Trojaner-Board - Brief von Telekom

Trojaner-Board (https://www.trojaner-board.de/)

- Log-Analyse und Auswertung (https://www.trojaner-board.de/log-analyse-auswertung/)

- - Brief von Telekom (https://www.trojaner-board.de/135709-brief-telekom.html)

Brief von Telekom

Guten Abend allerseits,

ich habe zum wiederholten Mal einen Brief von Telekom erhalten, in dem mir mitgeteilt wird, daß Port 25 gesperrt ist, wegen Spam-Verdacht.

Klar , daß ich keinen Spam versende.

Trotzdem verhält sich mein System (Windows 7) merkwürdig. Manche Fenster lassen sich nicht schliessen, andere nicht öffnen, jedenfalls nich t ohne Wartezeit von einigen Minuten.

hjt ist unerwünscht, also spare ich mir ein Log, interessant aber ist, dass catchme mehrere Fehler in ntdll.dll findet.

Könnt Ihr mir vielleicht helfen?

Hi, den Spam versendest du wohl eher auch nicht freiwillig, das wird Schadsoftware für dich erledigen :-)

Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop

Starte bitte die
OTL.exe
.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Kopiere nun den Inhalt in die http://larusso.trojaner-board.de/Images/otlfix.jpg
Textbox.

Code:

activex

netsvcs

msconfig

%SYSTEMDRIVE%\*.

%PROGRAMFILES%\*.exe

%LOCALAPPDATA%\*.exe

%systemroot%\*. /mp /s

C:\Windows\system32\*.tsp

/md5start

userinit.exe

eventlog.dll

scecli.dll

netlogon.dll

cngaudit.dll

ws2ifsl.sys

sceclt.dll

ntelogon.dll

winlogon.exe

logevent.dll

user32.DLL

explorer.exe

iaStor.sys

nvstor.sys

atapi.sys

IdeChnDr.sys

viasraid.sys

AGP440.sys

vaxscsi.sys

nvatabus.sys

viamraid.sys

nvata.sys

nvgts.sys

iastorv.sys

ViPrt.sys

eNetHook.dll

ahcix86.sys

KR10N.sys

nvstor32.sys

ahcix86s.sys

/md5stop

%systemroot%\system32\drivers\*.sys /lockedfiles

%systemroot%\System32\config\*.sav

%systemroot%\system32\*.dll /lockedfiles

%USERPROFILE%\*.*

%USERPROFILE%\Local Settings\Temp\*.exe

%USERPROFILE%\Local Settings\Temp\*.dll

%USERPROFILE%\Application Data\*.exe

HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs

CREATERESTOREPOINT

Schliesse bitte nun alle Programme. (Wichtig)
Klicke nun bitte auf den Quick Scan Button.
Kopiere
nun den Inhalt aus OTL.txt und Extra.txt hier in Deinen Thread

Hallo Markus, das ging ja schnell...

Beim Klick auf OTL bekomme ich eine Fehlermeldung:

Not Found

The requested URL /OTL.exe<br /> <br /> was not found on this server.

Additionally, a 404 Not Found error was encountered while trying to use an ErrorDocument to handle the request.

--------------------------------------------------------------------------------

Apache/2.2.24 (Unix) mod_ssl/2.2.24 OpenSSL/1.0.0-fips mod_auth_passthrough/2.1 mod_bwlimited/1.4 FrontPage/5.0.2.2635 Server at oldtimer.geekstogo.com Port 80

Hat sich die Adresse geändert?

Ich suche nicht blind, sondern hätte gerne verläßliche Adressen.

Gruß

den zweiten Link bitte nemen

ach, und nochwas, ich bekomme seit Tagen eine mail auf qq.com mit einer .rar oder .7z Datei, ich habe die Datei einmal gespeichert, ein Virus wurde angezeigt und ich habe sie gelöscht, ohne sie auszuführen.

hi
spammails kannst du bitte immer an die adresse in meiner Signatur weiterleiten

der Anhang weigert sich, weitergeschickt zu werden. Ich versuche nochmal

habs bekommen, dann man weiter mit otl

scan dauert noch... ich abe sehr viele Sprachen installiert, WG- Rechner, wir sind sehr international

ok, otl berichtet:
OTL Logfile:

Code:

OTL logfile created on: 28.05.2013 22:34:34 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\dk\Downloads

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16438)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,22 Gb Total Physical Memory | 5,52 Gb Available Physical Memory | 76,46% Memory free

14,43 Gb Paging File | 12,66 Gb Available in Paging File | 87,73% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 372,61 Gb Total Space | 244,39 Gb Free Space | 65,59% Space Free | Partition Type: NTFS

 

Computer Name: W7 | User Name: root | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.05.28 22:32:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\dk\Downloads\OTL.exe

PRC - [2013.04.10 14:15:13 | 003,661,456 | ---- | M] (网易公司) -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\YodaoDict.exe

PRC - [2013.04.10 14:15:13 | 001,900,176 | ---- | M] (网易公司) -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\5.4.43.3217\wordbook.exe

PRC - [2013.03.13 23:25:17 | 000,023,552 | ---- | M] (Microsoft) -- C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

PRC - [2013.01.09 17:46:38 | 000,165,280 | ---- | M] (Tencent) -- C:\Program Files (x86)\Tencent\QQ2012\Bin\TXPlatform.exe

PRC - [2013.01.08 00:25:59 | 000,128,416 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\QQ.exe

PRC - [2013.01.07 10:04:46 | 000,132,472 | ---- | M] (Tencent) -- C:\Program Files (x86)\Tencent\TM2008\Bin\TM.exe

PRC - [2013.01.06 21:26:57 | 001,595,056 | ---- | M] (Kingsoft Corporation) -- C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

PRC - [2013.01.06 21:26:57 | 000,123,992 | ---- | M] (Kingsoft Corporation) -- c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

PRC - [2009.09.02 09:44:22 | 000,315,478 | ---- | M] (IVT Corporation) -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe

PRC - [2009.09.02 09:41:24 | 001,466,476 | ---- | M] (IVT Corporation) -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

PRC - [2007.10.31 17:18:12 | 011,954,536 | ---- | M] (Ritlabs S.R.L.) -- C:\Program Files (x86)\The Bat!\thebat.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.01.08 00:26:00 | 000,234,912 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\libjpegturbo.dll

MOD - [2013.01.08 00:26:00 | 000,157,088 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\libpng.dll

MOD - [2013.01.08 00:26:00 | 000,136,608 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\libexpatw.dll

MOD - [2013.01.08 00:26:00 | 000,087,456 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\zlib.dll

MOD - [2013.01.08 00:25:59 | 000,128,416 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\QQ.exe

MOD - [2012.07.09 04:49:28 | 000,063,208 | ---- | M] () -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\5.4.43.3217\WordStrokeHelper32.dll

MOD - [2012.07.09 04:49:20 | 000,016,104 | ---- | M] () -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\Stable\Acrobat2Dict.dll

MOD - [2012.07.05 13:37:26 | 000,095,936 | ---- | M] () -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\5.4.43.3217\CrashRpt.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2013.03.26 18:23:32 | 000,230,416 | ---- | M] (Nitro PDF Software) [Disabled | Stopped] -- C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe -- (NitroReaderDriverReadSpool3)

SRV:64bit: - [2013.02.08 20:30:42 | 000,359,664 | ---- | M] (Logitech, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe -- (LBTServ)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV:64bit: - [2009.07.14 03:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svchost.exe -- (QTService)

SRV - [2013.03.29 15:29:41 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013.03.24 13:31:21 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2013.01.08 13:53:48 | 000,161,536 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2013.01.06 21:26:57 | 000,123,992 | ---- | M] (Kingsoft Corporation) [Auto | Running] -- c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe -- (kxescore)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.09.02 09:46:18 | 000,192,000 | ---- | M] (IVT Corporation) [On_Demand | Running] -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsHelpCS.exe -- (BsHelpCS)

SRV - [2009.09.02 09:41:24 | 001,466,476 | ---- | M] (IVT Corporation) [Auto | Running] -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe -- (BlueSoleilCS)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2008.11.09 22:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2007.05.31 11:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 11:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013.04.03 21:20:19 | 000,163,920 | ---- | M] (TENCENT) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\TesSafe.sys -- (TesSafe)

DRV:64bit: - [2013.03.07 13:21:28 | 000,038,664 | ---- | M] (Spotflux, Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tapSF0901.sys -- (tapSF0901)

DRV:64bit: - [2013.01.09 05:46:34 | 000,294,248 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Treiber\VMM.sys -- (vmm)

DRV:64bit: - [2013.01.06 21:27:01 | 000,210,296 | ---- | M] (Kingsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\kisknl.sys -- (kisknl)

DRV:64bit: - [2013.01.06 21:27:01 | 000,031,848 | ---- | M] (Kingsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kavbootc64.sys -- (kavbootc)

DRV:64bit: - [2013.01.03 10:17:38 | 000,077,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2013.01.03 10:17:38 | 000,061,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2012.12.25 14:34:10 | 000,024,728 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\TSysCare64.sys -- (TSysCare)

DRV:64bit: - [2012.12.19 15:47:20 | 000,132,008 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)

DRV:64bit: - [2012.10.28 17:09:54 | 000,038,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)

DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.08.05 11:24:26 | 000,292,024 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfbd.sys -- (Tosrfbd)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.02.11 20:16:38 | 010,628,640 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2011.01.27 16:27:04 | 000,067,384 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfusb.sys -- (Tosrfusb)

DRV:64bit: - [2010.11.29 12:47:00 | 000,082,224 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfcom.sys -- (Tosrfcom)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.08.30 11:48:00 | 000,094,528 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Tosrfhid.sys -- (Tosrfhid)

DRV:64bit: - [2010.07.01 19:11:24 | 000,012,352 | ---- | M] () [Kernel | "Start" not found. | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)

DRV:64bit: - [2010.04.29 07:55:42 | 000,032,768 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\androidusb.sys -- (androidusb)

DRV:64bit: - [2010.04.26 12:48:00 | 000,063,488 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TosRfSnd.sys -- (TosRfSnd)

DRV:64bit: - [2009.12.07 20:53:26 | 000,117,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)

DRV:64bit: - [2009.12.01 23:19:16 | 000,649,472 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emBDA64.sys -- (USB28xxBGA)

DRV:64bit: - [2009.12.01 23:18:32 | 000,617,216 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emOEM64.sys -- (USB28xxOEM)

DRV:64bit: - [2009.10.20 18:20:36 | 000,114,608 | ---- | M] (Philips Applied Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\phaudlwr.sys -- (phaudlwr)

DRV:64bit: - [2009.10.07 09:49:28 | 006,379,288 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)

DRV:64bit: - [2009.10.07 09:47:46 | 000,327,704 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)

DRV:64bit: - [2009.08.28 16:05:00 | 000,043,912 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VCommMgr.sys -- (VcommMgr)

DRV:64bit: - [2009.08.28 16:04:44 | 000,047,880 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btcusb.sys -- (Btcsrusb)

DRV:64bit: - [2009.08.26 12:18:20 | 000,034,440 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btnetBus.sys -- (IvtPanBusSrv)

DRV:64bit: - [2009.08.26 12:18:20 | 000,034,440 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btnetBus.sys -- (btnetBUs)

DRV:64bit: - [2009.08.26 11:16:52 | 000,030,344 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IvtBtBus.sys -- (IvtBtBUs)

DRV:64bit: - [2009.08.26 11:16:52 | 000,030,344 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IvtBtBus.sys -- (IvtAudioBusSrv)

DRV:64bit: - [2009.08.26 11:16:44 | 000,024,840 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BtHidBus.sys -- (BtHidBus)

DRV:64bit: - [2009.08.26 11:16:36 | 000,020,872 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VHIDMini.sys -- (VHidMinidrv)

DRV:64bit: - [2009.08.26 11:16:20 | 000,017,032 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VComm.sys -- (VComm)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2009.06.17 14:02:44 | 000,020,488 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btnetdrv.sys -- (BT)

DRV:64bit: - [2009.06.17 14:02:20 | 000,036,872 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)

DRV:64bit: - [2009.06.17 14:02:12 | 000,036,360 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\blueletaudio.sys -- (BlueletAudio)

DRV:64bit: - [2009.06.17 13:01:00 | 000,054,664 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosporte.sys -- (tosporte)

DRV:64bit: - [2009.06.10 22:35:02 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k60x64.sys -- (e1kexpress)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.09 05:18:20 | 000,053,816 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\DGIVECP.SYS -- (DgiVecp)

DRV:64bit: - [2009.04.29 17:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)

DRV:64bit: - [2008.06.12 08:40:13 | 000,085,424 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)

DRV:64bit: - [2008.02.05 02:50:42 | 000,079,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMNetSrv.sys -- (VPCNetS2)

DRV:64bit: - [2008.01.10 20:34:52 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.SYS -- (SSPORT)

DRV:64bit: - [2007.12.04 09:31:00 | 003,249,024 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\spc1000.sys -- (SPC1000)

DRV - [2013.01.06 21:27:01 | 000,164,696 | ---- | M] (Kingsoft Corporation) [Kernel | System | Running] -- c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys -- (KDHacker)

DRV - [2013.01.06 21:26:58 | 000,018,296 | ---- | M] (Kingsoft Corporation) [Kernel | Disabled | Running] -- C:\Program Files (x86)\kingsoft\kingsoft antivirus\kusbquery64.sys -- (KUsbGuard)

DRV - [2012.12.26 12:47:40 | 000,073,784 | ---- | M] (Tencent) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\TsFltMgr.sys -- (TsFltMgr)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2009.06.17 14:02:12 | 000,036,360 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\blueletaudio.sys -- (BlueletAudio)

DRV - [2004.05.05 21:48:40 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Stopped] -- C:\Windows\SysWow64\drivers\PQNTDRV.sys -- (PQNTDrv)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 33 5A A2 E6 47 EC CD 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www2.delta-search.com/?q={searchTerms}&affID=119816&tt=gc_&babsrc=SP_ss&mntrId=E6A500FF7A2C38D5

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\..\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}: "URL" = hxxp://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=20041099_oem_dg&ch=33

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 
 ========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)

FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent)

FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall,version=1.0.0: %commonprogramfiles%\tencent\NPQSCALL\npqscall.dll File not found

FF - HKLM\Software\MozillaPlugins\@qq.com/QQPhotoDrawEx: C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll ()

FF - HKLM\Software\MozillaPlugins\@qq.com/QzoneMusic: C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll (Tencent)

FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.87\Bin\npSSOAxCtrlForPTLogin.dll (Tencent)

FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodInsert: C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll (Shenzhen QVOD Technology Co.,Ltd)

FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodShare: C:\Program Files (x86)\QvodPlayer\npShareModule.dll (Shenzhen QVOD Technology Co.,Ltd)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKCU\Software\MozillaPlugins\duowan.com/Checker: C:\Program Files (x86)\Common Files\duowan\yy4.0\YYSSO\1.0.0.3\npChecker.dll (广州多玩信息技术有限公司)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}: C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013.03.23 11:21:47 | 000,000,000 | ---D | M]

 

[2013.05.02 22:46:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

 

Hosts file not found

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D298} - C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend_x64.dll (Shenzhen QVOD Technology Co.,Ltd)

O2:64bit: - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend.dll (Shenzhen QVOD Technology Co.,Ltd)

O2 - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: [BtTray] C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe (IVT Corporation)

O4 - HKLM..\Run: [kxesc] c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe (Kingsoft Corporation)

O4 - HKCU..\Run: [QTalk] C:\Program Files (x86)\Tencent\QTalk\V3.8.6\Bin\QTalk.exe (Tencent)

O4 - HKCU..\Run: [YY] C:\Program Files (x86)\yy\yy-5\YY.exe (YY Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O8:64bit: - Extra context menu item: 收藏到有道云笔记 - C:\Program Files (x86)\Youdao\YNote\ieext_menu.htm ()

O8 - Extra context menu item: 收藏到有道云笔记 - C:\Program Files (x86)\Youdao\YNote\ieext_menu.htm ()

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: 收藏到有道云笔记 - {65D09F88-CE18-4A95-B8AF-311C3311DB03} - C:\Program Files (x86)\Youdao\YNote\ieext_btn.htm ()

O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {3ABECEEC-DD81-4511-A7FD-B3B657B64892} hxxp://3gsoft.gtimg.com/sd/resource/cobrahall/2013/01/17/15/QQGameAssist.cab (AXDownload Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{34672EC1-93FF-4B33-A99E-DFEF97C19111}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A2C38D5-A295-4C23-82EF-1F2A414AF71A}: DhcpNameServer = 44.0.0.253 44.0.0.3 44.0.0.4 8.8.8.8

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\livecall - No CLSID value found

O18 - Protocol\Handler\msnim - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\skype4com.dll (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.28 19:09:14 | 000,000,000 | ---D | C] -- C:\Users\root\Desktop\Notfall-CD-2.2

[2013.05.28 17:58:27 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\QuickStoresToolbar

[2013.05.28 17:58:24 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

[2013.05.28 17:58:24 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker

[2013.05.28 17:33:14 | 000,000,000 | ---D | C] -- C:\Users\root\Desktop\ntdll

[2013.05.28 17:05:11 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\Diagnostics

[2013.05.26 01:36:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton PartitionMagic 8.0

[2013.05.26 01:36:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Symantec

[2013.05.23 23:26:03 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2013.05.22 21:23:17 | 000,000,000 | -H-D | C] -- C:\Windows\AxInstSV

[2013.05.18 20:50:55 | 005,191,704 | ---- | C] (Google Inc.) -- C:\Windows\SysNative\GooglePinyin2.ime

[2013.05.18 20:50:55 | 003,460,120 | ---- | C] (Google Inc.) -- C:\Windows\SysWow64\GooglePinyin2.ime

[2013.05.18 20:50:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Google

[2013.05.18 20:50:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Google

[2013.05.18 20:50:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google

[2013.05.18 18:46:10 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Duowan.com

[2013.05.18 18:46:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\yy

[2013.05.05 19:28:13 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Swift Sound

[2013.05.05 19:25:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NCH Software

[2013.05.05 19:25:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs

[2013.05.05 19:25:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Switch Sound File Converter

[2013.05.05 19:25:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NCH Swift Sound

[2013.05.05 19:18:41 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\NCH Swift Sound

[2013.05.05 18:38:58 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Software

[2013.05.05 11:34:17 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\bluesoleil

[2013.05.02 22:46:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2013.05.02 22:46:49 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Babylon

[2013.05.02 22:46:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon

[2013.04.30 13:07:29 | 000,000,000 | ---D | C] -- C:\ProgramData\KRSHistory

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.28 22:03:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.28 21:24:39 | 000,005,139 | ---- | M] () -- C:\Windows\SysWow64\LOCALSERVICE.INI

[2013.05.28 21:24:39 | 000,000,094 | ---- | M] () -- C:\Windows\SysWow64\LOCALDEVICE.INI

[2013.05.28 21:24:37 | 000,000,991 | ---- | M] () -- C:\Windows\SysWow64\bscs.ini

[2013.05.28 21:02:07 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.28 21:02:07 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.28 20:51:46 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs

[2013.05.28 20:51:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.28 20:51:39 | 1517,686,783 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.28 19:04:04 | 548,011,982 | ---- | M] () -- C:\Users\root\Desktop\Notfall-CD-2.2.zip

[2013.05.28 18:25:52 | 000,000,185 | ---- | M] () -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickStores.url

[2013.05.28 17:26:10 | 016,095,864 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.05.28 17:26:10 | 000,694,892 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat

[2013.05.28 17:26:10 | 000,693,840 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat

[2013.05.28 17:26:10 | 000,691,462 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat

[2013.05.28 17:26:10 | 000,690,122 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat

[2013.05.28 17:26:10 | 000,689,538 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat

[2013.05.28 17:26:10 | 000,679,694 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat

[2013.05.28 17:26:10 | 000,676,252 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat

[2013.05.28 17:26:10 | 000,664,104 | ---- | M] () -- C:\Windows\SysNative\prfh0416.dat

[2013.05.28 17:26:10 | 000,653,454 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.05.28 17:26:10 | 000,632,734 | ---- | M] () -- C:\Windows\SysNative\perfh00E.dat

[2013.05.28 17:26:10 | 000,623,720 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat

[2013.05.28 17:26:10 | 000,618,174 | ---- | M] () -- C:\Windows\SysNative\perfh01D.dat

[2013.05.28 17:26:10 | 000,616,484 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.05.28 17:26:10 | 000,610,676 | ---- | M] () -- C:\Windows\SysNative\perfh01F.dat

[2013.05.28 17:26:10 | 000,551,996 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat

[2013.05.28 17:26:10 | 000,462,594 | ---- | M] () -- C:\Windows\SysNative\perfh006.dat

[2013.05.28 17:26:10 | 000,449,064 | ---- | M] () -- C:\Windows\SysNative\perfh014.dat

[2013.05.28 17:26:10 | 000,435,122 | ---- | M] () -- C:\Windows\SysNative\perfh001.dat

[2013.05.28 17:26:10 | 000,434,058 | ---- | M] () -- C:\Windows\SysNative\perfh00B.dat

[2013.05.28 17:26:10 | 000,400,794 | ---- | M] () -- C:\Windows\SysNative\perfh012.dat

[2013.05.28 17:26:10 | 000,389,694 | ---- | M] () -- C:\Windows\SysNative\perfh011.dat

[2013.05.28 17:26:10 | 000,379,188 | ---- | M] () -- C:\Windows\SysNative\prfh0404.dat

[2013.05.28 17:26:10 | 000,363,044 | ---- | M] () -- C:\Windows\SysNative\prfh0804.dat

[2013.05.28 17:26:10 | 000,354,348 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat

[2013.05.28 17:26:10 | 000,148,698 | ---- | M] () -- C:\Windows\SysNative\perfc00E.dat

[2013.05.28 17:26:10 | 000,137,472 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat

[2013.05.28 17:26:10 | 000,135,250 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat

[2013.05.28 17:26:10 | 000,134,154 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat

[2013.05.28 17:26:10 | 000,133,320 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat

[2013.05.28 17:26:10 | 000,132,930 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat

[2013.05.28 17:26:10 | 000,130,566 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat

[2013.05.28 17:26:10 | 000,130,160 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.05.28 17:26:10 | 000,128,514 | ---- | M] () -- C:\Windows\SysNative\prfc0416.dat

[2013.05.28 17:26:10 | 000,127,550 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat

[2013.05.28 17:26:10 | 000,124,250 | ---- | M] () -- C:\Windows\SysNative\perfc01D.dat

[2013.05.28 17:26:10 | 000,122,252 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat

[2013.05.28 17:26:10 | 000,122,046 | ---- | M] () -- C:\Windows\SysNative\perfc01F.dat

[2013.05.28 17:26:10 | 000,106,864 | ---- | M] () -- C:\Windows\SysNative\perfc011.dat

[2013.05.28 17:26:10 | 000,106,864 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.05.28 17:26:10 | 000,105,380 | ---- | M] () -- C:\Windows\SysNative\perfc012.dat

[2013.05.28 17:26:10 | 000,104,724 | ---- | M] () -- C:\Windows\SysNative\prfc0804.dat

[2013.05.28 17:26:10 | 000,099,810 | ---- | M] () -- C:\Windows\SysNative\prfc0404.dat

[2013.05.28 17:26:10 | 000,089,794 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat

[2013.05.28 17:26:10 | 000,082,590 | ---- | M] () -- C:\Windows\SysNative\perfc00B.dat

[2013.05.28 17:26:10 | 000,080,278 | ---- | M] () -- C:\Windows\SysNative\perfc006.dat

[2013.05.28 17:26:10 | 000,079,460 | ---- | M] () -- C:\Windows\SysNative\perfc001.dat

[2013.05.28 17:26:10 | 000,077,562 | ---- | M] () -- C:\Windows\SysNative\perfc014.dat

[2013.05.28 17:26:10 | 000,069,570 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat

[2013.05.28 16:37:23 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys

[2013.05.26 12:51:49 | 000,000,261 | ---- | M] () -- C:\Windows\SysWow64\REMOTEDEVICE.INI

[2013.05.26 11:03:48 | 000,018,760 | ---- | M] () -- C:\Windows\SysWow64\QQVistaHelper.dll

[2013.05.20 19:28:49 | 000,002,718 | ---- | M] () -- C:\Windows\SysWow64\SHORTCUT.INI

[2013.05.18 20:50:55 | 005,191,704 | ---- | M] (Google Inc.) -- C:\Windows\SysNative\GooglePinyin2.ime

[2013.05.18 20:50:55 | 003,460,120 | ---- | M] (Google Inc.) -- C:\Windows\SysWow64\GooglePinyin2.ime

[2013.05.18 18:50:04 | 000,000,020 | ---- | M] () -- C:\Users\root\AppData\Roaming\004D5649544E41696E66

[2013.05.18 18:46:26 | 000,000,256 | ---- | M] () -- C:\Users\root\AppData\Roaming\0408002700AC0C

[2013.05.18 18:46:10 | 000,001,052 | ---- | M] () -- C:\Users\root\Desktop\YY.lnk

[2013.05.04 11:59:42 | 002,223,976 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2013.05.28 18:58:36 | 548,011,982 | ---- | C] () -- C:\Users\root\Desktop\Notfall-CD-2.2.zip

[2013.05.28 17:58:27 | 000,000,185 | ---- | C] () -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickStores.url

[2013.05.18 18:50:04 | 000,000,020 | ---- | C] () -- C:\Users\root\AppData\Roaming\004D5649544E41696E66

[2013.05.18 18:46:10 | 000,001,052 | ---- | C] () -- C:\Users\root\Desktop\YY.lnk

[2013.04.17 13:58:42 | 000,002,718 | ---- | C] () -- C:\Windows\SysWow64\SHORTCUT.INI

[2013.04.17 13:54:26 | 000,000,261 | ---- | C] () -- C:\Windows\SysWow64\REMOTEDEVICE.INI

[2013.04.17 13:48:46 | 000,005,139 | ---- | C] () -- C:\Windows\SysWow64\LOCALSERVICE.INI

[2013.04.17 13:43:24 | 000,000,094 | ---- | C] () -- C:\Windows\SysWow64\LOCALDEVICE.INI

[2013.04.17 13:31:17 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\BSPRINT.INI

[2013.04.15 12:54:57 | 000,723,230 | ---- | C] () -- C:\Windows\unins000.exe

[2013.04.15 12:54:57 | 000,048,009 | ---- | C] () -- C:\Windows\unins000.dat

[2013.02.10 22:59:45 | 000,000,256 | ---- | C] () -- C:\Users\root\AppData\Roaming\0408002700AC0C

[2013.01.11 18:18:56 | 000,430,992 | ---- | C] () -- C:\Windows\SysWow64\QGActiveX.dll

[2013.01.08 16:43:32 | 000,311,032 | ---- | C] () -- C:\Windows\SysWow64\IVTCredentialProvider.dll

[2013.01.08 01:34:18 | 000,479,232 | ---- | C] () -- C:\Windows\ssndii.exe

[2013.01.07 10:04:42 | 000,018,760 | ---- | C] () -- C:\Windows\SysWow64\QQVistaHelper.dll

[2013.01.06 23:08:46 | 000,000,017 | ---- | C] () -- C:\Users\root\AppData\Local\resmon.resmoncfg

[2012.06.29 22:15:24 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\VMProtectSDK32.dll

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== Files - Unicode (All) ==========

[2013.05.26 11:04:04 | 000,001,222 | ---- | M] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QT??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QT语音.lnk

[2013.05.26 11:04:04 | 000,001,222 | ---- | C] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QT??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QT语音.lnk

[2013.05.26 11:04:04 | 000,001,198 | ---- | M] ()(C:\Users\root\Desktop\QT??.lnk) -- C:\Users\root\Desktop\QT语音.lnk

[2013.05.26 11:04:04 | 000,001,198 | ---- | C] ()(C:\Users\root\Desktop\QT??.lnk) -- C:\Users\root\Desktop\QT语音.lnk

[2013.05.18 18:49:39 | 000,001,138 | ---- | M] ()(C:\Users\root\Desktop\YY????.lnk) -- C:\Users\root\Desktop\YY游戏大厅.lnk

[2013.04.22 10:32:13 | 000,001,138 | ---- | C] ()(C:\Users\root\Desktop\YY????.lnk) -- C:\Users\root\Desktop\YY游戏大厅.lnk

[2013.04.15 13:18:55 | 000,001,945 | ---- | M] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\快播.lnk

[2013.04.15 13:18:55 | 000,001,927 | ---- | M] ()(C:\Users\Public\Desktop\??.lnk) -- C:\Users\Public\Desktop\快播.lnk

[2013.04.15 13:18:30 | 000,001,945 | ---- | C] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\快播.lnk

[2013.04.15 13:18:30 | 000,001,927 | ---- | C] ()(C:\Users\Public\Desktop\??.lnk) -- C:\Users\Public\Desktop\快播.lnk

[2013.03.19 00:27:59 | 000,001,167 | ---- | M] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk

[2013.03.19 00:27:59 | 000,001,167 | ---- | C] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk

[2013.02.22 18:05:22 | 020,411,513 | ---- | M] ()(C:\Users\Public\Documents\QT?? 3.5.rar) -- C:\Users\Public\Documents\QT语音 3.5.rar

[2013.02.22 18:05:01 | 020,411,513 | ---- | C] ()(C:\Users\Public\Documents\QT?? 3.5.rar) -- C:\Users\Public\Documents\QT语音 3.5.rar

[2013.01.09 18:04:41 | 000,001,129 | ---- | M] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ游戏.lnk

[2013.01.09 18:04:41 | 000,001,129 | ---- | C] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ游戏.lnk

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\????) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\????) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯游戏

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\??) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\有道

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\??) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\小米

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\??) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\多玩

(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯软件

(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯游戏

(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\快播软件

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:05E9FFE5
 

< End of report >

--- --- ---

ok, otl berichtet:
OTL Logfile:

Code:

OTL logfile created on: 28.05.2013 22:34:34 - Run 1

OTL by OldTimer - Version 3.2.69.0     Folder = C:\Users\dk\Downloads

64bit- Ultimate Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation

Internet Explorer (Version = 9.10.9200.16438)

Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy

 

7,22 Gb Total Physical Memory | 5,52 Gb Available Physical Memory | 76,46% Memory free

14,43 Gb Paging File | 12,66 Gb Available in Paging File | 87,73% Paging File free

Paging file location(s): ?:\pagefile.sys [binary data]

 

%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)

Drive C: | 372,61 Gb Total Space | 244,39 Gb Free Space | 65,59% Space Free | Partition Type: NTFS

 

Computer Name: W7 | User Name: root | Logged in as Administrator.

