ok
07:35:09.0159 5372  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
07:35:09.0206 5372  kbdhid - ok
07:35:09.0237 5372  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe
07:35:09.0252 5372  KeyIso - ok
07:35:09.0284 5372  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
07:35:09.0299 5372  KSecDD - ok
07:35:09.0315 5372  [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
07:35:09.0330 5372  KSecPkg - ok
07:35:09.0362 5372  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
07:35:09.0424 5372  ksthunk - ok
07:35:09.0455 5372  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
07:35:09.0533 5372  KtmRm - ok
07:35:09.0596 5372  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll
07:35:09.0658 5372  LanmanServer - ok
07:35:09.0689 5372  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
07:35:09.0752 5372  LanmanWorkstation - ok
07:35:09.0798 5372  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
07:35:09.0861 5372  lltdio - ok
07:35:09.0908 5372  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
07:35:09.0970 5372  lltdsvc - ok
07:35:10.0001 5372  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
07:35:10.0064 5372  lmhosts - ok
07:35:10.0095 5372  [ BF22ACF4CF3734D61357E67F0521BC03 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
07:35:10.0126 5372  LMS - ok
07:35:10.0173 5372  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\drivers\lsi_fc.sys
07:35:10.0188 5372  LSI_FC - ok
07:35:10.0204 5372  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\drivers\lsi_sas.sys
07:35:10.0220 5372  LSI_SAS - ok
07:35:10.0235 5372  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\drivers\lsi_sas2.sys
07:35:10.0251 5372  LSI_SAS2 - ok
07:35:10.0266 5372  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\drivers\lsi_scsi.sys
07:35:10.0298 5372  LSI_SCSI - ok
07:35:10.0313 5372  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
07:35:10.0376 5372  luafv - ok
07:35:10.0422 5372  [ 922CBAC7B992B9614CAB7122F4BF9406 ] ManyCam        C:\Windows\system32\DRIVERS\mcvidrv_x64.sys
07:35:10.0454 5372  ManyCam - ok
07:35:10.0516 5372  [ B9FC4CCE5758B816F27DD4D1EED11841 ] MBAMProtector  C:\Windows\system32\drivers\mbam.sys
07:35:10.0532 5372  MBAMProtector - ok
07:35:10.0578 5372  [ 0DCF16B1449811EFA47AB52CAC84093C ] MBAMScheduler  C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
07:35:10.0610 5372  MBAMScheduler - ok
07:35:10.0656 5372  [ 9EAABA4D601004BEA4DAA6E146E19A96 ] MBAMService    C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
07:35:10.0688 5372  MBAMService - ok
07:35:10.0703 5372  [ 34A42DD7CF525D0D2C5232916496E4B8 ] mcaudrv_simple  C:\Windows\system32\drivers\mcaudrv_x64.sys
07:35:10.0750 5372  mcaudrv_simple - ok
07:35:10.0781 5372  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
07:35:10.0812 5372  Mcx2Svc - ok
07:35:10.0828 5372  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\drivers\megasas.sys
07:35:10.0844 5372  megasas - ok
07:35:10.0875 5372  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\drivers\MegaSR.sys
07:35:10.0890 5372  MegaSR - ok
07:35:10.0922 5372  [ 6B01B7414A105B9E51652089A03027CF ] MEIx64          C:\Windows\system32\DRIVERS\HECIx64.sys
07:35:10.0937 5372  MEIx64 - ok
07:35:10.0984 5372  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
07:35:11.0046 5372  MMCSS - ok
07:35:11.0062 5372  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
07:35:11.0124 5372  Modem - ok
07:35:11.0156 5372  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
07:35:11.0187 5372  monitor - ok
07:35:11.0218 5372  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
07:35:11.0234 5372  mouclass - ok
07:35:11.0265 5372  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
07:35:11.0296 5372  mouhid - ok
07:35:11.0327 5372  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
07:35:11.0343 5372  mountmgr - ok
07:35:11.0374 5372  [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
07:35:11.0390 5372  MozillaMaintenance - ok
07:35:11.0421 5372  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys
07:35:11.0436 5372  mpio - ok
07:35:11.0452 5372  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
07:35:11.0530 5372  mpsdrv - ok
07:35:11.0561 5372  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll
07:35:11.0639 5372  MpsSvc - ok
07:35:11.0670 5372  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
07:35:11.0717 5372  MRxDAV - ok
07:35:11.0733 5372  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
07:35:11.0780 5372  mrxsmb - ok
07:35:11.0795 5372  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
07:35:11.0811 5372  mrxsmb10 - ok
07:35:11.0842 5372  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
07:35:11.0873 5372  mrxsmb20 - ok
07:35:11.0889 5372  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys
07:35:11.0904 5372  msahci - ok
07:35:11.0920 5372  [ DB801A638D011B9633829EB6F663C900 ] msdsm          C:\Windows\system32\drivers\msdsm.sys
07:35:11.0936 5372  msdsm - ok
07:35:11.0951 5372  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
07:35:11.0998 5372  MSDTC - ok
07:35:12.0014 5372  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
07:35:12.0092 5372  Msfs - ok
07:35:12.0123 5372  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
07:35:12.0201 5372  mshidkmdf - ok
07:35:12.0216 5372  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys
07:35:12.0232 5372  msisadrv - ok
07:35:12.0263 5372  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
07:35:12.0341 5372  MSiSCSI - ok
07:35:12.0341 5372  msiserver - ok
07:35:12.0372 5372  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
07:35:12.0435 5372  MSKSSRV - ok
07:35:12.0466 5372  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
07:35:12.0513 5372  MSPCLOCK - ok
07:35:12.0528 5372  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
07:35:12.0591 5372  MSPQM - ok
07:35:12.0606 5372  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
07:35:12.0638 5372  MsRPC - ok
07:35:12.0653 5372  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys
07:35:12.0669 5372  mssmbios - ok
07:35:12.0716 5372  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
07:35:12.0778 5372  MSTEE - ok
07:35:12.0778 5372  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\drivers\MTConfig.sys
07:35:12.0809 5372  MTConfig - ok
07:35:12.0825 5372  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
07:35:12.0840 5372  Mup - ok
07:35:12.0887 5372  [ E3B58E3011B207C5289D11173B30E298 ] MyWiFiDHCPDNS  C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe
07:35:12.0903 5372  MyWiFiDHCPDNS - ok
07:35:12.0934 5372  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll
07:35:13.0012 5372  napagent - ok
07:35:13.0059 5372  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
07:35:13.0106 5372  NativeWifiP - ok
07:35:13.0152 5372  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys
07:35:13.0199 5372  NDIS - ok
07:35:13.0215 5372  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
07:35:13.0277 5372  NdisCap - ok
07:35:13.0324 5372  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
07:35:13.0386 5372  NdisTapi - ok
07:35:13.0402 5372  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
07:35:13.0480 5372  Ndisuio - ok
07:35:13.0496 5372  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
07:35:13.0558 5372  NdisWan - ok
07:35:13.0589 5372  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
07:35:13.0652 5372  NDProxy - ok
07:35:13.0698 5372  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
07:35:13.0761 5372  NetBIOS - ok
07:35:13.0776 5372  [ 09594D1089C523423B32A4229263F068 ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
07:35:13.0854 5372  NetBT - ok
07:35:13.0870 5372  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe
07:35:13.0901 5372  Netlogon - ok
07:35:13.0932 5372  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
07:35:14.0010 5372  Netman - ok
07:35:14.0073 5372  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetMsmqActivator C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
07:35:14.0088 5372  NetMsmqActivator - ok
07:35:14.0104 5372  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetPipeActivator C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
07:35:14.0120 5372  NetPipeActivator - ok
07:35:14.0151 5372  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
07:35:14.0213 5372  netprofm - ok
07:35:14.0229 5372  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpActivator C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
07:35:14.0244 5372  NetTcpActivator - ok
07:35:14.0244 5372  [ D22CD77D4F0D63D1169BB35911BFF12D ] NetTcpPortSharing C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\SMSvcHost.exe
07:35:14.0260 5372  NetTcpPortSharing - ok
07:35:14.0541 5372  [ B51E9AD4F4E4F8DBE0AB882756BC5DAB ] NETwNs64        C:\Windows\system32\DRIVERS\NETwNs64.sys
