Trojaner-Board

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   ständiger Systemabsturz Win 7 home premium, 32 Bit (https://www.trojaner-board.de/117508-staendiger-systemabsturz-win-7-home-premium-32-bit.html)

vivacitas83 17.06.2012 19:28
ständiger Systemabsturz Win 7 home premium, 32 Bit
 
Hallo!

Leider habe ich seit Tagen mit einem ungebetenen Gast zu tun...offensichtlich. Antispyware findet ne unerlaubte .exe Datei...will man sie löschen, Sysemabsturz! Avira wird gestoppt oder macht man eine Sysscan...Systemabsturz :(

Hier das benötigte:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.17.06

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Sandra :: SANDRA-NOTEBOOK [Administrator]

17.06.2012 20:13:17
mbam-log-2012-06-17 (20-13-17).txt

Art des Suchlaufs: Quick-Scan
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 213382
Laufzeit: 7 Minute(n), 11 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)


DANKE!!! Ich habe Angst, dass er aufeinmal gar nimmer angeht :(

LG, sandra

ich weiss...da seht alles ok, aber das stimmt definitiv nicht :(

HELO

cosinus 19.06.2012 11:01
Zitat:
Antispyware findet ne unerlaubte .exe Datei..
Geht das auch etwas konkreter?!
Was soll eine unerlaubte EXE Datei sein?
Komplettere Dateiname?

vivacitas83 26.06.2012 22:22
Hallo und Verzeihung,

war im KH.

Hier das vollständige log:

Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.06.26.08

Windows 7 Service Pack 1 x86 NTFS
Internet Explorer 9.0.8112.16421
Sandra :: SANDRA-NOTEBOOK [Administrator]

26.06.2012 21:51:53
mbam-log-2012-06-26 (21-51-53).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 345146
Laufzeit: 1 Stunde(n), 18 Minute(n), 36 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)

Es passiert immer wieder :( nun sogar mal öfters hintereinander!

Dank Euch

cosinus 27.06.2012 12:56
Schön, dass du so detailiert auf meine Frage eingegangen bist http://cosgan.de/images/midi/boese/a040.gif

Zitat:
Es passiert immer wieder nun sogar mal öfters hintereinander!
Ja bei mir passiert so auch einiges aber was verrat ich nicht. Nun hilf mir bitte!! :( :blabla:

vivacitas83 27.06.2012 21:39
Liste der Anhänge anzeigen (Anzahl: 1)
Hej cosinus,

Tut mir echt leid, aber hab den "Auftrag" bekommen das ganze log zu posten und dachte das mach ich mal schnell bevor nix mehr geht. Als ich erneut versuchte nach dieser Datei zu suchen, stürtzte er immer wieder ab :O

Leider steht da auch nix nützliches bei dem programm. Hab Dir ein Screenshot gemacht. Glaub aber nicht, dass das was bringt, denn da steht auch nur .exe :pfui:

cosinus 28.06.2012 13:20
Das meintest du mit "unerlaubte .exe Datei" :dummguck: :confused:

vivacitas83 28.06.2012 14:48
Öhm...ja, da das Porgramm es als Malware titulierte :/

Vermutlich lieg ich sowieso falsch, aber ich weiß nicht warum es andauernd abstürzt.:killpc:

cosinus 29.06.2012 10:46
Führ bitte auch ESET aus, danach sehen wir weiter.

Hinweis: ESET zeigt durchaus öfter ein paar Fehlalarme. Deswegen soll auch von ESET immer nur erst das Log gepostet und nichts entfernt werden.

ESET Online Scanner
Bitte während der Online-Scans evtl. vorhandene externe Festplatten einschalten! Bitte während der Scans alle Hintergrundwächter (Anti-Virus-Programm, Firewall, Skriptblocking und ähnliches) abstellen und nicht vergessen, alles hinterher wieder einzuschalten.
  • Anmerkung für Vista und Win7 User: Bitte den Browser unbedingt so öffnen: per Rechtsklick => als Administrator ausführen
  • Dein Anti-Virus-Programm während des Scans deaktivieren.

    Button http://img695.imageshack.us/img695/1599/eset1l.jpg (<< klick) drücken.
    • Firefox-User:
      Bitte esetsmartinstaller_enu.exe downloaden.Das Firefox-Addon auf dem Desktop speichern und dann installieren.
    • IE-User:
      müssen das Installieren eines ActiveX Elements erlauben.
  • Setze den einen Haken bei Yes, i accept the Terms of Use.
  • Drücke den http://img707.imageshack.us/img707/687/starteg.jpg Button.
  • Warte bis die Komponenten herunter geladen wurden.
  • Setze einen Haken bei "Scan archives".
  • Gehe sicher das bei Remove Found Threats kein Hacken gesetzt ist.
  • http://img707.imageshack.us/img707/687/starteg.jpg drücken.
  • Die Signaturen werden herunter geladen.Der Scan beginnt automatisch.
Wenn der Scan beendet wurde
  • Klicke Finish.
  • Browser schließen.
Drücke bitte die http://larusso.trojaner-board.de/Images/windows.jpg + R Taste und kopiere folgenden Text in das Ausführen Fenster.
Code:
"%PROGRAMFILES%\Eset\Eset Online Scanner\log.txt"
Hinweis: Falls du ein 64-Bit-Windows einsetzt, lautet der Pfad so:

Code:
"%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\log.txt"
Poste nun den Inhalt der log.txt.

vivacitas83 30.06.2012 08:40
HAllo!

Ok, es hat 3(!) Anläufe gebraucht, weil er 2x während dem scannen abgestürzt ist!

Hier das log:

ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=ad9878d324a78f4e8ba15028fc133dfd
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-06-29 10:58:58
# local_time=2012-06-30 12:58:58 (+0100, Mitteleuropäische Sommerzeit)
# country="Austria"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1797 16775165 100 94 15791 77536622 15458 0
# compatibility_mode=5893 16776574 100 94 2256497 92630992 0 0
# compatibility_mode=8192 67108863 100 0 25481 25481 0 0
# scanned=132929
# found=7
# cleaned=0
# scan_time=10940
C:\Users\Sandra\AppData\Local\GamePlayLabs Plugin\gplplugin.xpi Win32/Adware.GamePlayLabs application (unable to clean) 00000000000000000000000000000000 I
C:\Users\Sandra\AppData\Roaming\Mozilla\Firefox\Profiles\t2xu63eu.default\extensions\plugin2@gameplaylabs.com\chrome\content\overlay.js Win32/Adware.GamePlayLabs application (unable to clean) 00000000000000000000000000000000 I
D:\SANDRA-NOTEBOOK\Backup Set 2011-04-17 200103\Backup Files 2011-04-17 200103\Backup files 1.zip Win32/Adware.GamePlayLabs application (unable to clean) 00000000000000000000000000000000 I
D:\SANDRA-NOTEBOOK\Backup Set 2011-12-11 190002\Backup Files 2011-12-11 190002\Backup files 1.zip Win32/Adware.GamePlayLabs application (unable to clean) 00000000000000000000000000000000 I
D:\SANDRA-NOTEBOOK\Backup Set 2011-12-11 190002\Backup Files 2012-03-18 211500\Backup files 1.zip HTML/Iframe.B.Gen virus (unable to clean) 00000000000000000000000000000000 I
D:\SANDRA-NOTEBOOK\Backup Set 2012-04-08 201038\Backup Files 2012-04-08 201038\Backup files 1.zip Win32/Adware.GamePlayLabs application (unable to clean) 00000000000000000000000000000000 I
D:\SANDRA-NOTEBOOK\Backup Set 2012-06-17 190005\Backup Files 2012-06-17 190005\Backup files 1.zip Win32/Adware.GamePlayLabs application (unable to clean) 00000000000000000000000000000000 I

