Trojaner-Board
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   Ich wurde gehackt und fühle mich nicht mehr sicher (https://www.trojaner-board.de/116073-wurde-gehackt-fuehle-mich-mehr-sicher.html)

cosinus 03.06.2012 21:42
Wiederhol den Fix im abgesicherten Modus bitte

Xaduras 03.06.2012 21:54
Diesmal hat es glaube ich funktioniert.

Code:
All processes killed
========== OTL ==========
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
64bit-Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
HKLM\SOFTWARE\Microsoft\Internet Explorer\Main\\Local Page| /E : value set successfully!
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
HKU\S-1-5-21-503904159-1529643387-3823001629-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
HKU\S-1-5-21-503904159-1529643387-3823001629-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache| /E : value set successfully!
HKU\S-1-5-21-503904159-1529643387-3823001629-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache AcceptLangs| /E : value set successfully!
HKU\S-1-5-21-503904159-1529643387-3823001629-1001\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page Redirect Cache_TIMESTAMP| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-503904159-1529643387-3823001629-1001\Software\Microsoft\Internet Explorer\URLSearchHooks\\{1ce76c93-a797-4ca2-ab3c-f4a6cfba3440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1ce76c93-a797-4ca2-ab3c-f4a6cfba3440}\ not found.
HKEY_USERS\S-1-5-21-503904159-1529643387-3823001629-1001\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-503904159-1529643387-3823001629-1001\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-503904159-1529643387-3823001629-1001\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Prefs.js: "google.de" removed from browser.startup.homepage
Folder C:\Users\Pascal\AppData\Roaming\mozilla\Firefox\Profiles\ech13afx.default\extensions\{1ce76c93-a797-4ca2-ab3c-f4a6cfba3440}\ not found.
Folder C:\Users\Pascal\AppData\Roaming\mozilla\Firefox\Profiles\ech13afx.default\extensions\toolbar@ask.com\ not found.
Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_USERS\S-1-5-21-503904159-1529643387-3823001629-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{1CE76C93-A797-4CA2-AB3C-F4A6CFBA3440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{1CE76C93-A797-4CA2-AB3C-F4A6CFBA3440}\ not found.
Registry value HKEY_USERS\S-1-5-21-503904159-1529643387-3823001629-1001\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
File C:\Program Files (x86)\Ask.com\GenericAskToolbar.dll not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ApnUpdater not found.
File C:\Program Files (x86)\Ask.com\Updater\Updater.exe not found.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\EnableLUA not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\PromptOnSecureDesktop not found.
Registry value HKEY_USERS\S-1-5-21-503904159-1529643387-3823001629-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoDriveTypeAutoRun not found.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
File move failed. H:\autorun.inf scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46878b90-15d9-11e1-ac29-806e6f6e6963}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46878b90-15d9-11e1-ac29-806e6f6e6963}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{46878b90-15d9-11e1-ac29-806e6f6e6963}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{46878b90-15d9-11e1-ac29-806e6f6e6963}\ not found.
File move failed. H:\BlueBirds.exe scheduled to be moved on reboot.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{52ccecf3-4de0-11e1-ab0b-00ff01000001}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52ccecf3-4de0-11e1-ab0b-00ff01000001}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{52ccecf3-4de0-11e1-ab0b-00ff01000001}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{52ccecf3-4de0-11e1-ab0b-00ff01000001}\ not found.
File K:\OblivionLauncher.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{adbe6130-15db-11e1-b612-00241dd6f505}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{adbe6130-15db-11e1-b612-00241dd6f505}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{adbe6130-15db-11e1-b612-00241dd6f505}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{adbe6130-15db-11e1-b612-00241dd6f505}\ not found.
File "I:\WD SmartWare.exe" autoplay=true not found.
========== FILES ==========
File\Folder C:\Program Files (x86)\Ask.com not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Pascal
->Temp folder emptied: 745 bytes
->Temporary Internet Files folder emptied: 33300 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 64192571 bytes
->Google Chrome cache emptied: 0 bytes
->Flash cache emptied: 932 bytes
 
User: Public
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 0 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 32902 bytes
RecycleBin emptied: 26521 bytes
 
Total Files Cleaned = 61,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Pascal
->Flash cache emptied: 0 bytes
 
User: Public
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.44.0 log created on 06032012_225158

Files\Folders moved on Reboot...
File move failed. H:\autorun.inf scheduled to be moved on reboot.
File move failed. H:\BlueBirds.exe scheduled to be moved on reboot.
C:\Users\Pascal\AppData\Local\Temp\FXSAPIDebugLogFile.txt moved successfully.

Registry entries deleted on Reboot...

cosinus 04.06.2012 10:08
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

Xaduras 04.06.2012 11:14
Ich danke dir vielmals.