07:35:14.0978 5372  NETwNs64 - ok
07:35:15.0040 5372  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\drivers\nfrd960.sys
07:35:15.0056 5372  nfrd960 - ok
07:35:15.0087 5372  [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc          C:\Windows\System32\nlasvc.dll
07:35:15.0165 5372  NlaSvc - ok
07:35:15.0180 5372  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
07:35:15.0258 5372  Npfs - ok
07:35:15.0274 5372  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
07:35:15.0352 5372  nsi - ok
07:35:15.0368 5372  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
07:35:15.0430 5372  nsiproxy - ok
07:35:15.0492 5372  [ A2F74975097F52A00745F9637451FDD8 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
07:35:15.0555 5372  Ntfs - ok
07:35:15.0570 5372  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
07:35:15.0633 5372  Null - ok
07:35:15.0992 5372  [ 67428BB28210D22743CC5B3C032CBC57 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
07:35:16.0350 5372  nvlddmkm - ok
07:35:16.0397 5372  [ 2AFE430C06494691DD97CBB20A982544 ] nvpciflt        C:\Windows\system32\DRIVERS\nvpciflt.sys
07:35:16.0397 5372  nvpciflt - ok
07:35:16.0444 5372  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys
07:35:16.0460 5372  nvraid - ok
07:35:16.0475 5372  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys
07:35:16.0491 5372  nvstor - ok
07:35:16.0538 5372  [ D594841129E5902A67430C01F59EB20C ] nvsvc          C:\Windows\system32\nvvsvc.exe
07:35:16.0569 5372  nvsvc - ok
07:35:16.0584 5372  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys
07:35:16.0616 5372  nv_agp - ok
07:35:16.0616 5372  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys
07:35:16.0647 5372  ohci1394 - ok
07:35:16.0694 5372  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
07:35:16.0709 5372  ose - ok
07:35:16.0865 5372  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
07:35:17.0037 5372  osppsvc - ok
07:35:17.0068 5372  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
07:35:17.0099 5372  p2pimsvc - ok
07:35:17.0146 5372  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
07:35:17.0177 5372  p2psvc - ok
07:35:17.0208 5372  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\drivers\parport.sys
07:35:17.0240 5372  Parport - ok
07:35:17.0271 5372  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr        C:\Windows\system32\drivers\partmgr.sys
07:35:17.0286 5372  partmgr - ok
07:35:17.0318 5372  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
07:35:17.0349 5372  PcaSvc - ok
07:35:17.0380 5372  [ B26E102E0F54773119B162F56C9DD994 ] pci            C:\Windows\system32\drivers\pci.sys
07:35:17.0396 5372  pci - ok
07:35:17.0411 5372  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys
07:35:17.0427 5372  pciide - ok
07:35:17.0442 5372  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\drivers\pcmcia.sys
07:35:17.0474 5372  pcmcia - ok
07:35:17.0474 5372  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
07:35:17.0505 5372  pcw - ok
07:35:17.0520 5372  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
07:35:17.0598 5372  PEAUTH - ok
07:35:17.0661 5372  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
07:35:17.0692 5372  PerfHost - ok
07:35:17.0801 5372  [ BC7ED522BDAA0C635925B3E674B18F70 ] PFNService      C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe
07:35:17.0879 5372  PFNService ( UnsignedFile.Multi.Generic ) - warning
07:35:17.0879 5372  PFNService - detected UnsignedFile.Multi.Generic (1)
07:35:17.0942 5372  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla            C:\Windows\system32\pla.dll
07:35:18.0035 5372  pla - ok
07:35:18.0098 5372  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
07:35:18.0129 5372  PlugPlay - ok
07:35:18.0160 5372  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
07:35:18.0191 5372  PNRPAutoReg - ok
07:35:18.0207 5372  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
07:35:18.0238 5372  PNRPsvc - ok
07:35:18.0269 5372  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
07:35:18.0347 5372  PolicyAgent - ok
07:35:18.0394 5372  [ A2CCA4FB273E6050F17A0A416CFF2FCD ] Power          C:\Windows\system32\umpo.dll
07:35:18.0425 5372  Power - ok
07:35:18.0488 5372  [ C90FED91A08D7D1D71E52DBDCF4D1318 ] PowerSavingUtilityService C:\Program Files\Fujitsu\PSUtility\PSUService.exe
07:35:18.0503 5372  PowerSavingUtilityService - ok
07:35:18.0550 5372  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
07:35:18.0612 5372  PptpMiniport - ok
07:35:18.0628 5372  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\drivers\processr.sys
07:35:18.0659 5372  Processor - ok
07:35:18.0690 5372  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc        C:\Windows\system32\profsvc.dll
07:35:18.0706 5372  ProfSvc - ok
07:35:18.0737 5372  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe
07:35:18.0753 5372  ProtectedStorage - ok
07:35:18.0784 5372  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
07:35:18.0846 5372  Psched - ok
07:35:18.0893 5372  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\drivers\ql2300.sys
07:35:18.0956 5372  ql2300 - ok
07:35:18.0987 5372  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\drivers\ql40xx.sys
07:35:19.0002 5372  ql40xx - ok
07:35:19.0034 5372  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
07:35:19.0065 5372  QWAVE - ok
07:35:19.0080 5372  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
07:35:19.0127 5372  QWAVEdrv - ok
07:35:19.0127 5372  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
07:35:19.0174 5372  RasAcd - ok
07:35:19.0221 5372  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
07:35:19.0268 5372  RasAgileVpn - ok
07:35:19.0299 5372  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
07:35:19.0377 5372  RasAuto - ok
07:35:19.0408 5372  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
07:35:19.0470 5372  Rasl2tp - ok
07:35:19.0517 5372  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll
07:35:19.0580 5372  RasMan - ok
07:35:19.0611 5372  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
07:35:19.0673 5372  RasPppoe - ok
07:35:19.0689 5372  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
07:35:19.0767 5372  RasSstp - ok
07:35:19.0782 5372  [ 77F665941019A1594D887A74F301FA2F ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
07:35:19.0860 5372  rdbss - ok
07:35:19.0860 5372  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\drivers\rdpbus.sys
07:35:19.0907 5372  rdpbus - ok
07:35:19.0923 5372  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
07:35:19.0985 5372  RDPCDD - ok
07:35:20.0016 5372  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
07:35:20.0079 5372  RDPENCDD - ok
07:35:20.0079 5372  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
07:35:20.0141 5372  RDPREFMP - ok
07:35:20.0172 5372  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
07:35:20.0204 5372  RDPWD - ok
07:35:20.0235 5372  [ A115F49BEA840A5F049BC6310F35F776 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
07:35:20.0250 5372  rdyboost - ok
07:35:20.0282 5372  [ F3AF2B43F35DBB3A0EB9FEEEC7D62217 ] RegSrvc        C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
07:35:20.0297 5372  RegSrvc - ok
07:35:20.0313 5372  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
07:35:20.0375 5372  RemoteAccess - ok
07:35:20.0422 5372  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
07:35:20.0484 5372  RemoteRegistry - ok
07:35:20.0531 5372  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys
07:35:20.0562 5372  RFCOMM - ok
07:35:20.0594 5372  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
07:35:20.0640 5372  RpcEptMapper - ok
07:35:20.0672 5372  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
07:35:20.0703 5372  RpcLocator - ok
07:35:20.0734 5372  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs          C:\Windows\system32\rpcss.dll
07:35:20.0796 5372  RpcSs - ok
07:35:20.0828 5372  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
07:35:20.0906 5372  rspndr - ok
07:35:20.0937 5372  [ BC5A633C5FAF056193746C1D5D95B4F2 ] RSUSBSTOR      C:\Windows\System32\Drivers\RtsUStor.sys
07:35:20.0968 5372  RSUSBSTOR - ok
07:35:20.0999 5372  [ 7F4F11527AF5A7E4526CB6A146B3E40C ] RTL8167        C:\Windows\system32\DRIVERS\Rt64win7.sys
07:35:21.0030 5372  RTL8167 - ok
07:35:21.0046 5372  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs          C:\Windows\system32\lsass.exe
07:35:21.0062 5372  SamSs - ok
07:35:21.0077 5372  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys
07:35:21.0093 5372  sbp2port - ok
07:35:21.0202 5372  [ 794D4B48DFB6E999537C7C3947863463 ] SBSDWSCService  C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
07:35:21.0249 5372  SBSDWSCService - ok
07:35:21.0280 5372  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
07:35:21.0358 5372  SCardSvr - ok
07:35:21.0358 5372  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