Ich hoffe es nüzt was :/

Danke!!!

cosinus 01.07.2012 15:25
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

vivacitas83 02.07.2012 11:28
hoffe das ist nun so richtig (und nützlich) :

Code:
OTL logfile created on: 7/2/2012 11:29:11 AM - Run 1
OTL by OldTimer - Version 3.2.53.1    Folder = C:\Users\Sandra\Downloads
 Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000409 | Country: Österreich | Language: DEA | Date Format: dd.MM.yyyy
 
3.36 Gb Total Physical Memory | 2.46 Gb Available Physical Memory | 73.01% Memory free
6.73 Gb Paging File | 5.37 Gb Available in Paging File | 79.80% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\windows | %ProgramFiles% = C:\Program Files
Drive C: | 151.00 Gb Total Space | 75.39 Gb Free Space | 49.93% Space Free | Partition Type: NTFS
Drive D: | 294.66 Gb Total Space | 0.00 Gb Free Space | 0.00% Space Free | Partition Type: NTFS
 
Computer Name: SANDRA-NOTEBOOK | User Name: Sandra | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012/07/02 10:31:59 | 000,595,968 | ---- | M] (OldTimer Tools) -- C:\Users\Sandra\Downloads\OTL.exe
PRC - [2012/06/03 19:15:21 | 003,905,920 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SUPERANTISPYWARE.EXE
PRC - [2012/05/03 18:37:54 | 001,226,096 | ---- | M] (Lavasoft Limited) -- C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
PRC - [2012/05/03 18:37:50 | 020,221,792 | ---- | M] (Lavasoft Limited) -- C:\PROGRA~1\AD-AWA~1\AdAware.exe
PRC - [2011/12/19 13:20:06 | 003,289,032 | ---- | M] (GFI Software) -- C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe
PRC - [2011/10/21 11:09:36 | 000,198,032 | ---- | M] (Lavasoft) -- C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe
PRC - [2011/10/01 09:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
PRC - [2011/10/01 09:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
PRC - [2011/08/12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
PRC - [2011/07/10 10:34:50 | 000,269,480 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe
PRC - [2011/06/24 06:22:20 | 000,271,360 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\conhost.exe
PRC - [2011/05/11 20:30:00 | 004,999,976 | ---- | M] (Synaptics Incorporated) -- C:\Program Files\Synaptics\Scrybe\scrybe.exe
PRC - [2011/05/11 20:30:00 | 001,300,264 | ---- | M] (Synaptics, Inc.) -- C:\Program Files\Synaptics\Scrybe\Service\ScrybeUpdater.exe
PRC - [2011/04/30 03:51:36 | 000,136,360 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe
PRC - [2011/02/25 07:30:54 | 002,616,320 | ---- | M] (Microsoft Corporation) -- C:\Windows\explorer.exe
PRC - [2011/01/21 19:05:02 | 000,064,512 | ---- | M] (Nalpeiron Ltd.) -- C:\Windows\System32\nlssrv32.exe
PRC - [2011/01/10 15:22:55 | 000,281,768 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avgnt.exe
PRC - [2010/11/20 14:17:47 | 000,049,152 | ---- | M] (Microsoft Corporation) -- C:\Windows\System32\taskhost.exe
PRC - [2010/07/04 20:07:40 | 000,238,952 | ---- | M] (Teruten) -- C:\Windows\System32\FsUsbExService.Exe
PRC - [2010/05/06 08:44:44 | 001,749,504 | ---- | M] (SAMSUNG Electronics) -- C:\Program Files\Samsung\Samsung Support Center\SSCKbdHk.exe
PRC - [2010/04/16 18:56:44 | 000,644,384 | ---- | M] (Broadcom Corporation.) -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
PRC - [2010/04/07 15:40:06 | 000,843,264 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\Samsung\Easy Display Manager\dmhkcore.exe
PRC - [2010/02/10 16:29:52 | 000,719,360 | ---- | M] (Samsung Electronics Co., Ltd.) -- C:\Program Files\SAMSUNG\EasySpeedUpManager\EasySpeedUpManager.exe
PRC - [2010/01/19 04:34:48 | 002,201,192 | ---- | M] (SEC) -- C:\Program Files\Samsung\Samsung Recovery Solution 4\WCScheduler.exe
PRC - [2010/01/14 22:10:53 | 000,076,968 | ---- | M] (Avira GmbH) -- C:\Program Files\Avira\AntiVir Desktop\avshadow.exe
PRC - [2009/12/31 14:13:52 | 000,110,592 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Sandra\AppData\Roaming\T-Mobile Internet Manager\ouc.exe
PRC - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () -- C:\Windows\System32\Rezip.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012/07/01 21:37:35 | 000,065,024 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10006.dll
MOD - [2012/07/01 21:37:35 | 000,052,736 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10007.dll
MOD - [2011/10/11 22:00:31 | 000,117,760 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\UIREPAIR.DLL
MOD - [2011/10/11 22:00:31 | 000,052,224 | ---- | M] () -- C:\ProgramData\SUPERAntiSpyware.com\SUPERAntiSpyware\SDDLLS\SD10005.dll
MOD - [2011/03/31 19:31:02 | 000,066,856 | ---- | M] () -- C:\Program Files\Synaptics\SynTP\SynTPEnhPS.dll
MOD - [2006/08/12 05:48:40 | 000,049,152 | ---- | M] () -- C:\Program Files\Samsung\Easy Display Manager\HookDllPS2.dll
 
 
========== Win32 Services (SafeList) ==========
 
SRV - [2012/06/17 19:26:19 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012/05/03 18:37:54 | 001,226,096 | ---- | M] (Lavasoft Limited) [Auto | Running] -- C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe -- (Ad-Aware Service)
SRV - [2012/02/29 08:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2011/12/19 13:20:06 | 003,289,032 | ---- | M] (GFI Software) [Auto | Stopped] -- C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe -- (SBAMSvc)
SRV - [2011/12/15 19:29:42 | 000,014,848 | ---- | M] () [On_Demand | Stopped] -- C:\Program Files\OpenVPN\bin\openvpnserv.exe -- (OpenVPNService)
SRV - [2011/10/01 09:30:42 | 000,219,496 | ---- | M] (Microsoft Corporation) [On_Demand | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe -- (sftvsa)
SRV - [2011/10/01 09:30:36 | 000,508,776 | ---- | M] (Microsoft Corporation) [Auto | Running] -- C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe -- (sftlist)
SRV - [2011/08/12 01:38:07 | 000,116,608 | ---- | M] (SUPERAntiSpyware.com) [Auto | Running] -- C:\Program Files\SUPERAntiSpyware\SASCORE.EXE -- (!SASCORE)
SRV - [2011/07/10 10:34:50 | 000,269,480 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2011/05/11 20:30:00 | 001,300,264 | ---- | M] (Synaptics, Inc.) [Auto | Running] -- C:\Program Files\Synaptics\Scrybe\Service\ScrybeUpdater.exe -- (ScrybeUpdater)
SRV - [2011/04/30 03:51:36 | 000,136,360 | ---- | M] (Avira GmbH) [Auto | Running] -- C:\Program Files\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2011/02/23 21:50:44 | 001,343,400 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\Wat\WatAdminSvc.exe -- (WatAdminSvc)
SRV - [2011/01/21 19:05:02 | 000,064,512 | ---- | M] (Nalpeiron Ltd.) [Auto | Running] -- C:\Windows\System32\nlssrv32.exe -- (nlsX86cc)
SRV - [2010/07/04 20:07:40 | 000,238,952 | ---- | M] (Teruten) [Auto | Running] -- C:\Windows\System32\FsUsbExService.Exe -- (FsUsbExService)
SRV - [2010/04/16 18:56:44 | 000,644,384 | ---- | M] (Broadcom Corporation.) [Auto | Running] -- C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe -- (btwdins)
SRV - [2009/07/14 03:16:13 | 000,025,088 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\System32\sensrsvc.dll -- (SensrSvc)
SRV - [2009/07/14 03:15:41 | 000,680,960 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Program Files\Windows Defender\mpsvc.dll -- (WinDefend)
SRV - [2009/03/05 11:54:50 | 000,311,296 | ---- | M] () [Auto | Running] -- C:\Windows\System32\Rezip.exe -- (Rezip)
 