Boot Mode: Normal | Scan Mode: Current user | Include 64bit Scans

Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days

 
 ========== Processes (SafeList) ==========

 

PRC - [2013.05.28 22:32:52 | 000,602,112 | ---- | M] (OldTimer Tools) -- C:\Users\dk\Downloads\OTL.exe

PRC - [2013.04.10 14:15:13 | 003,661,456 | ---- | M] (网易公司) -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\YodaoDict.exe

PRC - [2013.04.10 14:15:13 | 001,900,176 | ---- | M] (网易公司) -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\5.4.43.3217\wordbook.exe

PRC - [2013.03.13 23:25:17 | 000,023,552 | ---- | M] (Microsoft) -- C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

PRC - [2013.01.09 17:46:38 | 000,165,280 | ---- | M] (Tencent) -- C:\Program Files (x86)\Tencent\QQ2012\Bin\TXPlatform.exe

PRC - [2013.01.08 00:25:59 | 000,128,416 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\QQ.exe

PRC - [2013.01.07 10:04:46 | 000,132,472 | ---- | M] (Tencent) -- C:\Program Files (x86)\Tencent\TM2008\Bin\TM.exe

PRC - [2013.01.06 21:26:57 | 001,595,056 | ---- | M] (Kingsoft Corporation) -- C:\Program Files (x86)\kingsoft\kingsoft antivirus\kxetray.exe

PRC - [2013.01.06 21:26:57 | 000,123,992 | ---- | M] (Kingsoft Corporation) -- c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

PRC - [2009.09.02 09:44:22 | 000,315,478 | ---- | M] (IVT Corporation) -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe

PRC - [2009.09.02 09:41:24 | 001,466,476 | ---- | M] (IVT Corporation) -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

PRC - [2007.10.31 17:18:12 | 011,954,536 | ---- | M] (Ritlabs S.R.L.) -- C:\Program Files (x86)\The Bat!\thebat.exe

 

 
 ========== Modules (No Company Name) ==========

 

MOD - [2013.01.08 00:26:00 | 000,234,912 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\libjpegturbo.dll

MOD - [2013.01.08 00:26:00 | 000,157,088 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\libpng.dll

MOD - [2013.01.08 00:26:00 | 000,136,608 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\libexpatw.dll

MOD - [2013.01.08 00:26:00 | 000,087,456 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\zlib.dll

MOD - [2013.01.08 00:25:59 | 000,128,416 | ---- | M] () -- C:\Program Files (x86)\Tencent\QQIntl\Bin\QQ.exe

MOD - [2012.07.09 04:49:28 | 000,063,208 | ---- | M] () -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\5.4.43.3217\WordStrokeHelper32.dll

MOD - [2012.07.09 04:49:20 | 000,016,104 | ---- | M] () -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\Stable\Acrobat2Dict.dll

MOD - [2012.07.05 13:37:26 | 000,095,936 | ---- | M] () -- C:\Users\dk\AppData\Local\Youdao\Dict\Application\5.4.43.3217\CrashRpt.dll

 

 
 ========== Services (SafeList) ==========

 

SRV:64bit: - [2013.03.26 18:23:32 | 000,230,416 | ---- | M] (Nitro PDF Software) [Disabled | Stopped] -- C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe -- (NitroReaderDriverReadSpool3)

SRV:64bit: - [2013.02.08 20:30:42 | 000,359,664 | ---- | M] (Logitech, Inc.) [Disabled | Stopped] -- C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe -- (LBTServ)

SRV:64bit: - [2009.07.14 03:41:27 | 001,011,712 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)

SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)

SRV:64bit: - [2009.07.14 03:39:46 | 000,027,136 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\svchost.exe -- (QTService)

SRV - [2013.03.29 15:29:41 | 000,253,656 | ---- | M] (Adobe Systems Incorporated) [Disabled | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)

SRV - [2013.03.24 13:31:21 | 000,655,624 | ---- | M] (Acresso Software Inc.) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe -- (FLEXnet Licensing Service)

SRV - [2013.01.08 13:53:48 | 000,161,536 | R--- | M] (Skype Technologies) [Disabled | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)

SRV - [2013.01.06 21:26:57 | 000,123,992 | ---- | M] (Kingsoft Corporation) [Auto | Running] -- c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe -- (kxescore)

SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)

SRV - [2009.09.02 09:46:18 | 000,192,000 | ---- | M] (IVT Corporation) [On_Demand | Running] -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsHelpCS.exe -- (BsHelpCS)

SRV - [2009.09.02 09:41:24 | 001,466,476 | ---- | M] (IVT Corporation) [Auto | Running] -- C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe -- (BlueSoleilCS)

SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)

SRV - [2008.11.09 22:48:14 | 000,602,392 | ---- | M] (Yahoo! Inc.) [Disabled | Stopped] -- C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe -- (YahooAUService)

SRV - [2007.05.31 11:11:54 | 000,443,784 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\wcescomm.dll -- (WcesComm)

SRV - [2007.05.31 11:11:46 | 000,225,672 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Windows\WindowsMobile\rapimgr.dll -- (RapiMgr)

 

 
 ========== Driver Services (SafeList) ==========

 

DRV:64bit: - [2013.04.03 21:20:19 | 000,163,920 | ---- | M] (TENCENT) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\TesSafe.sys -- (TesSafe)

DRV:64bit: - [2013.03.07 13:21:28 | 000,038,664 | ---- | M] (Spotflux, Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tapSF0901.sys -- (tapSF0901)

DRV:64bit: - [2013.01.09 05:46:34 | 000,294,248 | ---- | M] (Microsoft Corporation) [Kernel | System | Running] -- C:\Windows\SysNative\Treiber\VMM.sys -- (vmm)

DRV:64bit: - [2013.01.06 21:27:01 | 000,210,296 | ---- | M] (Kingsoft Corporation) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\kisknl.sys -- (kisknl)

DRV:64bit: - [2013.01.06 21:27:01 | 000,031,848 | ---- | M] (Kingsoft Corporation) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\kavbootc64.sys -- (kavbootc)

DRV:64bit: - [2013.01.03 10:17:38 | 000,077,192 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LHidFilt.Sys -- (LHidFilt)

DRV:64bit: - [2013.01.03 10:17:38 | 000,061,832 | ---- | M] (Logitech, Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\LMouFilt.Sys -- (LMouFilt)

DRV:64bit: - [2012.12.25 14:34:10 | 000,024,728 | ---- | M] () [File_System | Boot | Running] -- C:\Windows\SysNative\drivers\TSysCare64.sys -- (TSysCare)

DRV:64bit: - [2012.12.19 15:47:20 | 000,132,008 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)

DRV:64bit: - [2012.10.28 17:09:54 | 000,038,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tap0901.sys -- (tap0901)

DRV:64bit: - [2012.08.23 16:10:20 | 000,019,456 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\rdpvideominiport.sys -- (RdpVideoMiniport)

DRV:64bit: - [2012.08.23 16:07:35 | 000,057,856 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)

DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)

DRV:64bit: - [2011.08.05 11:24:26 | 000,292,024 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfbd.sys -- (Tosrfbd)

DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)

DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)

DRV:64bit: - [2011.02.11 20:16:38 | 010,628,640 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\igdkmd64.sys -- (igfx)

DRV:64bit: - [2011.01.27 16:27:04 | 000,067,384 | ---- | M] (TOSHIBA CORPORATION) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfusb.sys -- (Tosrfusb)

DRV:64bit: - [2010.11.29 12:47:00 | 000,082,224 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosrfcom.sys -- (Tosrfcom)

DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)

DRV:64bit: - [2010.08.30 11:48:00 | 000,094,528 | ---- | M] (TOSHIBA Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\Tosrfhid.sys -- (Tosrfhid)

DRV:64bit: - [2010.07.01 19:11:24 | 000,012,352 | ---- | M] () [Kernel | "Start" not found. | Unknown] -- C:\Program Files\Unlocker\UnlockerDriver5.sys -- (UnlockerDriver5)

DRV:64bit: - [2010.04.29 07:55:42 | 000,032,768 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\androidusb.sys -- (androidusb)

DRV:64bit: - [2010.04.26 12:48:00 | 000,063,488 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TosRfSnd.sys -- (TosRfSnd)

DRV:64bit: - [2009.12.07 20:53:26 | 000,117,504 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\ewusbmdm.sys -- (hwdatacard)

DRV:64bit: - [2009.12.01 23:19:16 | 000,649,472 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emBDA64.sys -- (USB28xxBGA)

DRV:64bit: - [2009.12.01 23:18:32 | 000,617,216 | ---- | M] (eMPIA Technology, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\emOEM64.sys -- (USB28xxOEM)

DRV:64bit: - [2009.10.20 18:20:36 | 000,114,608 | ---- | M] (Philips Applied Technologies) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\phaudlwr.sys -- (phaudlwr)

DRV:64bit: - [2009.10.07 09:49:28 | 006,379,288 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvuvc64.sys -- (LVUVC64)

DRV:64bit: - [2009.10.07 09:47:46 | 000,327,704 | ---- | M] (Logitech Inc.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\lvrs64.sys -- (LVRS64)

DRV:64bit: - [2009.08.28 16:05:00 | 000,043,912 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VCommMgr.sys -- (VcommMgr)

DRV:64bit: - [2009.08.28 16:04:44 | 000,047,880 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btcusb.sys -- (Btcsrusb)

DRV:64bit: - [2009.08.26 12:18:20 | 000,034,440 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\btnetBus.sys -- (IvtPanBusSrv)

DRV:64bit: - [2009.08.26 12:18:20 | 000,034,440 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btnetBus.sys -- (btnetBUs)

DRV:64bit: - [2009.08.26 11:16:52 | 000,030,344 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\IvtBtBus.sys -- (IvtBtBUs)

DRV:64bit: - [2009.08.26 11:16:52 | 000,030,344 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\IvtBtBus.sys -- (IvtAudioBusSrv)

DRV:64bit: - [2009.08.26 11:16:44 | 000,024,840 | ---- | M] (IVT Corporation.) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\BtHidBus.sys -- (BtHidBus)

DRV:64bit: - [2009.08.26 11:16:36 | 000,020,872 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\VHIDMini.sys -- (VHidMinidrv)

DRV:64bit: - [2009.08.26 11:16:20 | 000,017,032 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VComm.sys -- (VComm)

DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)

DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)

DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)

DRV:64bit: - [2009.07.14 01:21:48 | 000,038,400 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\tpm.sys -- (TPM)

DRV:64bit: - [2009.06.17 14:02:44 | 000,020,488 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\btnetdrv.sys -- (BT)

DRV:64bit: - [2009.06.17 14:02:20 | 000,036,872 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\BlueletSCOAudio.sys -- (BlueletSCOAudio)

DRV:64bit: - [2009.06.17 14:02:12 | 000,036,360 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\blueletaudio.sys -- (BlueletAudio)

DRV:64bit: - [2009.06.17 13:01:00 | 000,054,664 | ---- | M] (TOSHIBA Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\tosporte.sys -- (tosporte)

DRV:64bit: - [2009.06.10 22:35:02 | 000,220,672 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\e1k60x64.sys -- (e1kexpress)

DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)

DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)

DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)

DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)

DRV:64bit: - [2009.06.09 05:18:20 | 000,053,816 | ---- | M] (Samsung Electronics Co., Ltd.) [Kernel | Auto | Stopped] -- C:\Windows\SysNative\drivers\DGIVECP.SYS -- (DgiVecp)

DRV:64bit: - [2009.04.29 17:28:30 | 000,030,208 | ---- | M] (Windows (R) Codename Longhorn DDK provider) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\KMWDFILTER.sys -- (KMWDFILTER)

DRV:64bit: - [2008.06.12 08:40:13 | 000,085,424 | ---- | M] (PowerISO Computing, Inc.) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\scdemu.sys -- (SCDEmu)

DRV:64bit: - [2008.02.05 02:50:42 | 000,079,416 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VMNetSrv.sys -- (VPCNetS2)

DRV:64bit: - [2008.01.10 20:34:52 | 000,011,576 | ---- | M] (Samsung Electronics) [Kernel | Auto | Running] -- C:\Windows\SysNative\drivers\SSPORT.SYS -- (SSPORT)

DRV:64bit: - [2007.12.04 09:31:00 | 003,249,024 | ---- | M] () [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\spc1000.sys -- (SPC1000)

DRV - [2013.01.06 21:27:01 | 000,164,696 | ---- | M] (Kingsoft Corporation) [Kernel | System | Running] -- c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys -- (KDHacker)

DRV - [2013.01.06 21:26:58 | 000,018,296 | ---- | M] (Kingsoft Corporation) [Kernel | Disabled | Running] -- C:\Program Files (x86)\kingsoft\kingsoft antivirus\kusbquery64.sys -- (KUsbGuard)

DRV - [2012.12.26 12:47:40 | 000,073,784 | ---- | M] (Tencent) [Kernel | Boot | Stopped] -- C:\Windows\SysWOW64\drivers\TsFltMgr.sys -- (TsFltMgr)

DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)

DRV - [2009.06.17 14:02:12 | 000,036,360 | ---- | M] (IVT Corporation.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\blueletaudio.sys -- (BlueletAudio)

DRV - [2004.05.05 21:48:40 | 000,004,228 | ---- | M] (PowerQuest Corporation) [Kernel | System | Stopped] -- C:\Windows\SysWow64\drivers\PQNTDRV.sys -- (PQNTDrv)

 

 
 ========== Standard Registry (SafeList) ==========

 

 
 ========== Internet Explorer ==========

 

IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm

IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}

IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC

 

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = Google

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = MSN Deutschland: Aktuelle Nachrichten, Outlook.com Email und Skype Login.

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de

IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 33 5A A2 E6 47 EC CD 01  [binary data]

IE - HKCU\..\SearchScopes,DefaultScope = {6A1806CD-94D4-4689-BA73-E35EA1EA9990}

IE - HKCU\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE10SR

IE - HKCU\..\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}: "URL" = hxxp://www2.delta-search.com/?q={searchTerms}&affID=119816&tt=gc_&babsrc=SP_ss&mntrId=E6A500FF7A2C38D5

IE - HKCU\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7

IE - HKCU\..\SearchScopes\{B8E20CD7-BAC2-4820-9AA6-1060B3AF25E2}: "URL" = hxxp://www.baidu.com/s?wd={searchTerms}&ie={inputEncoding}&oe={outputEncoding}&abar=2&tn=20041099_oem_dg&ch=33

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0

IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyOverride" = *.local

 

 
 ========== FireFox ==========

 

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.7.2: C:\Windows\system32\npDeployJava1.dll (Oracle Corporation)

FF:64bit: - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.7.2: C:\Program Files\Java\jre7\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/DTPlugin,version=10.5.1: C:\Windows\SysWOW64\npDeployJava1.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin,version=10.5.1: C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\plugin2\npjp2.dll (Oracle Corporation)

FF - HKLM\Software\MozillaPlugins\@messenger.yahoo.com/YahooMessengerStatePlugin;version=1.0.0.6: C:\Program Files (x86)\Yahoo!\Shared\npYState.dll (Yahoo! Inc.)

FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files (x86)\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation)

FF - HKLM\Software\MozillaPlugins\@nitropdf.com/NitroPDF: C:\Program Files (x86)\Nitro\Reader 3\npnitromozilla.dll (Nitro PDF)

FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall: C:\Program Files (x86)\Common Files\Tencent\NPQSCALL\npqscall.dll (Tencent)

FF - HKLM\Software\MozillaPlugins\@qq.com/npqscall,version=1.0.0: %commonprogramfiles%\tencent\NPQSCALL\npqscall.dll File not found

FF - HKLM\Software\MozillaPlugins\@qq.com/QQPhotoDrawEx: C:\Program Files (x86)\Tencent\Qzone\npQQPhotoDrawEx.dll ()

FF - HKLM\Software\MozillaPlugins\@qq.com/QzoneMusic: C:\Program Files (x86)\Tencent\QQMusic\npQzoneMusic.dll (Tencent)

FF - HKLM\Software\MozillaPlugins\@qq.com/TXSSO: C:\Program Files (x86)\Common Files\Tencent\TXSSO\1.2.1.87\Bin\npSSOAxCtrlForPTLogin.dll (Tencent)

FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodInsert: C:\Program Files (x86)\QvodPlayer\npQvodInsert.dll (Shenzhen QVOD Technology Co.,Ltd)

FF - HKLM\Software\MozillaPlugins\@qvod.com/QvodShare: C:\Program Files (x86)\QvodPlayer\npShareModule.dll (Shenzhen QVOD Technology Co.,Ltd)

FF - HKLM\Software\MozillaPlugins\@videolan.org/vlc,version=2.0.5: C:\Program Files (x86)\VideoLAN\VLC\npvlc.dll (VideoLAN)

FF - HKCU\Software\MozillaPlugins\duowan.com/Checker: C:\Program Files (x86)\Common Files\duowan\yy4.0\YYSSO\1.0.0.3\npChecker.dll (广州多玩信息技术有限公司)

 

FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{F003DA68-8256-4b37-A6C4-350FA04494DF}: C:\Program Files\Logitech\SetPointP\LogiSmoothFirefoxExt [2013.03.23 11:21:47 | 000,000,000 | ---D | M]

 

[2013.05.02 22:46:56 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files (x86)\mozilla firefox\extensions

 

Hosts file not found

O2:64bit: - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files\Java\jre7\bin\ssv.dll (Oracle Corporation)

O2:64bit: - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D298} - C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend_x64.dll (Shenzhen QVOD Technology Co.,Ltd)

O2:64bit: - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\SetPointSmooth.dll (Logitech, Inc.)

O2:64bit: - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files\Java\jre7\bin\jp2ssv.dll (Oracle Corporation)

O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\ssv.dll (Oracle Corporation)

O2 - BHO: (QvodExtend) - {A8502600-B272-4F68-A67B-A0305D46D297} - C:\Program Files (x86)\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend.dll (Shenzhen QVOD Technology Co.,Ltd)

O2 - BHO: (Logitech SetPoint) - {AF949550-9094-4807-95EC-D1C317803333} - C:\Program Files\Logitech\SetPointP\32-bit\SetPointSmooth.dll (Logitech, Inc.)

O2 - BHO: (Java(tm) Plug-In 2 SSV Helper) - {DBC80044-A445-435b-BC74-9C25C1C588A9} - C:\Program Files (x86)\Oracle\JavaFX 2.1 Runtime\bin\jp2ssv.dll (Oracle Corporation)

O3:64bit: - HKLM\..\Toolbar: (no name) - {ae07101b-46d4-4a98-af68-0333ea26e113} - No CLSID value found.

O4:64bit: - HKLM..\Run: [HotKeysCmds] C:\Windows\SysNative\hkcmd.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Persistence] C:\Windows\SysNative\igfxpers.exe (Intel Corporation)

O4:64bit: - HKLM..\Run: [Windows Mobile Device Center] C:\Windows\WindowsMobile\wmdc.exe (Microsoft Corporation)

O4 - HKLM..\Run: [BtTray] C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe (IVT Corporation)

O4 - HKLM..\Run: [kxesc] c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe (Kingsoft Corporation)

O4 - HKCU..\Run: [QTalk] C:\Program Files (x86)\Tencent\QTalk\V3.8.6\Bin\QTalk.exe (Tencent)

O4 - HKCU..\Run: [YY] C:\Program Files (x86)\yy\yy-5\YY.exe (YY Inc.)

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 221

O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5

O8:64bit: - Extra context menu item: 收藏到有道云笔记 - C:\Program Files (x86)\Youdao\YNote\ieext_menu.htm ()

O8 - Extra context menu item: 收藏到有道云笔记 - C:\Program Files (x86)\Youdao\YNote\ieext_menu.htm ()

O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation)

O9 - Extra Button: 收藏到有道云笔记 - {65D09F88-CE18-4A95-B8AF-311C3311DB03} - C:\Program Files (x86)\Youdao\YNote\ieext_btn.htm ()

O9 - Extra Button: ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O9 - Extra 'Tools' menuitem : ICQ7.4 - {73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - C:\Program Files (x86)\ICQ7.4\ICQ.exe (ICQ, LLC.)

O10 - NameSpace_Catalog5\Catalog_Entries\000000000009 [] - C:\Program Files (x86)\Bonjour\mdnsNSP.dll File not found

O1364bit: - gopher Prefix: missing

O13 - gopher Prefix: missing

O16:64bit: - DPF: {D27CDB6E-AE6D-11CF-96B8-444553540000} hxxp://fpdownload2.macromedia.com/get/shockwave/cabs/flash/swflash.cab (Shockwave Flash Object)

O16 - DPF: {3ABECEEC-DD81-4511-A7FD-B3B657B64892} hxxp://3gsoft.gtimg.com/sd/resource/cobrahall/2013/01/17/15/QQGameAssist.cab (AXDownload Class)

O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{34672EC1-93FF-4B33-A99E-DFEF97C19111}: DhcpNameServer = 192.168.178.1

O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{7A2C38D5-A295-4C23-82EF-1F2A414AF71A}: DhcpNameServer = 44.0.0.253 44.0.0.3 44.0.0.4 8.8.8.8

O18:64bit: - Protocol\Handler\livecall - No CLSID value found

O18:64bit: - Protocol\Handler\msnim - No CLSID value found

O18:64bit: - Protocol\Handler\skype4com - No CLSID value found

O18 - Protocol\Handler\livecall - No CLSID value found

O18 - Protocol\Handler\msnim - No CLSID value found

O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Windows\SysWOW64\skype4com.dll (Skype Technologies)

O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)

O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)

O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)

O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)

O20:64bit: - Winlogon\Notify\igfxcui: DllName - (igfxdev.dll) - C:\Windows\SysNative\igfxdev.dll (Intel Corporation)

O20:64bit: - Winlogon\Notify\LBTWlgn: DllName - (c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll) - c:\program files\common files\logishrd\bluetooth\LBTWlgn.dll (Logitech, Inc.)

O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.

O32 - HKLM CDRom: AutoRun - 1

O34 - HKLM BootExecute: (autocheck autochk *)

O35:64bit: - HKLM\..comfile [open] -- "%1" %*

O35:64bit: - HKLM\..exefile [open] -- "%1" %*

O35 - HKLM\..comfile [open] -- "%1" %*

O35 - HKLM\..exefile [open] -- "%1" %*

O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*

O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*

O37 - HKLM\...com [@ = comfile] -- "%1" %*

O37 - HKLM\...exe [@ = exefile] -- "%1" %*

O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)

O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)

O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)

 
 ========== Files/Folders - Created Within 30 Days ==========

 

[2013.05.28 19:09:14 | 000,000,000 | ---D | C] -- C:\Users\root\Desktop\Notfall-CD-2.2

[2013.05.28 17:58:27 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\QuickStoresToolbar

[2013.05.28 17:58:24 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Unlocker

[2013.05.28 17:58:24 | 000,000,000 | ---D | C] -- C:\Program Files\Unlocker

[2013.05.28 17:33:14 | 000,000,000 | ---D | C] -- C:\Users\root\Desktop\ntdll

[2013.05.28 17:05:11 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\Diagnostics

[2013.05.26 01:36:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Norton PartitionMagic 8.0

[2013.05.26 01:36:00 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Symantec

[2013.05.23 23:26:03 | 000,000,000 | -HSD | C] -- C:\Config.Msi

[2013.05.22 21:23:17 | 000,000,000 | -H-D | C] -- C:\Windows\AxInstSV

[2013.05.18 20:50:55 | 005,191,704 | ---- | C] (Google Inc.) -- C:\Windows\SysNative\GooglePinyin2.ime

[2013.05.18 20:50:55 | 003,460,120 | ---- | C] (Google Inc.) -- C:\Windows\SysWow64\GooglePinyin2.ime

[2013.05.18 20:50:53 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Google

[2013.05.18 20:50:53 | 000,000,000 | ---D | C] -- C:\ProgramData\Google

[2013.05.18 20:50:53 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Google

[2013.05.18 18:46:10 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Duowan.com

[2013.05.18 18:46:08 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\yy

[2013.05.05 19:28:13 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Swift Sound

[2013.05.05 19:25:42 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NCH Software

[2013.05.05 19:25:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Audio Related Programs

[2013.05.05 19:25:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Switch Sound File Converter

[2013.05.05 19:25:33 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\NCH Swift Sound

[2013.05.05 19:18:41 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\NCH Swift Sound

[2013.05.05 18:38:58 | 000,000,000 | ---D | C] -- C:\ProgramData\NCH Software

[2013.05.05 11:34:17 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Local\bluesoleil

[2013.05.02 22:46:56 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Firefox

[2013.05.02 22:46:49 | 000,000,000 | ---D | C] -- C:\Users\root\AppData\Roaming\Babylon

[2013.05.02 22:46:49 | 000,000,000 | ---D | C] -- C:\ProgramData\Babylon

[2013.04.30 13:07:29 | 000,000,000 | ---D | C] -- C:\ProgramData\KRSHistory

 
 ========== Files - Modified Within 30 Days ==========

 

[2013.05.28 22:03:00 | 000,000,884 | ---- | M] () -- C:\Windows\tasks\Adobe Flash Player Updater.job

[2013.05.28 21:24:39 | 000,005,139 | ---- | M] () -- C:\Windows\SysWow64\LOCALSERVICE.INI

[2013.05.28 21:24:39 | 000,000,094 | ---- | M] () -- C:\Windows\SysWow64\LOCALDEVICE.INI

[2013.05.28 21:24:37 | 000,000,991 | ---- | M] () -- C:\Windows\SysWow64\bscs.ini

[2013.05.28 21:02:07 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0

[2013.05.28 21:02:07 | 000,016,944 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0

[2013.05.28 20:51:46 | 000,000,000 | ---- | M] () -- C:\Windows\SysNative\drivers\lvuvc.hs

[2013.05.28 20:51:43 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat

[2013.05.28 20:51:39 | 1517,686,783 | -HS- | M] () -- C:\hiberfil.sys

[2013.05.28 19:04:04 | 548,011,982 | ---- | M] () -- C:\Users\root\Desktop\Notfall-CD-2.2.zip

[2013.05.28 18:25:52 | 000,000,185 | ---- | M] () -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickStores.url

[2013.05.28 17:26:10 | 016,095,864 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI

[2013.05.28 17:26:10 | 000,694,892 | ---- | M] () -- C:\Windows\SysNative\perfh00C.dat

[2013.05.28 17:26:10 | 000,693,840 | ---- | M] () -- C:\Windows\SysNative\perfh00A.dat

[2013.05.28 17:26:10 | 000,691,462 | ---- | M] () -- C:\Windows\SysNative\perfh013.dat

[2013.05.28 17:26:10 | 000,690,122 | ---- | M] () -- C:\Windows\SysNative\perfh015.dat

[2013.05.28 17:26:10 | 000,689,538 | ---- | M] () -- C:\Windows\SysNative\perfh010.dat

[2013.05.28 17:26:10 | 000,679,694 | ---- | M] () -- C:\Windows\SysNative\prfh0816.dat

[2013.05.28 17:26:10 | 000,676,252 | ---- | M] () -- C:\Windows\SysNative\perfh019.dat

[2013.05.28 17:26:10 | 000,664,104 | ---- | M] () -- C:\Windows\SysNative\prfh0416.dat

[2013.05.28 17:26:10 | 000,653,454 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat

[2013.05.28 17:26:10 | 000,632,734 | ---- | M] () -- C:\Windows\SysNative\perfh00E.dat

[2013.05.28 17:26:10 | 000,623,720 | ---- | M] () -- C:\Windows\SysNative\perfh005.dat

[2013.05.28 17:26:10 | 000,618,174 | ---- | M] () -- C:\Windows\SysNative\perfh01D.dat

[2013.05.28 17:26:10 | 000,616,484 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat

[2013.05.28 17:26:10 | 000,610,676 | ---- | M] () -- C:\Windows\SysNative\perfh01F.dat

[2013.05.28 17:26:10 | 000,551,996 | ---- | M] () -- C:\Windows\SysNative\perfh008.dat

[2013.05.28 17:26:10 | 000,462,594 | ---- | M] () -- C:\Windows\SysNative\perfh006.dat

[2013.05.28 17:26:10 | 000,449,064 | ---- | M] () -- C:\Windows\SysNative\perfh014.dat

[2013.05.28 17:26:10 | 000,435,122 | ---- | M] () -- C:\Windows\SysNative\perfh001.dat

[2013.05.28 17:26:10 | 000,434,058 | ---- | M] () -- C:\Windows\SysNative\perfh00B.dat

[2013.05.28 17:26:10 | 000,400,794 | ---- | M] () -- C:\Windows\SysNative\perfh012.dat

[2013.05.28 17:26:10 | 000,389,694 | ---- | M] () -- C:\Windows\SysNative\perfh011.dat

[2013.05.28 17:26:10 | 000,379,188 | ---- | M] () -- C:\Windows\SysNative\prfh0404.dat

[2013.05.28 17:26:10 | 000,363,044 | ---- | M] () -- C:\Windows\SysNative\prfh0804.dat

[2013.05.28 17:26:10 | 000,354,348 | ---- | M] () -- C:\Windows\SysNative\perfh00D.dat

[2013.05.28 17:26:10 | 000,148,698 | ---- | M] () -- C:\Windows\SysNative\perfc00E.dat

[2013.05.28 17:26:10 | 000,137,472 | ---- | M] () -- C:\Windows\SysNative\perfc00A.dat

[2013.05.28 17:26:10 | 000,135,250 | ---- | M] () -- C:\Windows\SysNative\perfc015.dat

[2013.05.28 17:26:10 | 000,134,154 | ---- | M] () -- C:\Windows\SysNative\prfc0816.dat

[2013.05.28 17:26:10 | 000,133,320 | ---- | M] () -- C:\Windows\SysNative\perfc013.dat

[2013.05.28 17:26:10 | 000,132,930 | ---- | M] () -- C:\Windows\SysNative\perfc019.dat

[2013.05.28 17:26:10 | 000,130,566 | ---- | M] () -- C:\Windows\SysNative\perfc00C.dat

[2013.05.28 17:26:10 | 000,130,160 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat

[2013.05.28 17:26:10 | 000,128,514 | ---- | M] () -- C:\Windows\SysNative\prfc0416.dat

[2013.05.28 17:26:10 | 000,127,550 | ---- | M] () -- C:\Windows\SysNative\perfc010.dat