07:35:21.0420 5372  scfilter - ok
07:35:21.0452 5372  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll
07:35:21.0530 5372  Schedule - ok
07:35:21.0561 5372  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc    C:\Windows\System32\certprop.dll
07:35:21.0623 5372  SCPolicySvc - ok
07:35:21.0654 5372  [ 111E0EBC0AD79CB0FA014B907B231CF0 ] sdbus          C:\Windows\system32\DRIVERS\sdbus.sys
07:35:21.0686 5372  sdbus - ok
07:35:21.0717 5372  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
07:35:21.0748 5372  SDRSVC - ok
07:35:21.0779 5372  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
07:35:21.0842 5372  secdrv - ok
07:35:21.0857 5372  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll
07:35:21.0935 5372  seclogon - ok
07:35:21.0966 5372  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
07:35:22.0029 5372  SENS - ok
07:35:22.0044 5372  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
07:35:22.0091 5372  SensrSvc - ok
07:35:22.0107 5372  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\drivers\serenum.sys
07:35:22.0138 5372  Serenum - ok
07:35:22.0169 5372  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\drivers\serial.sys
07:35:22.0216 5372  Serial - ok
07:35:22.0232 5372  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\drivers\sermouse.sys
07:35:22.0263 5372  sermouse - ok
07:35:22.0294 5372  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll
07:35:22.0372 5372  SessionEnv - ok
07:35:22.0388 5372  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\drivers\sffdisk.sys
07:35:22.0419 5372  sffdisk - ok
07:35:22.0419 5372  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys
07:35:22.0450 5372  sffp_mmc - ok
07:35:22.0450 5372  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd        C:\Windows\system32\drivers\sffp_sd.sys
07:35:22.0481 5372  sffp_sd - ok
07:35:22.0497 5372  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\drivers\sfloppy.sys
07:35:22.0528 5372  sfloppy - ok
07:35:22.0575 5372  [ C6CC9297BD53E5229653303E556AA539 ] Sftfs          C:\Windows\system32\DRIVERS\Sftfslh.sys
07:35:22.0606 5372  Sftfs - ok
07:35:22.0668 5372  [ 13693B6354DD6E72DC5131DA7D764B90 ] sftlist        C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
07:35:22.0700 5372  sftlist - ok
07:35:22.0715 5372  [ 390AA7BC52CEE43F6790CDEA1E776703 ] Sftplay        C:\Windows\system32\DRIVERS\Sftplaylh.sys
07:35:22.0746 5372  Sftplay - ok
07:35:22.0762 5372  [ 617E29A0B0A2807466560D4C4E338D3E ] Sftredir        C:\Windows\system32\DRIVERS\Sftredirlh.sys
07:35:22.0762 5372  Sftredir - ok
07:35:22.0793 5372  [ 8F571F016FA1976F445147E9E6C8AE9B ] Sftvol          C:\Windows\system32\DRIVERS\Sftvollh.sys
07:35:22.0809 5372  Sftvol - ok
07:35:22.0840 5372  [ C3CDDD18F43D44AB713CF8C4916F7696 ] sftvsa          C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
07:35:22.0856 5372  sftvsa - ok
07:35:22.0887 5372  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
07:35:22.0965 5372  SharedAccess - ok
07:35:22.0996 5372  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll
07:35:23.0074 5372  ShellHWDetection - ok
07:35:23.0121 5372  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\drivers\SiSRaid2.sys
07:35:23.0136 5372  SiSRaid2 - ok
07:35:23.0152 5372  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\drivers\sisraid4.sys
07:35:23.0168 5372  SiSRaid4 - ok
07:35:23.0199 5372  [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
07:35:23.0214 5372  SkypeUpdate - ok
07:35:23.0246 5372  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
07:35:23.0308 5372  Smb - ok
07:35:23.0355 5372  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
07:35:23.0370 5372  SNMPTRAP - ok
07:35:23.0386 5372  SNP2UVC - ok
07:35:23.0402 5372  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
07:35:23.0417 5372  spldr - ok
07:35:23.0448 5372  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler        C:\Windows\System32\spoolsv.exe
07:35:23.0495 5372  Spooler - ok
07:35:23.0589 5372  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe
07:35:23.0729 5372  sppsvc - ok
07:35:23.0745 5372  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
07:35:23.0823 5372  sppuinotify - ok
07:35:23.0854 5372  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv            C:\Windows\system32\DRIVERS\srv.sys
07:35:23.0916 5372  srv - ok
07:35:23.0932 5372  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
07:35:23.0979 5372  srv2 - ok
07:35:24.0010 5372  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
07:35:24.0026 5372  srvnet - ok
07:35:24.0072 5372  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
07:35:24.0135 5372  SSDPSRV - ok
07:35:24.0150 5372  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
07:35:24.0213 5372  SstpSvc - ok
07:35:24.0275 5372  [ 2B3667CB7708F78E72583422618A17A5 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
07:35:24.0291 5372  Stereo Service - ok
07:35:24.0306 5372  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\drivers\stexstor.sys
07:35:24.0322 5372  stexstor - ok
07:35:24.0369 5372  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll
07:35:24.0416 5372  stisvc - ok
07:35:24.0447 5372  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys
07:35:24.0462 5372  swenum - ok
07:35:24.0509 5372  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
07:35:24.0587 5372  swprv - ok
07:35:24.0634 5372  [ 7BE4CDEA6BC7832BFE3112A350D8B9EA ] SysMain        C:\Windows\system32\sysmain.dll
07:35:24.0696 5372  SysMain - ok
07:35:24.0743 5372  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll
07:35:24.0774 5372  TabletInputService - ok
07:35:24.0774 5372  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv        C:\Windows\System32\tapisrv.dll
07:35:24.0852 5372  TapiSrv - ok
07:35:24.0868 5372  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
07:35:24.0930 5372  TBS - ok
07:35:24.0977 5372  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
07:35:25.0055 5372  Tcpip - ok
07:35:25.0086 5372  [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
07:35:25.0149 5372  TCPIP6 - ok
07:35:25.0180 5372  [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
07:35:25.0258 5372  tcpipreg - ok
07:35:25.0274 5372  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
07:35:25.0289 5372  TDPIPE - ok
07:35:25.0320 5372  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
07:35:25.0336 5372  TDTCP - ok
07:35:25.0383 5372  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
07:35:25.0445 5372  tdx - ok
07:35:25.0461 5372  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys
07:35:25.0476 5372  TermDD - ok
07:35:25.0508 5372  [ 2E648163254233755035B46DD7B89123 ] TermService    C:\Windows\System32\termsrv.dll
07:35:25.0601 5372  TermService - ok
07:35:25.0617 5372  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
07:35:25.0664 5372  Themes - ok
07:35:25.0695 5372  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
07:35:25.0742 5372  THREADORDER - ok
07:35:25.0773 5372  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
07:35:25.0851 5372  TrkWks - ok
07:35:25.0898 5372  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
07:35:25.0976 5372  TrustedInstaller - ok
07:35:25.0991 5372  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
07:35:26.0054 5372  tssecsrv - ok
07:35:26.0069 5372  [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys
07:35:26.0116 5372  TsUsbFlt - ok
07:35:26.0116 5372  [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD        C:\Windows\system32\drivers\TsUsbGD.sys
07:35:26.0132 5372  TsUsbGD - ok
07:35:26.0163 5372  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
07:35:26.0225 5372  tunnel - ok
07:35:26.0241 5372  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\drivers\uagp35.sys
07:35:26.0256 5372  uagp35 - ok
07:35:26.0272 5372  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
07:35:26.0350 5372  udfs - ok
07:35:26.0381 5372  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
07:35:26.0412 5372  UI0Detect - ok
07:35:26.0428 5372  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys
07:35:26.0444 5372  uliagpkx - ok
07:35:26.0475 5372  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
07:35:26.0506 5372  umbus - ok
07:35:26.0537 5372  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\drivers\umpass.sys
07:35:26.0568 5372  UmPass - ok
07:35:26.0662 5372  [ B097EBA0E3FEB020BB65FE43AF5ECCFF ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
07:35:26.0693 5372  UNS - ok
07:35:26.0724 5372  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
07:35:26.0787 5372  upnphost - ok
07:35:26.0818 5372  [ 6CC0985C3BB5931F73FF0846E06A9483 ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
07:35:26.0849 5372  usbccgp - ok
07:35:26.0880 5372  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys
07:35:26.0927 5372  usbcir - ok