 
========== Driver Services (SafeList) ==========
 
DRV - [2011/12/19 12:44:24 | 000,223,864 | ---- | M] (GFI Software) [Kernel | System | Running] -- C:\Windows\System32\drivers\SbFw.sys -- (SbFw)
DRV - [2011/12/19 12:44:24 | 000,093,816 | ---- | M] (GFI Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sbhips.sys -- (sbhips)
DRV - [2011/12/19 12:44:24 | 000,072,312 | ---- | M] (GFI Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\sbwtis.sys -- (sbwtis)
DRV - [2011/12/15 19:29:42 | 000,026,624 | ---- | M] (The OpenVPN Project) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\tap0901.sys -- (tap0901)
DRV - [2011/11/29 06:59:52 | 000,077,816 | ---- | M] (GFI Software) [File_System | Auto | Running] -- C:\Windows\System32\drivers\sbapifs.sys -- (sbapifs)
DRV - [2011/10/26 14:23:40 | 000,101,112 | ---- | M] (GFI Software) [Kernel | System | Stopped] -- C:\Windows\System32\drivers\SBREDrv.sys -- (SBRE)
DRV - [2011/10/01 09:30:42 | 000,019,304 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftvollh.sys -- (Sftvol)
DRV - [2011/10/01 09:30:40 | 000,021,864 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Running] -- C:\Windows\System32\drivers\Sftredirlh.sys -- (Sftredir)
DRV - [2011/10/01 09:30:38 | 000,194,408 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftplaylh.sys -- (Sftplay)
DRV - [2011/10/01 09:30:36 | 000,579,944 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\Sftfslh.sys -- (Sftfs)
DRV - [2011/09/29 12:16:18 | 000,094,584 | ---- | M] (GFI Software) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\SbFwIm.sys -- (SBFWIMCLMP)
DRV - [2011/09/29 12:16:18 | 000,094,584 | ---- | M] (GFI Software) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\SbFwIm.sys -- (SBFWIMCL)
DRV - [2011/07/22 18:27:02 | 000,012,880 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS -- (SASDIFSV)
DRV - [2011/07/12 23:55:22 | 000,067,664 | ---- | M] (SUPERAdBlocker.com and SUPERAntiSpyware.com) [Kernel | System | Running] -- C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS -- (SASKUTIL)
DRV - [2011/07/10 10:34:50 | 000,138,192 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\avipbb.sys -- (avipbb)
DRV - [2011/07/10 10:34:50 | 000,066,616 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\System32\drivers\avgntflt.sys -- (avgntflt)
DRV - [2010/11/20 12:24:41 | 000,052,224 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV - [2010/11/20 11:59:44 | 000,035,968 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\winusb.sys -- (WinUsb)
DRV - [2010/09/15 03:03:09 | 000,015,656 | ---- | M] (Windows (R) 2003 DDK 3790 provider) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\rtport.sys -- (rtport)
DRV - [2010/06/17 15:27:02 | 000,028,520 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\System32\drivers\ssmdrv.sys -- (ssmdrv)
DRV - [2010/06/14 10:32:54 | 000,036,608 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\FsUsbExDisk.Sys -- (FsUsbExDisk)
DRV - [2010/05/12 12:14:58 | 000,121,576 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdm.sys -- (ssadmdm)
DRV - [2010/05/12 12:14:58 | 000,098,152 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadserd.sys -- (ssadserd) SAMSUNG Android USB Diagnostic Serial Port (WDM)
DRV - [2010/05/12 12:14:56 | 000,096,488 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadbus.sys -- (ssadbus) SAMSUNG Android USB Composite Device driver (WDM)
DRV - [2010/05/12 12:14:56 | 000,012,776 | ---- | M] (MCCI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadmdfl.sys -- (ssadmdfl) SAMSUNG Android USB Modem (Filter)
DRV - [2010/05/12 12:14:54 | 000,030,312 | ---- | M] (Google Inc) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ssadadb.sys -- (androidusb)
DRV - [2010/02/27 02:31:22 | 000,132,480 | ---- | M] (Intel Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\Impcd.sys -- (Impcd)
DRV - [2010/02/11 04:17:24 | 009,936,584 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvlddmkm.sys -- (nvlddmkm)
DRV - [2009/11/12 22:14:30 | 000,066,664 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\nvhda32v.sys -- (NVHDA)
DRV - [2009/10/21 17:16:08 | 000,198,656 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbnet.sys -- (ewusbnet)
DRV - [2009/10/12 15:22:56 | 000,101,120 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbdev.sys -- (hwusbdev)
DRV - [2009/09/28 11:22:00 | 000,315,392 | ---- | M] () [Kernel | On_Demand | Running] -- C:\Windows\System32\drivers\yk62x86.sys -- (yukonw7)
DRV - [2009/09/10 15:31:48 | 000,102,912 | ---- | M] (Huawei Technologies Co., Ltd.) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ewusbmdm.sys -- (hwdatacard)
DRV - [2009/07/14 01:54:16 | 000,015,872 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\usb8023.sys -- (USB_RNDIS)
DRV - [2008/12/08 17:21:18 | 000,110,080 | ---- | M] (ZTE Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnet.sys -- (ZTEusbnet)
DRV - [2008/12/08 17:21:18 | 000,105,344 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbnmea.sys -- (ZTEusbnmea)
DRV - [2008/12/08 17:21:18 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\zteusbvoice.sys -- (ZTEusbvoice)
DRV - [2008/12/08 17:21:18 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbser6k.sys -- (ZTEusbser6k)
DRV - [2008/12/08 17:21:18 | 000,104,960 | ---- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\ZTEusbmdm6k.sys -- (ZTEusbmdm6k)
DRV - [2008/12/08 17:21:18 | 000,007,680 | R--- | M] (ZTE Incorporated) [Kernel | On_Demand | Stopped] -- C:\Windows\System32\drivers\massfilter.sys -- (massfilter)
DRV - [2008/10/09 13:50:08 | 000,022,528 | ---- | M] (Bytemobile, Inc.) [Kernel | Boot | Unknown] -- C:\Windows\System32\drivers\BMLoad.sys -- (BMLoad)
DRV - [2008/10/09 13:50:04 | 000,018,816 | ---- | M] (Bytemobile, Inc.) [Kernel | System | Stopped] -- C:\windows\System32\drivers\tcpipBM.sys -- (tcpipBM)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE - HKLM\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\..\SearchScopes\{67A2568C-7A0A-4EED-AECC-B5405DE63B64}: "URL" = hxxp://www.google.com/search?sourceid=ie7&q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&rlz=1I7SMSN
IE - HKLM\..\SearchScopes\{6A1806CD-94D4-4689-BA73-E35EA1EA9990}: "URL" = hxxp://www.google.com/search?q={searchTerms}&rls=com.microsoft:{language}:{referrer:source?}&ie={inputEncoding}&oe={outputEncoding}&sourceid=ie7
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.google.com/ig/redirectdomain?brand=smsn&bmod=smsn
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.ask.com/?l=dis&o=1586&gct=hp
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\URLSearchHook: {ff88a983-649d-4207-9336-9b999280b436} - No CLSID value found
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = hxxp://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\SearchScopes\{C0B6FD25-BB4E-4108-921C-0848B2E7E369}: "URL" = hxxp://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=crm&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^AT&apn_uid=f1d5defc-1291-40c9-b34e-5aa4abd1dbdd&apn_sauid=533F215B-BFAA-4D44-8C83-9860CE93F962
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
========== FireFox ==========
 