Hier das Log

Code:
12:11:48.0384 2788        TDSS rootkit removing tool 2.7.36.0 May 21 2012 16:40:16
12:11:50.0396 2788        ============================================================
12:11:50.0396 2788        Current date / time: 2012/06/04 12:11:50.0396
12:11:50.0396 2788        SystemInfo:
12:11:50.0396 2788       
12:11:50.0396 2788        OS Version: 6.1.7601 ServicePack: 1.0
12:11:50.0396 2788        Product type: Workstation
12:11:50.0396 2788        ComputerName: PASCAL-PC
12:11:50.0396 2788        UserName: Pascal
12:11:50.0396 2788        Windows directory: C:\Windows
12:11:50.0396 2788        System windows directory: C:\Windows
12:11:50.0396 2788        Running under WOW64
12:11:50.0396 2788        Processor architecture: Intel x64
12:11:50.0396 2788        Number of processors: 4
12:11:50.0396 2788        Page size: 0x1000
12:11:50.0396 2788        Boot type: Normal boot
12:11:50.0396 2788        ============================================================
12:11:51.0972 2788        Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1F8B1, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xF0, Type 'K0', Flags 0x00000040
12:11:51.0972 2788        ============================================================
12:11:51.0972 2788        \Device\Harddisk0\DR0:
12:11:51.0972 2788        MBR partitions:
12:11:51.0972 2788        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x3F, BlocksNum 0x186A02E1
12:11:51.0988 2788        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x186A035F, BlocksNum 0x186A02E1
12:11:52.0003 2788        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x30D4067F, BlocksNum 0x186A02E1
12:11:52.0019 2788        \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x493E099F, BlocksNum 0x186A02E1
12:11:52.0034 2788        \Device\Harddisk0\DR0\Partition4: MBR, Type 0x7, StartLBA 0x61A80CBF, BlocksNum 0x12C80E41
12:11:52.0034 2788        ============================================================
12:11:52.0066 2788        C: <-> \Device\Harddisk0\DR0\Partition0
12:11:52.0097 2788        D: <-> \Device\Harddisk0\DR0\Partition1
12:11:52.0128 2788        E: <-> \Device\Harddisk0\DR0\Partition2
12:11:52.0159 2788        F: <-> \Device\Harddisk0\DR0\Partition3
12:11:52.0175 2788        G: <-> \Device\Harddisk0\DR0\Partition4
12:11:52.0175 2788        ============================================================
12:11:52.0175 2788        Initialize success
12:11:52.0175 2788        ============================================================
12:12:20.0332 2244        ============================================================
12:12:20.0332 2244        Scan started
12:12:20.0332 2244        Mode: Manual; SigCheck; TDLFS;
12:12:20.0332 2244        ============================================================
12:12:21.0284 2244        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
12:12:21.0346 2244        1394ohci - ok
12:12:21.0377 2244        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
12:12:21.0393 2244        ACPI - ok
12:12:21.0408 2244        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
12:12:21.0471 2244        AcpiPmi - ok
12:12:21.0518 2244        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
12:12:21.0533 2244        adp94xx - ok
12:12:21.0564 2244        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
12:12:21.0580 2244        adpahci - ok
12:12:21.0596 2244        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
12:12:21.0611 2244        adpu320 - ok
12:12:21.0627 2244        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
12:12:21.0736 2244        AeLookupSvc - ok
12:12:21.0783 2244        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
12:12:21.0830 2244        AFD - ok
12:12:21.0861 2244        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
12:12:21.0892 2244        agp440 - ok
12:12:21.0892 2244        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
12:12:21.0939 2244        ALG - ok
12:12:21.0970 2244        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
12:12:21.0986 2244        aliide - ok
12:12:22.0032 2244        AMD External Events Utility (b5e2434fc851698c1f119cf1c3935a50) C:\Windows\system32\atiesrxx.exe
12:12:22.0110 2244        AMD External Events Utility - ok
12:12:22.0173 2244        AMD FUEL Service - ok
12:12:22.0188 2244        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
12:12:22.0204 2244        amdide - ok
12:12:22.0235 2244        amdiox64        (6a2eeb0c4133b20773bb3dd0b7b377b4) C:\Windows\system32\DRIVERS\amdiox64.sys
12:12:22.0251 2244        amdiox64 - ok
12:12:22.0266 2244        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
12:12:22.0313 2244        AmdK8 - ok
12:12:22.0578 2244        amdkmdag        (9e3b4946f7e1bca0b763e19d81edbf2c) C:\Windows\system32\DRIVERS\atikmdag.sys
12:12:22.0750 2244        amdkmdag - ok
12:12:22.0875 2244        amdkmdap        (b9e1c7b7f1865f99b16ff2e1bb94edb6) C:\Windows\system32\DRIVERS\atikmpag.sys
12:12:22.0922 2244        amdkmdap - ok
12:12:22.0937 2244        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
12:12:22.0968 2244        AmdPPM - ok
12:12:23.0000 2244        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
12:12:23.0031 2244        amdsata - ok
12:12:23.0046 2244        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
12:12:23.0062 2244        amdsbs - ok
12:12:23.0062 2244        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
12:12:23.0078 2244        amdxata - ok
12:12:23.0234 2244        AntiVirFirewallService (6acc11e9d2f01c88251123d26c1c5489) C:\Program Files (x86)\Avira\AntiVir Desktop\avfwsvc.exe
12:12:23.0280 2244        AntiVirFirewallService - ok
12:12:23.0343 2244        AntiVirMailService (b7fa28aefa586fb5a04876c7b31d03e6) C:\Program Files (x86)\Avira\AntiVir Desktop\avmailc.exe
12:12:23.0358 2244        AntiVirMailService - ok
12:12:23.0405 2244        AntiVirSchedulerService (2e35310d600f4cc64624786a813a041e) C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
12:12:23.0421 2244        AntiVirSchedulerService - ok
12:12:23.0452 2244        AntiVirService  (984102b9e2f6513008ed4e0c5ac4151d) C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
12:12:23.0483 2244        AntiVirService - ok
12:12:23.0546 2244        AntiVirWebService (9bc7247fd7379307bcff92cf8eb64b87) C:\Program Files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE
12:12:23.0577 2244        AntiVirWebService - ok
12:12:23.0639 2244        AODDriver4.01  (f312fad7dbd49ed21a194ac71b497832) C:\Program Files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys
12:12:23.0655 2244        AODDriver4.01 - ok
12:12:23.0780 2244        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
12:12:23.0889 2244        AppID - ok
12:12:23.0904 2244        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
12:12:23.0967 2244        AppIDSvc - ok
12:12:23.0998 2244        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
12:12:24.0014 2244        Appinfo - ok
12:12:24.0045 2244        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
12:12:24.0060 2244        arc - ok
12:12:24.0076 2244        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
12:12:24.0076 2244        arcsas - ok
12:12:24.0107 2244        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
12:12:24.0138 2244        AsyncMac - ok
12:12:24.0170 2244        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
12:12:24.0170 2244        atapi - ok
12:12:24.0404 2244        atikmdag        (9e3b4946f7e1bca0b763e19d81edbf2c) C:\Windows\system32\DRIVERS\atikmdag.sys
12:12:24.0497 2244        atikmdag - ok
12:12:24.0606 2244        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
12:12:24.0669 2244        AudioEndpointBuilder - ok
12:12:24.0669 2244        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
12:12:24.0700 2244        AudioSrv - ok
12:12:24.0747 2244        avfwim          (f3a3859d006783a0e0d40e227e52c35c) C:\Windows\system32\DRIVERS\avfwim.sys
12:12:24.0747 2244        avfwim - ok
12:12:24.0778 2244        avfwot          (bc06315a7bdbcad0c7719d1c1306a4db) C:\Windows\system32\DRIVERS\avfwot.sys
12:12:24.0809 2244        avfwot - ok
12:12:24.0856 2244        avgntflt        (26e38b5a58c6c55fafbc563eeddb0867) C:\Windows\system32\DRIVERS\avgntflt.sys
12:12:24.0887 2244        avgntflt - ok
12:12:24.0918 2244        avipbb          (9d1f00beff84cbbf46d7f052bc7e0565) C:\Windows\system32\DRIVERS\avipbb.sys
12:12:24.0934 2244        avipbb - ok
12:12:24.0950 2244        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
12:12:24.0965 2244        avkmgr - ok
12:12:24.0996 2244        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
12:12:25.0074 2244        AxInstSV - ok
12:12:25.0106 2244        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
12:12:25.0137 2244        b06bdrv - ok
12:12:25.0168 2244        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
12:12:25.0199 2244        b57nd60a - ok
12:12:25.0246 2244        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
12:12:25.0262 2244        BDESVC - ok
12:12:25.0277 2244        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
12:12:25.0324 2244        Beep - ok
12:12:25.0371 2244        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
12:12:25.0402 2244        BFE - ok
12:12:25.0433 2244        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
12:12:25.0480 2244        BITS - ok
12:12:25.0511 2244        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
12:12:25.0527 2244        blbdrive - ok
12:12:25.0558 2244        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
12:12:25.0589 2244        bowser - ok
12:12:25.0589 2244        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
12:12:25.0636 2244        BrFiltLo - ok
12:12:25.0652 2244        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
12:12:25.0652 2244        BrFiltUp - ok
12:12:25.0667 2244        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
12:12:25.0714 2244        Browser - ok
12:12:25.0730 2244        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
12:12:25.0776 2244        Brserid - ok
12:12:25.0792 2244        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
12:12:25.0808 2244        BrSerWdm - ok
12:12:25.0808 2244        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
12:12:25.0823 2244        BrUsbMdm - ok
12:12:25.0823 2244        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
12:12:25.0839 2244        BrUsbSer - ok
12:12:25.0854 2244        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
12:12:25.0854 2244        BTHMODEM - ok
12:12:25.0886 2244        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
12:12:25.0948 2244        bthserv - ok
12:12:25.0964 2244        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
12:12:25.0995 2244        cdfs - ok
12:12:26.0010 2244        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