[2013.05.28 17:26:10 | 000,124,250 | ---- | M] () -- C:\Windows\SysNative\perfc01D.dat

[2013.05.28 17:26:10 | 000,122,252 | ---- | M] () -- C:\Windows\SysNative\perfc005.dat

[2013.05.28 17:26:10 | 000,122,046 | ---- | M] () -- C:\Windows\SysNative\perfc01F.dat

[2013.05.28 17:26:10 | 000,106,864 | ---- | M] () -- C:\Windows\SysNative\perfc011.dat

[2013.05.28 17:26:10 | 000,106,864 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat

[2013.05.28 17:26:10 | 000,105,380 | ---- | M] () -- C:\Windows\SysNative\perfc012.dat

[2013.05.28 17:26:10 | 000,104,724 | ---- | M] () -- C:\Windows\SysNative\prfc0804.dat

[2013.05.28 17:26:10 | 000,099,810 | ---- | M] () -- C:\Windows\SysNative\prfc0404.dat

[2013.05.28 17:26:10 | 000,089,794 | ---- | M] () -- C:\Windows\SysNative\perfc008.dat

[2013.05.28 17:26:10 | 000,082,590 | ---- | M] () -- C:\Windows\SysNative\perfc00B.dat

[2013.05.28 17:26:10 | 000,080,278 | ---- | M] () -- C:\Windows\SysNative\perfc006.dat

[2013.05.28 17:26:10 | 000,079,460 | ---- | M] () -- C:\Windows\SysNative\perfc001.dat

[2013.05.28 17:26:10 | 000,077,562 | ---- | M] () -- C:\Windows\SysNative\perfc014.dat

[2013.05.28 17:26:10 | 000,069,570 | ---- | M] () -- C:\Windows\SysNative\perfc00D.dat

[2013.05.28 16:37:23 | 000,018,960 | ---- | M] (Logitech, Inc.) -- C:\Windows\SysNative\drivers\LNonPnP.sys

[2013.05.26 12:51:49 | 000,000,261 | ---- | M] () -- C:\Windows\SysWow64\REMOTEDEVICE.INI

[2013.05.26 11:03:48 | 000,018,760 | ---- | M] () -- C:\Windows\SysWow64\QQVistaHelper.dll

[2013.05.20 19:28:49 | 000,002,718 | ---- | M] () -- C:\Windows\SysWow64\SHORTCUT.INI

[2013.05.18 20:50:55 | 005,191,704 | ---- | M] (Google Inc.) -- C:\Windows\SysNative\GooglePinyin2.ime

[2013.05.18 20:50:55 | 003,460,120 | ---- | M] (Google Inc.) -- C:\Windows\SysWow64\GooglePinyin2.ime

[2013.05.18 18:50:04 | 000,000,020 | ---- | M] () -- C:\Users\root\AppData\Roaming\004D5649544E41696E66

[2013.05.18 18:46:26 | 000,000,256 | ---- | M] () -- C:\Users\root\AppData\Roaming\0408002700AC0C

[2013.05.18 18:46:10 | 000,001,052 | ---- | M] () -- C:\Users\root\Desktop\YY.lnk

[2013.05.04 11:59:42 | 002,223,976 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT

 
 ========== Files Created - No Company Name ==========

 

[2013.05.28 18:58:36 | 548,011,982 | ---- | C] () -- C:\Users\root\Desktop\Notfall-CD-2.2.zip

[2013.05.28 17:58:27 | 000,000,185 | ---- | C] () -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QuickStores.url

[2013.05.18 18:50:04 | 000,000,020 | ---- | C] () -- C:\Users\root\AppData\Roaming\004D5649544E41696E66

[2013.05.18 18:46:10 | 000,001,052 | ---- | C] () -- C:\Users\root\Desktop\YY.lnk

[2013.04.17 13:58:42 | 000,002,718 | ---- | C] () -- C:\Windows\SysWow64\SHORTCUT.INI

[2013.04.17 13:54:26 | 000,000,261 | ---- | C] () -- C:\Windows\SysWow64\REMOTEDEVICE.INI

[2013.04.17 13:48:46 | 000,005,139 | ---- | C] () -- C:\Windows\SysWow64\LOCALSERVICE.INI

[2013.04.17 13:43:24 | 000,000,094 | ---- | C] () -- C:\Windows\SysWow64\LOCALDEVICE.INI

[2013.04.17 13:31:17 | 000,000,000 | ---- | C] () -- C:\Windows\SysWow64\BSPRINT.INI

[2013.04.15 12:54:57 | 000,723,230 | ---- | C] () -- C:\Windows\unins000.exe

[2013.04.15 12:54:57 | 000,048,009 | ---- | C] () -- C:\Windows\unins000.dat

[2013.02.10 22:59:45 | 000,000,256 | ---- | C] () -- C:\Users\root\AppData\Roaming\0408002700AC0C

[2013.01.11 18:18:56 | 000,430,992 | ---- | C] () -- C:\Windows\SysWow64\QGActiveX.dll

[2013.01.08 16:43:32 | 000,311,032 | ---- | C] () -- C:\Windows\SysWow64\IVTCredentialProvider.dll

[2013.01.08 01:34:18 | 000,479,232 | ---- | C] () -- C:\Windows\ssndii.exe

[2013.01.07 10:04:42 | 000,018,760 | ---- | C] () -- C:\Windows\SysWow64\QQVistaHelper.dll

[2013.01.06 23:08:46 | 000,000,017 | ---- | C] () -- C:\Users\root\AppData\Local\resmon.resmoncfg

[2012.06.29 22:15:24 | 000,064,000 | ---- | C] () -- C:\Windows\SysWow64\VMProtectSDK32.dll

 
 ========== ZeroAccess Check ==========

 

[2009.07.14 06:55:00 | 000,000,227 | RHS- | M] () -- C:\Windows\assembly\Desktop.ini

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

 

[HKEY_CURRENT_USER\Software\Classes\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32] /64

 

[HKEY_CURRENT_USER\Software\Classes\Wow6432node\clsid\{fbeb8a05-beee-4442-804e-409d6c4515e9}\InProcServer32]

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32] /64

"" = C:\Windows\SysNative\shell32.dll -- [2012.06.09 07:43:10 | 014,172,672 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{42aedc87-2188-41fd-b9a3-0c966feabec1}\InProcServer32]

"" = %SystemRoot%\system32\shell32.dll -- [2012.06.09 06:41:00 | 012,873,728 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Apartment

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\fastprox.dll -- [2009.07.14 03:40:51 | 000,909,312 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{5839FCA9-774D-42A1-ACDA-D6A79037F57F}\InProcServer32]

"" = %systemroot%\system32\wbem\fastprox.dll -- [2010.11.20 14:19:02 | 000,606,208 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Free

 

[HKEY_LOCAL_MACHINE\Software\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32] /64

"" = C:\Windows\SysNative\wbem\wbemess.dll -- [2009.07.14 03:41:56 | 000,505,856 | ---- | M] (Microsoft Corporation)

"ThreadingModel" = Both

 

[HKEY_LOCAL_MACHINE\Software\Wow6432Node\Classes\clsid\{F3130CDB-AA52-4C3A-AB32-85FFC23AF9C1}\InProcServer32]

 
 ========== Files - Unicode (All) ==========

[2013.05.26 11:04:04 | 000,001,222 | ---- | M] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QT??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QT语音.lnk

[2013.05.26 11:04:04 | 000,001,222 | ---- | C] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QT??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QT语音.lnk

[2013.05.26 11:04:04 | 000,001,198 | ---- | M] ()(C:\Users\root\Desktop\QT??.lnk) -- C:\Users\root\Desktop\QT语音.lnk

[2013.05.26 11:04:04 | 000,001,198 | ---- | C] ()(C:\Users\root\Desktop\QT??.lnk) -- C:\Users\root\Desktop\QT语音.lnk

[2013.05.18 18:49:39 | 000,001,138 | ---- | M] ()(C:\Users\root\Desktop\YY????.lnk) -- C:\Users\root\Desktop\YY游戏大厅.lnk

[2013.04.22 10:32:13 | 000,001,138 | ---- | C] ()(C:\Users\root\Desktop\YY????.lnk) -- C:\Users\root\Desktop\YY游戏大厅.lnk

[2013.04.15 13:18:55 | 000,001,945 | ---- | M] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\快播.lnk

[2013.04.15 13:18:55 | 000,001,927 | ---- | M] ()(C:\Users\Public\Desktop\??.lnk) -- C:\Users\Public\Desktop\快播.lnk

[2013.04.15 13:18:30 | 000,001,945 | ---- | C] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\快播.lnk

[2013.04.15 13:18:30 | 000,001,927 | ---- | C] ()(C:\Users\Public\Desktop\??.lnk) -- C:\Users\Public\Desktop\快播.lnk

[2013.03.19 00:27:59 | 000,001,167 | ---- | M] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk

[2013.03.19 00:27:59 | 000,001,167 | ---- | C] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ音乐.lnk

[2013.02.22 18:05:22 | 020,411,513 | ---- | M] ()(C:\Users\Public\Documents\QT?? 3.5.rar) -- C:\Users\Public\Documents\QT语音 3.5.rar

[2013.02.22 18:05:01 | 020,411,513 | ---- | C] ()(C:\Users\Public\Documents\QT?? 3.5.rar) -- C:\Users\Public\Documents\QT语音 3.5.rar

[2013.01.09 18:04:41 | 000,001,129 | ---- | M] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ游戏.lnk

[2013.01.09 18:04:41 | 000,001,129 | ---- | C] ()(C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ??.lnk) -- C:\Users\root\Application Data\Microsoft\Internet Explorer\Quick Launch\QQ游戏.lnk

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\????) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯软件

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\????) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\腾讯游戏

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\??) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\有道

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\??) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\小米

(C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\??) -- C:\Users\root\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\多玩

(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯软件

(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\腾讯游戏

(C:\ProgramData\Microsoft\Windows\Start Menu\Programs\????) -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\快播软件

 
 ========== Alternate Data Streams ==========

 

@Alternate Data Stream - 130 bytes -> C:\ProgramData\TEMP:05E9FFE5
 

< End of report >

--- --- ---

Frage: ist das der Einzige PC im Haus?
Downloade dir bitte

TDSSKiller.exe und speichere diese Datei auf dem Desktop

Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
Drücke Start Scan
Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt

Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

Nein, ist nicht der einzige Rechner.

TDSSKILLER hat nichts gefunden.

da steht, log auf alle fälle posten, also, poste es bitte.
wie viele Rechner sinds noch?

Entschuldige, den Hinweis have ich wohl übersehen. hier das Log:
Es sind noch 2 notebooks per WLAN, und 5 Desktops per Kabel verbunden. Alle werden nur sehr selten benutzt.

Code:

12:06:34.0040 6984  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42

12:06:35.0821 6984  ============================================================

12:06:35.0821 6984  Current date / time: 2013/05/29 12:06:35.0821

12:06:35.0821 6984  SystemInfo:

12:06:35.0821 6984  

12:06:35.0821 6984  OS Version: 6.1.7601 ServicePack: 1.0

12:06:35.0821 6984  Product type: Workstation

12:06:35.0821 6984  ComputerName: W7

12:06:35.0822 6984  UserName: root

12:06:35.0822 6984  Windows directory: C:\Windows

12:06:35.0822 6984  System windows directory: C:\Windows

12:06:35.0822 6984  Running under WOW64

12:06:35.0822 6984  Processor architecture: Intel x64

12:06:35.0822 6984  Number of processors: 2

12:06:35.0822 6984  Page size: 0x1000

12:06:35.0822 6984  Boot type: Normal boot

12:06:35.0822 6984  ============================================================

12:06:36.0697 6984  Drive \Device\Harddisk0\DR0 - Size: 0x5D2710DE00 (372.61 Gb), SectorSize: 0x200, Cylinders: 0xBE01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

12:06:36.0702 6984  ============================================================

12:06:36.0702 6984  \Device\Harddisk0\DR0:

12:06:36.0702 6984  MBR partitions:

12:06:36.0702 6984  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x2E937800

12:06:36.0702 6984  ============================================================

12:06:36.0732 6984  C: <-> \Device\Harddisk0\DR0\Partition1

12:06:36.0733 6984  ============================================================

12:06:36.0733 6984  Initialize success

12:06:36.0733 6984  ============================================================

12:06:43.0451 4368  ============================================================

12:06:43.0451 4368  Scan started

12:06:43.0451 4368  Mode: Manual; 

12:06:43.0451 4368  ============================================================

12:06:44.0552 4368  ================ Scan system memory ========================

12:06:44.0552 4368  System memory - ok

12:06:44.0552 4368  ================ Scan services =============================

12:06:44.0830 4368  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys

12:06:44.0832 4368  1394ohci - ok

12:06:44.0887 4368  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

12:06:44.0890 4368  ACPI - ok

12:06:44.0911 4368  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

12:06:44.0912 4368  AcpiPmi - ok

12:06:45.0033 4368  [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

12:06:45.0035 4368  AdobeFlashPlayerUpdateSvc - ok

12:06:45.0085 4368  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys

12:06:45.0087 4368  adp94xx - ok

12:06:45.0120 4368  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys

12:06:45.0122 4368  adpahci - ok

12:06:45.0135 4368  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys

12:06:45.0136 4368  adpu320 - ok

12:06:45.0166 4368  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

12:06:45.0167 4368  AeLookupSvc - ok

12:06:45.0206 4368  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\Windows\system32\drivers\afd.sys

12:06:45.0209 4368  AFD - ok

12:06:45.0254 4368  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys

12:06:45.0254 4368  agp440 - ok

12:06:45.0271 4368  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe

12:06:45.0272 4368  ALG - ok

12:06:45.0312 4368  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys

12:06:45.0312 4368  aliide - ok

12:06:45.0316 4368  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys

12:06:45.0317 4368  amdide - ok

12:06:45.0330 4368  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys

12:06:45.0330 4368  AmdK8 - ok

12:06:45.0335 4368  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys

12:06:45.0336 4368  AmdPPM - ok

12:06:45.0361 4368  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

12:06:45.0362 4368  amdsata - ok

12:06:45.0378 4368  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys

12:06:45.0379 4368  amdsbs - ok

12:06:45.0402 4368  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys

12:06:45.0403 4368  amdxata - ok

12:06:45.0437 4368  [ 363571BC0C79E394E69300D1F2E3DDAE ] androidusb      C:\Windows\system32\Drivers\androidusb.sys

12:06:45.0437 4368  androidusb - ok

12:06:45.0461 4368  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys

12:06:45.0462 4368  AppID - ok

12:06:45.0485 4368  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

12:06:45.0486 4368  AppIDSvc - ok

12:06:45.0530 4368  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo         C:\Windows\System32\appinfo.dll

12:06:45.0531 4368  Appinfo - ok

12:06:45.0574 4368  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt         C:\Windows\System32\appmgmts.dll

12:06:45.0576 4368  AppMgmt - ok

12:06:45.0591 4368  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\DRIVERS\arc.sys

12:06:45.0591 4368  arc - ok

12:06:45.0600 4368  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys

12:06:45.0601 4368  arcsas - ok

12:06:45.0637 4368  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

12:06:45.0638 4368  AsyncMac - ok

12:06:45.0656 4368  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys

12:06:45.0657 4368  atapi - ok

12:06:45.0696 4368  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

12:06:45.0699 4368  AudioEndpointBuilder - ok

12:06:45.0709 4368  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll

12:06:45.0712 4368  AudioSrv - ok

12:06:45.0739 4368  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll

12:06:45.0740 4368  AxInstSV - ok

12:06:45.0780 4368  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys

12:06:45.0783 4368  b06bdrv - ok

12:06:45.0822 4368  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

12:06:45.0823 4368  b57nd60a - ok

12:06:45.0859 4368  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll

12:06:45.0860 4368  BDESVC - ok

12:06:45.0885 4368  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys

12:06:45.0885 4368  Beep - ok

12:06:45.0939 4368  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll

12:06:45.0942 4368  BFE - ok

12:06:45.0973 4368  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll

12:06:45.0977 4368  BITS - ok

12:06:46.0012 4368  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys

12:06:46.0013 4368  blbdrive - ok

12:06:46.0057 4368  [ 8BC053CD1F5F11F79C80BE85BC289258 ] BlueletAudio    C:\Windows\system32\DRIVERS\blueletaudio.sys

12:06:46.0057 4368  BlueletAudio - ok

12:06:46.0091 4368  [ 46134C260E6B019AA24506B8AB4D42D3 ] BlueletSCOAudio C:\Windows\system32\DRIVERS\BlueletSCOAudio.sys

12:06:46.0091 4368  BlueletSCOAudio - ok

12:06:46.0194 4368  [ 941E435E5A903CC60E50E72037FA39D0 ] BlueSoleilCS    C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

12:06:46.0201 4368  BlueSoleilCS - ok

12:06:46.0230 4368  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

12:06:46.0231 4368  bowser - ok

12:06:46.0258 4368  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys

12:06:46.0259 4368  BrFiltLo - ok

12:06:46.0270 4368  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys

12:06:46.0270 4368  BrFiltUp - ok

12:06:46.0293 4368  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll

12:06:46.0294 4368  Browser - ok

12:06:46.0320 4368  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

12:06:46.0321 4368  Brserid - ok

12:06:46.0334 4368  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

12:06:46.0335 4368  BrSerWdm - ok

12:06:46.0338 4368  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

12:06:46.0339 4368  BrUsbMdm - ok

12:06:46.0342 4368  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

12:06:46.0343 4368  BrUsbSer - ok

12:06:46.0367 4368  [ 403E99F6DDB6CE624E0F81A554AFF178 ] BsHelpCS        C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsHelpCS.exe

12:06:46.0368 4368  BsHelpCS - ok

12:06:46.0397 4368  [ EA05E37130B94670E8AA3379EAFAE22E ] BT              C:\Windows\system32\DRIVERS\btnetdrv.sys

12:06:46.0397 4368  BT - ok

12:06:46.0401 4368  BTCOM - ok

12:06:46.0445 4368  [ 8BFBA6EBB2654DEF3EBD4D882BAB8EE6 ] Btcsrusb        C:\Windows\system32\Drivers\btcusb.sys

12:06:46.0445 4368  Btcsrusb - ok

12:06:46.0495 4368  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum         C:\Windows\system32\DRIVERS\BthEnum.sys

12:06:46.0495 4368  BthEnum - ok

12:06:46.0533 4368  [ 81229822FACAA324718B3B3C973688ED ] BtHidBus        C:\Windows\system32\Drivers\BtHidBus.sys

12:06:46.0534 4368  BtHidBus - ok

12:06:46.0552 4368  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys

12:06:46.0552 4368  BTHMODEM - ok

12:06:46.0575 4368  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys

12:06:46.0576 4368  BthPan - ok

12:06:46.0608 4368  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT         C:\Windows\system32\Drivers\BTHport.sys

12:06:46.0611 4368  BTHPORT - ok

12:06:46.0647 4368  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll

12:06:46.0648 4368  bthserv - ok

12:06:46.0676 4368  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\system32\Drivers\BTHUSB.sys

12:06:46.0676 4368  BTHUSB - ok

12:06:46.0697 4368  [ 2531372CC2AD7C7204A7520DC7C2D0DA ] btnetBUs        C:\Windows\system32\Drivers\btnetBus.sys

12:06:46.0697 4368  btnetBUs - ok

12:06:46.0730 4368  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

12:06:46.0731 4368  cdfs - ok

12:06:46.0791 4368  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

12:06:46.0792 4368  cdrom - ok

12:06:46.0825 4368  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll

12:06:46.0825 4368  CertPropSvc - ok

12:06:46.0856 4368  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys

12:06:46.0856 4368  circlass - ok

12:06:46.0890 4368  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys

12:06:46.0892 4368  CLFS - ok

12:06:46.0951 4368  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

12:06:46.0952 4368  clr_optimization_v2.0.50727_32 - ok

12:06:47.0015 4368  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

12:06:47.0016 4368  clr_optimization_v2.0.50727_64 - ok

12:06:47.0084 4368  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

12:06:47.0085 4368  clr_optimization_v4.0.30319_32 - ok

12:06:47.0120 4368  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

12:06:47.0121 4368  clr_optimization_v4.0.30319_64 - ok

12:06:47.0163 4368  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys

12:06:47.0163 4368  CmBatt - ok

12:06:47.0178 4368  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys

12:06:47.0178 4368  cmdide - ok

12:06:47.0225 4368  [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG             C:\Windows\system32\Drivers\cng.sys

12:06:47.0227 4368  CNG - ok

12:06:47.0245 4368  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys

12:06:47.0245 4368  Compbatt - ok

12:06:47.0284 4368  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

12:06:47.0285 4368  CompositeBus - ok

12:06:47.0301 4368  COMSysApp - ok

12:06:47.0317 4368  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys

12:06:47.0317 4368  crcdisk - ok

12:06:47.0369 4368  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll

12:06:47.0371 4368  CryptSvc - ok

12:06:47.0411 4368  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC             C:\Windows\system32\drivers\csc.sys

12:06:47.0414 4368  CSC - ok

12:06:47.0433 4368  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll

12:06:47.0436 4368  CscService - ok

12:06:47.0474 4368  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll

12:06:47.0478 4368  DcomLaunch - ok

12:06:47.0512 4368  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll

12:06:47.0514 4368  defragsvc - ok

12:06:47.0550 4368  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

12:06:47.0551 4368  DfsC - ok

12:06:47.0577 4368  [ 2D589A2C024B2FB238535DB9F7B3597D ] DgiVecp         C:\Windows\system32\Drivers\DgiVecp.sys

12:06:47.0578 4368  DgiVecp - ok

12:06:47.0615 4368  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll

12:06:47.0617 4368  Dhcp - ok

12:06:47.0638 4368  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys

12:06:47.0639 4368  discache - ok

12:06:47.0658 4368  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys

12:06:47.0659 4368  Disk - ok

12:06:47.0683 4368  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

12:06:47.0685 4368  Dnscache - ok

12:06:47.0720 4368  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll

12:06:47.0721 4368  dot3svc - ok

12:06:47.0750 4368  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll

12:06:47.0751 4368  DPS - ok

12:06:47.0780 4368  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

12:06:47.0780 4368  drmkaud - ok

12:06:47.0829 4368  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

12:06:47.0833 4368  DXGKrnl - ok

12:06:47.0870 4368  [ 955F6564F448119C12AB3C048CCF8946 ] e1kexpress      C:\Windows\system32\DRIVERS\e1k60x64.sys

12:06:47.0872 4368  e1kexpress - ok

12:06:47.0893 4368  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll

12:06:47.0894 4368  EapHost - ok

12:06:47.0980 4368  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys

12:06:47.0994 4368  ebdrv - ok

12:06:48.0023 4368  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\Windows\System32\lsass.exe

12:06:48.0025 4368  EFS - ok

12:06:48.0087 4368  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

12:06:48.0091 4368  ehRecvr - ok

12:06:48.0119 4368  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe

12:06:48.0120 4368  ehSched - ok

12:06:48.0156 4368  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys

12:06:48.0158 4368  elxstor - ok

12:06:48.0172 4368  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys

12:06:48.0172 4368  ErrDev - ok

12:06:48.0226 4368  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll

12:06:48.0229 4368  EventSystem - ok

12:06:48.0262 4368  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys

12:06:48.0263 4368  exfat - ok

12:06:48.0285 4368  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys

12:06:48.0286 4368  fastfat - ok

12:06:48.0350 4368  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe

12:06:48.0353 4368  Fax - ok

12:06:48.0370 4368  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys

12:06:48.0370 4368  fdc - ok

12:06:48.0382 4368  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll

12:06:48.0383 4368  fdPHost - ok

12:06:48.0397 4368  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll

12:06:48.0398 4368  FDResPub - ok

12:06:48.0415 4368  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

12:06:48.0415 4368  FileInfo - ok

12:06:48.0428 4368  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

12:06:48.0428 4368  Filetrace - ok

12:06:48.0483 4368  [ BB0667B0171B632B97EA759515476F07 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

12:06:48.0486 4368  FLEXnet Licensing Service - ok

12:06:48.0503 4368  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys

12:06:48.0504 4368  flpydisk - ok

12:06:48.0549 4368  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

12:06:48.0551 4368  FltMgr - ok

12:06:48.0604 4368  [ 5B92E2B067F64DC53698EB84966B3F0D ] FontCache       C:\Windows\system32\FntCache.dll

12:06:48.0610 4368  FontCache - ok

12:06:48.0665 4368  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

12:06:48.0665 4368  FontCache3.0.0.0 - ok

12:06:48.0687 4368  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

12:06:48.0688 4368  FsDepends - ok

12:06:48.0722 4368  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

12:06:48.0722 4368  Fs_Rec - ok

12:06:48.0763 4368  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

12:06:48.0764 4368  fvevol - ok

12:06:48.0781 4368  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys

12:06:48.0781 4368  gagp30kx - ok

12:06:48.0823 4368  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll

12:06:48.0827 4368  gpsvc - ok

12:06:48.0848 4368  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

12:06:48.0849 4368  hcw85cir - ok

12:06:48.0902 4368  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

12:06:48.0904 4368  HdAudAddService - ok

12:06:48.0947 4368  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys

12:06:48.0948 4368  HDAudBus - ok

12:06:48.0962 4368  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys

12:06:48.0963 4368  HidBatt - ok

12:06:48.0981 4368  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys

12:06:48.0982 4368  HidBth - ok

12:06:48.0995 4368  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys

12:06:48.0996 4368  HidIr - ok

12:06:49.0030 4368  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll

12:06:49.0031 4368  hidserv - ok

12:06:49.0065 4368  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys

12:06:49.0065 4368  HidUsb - ok

12:06:49.0088 4368  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll

12:06:49.0090 4368  hkmsvc - ok

12:06:49.0120 4368  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

12:06:49.0122 4368  HomeGroupListener - ok

12:06:49.0157 4368  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

12:06:49.0159 4368  HomeGroupProvider - ok

12:06:49.0187 4368  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

12:06:49.0188 4368  HpSAMD - ok

12:06:49.0227 4368  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

12:06:49.0231 4368  HTTP - ok

12:06:49.0284 4368  [ D969D0E26C5B1E813B17066A8318D5D4 ] hwdatacard      C:\Windows\system32\DRIVERS\ewusbmdm.sys

12:06:49.0285 4368  hwdatacard - ok

12:06:49.0301 4368  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

12:06:49.0302 4368  hwpolicy - ok

12:06:49.0359 4368  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys

12:06:49.0359 4368  i8042prt - ok

12:06:49.0403 4368  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

12:06:49.0404 4368  iaStorV - ok

12:06:49.0454 4368  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

12:06:49.0458 4368  idsvc - ok

12:06:49.0698 4368  [ C6238C6ABD6AC99F5D152DA4E9439A3D ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys

12:06:49.0747 4368  igfx - ok

12:06:49.0831 4368  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys

12:06:49.0831 4368  iirsp - ok

12:06:49.0874 4368  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll

12:06:49.0878 4368  IKEEXT - ok

12:06:49.0911 4368  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys

12:06:49.0912 4368  intelide - ok

12:06:49.0936 4368  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

12:06:49.0936 4368  intelppm - ok

12:06:49.0968 4368  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

12:06:49.0970 4368  IPBusEnum - ok

12:06:49.0997 4368  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

12:06:49.0998 4368  IpFilterDriver - ok

12:06:50.0038 4368  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

12:06:50.0041 4368  iphlpsvc - ok

12:06:50.0056 4368  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

12:06:50.0057 4368  IPMIDRV - ok

12:06:50.0073 4368  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

12:06:50.0074 4368  IPNAT - ok

12:06:50.0101 4368  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys

12:06:50.0102 4368  IRENUM - ok

12:06:50.0116 4368  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

12:06:50.0117 4368  isapnp - ok

12:06:50.0139 4368  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

12:06:50.0140 4368  iScsiPrt - ok

12:06:50.0176 4368  [ 70EBDA3ED637B0212450C5542EDD11A7 ] IvtAudioBusSrv  C:\Windows\system32\Drivers\IvtBtBus.sys

12:06:50.0177 4368  IvtAudioBusSrv - ok

12:06:50.0180 4368  [ 70EBDA3ED637B0212450C5542EDD11A7 ] IvtBtBUs        C:\Windows\system32\Drivers\IvtBtBus.sys

12:06:50.0180 4368  IvtBtBUs - ok

12:06:50.0184 4368  IvtComBusSrv - ok

12:06:50.0206 4368  [ 2531372CC2AD7C7204A7520DC7C2D0DA ] IvtPanBusSrv    C:\Windows\system32\Drivers\btnetBus.sys

12:06:50.0206 4368  IvtPanBusSrv - ok

12:06:50.0240 4368  [ C04133591DA4F0E4F139BA02020E156E ] kavbootc        C:\Windows\system32\drivers\kavbootc64.sys

12:06:50.0241 4368  kavbootc - ok

12:06:50.0265 4368  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys

12:06:50.0266 4368  kbdclass - ok

12:06:50.0296 4368  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys

12:06:50.0297 4368  kbdhid - ok

12:06:50.0379 4368  [ 1F36BC853A467AEE5C55749D0CD67689 ] KDHacker        c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys

12:06:50.0380 4368  KDHacker - ok

12:06:50.0396 4368  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe

12:06:50.0397 4368  KeyIso - ok

12:06:50.0410 4368  [ 9B64685E594265EE5CD168CA7A513E08 ] kisknl          C:\Windows\system32\drivers\kisknl.sys

12:06:50.0411 4368  kisknl - ok

12:06:50.0445 4368  [ 07071C1E3CD8F0F9114AAC8B072CA1E5 ] KMWDFILTER      C:\Windows\system32\DRIVERS\KMWDFILTER.sys

12:06:50.0446 4368  KMWDFILTER - ok

12:06:50.0480 4368  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

12:06:50.0481 4368  KSecDD - ok

12:06:50.0491 4368  [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

12:06:50.0492 4368  KSecPkg - ok

12:06:50.0510 4368  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

12:06:50.0511 4368  ksthunk - ok

12:06:50.0542 4368  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll

12:06:50.0545 4368  KtmRm - ok

12:06:50.0606 4368  [ 2D838D0AB6CEF453F690E3D22C2F443C ] KUsbGuard       C:\Program Files (x86)\kingsoft\kingsoft antivirus\kusbquery64.sys