07:35:26.0943 5372  [ 6B3D5E6A9DA786EC755B00BC180C700B ] usbehci        C:\Windows\system32\drivers\usbehci.sys
07:35:26.0958 5372  usbehci - ok
07:35:26.0974 5372  [ 5A15C8D6A898D39E9171B437FF2326E0 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
07:35:27.0005 5372  usbhub - ok
07:35:27.0052 5372  [ 660B2C08CE7103E71EAA26F85B0B0A56 ] usbohci        C:\Windows\system32\drivers\usbohci.sys
07:35:27.0083 5372  usbohci - ok
07:35:27.0114 5372  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
07:35:27.0146 5372  usbprint - ok
07:35:27.0161 5372  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
07:35:27.0208 5372  USBSTOR - ok
07:35:27.0239 5372  [ 1529632FC96032D337B298F8A285D640 ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
07:35:27.0255 5372  usbuhci - ok
07:35:27.0364 5372  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\system32\Drivers\usbvideo.sys
07:35:27.0426 5372  usbvideo - ok
07:35:27.0458 5372  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
07:35:27.0520 5372  UxSms - ok
07:35:27.0551 5372  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe
07:35:27.0567 5372  VaultSvc - ok
07:35:27.0582 5372  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys
07:35:27.0598 5372  vdrvroot - ok
07:35:27.0629 5372  [ 8D6B481601D01A456E75C3210F1830BE ] vds            C:\Windows\System32\vds.exe
07:35:27.0707 5372  vds - ok
07:35:27.0738 5372  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
07:35:27.0754 5372  vga - ok
07:35:27.0770 5372  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
07:35:27.0832 5372  VgaSave - ok
07:35:27.0848 5372  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp          C:\Windows\system32\drivers\vhdmp.sys
07:35:27.0863 5372  vhdmp - ok
07:35:27.0879 5372  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys
07:35:27.0894 5372  viaide - ok
07:35:27.0910 5372  [ 071E1B172D49154EE1D23A2ACC472EFB ] volmgr          C:\Windows\system32\drivers\volmgr.sys
07:35:27.0926 5372  volmgr - ok
07:35:27.0957 5372  [ A255814907C89BE58B79EF2F189B843B ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
07:35:27.0988 5372  volmgrx - ok
07:35:28.0004 5372  [ DF8126BD41180351A093A3AD2FC8903B ] volsnap        C:\Windows\system32\drivers\volsnap.sys
07:35:28.0019 5372  volsnap - ok
07:35:28.0050 5372  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\drivers\vsmraid.sys
07:35:28.0066 5372  vsmraid - ok
07:35:28.0113 5372  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS            C:\Windows\system32\vssvc.exe
07:35:28.0222 5372  VSS - ok
07:35:28.0238 5372  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
07:35:28.0269 5372  vwifibus - ok
07:35:28.0284 5372  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
07:35:28.0316 5372  vwififlt - ok
07:35:28.0362 5372  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
07:35:28.0378 5372  vwifimp - ok
07:35:28.0409 5372  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
07:35:28.0472 5372  W32Time - ok
07:35:28.0503 5372  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\drivers\wacompen.sys
07:35:28.0534 5372  WacomPen - ok
07:35:28.0565 5372  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
07:35:28.0612 5372  WANARP - ok
07:35:28.0628 5372  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
07:35:28.0674 5372  Wanarpv6 - ok
07:35:28.0737 5372  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe
07:35:28.0799 5372  wbengine - ok
07:35:28.0830 5372  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
07:35:28.0862 5372  WbioSrvc - ok
07:35:28.0893 5372  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc        C:\Windows\System32\wcncsvc.dll
07:35:28.0940 5372  wcncsvc - ok
07:35:28.0971 5372  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
07:35:28.0986 5372  WcsPlugInService - ok
07:35:29.0002 5372  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\drivers\wd.sys
07:35:29.0033 5372  Wd - ok
07:35:29.0049 5372  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
07:35:29.0080 5372  Wdf01000 - ok
07:35:29.0111 5372  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
07:35:29.0142 5372  WdiServiceHost - ok
07:35:29.0158 5372  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
07:35:29.0174 5372  WdiSystemHost - ok
07:35:29.0205 5372  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient      C:\Windows\System32\webclnt.dll
07:35:29.0252 5372  WebClient - ok
07:35:29.0267 5372  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
07:35:29.0330 5372  Wecsvc - ok
07:35:29.0345 5372  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
07:35:29.0408 5372  wercplsupport - ok
07:35:29.0454 5372  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
07:35:29.0501 5372  WerSvc - ok
07:35:29.0532 5372  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
07:35:29.0595 5372  WfpLwf - ok
07:35:29.0610 5372  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
07:35:29.0626 5372  WIMMount - ok
07:35:29.0642 5372  WinDefend - ok
07:35:29.0657 5372  WinHttpAutoProxySvc - ok
07:35:29.0720 5372  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
07:35:29.0782 5372  Winmgmt - ok
07:35:29.0860 5372  [ BCB1310604AA415C4508708975B3931E ] WinRM          C:\Windows\system32\WsmSvc.dll
07:35:29.0954 5372  WinRM - ok
07:35:30.0016 5372  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
07:35:30.0047 5372  WinUsb - ok
07:35:30.0094 5372  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
07:35:30.0141 5372  Wlansvc - ok
07:35:30.0234 5372  [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
07:35:30.0312 5372  wlidsvc - ok
07:35:30.0328 5372  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\drivers\wmiacpi.sys
07:35:30.0359 5372  WmiAcpi - ok
07:35:30.0390 5372  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
07:35:30.0422 5372  wmiApSrv - ok
07:35:30.0453 5372  WMPNetworkSvc - ok
07:35:30.0500 5372  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
07:35:30.0515 5372  WPCSvc - ok
07:35:30.0546 5372  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
07:35:30.0578 5372  WPDBusEnum - ok
07:35:30.0593 5372  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
07:35:30.0656 5372  ws2ifsl - ok
07:35:30.0671 5372  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll
07:35:30.0702 5372  wscsvc - ok
07:35:30.0718 5372  WSearch - ok
07:35:30.0796 5372  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
07:35:30.0890 5372  wuauserv - ok
07:35:30.0905 5372  [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
07:35:30.0968 5372  WudfPf - ok
07:35:30.0983 5372  [ CF8D590BE3373029D57AF80914190682 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
07:35:31.0061 5372  WUDFRd - ok
07:35:31.0077 5372  [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
07:35:31.0139 5372  wudfsvc - ok
07:35:31.0155 5372  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
07:35:31.0202 5372  WwanSvc - ok
07:35:31.0233 5372  [ B3EEACF62445E24FBB2CD4B0FB4DB026 ] yukonw7        C:\Windows\system32\DRIVERS\yk62x64.sys
07:35:31.0280 5372  yukonw7 - ok
07:35:31.0342 5372  [ 74713CB32792F9C7632DAA7DA22CA974 ] ZeroConfigService C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
07:35:31.0373 5372  ZeroConfigService - ok
07:35:31.0404 5372  ================ Scan global ===============================
07:35:31.0436 5372  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
07:35:31.0467 5372  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
07:35:31.0482 5372  [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll
07:35:31.0498 5372  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
07:35:31.0529 5372  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
07:35:31.0545 5372  [Global] - ok
07:35:31.0545 5372  ================ Scan MBR ==================================
07:35:31.0560 5372  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0
07:35:32.0543 5372  \Device\Harddisk0\DR0 - ok
07:35:32.0543 5372  ================ Scan VBR ==================================
07:35:32.0559 5372  [ 65F937FACF852F5E3A3FA53425E66B69 ] \Device\Harddisk0\DR0\Partition1
07:35:32.0559 5372  \Device\Harddisk0\DR0\Partition1 - ok
07:35:32.0559 5372  ============================================================
07:35:32.0559 5372  Scan finished
07:35:32.0559 5372  ============================================================
07:35:32.0574 5764  Detected object count: 1
07:35:32.0574 5764  Actual detected object count: 1
07:36:16.0800 5764  PFNService ( UnsignedFile.Multi.Generic ) - skipped by user
07:36:16.0800 5764  PFNService ( UnsignedFile.Multi.Generic ) - User select action: Skip
Nein, natürlich wäre das unübersichtlich. Nur da ich die Art des Problems so gut wie nicht verstehe, kann ich auch nicht beurteilen, ob der PC von meinem Mann "behandelt" werden sollte wenn das Problem nicht mehr aufgetaucht ist. Und ob es durch ein Heimnetzwerk verteilbar ist? Nur darin wollte ich deine Einschätzung.