12:12:26.0026 2244        cdrom - ok
12:12:26.0042 2244        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
12:12:26.0073 2244        CertPropSvc - ok
12:12:26.0104 2244        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
12:12:26.0104 2244        circlass - ok
12:12:26.0135 2244        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
12:12:26.0151 2244        CLFS - ok
12:12:26.0198 2244        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
12:12:26.0229 2244        clr_optimization_v2.0.50727_32 - ok
12:12:26.0276 2244        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
12:12:26.0307 2244        clr_optimization_v2.0.50727_64 - ok
12:12:26.0369 2244        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
12:12:26.0416 2244        clr_optimization_v4.0.30319_32 - ok
12:12:26.0432 2244        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
12:12:26.0447 2244        clr_optimization_v4.0.30319_64 - ok
12:12:26.0447 2244        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
12:12:26.0478 2244        CmBatt - ok
12:12:26.0494 2244        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
12:12:26.0525 2244        cmdide - ok
12:12:26.0556 2244        CNG            (c4943b6c962e4b82197542447ad599f4) C:\Windows\system32\Drivers\cng.sys
12:12:26.0619 2244        CNG - ok
12:12:26.0619 2244        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
12:12:26.0634 2244        Compbatt - ok
12:12:26.0650 2244        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
12:12:26.0681 2244        CompositeBus - ok
12:12:26.0697 2244        COMSysApp - ok
12:12:26.0712 2244        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
12:12:26.0744 2244        crcdisk - ok
12:12:26.0790 2244        CryptSvc        (15597883fbe9b056f276ada3ad87d9af) C:\Windows\system32\cryptsvc.dll
12:12:26.0868 2244        CryptSvc - ok
12:12:26.0962 2244        DAUpdaterSvc    (80861969541971176e005d2c09dae851) D:\Spiele\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe
12:12:26.0978 2244        DAUpdaterSvc - ok
12:12:27.0009 2244        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
12:12:27.0056 2244        DcomLaunch - ok
12:12:27.0102 2244        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
12:12:27.0165 2244        defragsvc - ok
12:12:27.0352 2244        DevoloNetworkService (d17845a5385bfcb838cdc532af5e3e47) C:\Program Files (x86)\devolo\dlan\devolonetsvc.exe
12:12:27.0399 2244        DevoloNetworkService - ok
12:12:27.0508 2244        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
12:12:27.0570 2244        DfsC - ok
12:12:27.0602 2244        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
12:12:27.0617 2244        Dhcp - ok
12:12:27.0633 2244        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
12:12:27.0664 2244        discache - ok
12:12:27.0695 2244        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
12:12:27.0695 2244        Disk - ok
12:12:27.0726 2244        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
12:12:27.0758 2244        Dnscache - ok
12:12:27.0789 2244        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
12:12:27.0851 2244        dot3svc - ok
12:12:27.0867 2244        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
12:12:27.0898 2244        DPS - ok
12:12:27.0914 2244        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
12:12:27.0929 2244        drmkaud - ok
12:12:27.0992 2244        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
12:12:28.0023 2244        DXGKrnl - ok
12:12:28.0038 2244        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
12:12:28.0085 2244        EapHost - ok
12:12:28.0163 2244        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
12:12:28.0210 2244        ebdrv - ok
12:12:28.0288 2244        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
12:12:28.0350 2244        EFS - ok
12:12:28.0397 2244        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
12:12:28.0444 2244        ehRecvr - ok
12:12:28.0460 2244        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
12:12:28.0491 2244        ehSched - ok
12:12:28.0569 2244        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
12:12:28.0584 2244        elxstor - ok
12:12:28.0616 2244        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
12:12:28.0647 2244        ErrDev - ok
12:12:28.0662 2244        ESLvnic1        (c33acb897af927d1c1bd84f211fae75b) C:\Windows\system32\DRIVERS\ESLvnic.sys
12:12:28.0678 2244        ESLvnic1 - ok
12:12:28.0725 2244        ESLWireAC      (abc24f129c616e5dee5ce58683606c84) C:\Windows\system32\drivers\ESLWireACD.sys
12:12:28.0756 2244        ESLWireAC - ok
12:12:28.0787 2244        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
12:12:28.0834 2244        EventSystem - ok
12:12:28.0850 2244        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
12:12:28.0881 2244        exfat - ok
12:12:28.0896 2244        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
12:12:28.0928 2244        fastfat - ok
12:12:28.0959 2244        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
12:12:28.0990 2244        Fax - ok
12:12:29.0006 2244        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
12:12:29.0021 2244        fdc - ok
12:12:29.0037 2244        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
12:12:29.0068 2244        fdPHost - ok
12:12:29.0068 2244        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
12:12:29.0099 2244        FDResPub - ok
12:12:29.0115 2244        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
12:12:29.0130 2244        FileInfo - ok
12:12:29.0146 2244        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
12:12:29.0177 2244        Filetrace - ok
12:12:29.0177 2244        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
12:12:29.0177 2244        flpydisk - ok
12:12:29.0193 2244        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
12:12:29.0208 2244        FltMgr - ok
12:12:29.0255 2244        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
12:12:29.0302 2244        FontCache - ok
12:12:29.0364 2244        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
12:12:29.0380 2244        FontCache3.0.0.0 - ok
12:12:29.0396 2244        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
12:12:29.0411 2244        FsDepends - ok
12:12:29.0442 2244        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
12:12:29.0442 2244        Fs_Rec - ok
12:12:29.0458 2244        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
12:12:29.0489 2244        fvevol - ok
12:12:29.0505 2244        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
12:12:29.0505 2244        gagp30kx - ok
12:12:29.0536 2244        gdrv            (4412705f7fd88aacb1dad2ed321c3328) C:\Windows\gdrv.sys
12:12:29.0552 2244        gdrv - ok
12:12:29.0598 2244        gdwfpcd - ok
12:12:29.0645 2244        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
12:12:29.0676 2244        gpsvc - ok
12:12:29.0676 2244        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
12:12:29.0708 2244        hcw85cir - ok
12:12:29.0770 2244        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
12:12:29.0817 2244        HdAudAddService - ok
12:12:29.0848 2244        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
12:12:29.0895 2244        HDAudBus - ok
12:12:29.0910 2244        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
12:12:29.0926 2244        HidBatt - ok
12:12:29.0942 2244        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
12:12:29.0957 2244        HidBth - ok
12:12:29.0957 2244        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
12:12:29.0988 2244        HidIr - ok
12:12:30.0004 2244        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
12:12:30.0051 2244        hidserv - ok
12:12:30.0066 2244        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
12:12:30.0066 2244        HidUsb - ok
12:12:30.0098 2244        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
12:12:30.0160 2244        hkmsvc - ok
12:12:30.0176 2244        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
12:12:30.0207 2244        HomeGroupListener - ok
12:12:30.0238 2244        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
12:12:30.0269 2244        HomeGroupProvider - ok
12:12:30.0285 2244        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
12:12:30.0300 2244        HpSAMD - ok
12:12:30.0347 2244        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
12:12:30.0394 2244        HTTP - ok
12:12:30.0410 2244        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
12:12:30.0410 2244        hwpolicy - ok
12:12:30.0441 2244        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
12:12:30.0441 2244        i8042prt - ok
12:12:30.0488 2244        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
12:12:30.0503 2244        iaStorV - ok
12:12:30.0597 2244        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
12:12:30.0628 2244        idsvc - ok
12:12:30.0659 2244        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
12:12:30.0659 2244        iirsp - ok
12:12:30.0690 2244        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
12:12:30.0722 2244        IKEEXT - ok
12:12:30.0815 2244        IntcAzAudAddService (4b071aebbc13d60430ee0371b262f681) C:\Windows\system32\drivers\RTKVHD64.sys
12:12:30.0862 2244        IntcAzAudAddService - ok
12:12:30.0924 2244        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
12:12:30.0956 2244        intelide - ok
12:12:30.0971 2244        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
12:12:30.0987 2244        intelppm - ok
12:12:31.0002 2244        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
12:12:31.0049 2244        IPBusEnum - ok
12:12:31.0080 2244        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
12:12:31.0143 2244        IpFilterDriver - ok
12:12:31.0174 2244        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
12:12:31.0205 2244        iphlpsvc - ok
12:12:31.0236 2244        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
12:12:31.0236 2244        IPMIDRV - ok
12:12:31.0252 2244        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
12:12:31.0283 2244        IPNAT - ok
12:12:31.0299 2244        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
12:12:31.0330 2244        IRENUM - ok
12:12:31.0346 2244        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
12:12:31.0346 2244        isapnp - ok
12:12:31.0361 2244        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
12:12:31.0377 2244        iScsiPrt - ok
12:12:31.0392 2244        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
12:12:31.0392 2244        kbdclass - ok
12:12:31.0424 2244        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
12:12:31.0439 2244        kbdhid - ok
12:12:31.0455 2244        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:12:31.0470 2244        KeyIso - ok