12:06:50.0606 4368  KUsbGuard - ok

12:06:50.0643 4368  [ D475D06DE67A3A1D9AD9E632B4C1501C ] kxescore        c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

12:06:50.0644 4368  kxescore - ok

12:06:50.0684 4368  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll

12:06:50.0686 4368  LanmanServer - ok

12:06:50.0723 4368  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

12:06:50.0725 4368  LanmanWorkstation - ok

12:06:50.0862 4368  [ 70FB6254E29150A7A4A39FDFFD306C33 ] LBTServ         C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

12:06:50.0864 4368  LBTServ - ok

12:06:50.0907 4368  [ 1470EF17E02E82E4F43346DF9E9F11E1 ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys

12:06:50.0907 4368  LHidFilt - ok

12:06:50.0923 4368  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

12:06:50.0924 4368  lltdio - ok

12:06:50.0964 4368  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll

12:06:50.0967 4368  lltdsvc - ok

12:06:50.0983 4368  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll

12:06:50.0985 4368  lmhosts - ok

12:06:50.0989 4368  [ 12814AE119E959437BEA3110F81BD188 ] LMouFilt        C:\Windows\system32\DRIVERS\LMouFilt.Sys

12:06:50.0990 4368  LMouFilt - ok

12:06:51.0019 4368  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys

12:06:51.0020 4368  LSI_FC - ok

12:06:51.0045 4368  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys

12:06:51.0046 4368  LSI_SAS - ok

12:06:51.0059 4368  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys

12:06:51.0060 4368  LSI_SAS2 - ok

12:06:51.0078 4368  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys

12:06:51.0078 4368  LSI_SCSI - ok

12:06:51.0110 4368  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys

12:06:51.0111 4368  luafv - ok

12:06:51.0164 4368  [ 986C1CB787A007BAA5F74E7D316D7246 ] LVRS64          C:\Windows\system32\DRIVERS\lvrs64.sys

12:06:51.0165 4368  LVRS64 - ok

12:06:51.0331 4368  [ 5747BC465ABEA2858C5D037252AED84E ] LVUVC64         C:\Windows\system32\DRIVERS\lvuvc64.sys

12:06:51.0358 4368  LVUVC64 - ok

12:06:51.0419 4368  [ 31C6AFFFAD7C733A65F888929548BC22 ] mbamchameleon   C:\Windows\system32\drivers\mbamchameleon.sys

12:06:51.0420 4368  mbamchameleon - ok

12:06:51.0443 4368  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

12:06:51.0445 4368  Mcx2Svc - ok

12:06:51.0470 4368  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys

12:06:51.0471 4368  megasas - ok

12:06:51.0488 4368  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys

12:06:51.0489 4368  MegaSR - ok

12:06:51.0521 4368  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll

12:06:51.0522 4368  MMCSS - ok

12:06:51.0543 4368  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys

12:06:51.0543 4368  Modem - ok

12:06:51.0572 4368  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

12:06:51.0573 4368  monitor - ok

12:06:51.0607 4368  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys

12:06:51.0608 4368  mouclass - ok

12:06:51.0637 4368  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

12:06:51.0637 4368  mouhid - ok

12:06:51.0669 4368  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

12:06:51.0670 4368  mountmgr - ok

12:06:51.0698 4368  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys

12:06:51.0699 4368  mpio - ok

12:06:51.0721 4368  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

12:06:51.0722 4368  mpsdrv - ok

12:06:51.0757 4368  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll

12:06:51.0762 4368  MpsSvc - ok

12:06:51.0795 4368  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

12:06:51.0796 4368  MRxDAV - ok

12:06:51.0825 4368  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

12:06:51.0826 4368  mrxsmb - ok

12:06:51.0845 4368  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

12:06:51.0846 4368  mrxsmb10 - ok

12:06:51.0857 4368  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

12:06:51.0858 4368  mrxsmb20 - ok

12:06:51.0889 4368  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys

12:06:51.0889 4368  msahci - ok

12:06:51.0905 4368  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

12:06:51.0906 4368  msdsm - ok

12:06:51.0921 4368  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe

12:06:51.0923 4368  MSDTC - ok

12:06:51.0931 4368  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

12:06:51.0931 4368  Msfs - ok

12:06:51.0941 4368  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

12:06:51.0942 4368  mshidkmdf - ok

12:06:51.0959 4368  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

12:06:51.0960 4368  msisadrv - ok

12:06:51.0995 4368  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

12:06:51.0996 4368  MSiSCSI - ok

12:06:51.0999 4368  msiserver - ok

12:06:52.0031 4368  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

12:06:52.0031 4368  MSKSSRV - ok

12:06:52.0041 4368  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

12:06:52.0041 4368  MSPCLOCK - ok

12:06:52.0059 4368  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

12:06:52.0060 4368  MSPQM - ok

12:06:52.0095 4368  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

12:06:52.0097 4368  MsRPC - ok

12:06:52.0107 4368  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

12:06:52.0108 4368  mssmbios - ok

12:06:52.0111 4368  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

12:06:52.0111 4368  MSTEE - ok

12:06:52.0130 4368  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys

12:06:52.0131 4368  MTConfig - ok

12:06:52.0149 4368  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys

12:06:52.0150 4368  Mup - ok

12:06:52.0182 4368  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll

12:06:52.0185 4368  napagent - ok

12:06:52.0222 4368  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

12:06:52.0224 4368  NativeWifiP - ok

12:06:52.0283 4368  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys

12:06:52.0287 4368  NDIS - ok

12:06:52.0301 4368  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

12:06:52.0302 4368  NdisCap - ok

12:06:52.0339 4368  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

12:06:52.0339 4368  NdisTapi - ok

12:06:52.0366 4368  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

12:06:52.0367 4368  Ndisuio - ok

12:06:52.0396 4368  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

12:06:52.0397 4368  NdisWan - ok

12:06:52.0431 4368  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

12:06:52.0432 4368  NDProxy - ok

12:06:52.0462 4368  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

12:06:52.0463 4368  NetBIOS - ok

12:06:52.0497 4368  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

12:06:52.0499 4368  NetBT - ok

12:06:52.0519 4368  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe

12:06:52.0520 4368  Netlogon - ok

12:06:52.0561 4368  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll

12:06:52.0564 4368  Netman - ok

12:06:52.0588 4368  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll

12:06:52.0591 4368  netprofm - ok

12:06:52.0625 4368  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

12:06:52.0626 4368  NetTcpPortSharing - ok

12:06:52.0636 4368  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys

12:06:52.0637 4368  nfrd960 - ok

12:06:52.0713 4368  [ 3A936AD705E1A20852DC6C694CB192F7 ] NitroReaderDriverReadSpool3 C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe

12:06:52.0714 4368  NitroReaderDriverReadSpool3 - ok

12:06:52.0738 4368  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll

12:06:52.0741 4368  NlaSvc - ok

12:06:52.0817 4368  [ 6EF0506CE1F553E9BD085645933C8686 ] NMIndexingService C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe

12:06:52.0819 4368  NMIndexingService - ok

12:06:52.0834 4368  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

12:06:52.0835 4368  Npfs - ok

12:06:52.0860 4368  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll

12:06:52.0862 4368  nsi - ok

12:06:52.0869 4368  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

12:06:52.0870 4368  nsiproxy - ok

12:06:52.0923 4368  [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

12:06:52.0931 4368  Ntfs - ok

12:06:52.0943 4368  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys

12:06:52.0944 4368  Null - ok

12:06:52.0977 4368  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys

12:06:52.0978 4368  nvraid - ok

12:06:52.0995 4368  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys

12:06:52.0996 4368  nvstor - ok

12:06:53.0024 4368  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

12:06:53.0024 4368  nv_agp - ok

12:06:53.0034 4368  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

12:06:53.0034 4368  ohci1394 - ok

12:06:53.0060 4368  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

12:06:53.0064 4368  p2pimsvc - ok

12:06:53.0087 4368  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll

12:06:53.0090 4368  p2psvc - ok

12:06:53.0103 4368  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys

12:06:53.0104 4368  Parport - ok

12:06:53.0121 4368  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys

12:06:53.0121 4368  partmgr - ok

12:06:53.0136 4368  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll

12:06:53.0138 4368  PcaSvc - ok

12:06:53.0157 4368  pccsmcfd - ok

12:06:53.0180 4368  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys

12:06:53.0181 4368  pci - ok

12:06:53.0196 4368  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys

12:06:53.0196 4368  pciide - ok

12:06:53.0220 4368  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys

12:06:53.0221 4368  pcmcia - ok

12:06:53.0240 4368  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys

12:06:53.0240 4368  pcw - ok

12:06:53.0265 4368  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

12:06:53.0268 4368  PEAUTH - ok

12:06:53.0321 4368  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll

12:06:53.0328 4368  PeerDistSvc - ok

12:06:53.0415 4368  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe

12:06:53.0416 4368  PerfHost - ok

12:06:53.0471 4368  [ FE8AF03EFEC0387FBBFCFD32E328DB9A ] phaudlwr        C:\Windows\system32\DRIVERS\phaudlwr.sys

12:06:53.0472 4368  phaudlwr - ok

12:06:53.0522 4368  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll

12:06:53.0530 4368  pla - ok

12:06:53.0576 4368  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

12:06:53.0580 4368  PlugPlay - ok

12:06:53.0605 4368  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

12:06:53.0606 4368  PNRPAutoReg - ok

12:06:53.0633 4368  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

12:06:53.0635 4368  PNRPsvc - ok

12:06:53.0668 4368  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

12:06:53.0671 4368  PolicyAgent - ok

12:06:53.0706 4368  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll

12:06:53.0708 4368  Power - ok

12:06:53.0749 4368  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

12:06:53.0750 4368  PptpMiniport - ok

12:06:53.0780 4368  PQNTDrv - ok

12:06:53.0802 4368  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\DRIVERS\processr.sys

12:06:53.0802 4368  Processor - ok

12:06:53.0842 4368  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll

12:06:53.0844 4368  ProfSvc - ok

12:06:53.0854 4368  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

12:06:53.0855 4368  ProtectedStorage - ok

12:06:53.0903 4368  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

12:06:53.0904 4368  Psched - ok

12:06:53.0945 4368  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys

12:06:53.0952 4368  ql2300 - ok

12:06:53.0968 4368  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys

12:06:53.0969 4368  ql40xx - ok

12:06:54.0054 4368  QQPCRTP - ok

12:06:54.0067 4368  QQSysMonX64 - ok

12:06:54.0115 4368  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll

12:06:54.0117 4368  QWAVE - ok

12:06:54.0137 4368  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

12:06:54.0137 4368  QWAVEdrv - ok

12:06:54.0189 4368  [ A55E7D0D873B2C97585B3B5926AC6ADE ] RapiMgr         C:\Windows\WindowsMobile\rapimgr.dll

12:06:54.0190 4368  RapiMgr - ok

12:06:54.0203 4368  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

12:06:54.0204 4368  RasAcd - ok

12:06:54.0238 4368  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

12:06:54.0239 4368  RasAgileVpn - ok

12:06:54.0255 4368  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll

12:06:54.0257 4368  RasAuto - ok

12:06:54.0287 4368  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

12:06:54.0288 4368  Rasl2tp - ok

12:06:54.0324 4368  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll

12:06:54.0327 4368  RasMan - ok

12:06:54.0354 4368  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

12:06:54.0354 4368  RasPppoe - ok

12:06:54.0367 4368  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

12:06:54.0367 4368  RasSstp - ok

12:06:54.0393 4368  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

12:06:54.0395 4368  rdbss - ok

12:06:54.0412 4368  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys

12:06:54.0412 4368  rdpbus - ok

12:06:54.0419 4368  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

12:06:54.0419 4368  RDPCDD - ok

12:06:54.0453 4368  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys

12:06:54.0454 4368  RDPDR - ok

12:06:54.0485 4368  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

12:06:54.0486 4368  RDPENCDD - ok

12:06:54.0493 4368  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

12:06:54.0493 4368  RDPREFMP - ok

12:06:54.0542 4368  [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys

12:06:54.0543 4368  RdpVideoMiniport - ok

12:06:54.0579 4368  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

12:06:54.0580 4368  RDPWD - ok

12:06:54.0613 4368  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

12:06:54.0614 4368  rdyboost - ok

12:06:54.0640 4368  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll

12:06:54.0641 4368  RemoteAccess - ok

12:06:54.0670 4368  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

12:06:54.0672 4368  RemoteRegistry - ok

12:06:54.0708 4368  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys

12:06:54.0709 4368  RFCOMM - ok

12:06:54.0734 4368  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

12:06:54.0736 4368  RpcEptMapper - ok

12:06:54.0749 4368  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe

12:06:54.0750 4368  RpcLocator - ok

12:06:54.0790 4368  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll

12:06:54.0793 4368  RpcSs - ok

12:06:54.0827 4368  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

12:06:54.0828 4368  rspndr - ok

12:06:54.0852 4368  [ E60C0A09F997826C7627B244195AB581 ] s3cap           C:\Windows\system32\drivers\vms3cap.sys

12:06:54.0853 4368  s3cap - ok

12:06:54.0866 4368  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\Windows\system32\lsass.exe

12:06:54.0867 4368  SamSs - ok

12:06:54.0885 4368  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

12:06:54.0886 4368  sbp2port - ok

12:06:54.0919 4368  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll

12:06:54.0921 4368  SCardSvr - ok

12:06:54.0981 4368  [ B00BCE3D99FE7CE29C6E873AC62F450E ] SCDEmu          C:\Windows\system32\drivers\SCDEmu.sys

12:06:54.0981 4368  SCDEmu - ok

12:06:55.0011 4368  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

12:06:55.0012 4368  scfilter - ok

12:06:55.0058 4368  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll

12:06:55.0065 4368  Schedule - ok

12:06:55.0102 4368  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll

12:06:55.0103 4368  SCPolicySvc - ok

12:06:55.0131 4368  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

12:06:55.0133 4368  SDRSVC - ok

12:06:55.0163 4368  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys

12:06:55.0164 4368  secdrv - ok

12:06:55.0182 4368  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll

12:06:55.0184 4368  seclogon - ok

12:06:55.0200 4368  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll

12:06:55.0202 4368  SENS - ok

12:06:55.0219 4368  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll

12:06:55.0221 4368  SensrSvc - ok

12:06:55.0248 4368  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys

12:06:55.0248 4368  Serenum - ok

12:06:55.0260 4368  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys

12:06:55.0261 4368  Serial - ok

12:06:55.0276 4368  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys

12:06:55.0276 4368  sermouse - ok

12:06:55.0313 4368  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll

12:06:55.0315 4368  SessionEnv - ok

12:06:55.0331 4368  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

12:06:55.0332 4368  sffdisk - ok

12:06:55.0344 4368  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

12:06:55.0345 4368  sffp_mmc - ok

12:06:55.0356 4368  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

12:06:55.0356 4368  sffp_sd - ok

12:06:55.0373 4368  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys

12:06:55.0373 4368  sfloppy - ok

12:06:55.0400 4368  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll

12:06:55.0402 4368  SharedAccess - ok

12:06:55.0434 4368  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

12:06:55.0436 4368  ShellHWDetection - ok

12:06:55.0457 4368  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys

12:06:55.0458 4368  SiSRaid2 - ok

12:06:55.0470 4368  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys

12:06:55.0471 4368  SiSRaid4 - ok

12:06:55.0511 4368  [ FF0DB4D9A08864A5C7B67477CD8E3B2A ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe

12:06:55.0512 4368  SkypeUpdate - ok

12:06:55.0544 4368  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

12:06:55.0545 4368  Smb - ok

12:06:55.0585 4368  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

12:06:55.0586 4368  SNMPTRAP - ok

12:06:55.0689 4368  [ B0D84C0756B2C4A6965DB7DE730AD635 ] SPC1000         C:\Windows\system32\DRIVERS\spc1000.sys

12:06:55.0704 4368  SPC1000 - ok

12:06:55.0718 4368  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys

12:06:55.0719 4368  spldr - ok

12:06:55.0750 4368  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe

12:06:55.0754 4368  Spooler - ok

12:06:55.0853 4368  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe

12:06:55.0871 4368  sppsvc - ok

12:06:55.0893 4368  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

12:06:55.0895 4368  sppuinotify - ok

12:06:55.0928 4368  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys

12:06:55.0931 4368  srv - ok

12:06:55.0945 4368  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

12:06:55.0947 4368  srv2 - ok

12:06:55.0961 4368  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

12:06:55.0962 4368  srvnet - ok

12:06:56.0001 4368  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

12:06:56.0003 4368  SSDPSRV - ok

12:06:56.0020 4368  [ 0211AB46B73A2623B86C1CFCB30579AB ] SSPORT          C:\Windows\system32\Drivers\SSPORT.sys

12:06:56.0021 4368  SSPORT - ok

12:06:56.0030 4368  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll

12:06:56.0032 4368  SstpSvc - ok

12:06:56.0061 4368  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys

12:06:56.0062 4368  stexstor - ok

12:06:56.0116 4368  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll

12:06:56.0120 4368  stisvc - ok

12:06:56.0158 4368  [ 7785DC213270D2FC066538DAF94087E7 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys

12:06:56.0158 4368  storflt - ok

12:06:56.0186 4368  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc         C:\Windows\system32\drivers\storvsc.sys

12:06:56.0187 4368  storvsc - ok

12:06:56.0214 4368  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys

12:06:56.0214 4368  swenum - ok

12:06:56.0233 4368  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll

12:06:56.0237 4368  swprv - ok

12:06:56.0255 4368  Synth3dVsc - ok

12:06:56.0318 4368  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll

12:06:56.0334 4368  SysMain - ok

12:06:56.0365 4368  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

12:06:56.0367 4368  TabletInputService - ok

12:06:56.0420 4368  [ A8D3F11BC8F37C3D7D026C3E1219B5AC ] tap0901         C:\Windows\system32\DRIVERS\tap0901.sys

12:06:56.0420 4368  tap0901 - ok

12:06:56.0436 4368  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll

12:06:56.0439 4368  TapiSrv - ok

12:06:56.0480 4368  [ F7CABF86615803051D586FBF4D916048 ] tapSF0901       C:\Windows\system32\DRIVERS\tapSF0901.sys

12:06:56.0481 4368  tapSF0901 - ok

12:06:56.0503 4368  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll

12:06:56.0505 4368  TBS - ok

12:06:56.0560 4368  [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

12:06:56.0568 4368  Tcpip - ok

12:06:56.0601 4368  [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

12:06:56.0610 4368  TCPIP6 - ok

12:06:56.0648 4368  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

12:06:56.0648 4368  tcpipreg - ok

12:06:56.0680 4368  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

12:06:56.0680 4368  TDPIPE - ok

12:06:56.0708 4368  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

12:06:56.0709 4368  TDTCP - ok

12:06:56.0770 4368  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

12:06:56.0771 4368  tdx - ok

12:06:56.0798 4368  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys

12:06:56.0799 4368  TermDD - ok

12:06:56.0837 4368  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll

12:06:56.0841 4368  TermService - ok

12:06:56.0882 4368  [ 2E435EF337679AA45AD0307B86256062 ] TesSafe         C:\Windows\system32\TesSafe.sys

12:06:56.0884 4368  TesSafe - ok

12:06:56.0907 4368  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll

12:06:56.0910 4368  Themes - ok

12:06:56.0936 4368  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll

12:06:56.0937 4368  THREADORDER - ok

12:06:56.0976 4368  [ 8021F63311797085949FA387F7C83583 ] tosporte        C:\Windows\system32\DRIVERS\tosporte.sys

12:06:56.0977 4368  tosporte - ok

12:06:57.0021 4368  [ 58E3F35AECD7BD5FCC1BD198B4AD354F ] Tosrfbd         C:\Windows\system32\DRIVERS\tosrfbd.sys

12:06:57.0023 4368  Tosrfbd - ok

12:06:57.0069 4368  [ 9E4E65EA51E34647340BD6007467AC54 ] Tosrfcom        C:\Windows\system32\Drivers\tosrfcom.sys

12:06:57.0070 4368  Tosrfcom - ok

12:06:57.0092 4368  [ 7D2467D3EB9BAA4B69AE4A28C83DE57A ] Tosrfhid        C:\Windows\system32\DRIVERS\Tosrfhid.sys

12:06:57.0092 4368  Tosrfhid - ok

12:06:57.0121 4368  [ 7052B10E54B48AF12BD5606596A8E039 ] TosRfSnd        C:\Windows\system32\drivers\tosrfsnd.sys

12:06:57.0121 4368  TosRfSnd - ok

12:06:57.0129 4368  [ 7A0048693F98460FF537BE31C741B927 ] Tosrfusb        C:\Windows\system32\DRIVERS\tosrfusb.sys

12:06:57.0130 4368  Tosrfusb - ok

12:06:57.0162 4368  [ DBCC20C02E8A3E43B03C304A4E40A84F ] TPM             C:\Windows\system32\drivers\tpm.sys

12:06:57.0163 4368  TPM - ok

12:06:57.0198 4368  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll

12:06:57.0200 4368  TrkWks - ok

12:06:57.0264 4368  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

12:06:57.0265 4368  TrustedInstaller - ok

12:06:57.0270 4368  TsFltMgr - ok

12:06:57.0301 4368  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

12:06:57.0302 4368  tssecsrv - ok

12:06:57.0321 4368  [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

12:06:57.0321 4368  TsUsbFlt - ok

12:06:57.0326 4368  tsusbhub - ok

12:06:57.0376 4368  [ A67E705F93E4664026D8F40E8EC83555 ] TSysCare        C:\Windows\system32\Drivers\TSysCare64.sys

12:06:57.0377 4368  TSysCare - ok

12:06:57.0428 4368  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

12:06:57.0429 4368  tunnel - ok

12:06:57.0458 4368  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys

12:06:57.0460 4368  uagp35 - ok

12:06:57.0492 4368  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

12:06:57.0493 4368  udfs - ok

12:06:57.0530 4368  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

12:06:57.0532 4368  UI0Detect - ok

12:06:57.0562 4368  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

12:06:57.0563 4368  uliagpkx - ok

12:06:57.0594 4368  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys

12:06:57.0595 4368  umbus - ok

12:06:57.0611 4368  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys

12:06:57.0611 4368  UmPass - ok

12:06:57.0644 4368  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll

12:06:57.0647 4368  UmRdpService - ok

12:06:57.0749 4368  [ 9DC07E73A4ABB9ACF692113B36A5009F ] UnlockerDriver5 C:\Program Files\Unlocker\UnlockerDriver5.sys

12:06:57.0750 4368  UnlockerDriver5 - ok

12:06:57.0775 4368  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll

12:06:57.0779 4368  upnphost - ok

12:06:57.0837 4368  [ 0835843DE85ACBD7D5C6CF887E8876B7 ] USB28xxBGA      C:\Windows\system32\DRIVERS\emBDA64.sys

12:06:57.0840 4368  USB28xxBGA - ok

12:06:57.0863 4368  [ C95A614A4DC06DCFC3DA7B15F299F827 ] USB28xxOEM      C:\Windows\system32\DRIVERS\emOEM64.sys

12:06:57.0866 4368  USB28xxOEM - ok

12:06:57.0908 4368  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys

12:06:57.0909 4368  usbaudio - ok

12:06:57.0925 4368  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

12:06:57.0926 4368  usbccgp - ok

12:06:57.0956 4368  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys

12:06:57.0956 4368  usbcir - ok

12:06:57.0974 4368  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys

12:06:57.0975 4368  usbehci - ok

12:06:58.0000 4368  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

12:06:58.0001 4368  usbhub - ok

12:06:58.0018 4368  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\Windows\system32\drivers\usbohci.sys

12:06:58.0018 4368  usbohci - ok

12:06:58.0061 4368  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

12:06:58.0061 4368  usbprint - ok

12:06:58.0078 4368  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

12:06:58.0079 4368  USBSTOR - ok

12:06:58.0097 4368  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys

12:06:58.0098 4368  usbuhci - ok

12:06:58.0138 4368  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys

12:06:58.0139 4368  usbvideo - ok

12:06:58.0165 4368  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll

12:06:58.0167 4368  UxSms - ok

12:06:58.0175 4368  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe

12:06:58.0176 4368  VaultSvc - ok

12:06:58.0223 4368  [ D7FCD8FBBF6CC93140D9C7C7959ED60C ] VBoxDrv         C:\Windows\system32\DRIVERS\VBoxDrv.sys

12:06:58.0224 4368  VBoxDrv - ok

12:06:58.0243 4368  [ 6B22F16BE58AEF1A57970611D7109507 ] VBoxNetAdp      C:\Windows\system32\DRIVERS\VBoxNetAdp.sys

12:06:58.0244 4368  VBoxNetAdp - ok

12:06:58.0255 4368  [ 10DD814DA2F2064F53B9694E30FF45A4 ] VBoxNetFlt      C:\Windows\system32\DRIVERS\VBoxNetFlt.sys

12:06:58.0256 4368  VBoxNetFlt - ok

12:06:58.0278 4368  [ 812C2E4EC41CFCACE761620E17463529 ] VBoxUSBMon      C:\Windows\system32\DRIVERS\VBoxUSBMon.sys

12:06:58.0279 4368  VBoxUSBMon - ok

12:06:58.0324 4368  [ 389AB97570E7F25192CA18B6348C904F ] VComm           C:\Windows\system32\DRIVERS\VComm.sys

12:06:58.0325 4368  VComm - ok

12:06:58.0340 4368  [ 72F11B412446FAAF95B156A6B781502C ] VcommMgr        C:\Windows\system32\Drivers\VcommMgr.sys

12:06:58.0340 4368  VcommMgr - ok

12:06:58.0374 4368  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

12:06:58.0375 4368  vdrvroot - ok

12:06:58.0405 4368  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe

12:06:58.0409 4368  vds - ok

12:06:58.0436 4368  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

12:06:58.0436 4368  vga - ok

12:06:58.0457 4368  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys

12:06:58.0458 4368  VgaSave - ok

12:06:58.0462 4368  VGPU - ok

12:06:58.0492 4368  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

12:06:58.0493 4368  vhdmp - ok

12:06:58.0523 4368  [ F3678125BFF5615B087EA7F4BD363370 ] VHidMinidrv     C:\Windows\system32\drivers\VHIDMini.sys

12:06:58.0523 4368  VHidMinidrv - ok

12:06:58.0549 4368  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys

12:06:58.0550 4368  viaide - ok

12:06:58.0566 4368  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus           C:\Windows\system32\drivers\vmbus.sys

12:06:58.0568 4368  vmbus - ok

12:06:58.0583 4368  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys

12:06:58.0583 4368  VMBusHID - ok

12:06:58.0646 4368  [ B2E25DB5A6A178C056342ABD747B7326 ] vmm             C:\Windows\system32\Treiber\vmm.sys

12:06:58.0647 4368  vmm - ok

12:06:58.0661 4368  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

12:06:58.0661 4368  volmgr - ok

12:06:58.0700 4368  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

12:06:58.0702 4368  volmgrx - ok

12:06:58.0740 4368  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap         C:\Windows\system32\drivers\volsnap.sys

12:06:58.0743 4368  volsnap - ok

12:06:58.0769 4368  [ 6BDCA00FC57CC40DA3C8E88B2CEA21AB ] VPCNetS2        C:\Windows\system32\DRIVERS\VMNetSrv.sys

12:06:58.0770 4368  VPCNetS2 - ok

12:06:58.0793 4368  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys

12:06:58.0794 4368  vsmraid - ok

12:06:58.0847 4368  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe

12:06:58.0855 4368  VSS - ok

12:06:58.0871 4368  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys

12:06:58.0872 4368  vwifibus - ok

12:06:58.0902 4368  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll

12:06:58.0905 4368  W32Time - ok

12:06:58.0927 4368  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys

12:06:58.0928 4368  WacomPen - ok

12:06:58.0984 4368  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

12:06:58.0985 4368  WANARP - ok

12:06:58.0998 4368  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

12:06:58.0998 4368  Wanarpv6 - ok

12:06:59.0046 4368  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe

12:06:59.0055 4368  wbengine - ok

12:06:59.0079 4368  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

12:06:59.0082 4368  WbioSrvc - ok

12:06:59.0135 4368  [ 8BDA6DB43AA54E8BB5E0794541DDC209 ] WcesComm        C:\Windows\WindowsMobile\wcescomm.dll

12:06:59.0137 4368  WcesComm - ok

12:06:59.0166 4368  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll

12:06:59.0169 4368  wcncsvc - ok

12:06:59.0183 4368  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

12:06:59.0185 4368  WcsPlugInService - ok

12:06:59.0215 4368  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys

12:06:59.0215 4368  Wd - ok

12:06:59.0254 4368  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

12:06:59.0258 4368  Wdf01000 - ok

12:06:59.0278 4368  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll

12:06:59.0280 4368  WdiServiceHost - ok

12:06:59.0283 4368  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll

12:06:59.0285 4368  WdiSystemHost - ok

12:06:59.0315 4368  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\Windows\System32\webclnt.dll

12:06:59.0317 4368  WebClient - ok

12:06:59.0334 4368  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll

12:06:59.0336 4368  Wecsvc - ok

12:06:59.0353 4368  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

12:06:59.0355 4368  wercplsupport - ok

12:06:59.0381 4368  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll

12:06:59.0384 4368  WerSvc - ok

12:06:59.0414 4368  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

12:06:59.0414 4368  WfpLwf - ok

12:06:59.0432 4368  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

12:06:59.0432 4368  WIMMount - ok

12:06:59.0463 4368  WinDefend - ok

12:06:59.0467 4368  WinHttpAutoProxySvc - ok

12:06:59.0524 4368  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

12:06:59.0525 4368  Winmgmt - ok

12:06:59.0590 4368  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll

12:06:59.0601 4368  WinRM - ok

12:06:59.0673 4368  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys

12:06:59.0674 4368  WinUsb - ok

12:06:59.0715 4368  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll

12:06:59.0720 4368  Wlansvc - ok

12:06:59.0851 4368  [ 357CABBF155AFD1D3926E62539D2A3A7 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