Ich hab jetzt beim surfen wieder gesehn, dass im Firefox Browser unten links wo die urls durchrattern "Übertragen der Daten von searchvhb.com..." bei fast jeder neu geöffneten Seite dabei ist. Zwei mal was das dann auch die Endseite. Es ist zum Verzweifeln!

cosinus 02.10.2012 10:43
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

yruwhatur 02.10.2012 11:32
Code:
ComboFix 12-10-02.02 - Lisa 02.10.2012  3:19.2.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8054.5725 [GMT -7:00]
ausgeführt von:: c:\users\Lisa\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-09-02 bis 2012-10-02  ))))))))))))))))))))))))))))))
.
.
2012-10-02 10:21 . 2012-10-02 10:21        --------        d-----w-        c:\users\Default\AppData\Local\temp
2012-10-02 06:47 . 2012-10-02 06:47        69000        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CEE50688-914D-469E-8379-9829FEE6B7BE}\offreg.dll
2012-10-02 06:19 . 2012-08-30 07:27        9308616        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{CEE50688-914D-469E-8379-9829FEE6B7BE}\mpengine.dll
2012-10-01 09:25 . 2012-10-01 09:25        --------        d-----w-        C:\_OTL
2012-09-29 19:51 . 2012-09-29 19:51        --------        d-----w-        C:\TEMP
2012-09-28 13:32 . 2012-09-28 13:32        --------        d-----w-        c:\program files (x86)\ESET
2012-09-28 07:57 . 2012-10-01 09:36        --------        d-----r-        c:\users\Lisa\Dropbox
2012-09-28 07:28 . 2012-10-01 15:33        --------        d-----r-        c:\users\Leapforce\Dropbox
2012-09-28 07:27 . 2012-10-01 14:49        --------        d-----w-        c:\users\Lisa\AppData\Roaming\Dropbox
2012-09-28 07:26 . 2012-10-01 15:33        --------        d-----w-        c:\users\Leapforce\AppData\Roaming\Dropbox
2012-09-28 06:56 . 2012-09-28 06:56        --------        d-----w-        c:\users\Leapforce\AppData\Roaming\Malwarebytes
2012-09-27 12:00 . 2012-09-27 12:01        --------        d-----w-        c:\program files (x86)\Malwarebytes' Anti-Malware
2012-09-27 12:00 . 2012-09-08 00:04        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys
2012-09-27 08:08 . 2012-09-27 08:08        --------        d-----w-        c:\users\Lisa\AppData\Roaming\Malwarebytes
2012-09-27 08:08 . 2012-09-27 08:08        --------        d-----w-        c:\programdata\Malwarebytes
2012-09-27 08:02 . 2012-09-27 08:02        --------        d-----w-        c:\users\Lisa\AppData\Local\ElevatedDiagnostics
2012-09-26 05:31 . 2012-08-21 21:01        245760        ----a-w-        c:\windows\system32\OxpsConverter.exe
2012-09-25 15:06 . 2012-09-25 15:06        --------        d-----w-        c:\users\Lisa\AppData\Roaming\FireShot
2012-09-14 18:08 . 2012-10-01 09:25        --------        d-----w-        c:\program files (x86)\Spybot - Search & Destroy
2012-09-14 18:08 . 2012-09-14 18:38        --------        d-----w-        c:\programdata\Spybot - Search & Destroy
2012-09-12 09:05 . 2012-09-27 10:00        --------        d-----w-        c:\users\Leapforce\AppData\Roaming\Audacity
2012-09-12 08:59 . 2012-09-12 09:00        --------        d-----w-        c:\program files (x86)\Audacity
2012-09-12 05:19 . 2012-08-22 18:12        950128        ----a-w-        c:\windows\system32\drivers\ndis.sys
2012-09-12 05:19 . 2012-07-04 20:26        41472        ----a-w-        c:\windows\system32\drivers\RNDISMP.sys
2012-09-12 05:19 . 2012-08-02 17:58        574464        ----a-w-        c:\windows\system32\d3d10level9.dll
2012-09-12 05:19 . 2012-08-02 16:57        490496        ----a-w-        c:\windows\SysWow64\d3d10level9.dll
2012-09-12 05:19 . 2012-08-22 18:12        1913200        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-09-12 05:19 . 2012-08-22 18:12        376688        ----a-w-        c:\windows\system32\drivers\netio.sys
2012-09-12 05:19 . 2012-08-22 18:12        288624        ----a-w-        c:\windows\system32\drivers\FWPKCLNT.SYS
2012-09-11 20:32 . 2012-09-12 13:48        --------        d-----w-        c:\program files (x86)\ManyCam
2012-09-11 19:14 . 2012-09-11 19:14        --------        d-----w-        c:\users\Lisa\AppData\Local\Diagnostics
2012-09-11 18:29 . 2012-09-11 18:50        --------        d-----w-        c:\program files (x86)\VS Revo Group
2012-09-11 18:09 . 2012-09-11 18:09        --------        d-----w-        c:\users\Lisa\AppData\Roaming\InstallShield
2012-09-11 16:51 . 2012-09-11 16:51        --------        d-----w-        c:\users\Lisa\AppData\Roaming\CyberLink
2012-09-11 12:56 . 2012-09-11 12:56        --------        d-----r-        c:\users\Leapforce\AppData\Roaming\Brother
2012-09-11 07:57 . 2012-09-11 07:57        --------        d-----r-        c:\users\Lisa\AppData\Roaming\Brother
2012-09-11 07:56 . 2012-09-11 07:56        --------        d-----w-        c:\program files (x86)\Brownie
2012-09-11 07:56 . 2008-10-23 07:00        111928        ------w-        c:\windows\SysWow64\BRRBTOOL.EXE
2012-09-11 07:56 . 2007-01-16 07:00        24223        ------w-        c:\windows\SysWow64\brlm03a.dll
2012-09-11 07:56 . 2006-12-21 18:23        176128        ------w-        c:\windows\SysWow64\BROSNMP.DLL
2012-09-11 07:56 . 2004-08-10 07:42        77824        ------w-        c:\windows\SysWow64\brlmw03a.dll
2012-09-11 07:52 . 2012-09-11 07:55        --------        d-----w-        c:\program files (x86)\Brother
2012-09-11 07:52 . 2009-05-26 02:14        196608        ------w-        c:\windows\SysWow64\Pdrvinst.dll
2012-09-11 07:52 . 2004-04-19 06:40        69715        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\ctor.dll
2012-09-11 07:52 . 2004-04-19 06:39        266240        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iscript.dll
2012-09-11 07:52 . 2004-04-19 06:39        172032        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iuser.dll
2012-09-11 07:52 . 2004-04-19 06:39        5632        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\DotNetInstaller.exe
2012-09-11 07:52 . 2012-09-11 07:52        303236        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\setup.dll
2012-09-11 07:52 . 2012-09-11 07:52        180356        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iGdi.dll
2012-09-11 07:52 . 2004-04-19 06:42        733184        ----a-w-        c:\program files (x86)\Common Files\InstallShield\Professional\RunTime\10\00\Intel32\iKernel.dll
2012-09-10 12:24 . 2012-09-10 12:24        --------        d-----w-        c:\users\Lisa\AppData\Roaming\Avira
2012-09-10 07:17 . 2012-09-10 07:17        --------        d-----w-        c:\users\Leapforce\AppData\Roaming\IrfanView
2012-09-10 07:11 . 2012-09-10 07:11        --------        d-----w-        c:\users\Leapforce\AppData\Roaming\Avira
2012-09-10 07:05 . 2012-07-19 01:04        27760        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2012-09-10 07:05 . 2012-07-19 01:04        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-09-10 07:05 . 2012-07-19 01:04        98848        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-09-10 07:05 . 2012-09-10 07:05        --------        d-----w-        c:\programdata\Avira
2012-09-10 07:05 . 2012-09-10 07:05        --------        d-----w-        c:\program files (x86)\Avira
2012-09-09 20:31 . 2012-09-09 20:31        --------        d-----w-        c:\users\Lisa\AppData\Roaming\IrfanView
2012-09-09 20:31 . 2012-09-09 20:31        --------        d-----w-        c:\program files (x86)\IrfanView
2012-09-08 09:24 . 2012-09-08 09:24        --------        d-----w-        c:\program files (x86)\Mozilla Maintenance Service
2012-09-07 05:28 . 2012-09-07 05:28        --------        d-----w-        c:\users\Leapforce\AppData\Roaming\vlc
2012-09-04 16:12 . 2012-05-04 11:00        366592        ----a-w-        c:\windows\system32\qdvd.dll
2012-09-04 16:12 . 2012-05-04 09:59        514560        ----a-w-        c:\windows\SysWow64\qdvd.dll
2012-09-03 13:08 . 2012-09-05 13:14        --------        d---a-w-        c:\users\Lisa\STUDIUM
2012-09-03 13:07 . 2012-09-28 08:09        --------        d---a-w-        c:\users\Lisa\Schriftliches und so
2012-09-03 13:07 . 2012-09-20 11:31        --------        d---a-w-        c:\users\Lisa\Rezepte
2012-09-03 13:06 . 2012-09-04 17:04        --------        d-----w-        c:\users\Lisa\Programme
2012-09-03 13:06 . 2012-09-27 07:19        --------        d---a-w-        c:\users\Lisa\My Received Files (E-mail, ICQ, MSN, Skype)
2012-09-03 13:06 . 2012-09-17 06:58        --------        d-----w-        c:\users\Lisa\Gutscheine
2012-09-03 13:03 . 2012-09-03 13:06        --------        d-----w-        c:\users\Lisa\Games
2012-09-03 13:01 . 2012-09-04 17:15        --------        d---a-w-        c:\users\Lisa\eBooks, Music, Lyrics, etc
2012-09-03 12:57 . 2012-09-20 10:19        --------        d-----w-        c:\users\Lisa\Bilddateien
2012-09-03 11:52 . 2012-09-18 08:32        --------        d-----w-        c:\users\Lisa\Backup Dateien
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-08-30 10:54 . 2012-08-30 10:13        73416        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-08-30 10:54 . 2012-08-30 10:13        696520        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-08-30 10:42 . 2010-06-24 19:33        19720        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll
2012-08-21 09:12 . 2012-08-30 13:04        285328        ----a-w-        c:\windows\system32\aswBoot.exe
2012-07-18 18:15 . 2012-08-31 07:26        3148800        ----a-w-        c:\windows\system32\win32k.sys