12:12:31.0486 2244        KSecDD          (da1e991a61cfdd755a589e206b97644b) C:\Windows\system32\Drivers\ksecdd.sys
12:12:31.0486 2244        KSecDD - ok
12:12:31.0502 2244        KSecPkg        (7e33198d956943a4f11a5474c1e9106f) C:\Windows\system32\Drivers\ksecpkg.sys
12:12:31.0502 2244        KSecPkg - ok
12:12:31.0517 2244        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
12:12:31.0548 2244        ksthunk - ok
12:12:31.0580 2244        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
12:12:31.0611 2244        KtmRm - ok
12:12:31.0642 2244        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
12:12:31.0673 2244        LanmanServer - ok
12:12:31.0704 2244        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
12:12:31.0736 2244        LanmanWorkstation - ok
12:12:31.0829 2244        LBTServ        (64222b8f5357fd3c26c8957021bccb58) C:\Program Files\Common Files\Logishrd\Bluetooth\LBTServ.exe
12:12:31.0845 2244        LBTServ - ok
12:12:31.0876 2244        LHidFilt        (a7a1f07a63eecea1de943592374e26ce) C:\Windows\system32\DRIVERS\LHidFilt.Sys
12:12:31.0907 2244        LHidFilt - ok
12:12:31.0938 2244        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
12:12:32.0016 2244        lltdio - ok
12:12:32.0048 2244        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
12:12:32.0094 2244        lltdsvc - ok
12:12:32.0094 2244        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
12:12:32.0110 2244        lmhosts - ok
12:12:32.0126 2244        LMouFilt        (3ffc578a2388ed48600ea7b3a37e4394) C:\Windows\system32\DRIVERS\LMouFilt.Sys
12:12:32.0141 2244        LMouFilt - ok
12:12:32.0157 2244        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
12:12:32.0172 2244        LSI_FC - ok
12:12:32.0172 2244        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
12:12:32.0188 2244        LSI_SAS - ok
12:12:32.0188 2244        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
12:12:32.0204 2244        LSI_SAS2 - ok
12:12:32.0219 2244        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
12:12:32.0235 2244        LSI_SCSI - ok
12:12:32.0235 2244        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
12:12:32.0297 2244        luafv - ok
12:12:32.0313 2244        LUsbFilt        (2e46243c1100f1d17803803c4d4191f1) C:\Windows\system32\Drivers\LUsbFilt.Sys
12:12:32.0313 2244        LUsbFilt - ok
12:12:32.0328 2244        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
12:12:32.0344 2244        Mcx2Svc - ok
12:12:32.0360 2244        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
12:12:32.0375 2244        megasas - ok
12:12:32.0391 2244        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
12:12:32.0406 2244        MegaSR - ok
12:12:32.0406 2244        MEMSWEEP2 - ok
12:12:32.0438 2244        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
12:12:32.0516 2244        MMCSS - ok
12:12:32.0531 2244        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
12:12:32.0562 2244        Modem - ok
12:12:32.0578 2244        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
12:12:32.0594 2244        monitor - ok
12:12:32.0625 2244        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
12:12:32.0625 2244        mouclass - ok
12:12:32.0656 2244        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
12:12:32.0672 2244        mouhid - ok
12:12:32.0703 2244        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
12:12:32.0734 2244        mountmgr - ok
12:12:32.0796 2244        MozillaMaintenance (96aa8ba23142cc8e2b30f3cae0c80254) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
12:12:32.0828 2244        MozillaMaintenance - ok
12:12:32.0843 2244        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
12:12:32.0859 2244        mpio - ok
12:12:32.0874 2244        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
12:12:32.0906 2244        mpsdrv - ok
12:12:32.0952 2244        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
12:12:32.0984 2244        MpsSvc - ok
12:12:33.0015 2244        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
12:12:33.0046 2244        MRxDAV - ok
12:12:33.0062 2244        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
12:12:33.0093 2244        mrxsmb - ok
12:12:33.0124 2244        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
12:12:33.0171 2244        mrxsmb10 - ok
12:12:33.0186 2244        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
12:12:33.0202 2244        mrxsmb20 - ok
12:12:33.0218 2244        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
12:12:33.0218 2244        msahci - ok
12:12:33.0233 2244        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
12:12:33.0249 2244        msdsm - ok
12:12:33.0264 2244        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
12:12:33.0311 2244        MSDTC - ok
12:12:33.0327 2244        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
12:12:33.0358 2244        Msfs - ok
12:12:33.0374 2244        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
12:12:33.0405 2244        mshidkmdf - ok
12:12:33.0420 2244        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
12:12:33.0436 2244        msisadrv - ok
12:12:33.0467 2244        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
12:12:33.0514 2244        MSiSCSI - ok
12:12:33.0514 2244        msiserver - ok
12:12:33.0545 2244        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
12:12:33.0608 2244        MSKSSRV - ok
12:12:33.0623 2244        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
12:12:33.0654 2244        MSPCLOCK - ok
12:12:33.0654 2244        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
12:12:33.0686 2244        MSPQM - ok
12:12:33.0717 2244        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
12:12:33.0764 2244        MsRPC - ok
12:12:33.0764 2244        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
12:12:33.0779 2244        mssmbios - ok
12:12:33.0779 2244        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
12:12:33.0826 2244        MSTEE - ok
12:12:33.0826 2244        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
12:12:33.0842 2244        MTConfig - ok
12:12:33.0857 2244        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
12:12:33.0857 2244        Mup - ok
12:12:33.0888 2244        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
12:12:33.0920 2244        napagent - ok
12:12:33.0951 2244        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
12:12:33.0982 2244        NativeWifiP - ok
12:12:34.0013 2244        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
12:12:34.0029 2244        NDIS - ok
12:12:34.0044 2244        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
12:12:34.0060 2244        NdisCap - ok
12:12:34.0091 2244        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
12:12:34.0122 2244        NdisTapi - ok
12:12:34.0138 2244        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
12:12:34.0169 2244        Ndisuio - ok
12:12:34.0185 2244        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
12:12:34.0216 2244        NdisWan - ok
12:12:34.0247 2244        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
12:12:34.0263 2244        NDProxy - ok
12:12:34.0278 2244        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
12:12:34.0325 2244        NetBIOS - ok
12:12:34.0341 2244        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
12:12:34.0372 2244        NetBT - ok
12:12:34.0403 2244        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:12:34.0403 2244        Netlogon - ok
12:12:34.0434 2244        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
12:12:34.0481 2244        Netman - ok
12:12:34.0497 2244        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
12:12:34.0528 2244        netprofm - ok
12:12:34.0606 2244        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
12:12:34.0637 2244        NetTcpPortSharing - ok
12:12:34.0653 2244        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
12:12:34.0668 2244        nfrd960 - ok
12:12:34.0684 2244        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
12:12:34.0731 2244        NlaSvc - ok
12:12:34.0731 2244        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
12:12:34.0762 2244        Npfs - ok
12:12:34.0840 2244        NPF_devolo      (49697c2c761acb5c0de99cc8fe93e95b) C:\Windows\sysWOW64\drivers\npf_devolo.sys
12:12:34.0871 2244        NPF_devolo - ok
12:12:34.0887 2244        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
12:12:34.0934 2244        nsi - ok
12:12:34.0949 2244        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
12:12:34.0980 2244        nsiproxy - ok
12:12:35.0027 2244        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
12:12:35.0058 2244        Ntfs - ok
12:12:35.0121 2244        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
12:12:35.0183 2244        Null - ok
12:12:35.0199 2244        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
12:12:35.0214 2244        nvraid - ok
12:12:35.0230 2244        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
12:12:35.0246 2244        nvstor - ok
12:12:35.0261 2244        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
12:12:35.0277 2244        nv_agp - ok
12:12:35.0277 2244        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
12:12:35.0292 2244        ohci1394 - ok
12:12:35.0308 2244        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
12:12:35.0339 2244        p2pimsvc - ok
12:12:35.0370 2244        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
12:12:35.0386 2244        p2psvc - ok
12:12:35.0402 2244        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
12:12:35.0417 2244        Parport - ok
12:12:35.0433 2244        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
12:12:35.0448 2244        partmgr - ok
12:12:35.0464 2244        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
12:12:35.0480 2244        PcaSvc - ok
12:12:35.0495 2244        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
12:12:35.0511 2244        pci - ok
12:12:35.0526 2244        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
12:12:35.0526 2244        pciide - ok
12:12:35.0558 2244        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
12:12:35.0558 2244        pcmcia - ok
12:12:35.0573 2244        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
12:12:35.0573 2244        pcw - ok
12:12:35.0604 2244        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
12:12:35.0636 2244        PEAUTH - ok
12:12:35.0698 2244        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
12:12:35.0729 2244        PerfHost - ok
12:12:35.0807 2244        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
12:12:35.0854 2244        pla - ok
12:12:35.0885 2244        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