12:06:59.0862 4368  wlidsvc - ok

12:06:59.0905 4368  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

12:06:59.0906 4368  WmiAcpi - ok

12:06:59.0933 4368  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

12:06:59.0934 4368  wmiApSrv - ok

12:06:59.0978 4368  WMPNetworkSvc - ok

12:06:59.0999 4368  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll

12:07:00.0001 4368  WPCSvc - ok

12:07:00.0031 4368  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

12:07:00.0033 4368  WPDBusEnum - ok

12:07:00.0055 4368  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

12:07:00.0055 4368  ws2ifsl - ok

12:07:00.0076 4368  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll

12:07:00.0079 4368  wscsvc - ok

12:07:00.0082 4368  WSearch - ok

12:07:00.0147 4368  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll

12:07:00.0162 4368  wuauserv - ok

12:07:00.0194 4368  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

12:07:00.0195 4368  WudfPf - ok

12:07:00.0228 4368  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

12:07:00.0229 4368  WUDFRd - ok

12:07:00.0250 4368  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

12:07:00.0252 4368  wudfsvc - ok

12:07:00.0274 4368  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc         C:\Windows\System32\wwansvc.dll

12:07:00.0277 4368  WwanSvc - ok

12:07:00.0354 4368  [ DD0042F0C3B606A6A8B92D49AFB18AD6 ] YahooAUService  C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

12:07:00.0358 4368  YahooAUService - ok

12:07:00.0396 4368  [ 24FB8DB6D1D55E2C5D0A53DFE48E6AF8 ] Yontoo Desktop Updater C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

12:07:00.0397 4368  Yontoo Desktop Updater - ok

12:07:00.0450 4368  ================ Scan global ===============================

12:07:00.0475 4368  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

12:07:00.0500 4368  [ 72CC564BBC70DE268784BCE91EB8A28F ] C:\Windows\system32\winsrv.dll

12:07:00.0508 4368  [ 72CC564BBC70DE268784BCE91EB8A28F ] C:\Windows\system32\winsrv.dll

12:07:00.0528 4368  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

12:07:00.0566 4368  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

12:07:00.0568 4368  [Global] - ok

12:07:00.0569 4368  ================ Scan MBR ==================================

12:07:00.0582 4368  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

12:07:00.0858 4368  \Device\Harddisk0\DR0 - ok

12:07:00.0859 4368  ================ Scan VBR ==================================

12:07:00.0864 4368  [ 7F8BEAF9F355FB8EA3923BF5AFDD2208 ] \Device\Harddisk0\DR0\Partition1

12:07:00.0866 4368  \Device\Harddisk0\DR0\Partition1 - ok

12:07:00.0866 4368  ============================================================

12:07:00.0866 4368  Scan finished

12:07:00.0866 4368  ============================================================

12:07:00.0874 6532  Detected object count: 0

12:07:00.0874 6532  Actual detected object count: 0

Außerdem den TDSS-Killer nicht richtig konfiguriert, bitte noch mal nach Anleitung ausführen

Wie, ist der immer noch nicht richtig konfiguriert?

ne, du hast die Haken nicht nach der tdssskiller Anleitung gesetzt

noch ein Versuch:

Code:

13:37:31.0340 1468  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42

13:37:31.0773 1468  ============================================================

13:37:31.0773 1468  Current date / time: 2013/05/29 13:37:31.0773

13:37:31.0773 1468  SystemInfo:

13:37:31.0773 1468  

13:37:31.0773 1468  OS Version: 6.1.7601 ServicePack: 1.0

13:37:31.0773 1468  Product type: Workstation

13:37:31.0773 1468  ComputerName: W7

13:37:31.0774 1468  UserName: root

13:37:31.0774 1468  Windows directory: C:\Windows

13:37:31.0774 1468  System windows directory: C:\Windows

13:37:31.0774 1468  Running under WOW64

13:37:31.0774 1468  Processor architecture: Intel x64

13:37:31.0774 1468  Number of processors: 2

13:37:31.0774 1468  Page size: 0x1000

13:37:31.0774 1468  Boot type: Normal boot

13:37:31.0774 1468  ============================================================

13:37:32.0407 1468  BG loaded

13:37:32.0643 1468  Drive \Device\Harddisk0\DR0 - Size: 0x5D2710DE00 (372.61 Gb), SectorSize: 0x200, Cylinders: 0xBE01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040

13:37:32.0647 1468  ============================================================

13:37:32.0647 1468  \Device\Harddisk0\DR0:

13:37:32.0648 1468  MBR partitions:

13:37:32.0648 1468  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x2E937800

13:37:32.0648 1468  ============================================================

13:37:32.0677 1468  C: <-> \Device\Harddisk0\DR0\Partition1

13:37:32.0678 1468  ============================================================

13:37:32.0678 1468  Initialize success

13:37:32.0678 1468  ============================================================

13:39:08.0383 7656  ============================================================

13:39:08.0383 7656  Scan started

13:39:08.0383 7656  Mode: Manual; SigCheck; TDLFS; 

13:39:08.0383 7656  ============================================================

13:39:08.0812 7656  ================ Scan system memory ========================

13:39:08.0813 7656  System memory - ok

13:39:08.0813 7656  ================ Scan services =============================

13:39:08.0984 7656  [ A87D604AEA360176311474C87A63BB88 ] 1394ohci        C:\Windows\system32\drivers\1394ohci.sys

13:39:09.0052 7656  1394ohci - ok

13:39:09.0099 7656  [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI            C:\Windows\system32\drivers\ACPI.sys

13:39:09.0113 7656  ACPI - ok

13:39:09.0140 7656  [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi         C:\Windows\system32\drivers\acpipmi.sys

13:39:09.0153 7656  AcpiPmi - ok

13:39:09.0260 7656  [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe

13:39:09.0279 7656  AdobeFlashPlayerUpdateSvc - ok

13:39:09.0317 7656  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx         C:\Windows\system32\DRIVERS\adp94xx.sys

13:39:09.0340 7656  adp94xx - ok

13:39:09.0357 7656  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci         C:\Windows\system32\DRIVERS\adpahci.sys

13:39:09.0371 7656  adpahci - ok

13:39:09.0388 7656  [ E109549C90F62FB570B9540C4B148E54 ] adpu320         C:\Windows\system32\DRIVERS\adpu320.sys

13:39:09.0400 7656  adpu320 - ok

13:39:09.0436 7656  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc     C:\Windows\System32\aelupsvc.dll

13:39:09.0466 7656  AeLookupSvc - ok

13:39:09.0509 7656  [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD             C:\Windows\system32\drivers\afd.sys

13:39:09.0524 7656  AFD - ok

13:39:09.0565 7656  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\drivers\agp440.sys

13:39:09.0576 7656  agp440 - ok

13:39:09.0599 7656  [ 3290D6946B5E30E70414990574883DDB ] ALG             C:\Windows\System32\alg.exe

13:39:09.0611 7656  ALG - ok

13:39:09.0656 7656  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\drivers\aliide.sys

13:39:09.0667 7656  aliide - ok

13:39:09.0670 7656  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\drivers\amdide.sys

13:39:09.0680 7656  amdide - ok

13:39:09.0691 7656  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8           C:\Windows\system32\DRIVERS\amdk8.sys

13:39:09.0702 7656  AmdK8 - ok

13:39:09.0706 7656  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys

13:39:09.0717 7656  AmdPPM - ok

13:39:09.0739 7656  [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata         C:\Windows\system32\drivers\amdsata.sys

13:39:09.0750 7656  amdsata - ok

13:39:09.0781 7656  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys

13:39:09.0792 7656  amdsbs - ok

13:39:09.0805 7656  [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata         C:\Windows\system32\drivers\amdxata.sys

13:39:09.0815 7656  amdxata - ok

13:39:09.0848 7656  [ 363571BC0C79E394E69300D1F2E3DDAE ] androidusb      C:\Windows\system32\Drivers\androidusb.sys

13:39:09.0857 7656  androidusb - ok

13:39:09.0897 7656  [ 89A69C3F2F319B43379399547526D952 ] AppID           C:\Windows\system32\drivers\appid.sys

13:39:09.0923 7656  AppID - ok

13:39:09.0946 7656  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll

13:39:09.0974 7656  AppIDSvc - ok

13:39:10.0039 7656  [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo         C:\Windows\System32\appinfo.dll

13:39:10.0066 7656  Appinfo - ok

13:39:10.0102 7656  [ 4ABA3E75A76195A3E38ED2766C962899 ] AppMgmt         C:\Windows\System32\appmgmts.dll

13:39:10.0113 7656  AppMgmt - ok

13:39:10.0126 7656  [ C484F8CEB1717C540242531DB7845C4E ] arc             C:\Windows\system32\DRIVERS\arc.sys

13:39:10.0137 7656  arc - ok

13:39:10.0152 7656  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys

13:39:10.0163 7656  arcsas - ok

13:39:10.0198 7656  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys

13:39:10.0226 7656  AsyncMac - ok

13:39:10.0242 7656  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi           C:\Windows\system32\drivers\atapi.sys

13:39:10.0252 7656  atapi - ok

13:39:10.0298 7656  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll

13:39:10.0330 7656  AudioEndpointBuilder - ok

13:39:10.0339 7656  [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv        C:\Windows\System32\Audiosrv.dll

13:39:10.0371 7656  AudioSrv - ok

13:39:10.0407 7656  [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV        C:\Windows\System32\AxInstSV.dll

13:39:10.0422 7656  AxInstSV - ok

13:39:10.0465 7656  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv         C:\Windows\system32\DRIVERS\bxvbda.sys

13:39:10.0484 7656  b06bdrv - ok

13:39:10.0515 7656  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys

13:39:10.0527 7656  b57nd60a - ok

13:39:10.0569 7656  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll

13:39:10.0580 7656  BDESVC - ok

13:39:10.0595 7656  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys

13:39:10.0622 7656  Beep - ok

13:39:10.0683 7656  [ 82974D6A2FD19445CC5171FC378668A4 ] BFE             C:\Windows\System32\bfe.dll

13:39:10.0730 7656  BFE - ok

13:39:10.0765 7656  [ 1EA7969E3271CBC59E1730697DC74682 ] BITS            C:\Windows\System32\qmgr.dll

13:39:10.0799 7656  BITS - ok

13:39:10.0830 7656  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys

13:39:10.0841 7656  blbdrive - ok

13:39:10.0882 7656  [ 8BC053CD1F5F11F79C80BE85BC289258 ] BlueletAudio    C:\Windows\system32\DRIVERS\blueletaudio.sys

13:39:10.0894 7656  BlueletAudio - ok

13:39:10.0925 7656  [ 46134C260E6B019AA24506B8AB4D42D3 ] BlueletSCOAudio C:\Windows\system32\DRIVERS\BlueletSCOAudio.sys

13:39:10.0933 7656  BlueletSCOAudio - ok

13:39:11.0028 7656  [ 941E435E5A903CC60E50E72037FA39D0 ] BlueSoleilCS    C:\Program Files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

13:39:11.0047 7656  BlueSoleilCS ( UnsignedFile.Multi.Generic ) - warning

13:39:11.0047 7656  BlueSoleilCS - detected UnsignedFile.Multi.Generic (1)

13:39:11.0081 7656  [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys

13:39:11.0092 7656  bowser - ok

13:39:11.0117 7656  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys

13:39:11.0129 7656  BrFiltLo - ok

13:39:11.0137 7656  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys

13:39:11.0149 7656  BrFiltUp - ok

13:39:11.0185 7656  [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser         C:\Windows\System32\browser.dll

13:39:11.0197 7656  Browser - ok

13:39:11.0220 7656  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid         C:\Windows\System32\Drivers\Brserid.sys

13:39:11.0232 7656  Brserid - ok

13:39:11.0251 7656  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys

13:39:11.0266 7656  BrSerWdm - ok

13:39:11.0269 7656  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys

13:39:11.0281 7656  BrUsbMdm - ok

13:39:11.0285 7656  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys

13:39:11.0296 7656  BrUsbSer - ok

13:39:11.0325 7656  [ 403E99F6DDB6CE624E0F81A554AFF178 ] BsHelpCS        C:\Program Files (x86)\IVT Corporation\BlueSoleil\BsHelpCS.exe

13:39:11.0330 7656  BsHelpCS ( UnsignedFile.Multi.Generic ) - warning

13:39:11.0330 7656  BsHelpCS - detected UnsignedFile.Multi.Generic (1)

13:39:11.0355 7656  [ EA05E37130B94670E8AA3379EAFAE22E ] BT              C:\Windows\system32\DRIVERS\btnetdrv.sys

13:39:11.0364 7656  BT - ok

13:39:11.0385 7656  BTCOM - ok

13:39:11.0519 7656  [ 8BFBA6EBB2654DEF3EBD4D882BAB8EE6 ] Btcsrusb        C:\Windows\system32\Drivers\btcusb.sys

13:39:11.0531 7656  Btcsrusb - ok

13:39:11.0586 7656  [ CF98190A94F62E405C8CB255018B2315 ] BthEnum         C:\Windows\system32\DRIVERS\BthEnum.sys

13:39:11.0601 7656  BthEnum - ok

13:39:11.0658 7656  [ 81229822FACAA324718B3B3C973688ED ] BtHidBus        C:\Windows\system32\Drivers\BtHidBus.sys

13:39:11.0669 7656  BtHidBus - ok

13:39:11.0693 7656  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys

13:39:11.0711 7656  BTHMODEM - ok

13:39:11.0733 7656  [ 02DD601B708DD0667E1331FA8518E9FF ] BthPan          C:\Windows\system32\DRIVERS\bthpan.sys

13:39:11.0747 7656  BthPan - ok

13:39:11.0791 7656  [ 738D0E9272F59EB7A1449C3EC118E6C4 ] BTHPORT         C:\Windows\system32\Drivers\BTHport.sys

13:39:11.0811 7656  BTHPORT - ok

13:39:11.0846 7656  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv         C:\Windows\system32\bthserv.dll

13:39:11.0874 7656  bthserv - ok

13:39:11.0899 7656  [ F188B7394D81010767B6DF3178519A37 ] BTHUSB          C:\Windows\system32\Drivers\BTHUSB.sys

13:39:11.0910 7656  BTHUSB - ok

13:39:11.0929 7656  [ 2531372CC2AD7C7204A7520DC7C2D0DA ] btnetBUs        C:\Windows\system32\Drivers\btnetBus.sys

13:39:11.0937 7656  btnetBUs - ok

13:39:11.0962 7656  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys

13:39:11.0991 7656  cdfs - ok

13:39:12.0040 7656  [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom           C:\Windows\system32\DRIVERS\cdrom.sys

13:39:12.0052 7656  cdrom - ok

13:39:12.0090 7656  [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc     C:\Windows\System32\certprop.dll

13:39:12.0118 7656  CertPropSvc - ok

13:39:12.0154 7656  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys

13:39:12.0167 7656  circlass - ok

13:39:12.0197 7656  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys

13:39:12.0211 7656  CLFS - ok

13:39:12.0267 7656  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe

13:39:12.0280 7656  clr_optimization_v2.0.50727_32 - ok

13:39:12.0338 7656  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe

13:39:12.0351 7656  clr_optimization_v2.0.50727_64 - ok

13:39:12.0416 7656  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe

13:39:12.0426 7656  clr_optimization_v4.0.30319_32 - ok

13:39:12.0468 7656  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe

13:39:12.0482 7656  clr_optimization_v4.0.30319_64 - ok

13:39:12.0519 7656  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys

13:39:12.0530 7656  CmBatt - ok

13:39:12.0551 7656  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\drivers\cmdide.sys

13:39:12.0561 7656  cmdide - ok

13:39:12.0598 7656  [ AAFCB52FE0037207FB6FBEA070D25EFE ] CNG             C:\Windows\system32\Drivers\cng.sys

13:39:12.0618 7656  CNG - ok

13:39:12.0635 7656  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys

13:39:12.0645 7656  Compbatt - ok

13:39:12.0682 7656  [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus    C:\Windows\system32\drivers\CompositeBus.sys

13:39:12.0695 7656  CompositeBus - ok

13:39:12.0707 7656  COMSysApp - ok

13:39:12.0723 7656  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk         C:\Windows\system32\DRIVERS\crcdisk.sys

13:39:12.0733 7656  crcdisk - ok

13:39:12.0784 7656  [ 9C01375BE382E834CC26D1B7EAF2C4FE ] CryptSvc        C:\Windows\system32\cryptsvc.dll

13:39:12.0795 7656  CryptSvc - ok

13:39:12.0843 7656  [ 54DA3DFD29ED9F1619B6F53F3CE55E49 ] CSC             C:\Windows\system32\drivers\csc.sys

13:39:12.0862 7656  CSC - ok

13:39:12.0889 7656  [ 3AB183AB4D2C79DCF459CD2C1266B043 ] CscService      C:\Windows\System32\cscsvc.dll

13:39:12.0905 7656  CscService - ok

13:39:12.0947 7656  [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch      C:\Windows\system32\rpcss.dll

13:39:12.0978 7656  DcomLaunch - ok

13:39:13.0009 7656  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc       C:\Windows\System32\defragsvc.dll

13:39:13.0039 7656  defragsvc - ok

13:39:13.0073 7656  [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys

13:39:13.0100 7656  DfsC - ok

13:39:13.0125 7656  [ 2D589A2C024B2FB238535DB9F7B3597D ] DgiVecp         C:\Windows\system32\Drivers\DgiVecp.sys

13:39:13.0133 7656  DgiVecp - ok

13:39:13.0163 7656  [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp            C:\Windows\system32\dhcpcore.dll

13:39:13.0175 7656  Dhcp - ok

13:39:13.0202 7656  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys

13:39:13.0230 7656  discache - ok

13:39:13.0255 7656  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys

13:39:13.0266 7656  Disk - ok

13:39:13.0297 7656  [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache        C:\Windows\System32\dnsrslvr.dll

13:39:13.0309 7656  Dnscache - ok

13:39:13.0342 7656  [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc         C:\Windows\System32\dot3svc.dll

13:39:13.0380 7656  dot3svc - ok

13:39:13.0413 7656  [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS             C:\Windows\system32\dps.dll

13:39:13.0441 7656  DPS - ok

13:39:13.0468 7656  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud         C:\Windows\system32\drivers\drmkaud.sys

13:39:13.0480 7656  drmkaud - ok

13:39:13.0527 7656  [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl         C:\Windows\System32\drivers\dxgkrnl.sys

13:39:13.0554 7656  DXGKrnl - ok

13:39:13.0592 7656  [ 955F6564F448119C12AB3C048CCF8946 ] e1kexpress      C:\Windows\system32\DRIVERS\e1k60x64.sys

13:39:13.0607 7656  e1kexpress - ok

13:39:13.0631 7656  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost         C:\Windows\System32\eapsvc.dll

13:39:13.0660 7656  EapHost - ok

13:39:13.0755 7656  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv           C:\Windows\system32\DRIVERS\evbda.sys

13:39:13.0802 7656  ebdrv - ok

13:39:13.0861 7656  [ C118A82CD78818C29AB228366EBF81C3 ] EFS             C:\Windows\System32\lsass.exe

13:39:13.0876 7656  EFS - ok

13:39:13.0933 7656  [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr         C:\Windows\ehome\ehRecvr.exe

13:39:13.0949 7656  ehRecvr - ok

13:39:13.0973 7656  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched         C:\Windows\ehome\ehsched.exe

13:39:13.0985 7656  ehSched - ok

13:39:14.0034 7656  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor         C:\Windows\system32\DRIVERS\elxstor.sys

13:39:14.0050 7656  elxstor - ok

13:39:14.0067 7656  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\drivers\errdev.sys

13:39:14.0078 7656  ErrDev - ok

13:39:14.0130 7656  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem     C:\Windows\system32\es.dll

13:39:14.0161 7656  EventSystem - ok

13:39:14.0190 7656  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat           C:\Windows\system32\drivers\exfat.sys

13:39:14.0220 7656  exfat - ok

13:39:14.0239 7656  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat         C:\Windows\system32\drivers\fastfat.sys

13:39:14.0268 7656  fastfat - ok

13:39:14.0312 7656  [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax             C:\Windows\system32\fxssvc.exe

13:39:14.0327 7656  Fax - ok

13:39:14.0356 7656  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc             C:\Windows\system32\DRIVERS\fdc.sys

13:39:14.0367 7656  fdc - ok

13:39:14.0377 7656  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost         C:\Windows\system32\fdPHost.dll

13:39:14.0406 7656  fdPHost - ok

13:39:14.0416 7656  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll

13:39:14.0444 7656  FDResPub - ok

13:39:14.0459 7656  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys

13:39:14.0470 7656  FileInfo - ok

13:39:14.0481 7656  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace       C:\Windows\system32\drivers\filetrace.sys

13:39:14.0509 7656  Filetrace - ok

13:39:14.0553 7656  [ BB0667B0171B632B97EA759515476F07 ] FLEXnet Licensing Service C:\Program Files (x86)\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe

13:39:14.0567 7656  FLEXnet Licensing Service - ok

13:39:14.0581 7656  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys

13:39:14.0591 7656  flpydisk - ok

13:39:14.0635 7656  [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys

13:39:14.0648 7656  FltMgr - ok

13:39:14.0690 7656  [ 5B92E2B067F64DC53698EB84966B3F0D ] FontCache       C:\Windows\system32\FntCache.dll

13:39:14.0710 7656  FontCache - ok

13:39:14.0759 7656  [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe

13:39:14.0772 7656  FontCache3.0.0.0 - ok

13:39:14.0798 7656  [ D43703496149971890703B4B1B723EAC ] FsDepends       C:\Windows\system32\drivers\FsDepends.sys

13:39:14.0814 7656  FsDepends - ok

13:39:14.0841 7656  [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys

13:39:14.0856 7656  Fs_Rec - ok

13:39:14.0890 7656  [ 1F7B25B858FA27015169FE95E54108ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys

13:39:14.0912 7656  fvevol - ok

13:39:14.0942 7656  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys

13:39:14.0958 7656  gagp30kx - ok

13:39:15.0001 7656  [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc           C:\Windows\System32\gpsvc.dll

13:39:15.0041 7656  gpsvc - ok

13:39:15.0092 7656  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys

13:39:15.0109 7656  hcw85cir - ok

13:39:15.0261 7656  [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys

13:39:15.0282 7656  HdAudAddService - ok

13:39:15.0382 7656  [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus        C:\Windows\system32\drivers\HDAudBus.sys

13:39:15.0401 7656  HDAudBus - ok

13:39:15.0422 7656  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt         C:\Windows\system32\DRIVERS\HidBatt.sys

13:39:15.0437 7656  HidBatt - ok

13:39:15.0457 7656  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys

13:39:15.0477 7656  HidBth - ok

13:39:15.0488 7656  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr           C:\Windows\system32\DRIVERS\hidir.sys

13:39:15.0504 7656  HidIr - ok

13:39:15.0539 7656  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv         C:\Windows\system32\hidserv.dll

13:39:15.0567 7656  hidserv - ok

13:39:15.0615 7656  [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys

13:39:15.0627 7656  HidUsb - ok

13:39:15.0655 7656  [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc          C:\Windows\system32\kmsvc.dll

13:39:15.0684 7656  hkmsvc - ok

13:39:15.0712 7656  [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll

13:39:15.0724 7656  HomeGroupListener - ok

13:39:15.0757 7656  [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll

13:39:15.0770 7656  HomeGroupProvider - ok

13:39:15.0796 7656  [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD          C:\Windows\system32\drivers\HpSAMD.sys

13:39:15.0806 7656  HpSAMD - ok

13:39:15.0852 7656  [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP            C:\Windows\system32\drivers\HTTP.sys

13:39:15.0885 7656  HTTP - ok

13:39:15.0935 7656  [ D969D0E26C5B1E813B17066A8318D5D4 ] hwdatacard      C:\Windows\system32\DRIVERS\ewusbmdm.sys

13:39:15.0945 7656  hwdatacard - ok

13:39:15.0960 7656  [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys

13:39:15.0970 7656  hwpolicy - ok

13:39:16.0025 7656  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\drivers\i8042prt.sys

13:39:16.0038 7656  i8042prt - ok

13:39:16.0069 7656  [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV         C:\Windows\system32\drivers\iaStorV.sys

13:39:16.0083 7656  iaStorV - ok

13:39:16.0134 7656  [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc           C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe

13:39:16.0151 7656  idsvc - ok

13:39:16.0379 7656  [ C6238C6ABD6AC99F5D152DA4E9439A3D ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys

13:39:16.0479 7656  igfx - ok

13:39:16.0521 7656  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp           C:\Windows\system32\DRIVERS\iirsp.sys

13:39:16.0532 7656  iirsp - ok

13:39:16.0581 7656  [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT          C:\Windows\System32\ikeext.dll

13:39:16.0614 7656  IKEEXT - ok

13:39:16.0643 7656  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\drivers\intelide.sys

13:39:16.0653 7656  intelide - ok

13:39:16.0676 7656  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys

13:39:16.0687 7656  intelppm - ok

13:39:16.0717 7656  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum       C:\Windows\system32\ipbusenum.dll

13:39:16.0745 7656  IPBusEnum - ok

13:39:16.0770 7656  [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys

13:39:16.0797 7656  IpFilterDriver - ok

13:39:16.0836 7656  [ 08C2957BB30058E663720C5606885653 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll

13:39:16.0851 7656  iphlpsvc - ok

13:39:16.0871 7656  [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV         C:\Windows\system32\drivers\IPMIDrv.sys

13:39:16.0882 7656  IPMIDRV - ok

13:39:16.0897 7656  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT           C:\Windows\system32\drivers\ipnat.sys

13:39:16.0925 7656  IPNAT - ok

13:39:16.0949 7656  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys

13:39:16.0963 7656  IRENUM - ok

13:39:16.0981 7656  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\drivers\isapnp.sys

13:39:16.0991 7656  isapnp - ok

13:39:17.0010 7656  [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt        C:\Windows\system32\drivers\msiscsi.sys

13:39:17.0025 7656  iScsiPrt - ok

13:39:17.0049 7656  [ 70EBDA3ED637B0212450C5542EDD11A7 ] IvtAudioBusSrv  C:\Windows\system32\Drivers\IvtBtBus.sys

13:39:17.0057 7656  IvtAudioBusSrv - ok

13:39:17.0061 7656  [ 70EBDA3ED637B0212450C5542EDD11A7 ] IvtBtBUs        C:\Windows\system32\Drivers\IvtBtBus.sys

13:39:17.0068 7656  IvtBtBUs - ok

13:39:17.0071 7656  IvtComBusSrv - ok

13:39:17.0095 7656  [ 2531372CC2AD7C7204A7520DC7C2D0DA ] IvtPanBusSrv    C:\Windows\system32\Drivers\btnetBus.sys

13:39:17.0103 7656  IvtPanBusSrv - ok

13:39:17.0138 7656  [ C04133591DA4F0E4F139BA02020E156E ] kavbootc        C:\Windows\system32\drivers\kavbootc64.sys

13:39:17.0146 7656  kavbootc - ok

13:39:17.0171 7656  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys

13:39:17.0182 7656  kbdclass - ok

13:39:17.0211 7656  [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys

13:39:17.0221 7656  kbdhid - ok

13:39:17.0318 7656  [ 1F36BC853A467AEE5C55749D0CD67689 ] KDHacker        c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys

13:39:17.0332 7656  KDHacker - ok

13:39:17.0344 7656  [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso          C:\Windows\system32\lsass.exe

13:39:17.0354 7656  KeyIso - ok

13:39:17.0365 7656  [ 9B64685E594265EE5CD168CA7A513E08 ] kisknl          C:\Windows\system32\drivers\kisknl.sys

13:39:17.0376 7656  kisknl - ok

13:39:17.0418 7656  [ 07071C1E3CD8F0F9114AAC8B072CA1E5 ] KMWDFILTER      C:\Windows\system32\DRIVERS\KMWDFILTER.sys

13:39:17.0426 7656  KMWDFILTER - ok

13:39:17.0461 7656  [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys

13:39:17.0472 7656  KSecDD - ok

13:39:17.0488 7656  [ 7EFB9333E4ECCE6AE4AE9D777D9E553E ] KSecPkg         C:\Windows\system32\Drivers\ksecpkg.sys

13:39:17.0500 7656  KSecPkg - ok

13:39:17.0533 7656  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk         C:\Windows\system32\drivers\ksthunk.sys

13:39:17.0561 7656  ksthunk - ok

13:39:17.0597 7656  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm           C:\Windows\system32\msdtckrm.dll

13:39:17.0630 7656  KtmRm - ok

13:39:17.0686 7656  [ 2D838D0AB6CEF453F690E3D22C2F443C ] KUsbGuard       C:\Program Files (x86)\kingsoft\kingsoft antivirus\kusbquery64.sys

13:39:17.0695 7656  KUsbGuard - ok

13:39:17.0732 7656  [ D475D06DE67A3A1D9AD9E632B4C1501C ] kxescore        c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe

13:39:17.0744 7656  kxescore - ok

13:39:17.0781 7656  [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer    C:\Windows\system32\srvsvc.dll

13:39:17.0810 7656  LanmanServer - ok

13:39:17.0837 7656  [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll

13:39:17.0865 7656  LanmanWorkstation - ok

13:39:17.0992 7656  [ 70FB6254E29150A7A4A39FDFFD306C33 ] LBTServ         C:\Program Files\Common Files\LogiShrd\Bluetooth\lbtserv.exe

13:39:18.0011 7656  LBTServ - ok

13:39:18.0053 7656  [ 1470EF17E02E82E4F43346DF9E9F11E1 ] LHidFilt        C:\Windows\system32\DRIVERS\LHidFilt.Sys

13:39:18.0064 7656  LHidFilt - ok

13:39:18.0078 7656  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys

13:39:18.0107 7656  lltdio - ok

13:39:18.0145 7656  [ C1185803384AB3FEED115F79F109427F ] lltdsvc         C:\Windows\System32\lltdsvc.dll

13:39:18.0176 7656  lltdsvc - ok

13:39:18.0196 7656  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts         C:\Windows\System32\lmhsvc.dll

13:39:18.0225 7656  lmhosts - ok

13:39:18.0230 7656  [ 12814AE119E959437BEA3110F81BD188 ] LMouFilt        C:\Windows\system32\DRIVERS\LMouFilt.Sys

13:39:18.0239 7656  LMouFilt - ok

13:39:18.0273 7656  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys

13:39:18.0284 7656  LSI_FC - ok

13:39:18.0308 7656  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS         C:\Windows\system32\DRIVERS\lsi_sas.sys