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
FF - prefs.js..browser.search.selectedEngine: "LEO Eng-Deu"
FF - prefs.js..browser.search.useDBForOrder: true
FF - prefs.js..browser.startup.homepage: "hxxp://www.google.at/"
FF - prefs.js..extensions.enabledItems: youtube2mp3@mondayx.de:1.2.3
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22
FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26
FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.4
FF - prefs.js..extensions.enabledItems: {d10d0bf8-f5b5-c8b4-a8b2-2b9879e08c5d}:1.3.9
 
 
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\windows\system32\Macromed\Flash\NPSWF32.dll ()
FF - HKLM\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf:  File not found
FF - HKLM\Software\MozillaPlugins\@foxitsoftware.com/Foxit Reader Plugin,version=1.0,application/pdf: C:\Program Files\Foxit Software\Foxit Reader\plugins\npFoxitReaderPlugin.dll File not found
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/GENUINE: disabled File not found
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/SharePoint,version=14.0: C:\PROGRA~1\MICROS~2\Office14\NPSPWRAP.DLL (Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@microsoft.com/WLPG,version=14.0.8081.0709: C:\Program Files\Windows Live\Photo Gallery\NPWLPG.dll (Microsoft Corporation)
FF - HKCU\Software\MozillaPlugins\@docu-track.com/PDF-XChange Viewer Plugin,version=1.0,application/pdf:  File not found
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/17 19:26:20 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/05/24 19:36:21 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011/11/13 19:15:23 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 9.0.1\extensions\\Plugins: C:\Program Files\Mozilla Thunderbird\plugins
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: C:\Program Files\Mozilla Firefox\components [2012/06/17 19:26:20 | 000,000,000 | ---D | M]
FF - HKEY_CURRENT_USER\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: C:\Program Files\Mozilla Firefox\plugins [2012/05/24 19:36:21 | 000,000,000 | ---D | M]
 
[2011/03/08 22:03:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sandra\AppData\Roaming\mozilla\Extensions
[2011/03/08 22:03:21 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sandra\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6}
[2012/06/29 14:50:52 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Sandra\AppData\Roaming\mozilla\Firefox\Profiles\t2xu63eu.default\extensions
[2011/04/04 22:25:55 | 000,000,000 | ---D | M] (GamePlayLabs Plugin) -- C:\Users\Sandra\AppData\Roaming\mozilla\Firefox\Profiles\t2xu63eu.default\extensions\plugin2@gameplaylabs.com
[2011/09/03 12:29:40 | 000,000,000 | ---D | M] (YouTube to MP3) -- C:\Users\Sandra\AppData\Roaming\mozilla\Firefox\Profiles\t2xu63eu.default\extensions\youtube2mp3@mondayx.de
[2012/06/01 17:53:14 | 000,000,000 | ---D | M] (No name found) -- C:\Program Files\mozilla firefox\extensions
[2012/06/29 14:50:52 | 000,743,305 | ---- | M] () (No name found) -- C:\USERS\SANDRA\APPDATA\ROAMING\MOZILLA\FIREFOX\PROFILES\T2XU63EU.DEFAULT\EXTENSIONS\{D10D0BF8-F5B5-C8B4-A8B2-2B9879E08C5D}.XPI
[2012/06/17 19:26:20 | 000,085,472 | ---- | M] (Mozilla Foundation) -- C:\Program Files\mozilla firefox\components\browsercomps.dll
[2011/05/04 04:52:23 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll
[2011/06/30 20:30:14 | 000,012,800 | ---- | M] (Nullsoft, Inc.) -- C:\Program Files\mozilla firefox\plugins\npwachk.dll
[2012/06/17 19:26:16 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml
[2012/06/17 19:26:16 | 000,002,252 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\bing.xml
[2012/06/17 19:26:16 | 000,001,153 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml
[2012/06/17 19:26:16 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml
[2012/06/17 19:26:16 | 000,001,178 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml
[2012/06/17 19:26:16 | 000,001,105 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml
 
O1 HOSTS File: ([2009/06/10 23:39:37 | 000,000,824 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\Toolbar\WebBrowser: (no name) - {FF88A983-649D-4207-9336-9B999280B436} - No CLSID value found.
O4 - HKLM..\Run: [Ad-Aware Antivirus] C:\Program Files\Ad-Aware Antivirus\AdAwareLauncher.exe (Lavasoft Limited)
O4 - HKLM..\Run: [Ad-Aware Browsing Protection] C:\ProgramData\Ad-Aware Browsing Protection\adawarebp.exe (Lavasoft)
O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira GmbH)
O4 - HKU\S-1-5-21-1824515743-1129300623-418782207-1000..\Run: [HW_OPENEYE_OUC_T-Mobile Internet Manager] C:\Program Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
O4 - HKU\S-1-5-21-1824515743-1129300623-418782207-1000..\Run: [SUPERAntiSpyware] C:\Program Files\SUPERAntiSpyware\SUPERAntiSpyware.exe (SUPERAntiSpyware.com)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe (Microsoft Corporation)
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm ()
O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm ()
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_22-windows-i586.cab (Java Plug-in 1.6.0_22)
O16 - DPF: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_26-windows-i586.cab (Java Plug-in 1.6.0_26)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 10.0.0.138
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{1A7D2EF4-E976-4A68-8C63-6E36A173B396}: DhcpNameServer = 192.168.0.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{26CFA158-2B9B-40ED-B46C-D8EB42B90917}: NameServer = 213.162.69.170 213.162.69.169
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{547D5E76-2509-49C9-A093-F2268C116CB8}: DhcpNameServer = 195.34.133.21 212.186.211.21
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{81E2AD3D-BB31-4066-9E11-C5D237E2E862}: DhcpNameServer = 212.91.97.3 212.91.97.4
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{BEF0FCF6-5A11-4CEC-86E6-56CA61880306}: DhcpNameServer = 10.0.0.138
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~1\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\windows\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\System32\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\windows\System32\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - Winlogon\Notify\!SASWinLogon: DllName - (C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL) - C:\Program Files\SUPERAntiSpyware\SASWINLO.DLL (SUPERAntiSpyware.com)
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O28 - HKLM ShellExecuteHooks: {5AE067D3-9AFB-48E0-853A-EBB7F4A000DA} - C:\Program Files\SUPERAntiSpyware\SASSEH.DLL (SuperAdBlocker.com)
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2d2da28b-a951-11e1-b494-001bb1166a05}\Shell - "" = AutoRun
O33 - MountPoints2\{2d2da28b-a951-11e1-b494-001bb1166a05}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{2d2da29d-a951-11e1-b494-001bb1166a05}\Shell - "" = AutoRun
O33 - MountPoints2\{2d2da29d-a951-11e1-b494-001bb1166a05}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{50f77daf-c1ab-11e0-9326-001bb1166a05}\Shell - "" = AutoRun
O33 - MountPoints2\{50f77daf-c1ab-11e0-9326-001bb1166a05}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
O34 - HKLM BootExecute: (autocheck autochk *)
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs: FastUserSwitchingCompatibility -  File not found
NetSvcs: Ias - C:\windows\System32\ias.dll (Microsoft Corporation)
NetSvcs: Nla -  File not found
NetSvcs: Ntmssvc -  File not found
NetSvcs: NWCWorkstation -  File not found
NetSvcs: Nwsapagent -  File not found
NetSvcs: SRService -  File not found
NetSvcs: WmdmPmSp -  File not found
NetSvcs: LogonHours -  File not found
NetSvcs: PCAudit -  File not found
NetSvcs: helpsvc -  File not found
NetSvcs: uploadmgr -  File not found
 