12:12:35.0901 2244        PlugPlay - ok
12:12:35.0916 2244        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
12:12:35.0932 2244        PNRPAutoReg - ok
12:12:35.0948 2244        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
12:12:35.0963 2244        PNRPsvc - ok
12:12:35.0979 2244        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
12:12:36.0010 2244        PolicyAgent - ok
12:12:36.0041 2244        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
12:12:36.0072 2244        Power - ok
12:12:36.0119 2244        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
12:12:36.0182 2244        PptpMiniport - ok
12:12:36.0197 2244        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
12:12:36.0213 2244        Processor - ok
12:12:36.0244 2244        ProfSvc        (5c78838b4d166d1a27db3a8a820c799a) C:\Windows\system32\profsvc.dll
12:12:36.0275 2244        ProfSvc - ok
12:12:36.0291 2244        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:12:36.0306 2244        ProtectedStorage - ok
12:12:36.0322 2244        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
12:12:36.0353 2244        Psched - ok
12:12:36.0400 2244        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
12:12:36.0431 2244        ql2300 - ok
12:12:36.0494 2244        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
12:12:36.0525 2244        ql40xx - ok
12:12:36.0556 2244        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
12:12:36.0603 2244        QWAVE - ok
12:12:36.0618 2244        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
12:12:36.0650 2244        QWAVEdrv - ok
12:12:36.0650 2244        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
12:12:36.0696 2244        RasAcd - ok
12:12:36.0712 2244        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
12:12:36.0743 2244        RasAgileVpn - ok
12:12:36.0743 2244        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
12:12:36.0774 2244        RasAuto - ok
12:12:36.0790 2244        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
12:12:36.0821 2244        Rasl2tp - ok
12:12:36.0852 2244        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
12:12:36.0884 2244        RasMan - ok
12:12:36.0899 2244        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
12:12:36.0946 2244        RasPppoe - ok
12:12:36.0962 2244        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
12:12:36.0993 2244        RasSstp - ok
12:12:37.0024 2244        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
12:12:37.0055 2244        rdbss - ok
12:12:37.0055 2244        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
12:12:37.0071 2244        rdpbus - ok
12:12:37.0086 2244        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
12:12:37.0118 2244        RDPCDD - ok
12:12:37.0118 2244        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
12:12:37.0164 2244        RDPENCDD - ok
12:12:37.0180 2244        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
12:12:37.0196 2244        RDPREFMP - ok
12:12:37.0211 2244        RDPWD          (6d76e6433574b058adcb0c50df834492) C:\Windows\system32\drivers\RDPWD.sys
12:12:37.0258 2244        RDPWD - ok
12:12:37.0289 2244        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
12:12:37.0305 2244        rdyboost - ok
12:12:37.0320 2244        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
12:12:37.0383 2244        RemoteAccess - ok
12:12:37.0414 2244        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
12:12:37.0476 2244        RemoteRegistry - ok
12:12:37.0492 2244        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
12:12:37.0523 2244        RpcEptMapper - ok
12:12:37.0539 2244        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
12:12:37.0554 2244        RpcLocator - ok
12:12:37.0586 2244        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
12:12:37.0601 2244        RpcSs - ok
12:12:37.0632 2244        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
12:12:37.0664 2244        rspndr - ok
12:12:37.0695 2244        RTHDMIAzAudService (67c7695d3b18682addf8419eda4bbfb8) C:\Windows\system32\drivers\RtHDMIVX.sys
12:12:37.0695 2244        RTHDMIAzAudService - ok
12:12:37.0726 2244        RTL8167        (abcb5a38a0d85bdf69b7877e1ad1eed5) C:\Windows\system32\DRIVERS\Rt64win7.sys
12:12:37.0757 2244        RTL8167 - ok
12:12:37.0773 2244        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:12:37.0788 2244        SamSs - ok
12:12:37.0804 2244        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
12:12:37.0804 2244        sbp2port - ok
12:12:37.0820 2244        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
12:12:37.0851 2244        SCardSvr - ok
12:12:37.0866 2244        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
12:12:37.0898 2244        scfilter - ok
12:12:37.0944 2244        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
12:12:37.0991 2244        Schedule - ok
12:12:38.0007 2244        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
12:12:38.0038 2244        SCPolicySvc - ok
12:12:38.0054 2244        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
12:12:38.0054 2244        SDRSVC - ok
12:12:38.0085 2244        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
12:12:38.0132 2244        secdrv - ok
12:12:38.0147 2244        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
12:12:38.0178 2244        seclogon - ok
12:12:38.0210 2244        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
12:12:38.0241 2244        SENS - ok
12:12:38.0256 2244        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
12:12:38.0288 2244        SensrSvc - ok
12:12:38.0303 2244        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
12:12:38.0334 2244        Serenum - ok
12:12:38.0350 2244        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
12:12:38.0366 2244        Serial - ok
12:12:38.0381 2244        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
12:12:38.0397 2244        sermouse - ok
12:12:38.0428 2244        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
12:12:38.0475 2244        SessionEnv - ok
12:12:38.0475 2244        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
12:12:38.0522 2244        sffdisk - ok
12:12:38.0537 2244        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
12:12:38.0553 2244        sffp_mmc - ok
12:12:38.0568 2244        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
12:12:38.0584 2244        sffp_sd - ok
12:12:38.0600 2244        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
12:12:38.0615 2244        sfloppy - ok
12:12:38.0646 2244        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
12:12:38.0678 2244        SharedAccess - ok
12:12:38.0693 2244        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
12:12:38.0724 2244        ShellHWDetection - ok
12:12:38.0740 2244        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
12:12:38.0740 2244        SiSRaid2 - ok
12:12:38.0756 2244        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
12:12:38.0771 2244        SiSRaid4 - ok
12:12:38.0787 2244        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
12:12:38.0818 2244        Smb - ok
12:12:38.0849 2244        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
12:12:38.0849 2244        SNMPTRAP - ok
12:12:38.0880 2244        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
12:12:38.0880 2244        spldr - ok
12:12:38.0912 2244        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
12:12:38.0927 2244        Spooler - ok
12:12:39.0021 2244        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
12:12:39.0099 2244        sppsvc - ok
12:12:39.0177 2244        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
12:12:39.0239 2244        sppuinotify - ok
12:12:39.0239 2244        sptd - ok
12:12:39.0317 2244        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
12:12:39.0364 2244        srv - ok
12:12:39.0380 2244        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
12:12:39.0411 2244        srv2 - ok
12:12:39.0426 2244        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
12:12:39.0442 2244        srvnet - ok
12:12:39.0473 2244        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
12:12:39.0520 2244        SSDPSRV - ok
12:12:39.0536 2244        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
12:12:39.0551 2244        SstpSvc - ok
12:12:39.0629 2244        StarWindServiceAE (b1691af4a072cb674d600db16dd7308e) C:\Program Files (x86)\Alcohol Soft\Alcohol 120\StarWind\StarWindServiceAE.exe
12:12:39.0660 2244        StarWindServiceAE ( UnsignedFile.Multi.Generic ) - warning
12:12:39.0660 2244        StarWindServiceAE - detected UnsignedFile.Multi.Generic (1)
12:12:39.0676 2244        Steam Client Service - ok
12:12:39.0707 2244        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
12:12:39.0723 2244        stexstor - ok
12:12:39.0754 2244        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
12:12:39.0785 2244        stisvc - ok
12:12:39.0801 2244        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
12:12:39.0801 2244        swenum - ok
12:12:39.0832 2244        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
12:12:39.0863 2244        swprv - ok
12:12:39.0910 2244        SXDS10          (cd77fd9b0071d2f36b14cc23dde1aad0) C:\Program Files (x86)\Common Files\soft Xpansion\sxds10.exe
12:12:39.0941 2244        SXDS10 ( UnsignedFile.Multi.Generic ) - warning
12:12:39.0941 2244        SXDS10 - detected UnsignedFile.Multi.Generic (1)
12:12:40.0004 2244        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
12:12:40.0050 2244        SysMain - ok
12:12:40.0128 2244        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
12:12:40.0191 2244        TabletInputService - ok
12:12:40.0206 2244        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
12:12:40.0253 2244        TapiSrv - ok
12:12:40.0253 2244        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
12:12:40.0284 2244        TBS - ok
12:12:40.0394 2244        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
12:12:40.0425 2244        Tcpip - ok
12:12:40.0503 2244        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
12:12:40.0518 2244        TCPIP6 - ok
12:12:40.0565 2244        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
12:12:40.0628 2244        tcpipreg - ok
12:12:40.0643 2244        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
12:12:40.0659 2244        TDPIPE - ok
12:12:40.0674 2244        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
12:12:40.0706 2244        TDTCP - ok
12:12:40.0721 2244        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
12:12:40.0752 2244        tdx - ok
12:12:40.0768 2244        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
12:12:40.0768 2244        TermDD - ok