13:39:18.0319 7656  LSI_SAS - ok

13:39:18.0339 7656  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys

13:39:18.0349 7656  LSI_SAS2 - ok

13:39:18.0365 7656  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys

13:39:18.0376 7656  LSI_SCSI - ok

13:39:18.0406 7656  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv           C:\Windows\system32\drivers\luafv.sys

13:39:18.0438 7656  luafv - ok

13:39:18.0492 7656  [ 986C1CB787A007BAA5F74E7D316D7246 ] LVRS64          C:\Windows\system32\DRIVERS\lvrs64.sys

13:39:18.0503 7656  LVRS64 - ok

13:39:18.0653 7656  [ 5747BC465ABEA2858C5D037252AED84E ] LVUVC64         C:\Windows\system32\DRIVERS\lvuvc64.sys

13:39:18.0732 7656  LVUVC64 - ok

13:39:18.0806 7656  [ 31C6AFFFAD7C733A65F888929548BC22 ] mbamchameleon   C:\Windows\system32\drivers\mbamchameleon.sys

13:39:18.0822 7656  mbamchameleon - ok

13:39:18.0847 7656  [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc         C:\Windows\system32\Mcx2Svc.dll

13:39:18.0860 7656  Mcx2Svc - ok

13:39:18.0891 7656  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas         C:\Windows\system32\DRIVERS\megasas.sys

13:39:18.0902 7656  megasas - ok

13:39:18.0916 7656  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys

13:39:18.0929 7656  MegaSR - ok

13:39:18.0957 7656  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS           C:\Windows\system32\mmcss.dll

13:39:18.0986 7656  MMCSS - ok

13:39:19.0004 7656  [ 800BA92F7010378B09F9ED9270F07137 ] Modem           C:\Windows\system32\drivers\modem.sys

13:39:19.0033 7656  Modem - ok

13:39:19.0067 7656  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor         C:\Windows\system32\DRIVERS\monitor.sys

13:39:19.0080 7656  monitor - ok

13:39:19.0119 7656  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys

13:39:19.0129 7656  mouclass - ok

13:39:19.0157 7656  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys

13:39:19.0168 7656  mouhid - ok

13:39:19.0206 7656  [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys

13:39:19.0217 7656  mountmgr - ok

13:39:19.0243 7656  [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio            C:\Windows\system32\drivers\mpio.sys

13:39:19.0255 7656  mpio - ok

13:39:19.0274 7656  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys

13:39:19.0302 7656  mpsdrv - ok

13:39:19.0353 7656  [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc          C:\Windows\system32\mpssvc.dll

13:39:19.0402 7656  MpsSvc - ok

13:39:19.0430 7656  [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys

13:39:19.0445 7656  MRxDAV - ok

13:39:19.0477 7656  [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys

13:39:19.0488 7656  mrxsmb - ok

13:39:19.0505 7656  [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys

13:39:19.0518 7656  mrxsmb10 - ok

13:39:19.0534 7656  [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys

13:39:19.0546 7656  mrxsmb20 - ok

13:39:19.0574 7656  [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci          C:\Windows\system32\drivers\msahci.sys

13:39:19.0584 7656  msahci - ok

13:39:19.0607 7656  [ DB801A638D011B9633829EB6F663C900 ] msdsm           C:\Windows\system32\drivers\msdsm.sys

13:39:19.0619 7656  msdsm - ok

13:39:19.0640 7656  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC           C:\Windows\System32\msdtc.exe

13:39:19.0652 7656  MSDTC - ok

13:39:19.0659 7656  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys

13:39:19.0687 7656  Msfs - ok

13:39:19.0701 7656  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf       C:\Windows\System32\drivers\mshidkmdf.sys

13:39:19.0729 7656  mshidkmdf - ok

13:39:19.0744 7656  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\drivers\msisadrv.sys

13:39:19.0754 7656  msisadrv - ok

13:39:19.0788 7656  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI         C:\Windows\system32\iscsiexe.dll

13:39:19.0818 7656  MSiSCSI - ok

13:39:19.0821 7656  msiserver - ok

13:39:19.0849 7656  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV         C:\Windows\system32\drivers\MSKSSRV.sys

13:39:19.0877 7656  MSKSSRV - ok

13:39:19.0884 7656  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys

13:39:19.0912 7656  MSPCLOCK - ok

13:39:19.0927 7656  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM           C:\Windows\system32\drivers\MSPQM.sys

13:39:19.0955 7656  MSPQM - ok

13:39:19.0996 7656  [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC           C:\Windows\system32\drivers\MsRPC.sys

13:39:20.0010 7656  MsRPC - ok

13:39:20.0025 7656  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\drivers\mssmbios.sys

13:39:20.0036 7656  mssmbios - ok

13:39:20.0040 7656  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE           C:\Windows\system32\drivers\MSTEE.sys

13:39:20.0069 7656  MSTEE - ok

13:39:20.0081 7656  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys

13:39:20.0093 7656  MTConfig - ok

13:39:20.0116 7656  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup             C:\Windows\system32\Drivers\mup.sys

13:39:20.0127 7656  Mup - ok

13:39:20.0167 7656  [ 582AC6D9873E31DFA28A4547270862DD ] napagent        C:\Windows\system32\qagentRT.dll

13:39:20.0198 7656  napagent - ok

13:39:20.0240 7656  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP     C:\Windows\system32\DRIVERS\nwifi.sys

13:39:20.0264 7656  NativeWifiP - ok

13:39:20.0319 7656  [ 760E38053BF56E501D562B70AD796B88 ] NDIS            C:\Windows\system32\drivers\ndis.sys

13:39:20.0347 7656  NDIS - ok

13:39:20.0368 7656  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap         C:\Windows\system32\DRIVERS\ndiscap.sys

13:39:20.0397 7656  NdisCap - ok

13:39:20.0472 7656  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys

13:39:20.0500 7656  NdisTapi - ok

13:39:20.0574 7656  [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio         C:\Windows\system32\DRIVERS\ndisuio.sys

13:39:20.0609 7656  Ndisuio - ok

13:39:20.0638 7656  [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan         C:\Windows\system32\DRIVERS\ndiswan.sys

13:39:20.0666 7656  NdisWan - ok

13:39:20.0697 7656  [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy         C:\Windows\system32\drivers\NDProxy.sys

13:39:20.0724 7656  NDProxy - ok

13:39:20.0737 7656  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS         C:\Windows\system32\DRIVERS\netbios.sys

13:39:20.0764 7656  NetBIOS - ok

13:39:20.0805 7656  [ 09594D1089C523423B32A4229263F068 ] NetBT           C:\Windows\system32\DRIVERS\netbt.sys

13:39:20.0833 7656  NetBT - ok

13:39:20.0843 7656  [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon        C:\Windows\system32\lsass.exe

13:39:20.0854 7656  Netlogon - ok

13:39:20.0886 7656  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll

13:39:20.0917 7656  Netman - ok

13:39:20.0937 7656  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll

13:39:20.0969 7656  netprofm - ok

13:39:20.0990 7656  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe

13:39:21.0000 7656  NetTcpPortSharing - ok

13:39:21.0027 7656  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960         C:\Windows\system32\DRIVERS\nfrd960.sys

13:39:21.0038 7656  nfrd960 - ok

13:39:21.0112 7656  [ 3A936AD705E1A20852DC6C694CB192F7 ] NitroReaderDriverReadSpool3 C:\Program Files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe

13:39:21.0122 7656  NitroReaderDriverReadSpool3 - ok

13:39:21.0154 7656  [ 8AD77806D336673F270DB31645267293 ] NlaSvc          C:\Windows\System32\nlasvc.dll

13:39:21.0167 7656  NlaSvc - ok

13:39:21.0233 7656  [ 6EF0506CE1F553E9BD085645933C8686 ] NMIndexingService C:\Program Files (x86)\Common Files\Nero\Lib\NMIndexingService.exe

13:39:21.0250 7656  NMIndexingService - ok

13:39:21.0266 7656  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys

13:39:21.0295 7656  Npfs - ok

13:39:21.0317 7656  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi             C:\Windows\system32\nsisvc.dll

13:39:21.0346 7656  nsi - ok

13:39:21.0360 7656  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys

13:39:21.0388 7656  nsiproxy - ok

13:39:21.0446 7656  [ E453ACF4E7D44E5530B5D5F2B9CA8563 ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys

13:39:21.0475 7656  Ntfs - ok

13:39:21.0483 7656  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys

13:39:21.0510 7656  Null - ok

13:39:21.0541 7656  [ 0A92CB65770442ED0DC44834632F66AD ] nvraid          C:\Windows\system32\drivers\nvraid.sys

13:39:21.0553 7656  nvraid - ok

13:39:21.0567 7656  [ DAB0E87525C10052BF65F06152F37E4A ] nvstor          C:\Windows\system32\drivers\nvstor.sys

13:39:21.0579 7656  nvstor - ok

13:39:21.0605 7656  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\drivers\nv_agp.sys

13:39:21.0616 7656  nv_agp - ok

13:39:21.0631 7656  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\drivers\ohci1394.sys

13:39:21.0643 7656  ohci1394 - ok

13:39:21.0667 7656  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll

13:39:21.0680 7656  p2pimsvc - ok

13:39:21.0702 7656  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll

13:39:21.0716 7656  p2psvc - ok

13:39:21.0734 7656  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport         C:\Windows\system32\DRIVERS\parport.sys

13:39:21.0745 7656  Parport - ok

13:39:21.0768 7656  [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr         C:\Windows\system32\drivers\partmgr.sys

13:39:21.0779 7656  partmgr - ok

13:39:21.0791 7656  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll

13:39:21.0808 7656  PcaSvc - ok

13:39:21.0829 7656  pccsmcfd - ok

13:39:21.0844 7656  [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci             C:\Windows\system32\drivers\pci.sys

13:39:21.0856 7656  pci - ok

13:39:21.0877 7656  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\drivers\pciide.sys

13:39:21.0887 7656  pciide - ok

13:39:21.0909 7656  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys

13:39:21.0921 7656  pcmcia - ok

13:39:21.0937 7656  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw             C:\Windows\system32\drivers\pcw.sys

13:39:21.0948 7656  pcw - ok

13:39:21.0971 7656  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys

13:39:22.0004 7656  PEAUTH - ok

13:39:22.0051 7656  [ B9B0A4299DD2D76A4243F75FD54DC680 ] PeerDistSvc     C:\Windows\system32\peerdistsvc.dll

13:39:22.0073 7656  PeerDistSvc - ok

13:39:22.0154 7656  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe

13:39:22.0166 7656  PerfHost - ok

13:39:22.0227 7656  [ FE8AF03EFEC0387FBBFCFD32E328DB9A ] phaudlwr        C:\Windows\system32\DRIVERS\phaudlwr.sys

13:39:22.0237 7656  phaudlwr - ok

13:39:22.0286 7656  [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla             C:\Windows\system32\pla.dll

13:39:22.0324 7656  pla - ok

13:39:22.0373 7656  [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll

13:39:22.0387 7656  PlugPlay - ok

13:39:22.0410 7656  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg     C:\Windows\system32\pnrpauto.dll

13:39:22.0421 7656  PNRPAutoReg - ok

13:39:22.0438 7656  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc         C:\Windows\system32\pnrpsvc.dll

13:39:22.0452 7656  PNRPsvc - ok

13:39:22.0489 7656  [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent     C:\Windows\System32\ipsecsvc.dll

13:39:22.0521 7656  PolicyAgent - ok

13:39:22.0552 7656  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power           C:\Windows\system32\umpo.dll

13:39:22.0582 7656  Power - ok

13:39:22.0620 7656  [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys

13:39:22.0648 7656  PptpMiniport - ok

13:39:22.0676 7656  PQNTDrv - ok

13:39:22.0698 7656  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor       C:\Windows\system32\DRIVERS\processr.sys

13:39:22.0709 7656  Processor - ok

13:39:22.0746 7656  [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc         C:\Windows\system32\profsvc.dll

13:39:22.0759 7656  ProfSvc - ok

13:39:22.0767 7656  [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe

13:39:22.0779 7656  ProtectedStorage - ok

13:39:22.0817 7656  [ 0557CF5A2556BD58E26384169D72438D ] Psched          C:\Windows\system32\DRIVERS\pacer.sys

13:39:22.0844 7656  Psched - ok

13:39:22.0894 7656  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys

13:39:22.0924 7656  ql2300 - ok

13:39:22.0939 7656  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys

13:39:22.0951 7656  ql40xx - ok

13:39:23.0034 7656  QQPCRTP - ok

13:39:23.0048 7656  QQSysMonX64 - ok

13:39:23.0103 7656  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE           C:\Windows\system32\qwave.dll

13:39:23.0121 7656  QWAVE - ok

13:39:23.0133 7656  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys

13:39:23.0148 7656  QWAVEdrv - ok

13:39:23.0201 7656  [ A55E7D0D873B2C97585B3B5926AC6ADE ] RapiMgr         C:\Windows\WindowsMobile\rapimgr.dll

13:39:23.0212 7656  RapiMgr - ok

13:39:23.0224 7656  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys

13:39:23.0251 7656  RasAcd - ok

13:39:23.0284 7656  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn     C:\Windows\system32\DRIVERS\AgileVpn.sys

13:39:23.0313 7656  RasAgileVpn - ok

13:39:23.0326 7656  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto         C:\Windows\System32\rasauto.dll

13:39:23.0356 7656  RasAuto - ok

13:39:23.0383 7656  [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp         C:\Windows\system32\DRIVERS\rasl2tp.sys

13:39:23.0410 7656  Rasl2tp - ok

13:39:23.0428 7656  [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan          C:\Windows\System32\rasmans.dll

13:39:23.0458 7656  RasMan - ok

13:39:23.0482 7656  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys

13:39:23.0511 7656  RasPppoe - ok

13:39:23.0520 7656  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp         C:\Windows\system32\DRIVERS\rassstp.sys

13:39:23.0549 7656  RasSstp - ok

13:39:23.0580 7656  [ 77F665941019A1594D887A74F301FA2F ] rdbss           C:\Windows\system32\DRIVERS\rdbss.sys

13:39:23.0609 7656  rdbss - ok

13:39:23.0623 7656  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys

13:39:23.0636 7656  rdpbus - ok

13:39:23.0647 7656  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys

13:39:23.0674 7656  RDPCDD - ok

13:39:23.0715 7656  [ 1B6163C503398B23FF8B939C67747683 ] RDPDR           C:\Windows\system32\drivers\rdpdr.sys

13:39:23.0727 7656  RDPDR - ok

13:39:23.0755 7656  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys

13:39:23.0783 7656  RDPENCDD - ok

13:39:23.0787 7656  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys

13:39:23.0816 7656  RDPREFMP - ok

13:39:23.0853 7656  [ 313F68E1A3E6345A4F47A36B07062F34 ] RdpVideoMiniport C:\Windows\system32\drivers\rdpvideominiport.sys

13:39:23.0863 7656  RdpVideoMiniport - ok

13:39:23.0897 7656  [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD           C:\Windows\system32\drivers\RDPWD.sys

13:39:23.0909 7656  RDPWD - ok

13:39:23.0940 7656  [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys

13:39:23.0953 7656  rdyboost - ok

13:39:23.0975 7656  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll

13:39:24.0005 7656  RemoteAccess - ok

13:39:24.0040 7656  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll

13:39:24.0072 7656  RemoteRegistry - ok

13:39:24.0112 7656  [ 3DD798846E2C28102B922C56E71B7932 ] RFCOMM          C:\Windows\system32\DRIVERS\rfcomm.sys

13:39:24.0125 7656  RFCOMM - ok

13:39:24.0162 7656  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll

13:39:24.0191 7656  RpcEptMapper - ok

13:39:24.0210 7656  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe

13:39:24.0221 7656  RpcLocator - ok

13:39:24.0259 7656  [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs           C:\Windows\system32\rpcss.dll

13:39:24.0290 7656  RpcSs - ok

13:39:24.0330 7656  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys

13:39:24.0358 7656  rspndr - ok

13:39:24.0388 7656  [ E60C0A09F997826C7627B244195AB581 ] s3cap           C:\Windows\system32\drivers\vms3cap.sys

13:39:24.0398 7656  s3cap - ok

13:39:24.0418 7656  [ C118A82CD78818C29AB228366EBF81C3 ] SamSs           C:\Windows\system32\lsass.exe

13:39:24.0429 7656  SamSs - ok

13:39:24.0446 7656  [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port        C:\Windows\system32\drivers\sbp2port.sys

13:39:24.0457 7656  sbp2port - ok

13:39:24.0471 7656  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll

13:39:24.0501 7656  SCardSvr - ok

13:39:24.0558 7656  [ B00BCE3D99FE7CE29C6E873AC62F450E ] SCDEmu          C:\Windows\system32\drivers\SCDEmu.sys

13:39:24.0568 7656  SCDEmu - ok

13:39:24.0597 7656  [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys

13:39:24.0624 7656  scfilter - ok

13:39:24.0669 7656  [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule        C:\Windows\system32\schedsvc.dll

13:39:24.0706 7656  Schedule - ok

13:39:24.0729 7656  [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc     C:\Windows\System32\certprop.dll

13:39:24.0756 7656  SCPolicySvc - ok

13:39:24.0784 7656  [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC          C:\Windows\System32\SDRSVC.dll

13:39:24.0796 7656  SDRSVC - ok

13:39:24.0832 7656  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys

13:39:24.0860 7656  secdrv - ok

13:39:24.0892 7656  [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon        C:\Windows\system32\seclogon.dll

13:39:24.0920 7656  seclogon - ok

13:39:24.0952 7656  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll

13:39:24.0982 7656  SENS - ok

13:39:24.0995 7656  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll

13:39:25.0007 7656  SensrSvc - ok

13:39:25.0021 7656  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum         C:\Windows\system32\DRIVERS\serenum.sys

13:39:25.0032 7656  Serenum - ok

13:39:25.0045 7656  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys

13:39:25.0057 7656  Serial - ok

13:39:25.0077 7656  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys

13:39:25.0088 7656  sermouse - ok

13:39:25.0123 7656  [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv      C:\Windows\system32\sessenv.dll

13:39:25.0151 7656  SessionEnv - ok

13:39:25.0166 7656  [ A554811BCD09279536440C964AE35BBF ] sffdisk         C:\Windows\system32\drivers\sffdisk.sys

13:39:25.0178 7656  sffdisk - ok

13:39:25.0187 7656  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\drivers\sffp_mmc.sys

13:39:25.0199 7656  sffp_mmc - ok

13:39:25.0207 7656  [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd         C:\Windows\system32\drivers\sffp_sd.sys

13:39:25.0220 7656  sffp_sd - ok

13:39:25.0232 7656  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy         C:\Windows\system32\DRIVERS\sfloppy.sys

13:39:25.0243 7656  sfloppy - ok

13:39:25.0276 7656  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll

13:39:25.0307 7656  SharedAccess - ok

13:39:25.0326 7656  [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll

13:39:25.0357 7656  ShellHWDetection - ok

13:39:25.0383 7656  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys

13:39:25.0393 7656  SiSRaid2 - ok

13:39:25.0404 7656  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys

13:39:25.0415 7656  SiSRaid4 - ok

13:39:25.0470 7656  [ FF0DB4D9A08864A5C7B67477CD8E3B2A ] SkypeUpdate     C:\Program Files (x86)\Skype\Updater\Updater.exe

13:39:25.0479 7656  SkypeUpdate - ok

13:39:25.0511 7656  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb             C:\Windows\system32\DRIVERS\smb.sys

13:39:25.0539 7656  Smb - ok

13:39:25.0569 7656  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe

13:39:25.0581 7656  SNMPTRAP - ok

13:39:25.0710 7656  [ B0D84C0756B2C4A6965DB7DE730AD635 ] SPC1000         C:\Windows\system32\DRIVERS\spc1000.sys

13:39:25.0751 7656  SPC1000 - ok

13:39:25.0760 7656  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr           C:\Windows\system32\drivers\spldr.sys

13:39:25.0770 7656  spldr - ok

13:39:25.0800 7656  [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler         C:\Windows\System32\spoolsv.exe

13:39:25.0815 7656  Spooler - ok

13:39:25.0917 7656  [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc          C:\Windows\system32\sppsvc.exe

13:39:25.0981 7656  sppsvc - ok

13:39:26.0001 7656  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify     C:\Windows\system32\sppuinotify.dll

13:39:26.0031 7656  sppuinotify - ok

13:39:26.0070 7656  [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv             C:\Windows\system32\DRIVERS\srv.sys

13:39:26.0083 7656  srv - ok

13:39:26.0103 7656  [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys

13:39:26.0117 7656  srv2 - ok

13:39:26.0134 7656  [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys

13:39:26.0146 7656  srvnet - ok

13:39:26.0184 7656  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV         C:\Windows\System32\ssdpsrv.dll

13:39:26.0214 7656  SSDPSRV - ok

13:39:26.0228 7656  [ 0211AB46B73A2623B86C1CFCB30579AB ] SSPORT          C:\Windows\system32\Drivers\SSPORT.sys

13:39:26.0236 7656  SSPORT - ok

13:39:26.0246 7656  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc         C:\Windows\system32\sstpsvc.dll

13:39:26.0275 7656  SstpSvc - ok

13:39:26.0310 7656  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys

13:39:26.0320 7656  stexstor - ok

13:39:26.0374 7656  [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc          C:\Windows\System32\wiaservc.dll

13:39:26.0399 7656  stisvc - ok

13:39:26.0440 7656  [ 7785DC213270D2FC066538DAF94087E7 ] storflt         C:\Windows\system32\drivers\vmstorfl.sys

13:39:26.0450 7656  storflt - ok

13:39:26.0485 7656  [ D34E4943D5AC096C8EDEEBFD80D76E23 ] storvsc         C:\Windows\system32\drivers\storvsc.sys

13:39:26.0495 7656  storvsc - ok

13:39:26.0529 7656  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\drivers\swenum.sys

13:39:26.0539 7656  swenum - ok

13:39:26.0557 7656  [ E08E46FDD841B7184194011CA1955A0B ] swprv           C:\Windows\System32\swprv.dll

13:39:26.0590 7656  swprv - ok

13:39:26.0612 7656  Synth3dVsc - ok

13:39:26.0683 7656  [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain         C:\Windows\system32\sysmain.dll

13:39:26.0723 7656  SysMain - ok

13:39:26.0755 7656  [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll

13:39:26.0771 7656  TabletInputService - ok

13:39:26.0818 7656  [ A8D3F11BC8F37C3D7D026C3E1219B5AC ] tap0901         C:\Windows\system32\DRIVERS\tap0901.sys

13:39:26.0827 7656  tap0901 - ok

13:39:26.0843 7656  [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv         C:\Windows\System32\tapisrv.dll

13:39:26.0873 7656  TapiSrv - ok

13:39:26.0920 7656  [ F7CABF86615803051D586FBF4D916048 ] tapSF0901       C:\Windows\system32\DRIVERS\tapSF0901.sys

13:39:26.0929 7656  tapSF0901 - ok

13:39:26.0951 7656  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS             C:\Windows\System32\tbssvc.dll

13:39:26.0981 7656  TBS - ok

13:39:27.0041 7656  [ 37608401DFDB388CAF66917F6B2D6FB0 ] Tcpip           C:\Windows\system32\drivers\tcpip.sys

13:39:27.0074 7656  Tcpip - ok

13:39:27.0107 7656  [ 37608401DFDB388CAF66917F6B2D6FB0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys

13:39:27.0139 7656  TCPIP6 - ok

13:39:27.0170 7656  [ 1B16D0BD9841794A6E0CDE0CEF744ABC ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys

13:39:27.0182 7656  tcpipreg - ok

13:39:27.0211 7656  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys

13:39:27.0222 7656  TDPIPE - ok

13:39:27.0248 7656  [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP           C:\Windows\system32\drivers\tdtcp.sys

13:39:27.0258 7656  TDTCP - ok

13:39:27.0301 7656  [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx             C:\Windows\system32\DRIVERS\tdx.sys

13:39:27.0328 7656  tdx - ok

13:39:27.0362 7656  [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD          C:\Windows\system32\drivers\termdd.sys

13:39:27.0373 7656  TermDD - ok

13:39:27.0409 7656  [ 2E648163254233755035B46DD7B89123 ] TermService     C:\Windows\System32\termsrv.dll

13:39:27.0442 7656  TermService - ok

13:39:27.0487 7656  [ 2E435EF337679AA45AD0307B86256062 ] TesSafe         C:\Windows\system32\TesSafe.sys

13:39:27.0498 7656  TesSafe - ok

13:39:27.0521 7656  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll

13:39:27.0538 7656  Themes - ok

13:39:27.0566 7656  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER     C:\Windows\system32\mmcss.dll

13:39:27.0595 7656  THREADORDER - ok

13:39:27.0632 7656  [ 8021F63311797085949FA387F7C83583 ] tosporte        C:\Windows\system32\DRIVERS\tosporte.sys

13:39:27.0640 7656  tosporte - ok

13:39:27.0685 7656  [ 58E3F35AECD7BD5FCC1BD198B4AD354F ] Tosrfbd         C:\Windows\system32\DRIVERS\tosrfbd.sys

13:39:27.0696 7656  Tosrfbd - ok

13:39:27.0749 7656  [ 9E4E65EA51E34647340BD6007467AC54 ] Tosrfcom        C:\Windows\system32\Drivers\tosrfcom.sys

13:39:27.0758 7656  Tosrfcom - ok

13:39:27.0772 7656  [ 7D2467D3EB9BAA4B69AE4A28C83DE57A ] Tosrfhid        C:\Windows\system32\DRIVERS\Tosrfhid.sys

13:39:27.0780 7656  Tosrfhid - ok

13:39:27.0801 7656  [ 7052B10E54B48AF12BD5606596A8E039 ] TosRfSnd        C:\Windows\system32\drivers\tosrfsnd.sys

13:39:27.0804 7656  TosRfSnd ( UnsignedFile.Multi.Generic ) - warning

13:39:27.0804 7656  TosRfSnd - detected UnsignedFile.Multi.Generic (1)

13:39:27.0817 7656  [ 7A0048693F98460FF537BE31C741B927 ] Tosrfusb        C:\Windows\system32\DRIVERS\tosrfusb.sys

13:39:27.0825 7656  Tosrfusb - ok

13:39:27.0859 7656  [ DBCC20C02E8A3E43B03C304A4E40A84F ] TPM             C:\Windows\system32\drivers\tpm.sys

13:39:27.0870 7656  TPM - ok

13:39:27.0911 7656  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll

13:39:27.0941 7656  TrkWks - ok

13:39:27.0994 7656  [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe

13:39:28.0021 7656  TrustedInstaller - ok

13:39:28.0027 7656  TsFltMgr - ok

13:39:28.0056 7656  [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys

13:39:28.0083 7656  tssecsrv - ok

13:39:28.0109 7656  [ 17C6B51CBCCDED95B3CC14E22791F85E ] TsUsbFlt        C:\Windows\system32\drivers\tsusbflt.sys

13:39:28.0120 7656  TsUsbFlt - ok

13:39:28.0123 7656  tsusbhub - ok

13:39:28.0156 7656  [ A67E705F93E4664026D8F40E8EC83555 ] TSysCare        C:\Windows\system32\Drivers\TSysCare64.sys

13:39:28.0164 7656  TSysCare - ok

13:39:28.0216 7656  [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys

13:39:28.0244 7656  tunnel - ok

13:39:28.0271 7656  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys

13:39:28.0282 7656  uagp35 - ok

13:39:28.0313 7656  [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs            C:\Windows\system32\DRIVERS\udfs.sys

13:39:28.0342 7656  udfs - ok

13:39:28.0368 7656  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect       C:\Windows\system32\UI0Detect.exe

13:39:28.0380 7656  UI0Detect - ok

13:39:28.0408 7656  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\drivers\uliagpkx.sys

13:39:28.0418 7656  uliagpkx - ok

13:39:28.0473 7656  [ DC54A574663A895C8763AF0FA1FF7561 ] umbus           C:\Windows\system32\DRIVERS\umbus.sys

13:39:28.0490 7656  umbus - ok

13:39:28.0507 7656  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys

13:39:28.0522 7656  UmPass - ok

13:39:28.0557 7656  [ A293DCD756D04D8492A750D03B9A297C ] UmRdpService    C:\Windows\System32\umrdp.dll

13:39:28.0576 7656  UmRdpService - ok

13:39:28.0679 7656  [ 9DC07E73A4ABB9ACF692113B36A5009F ] UnlockerDriver5 C:\Program Files\Unlocker\UnlockerDriver5.sys

13:39:28.0690 7656  UnlockerDriver5 - ok

13:39:28.0713 7656  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll

13:39:28.0749 7656  upnphost - ok

13:39:28.0807 7656  [ 0835843DE85ACBD7D5C6CF887E8876B7 ] USB28xxBGA      C:\Windows\system32\DRIVERS\emBDA64.sys

13:39:28.0820 7656  USB28xxBGA - ok

13:39:28.0842 7656  [ C95A614A4DC06DCFC3DA7B15F299F827 ] USB28xxOEM      C:\Windows\system32\DRIVERS\emOEM64.sys

13:39:28.0855 7656  USB28xxOEM - ok

13:39:28.0896 7656  [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio        C:\Windows\system32\drivers\usbaudio.sys

13:39:28.0908 7656  usbaudio - ok

13:39:28.0921 7656  [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp         C:\Windows\system32\DRIVERS\usbccgp.sys

13:39:28.0931 7656  usbccgp - ok

13:39:28.0976 7656  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\drivers\usbcir.sys

13:39:28.0989 7656  usbcir - ok

13:39:29.0003 7656  [ C025055FE7B87701EB042095DF1A2D7B ] usbehci         C:\Windows\system32\DRIVERS\usbehci.sys

13:39:29.0014 7656  usbehci - ok

13:39:29.0037 7656  [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys

13:39:29.0050 7656  usbhub - ok

13:39:29.0063 7656  [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci         C:\Windows\system32\drivers\usbohci.sys

13:39:29.0073 7656  usbohci - ok

13:39:29.0114 7656  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys

13:39:29.0127 7656  usbprint - ok

13:39:29.0148 7656  [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR         C:\Windows\system32\DRIVERS\USBSTOR.SYS

13:39:29.0159 7656  USBSTOR - ok

13:39:29.0184 7656  [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci         C:\Windows\system32\DRIVERS\usbuhci.sys