MsConfig - StartUpFolder: C:^ProgramData^Microsoft^Windows^Start Menu^Programs^Startup^Bluetooth.lnk - C:\PROGRA~1\WIDCOMM\BLUETO~1\BTTray.exe - (Broadcom Corporation.)
MsConfig - StartUpReg: APSDaemon - hkey= - key= -  File not found
MsConfig - StartUpReg: AutoStartNPSAgent - hkey= - key= - C:\Program Files\Samsung\Samsung New PC Studio\NPSAgent.exe (Samsung Electronics Co., Ltd.)
MsConfig - StartUpReg: CLMLServer - hkey= - key= - C:\Program Files\CyberLink\Power2Go\CLMLSvc.exe (CyberLink)
MsConfig - StartUpReg: Facebook Update - hkey= - key= - C:\Users\Sandra\AppData\Local\Facebook\Update\FacebookUpdate.exe (Facebook Inc.)
MsConfig - StartUpReg: FlashPlayerUpdate - hkey= - key= -  File not found
MsConfig - StartUpReg: HW_OPENEYE_OUC_T-Mobile Internet Manager - hkey= - key= - C:\Program Files\T-Mobile\T-Mobile Internet Manager\UpdateDog\ouc.exe (Huawei Technologies Co., Ltd.)
MsConfig - StartUpReg: iTunesHelper - hkey= - key= -  File not found
MsConfig - StartUpReg: NortonOnlineBackup - hkey= - key= -  File not found
MsConfig - StartUpReg: NvCplDaemon - hkey= - key= -  File not found
MsConfig - StartUpReg: PDVD8LanguageShortcut - hkey= - key= - C:\Program Files\CyberLink\PowerDVD8\Language\Language.exe (CyberLink Corp.)
MsConfig - StartUpReg: QuickTime Task - hkey= - key= - C:\Program Files\QuickTime\QTTask.exe (Apple Inc.)
MsConfig - StartUpReg: RemoteControl8 - hkey= - key= - C:\Program Files\CyberLink\PowerDVD8\PDVD8Serv.exe (CyberLink Corp.)
MsConfig - StartUpReg: SynTPEnh - hkey= - key= -  File not found
MsConfig - StartUpReg: UCam_Menu - hkey= - key= - C:\Program Files\CyberLink\YouCam\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: UpdateLBPShortCut - hkey= - key= - C:\Program Files\CyberLink\LabelPrint\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: UpdateP2GoShortCut - hkey= - key= - C:\Program Files\CyberLink\Power2Go\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: UpdatePDRShortCut - hkey= - key= - C:\Program Files\CyberLink\PowerDirector\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: UpdatePPShortCut - hkey= - key= - C:\Program Files\CyberLink\PowerProducer\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: UpdatePSTShortCut - hkey= - key= - C:\Program Files\CyberLink\DVD Suite\MUITransfer\MUIStartMenu.exe (CyberLink Corp.)
MsConfig - StartUpReg: WinampAgent - hkey= - key= - C:\Program Files\Winamp\winampa.exe (Nullsoft, Inc.)
 