12:12:40.0815 2244        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
12:12:40.0877 2244        TermService - ok
12:12:40.0893 2244        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
12:12:40.0908 2244        Themes - ok
12:12:40.0924 2244        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
12:12:40.0940 2244        THREADORDER - ok
12:12:40.0971 2244        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
12:12:41.0033 2244        TrkWks - ok
12:12:41.0080 2244        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
12:12:41.0111 2244        TrustedInstaller - ok
12:12:41.0142 2244        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
12:12:41.0174 2244        tssecsrv - ok
12:12:41.0236 2244        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
12:12:41.0267 2244        TsUsbFlt - ok
12:12:41.0314 2244        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
12:12:41.0376 2244        tunnel - ok
12:12:41.0376 2244        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
12:12:41.0392 2244        uagp35 - ok
12:12:41.0408 2244        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
12:12:41.0454 2244        udfs - ok
12:12:41.0454 2244        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
12:12:41.0470 2244        UI0Detect - ok
12:12:41.0486 2244        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
12:12:41.0501 2244        uliagpkx - ok
12:12:41.0517 2244        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\DRIVERS\umbus.sys
12:12:41.0517 2244        umbus - ok
12:12:41.0548 2244        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
12:12:41.0548 2244        UmPass - ok
12:12:41.0579 2244        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
12:12:41.0610 2244        upnphost - ok
12:12:41.0642 2244        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
12:12:41.0673 2244        usbccgp - ok
12:12:41.0704 2244        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
12:12:41.0720 2244        usbcir - ok
12:12:41.0735 2244        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
12:12:41.0751 2244        usbehci - ok
12:12:41.0782 2244        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
12:12:41.0798 2244        usbhub - ok
12:12:41.0813 2244        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\DRIVERS\usbohci.sys
12:12:41.0829 2244        usbohci - ok
12:12:41.0844 2244        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
12:12:41.0876 2244        usbprint - ok
12:12:41.0891 2244        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
12:12:41.0907 2244        USBSTOR - ok
12:12:41.0922 2244        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\drivers\usbuhci.sys
12:12:41.0938 2244        usbuhci - ok
12:12:41.0969 2244        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
12:12:42.0000 2244        UxSms - ok
12:12:42.0016 2244        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
12:12:42.0016 2244        VaultSvc - ok
12:12:42.0032 2244        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
12:12:42.0032 2244        vdrvroot - ok
12:12:42.0078 2244        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
12:12:42.0125 2244        vds - ok
12:12:42.0141 2244        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
12:12:42.0141 2244        vga - ok
12:12:42.0156 2244        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
12:12:42.0188 2244        VgaSave - ok
12:12:42.0203 2244        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
12:12:42.0203 2244        vhdmp - ok
12:12:42.0234 2244        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
12:12:42.0234 2244        viaide - ok
12:12:42.0250 2244        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
12:12:42.0266 2244        volmgr - ok
12:12:42.0281 2244        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
12:12:42.0297 2244        volmgrx - ok
12:12:42.0312 2244        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
12:12:42.0312 2244        volsnap - ok
12:12:42.0344 2244        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
12:12:42.0344 2244        vsmraid - ok
12:12:42.0390 2244        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
12:12:42.0453 2244        VSS - ok
12:12:42.0531 2244        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
12:12:42.0578 2244        vwifibus - ok
12:12:42.0609 2244        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
12:12:42.0640 2244        W32Time - ok
12:12:42.0656 2244        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
12:12:42.0671 2244        WacomPen - ok
12:12:42.0702 2244        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
12:12:42.0734 2244        WANARP - ok
12:12:42.0734 2244        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
12:12:42.0749 2244        Wanarpv6 - ok
12:12:42.0796 2244        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
12:12:42.0843 2244        wbengine - ok
12:12:42.0874 2244        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
12:12:42.0890 2244        WbioSrvc - ok
12:12:42.0921 2244        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
12:12:42.0952 2244        wcncsvc - ok
12:12:42.0952 2244        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
12:12:42.0968 2244        WcsPlugInService - ok
12:12:42.0983 2244        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
12:12:42.0983 2244        Wd - ok
12:12:43.0014 2244        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
12:12:43.0030 2244        Wdf01000 - ok
12:12:43.0046 2244        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
12:12:43.0124 2244        WdiServiceHost - ok
12:12:43.0124 2244        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
12:12:43.0139 2244        WdiSystemHost - ok
12:12:43.0170 2244        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
12:12:43.0186 2244        WebClient - ok
12:12:43.0202 2244        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
12:12:43.0233 2244        Wecsvc - ok
12:12:43.0248 2244        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
12:12:43.0280 2244        wercplsupport - ok
12:12:43.0295 2244        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
12:12:43.0326 2244        WerSvc - ok
12:12:43.0342 2244        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
12:12:43.0358 2244        WfpLwf - ok
12:12:43.0373 2244        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
12:12:43.0389 2244        WIMMount - ok
12:12:43.0420 2244        WinDefend - ok
12:12:43.0420 2244        WinHttpAutoProxySvc - ok
12:12:43.0482 2244        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
12:12:43.0545 2244        Winmgmt - ok
12:12:43.0607 2244        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
12:12:43.0670 2244        WinRM - ok
12:12:43.0763 2244        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
12:12:43.0810 2244        WinUsb - ok
12:12:43.0841 2244        WireHelpSvc    (ee5619c43cb3940a4471bd7596b04b7a) C:\Program Files\Common Files\WireHelpSvc.exe
12:12:43.0872 2244        WireHelpSvc - ok
12:12:43.0919 2244        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
12:12:43.0966 2244        Wlansvc - ok
12:12:44.0091 2244        wlidsvc        (98f138897ef4246381d197cb81846d62) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
12:12:44.0122 2244        wlidsvc - ok
12:12:44.0169 2244        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
12:12:44.0200 2244        WmiAcpi - ok
12:12:44.0216 2244        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
12:12:44.0231 2244        wmiApSrv - ok
12:12:44.0278 2244        WMPNetworkSvc - ok
12:12:44.0278 2244        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
12:12:44.0309 2244        WPCSvc - ok
12:12:44.0325 2244        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
12:12:44.0340 2244        WPDBusEnum - ok
12:12:44.0356 2244        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
12:12:44.0403 2244        ws2ifsl - ok
12:12:44.0418 2244        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
12:12:44.0450 2244        wscsvc - ok
12:12:44.0450 2244        WSearch - ok
12:12:44.0871 2244        wuauserv        (9df12edbc698b0bc353b3ef84861e430) C:\Windows\system32\wuaueng.dll
12:12:44.0933 2244        wuauserv - ok
12:12:45.0105 2244        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
12:12:45.0136 2244        WudfPf - ok
12:12:45.0152 2244        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
12:12:45.0183 2244        WUDFRd - ok
12:12:45.0198 2244        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
12:12:45.0230 2244        wudfsvc - ok
12:12:45.0261 2244        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
12:12:45.0292 2244        WwanSvc - ok
12:12:45.0308 2244        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
12:12:45.0542 2244        \Device\Harddisk0\DR0 - ok
12:12:45.0557 2244        Boot (0x1200)  (50cc141ee6d99438f7d50bf0fdef701a) \Device\Harddisk0\DR0\Partition0
12:12:45.0557 2244        \Device\Harddisk0\DR0\Partition0 - ok
12:12:45.0557 2244        Boot (0x1200)  (59c35c354c50020cbcc4260b190c3cb4) \Device\Harddisk0\DR0\Partition1
12:12:45.0557 2244        \Device\Harddisk0\DR0\Partition1 - ok
12:12:45.0588 2244        Boot (0x1200)  (c97277ce74aa3394aae9ad807a0ef2e4) \Device\Harddisk0\DR0\Partition2
12:12:45.0588 2244        \Device\Harddisk0\DR0\Partition2 - ok
12:12:45.0604 2244        Boot (0x1200)  (2580e370136c3241e4af3828ab150ba3) \Device\Harddisk0\DR0\Partition3
12:12:45.0604 2244        \Device\Harddisk0\DR0\Partition3 - ok
12:12:45.0635 2244        Boot (0x1200)  (e2b05270ae8ebee0500239f77471b6ec) \Device\Harddisk0\DR0\Partition4
12:12:45.0635 2244        \Device\Harddisk0\DR0\Partition4 - ok
12:12:45.0635 2244        ============================================================
12:12:45.0635 2244        Scan finished
12:12:45.0635 2244        ============================================================
12:12:45.0635 0772        Detected object count: 2
12:12:45.0635 0772        Actual detected object count: 2
12:12:58.0334 0772        StarWindServiceAE ( UnsignedFile.Multi.Generic ) - skipped by user
12:12:58.0334 0772        StarWindServiceAE ( UnsignedFile.Multi.Generic ) - User select action: Skip
12:12:58.0334 0772        SXDS10 ( UnsignedFile.Multi.Generic ) - skipped by user
12:12:58.0334 0772        SXDS10 ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus 04.06.2012 16:01
Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix
  • Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.
  • Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
    Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.
  • Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.
Wichtiger Hinweis:
Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