13:39:29.0194 7656  usbuhci - ok

13:39:29.0233 7656  [ 454800C2BC7F3927CE030141EE4F4C50 ] usbvideo        C:\Windows\System32\Drivers\usbvideo.sys

13:39:29.0247 7656  usbvideo - ok

13:39:29.0276 7656  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms           C:\Windows\System32\uxsms.dll

13:39:29.0305 7656  UxSms - ok

13:39:29.0311 7656  [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc        C:\Windows\system32\lsass.exe

13:39:29.0322 7656  VaultSvc - ok

13:39:29.0351 7656  [ D7FCD8FBBF6CC93140D9C7C7959ED60C ] VBoxDrv         C:\Windows\system32\DRIVERS\VBoxDrv.sys

13:39:29.0364 7656  VBoxDrv - ok

13:39:29.0380 7656  [ 6B22F16BE58AEF1A57970611D7109507 ] VBoxNetAdp      C:\Windows\system32\DRIVERS\VBoxNetAdp.sys

13:39:29.0390 7656  VBoxNetAdp - ok

13:39:29.0400 7656  [ 10DD814DA2F2064F53B9694E30FF45A4 ] VBoxNetFlt      C:\Windows\system32\DRIVERS\VBoxNetFlt.sys

13:39:29.0410 7656  VBoxNetFlt - ok

13:39:29.0431 7656  [ 812C2E4EC41CFCACE761620E17463529 ] VBoxUSBMon      C:\Windows\system32\DRIVERS\VBoxUSBMon.sys

13:39:29.0441 7656  VBoxUSBMon - ok

13:39:29.0485 7656  [ 389AB97570E7F25192CA18B6348C904F ] VComm           C:\Windows\system32\DRIVERS\VComm.sys

13:39:29.0493 7656  VComm - ok

13:39:29.0501 7656  [ 72F11B412446FAAF95B156A6B781502C ] VcommMgr        C:\Windows\system32\Drivers\VcommMgr.sys

13:39:29.0509 7656  VcommMgr - ok

13:39:29.0544 7656  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\drivers\vdrvroot.sys

13:39:29.0554 7656  vdrvroot - ok

13:39:29.0591 7656  [ 8D6B481601D01A456E75C3210F1830BE ] vds             C:\Windows\System32\vds.exe

13:39:29.0623 7656  vds - ok

13:39:29.0655 7656  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga             C:\Windows\system32\DRIVERS\vgapnp.sys

13:39:29.0674 7656  vga - ok

13:39:29.0693 7656  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave         C:\Windows\System32\drivers\vga.sys

13:39:29.0723 7656  VgaSave - ok

13:39:29.0727 7656  VGPU - ok

13:39:29.0752 7656  [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp           C:\Windows\system32\drivers\vhdmp.sys

13:39:29.0765 7656  vhdmp - ok

13:39:29.0792 7656  [ F3678125BFF5615B087EA7F4BD363370 ] VHidMinidrv     C:\Windows\system32\drivers\VHIDMini.sys

13:39:29.0800 7656  VHidMinidrv - ok

13:39:29.0818 7656  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\drivers\viaide.sys

13:39:29.0828 7656  viaide - ok

13:39:29.0860 7656  [ 86EA3E79AE350FEA5331A1303054005F ] vmbus           C:\Windows\system32\drivers\vmbus.sys

13:39:29.0872 7656  vmbus - ok

13:39:29.0893 7656  [ 7DE90B48F210D29649380545DB45A187 ] VMBusHID        C:\Windows\system32\drivers\VMBusHID.sys

13:39:29.0903 7656  VMBusHID - ok

13:39:29.0965 7656  [ B2E25DB5A6A178C056342ABD747B7326 ] vmm             C:\Windows\system32\Treiber\vmm.sys

13:39:29.0981 7656  vmm - ok

13:39:29.0996 7656  [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr          C:\Windows\system32\drivers\volmgr.sys

13:39:30.0007 7656  volmgr - ok

13:39:30.0044 7656  [ A255814907C89BE58B79EF2F189B843B ] volmgrx         C:\Windows\system32\drivers\volmgrx.sys

13:39:30.0058 7656  volmgrx - ok

13:39:30.0076 7656  [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap         C:\Windows\system32\drivers\volsnap.sys

13:39:30.0091 7656  volsnap - ok

13:39:30.0113 7656  [ 6BDCA00FC57CC40DA3C8E88B2CEA21AB ] VPCNetS2        C:\Windows\system32\DRIVERS\VMNetSrv.sys

13:39:30.0123 7656  VPCNetS2 - ok

13:39:30.0162 7656  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid         C:\Windows\system32\DRIVERS\vsmraid.sys

13:39:30.0173 7656  vsmraid - ok

13:39:30.0224 7656  [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS             C:\Windows\system32\vssvc.exe

13:39:30.0264 7656  VSS - ok

13:39:30.0281 7656  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\System32\drivers\vwifibus.sys

13:39:30.0294 7656  vwifibus - ok

13:39:30.0328 7656  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time         C:\Windows\system32\w32time.dll

13:39:30.0359 7656  W32Time - ok

13:39:30.0379 7656  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys

13:39:30.0390 7656  WacomPen - ok

13:39:30.0436 7656  [ 356AFD78A6ED4457169241AC3965230C ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys

13:39:30.0463 7656  WANARP - ok

13:39:30.0467 7656  [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys

13:39:30.0494 7656  Wanarpv6 - ok

13:39:30.0547 7656  [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine        C:\Windows\system32\wbengine.exe

13:39:30.0570 7656  wbengine - ok

13:39:30.0589 7656  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll

13:39:30.0606 7656  WbioSrvc - ok

13:39:30.0728 7656  [ 8BDA6DB43AA54E8BB5E0794541DDC209 ] WcesComm        C:\Windows\WindowsMobile\wcescomm.dll

13:39:30.0748 7656  WcesComm - ok

13:39:30.0874 7656  [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc         C:\Windows\System32\wcncsvc.dll

13:39:30.0900 7656  wcncsvc - ok

13:39:30.0917 7656  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll

13:39:30.0930 7656  WcsPlugInService - ok

13:39:30.0948 7656  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys

13:39:30.0959 7656  Wd - ok

13:39:30.0996 7656  [ 442783E2CB0DA19873B7A63833FF4CB4 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys

13:39:31.0017 7656  Wdf01000 - ok

13:39:31.0026 7656  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll

13:39:31.0044 7656  WdiServiceHost - ok

13:39:31.0048 7656  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost   C:\Windows\system32\wdi.dll

13:39:31.0064 7656  WdiSystemHost - ok

13:39:31.0098 7656  [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient       C:\Windows\System32\webclnt.dll

13:39:31.0115 7656  WebClient - ok

13:39:31.0134 7656  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll

13:39:31.0164 7656  Wecsvc - ok

13:39:31.0186 7656  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport   C:\Windows\System32\wercplsupport.dll

13:39:31.0215 7656  wercplsupport - ok

13:39:31.0239 7656  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll

13:39:31.0269 7656  WerSvc - ok

13:39:31.0296 7656  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys

13:39:31.0324 7656  WfpLwf - ok

13:39:31.0339 7656  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys

13:39:31.0349 7656  WIMMount - ok

13:39:31.0379 7656  WinDefend - ok

13:39:31.0383 7656  WinHttpAutoProxySvc - ok

13:39:31.0432 7656  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt         C:\Windows\system32\wbem\WMIsvc.dll

13:39:31.0470 7656  Winmgmt - ok

13:39:31.0530 7656  [ BCB1310604AA415C4508708975B3931E ] WinRM           C:\Windows\system32\WsmSvc.dll

13:39:31.0574 7656  WinRM - ok

13:39:31.0639 7656  [ FE88B288356E7B47B74B13372ADD906D ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys

13:39:31.0657 7656  WinUsb - ok

13:39:31.0697 7656  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc         C:\Windows\System32\wlansvc.dll

13:39:31.0719 7656  Wlansvc - ok

13:39:31.0853 7656  [ 357CABBF155AFD1D3926E62539D2A3A7 ] wlidsvc         C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

13:39:31.0895 7656  wlidsvc - ok

13:39:31.0938 7656  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi         C:\Windows\system32\drivers\wmiacpi.sys

13:39:31.0948 7656  WmiAcpi - ok

13:39:31.0982 7656  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe

13:39:31.0994 7656  wmiApSrv - ok

13:39:32.0035 7656  WMPNetworkSvc - ok

13:39:32.0056 7656  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll

13:39:32.0068 7656  WPCSvc - ok

13:39:32.0105 7656  [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll

13:39:32.0118 7656  WPDBusEnum - ok

13:39:32.0145 7656  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl         C:\Windows\system32\drivers\ws2ifsl.sys

13:39:32.0173 7656  ws2ifsl - ok

13:39:32.0191 7656  [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc          C:\Windows\System32\wscsvc.dll

13:39:32.0207 7656  wscsvc - ok

13:39:32.0210 7656  WSearch - ok

13:39:32.0278 7656  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll

13:39:32.0315 7656  wuauserv - ok

13:39:32.0342 7656  [ AB886378EEB55C6C75B4F2D14B6C869F ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys

13:39:32.0352 7656  WudfPf - ok

13:39:32.0384 7656  [ DDA4CAF29D8C0A297F886BFE561E6659 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys

13:39:32.0396 7656  WUDFRd - ok

13:39:32.0415 7656  [ B20F051B03A966392364C83F009F7D17 ] wudfsvc         C:\Windows\System32\WUDFSvc.dll

13:39:32.0427 7656  wudfsvc - ok

13:39:32.0448 7656  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc         C:\Windows\System32\wwansvc.dll

13:39:32.0464 7656  WwanSvc - ok

13:39:32.0535 7656  [ DD0042F0C3B606A6A8B92D49AFB18AD6 ] YahooAUService  C:\Program Files (x86)\Yahoo!\SoftwareUpdate\YahooAUService.exe

13:39:32.0549 7656  YahooAUService - ok

13:39:32.0586 7656  [ 24FB8DB6D1D55E2C5D0A53DFE48E6AF8 ] Yontoo Desktop Updater C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

13:39:32.0588 7656  Yontoo Desktop Updater ( UnsignedFile.Multi.Generic ) - warning

13:39:32.0588 7656  Yontoo Desktop Updater - detected UnsignedFile.Multi.Generic (1)

13:39:32.0631 7656  ================ Scan global ===============================

13:39:32.0648 7656  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll

13:39:32.0673 7656  [ 72CC564BBC70DE268784BCE91EB8A28F ] C:\Windows\system32\winsrv.dll

13:39:32.0679 7656  [ 72CC564BBC70DE268784BCE91EB8A28F ] C:\Windows\system32\winsrv.dll

13:39:32.0701 7656  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll

13:39:32.0730 7656  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe

13:39:32.0733 7656  [Global] - ok

13:39:32.0733 7656  ================ Scan MBR ==================================

13:39:32.0747 7656  [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0

13:39:33.0139 7656  \Device\Harddisk0\DR0 - ok

13:39:33.0139 7656  ================ Scan VBR ==================================

13:39:33.0273 7656  [ 7F8BEAF9F355FB8EA3923BF5AFDD2208 ] \Device\Harddisk0\DR0\Partition1

13:39:33.0291 7656  \Device\Harddisk0\DR0\Partition1 - ok

13:39:33.0292 7656  ============================================================

13:39:33.0292 7656  Scan finished

13:39:33.0292 7656  ============================================================

13:39:33.0301 2736  Detected object count: 4

13:39:33.0301 2736  Actual detected object count: 4

13:39:36.0975 2736  BlueSoleilCS ( UnsignedFile.Multi.Generic ) - skipped by user

13:39:36.0975 2736  BlueSoleilCS ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:39:36.0977 2736  BsHelpCS ( UnsignedFile.Multi.Generic ) - skipped by user

13:39:36.0977 2736  BsHelpCS ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:39:36.0978 2736  TosRfSnd ( UnsignedFile.Multi.Generic ) - skipped by user

13:39:36.0979 2736  TosRfSnd ( UnsignedFile.Multi.Generic ) - User select action: Skip 

13:39:36.0980 2736  Yontoo Desktop Updater ( UnsignedFile.Multi.Generic ) - skipped by user

13:39:36.0980 2736  Yontoo Desktop Updater ( UnsignedFile.Multi.Generic ) - User select action: Skip

Passt.
nutzt ihr eig Wlan, wenn ja wie ist die Verschlüsselung? also zb WPA, WPA2 oder WEP
Scan mit Combofix

WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link

WICHTIG: Speichere Combofix auf deinem Desktop.

Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.

Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.

Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!

Wenn Combofix fertig ist, wird es ein Logfile erstellen.

Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).

Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

Die Verslüsselung ist auf WPA2 eingestellt, der Schlüssel hat 16 Stellen. Combofix läuft noch, ich schreibe dies von einem anderen Rechnner aus.

ok.
wenn wir pech haben müssen wir die uns auch noch ansehen, der sieht erst mal ok aus bisher

ist eine Fritzbox 7270

So Combofix ist fertig:

Code:

ComboFix 13-05-29.01 - root 29.05.2013  13:51:38.1.2 - x64

Microsoft Windows 7 Ultimate   6.1.7601.1.1252.49.1033.18.7391.5320 [GMT 2:00]

ausgeführt von:: c:\users\dk\Desktop\ComboFix.exe

AV: Kingsoft Antivirus System Defense *Disabled/Updated* {B6A51389-A795-5AC9-13BA-F569D73F3FE8}

SP: Kingsoft Antivirus System Defense *Disabled/Updated* {0DC4F26D-81AF-5547-290A-CE1BACB87555}

SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}

.

.

((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))

.

.

c:\users\dk\AppData\Roaming\004D5649544E41696E66

c:\users\root\AppData\Roaming\004D5649544E41696E66

c:\users\root\AppData\Roaming\0408002700AC0C

c:\windows\SysWow64\pt

c:\windows\SysWow64\pt\AuthFWSnapIn.Resources.dll

c:\windows\SysWow64\pt\AuthFWWizFwk.Resources.dll

c:\windows\vspc1000.exe

.

.

(((((((((((((((((((((((((((((((((((((((   Treiber/Dienste   )))))))))))))))))))))))))))))))))))))))))))))))))

.

.

-------\Legacy_TESSAFE

-------\Service_TesSafe

.

.

(((((((((((((((((((((((   Dateien erstellt von 2013-04-28 bis 2013-05-29  ))))))))))))))))))))))))))))))

.

.

2013-05-28 22:25 . 2013-05-28 22:41        --------        d-----w-        c:\programdata\Malwarebytes' Anti-Malware (portable)

2013-05-28 22:24 . 2013-05-28 22:24        36680        ----a-w-        c:\windows\system32\drivers\mbamchameleon.sys

2013-05-28 15:58 . 2013-05-28 16:25        --------        d-----w-        c:\users\root\AppData\Roaming\QuickStoresToolbar

2013-05-28 15:58 . 2013-05-28 16:00        --------        d-----w-        c:\program files\Unlocker

2013-05-28 15:05 . 2013-05-28 15:05        --------        d-----w-        c:\users\root\AppData\Local\Diagnostics

2013-05-25 23:36 . 2013-05-25 23:36        --------        d-----w-        c:\program files (x86)\Symantec

2013-05-22 19:23 . 2013-05-22 19:38        --------        d--h--w-        c:\windows\AxInstSV

2013-05-18 18:50 . 2013-05-18 18:50        5191704        ----a-w-        c:\windows\system32\GooglePinyin2.ime

2013-05-18 18:50 . 2013-05-18 18:50        3460120        ----a-w-        c:\windows\SysWow64\GooglePinyin2.ime

2013-05-18 18:50 . 2013-05-18 18:50        --------        d-----w-        c:\program files (x86)\Google

2013-05-18 16:46 . 2013-05-18 16:46        --------        d-----w-        c:\program files (x86)\yy

2013-05-05 17:28 . 2013-05-05 17:38        --------        d-----w-        c:\programdata\NCH Swift Sound

2013-05-05 17:25 . 2013-05-05 17:25        --------        d-----w-        c:\program files (x86)\NCH Software

2013-05-05 17:25 . 2013-05-05 17:49        --------        d-----w-        c:\program files (x86)\NCH Swift Sound

2013-05-05 17:18 . 2013-05-05 17:38        --------        d-----w-        c:\users\dk\AppData\Roaming\NCH Swift Sound

2013-05-05 17:18 . 2013-05-05 17:18        --------        d-----w-        c:\users\root\AppData\Roaming\NCH Swift Sound

2013-05-05 16:38 . 2013-05-05 16:38        --------        d-----w-        c:\programdata\NCH Software

2013-05-05 16:38 . 2013-05-05 16:59        --------        d-----w-        c:\users\dk\AppData\Roaming\NCH Software

2013-05-05 09:34 . 2013-05-05 09:34        --------        d-----w-        c:\users\root\AppData\Local\bluesoleil

2013-05-03 08:02 . 2013-05-03 08:02        --------        d-----w-        c:\users\dk\AppData\Local\4Neurons

2013-05-02 20:46 . 2013-05-02 20:46        --------        d-----w-        c:\users\root\AppData\Roaming\Babylon

2013-05-02 20:46 . 2013-05-02 20:46        --------        d-----w-        c:\programdata\Babylon

2013-04-30 11:07 . 2013-04-30 11:07        --------        d-----w-        c:\programdata\KRSHistory

.

.

.

((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))

.

2013-05-28 14:37 . 2013-03-23 09:17        18960        ----a-w-        c:\windows\system32\drivers\LNonPnP.sys

2013-05-26 09:03 . 2013-01-07 08:04        18760        ----a-w-        c:\windows\SysWow64\QQVistaHelper.dll

2013-05-01 10:10 . 2012-07-17 13:37        22240        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\ppcrlconfig600.dll

2013-04-15 10:54 . 2013-04-15 10:54        723230        ----a-w-        c:\windows\unins000.exe

2013-04-04 12:50 . 2013-01-16 14:52        25928        ----a-w-        c:\windows\system32\drivers\mbam.sys

2013-04-03 19:20 . 2013-04-03 18:36        163920        ----a-w-        c:\windows\system32\TesSafe.sys

2013-03-29 13:29 . 2013-01-08 02:09        73432        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl

2013-03-29 13:29 . 2013-01-08 02:09        693976        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe

2013-03-26 16:23 . 2013-04-10 14:52        29712        ----a-w-        c:\windows\system32\nitrolocalmon2.dll

2013-03-26 16:23 . 2013-04-10 14:52        17936        ----a-w-        c:\windows\system32\nitrolocalui2.dll

2013-03-23 09:22 . 2013-03-23 09:22        53248        ----a-r-        c:\users\root\AppData\Roaming\Microsoft\Installer\{3EE9BCAE-E9A9-45E5-9B1C-83A4D357E05C}\ARPPRODUCTICON.exe

2013-03-07 11:21 . 2013-03-07 11:21        38664        ----a-w-        c:\windows\system32\drivers\tapSF0901.sys

.

.

((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))

.

.

*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 

REGEDIT4

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\~\Browser Helper Objects\{A8502600-B272-4F68-A67B-A0305D46D297}]

2013-02-04 03:21        217520        ----a-w-        c:\program files (x86)\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend.dll

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DownloadIcon]

@="{A8502600-B272-4F68-A67B-A0305D46D297}"

[HKEY_CLASSES_ROOT\CLSID\{A8502600-B272-4F68-A67B-A0305D46D297}]

2013-02-04 03:21        217520        ----a-w-        c:\program files (x86)\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend.dll

.

[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-20 1475584]

"QTalk"="c:\program files (x86)\Tencent\QTalk\V3.8.6\Bin\QTalk.exe" [2013-05-26 305176]

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]

"kxesc"="c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" [2013-01-06 1595056]

"BtTray"="c:\program files (x86)\IVT Corporation\BlueSoleil\BtTray.exe" [2009-09-02 315478]

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]

"ConsentPromptBehaviorAdmin"= 5 (0x5)

"ConsentPromptBehaviorUser"= 3 (0x3)

"EnableUIADesktopToggle"= 0 (0x0)

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]

"LoadAppInit_DLLs"=1 (0x1)

.

[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\keyboard layouts\e0200804]

   Ime File        REG_SZ                 GOOGLEPINYIN2.IME

.

R0 TsFltMgr;tencent TsFltMgr;c:\windows\System32\drivers\TsFltMgr.sys [x]

R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]

R2 QQSysMonX64;QQSysMonX64;c:\program files (x86)\Tencent\QQPCMgr\7.3.8128.217\QQSysMonX64.sys [x]

R3 androidusb;ADB Interface Driver;c:\windows\system32\Drivers\androidusb.sys [2010-04-29 32768]

R3 BTCOM;Bluetooth Serial port driver;c:\windows\system32\DRIVERS\btcomport.sys [x]

R3 IvtAudioBusSrv;IvtAudioBusSrv;c:\windows\system32\Drivers\IvtBtBus.sys [2009-08-26 30344]

R3 IvtComBusSrv;IvtComBusSrv;c:\windows\system32\Drivers\btcombus.sys [x]

R3 IvtPanBusSrv;IvtPanBusSrv;c:\windows\system32\Drivers\btnetBus.sys [2009-08-26 34440]

R3 mbamchameleon;mbamchameleon;c:\windows\system32\drivers\mbamchameleon.sys [2013-05-28 36680]

R3 phaudlwr;Philips Audio Filter;c:\windows\system32\DRIVERS\phaudlwr.sys [2009-10-20 114608]

R3 QTService;QTService;c:\windows\system32\svchost.exe [2009-07-14 27136]

R3 RdpVideoMiniport;Remote Desktop Video Miniport Driver;c:\windows\system32\drivers\rdpvideominiport.sys [2012-08-23 19456]

R3 SPC1000;USB2.0 PC Camera (SPC1000);c:\windows\system32\DRIVERS\spc1000.sys [2007-12-04 3249024]

R3 Synth3dVsc;Synth3dVsc;c:\windows\system32\drivers\synth3dvsc.sys [x]

R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2012-08-23 57856]

R3 tsusbhub;tsusbhub;tsusbhub [x]

R4 NitroReaderDriverReadSpool3;NitroPDFReaderDriverCreatorReadSpool3;c:\program files\Common Files\Nitro\Reader\3.0\NitroPDFReaderDriverService3x64.exe [2013-03-26 230416]

R4 QQPCRTP;QQPCMgr RTP Service;c:\program files (x86)\Tencent\QQPCMgr\7.3.8128.217\QQPCRtp.exe [x]

R4 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2013-01-08 161536]

S0 BtHidBus;Bluetooth HID Bus Service;c:\windows\System32\Drivers\BtHidBus.sys [2009-08-26 24840]

S0 kavbootc;kavbootc;c:\windows\system32\drivers\kavbootc64.sys [2013-01-06 31848]

S1 KDHacker;KDHacker;c:\program files (x86)\kingsoft\kingsoft antivirus\security\kxescan\kdhacker64.sys [2013-01-06 164696]

S2 kisknl;kisknl;c:\windows\system32\drivers\kisknl.sys [2013-01-06 210296]

S2 kxescore;Kingsoft Core Service;c:\program files (x86)\kingsoft\kingsoft antivirus\kxescore.exe [2013-01-06 123992]

S2 SSPORT;SSPORT;c:\windows\system32\Drivers\SSPORT.sys [2008-01-10 11576]

S3 btnetBUs;Bluetooth PAN Bus Service;c:\windows\system32\Drivers\btnetBus.sys [2009-08-26 34440]

S3 e1kexpress;Intel(R) PRO/1000 PCI Express Network Connection Driver K;c:\windows\system32\DRIVERS\e1k60x64.sys [2009-06-10 220672]

S3 IvtBtBUs;IVT Bluetooth Bus Service;c:\windows\system32\Drivers\IvtBtBus.sys [2009-08-26 30344]

S3 LVRS64;Logitech RightSound Filter Driver;c:\windows\system32\DRIVERS\lvrs64.sys [2009-10-07 327704]

S3 LVUVC64;Logitech QuickCam E3500(UVC);c:\windows\system32\DRIVERS\lvuvc64.sys [2009-10-07 6379288]

S3 tapSF0901;Spotflux TAP Device Driver;c:\windows\system32\DRIVERS\tapSF0901.sys [2013-03-07 38664]

.

.

[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]

QTService        REG_MULTI_SZ           QTService

.

Inhalt des "geplante Tasks" Ordners

.

2013-05-29 c:\windows\Tasks\Adobe Flash Player Updater.job

- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2013-01-08 13:29]

.

.

--------- X64 Entries -----------

.

.

[HKEY_LOCAL_MACHINE\~\Browser Helper Objects\{A8502600-B272-4F68-A67B-A0305D46D298}]

2013-02-04 03:21        330160        ----a-w-        c:\program files (x86)\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend_x64.dll

.

[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\explorer\shelliconoverlayidentifiers\DownloadIcon]

@="{A8502600-B272-4F68-A67B-A0305D46D298}"

[HKEY_CLASSES_ROOT\CLSID\{A8502600-B272-4F68-A67B-A0305D46D298}]

2013-02-04 03:21        330160        ----a-w-        c:\program files (x86)\QvodPlayer\QvodExtend\5.0.83.0\QvodExtend_x64.dll

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]

"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2011-02-11 386584]

"Persistence"="c:\windows\system32\igfxpers.exe" [2011-02-11 417304]

"Windows Mobile Device Center"="c:\windows\WindowsMobile\wmdc.exe" [2007-05-31 660360]

.

HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost  - LocalService

FontCache

.

------- Zusätzlicher Suchlauf -------

.

uLocal Page = c:\windows\system32\blank.htm

uStart Page = www.google.de

mStart Page = www.google.de

mLocal Page = c:\windows\SysWOW64\blank.htm

uInternet Settings,ProxyOverride = *.local

IE: ???????? - c:\program files (x86)\Youdao\YNote\ieext_menu.htm

IE: {{65D09F88-CE18-4A95-B8AF-311C3311DB03} - c:\program files (x86)\Youdao\YNote\ieext_btn.htm

IE: {{73C6DCFB-B606-47F3-BDFA-9A4FBF931E37} - c:\program files (x86)\ICQ7.4\ICQ.exe

TCP: DhcpNameServer = 192.168.178.1

DPF: {3ABECEEC-DD81-4511-A7FD-B3B657B64892} - hxxp://3gsoft.gtimg.com/sd/resource/cobrahall/2013/01/17/15/QQGameAssist.cab

.

- - - - Entfernte verwaiste Registrierungseinträge - - - -

.

SafeBoot-45273463.sys

HKLM_Wow6432Node-ActiveSetup-{2D46B6DC-2207-486B-B523-A557E6D54B47} - start

.

.

.

--------------------- Gesperrte Registrierungsschluessel ---------------------

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]

@Denied: (2) (LocalSystem)

"{9030D464-4C02-4ABF-8ECC-5164760863C6}"=hex:51,66,7a,6c,4c,1d,38,12,0a,d7,23,

   94,30,02,d1,0f,f1,da,12,24,73,56,27,d2

"{A8502600-B272-4F68-A67B-A0305D46D297}"=hex:51,66,7a,6c,4c,1d,38,12,6e,25,43,

   ac,40,fc,06,0a,d9,6d,e3,70,58,18,96,83

"{761497BB-D6F0-462C-B6EB-D4DAF1D92D43}"=hex:51,66,7a,6c,4c,1d,38,12,d5,94,07,

   72,c2,98,42,03,c9,fd,97,9a,f4,87,69,57

"{DBC80044-A445-435B-BC74-9C25C1C588A9}"=hex:51,66,7a,6c,4c,1d,38,12,2a,03,db,

   df,77,ea,35,06,c3,62,df,65,c4,9b,cc,bd

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]

@Denied: (2) (LocalSystem)

"Timestamp"=hex:6e,75,a6,3f,b4,01,ce,01

.

[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\User Preferences]

@Denied: (2) (LocalSystem)

"88D7D0879DAB32E14DE5B3A805A34F98AFF34F5977"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fb,29,d5,2b,1a,7f,97,4d,bf,e1,82,\

"2D53CFFC5C1A3DD2E97B7979AC2A92BD59BC839E81"=hex:01,00,00,00,d0,8c,9d,df,01,15,

   d1,11,8c,7a,00,c0,4f,c2,97,eb,01,00,00,00,fb,29,d5,2b,1a,7f,97,4d,bf,e1,82,\

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="FlashBroker"

"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]

"Enabled"=dword:00000001

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Shockwave Flash Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]

@="0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]

@="ShockwaveFlash.ShockwaveFlash.11"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="ShockwaveFlash.ShockwaveFlash"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]

@Denied: (A 2) (Everyone)

@="Macromedia Flash Factory Object"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"

"ThreadingModel"="Apartment"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]

@="FlashFactory.FlashFactory.1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]

@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]

@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]

@="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]

@="FlashFactory.FlashFactory"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]

@Denied: (A 2) (Everyone)

@="IFlashBroker5"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]

@="{00020424-0000-0000-C000-000000000046}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]

@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"

"Version"="1.0"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*]

@="?????????????????? v1"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*1*\CLSID]

@="{E23FE9C6-778E-49D4-B537-38FCDE4887D8}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*]

@="?????????????????? v2"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\VideoLAN.VLCPlugin.*2*\CLSID]

@="{9BE31822-FDAD-461B-AD51-BE1D1C159921}"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\MenuExt\ûm*R0RQ*Q*hˆÅ`]

"contexts"=dword:00000002

@="c:\\Program Files (x86)\\Tencent\\TM2008\\Bin\\AddEmotion.htm"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Uninstall\Q*Q*8nb]

"DisplayName"="QQ??"

"UninstallString"="c:\\Program Files (x86)\\Tencent\\QQGame\\Uninstall.EXE"

"Publisher"="????"

"DisplayIcon"="c:\\Program Files (x86)\\Tencent\\QQGame\\QQGame.EXE"

"DisplayVersion"="3.0.110.53"

.

[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows CE Services]

"SymbolicLinkValue"=hex(6):5c,00,72,00,65,00,67,00,69,00,73,00,74,00,72,00,79,

   00,5c,00,4d,00,41,00,43,00,48,00,49,00,4e,00,45,00,5c,00,53,00,4f,00,46,00,\

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]

@Denied: (A) (Users)

@Denied: (A) (Everyone)

@Allowed: (B 1 2 3 4 5) (S-1-5-20)

"BlindDial"=dword:00000000

.

[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]

@Denied: (Full) (Everyone)

.