2012-07-06 20:07 . 2012-08-31 10:39        552960        ----a-w-        c:\windows\system32\drivers\bthport.sys
2012-07-04 22:16 . 2012-08-31 07:26        73216        ----a-w-        c:\windows\system32\netapi32.dll
2012-07-04 22:13 . 2012-08-31 07:26        59392        ----a-w-        c:\windows\system32\browcli.dll
2012-07-04 22:13 . 2012-08-31 07:26        136704        ----a-w-        c:\windows\system32\browser.dll
2012-07-04 21:14 . 2012-08-31 07:26        41984        ----a-w-        c:\windows\SysWow64\browcli.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        94208        ----a-w-        c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        94208        ----a-w-        c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        94208        ----a-w-        c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-02-06 291608]
"IndicatorUtility"="c:\program files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe" [2010-09-30 48752]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-07-19 348664]
.
c:\users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-8-26 26924984]
.
c:\users\Leapforce\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
Dropbox.lnk - c:\users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe [2012-8-26 26924984]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 5 (0x5)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\SafeBoot\Minimal\Wdf01000.sys]
@="Driver"
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-08 676936]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944]
R3 AMPPALP;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Protocol;c:\windows\system32\DRIVERS\amppal.sys [2011-12-05 195584]
R3 btmaux;Intel Bluetooth Auxiliary Service;c:\windows\system32\DRIVERS\btmaux.sys [2011-12-13 94720]
R3 btmhsf;btmhsf;c:\windows\system32\DRIVERS\btmhsf.sys [2011-12-13 747008]
R3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [x]
R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-01-30 276248]
R3 ibtfltcoex;ibtfltcoex;c:\windows\system32\DRIVERS\iBtFltCoex.sys [2011-12-14 60416]
R3 ManyCam;ManyCam Virtual Webcam;c:\windows\system32\DRIVERS\mcvidrv_x64.sys [2012-01-11 34304]
R3 mcaudrv_simple;ManyCam Virtual Microphone;c:\windows\system32\drivers\mcaudrv_x64.sys [2012-02-22 28160]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-08 114144]
R3 MyWiFiDHCPDNS;Wireless PAN DHCP Server;c:\program files\Intel\WiFi\bin\PanDhcpDns.exe [2011-12-08 273168]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392]
R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232]
R3 yukonw7;NDIS6.2 Miniport Driver for Marvell Yukon Ethernet Controller;c:\windows\system32\DRIVERS\yk62x64.sys [2009-06-10 389120]
S0 FBIOSDRV;Fujitsu BIOS Driver;c:\windows\System32\Drivers\FBIOSDRV.sys [2009-06-24 21104]
S0 iusb3hcs;Intel(R) USB 3.0 Host Controller Switch Driver;c:\windows\system32\drivers\iusb3hcs.sys [2012-02-06 16152]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2012-02-04 28992]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-07-19 27760]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [2009-07-14 59904]
S2 AMPPALR3;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service;c:\program files\Intel\BluetoothHS\BTHSAmpPalService.exe [2011-12-05 659968]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-07-19 86224]
S2 Bluetooth Device Monitor;Bluetooth Device Monitor;c:\program files (x86)\Intel\Bluetooth\devmonsrv.exe [2011-12-20 1014096]
S2 Bluetooth OBEX Service;Bluetooth OBEX Service;c:\program files (x86)\Intel\Bluetooth\obexsrv.exe [2011-12-20 1104208]
S2 BTHSSecurityMgr;Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service;c:\program files\Intel\BluetoothHS\BTHSSecurityMgr.exe [2011-12-05 135952]
S2 cvhsvc;Client Virtualization Handler;c:\program files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE [2012-01-04 822624]
S2 DTSAudioSvc;DTSAudioSvc;c:\program files\Realtek\Audio\HDA\DTSU2PAuSrv64.exe [2011-08-05 225280]
S2 FUJ02E3Service;FUJ02E3Service;c:\program files\Fujitsu\FUJ02E3\FUJ02E3.exe [2011-11-24 76104]
S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2011-12-08 607456]
S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2011-12-16 161560]
S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-08 399432]
S2 PFNService;PFNService;c:\program files\Fujitsu\Plugfree NETWORK\PFNService.exe [2011-12-22 2213376]
S2 PowerSavingUtilityService;PowerSavingUtilityService;c:\program files\Fujitsu\PSUtility\PSUService.exe [2011-10-03 63856]
S2 SBSDWSCService;SBSD Security Center Service;c:\program files (x86)\Spybot - Search & Destroy\SDWinSec.exe [2009-01-26 1153368]
S2 sftlist;Application Virtualization Client;c:\program files (x86)\Microsoft Application Virtualization Client\sftlist.exe [2011-10-01 508776]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-02-03 382272]
S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2011-12-16 363800]
S2 ZeroConfigService;Intel(R) PROSet/Wireless Zero Configuration Service;c:\program files\Intel\WiFi\bin\ZeroConfigService.exe [2011-12-08 594704]
S3 AMPPAL;Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Virtual Adapter;c:\windows\system32\DRIVERS\AMPPAL.sys [2011-12-05 195584]
S3 Bluetooth Media Service;Bluetooth Media Service;c:\program files (x86)\Intel\Bluetooth\mediasrv.exe [2011-12-20 1304912]
S3 FUJ02E3;Fujitsu FUJ02E3 Device Driver;c:\windows\system32\drivers\FUJ02E3.sys [2006-11-01 7296]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-05 331264]
S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-02-06 356120]
S3 iusb3xhc;Intel(R) USB 3.0 eXtensible Host Controller Driver;c:\windows\system32\drivers\iusb3xhc.sys [2012-02-06 787736]
S3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-08 25928]
S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2011-11-09 60184]
S3 NETwNs64;___ Intel(R) Wireless WiFi Link 5000 Series Adapter Driver for Windows 7 - 64 Bit;c:\windows\system32\DRIVERS\NETwNs64.sys [2011-12-02 11417088]
S3 osppsvc;Office Software Protection Platform;c:\program files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE [2010-01-09 4925184]
S3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2011-07-22 251496]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-09-29 646248]
S3 Sftfs;Sftfs;c:\windows\system32\DRIVERS\Sftfslh.sys [2011-10-01 764264]
S3 Sftplay;Sftplay;c:\windows\system32\DRIVERS\Sftplaylh.sys [2011-10-01 268648]
S3 Sftredir;Sftredir;c:\windows\system32\DRIVERS\Sftredirlh.sys [2011-10-01 25960]
S3 Sftvol;Sftvol;c:\windows\system32\DRIVERS\Sftvollh.sys [2011-10-01 22376]
S3 sftvsa;Application Virtualization Service Agent;c:\program files (x86)\Microsoft Application Virtualization Client\sftvsa.exe [2011-10-01 219496]
S3 vwifimp;Microsoft Virtual WiFi Miniport Service;c:\windows\system32\DRIVERS\vwifimp.sys [2009-07-14 17920]
.
.
--- Andere Dienste/Treiber im Speicher ---
.
*NewlyCreated* - 91105048
*Deregistered* - 91105048
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt1]
@="{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314ED9-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        97792        ----a-w-        c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt2]
@="{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDA-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        97792        ----a-w-        c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt3]
@="{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDB-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        97792        ----a-w-        c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DropboxExt4]
@="{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}"
[HKEY_CLASSES_ROOT\CLSID\{FB314EDC-A251-47B7-93E1-CDD82E34AF8B}]
2012-06-30 04:19        97792        ----a-w-        c:\users\Lisa\AppData\Roaming\Dropbox\bin\DropboxExt64.14.dll
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-12-13 13374568]
"RtHDVBg_DTS"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2011-11-15 2277992]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2011-12-20 589176]
"BTMTrayAgent"="c:\program files (x86)\Intel\Bluetooth\btmshell.dll" [2011-12-20 11406608]
"LoadFUJ02E3"="c:\program files\Fujitsu\FUJ02E3\fuj02e3.exe" [2011-11-24 76104]
"PSUTility"="c:\program files\Fujitsu\PSUtility\TrayManager.exe" [2011-10-03 205168]
"LoadFujitsuQuickTouch"="c:\program files\Fujitsu\Application Panel\QuickTouch.exe" [2011-10-01 158024]
"LoadBtnHnd"="c:\program files\Fujitsu\Application Panel\BtnHnd.exe" [2011-10-01 23368]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-01-30 170264]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-01-30 398616]
"Persistence"="c:\windows\system32\igfxpers.exe" [2012-01-30 440600]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.fujitsu.com/fts
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Lisa\AppData\Roaming\Mozilla\Firefox\Profiles\9smvgfht.default\
FF - prefs.js: network.proxy.type - 0
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_4_402_265_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_4_402_265.ocx, 1"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-10-02  03:24:14
ComboFix-quarantined-files.txt  2012-10-02 10:24
.
Vor Suchlauf: 10 Verzeichnis(se), 667.115.470.848 Bytes frei
Nach Suchlauf: 12 Verzeichnis(se), 666.482.503.680 Bytes frei
.
- - End Of File - - 58AB0C326299C9EFC839DBF522868B74
hätte ich die Wirewall auch ausmachen sollen?