SafeBootMin: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SafeBootMin: Ad-Aware Service - C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
SafeBootMin: AppMgmt - Service
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: mcmscsvc - Service
SafeBootMin: MCODS - Service
SafeBootMin: NTDS -  File not found
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SBAMSvc - C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet: !SASCORE - C:\Program Files\SUPERAntiSpyware\SASCORE.EXE (SUPERAntiSpyware.com)
SafeBootNet: Ad-Aware Service - C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe (Lavasoft Limited)
SafeBootNet: AppMgmt - Service
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: mcmscsvc - Service
SafeBootNet: MCODS - Service
SafeBootNet: Messenger - Service
SafeBootNet: MpfService - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: NTDS -  File not found
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SBAMSvc - C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe (GFI Software)
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WinDefend - C:\Program Files\Windows Defender\mpsvc.dll (Microsoft Corporation)
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {3C3901C5-3455-3E0A-A214-0B093A5070A6} - .NET Framework
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {D27CDB6E-AE6D-11CF-96B8-444553540000} - Adobe Flash Player
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: MSVideo8 - C:\windows\System32\vfwwdm32.dll (Microsoft Corporation)
Drivers32: vidc.cvid - C:\windows\System32\iccvid.dll (Radius Inc.)
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012/06/29 14:52:00 | 000,000,000 | ---D | C] -- C:\Program Files\ESET
[2012/06/17 20:12:27 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\Malwarebytes
[2012/06/17 20:11:42 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012/06/17 20:11:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes
[2012/06/17 20:11:39 | 000,022,344 | ---- | C] (Malwarebytes Corporation) -- C:\windows\System32\drivers\mbam.sys
[2012/06/17 20:11:39 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware
[2012/06/17 19:45:40 | 000,000,000 | ---D | C] -- C:\windows\System32\AppLogs
[2012/06/17 00:39:07 | 000,000,000 | ---D | C] -- C:\88a3095b5aeba41de7
[2012/06/16 22:45:09 | 000,000,000 | ---D | C] -- C:\windows\pss
[2012/06/04 21:09:10 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Local\adaware
[2012/06/04 21:09:09 | 000,000,000 | ---D | C] -- C:\ProgramData\Ad-Aware Browsing Protection
[2012/06/04 21:09:07 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Ad-Aware Antivirus
[2012/06/04 21:08:42 | 000,093,816 | ---- | C] (GFI Software) -- C:\windows\System32\drivers\sbhips.sys
[2012/06/04 21:08:32 | 000,223,864 | ---- | C] (GFI Software) -- C:\windows\System32\drivers\SbFw.sys
[2012/06/04 21:08:32 | 000,094,584 | ---- | C] (GFI Software) -- C:\windows\System32\drivers\SbFwIm.sys
[2012/06/04 21:08:31 | 000,000,000 | ---D | C] -- C:\windows\System32\drivers\VDD
[2012/06/04 21:08:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Lavasoft
[2012/06/04 21:08:30 | 000,000,000 | ---D | C] -- C:\Program Files\Ad-Aware Antivirus
[2012/06/04 20:53:49 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\Ad-Aware Antivirus
[2012/06/03 14:47:04 | 000,000,000 | ---D | C] -- C:\ProgramData\435E
[2012/06/03 11:30:45 | 000,000,000 | ---D | C] -- C:\Users\Sandra\AppData\Roaming\Foxit Software
[2012/06/03 11:30:27 | 000,000,000 | ---D | C] -- C:\Program Files\Foxit Software
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012/07/02 10:17:10 | 000,014,736 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012/07/02 10:17:10 | 000,014,736 | -H-- | M] () -- C:\windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012/07/02 10:16:08 | 000,067,584 | --S- | M] () -- C:\windows\bootstat.dat
[2012/07/01 21:37:29 | 000,000,330 | ---- | M] () -- C:\windows\tasks\DriverScanner.job
[2012/07/01 21:36:11 | 3611,873,280 | -HS- | M] () -- C:\hiberfil.sys
[2012/06/30 11:08:39 | 000,654,844 | ---- | M] () -- C:\windows\System32\perfh007.dat
[2012/06/30 11:08:39 | 000,616,686 | ---- | M] () -- C:\windows\System32\perfh009.dat
[2012/06/30 11:08:39 | 000,130,426 | ---- | M] () -- C:\windows\System32\perfc007.dat
[2012/06/30 11:08:39 | 000,106,808 | ---- | M] () -- C:\windows\System32\perfc009.dat
[2012/06/29 16:44:46 | 000,279,392 | ---- | M] () -- C:\Users\Sandra\Desktop\lipplan_oberlaa.jpg
[2012/06/27 22:39:18 | 000,127,059 | ---- | M] () -- C:\Users\Sandra\Desktop\AntiSpyWare Quarantine.jpg
[2012/06/26 17:34:32 | 000,042,237 | ---- | M] () -- C:\Users\Sandra\Desktop\MAG ELF - Servicestelle.pdf
[2012/06/25 09:11:19 | 000,048,775 | ---- | M] () -- C:\Users\Sandra\Desktop\2012 06 25 Fehlermeldung Serververbindung.jpg
[2012/06/25 08:49:14 | 000,071,559 | ---- | M] () -- C:\Users\Sandra\Desktop\AR 041 LLC (2012-020,022,024).pdf
[2012/06/25 08:48:51 | 000,066,406 | ---- | M] () -- C:\Users\Sandra\Desktop\LS 029 LLC (2012-020,022,024).pdf
[2012/06/24 10:09:31 | 000,001,650 | ---- | M] () -- C:\Users\Sandra\Desktop\Docs (server001.ledworx.local) - Verknüpfung.lnk
[2012/06/18 21:25:59 | 000,018,391 | ---- | M] () -- C:\Users\Sandra\Desktop\Beach-quiz.odt
[2012/06/17 20:11:42 | 000,001,067 | ---- | M] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/17 10:25:47 | 003,659,288 | ---- | M] () -- C:\windows\System32\FNTCACHE.DAT
[2012/06/11 07:28:59 | 000,001,738 | ---- | M] () -- C:\windows\System32\EmailAVConfig.xml
[2012/06/07 23:00:51 | 000,001,188 | ---- | M] () -- C:\windows\System32\ServiceConfig.xml
[1 C:\windows\System32\*.tmp files -> C:\windows\System32\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012/06/29 16:44:42 | 000,279,392 | ---- | C] () -- C:\Users\Sandra\Desktop\lipplan_oberlaa.jpg
[2012/06/27 22:39:17 | 000,127,059 | ---- | C] () -- C:\Users\Sandra\Desktop\AntiSpyWare Quarantine.jpg
[2012/06/26 17:34:32 | 000,042,237 | ---- | C] () -- C:\Users\Sandra\Desktop\MAG ELF - Servicestelle.pdf
[2012/06/25 09:11:19 | 000,048,775 | ---- | C] () -- C:\Users\Sandra\Desktop\2012 06 25 Fehlermeldung Serververbindung.jpg
[2012/06/25 08:49:14 | 000,071,559 | ---- | C] () -- C:\Users\Sandra\Desktop\AR 041 LLC (2012-020,022,024).pdf
[2012/06/25 08:48:48 | 000,066,406 | ---- | C] () -- C:\Users\Sandra\Desktop\LS 029 LLC (2012-020,022,024).pdf
[2012/06/18 21:21:24 | 000,018,391 | ---- | C] () -- C:\Users\Sandra\Desktop\Beach-quiz.odt
[2012/06/17 20:11:42 | 000,001,067 | ---- | C] () -- C:\Users\Public\Desktop\Malwarebytes Anti-Malware.lnk
[2012/06/11 07:28:59 | 000,001,738 | ---- | C] () -- C:\windows\System32\EmailAVConfig.xml
[2012/06/07 23:00:51 | 000,001,188 | ---- | C] () -- C:\windows\System32\ServiceConfig.xml
[2011/10/09 23:27:25 | 000,003,347 | ---- | C] () -- C:\Users\Sandra\.recently-used.xbel
[2011/08/27 12:54:48 | 000,044,544 | ---- | C] () -- C:\windows\System32\Gif89.dll
[2011/04/10 23:25:01 | 000,003,584 | ---- | C] () -- C:\Users\Sandra\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini
[2011/04/10 22:54:51 | 000,000,088 | RHS- | C] () -- C:\ProgramData\F3426455BD.sys
[2011/04/10 22:54:50 | 000,002,984 | -HS- | C] () -- C:\ProgramData\KGyGaAvL.sys
[2011/03/20 23:08:04 | 000,110,592 | ---- | C] () -- C:\windows\System32\FsUsbExDevice.Dll
[2011/03/20 23:08:04 | 000,036,608 | ---- | C] () -- C:\windows\System32\FsUsbExDisk.Sys
[2011/02/23 12:02:25 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat
[2011/02/23 11:34:59 | 000,131,368 | ---- | C] () -- C:\ProgramData\FullRemove.exe
[2010/07/06 01:46:17 | 000,654,844 | ---- | C] () -- C:\windows\System32\perfh007.dat
[2010/07/06 01:46:17 | 000,295,922 | ---- | C] () -- C:\windows\System32\perfi007.dat
[2010/07/06 01:46:17 | 000,130,426 | ---- | C] () -- C:\windows\System32\perfc007.dat
[2010/07/06 01:46:17 | 000,038,104 | ---- | C] () -- C:\windows\System32\perfd007.dat
[2010/07/05 10:02:50 | 000,307,200 | ---- | C] () -- C:\windows\SetDisplayResolution.exe
[2010/07/05 09:29:15 | 000,001,670 | ---- | C] () -- C:\windows\HotFixList.ini
[2010/07/05 09:16:47 | 000,311,296 | ---- | C] () -- C:\windows\System32\Rezip.exe
[2010/07/05 09:15:48 | 000,006,656 | ---- | C] () -- C:\windows\System32\bcmwlrc.dll
 