------------------------ Weitere laufende Prozesse ------------------------

.

c:\program files (x86)\IVT Corporation\BlueSoleil\BlueSoleilCS.exe

c:\program files (x86)\spotflux\.\spotflux.exe

c:\program files (x86)\Google\Google Pinyin 2\GooglePinyinDaemon.exe

c:\program files (x86)\Google\Google Pinyin 2\GooglePinyinService.exe

c:\program files (x86)\Java\jre7\bin\javaw.exe

c:\program files (x86)\spotflux\openvpn.exe

.

**************************************************************************

.

Zeit der Fertigstellung: 2013-05-29  17:42:56 - PC wurde neu gestartet

ComboFix-quarantined-files.txt  2013-05-29 15:42

.

Vor Suchlauf: 10 Verzeichnis(se), 273.216.851.968 Bytes frei

Nach Suchlauf: 15 Verzeichnis(se), 272.398.589.952 Bytes frei

.

- - End Of File - - 3768933A04D8C453DBF246A6FC6BE1D2

hatte dein antimalware programm eigendlich mal Funde, wenn ja, kannst du die posten?

nein, hatte keine Funde, allerdings hatte ich sie vor dem scan deaktiviert. Endlich mal? Du hältsts nichs von Kingsoft?

nein ich wollte nur allgemein wissen, obs Funde hatte.
malwarebytes:
Downloade Dir bitte Malwarebytes

Installiere
das Programm in den vorgegebenen Pfad.
Vista und Win7 User mit Rechtsklick "als Administrator starten"
Starte Malwarebytes, klicke auf Aktualisierung --> Suche
nach Aktualisierung
Wenn das Update beendet wurde, aktiviere vollständiger Scan durchführen und drücke auf Scannen.
Wenn der Scan beendet
ist, klicke auf Ergebnisse anzeigen.
Versichere Dich, dass alle Funde markiert sind und drücke Entferne Auswahl.
Poste
das Logfile, welches sich in Notepad öffnet, hier in den Thread.
Nachträglich kannst du den Bericht unter "Log Dateien" finden.

mbam ist jetzt auch fertig:

Code:

Malwarebytes Anti-Malware 1.75.0.1300

www.malwarebytes.org
 

Datenbank Version: v2013.05.29.07
 

Windows 7 Service Pack 1 x64 NTFS

Internet Explorer 10.0.9200.16438

root :: W7 [Administrator]
 

29.05.2013 22:09:11

mbam-log-2013-05-29 (22-09-11).txt
 

Art des Suchlaufs: Vollständiger Suchlauf (C:\|)

Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM

Deaktivierte Suchlaufeinstellungen: P2P

Durchsuchte Objekte: 958970

Laufzeit: 3 Stunde(n), 2 Minute(n), 17 Sekunde(n)
 

Infizierte Speicherprozesse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Speichermodule: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungsschlüssel: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Registrierungswerte: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateiobjekte der Registrierung: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Verzeichnisse: 0

(Keine bösartigen Objekte gefunden)
 

Infizierte Dateien: 0

(Keine bösartigen Objekte gefunden)
 

(Ende)

sieht gut aus.
Gibts an dem PC auffälligkeiten?

lade den CCleaner standard:
CCleaner - Download - Filepony
falls der CCleaner
bereits instaliert, überspringen.
öffnen, Tools (extras),uninstall Llist, als txt speichern. öffnen.
hinter, jedes von dir benötigte programm, schreibe notwendig.
hinter, jedes, von dir nicht benötigte, unnötig.
hinter, dir unbekannte, unbekannt.
liste posten.

Auffälligkeiten:

Programme lassen sich nicht in den Vordergrund bringen und auch nicht schließen. Letzteres nur über die Taskleiste.

Das Youdao dict verschwindet häufig.

Copy und paste nicht möglich.

Im Editor geht die Funktion Suchen&Ersetzen nicht.

was mir bis jetzt so aufgeallen ist.

Code:

Ja        HKCU:Run        BgMonitor_{79662E04-7C6C-4d9f-84C7-88D8A56B10AA}        Nero AG        "C:\Program Files (x86)\Common Files\Nero\Lib\NMBgMonitor.exe" - unnötig

Nein        HKCU:Run        ICQ        ICQ, LLC.        "C:\Program Files (x86)\ICQ7.4\ICQ.exe" silent loginmode=4 - unnötig

Nein        HKCU:Run        Messenger (Yahoo!)        Yahoo! Inc.        "C:\PROGRA~2\Yahoo!\MESSEN~1\YahooMessenger.exe" -quiet - unnötig

Nein        HKCU:Run        msnmsgr                "C:\Program Files (x86)\Windows Live\Messenger\msnmsgr.exe" /background - unnötig

Ja        HKCU:Run        QQIntl        Tencent Technology(Shenzhen) Company Limited        "C:\Program Files (x86)\Tencent\QQIntl\Bin\QQ.exe" /background - notwendig

Ja        HKCU:Run        QTalk                "C:\Program Files (x86)\Tencent\QTalk\V3.8.4\Bin\QTalk.exe" /background - notwendig

Ja        HKCU:Run        Sidebar        Microsoft Corporation        C:\Program Files\Windows Sidebar\sidebar.exe /autoRun - notwendig

Ja        HKCU:Run        thebat_startup        Ritlabs S.R.L.        C:\Program Files (x86)\The Bat!\thebat.exe /minimize - notwendig

Ja        HKCU:Run        TM        Tencent        "C:\Program Files (x86)\Tencent\TM2008\Bin\TM.exe" /background - notwendig

Nein        HKCU:Run        Yahoo! Pager        Yahoo! Inc.        "C:\Program Files (x86)\Yahoo!\Messenger\YahooMessenger.exe" -quiet - unnötig

Nein        HKCU:Run        ynote        NetEase        "C:\Program Files (x86)\Youdao\YNote\RunYNote.exe" hide - notwendig

Ja        HKCU:Run        YodaoDict        网易公司        "C:\Users\dk\AppData\Local\Youdao\Dict\Application\YodaoDict.exe" -hide -autostart - notwendig

Nein        HKCU:Run        Yontoo Desktop                "C:\Users\root\AppData\Roaming\Yontoo\YontooDesktop.exe" - notwendig

Ja        HKLM:Run        BtTray        IVT Corporation        "C:\Program Files (x86)\IVT Corporation\BlueSoleil\BtTray.exe" - notwendig

Nein        HKLM:Run        EvtMgr6        Logitech, Inc.        C:\Program Files\Logitech\SetPointP\SetPoint.exe /launchGaming - notwendig

Ja        HKLM:Run        HotKeysCmds        Intel Corporation        C:\Windows\system32\hkcmd.exe - notwendig

Nein        HKLM:Run        IgfxTray        Intel Corporation        C:\Windows\system32\igfxtray.exe - notwendig

Nein        HKLM:Run        ITSecMng                %ProgramFiles%\TOSHIBA\Bluetooth Toshiba Stack\ItSecMng.exe /START - notwendig

Ja        HKLM:Run        kxesc        Kingsoft Corporation        "c:\program files (x86)\kingsoft\kingsoft antivirus\kxetray.exe" -autorun - notwendig

Nein        HKLM:Run        MessengerPlusForSkypeService                "C:\Program Files (x86)\Yuna Software\Messenger Plus! for Skype\MsgPlusForSkypeService.exe" - unnötig

Ja        HKLM:Run        Persistence        Intel Corporation        C:\Windows\system32\igfxpers.exe - notwendig

Nein        HKLM:Run        PlusService                C:\Program Files (x86)\Yuna Software\Messenger Plus!\PlusService.exe - unnötig

Nein        HKLM:Run        PWRISOVM.EXE        PowerISO Computing, Inc.        C:\Program Files (x86)\PowerISO\PWRISOVM.EXE - notwendig

Nein        HKLM:Run        QQPCTray                "C:\Program Files (x86)\Tencent\QQPCMgr\7.3.8128.217\QQPCTray.exe"  /regrun - notwendig

Nein        HKLM:Run        QvodTerminal        Shenzhen QVOD Technology Co.,Ltd        "C:\Program Files (x86)\QvodPlayer\QvodTerminal.exe" -autorun - notwendig

Nein        HKLM:Run        Samsung PanelMgr                C:\Windows\Samsung\PanelMgr\ssmmgr.exe /autorun - notwendig

Nein        HKLM:Run        spc1000                C:\Windows\vspc1000.exe - unnötig

Nein        HKLM:Run        SunJavaUpdateSched        Sun Microsystems, Inc.        "C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe" - notwendig

Ja        HKLM:Run        Windows Mobile Device Center        Microsoft Corporation        %windir%\WindowsMobile\wmdc.exe - notwendig

Nein        Startup Common        Bluetooth Manager.lnk                C:\PROGRA~2\Toshiba\BLUETO~1\TosBtMng.exe  - notwendig

Nein        Startup Common        PS Monitor 1.30.lnk                C:\PROGRA~2\PSMONI~1\PsMon.exe  - notwendig

ok
HitmanPro - Download - Filepony

Hitmanpro laden, doppelklick, scan.
Nichts löschen, weiter.
Log speichern, bzw als xml exportieren, dann posten bzw packen und anhängen

Entschuldige, daß alles immer so lange baucht... morgen habe ich keine Zeit, Ich werde den ganzen Tag unterwegs sein.

Hier jetzt das Log von HitmanPro:

Code:

HitmanPro 3.7.5.199

www.hitmanpro.com
 

   Computer name . . . . : W7

   Windows . . . . . . . : 6.1.1.7601.X64/2

   User name . . . . . . : w7\root

   UAC . . . . . . . . . : Enabled

   License . . . . . . . : Trial (30 days left)
 

   Scan date . . . . . . : 2013-05-30 17:57:09

   Scan mode . . . . . . : Normal

   Scan duration . . . . : 14m 9s

   Disk access mode  . . : Direct disk access (SRB)

   Cloud . . . . . . . . : Internet

   Reboot  . . . . . . . : No
 

   Threats . . . . . . . : 19

   Traces  . . . . . . . : 672
 

   Objects scanned . . . : 3.654.156

   Files scanned . . . . : 77.729

   Remnants scanned  . . : 1.830.004 files / 1.746.423 keys
 

Malware _____________________________________________________________________
 

   C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll -> Quarantined

      Size . . . . . . . : 459.264 bytes

      Age  . . . . . . . : 75.8 days (2013-03-15 21:59:34)

      Entropy  . . . . . : 6.4

      SHA-256  . . . . . : F02FC92E94E2CCA17DC9AECF08C8C115C92E46B9D218D382E87697DAEC421231

    > Emsisoft . . . . . : Adware.Win32.Yontoo.AMN!A2

      Fuzzy  . . . . . . : 98.0

      Forensic Cluster

         -5.3s C:\ProgramData\Tarma Installer\

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache\

         -0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\

         -0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe

         -0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll

         -0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico

          0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll

          0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache\

          0.1s C:\Program Files (x86)\Yontoo\

          0.1s C:\Program Files (x86)\Yontoo\sqlite3.exe

          0.1s C:\Users\root\AppData\Roaming\Yontoo\

          0.1s C:\Users\root\AppData\Roaming\Yontoo\YontooDesktop.exe

          0.1s C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

          3.2s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat

          3.4s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat

          5.9s C:\Users\root\AppData\Roaming\Yontoo\dat\update\

          5.9s C:\Users\root\AppData\Roaming\Yontoo\dat\

         12.4s C:\Users\root\AppData\Roaming\Yontoo\dat\Desktop.OS.dll

         28.5s C:\Users\root\AppData\Roaming\Yontoo\PlugIns.cache

         29.1s C:\Users\root\AppData\Roaming\Yontoo\dat\HeartBeat.dat
 
 

Potential Unwanted Programs _________________________________________________
 

   C:\Program Files (x86)\Yontoo\ (Yontoo)

   C:\Program Files (x86)\Yontoo\sqlite3.exe (Yontoo)

      Size . . . . . . . : 465.408 bytes

      Age  . . . . . . . : 75.8 days (2013-03-15 21:59:34)

      Entropy  . . . . . : 6.5

      SHA-256  . . . . . : F7B2783B68E6B991EEDAB07F6B2BFF0E6594E19AD470EDAA89618BC9ED367B3C

      Fuzzy  . . . . . . : 6.0

      Forensic Cluster

         -5.3s C:\ProgramData\Tarma Installer\

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache\

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache\

         -0.0s C:\Program Files (x86)\Yontoo\

          0.0s C:\Program Files (x86)\Yontoo\sqlite3.exe

          0.0s C:\Users\root\AppData\Roaming\Yontoo\

          0.0s C:\Users\root\AppData\Roaming\Yontoo\YontooDesktop.exe

          0.0s C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

          3.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat

          3.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat

          5.8s C:\Users\root\AppData\Roaming\Yontoo\dat\update\

          5.8s C:\Users\root\AppData\Roaming\Yontoo\dat\

         12.3s C:\Users\root\AppData\Roaming\Yontoo\dat\Desktop.OS.dll

         28.4s C:\Users\root\AppData\Roaming\Yontoo\PlugIns.cache

         29.0s C:\Users\root\AppData\Roaming\Yontoo\dat\HeartBeat.dat
 

   C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe (Yontoo)

      Size . . . . . . . : 23.552 bytes

      Age  . . . . . . . : 75.8 days (2013-03-15 21:59:34)

      Entropy  . . . . . : 5.6

      SHA-256  . . . . . : 967B7FA83171485DA1EEF51DB2A21FD17DFB4846E1F700C83E516BD40A542DCA

      Product  . . . . . : Y2Desktop.Updater

      Publisher  . . . . : Microsoft

      Description  . . . : Y2Desktop.Updater

      Version  . . . . . : 1.0.0.0

      Copyright  . . . . : Copyright © Microsoft 2013

      Service  . . . . . : Yontoo Desktop Updater

      Parent Name  . . . : C:\Windows\system32\services.exe

      Running processes  : 2012

      Fuzzy  . . . . . . : 7.0

      Startup

         HKLM\SYSTEM\CurrentControlSet\Services\Yontoo Desktop Updater\

      Forensic Cluster

         -5.4s C:\ProgramData\Tarma Installer\

         -5.4s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\

         -5.4s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe

         -5.4s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll

         -5.4s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico

         -5.4s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll

         -5.4s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache\

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll

         -0.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache\

         -0.1s C:\Program Files (x86)\Yontoo\

         -0.0s C:\Program Files (x86)\Yontoo\sqlite3.exe

         -0.0s C:\Users\root\AppData\Roaming\Yontoo\

         -0.0s C:\Users\root\AppData\Roaming\Yontoo\YontooDesktop.exe

          0.0s C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

          3.1s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat

          3.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat

          5.8s C:\Users\root\AppData\Roaming\Yontoo\dat\update\

          5.8s C:\Users\root\AppData\Roaming\Yontoo\dat\

         12.2s C:\Users\root\AppData\Roaming\Yontoo\dat\Desktop.OS.dll

         28.4s C:\Users\root\AppData\Roaming\Yontoo\PlugIns.cache

         28.9s C:\Users\root\AppData\Roaming\Yontoo\dat\HeartBeat.dat
 

   C:\ProgramData\Babylon\ (Babylon)

   C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\ (Yontoo)

   C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll (Yontoo)

   C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat (Yontoo)

   C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe (Yontoo)

      Size . . . . . . . : 227.984 bytes

      Age  . . . . . . . : 75.8 days (2013-03-15 21:59:34)

      Entropy  . . . . . : 6.4

      SHA-256  . . . . . : 17936188EFAC05A0EF9FD87A79B268445CE307DD37A6F9206D116F195AB049C9

      Product  . . . . . : Tarma® Installer

      Publisher  . . . . : Tarma Software Research Pty Ltd

      Description  . . . : Tarma® Installer

      Version  . . . . . : 2011.03.11.1355U

      Copyright  . . . . : © 1990-2011 Tarma Software Research Pty Ltd

      RSA Key Size . . . : 2048

      Authenticode . . . : Valid

      Fuzzy  . . . . . . : -15.0

      Forensic Cluster

         -5.3s C:\ProgramData\Tarma Installer\

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.exe

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setup.dll

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.ico

         -5.3s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\_Setupx.dll

         -5.2s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Cache\

          0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\

          0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.exe

          0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setup.dll

          0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico

          0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\_Setupx.dll

          0.0s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Cache\

          0.1s C:\Program Files (x86)\Yontoo\

          0.1s C:\Program Files (x86)\Yontoo\sqlite3.exe

          0.1s C:\Users\root\AppData\Roaming\Yontoo\

          0.1s C:\Users\root\AppData\Roaming\Yontoo\YontooDesktop.exe

          0.1s C:\Program Files (x86)\Yontoo\Y2Desktop.Updater.exe

          3.2s C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.dat

          3.4s C:\ProgramData\Tarma Installer\{361E80BE-388B-4270-BF54-A10C2B756504}\Setup.dat

          5.9s C:\Users\root\AppData\Roaming\Yontoo\dat\update\

          5.9s C:\Users\root\AppData\Roaming\Yontoo\dat\

         12.4s C:\Users\root\AppData\Roaming\Yontoo\dat\Desktop.OS.dll

         28.5s C:\Users\root\AppData\Roaming\Yontoo\PlugIns.cache

         29.1s C:\Users\root\AppData\Roaming\Yontoo\dat\HeartBeat.dat
 

   C:\ProgramData\Tarma Installer\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\Setup.ico (Yontoo)

   C:\Users\root\AppData\Roaming\Babylon\ (Babylon)

   C:\Users\root\AppData\Roaming\Babylon\log_file.txt (Babylon)

   HKLM\SOFTWARE\Classes\AppID\YontooIEClient.DLL\ (Yontoo)

   HKLM\SOFTWARE\Classes\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}\ (Delta Search)

   HKLM\SOFTWARE\Classes\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Prod.cap\ (Claro)

   HKLM\SOFTWARE\Classes\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Wow6432Node\AppID\YontooIEClient.DLL\ (Yontoo)

   HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{C26644C4-2A12-4CA6-8F2E-0EDE6CF018F3}\ (Delta Search)

   HKLM\SOFTWARE\Classes\Wow6432Node\AppID\{CFDAFE39-20CE-451D-BD45-A37452F39CF0}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Wow6432Node\CLSID\{FE9271F2-6EFD-44b0-A826-84C829536E93}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{10DE7085-6A1E-4D41-A7BF-9AF93E351401}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Wow6432Node\Interface\{1AD27395-1659-4DFF-A319-2CFA243861A5}\ (Yontoo)

   HKLM\SOFTWARE\Classes\Wow6432Node\TypeLib\{D372567D-67C1-4B29-B3F0-159B52B3E967}\ (Yontoo)

   HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall\{889DF117-14D1-44EE-9F31-C5FB5D47F68B}\ (Yontoo)

   HKLM\SOFTWARE\Wow6432Node\Babylon\ (Babylon)

   HKLM\SOFTWARE\Wow6432Node\DataMngr\ (SearchQU)

   HKLM\SOFTWARE\Wow6432Node\Google\Chrome\Extensions\niapdbllcanepiiimjjndipklodoedlc\ (Yontoo)

   HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Ext\PreApproved\{DF7770F7-832F-4BDF-B144-100EDDD0C3AE}\ (Yontoo)

   HKU\S-1-5-21-3787709050-3703385985-4224489799-1001\Software\BabylonToolbar\ (Babylon)

   HKU\S-1-5-21-3787709050-3703385985-4224489799-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0ECDF796-C2DC-4d79-A620-CCE0C0A66CC9}\ (Babylon)

   HKU\S-1-5-21-3787709050-3703385985-4224489799-1001_Classes\Wow6432Node\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}\ (Yontoo)

   HKU\S-1-5-21-3787709050-3703385985-4224489799-1003_Classes\Wow6432Node\CLSID\{80922ee0-8a76-46ae-95d5-bd3c3fe0708d}\ (Yontoo)

mach einfach so, wie zeit ist, starte mal neu und schaue, ob hitmanpro alles gelöscht hatt. also neuen Scan starten.

Hitman hat scheinbar alles gelöscht. Allerdings kann ich nach wie vor manchmal nichts
anklicken, kein Programm starten/beenden. Auch das Startmenü ist betroffen.

Gibt es ein Programm, mit dem ich ntdll.dll scannen kann?

warum solltest du die scannen? gibts ne Fehlermeldung mit dieser DLL?

Ich hatte mal ein Programm, weiß aber den Namen nicht mehr. Das hat Fehlermelungen über die Datei gemeldet. 0 != 12 usw. oder so, Ich habe die Datei nicht wiedergefunden.

die Logs haben nichts auffälliges gezeigt, wir denn das gerät zb fürs onlinebanking genutzt? dann sollte man evtl. sicher gehen und es einmal neu aufsetzen und absichern zumal wir uns ja dann noch evtl. otl logs der Anderen PC's ansehen müsste

Ja, wird auch fuer Onlinebanking eingesetzt. otl auf allen anderen laufen zu lassen, wird sicher länger dauern als dieses System neu zu installiere.

Schon beschämend, daß Bill Gates sich von Kindern und anderen schlauen Leuten bescheixxen läßt...

Vielen Dank erstmal bis hier für deine Geduld und Mühe.

Hi, naja, es gibt schon noch konfigurationen bzw backup möglichkeiten die man nutzen kann.
du kannst ja mal über die anderen PC's hitmanpro laufen lassen, nichts löschen und die logs anhängen, aber bitte nummeriert so das wir dann wissen was zu welchem pc gehört
1. Datenrettung:

deaktiviere Autorun: http://www.trojaner-board.de/83238-a...sschalten.html
dann sichere Daten auf nen externen datenträger: http://www.trojaner-board.de/82533-d...ted-magic.html
Bilder, Dokumente, Musik Videos (persönliches) http://www.trojaner-board.de/71715-k...iendungen.html

2. Formatieren, Windows neu instalieren:

nutzt du eine Windows CD: http://www.trojaner-board.de/51262-a...sicherung.html
recovery cd oder recovery partition.
falls dies ein fertig pc ist, nenne hersteller + typ.
Keine Windows 7 DVD? http://www.trojaner-board.de/100776-...-download.html

3. PC absichern: http://www.trojaner-board.de/96344-a...-rechners.html
ich werde außerdem noch weitere punkte dazu posten.
4. alle Passwörter ändern!
5. nach PC Absicherung, die gesicherten Daten prüfen und falls sauber: zurückspielen.
6. werde ich dann noch was zum absichern von Onlinebanking mit Chip Card Reader + Star Money sagen.die Hitmanpro logs sollten nich so viel Zeit in Anspruch nemen

Danke für die Hinweise, Datenverlust hat es nicht gegeben, ich mache jeden Morgen ein Backup für alle Benutzer auf einen USB-Stick. Die installierten Programme habe ich auf einem anderen Stick, ist also nicht die Gewalt. Das Problem werden die mui's, denn es gibt wieder Genörgel, wenn die Heimatsprache nicht dabei ist...

Ich danke dir herzlich für deine Zeit und Mühe, Windows gibt's jetzt neu aufgesetzt.

Gute Nacht dann erstmal. Samstag geht's weiter...

Hi, na die Sprachpakete gibts ja gott sei dank als download.
ich geb dir schon mal die Tipps zum absichern.
als antimalware programm würde ich emsisoft empfehlen.
diese haben für mich den besten schutz kostet aber etwas.
Computeractive Software Store - Emsisoft Anti-Malware 7 [1-PC] - 63% off RRP
testversion:
Meine Antivirus-Empfehlung: Emsisoft Anti-Malware
insbesondere wenn du onlinebanking, einkäufe, sonstige zahlungsabwicklungen oder ähnlich wichtiges, wie zb berufliches machst, also sensible daten zu schützen sind, solltest du in sicherheitssoftware investieren.
vor dem aktivieren der lizenz die 30 tage testzeitraum ausnutzen.

kostenlos, aber eben nicht ganz so gut währe avast zu empfehlen.
http://www.trojaner-board.de/110895-...antivirus.html

sag mir welches du nutzt, dann gebe ich konfigurationshinweise.
bitte dein bisheriges av deinstalieren
die folgende anleitung ist umfangreich, dass ist mir klar, sie sollte aber umgesetzt werden, da nur dann dein pc sicher ist. stelle so viele fragen wie nötig, ich arbeite gern alles mit dir durch!

http://www.trojaner-board.de/96344-a...-rechners.html
Starte bitte mit der Passage, Windows Vista und Windows 7
Bitte beginne damit, Windows Updates zu instalieren.
Am besten geht dies, wenn du über Start, Suchen gehst, und dort Windows Updates eingibst.
Prüfe unter "Einstellungen ändern" dass folgendes ausgewählt ist:
- Updates automatisch Instalieren,
- Täglich
- Uhrzeit wählen
- Bitte den gesammten rest anhaken, außer:
- detailierte benachichtungen anzeigen, wenn neue Microsoft software verfügbar ist.
Klicke jetzt die Schaltfläche "OK"
Klicke jetzt "nach Updates suchen".
Bitte instaliere zunächst wichtige Updates.
Es wird nötig sein, den PC zwischendurch neu zu starten. falls dies der Fall ist, musst du erneut über Start, Suchen, Windows Update aufrufen, auf Updates suchen klicken und die nächsten instalieren.
Mache das selbe bitte mit den optionalen Updates.
Bitte übernimm den rest so, wie es im Abschnitt windows 7 / Vista zu lesen ist.
aus dem Abschnitt xp, bitte den punkt "datenausführungsverhinderung, dep" übernehmen.
als browser rate ich dir zu chrome:
http://support.google.com/chrome/bin...&answer=118663
anleitung lesen bitte
falls du nen andern nutzen willst, sags mir dann muss ich teile der nun folgenden anleitung anpassen.

Sandboxie
Die devinition einer Sandbox ist hier nachzulesen:
Sandbox
Kurz gesagt, man kann Programme fast 100 %ig isuliert vom System ausführen.

Der Vorteil liegt klar auf der Hand, wenn über den Browser Schadcode eingeschläust wird, kann dieser nicht nach außen dringen.
Download Link:
Sandboxie - Download - Filepony

anleitung:
http://www.trojaner-board.de/71542-a...sandboxie.html
ausführliche anleitung als pdf, auch abarbeiten:
Sandbox Einstellungen |

bitte folgende zusatz konfiguration machen:
sandboxie control öffnen, menü sandbox anklicken, defauldbox wählen.
dort klicke auf sandbox einstellungen.
beschrenkungen, bei programm start und internet zugriff schreibe:
chrome.exe
dann gehe auf anwendungen, webbrowser, chrome.
dort aktiviere alles außer gesammten profil ordner freigeben.
Wie du evtl. schon gesehen hast, kannst du einige Funktionen nicht nutzen.
Dies ist nur in der Vollversion nötig, zu deren Kauf ich dir rate.
Du kannst zb unter "Erzwungene Programmstarts" festlegen, dass alle Browser in der Sandbox starten.
Ansonsten musst du immer auf "Sandboxed webbrowser" klicken bzw Rechtsklick, in Sandboxie starten.
Eine lebenslange Lizenz kostet 30 €, und ist auf allen deinen PC's nutzbar.

Weiter mit:
Maßnahmen für ALLE Windows-Versionen
alles komplett durcharbeiten
anmerkung zu file hippo.
in den settings zusätzlich auswählen:
hide beta updates.
Run updateChecker when Windows starts

Backup Programm:
in meiner Anleitung ist bereits ein Backup Programm verlinkt, als Alternative bietet sich auch das Windows eigene Backup Programm an:
http://www.trojaner-board.de/82962-w...en-backup.html
Dies ist aber leider nur für Windows 7 Nutzer vernünftig nutzbar.
Alle Anderen sollten sich aber auf jeden fall auch ein Backup Programm instalieren, denn dies kann unter Umständen sehr wichtig sein, zum Beispiel, wenn die Festplatte einmal kaputt ist.

Zum Schluss, die allgemeinen sicherheitstipps beachten, wenn es dich betrifft, den Tipp zum Onlinebanking beachten und alle Passwörter ändern
bitte auch lesen, wie mache ich programme für alle sichtbar:
Programme für alle Konten nutzbar machen - PCtipp.ch - Praxis & Hilfe
surfe jetzt also nur noch im standard nutzer konto und dort in der sandbox.
wenn du die kostenlose version nutzt, dann mit klick auf sandboxed web browser, wenn du die bezahlversion hast, kannst du erzwungene programm starts festlegen, dann wird sandboxie immer gestartet wenn du nen browser aufrufst.
wenn du mit der maus über den browser fährst sollte der eingerahmt sein, dann bist du im sandboxed web browser

passwort sicherheit:
jeder dienst benötigt ein eigenes, mindestens 12-stelliges passwort
bei der passwort verwaltung und erstellung hilft roboform
Passwort Manager, Formular Ausfueller, Passwort Management | RoboForm Passwort Manager
anleitung:
RoboForm-Bedienungsanleitung: Passwort-Manager, Verwalten von Passwörtern und persönlichen Daten

danke dir, Markus, seltsamerweise ist kein unbefugter Zugriff auf mein Konto erfolgt ( die letzte Login-Zeit wird angezeigt), wäre auch sinnlos, eine TAN per Zufall zu erzeugen, halt ich nicht für machbar. Ich verwende mindestens 12-stellige Passwörter, bestehend aus Groß- und Kleinbuchstaben, Zahlen und Satzzeichen. Mein qq-Passwort wurde mal entwendet, seither nutze ich bis zu 18-stellige Passwörter.

Ach übrigens: was war mit der Datei, die ich dir geschickt habe? ich hätte noch weitere email mit dubiosen Anhängen, die kommen fast im Sekundentakt hier an. Interesse?

Update: ich mache das so nach neu aufsetzen: AV installieren, dann Windows Update,
dann Programme installieren.

Samstag Unterricht in deutsch in China mittels qtalk. Köstlich, wenn jemand zuhören möchte. QQ und TM sind msn-Ersatz in China, die werden von mehreren Mrd. Chinesen eingesetzt. Wie hier ein kleiner Teil von Benutzern yahoo, msn, skype und icq zusammen benutzt wird.

Vielen Dank noch einmal für deine Tips!

Schönen Abend noch

hi ich würde windows instalieren und dann treiber, an aktuellen spams besteht interesse, also immer her damit

die haben allerdings alle chinesische Absender, aber ich schicke sie dir am Samstag, heute ist zu spät, morgen habe ich keine Zeit, muß um 6 aufstehen... und das als Rentner!

aber bitte drann denken, dann nur die aktuellen mails, 3 oder 4 tage alte bringen meist nich mehr so viel :-)