cosinus 02.10.2012 18:57
Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).



Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

yruwhatur 02.10.2012 19:57
Code:
GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-10-02 11:33:55
Windows 6.1.7601 Service Pack 1
Running: pdb2knfi.exe


---- Registry - GMER 1.0.15 ----

Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\00150086aeb0                     
Reg  HKLM\SYSTEM\CurrentControlSet\services\BTHPORT\Parameters\Keys\685d432dc223                     
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\00150086aeb0 (not active ControlSet) 
Reg  HKLM\SYSTEM\ControlSet002\services\BTHPORT\Parameters\Keys\685d432dc223 (not active ControlSet) 

---- EOF - GMER 1.0.15 ----
Code:
Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 11:40:45 on 02.10.2012

OS: Windows 7 Home Premium Edition Service Pack 1 (Build 7601), 64-bit
Default Browser: Mozilla Corporation Firefox 15.0.1

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"CyberLink WebCam Virtual Driver" (clwvd) - ? - C:\Windows\System32\DRIVERS\clwvd.sys  (File not found)
"MBAMProtector" (MBAMProtector) - "Malwarebytes Corporation" - C:\Windows\system32\drivers\mbam.sys
"Sftfs" (Sftfs) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\Sftfslh.sys
"Sftplay" (Sftplay) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\Sftplaylh.sys
"Sftredir" (Sftredir) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\Sftredirlh.sys
"Sftvol" (Sftvol) - "Microsoft Corporation" - C:\Windows\System32\DRIVERS\Sftvollh.sys
"USB2.0 PC Camera (SNP2UVC)" (SNP2UVC) - ? - C:\Windows\System32\DRIVERS\snp2uvc.sys  (File not found)

[Explorer]
-----( HKCU\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{FB314ED9-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDA-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDB-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
{FB314EDC-A251-47B7-93E1-CDD82E34AF8B} "DropboxExt" - ? -  (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A} "PXCInfoShlExt Class" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\Win32\XCShInfo.dll
-----( HKLM\Software\Classes\Protocols\Handler )-----
{E43EF6CD-A37A-4A9B-9E6F-83F89B8E6324} "Album Download IE Asynchronous Pluggable Protocol Interface" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\AlbumDownloadProtocolHandler.dll
{FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} "IEProtocolHandler Class" - "Skype Technologies" - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL
{03C514A3-1EFB-4856-9F99-10D7BE1653C0} "Windows Live Mail HTML Asynchronous Pluggable Protocol Handler" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Mail\mailcomm.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{CF822AB4-6DB5-4FDA-BC28-E61DF36D2583} "PDF-XChange PDF Preview Provider" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\Win32\XCShInfo.dll
{67EB453C-1BE1-48EC-AAF3-23B10277FCC1} "PDF-XChange PDF Property Handler" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\Win32\XCShInfo.dll
{EBD0B8F4-A9A0-41B7-9695-030CD264D9C8} "PDF-XChange PDF Thumbnail Provider" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\Win32\XCShInfo.dll
{B2F55D43-C7A4-4B7C-90D7-7A860DFA9F2A} "PXCInfoShlExt Class" - "Tracker Software Products Ltd." - C:\Program Files\Tracker Software\Shell Extensions\Win32\XCShInfo.dll
{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - ? -  (File not found | COM-object registry key not found)
{2BE99FD4-A181-4996-BFA9-58C5FFD11F6C} "Windows Live Photo Gallery Autoplay Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F30F64-AC33-42F5-8FD1-5DC2D3FDE06C} "Windows Live Photo Gallery Editor Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F3712A-CA79-45B4-9E4D-D7891E7F8B9D} "Windows Live Photo Gallery Editor Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F30F90-3E96-453B-AFCD-D71989ECC2C7} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F33137-EE26-412F-8D71-F84E4C2C6625} "Windows Live Photo Gallery Viewer Autoplay Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{00F374B7-B390-4884-B372-2FC349F2172B} "Windows Live Photo Gallery Viewer Drop Target" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoGallery.exe
{00F346CB-35A4-465B-8B8F-65A29DBAB1F6} "Windows Live Photo Gallery Viewer Shim" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\PhotoViewerShim.dll
{0563DB41-F538-4B37-A92D-4659049B7766} "WLMD Message Handler" - ? -  (File not found | COM-object registry key not found)
{06A2568A-CED6-4187-BB20-400B8C02BE5A} "{06A2568A-CED6-4187-BB20-400B8C02BE5A}" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Photo Gallery\WLXPhotoAcquireWizard.exe
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\ShellServiceObjectDelayLoad )-----
{E6FB5E20-DE35-11CF-9C87-00AA005127ED} "WebCheck" - ? -  (File not found | COM-object registry key not found)

[Internet Explorer]
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
{5F7B1267-94A9-47F5-98DB-E99415F33AEC} "@C:\Program Files (x86)\Windows Live\Writer\WindowsLiveWriterShortcuts.dll,-1004" - "Microsoft Corporation" - C:\Program Files (x86)\Windows Live\Writer\WriterBrowserExtension.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID Sign-in Helper" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[LSA Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Lsa )-----
"Security Packages" - "Microsoft Corp." - C:\Windows\system32\livessp.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
"Dropbox.lnk" - "Dropbox, Inc." - C:\Users\Lisa\AppData\Roaming\Dropbox\bin\Dropbox.exe  (Shortcut exists | File exists)
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files (x86)\Avira\AntiVir Desktop\avgnt.exe" /min
"IndicatorUtility" - "FUJITSU LIMITED" - "C:\Program Files (x86)\Fujitsu\Fujitsu Hotkey Utility\IndicatorUty.exe"
"USB3MON" - "Intel Corporation" - "C:\Program Files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe"

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@%ProgramFiles%\Windows Defender\MsMpRes.dll,-103" (WinDefend) - ? - C:\Program Files (x86)\Windows Defender\mpsvc.dll  (File not found)
"@%PROGRAMFILES%\Windows Media Player\wmpnetwk.exe,-101" (WMPNetworkSvc) - ? - "C:\Program Files (x86)\Windows Media Player\wmpnetwk.exe"  (File not found)
"Application Virtualization Client" (sftlist) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftlist.exe
"Application Virtualization Service Agent" (sftvsa) - "Microsoft Corporation" - C:\Program Files (x86)\Microsoft Application Virtualization Client\sftvsa.exe
"ASP.NET State Service" (aspnet_state) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\aspnet_state.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
"Bluetooth Device Monitor" (Bluetooth Device Monitor) - "Intel Corporation" - C:\Program Files (x86)\Intel\Bluetooth\devmonsrv.exe
"Bluetooth Media Service" (Bluetooth Media Service) - "Intel Corporation" - C:\Program Files (x86)\Intel\Bluetooth\mediasrv.exe
"Bluetooth OBEX Service" (Bluetooth OBEX Service) - "Intel Corporation" - C:\Program Files (x86)\Intel\Bluetooth\obexsrv.exe
"Client Virtualization Handler" (cvhsvc) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
"FUJ02E3Service" (FUJ02E3Service) - "FUJITSU LIMITED" - C:\Program Files\Fujitsu\FUJ02E3\FUJ02E3.exe
"Intel(R) Capability Licensing Service Interface" (Intel(R) Capability Licensing Service Interface) - "Intel(R) Corporation" - C:\Program Files\Intel\iCLS Client\HeciServer.exe
"Intel(R) Centrino(R) Wireless Bluetooth(R) 3.0 + High Speed Security Service" (BTHSSecurityMgr) - "Intel(R) Corporation" - C:\Program Files\Intel\BluetoothHS\BTHSSecurityMgr.exe
"Intel(R) Dynamic Application Loader Host Interface Service" (jhi_service) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe
"Intel(R) Management and Security Application Local Management Service" (LMS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
"Intel(R) Management and Security Application User Notification Service" (UNS) - "Intel Corporation" - C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
"Intel(R) PROSet/Wireless Event Log" (EvtEng) - "Intel(R) Corporation" - C:\Program Files\Intel\WiFi\bin\EvtEng.exe
"Intel(R) PROSet/Wireless Registry Service" (RegSrvc) - "Intel(R) Corporation" - C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe
"Intel(R) PROSet/Wireless Zero Configuration Service" (ZeroConfigService) - "Intel® Corporation" - C:\Program Files\Intel\WiFi\bin\ZeroConfigService.exe
"Intel® Centrino® Wireless Bluetooth® 3.0 + High Speed Service" (AMPPALR3) - "Intel Corporation" - C:\Program Files\Intel\BluetoothHS\BTHSAmpPalService.exe
"MBAMScheduler" (MBAMScheduler) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe
"MBAMService" (MBAMService) - "Malwarebytes Corporation" - C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe
"Microsoft .NET Framework NGEN v4.0.30319_X64" (clr_optimization_v4.0.30319_64) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\WINDOWS\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Mozilla Maintenance Service" (MozillaMaintenance) - "Mozilla Foundation" - C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
"NVIDIA Display Driver Service" (nvsvc) - "NVIDIA Corporation" - C:\Windows\system32\nvvsvc.exe
"NVIDIA Stereoscopic 3D Driver Service" (Stereo Service) - "NVIDIA Corporation" - C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
"Office  Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"Office Software Protection Platform" (osppsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
"PFNService" (PFNService) - "FUJITSU LIMITED" - C:\Program Files\Fujitsu\Plugfree NETWORK\PFNService.exe
"PowerSavingUtilityService" (PowerSavingUtilityService) - "FUJITSU LIMITED" - C:\Program Files\Fujitsu\PSUtility\PSUService.exe
"SBSD Security Center Service" (SBSDWSCService) - "Safer Networking Ltd." - C:\Program Files (x86)\Spybot - Search & Destroy\SDWinSec.exe
"Skype Updater" (SkypeUpdate) - "Skype Technologies" - C:\Program Files (x86)\Skype\Updater\Updater.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corp." - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
"Wireless PAN DHCP Server" (MyWiFiDHCPDNS) - ? - C:\Program Files\Intel\WiFi\bin\PanDhcpDns.exe

[Winsock Providers]
-----( HKLM\SYSTEM\CurrentControlSet\Services\WinSock2\Parameters\NameSpace_Catalog5\Catalog_Entries )-----
"WindowsLive Local NSP" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL
"WindowsLive NSP" - "Microsoft Corp." - C:\Program Files (x86)\Common Files\Microsoft Shared\Windows Live\WLIDNSP.DLL