Xaduras 04.06.2012 16:50
Hier das Log

Code:
ComboFix 12-06-03.05 - Pascal 04.06.2012  17:42:28.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7601.1.1252.49.1031.18.8190.6357 [GMT 2:00]
ausgeführt von:: c:\users\Pascal\Downloads\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
FW: FireWall *Enabled* {CE40CCC0-8ADB-6D67-25A0-C5B6438E4B57}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
F:\install.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2012-05-04 bis 2012-06-04  ))))))))))))))))))))))))))))))
.
.
2012-06-04 14:50 . 2012-06-04 14:50        8646        ----a-w-        c:\programdata\Microsoft\IdentityCRL\production\temp\wlidui_WLIDSVC\TILEBOX.JS
2012-06-03 19:53 . 2012-06-03 19:53        --------        d-----w-        C:\_OTL
2012-06-01 17:11 . 2012-06-01 17:11        139360        ----a-w-        c:\windows\system32\drivers\avfwot.sys
2012-06-01 17:11 . 2012-06-01 17:11        114128        ----a-w-        c:\windows\system32\drivers\avfwim.sys
2012-06-01 17:09 . 2012-06-01 17:09        --------        d-----w-        c:\users\Pascal\AppData\Roaming\Avira
2012-06-01 17:07 . 2012-06-01 17:07        --------        d-----w-        c:\program files (x86)\Avira
2012-06-01 17:07 . 2012-06-01 17:06        98848        ----a-w-        c:\windows\system32\drivers\avgntflt.sys
2012-06-01 17:07 . 2012-06-01 17:06        27760        ----a-w-        c:\windows\system32\drivers\avkmgr.sys
2012-06-01 17:07 . 2012-06-01 17:06        132832        ----a-w-        c:\windows\system32\drivers\avipbb.sys
2012-06-01 15:45 . 2012-06-01 15:45        --------        d-----w-        c:\program files (x86)\ESET
2012-05-31 21:40 . 2012-05-31 21:40        --------        d-----w-        c:\program files (x86)\Common Files\Java
2012-05-31 21:40 . 2012-05-31 21:40        --------        d-----w-        c:\program files (x86)\Oracle
2012-05-31 21:39 . 2012-04-04 16:47        772504        ----a-w-        c:\windows\SysWow64\npDeployJava1.dll
2012-05-31 14:04 . 2012-05-31 14:04        --------        d-----w-        c:\users\Pascal\AppData\Roaming\Malwarebytes
2012-05-31 14:03 . 2012-05-31 14:03        --------        d-----w-        c:\programdata\Malwarebytes
2012-05-31 10:03 . 2012-05-31 10:12        --------        d-----w-        c:\programdata\SecTaskMan
2012-05-31 09:58 . 2012-05-31 09:58        --------        d-----w-        c:\users\Pascal\AppData\Local\G DATA
2012-05-31 09:51 . 2012-05-31 09:51        --------        d-----w-        c:\users\Pascal\AppData\Roaming\TuneUp Software
2012-05-31 09:50 . 2012-05-31 09:51        --------        d-----w-        c:\programdata\TuneUp Software
2012-05-31 09:50 . 2012-05-31 09:50        --------        d-sh--w-        c:\programdata\{32364CEA-7855-4A3C-B674-53D8E9B97936}
2012-05-31 09:50 . 2012-05-31 09:50        --------        d--h--w-        c:\programdata\Common Files
2012-05-30 08:48 . 2012-05-30 09:46        --------        d-----w-        c:\program files (x86)\Sophos
2012-05-30 08:40 . 2012-06-01 14:27        663197        ----a-w-        c:\windows\SysWow64\sig.bin
2012-05-29 22:00 . 2012-05-29 22:00        106648        ----a-w-        c:\windows\system32\drivers\GRD.sys
2012-05-29 21:58 . 2012-03-29 14:42        10760        ----a-w-        c:\windows\SysWow64\GdScrSv.de.dll
2012-05-29 21:54 . 2012-05-29 21:54        59768        ----a-w-        c:\windows\system32\drivers\PktIcpt.sys
2012-05-29 21:53 . 2012-06-01 17:05        --------        d-----w-        c:\program files (x86)\G Data
2012-05-29 21:53 . 2012-06-01 17:04        --------        d-----w-        c:\programdata\G DATA
2012-05-29 21:49 . 2012-06-01 17:04        --------        d-----w-        c:\users\Pascal\AppData\Local\Downloaded Installations
2012-05-29 21:34 . 2012-05-29 21:34        --------        d-----w-        c:\program files\CCleaner
2012-05-29 13:25 . 2012-05-31 23:16        --------        d-----w-        c:\users\Pascal\AppData\Local\ESL Wire Game Client
2012-05-29 13:25 . 2012-05-29 13:25        --------        d-----w-        c:\programdata\ESL Wire
2012-05-23 19:55 . 2012-05-08 17:02        8955792        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{94269165-A0FA-411B-9044-6696A7204E9D}\mpengine.dll
2012-05-23 19:55 . 2012-03-03 06:35        1544704        ----a-w-        c:\windows\system32\DWrite.dll
2012-05-23 19:55 . 2012-03-03 05:31        1077248        ----a-w-        c:\windows\SysWow64\DWrite.dll
2012-05-23 19:55 . 2012-03-31 06:05        5559664        ----a-w-        c:\windows\system32\ntoskrnl.exe
2012-05-23 19:55 . 2012-03-31 04:39        3968368        ----a-w-        c:\windows\SysWow64\ntkrnlpa.exe
2012-05-23 19:55 . 2012-03-31 04:39        3913072        ----a-w-        c:\windows\SysWow64\ntoskrnl.exe
2012-05-23 19:55 . 2012-03-31 03:10        3146240        ----a-w-        c:\windows\system32\win32k.sys
2012-05-23 19:55 . 2012-03-17 07:58        75120        ----a-w-        c:\windows\system32\drivers\partmgr.sys
2012-05-23 19:54 . 2012-03-30 11:35        1918320        ----a-w-        c:\windows\system32\drivers\tcpip.sys
2012-05-23 19:54 . 2012-03-31 05:42        1732096        ----a-w-        c:\program files\Windows Journal\NBDoc.DLL
2012-05-23 19:54 . 2012-03-31 05:40        1402880        ----a-w-        c:\program files\Windows Journal\JNWDRV.dll
2012-05-23 19:54 . 2012-03-31 05:40        1367552        ----a-w-        c:\program files\Common Files\Microsoft Shared\ink\journal.dll
2012-05-23 19:54 . 2012-03-31 05:40        1393664        ----a-w-        c:\program files\Windows Journal\JNTFiltr.dll
2012-05-23 19:54 . 2012-03-31 04:29        936960        ----a-w-        c:\program files (x86)\Common Files\Microsoft Shared\ink\journal.dll
2012-05-14 10:40 . 2012-05-14 10:40        --------        d-----w-        c:\programdata\Battle.net
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-05 20:02 . 2012-03-31 09:33        419488        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2012-05-05 20:02 . 2011-11-23 14:34        70304        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
2012-05-02 13:39 . 2012-01-18 18:59        168864        ----a-w-        c:\program files\Common Files\WireHelpSvc.exe
2012-05-02 13:39 . 2012-01-18 18:59        147472        ----a-w-        c:\windows\system32\drivers\ESLWireACD.sys
2012-04-04 16:47 . 2011-12-29 17:25        687504        ----a-w-        c:\windows\SysWow64\deployJava1.dll
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"StartCCC"="c:\program files (x86)\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe" [2011-10-25 343168]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-01-17 252296]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-06-01 348624]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
Logitech SetPoint.lnk - c:\program files\Logitech\SetPoint\SetPoint.exe [2011-11-23 1148944]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\drivers32]
"aux1"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\system\currentcontrolset\control\lsa]
Security Packages        REG_MULTI_SZ          kerberos msv1_0 schannel wdigest tspkg pku2u livessp
.
R1 gdwfpcd;G Data WFP CD;c:\windows\system32\drivers\gdwfpcd64.sys [x]
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R3 DAUpdaterSvc;Dragon Age: Origins - Inhaltsupdater;d:\spiele\Dragon Age\bin_ship\DAUpdaterSvc.Service.exe [2009-07-26 25832]
R3 ESLvnic1;ESLvnic Virtual Network 64 Bit;c:\windows\system32\DRIVERS\ESLvnic.sys [x]
R3 MEMSWEEP2;MEMSWEEP2;c:\windows\system32\BB44.tmp [x]
R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-05-04 129976]
R3 SXDS10;soft Xpansion Dispatch Service;c:\program files (x86)\Common Files\soft Xpansion\sxds10.exe \Service [x]
R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [x]
R4 sptd;sptd;c:\windows\\SystemRoot\System32\Drivers\sptd.sys [x]
S1 avfwot;avfwot;c:\windows\system32\DRIVERS\avfwot.sys [x]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [x]
S2 AMD External Events Utility;AMD External Events Utility;c:\windows\system32\atiesrxx.exe [x]
S2 AMD FUEL Service;AMD FUEL Service;c:\program files\ATI Technologies\ATI.ACE\Fuel\Fuel.Service.exe [2011-10-25 361984]
S2 AntiVirFirewallService;Avira FireWall;c:\program files (x86)\Avira\AntiVir Desktop\avfwsvc.exe [2012-06-01 619472]
S2 AntiVirMailService;Avira Email Schutz;c:\program files (x86)\Avira\AntiVir Desktop\avmailc.exe [2012-06-01 375760]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-06-01 86224]
S2 AntiVirWebService;Avira Browser Schutz;c:\program files (x86)\Avira\AntiVir Desktop\AVWEBGRD.EXE [2012-06-01 465360]
S2 AODDriver4.01;AODDriver4.01;c:\program files\ATI Technologies\ATI.ACE\Fuel\amd64\AODDriver2.sys [2011-06-24 55424]
S2 DevoloNetworkService;devolo Network Service;c:\program files (x86)\devolo\dlan\devolonetsvc.exe [2010-12-23 3304768]
S2 ESLWireAC;ESLWireAC;c:\windows\system32\drivers\ESLWireACD.sys [x]
S2 NPF_devolo;NetGroup Packet Filter Driver (devolo);c:\windows\sysWOW64\drivers\npf_devolo.sys [2010-06-10 34048]
S2 WireHelpSvc;WireHelpSvc;c:\program files\Common Files\WireHelpSvc.exe [2012-05-02 168864]
S3 amdiox64;AMD IO Driver;c:\windows\system32\DRIVERS\amdiox64.sys [x]
S3 amdkmdag;amdkmdag;c:\windows\system32\DRIVERS\atikmdag.sys [x]
S3 amdkmdap;amdkmdap;c:\windows\system32\DRIVERS\atikmpag.sys [x]
S3 avfwim;AvFw Packet Filter Miniport;c:\windows\system32\DRIVERS\avfwim.sys [x]
S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [x]
.
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2009-01-20 6963744]
"Skytel"="c:\program files\Realtek\Audio\HDA\Skytel.exe" [2009-01-20 1833504]
"Kernel and Hardware Abstraction Layer"="KHALMNPR.EXE" [2007-09-21 134160]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"LoadAppInit_DLLs"=0x0
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page =
mLocal Page =
LSP: c:\program files (x86)\Avira\AntiVir Desktop\avsda.dll
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\Pascal\AppData\Roaming\Mozilla\Firefox\Profiles\ech13afx.default\
.
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\services\MEMSWEEP2]
"ImagePath"="\??\c:\windows\system32\BB44.tmp"
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\S-1-5-21-503904159-1529643387-3823001629-1001\Software\SecuROM\License information*]
"datasecu"=hex:f2,7f,56,d4,12,e4,0e,39,25,e8,55,f9,64,9a,ec,09,16,49,66,6e,79,
  b0,80,d8,12,06,d7,99,38,45,ab,52,8f,3d,2f,23,eb,c7,73,95,ea,b1,65,16,bc,e7,\
"rkeysecu"=hex:04,ee,e0,ec,4f,fb,2a,f8,af,94,75,11,b5,d5,ff,cf
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2012-06-04  17:47:02
ComboFix-quarantined-files.txt  2012-06-04 15:47
.
Vor Suchlauf: 9 Verzeichnis(se), 120.825.999.360 Bytes frei
Nach Suchlauf: 14 Verzeichnis(se), 120.468.754.432 Bytes frei
.
- - End Of File - - 43739485876F213C37F82DC514C45774
Ich hatte die Firewall ausgestellt (musste sie auch wieder aktivieren).

cosinus 04.06.2012 20:21
Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!
  • Starte die aswMBR.exe Vista und Win7 User aswMBR per Rechtsklick "als Administrator ausführen"
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen) Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort. Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit.