========== LOP Check ==========
 
[2012/06/17 19:48:37 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Ad-Aware Antivirus
[2012/04/12 10:36:17 | 000,000,000 | ---D | M] -- C:\Users\Gast\AppData\Roaming\Synaptics
[2012/06/29 14:52:33 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Ad-Aware Antivirus
[2011/09/21 20:08:06 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011/07/08 23:54:35 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/06/12 22:35:50 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Foxit Software
[2011/10/09 23:27:25 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\gtk-2.0
[2011/10/16 12:09:19 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\mp3DirectCut
[2011/11/13 21:28:14 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\MusicNet
[2011/07/09 10:56:00 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\OpenCandy
[2012/02/28 22:55:40 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\OpenOffice.org
[2011/03/20 23:26:40 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\PDF Writer
[2011/03/20 23:07:56 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Samsung
[2012/06/25 23:45:06 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\SoftGrid Client
[2011/09/11 22:05:45 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Synaptics
[2012/05/29 07:47:49 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\T-Mobile
[2012/05/29 07:49:30 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\T-Mobile Internet Manager
[2011/03/08 22:03:20 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Thunderbird
[2011/04/10 22:36:10 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\TP
[2011/08/27 13:01:23 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\TuneUp Software
[2011/07/09 10:57:42 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Uniblue
[2012/06/16 22:23:41 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\uTorrent
[2011/08/08 12:48:08 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Vodafone
[2012/07/01 21:37:29 | 000,000,330 | ---- | M] () -- C:\windows\Tasks\DriverScanner.job
[2012/05/13 17:59:06 | 000,032,632 | ---- | M] () -- C:\windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012/06/29 14:52:33 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Ad-Aware Antivirus
[2011/11/13 19:52:15 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Adobe
[2011/07/27 21:36:51 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Apple Computer
[2011/04/24 03:48:29 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Avira
[2011/09/21 20:08:06 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\com.adobe.downloadassistant.AdobeDownloadAssistant
[2011/04/10 22:54:51 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Corel
[2011/05/26 18:37:58 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\CyberLink
[2011/07/08 23:54:35 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\DVDVideoSoftIEHelpers
[2012/06/12 22:35:50 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Foxit Software
[2011/02/23 12:03:55 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Google
[2011/10/09 23:27:25 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\gtk-2.0
[2011/02/23 11:58:53 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Identities
[2011/02/23 21:41:33 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Macromedia
[2012/06/17 20:12:27 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Malwarebytes
[2010/07/06 01:36:15 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Media Center Programs
[2012/02/08 15:20:01 | 000,000,000 | --SD | M] -- C:\Users\Sandra\AppData\Roaming\Microsoft
[2011/02/23 12:06:47 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Mozilla
[2011/10/16 12:09:19 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\mp3DirectCut
[2011/11/13 21:28:14 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\MusicNet
[2011/07/09 10:56:00 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\OpenCandy
[2012/02/28 22:55:40 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\OpenOffice.org
[2011/03/20 23:26:40 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\PDF Writer
[2011/03/20 23:07:56 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Samsung
[2012/05/24 19:32:08 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Skype
[2011/07/14 00:06:15 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\skypePM
[2012/06/25 23:45:06 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\SoftGrid Client
[2011/10/11 22:00:26 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\SUPERAntiSpyware.com
[2011/09/11 22:05:45 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Synaptics
[2012/05/29 07:47:49 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\T-Mobile
[2012/05/29 07:49:30 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\T-Mobile Internet Manager
[2011/03/08 22:03:20 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Thunderbird
[2011/04/10 22:36:10 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\TP
[2011/08/27 13:01:23 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\TuneUp Software
[2011/07/09 10:57:42 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Uniblue
[2012/06/16 22:23:41 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\uTorrent
[2012/03/11 20:00:30 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\vlc
[2011/08/08 12:48:08 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Vodafone
[2012/03/11 20:26:25 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\Winamp
[2012/01/01 19:22:58 | 000,000,000 | ---D | M] -- C:\Users\Sandra\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
[2011/09/21 20:03:44 | 000,053,632 | ---- | M] (Adobe Systems Inc.) -- C:\Users\Sandra\AppData\Roaming\Macromedia\Flash Player\www.macromedia.com\bin\airappinstaller\airappinstaller.exe
[2011/06/07 20:58:20 | 005,845,432 | ---- | M] (Uniblue Systems Ltd                                        ) -- C:\Users\Sandra\AppData\Roaming\OpenCandy\OpenCandy_AAB76C1FF91040E0A0828965171E77B0\driverscanner (9).exe
[2011/07/09 10:56:05 | 000,416,160 | ---- | M] () -- C:\Users\Sandra\AppData\Roaming\OpenCandy\OpenCandy_AAB76C1FF91040E0A0828965171E77B0\LatestDLMgr.exe
[2010/01/07 14:35:18 | 001,007,616 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Sandra\AppData\Roaming\T-Mobile Internet Manager\LiveUpdate.exe
[2009/12/31 14:13:52 | 000,110,592 | ---- | M] (Huawei Technologies Co., Ltd.) -- C:\Users\Sandra\AppData\Roaming\T-Mobile Internet Manager\ouc.exe
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\drivers\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\System32\DriverStore\FileRepository\machine.inf_x86_neutral_a97a2a0d0fbc6696\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_b9e9435f20046eeb\AGP440.sys
[2009/07/14 03:26:15 | 000,053,312 | ---- | M] (Microsoft Corporation) MD5=507812C3054C21CEF746B6EE3D04DD6E -- C:\Windows\winsxs\x86_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_bc1a57271cf2f285\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\drivers\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\System32\DriverStore\FileRepository\mshdc.inf_x86_neutral_fab873f3e8a3315c\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_dd0e7e3d82dd640d\atapi.sys
[2009/07/14 03:26:15 | 000,021,584 | ---- | M] (Microsoft Corporation) MD5=338C86357871C167A96AB976519BF59E -- C:\Windows\winsxs\x86_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_df3f92057fcbe7a7\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\System32\cngaudit.dll
[2009/07/14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
 
< MD5 for: EVENTLOG.DLL  >
[2007/05/17 14:34:04 | 000,007,216 | ---- | M] () MD5=C2A279A458A06DE2C83D842AA042B5A8 -- C:\Program Files\CyberLink\PowerDirector\EventLog.dll
 
< MD5 for: IASTOR.SYS  >
[2010/04/27 09:47:34 | 000,435,736 | ---- | M] (Intel Corporation) MD5=EB3A2C773E202CED30595BBFAD24FEBF -- C:\Windows\System32\drivers\iaStor.sys
[2010/04/27 09:47:34 | 000,435,736 | ---- | M] (Intel Corporation) MD5=EB3A2C773E202CED30595BBFAD24FEBF -- C:\Windows\System32\DriverStore\FileRepository\iaahci.inf_x86_neutral_f694c1cdcd94f044\iaStor.sys
 