===[ Logfile end ]=========================================[ Logfile end ]===

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru
Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-10-02 11:42:10
-----------------------------
11:42:10.410    OS Version: Windows x64 6.1.7601 Service Pack 1
11:42:10.410    Number of processors: 4 586 0x3A09
11:42:10.411    ComputerName: LISASLAPTOP  UserName: Lisa
11:42:11.647    Initialize success
11:43:45.013    AVAST engine defs: 12100200
11:43:58.251    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
11:43:58.255    Disk 0 Vendor: TOSHIBA_ GT00 Size: 715404MB BusType: 3
11:43:58.265    Disk 0 MBR read successfully
11:43:58.267    Disk 0 MBR scan
11:43:58.269    Disk 0 Windows 7 default MBR code
11:43:58.273    Disk 0 Partition 1 80 (A) 27 Hidden NTFS WinRE NTFS        2048 MB offset 2048
11:43:58.276    Disk 0 Partition - 00    0F Extended LBA            713353 MB offset 4198400
11:43:58.293    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      697989 MB offset 4200448
11:43:58.296    Disk 0 Partition - 00    05    Extended              1025 MB offset 1433681920
11:43:58.342    Disk 0 Partition 3 00    27 Hidden NTFS WinRE NTFS        1024 MB offset 1433683968
11:43:58.346    Disk 0 Partition - 00    05    Extended            14337 MB offset 2865266688
11:43:58.363    Disk 0 Partition 4 00    27 Hidden NTFS WinRE NTFS        14336 MB offset 1435785216
11:43:58.400    Disk 0 scanning C:\Windows\system32\drivers
11:44:06.611    Service scanning
11:44:35.576    Modules scanning
11:44:35.585    Disk 0 trace - called modules:
11:44:35.623    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll
11:44:35.627    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8009ff8060]
11:44:35.631    3 CLASSPNP.SYS[fffff88001c9643f] -> nt!IofCallDriver -> [0xfffffa80077ac950]
11:44:35.635    5 ACPI.sys[fffff88000fad7a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa80077b0050]
11:44:36.790    AVAST engine scan C:\Windows
11:44:38.846    AVAST engine scan C:\Windows\system32
11:46:22.875    AVAST engine scan C:\Windows\system32\drivers
11:46:30.676    AVAST engine scan C:\Users\Lisa
11:49:24.555    AVAST engine scan C:\ProgramData
11:49:43.707    Scan finished successfully
11:51:37.393    Disk 0 MBR has been saved successfully to "C:\Users\Lisa\Desktop\MBR.dat"
11:51:37.397    The log file has been saved successfully to "C:\Users\Lisa\Desktop\aswMBR.txt"

cosinus 03.10.2012 17:53
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

yruwhatur 03.10.2012 21:35
Code:
Malwarebytes Anti-Malware (Test) 1.65.0.1400
www.malwarebytes.org

Datenbank Version: v2012.10.03.09

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Lisa :: LISASLAPTOP [Administrator]

Schutz: Deaktiviert

03.10.2012 12:31:09
mbam-log-2012-10-03 (12-31-09).txt

Art des Suchlaufs: Vollständiger Suchlauf (C:\|D:\|Q:\|)
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 318093
Laufzeit: 16 Minute(n), 12 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/03/2012 at 01:31 PM

Application Version : 5.5.1022

Core Rules Database Version : 9335
Trace Rules Database Version: 7147

Scan type      : Complete Scan
Total Scan Time : 00:19:50

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 718
Memory threats detected  : 0
Registry items scanned    : 70232
Registry threats detected : 0
File items scanned        : 37949
File threats detected    : 14

Adware.Tracking Cookie
        C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\TJMPKVIO.txt [ /zanox.com ]
        C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\MMGRZMMJ.txt [ /ad1.adfarm1.adition.com ]
        C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\OEAKRN7N.txt [ /adfarm1.adition.com ]
        C:\Users\Lisa\AppData\Roaming\Microsoft\Windows\Cookies\GPHZJ5WB.txt [ /ad.zanox.com ]
        C:\USERS\LEAPFORCE\AppData\Roaming\Microsoft\Windows\Cookies\VCQHFGKG.txt [ Cookie:leapforce@c.atdmt.com/ ]
        C:\USERS\LEAPFORCE\AppData\Roaming\Microsoft\Windows\Cookies\T05NJ8BB.txt [ Cookie:leapforce@zanox.com/ ]
        C:\USERS\LEAPFORCE\AppData\Roaming\Microsoft\Windows\Cookies\F9T9TBHP.txt [ Cookie:leapforce@atdmt.com/ ]
        C:\USERS\LEAPFORCE\AppData\Roaming\Microsoft\Windows\Cookies\Low\TQY3E41F.txt [ Cookie:leapforce@c.atdmt.com/ ]
        C:\USERS\LEAPFORCE\AppData\Roaming\Microsoft\Windows\Cookies\Low\CQZYJITV.txt [ Cookie:leapforce@atdmt.com/ ]
        C:\USERS\LEAPFORCE\Cookies\VCQHFGKG.txt [ Cookie:leapforce@c.atdmt.com/ ]
        C:\USERS\LEAPFORCE\Cookies\T05NJ8BB.txt [ Cookie:leapforce@zanox.com/ ]
        C:\USERS\LEAPFORCE\Cookies\F9T9TBHP.txt [ Cookie:leapforce@atdmt.com/ ]
        C:\USERS\LISA\Cookies\MMGRZMMJ.txt [ Cookie:lisa@ad1.adfarm1.adition.com/ ]
        C:\USERS\LISA\Cookies\GPHZJ5WB.txt [ Cookie:lisa@ad.zanox.com/ ]
searchvhb.com rattert immer noch durch...

cosinus 04.10.2012 09:36
Code:
UAC On - Limited User
Wie hast du sasw gestartet? Einfach per Doppelklick? Oder so wie es in der Anleitung steht?

Zitat:
Zitat von cosinus (Beitrag 324870)
Teil 2: Programm ausführen
Das Programm wurde nun installiert, eine Verknüpfung auf dem Desktop sollte erstellt worden sein. Nachdem du es gestartet hast, wird es sich erstmalig beim Updateserver nach neuen Schädlingssignaturen umsehen und Updates installieren. Diesen Vorgang NICHT abbrechen!

Benutzer mit Windows Vista und Windows 7 starten das Tool bitte wieder per Rechtsklick => als Administrator ausführen!

yruwhatur 04.10.2012 14:21
Ich hatte mich auch schon gewundert und dann gleich noch einen Scan laufen lassen bei dem ich genau drauf geachtet hab, es als Admin auszuführen. Ich habs jetzt nochmal so gestartet und das Gleiche:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 10/04/2012 at 06:13 AM

Application Version : 5.5.1022

Core Rules Database Version : 9335
Trace Rules Database Version: 7147

Scan type      : Complete Scan
Total Scan Time : 00:20:47

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 725
Memory threats detected  : 0
Registry items scanned    : 70232
Registry threats detected : 0
File items scanned        : 37973
File threats detected    : 0
Komisch, hast du ne Erklärung?

cosinus 04.10.2012 14:34
Das ist wahrscheinlich ein Bug von diesem Programm, ich bin auch schon am Überlegen ob ich das am Ende überhaupt noch einsetze

Sieht jedenfalls ok aus, da wurden nur Cookies gefunden, zuletzt nichts mehr
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

yruwhatur 04.10.2012 14:52
Liste der Anhänge anzeigen (Anzahl: 1)
Moment, ich hab's jetzt nochmal deinstalliert und alles ganz penibel nach Anleitung wieder installiert und lass es grad nochmal drüberlaufen. Scheint doch noch ein paar Sachen zu finden. Ich poste gleich das log.

searchvhb.com rattert immernoch bei fast jeder neu geladenen Seite unten durch, da unten links, wo man die urls laufen sieht. Neuerdings krieg ich Popups, in der rechten unteren ecke, die auch über searchvhb.com und andere auf shopping-Seiten leiten.

screenshot angehängt

Was ich erwähnen sollte: Ich arbeite im Auftrag eines Search Engine Quality Evaluators und bin deswegen auf "wildes Surfen" in Firefox angewiesen. Dummerweise kann ich mit diesen Redirects auch nicht arbeiten, denn es gehört auch immer etwas recherche dazu und wenn sich jeder dritte Link nicht korrekt öffnet bin ich zu langsam.
In diesem Rahmen hab ich auf dem nicht Admin-Account Toolbars von LF und ein Zeitmanagement-Tool, welches ein anderer Rater vertreibt installiert: Mit dem gibt es immer Probleme, dass ich nicht auf die LF-Seite geleitet werde, wie ich sollte, sondern auf searchvhb.com direkt. Kann es sein, dass damit was faul ist? hxxp://lftaskmaster.com/rateraide

cosinus 04.10.2012 14:55
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT


Alle Zeitangaben in WEZ +1. Es ist jetzt 03:33 Uhr.
Seite 2 von 3 1 2 3
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131