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

Xaduras 04.06.2012 20:50
Soweit nochmal danke.

Hier das Log:

Code:
aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-06-04 21:41:26
-----------------------------
21:41:26.809    OS Version: Windows x64 6.1.7601 Service Pack 1
21:41:26.809    Number of processors: 4 586 0x402
21:41:26.809    ComputerName: PASCAL-PC  UserName: Pascal
21:41:27.214    Initialize success
21:42:45.397    AVAST engine defs: 12060401
21:42:50.233    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP3T0L0-3
21:42:50.233    Disk 0 Vendor: SAMSUNG_HD103SJ 1AJ100E4 Size: 953869MB BusType: 3
21:42:50.248    Disk 0 MBR read successfully
21:42:50.248    Disk 0 MBR scan
21:42:50.264    Disk 0 Windows 7 default MBR code
21:42:50.264    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS      200000 MB offset 63
21:42:50.279    Disk 0 Partition - 00    0F Extended LBA            753858 MB offset 409600800
21:42:50.295    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      200000 MB offset 409600863
21:42:50.295    Disk 0 Partition - 00    05    Extended            200000 MB offset 819201600
21:42:50.311    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS      200000 MB offset 819201663
21:42:50.311    Disk 0 Partition - 00    05    Extended            200000 MB offset 1638403200
21:42:50.342    Disk 0 Partition 4 00    07    HPFS/NTFS NTFS      200000 MB offset 1228802463
21:42:50.342    Disk 0 Partition - 00    05    Extended            153857 MB offset 2457604800
21:42:50.357    Disk 0 Partition 5 00    07    HPFS/NTFS NTFS      153857 MB offset 1638403263
21:42:50.389    Disk 0 scanning C:\Windows\system32\drivers
21:42:57.034    Service scanning
21:43:12.213    Modules scanning
21:43:12.213    Disk 0 trace - called modules:
21:43:12.244    ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys ataport.SYS pciide.sys PCIIDEX.SYS hal.dll atapi.sys
21:43:12.244    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8007abf060]
21:43:12.244    3 CLASSPNP.SYS[fffff880019b643f] -> nt!IofCallDriver -> [0xfffffa8006b0f520]
21:43:12.260    5 ACPI.sys[fffff88000f7a7a1] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP3T0L0-3[0xfffffa8006b0b060]
21:43:12.603    AVAST engine scan C:\Windows
21:43:14.413    AVAST engine scan C:\Windows\system32
21:45:24.882    AVAST engine scan C:\Windows\system32\drivers
21:45:42.477    AVAST engine scan C:\Users\Pascal
21:46:23.887    AVAST engine scan C:\ProgramData
21:47:47.211    Scan finished successfully
21:48:44.700    Disk 0 MBR has been saved successfully to "C:\Users\Pascal\Desktop\MBR.dat"
21:48:44.704    The log file has been saved successfully to "C:\Users\Pascal\Desktop\aswMBR.txt"

cosinus 04.06.2012 21:31
Sieht ok aus. Wir sollten fast durch sein. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SASW und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

Xaduras 05.06.2012 00:51
Das hört sich doch schonmal gut an. Danke soweit.


Hier die Logs

AntiSpyware:

Code:
SUPERAntiSpyware Scan Log
hxxp://www.superantispyware.com

Generated 06/05/2012 at 01:49 AM

Application Version : 5.0.1150

Core Rules Database Version : 8680
Trace Rules Database Version: 6492

Scan type      : Complete Scan
Total Scan Time : 01:18:51

Operating System Information
Windows 7 Home Premium 64-bit, Service Pack 1 (Build 6.01.7601)
UAC On - Limited User

Memory items scanned      : 734
Memory threats detected  : 0
Registry items scanned    : 64361
Registry threats detected : 0
File items scanned        : 169510
File threats detected    : 11

Adware.Tracking Cookie
        statse.webtrendslive.com [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        de.sitestat.com [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        .imrworldwide.com [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        www.etracker.de [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        .xiti.com [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        .divx.112.2o7.net [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        .statcounter.com [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        stats.computecmedia.de [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
        .serving-sys.com [ C:\USERS\PASCAL\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\ECH13AFX.DEFAULT\COOKIES.SQLITE ]
Malwarebytes

Code:
Malwarebytes Anti-Malware (Test) 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.04.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 8.0.7601.17514
Pascal :: PASCAL-PC [Administrator]

Schutz: Deaktiviert

04.06.2012 23:58:18
mbam-log-2012-06-04 (23-58-18).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 360404
Laufzeit: 26 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
Malware

cosinus 05.06.2012 10:19
Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )


Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

Xaduras 05.06.2012 14:47
Ich werde von nun an den Cookie-Culler benutzen. Die Benutzung sieht jedenfalls einfach aus.

Weitere Funde bzw. Probleme habe ich keine mehr.

Ich danke Ihnen vielmals für Ihre Hilfe und Hinweise.

cosinus 05.06.2012 15:57
Dann wären wir durch! :abklatsch:

Die Programme, die hier zum Einsatz kamen, können alle wieder runter. CF kann über Start, Ausführen mit combofix /uninstall entfernt werden. Melde dich falls es da Fehlermeldungen zu gibt. Mit Hilfe von OTL kannst du auch viele Tools entfernen:

Starte bitte OTL und klicke auf Bereinigung.
Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen.


Malwarebytes zu behalten ist zu empfehlen. Kannst ja 1x im Monat damit einen Vollscan machen, aber immer vorher ans Update denken.


Bitte abschließend die Updates prüfen, unten mein Leitfaden dazu. Um in Zukunft die Aktualität der installierten Programme besser im Überblick zu halten, kannst du zB Secunia PSI verwenden.
Für noch mehr Sicherheit solltest Du nach der beseitigten Infektion auch möglichst alle Passwörter ändern.


Microsoftupdate

Windows XP: Besuch mit dem IE die MS-Updateseite und lass Dir alle wichtigen Updates installieren.

Windows Vista/7: Anleitung Windows-Update


PDF-Reader aktualisieren
Ein veralteter AdobeReader stellt ein großes Sicherheitsrisiko dar. Du solltest daher besser alte Versionen vom AdobeReader über Systemsteuerung => Software bzw. Programme und Funktionen deinstallieren, indem Du dort auf "Adobe Reader x.0" klickst und das Programm entfernst. (falls du AdobeReader installiert hast)

Ich empfehle einen alternativen PDF-Reader wie PDF Xchange Viewer, SumatraPDF oder Foxit PDF Reader, die sind sehr viel schlanker und flotter als der AdobeReader.

Bitte überprüf bei der Gelegenheit auch die Aktualität des Flashplayers:

Adobe - Andere Version des Adobe Flash Player installieren

Notfalls kann man auch von Chip.de runterladen => http://filepony.de/?q=Flash+Player

Natürlich auch darauf achten, dass andere installierte Browser wie zB Firefox, Opera oder Chrome aktuell sind.


Java-Update
Veraltete Java-Installationen sind ein Sicherheitsrisiko, daher solltest Du die alten Versionen löschen (falls vorhanden, am besten mit JavaRa) und auf die neuste aktualisieren. Beende dazu alle Programme (v.a. die Browser), klick danach auf Start, Systemsteuerung, Software und deinstalliere darüber alle aufgelisteten Java-Versionen. Lad Dir danach von hier das aktuelle Java SE Runtime Environment (JRE) herunter und installiere es.

Xaduras 06.06.2012 17:03
Habe jetzt soweit mit Hilfe von Seciuna alles soweit aktualisiert.

Ich denke mal dank Ihnen bin ich soweit nun gut geschützt.

Nochmals vielen Dank.


Alle Zeitangaben in WEZ +1. Es ist jetzt 17:56 Uhr.
Seite 2 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131