< MD5 for: IASTORV.SYS  >
[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\drivers\iaStorV.sys
[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_0bcee2057afcc090\iaStorV.sys
[2011/03/11 07:38:51 | 000,332,160 | ---- | M] (Intel Corporation) MD5=5CD5F9A5444E6CDCB0AC89BD62D8B76E -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_b0daddb9e6380745\iaStorV.sys
[2011/03/11 07:43:55 | 000,332,160 | ---- | M] (Intel Corporation) MD5=71F1A494FEDF4B33C02C4A6A28D6D9E9 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_aef580fde910b4b0\iaStorV.sys
[2011/03/11 07:28:00 | 000,332,160 | ---- | M] (Intel Corporation) MD5=778D0E6D7D9EBA0C403BADBAAD41DB20 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_b152a892ff64119f\iaStorV.sys
[2009/07/14 03:20:36 | 000,332,352 | ---- | M] (Intel Corporation) MD5=934AF4D7C5F457B9F0743F4299B77B67 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_aee7a89be91b9000\iaStorV.sys
[2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\System32\DriverStore\FileRepository\iastorv.inf_x86_neutral_668286aa35d55928\iaStorV.sys
[2010/11/20 14:29:54 | 000,332,160 | ---- | M] (Intel Corporation) MD5=A3CAE5D281DB4CFF7CFF8233507EE5AD -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_b118bc63e60a139a\iaStorV.sys
[2011/03/11 07:52:21 | 000,332,160 | ---- | M] (Intel Corporation) MD5=B9039A34C2F8769490DCC494E2402445 -- C:\Windows\winsxs\x86_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_afae2d45020c148b\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\System32\netlogon.dll
[2010/11/20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_ffbf212e963c0162\netlogon.dll
[2009/07/14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\x86_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_fd8e0d66994d7dc8\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\drivers\nvstor.sys
[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_0276fc3b3ea60d41\nvstor.sys
[2011/03/11 07:39:00 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4380E59A170D88C4F1022EFF6719A8A4 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_3ba44e691d6eb11d\nvstor.sys
[2011/03/11 07:44:01 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=4520B63899E867F354EE012D34E11536 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_39bef1ad20475e88\nvstor.sys
[2011/03/11 07:28:10 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=66D468654A58594F5F3BA63D5AD5B1AF -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_3c1c1942369abb77\nvstor.sys
[2011/03/11 07:52:25 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=8A7583A3B58D3EEB28BB26626526BC91 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_3a779df43942be63\nvstor.sys
[2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\System32\DriverStore\FileRepository\nvraid.inf_x86_neutral_dd659ed032d28a14\nvstor.sys
[2010/11/20 14:30:06 | 000,143,744 | ---- | M] (NVIDIA Corporation) MD5=9283C58EBAA2618F93482EB5DABCEC82 -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_3be22d131d40bd72\nvstor.sys
[2009/07/14 03:20:44 | 000,142,416 | ---- | M] (NVIDIA Corporation) MD5=C99F251A5DE63C6F129CF71933ACED0F -- C:\Windows\winsxs\x86_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_39b1194b205239d8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009/07/14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_37e4387f3a6f0483\scecli.dll
[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\System32\scecli.dll
[2010/11/20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\x86_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_3a154c47375d881d\scecli.dll
 
< MD5 for: USER32.DLL  >
[2009/07/14 03:16:17 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=34B7E222E81FAFA885F0C5F2CFA56861 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_cd0ec264ceb014a3\user32.dll
[2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\System32\user32.dll
[2010/11/20 14:21:33 | 000,811,520 | ---- | M] (Microsoft Corporation) MD5=F1DD3ACAEE5E6B4BBC69BC6DF75CEF66 -- C:\Windows\winsxs\x86_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_cf3fd62ccb9e983d\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\System32\userinit.exe
[2010/11/20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009/07/14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\System32\wininit.exe
[2009/07/14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2012/04/04 15:56:38 | 000,199,240 | ---- | M] () MD5=097D0E812D7A9A3101CE46CB2BE0474D -- C:\Program Files\Malwarebytes' Anti-Malware\Chameleon\winlogon.exe
[2009/10/28 08:17:59 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=37CDB7E72EB66BA85A87CBE37E7F03FD -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_6fc699643622d177\winlogon.exe
[2009/10/28 07:52:08 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=3BABE6767C78FBF5FB8435FEED187F30 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_703394514f56f7c2\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\System32\winlogon.exe
[2010/11/20 14:17:54 | 000,286,720 | ---- | M] (Microsoft Corporation) MD5=6D13E1406F50C66E2A95D97F22C47560 -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_71ca6b0233339500\winlogon.exe
[2009/07/14 03:14:45 | 000,285,696 | ---- | M] (Microsoft Corporation) MD5=8EC6A4AB12B8F3759E21F8E3A388F2CF -- C:\Windows\winsxs\x86_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_6f99573a36451166\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\System32\drivers\ws2ifsl.sys
[2009/07/14 01:55:02 | 000,016,384 | ---- | M] (Microsoft Corporation) MD5=6DB3276587B853BF886B69528FDB048C -- C:\Windows\winsxs\x86_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_4f5cf6f829213bb2\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
[1 C:\windows\system32\*.tmp files -> C:\windows\system32\*.tmp -> ]
 
========== Alternate Data Streams ==========
 
@Alternate Data Stream - 164 bytes -> C:\Users\Sandra\Documents\T-Mobile Vertragskündigung.docx.jpeg:3or4kl4x13tuuug3Byamue2s4b
@Alternate Data Stream - 164 bytes -> C:\Users\Sandra\Documents\sig sandfa.jpg:3or4kl4x13tuuug3Byamue2s4b

< End of report >
Vielen herzlichen Dank für die Bemühungen!!!:knuddel:

Frage,

da ist ein zweites log betitelt mit "Extras.txt" auch aufgegangen. Soll ich das auch hierher kopieren?

cosinus 02.07.2012 14:13
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKLM\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778
FF - prefs.js..browser.search.defaultengine: "Ask.com"
FF - prefs.js..browser.search.defaultenginename: "Ask.com"
FF - prefs.js..browser.search.order.1: "Ask.com"
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://www.ask.com/?l=dis&o=1586&gct=hp
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\URLSearchHook: {ff88a983-649d-4207-9336-9b999280b436} - No CLSID value found
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\SearchScopes,DefaultScope = {67A2568C-7A0A-4EED-AECC-B5405DE63B64}
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = http://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}: "URL" = http://search.conduit.com/ResultsExt.aspx?q={searchTerms}&SearchSource=4&ctid=CT3031778
IE - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\SearchScopes\{C0B6FD25-BB4E-4108-921C-0848B2E7E369}: "URL" = http://websearch.ask.com/redirect?client=ie&tb=DVS2&o=1586&src=crm&q={searchTerms}&locale=&apn_ptnrs=^AAA&apn_dtid=^YYYYYY^YY^AT&apn_uid=f1d5defc-1291-40c9-b34e-5aa4abd1dbdd&apn_sauid=533F215B-BFAA-4D44-8C83-9860CE93F962
O3 - HKLM\..\Toolbar: (no name) - Locked - No CLSID value found.
O3 - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\Toolbar\WebBrowser: (no name) - {D4027C7F-154A-4066-A1AD-4243D8127440} - No CLSID value found.
O3 - HKU\S-1-5-21-1824515743-1129300623-418782207-1000\..\Toolbar\WebBrowser: (no name) - {FF88A983-649D-4207-9336-9B999280B436} - No CLSID value found.
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 5
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O32 - HKLM CDRom: AutoRun - 1
O32 - AutoRun File - [2009/06/10 23:42:20 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
O33 - MountPoints2\{2d2da28b-a951-11e1-b494-001bb1166a05}\Shell - "" = AutoRun
O33 - MountPoints2\{2d2da28b-a951-11e1-b494-001bb1166a05}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{2d2da29d-a951-11e1-b494-001bb1166a05}\Shell - "" = AutoRun
O33 - MountPoints2\{2d2da29d-a951-11e1-b494-001bb1166a05}\Shell\AutoRun\command - "" = F:\AutoRun.exe
O33 - MountPoints2\{50f77daf-c1ab-11e0-9326-001bb1166a05}\Shell - "" = AutoRun
O33 - MountPoints2\{50f77daf-c1ab-11e0-9326-001bb1166a05}\Shell\AutoRun\command - "" = F:\setup_vmc_lite.exe /checkApplicationPresence
O33 - MountPoints2\F\Shell - "" = AutoRun
O33 - MountPoints2\F\Shell\AutoRun\command - "" = F:\AutoRun.exe
[2012/06/17 00:39:07 | 000,000,000 | ---D | C] -- C:\88a3095b5aeba41de7
[2012/06/03 14:47:04 | 000,000,000 | ---D | C] -- C:\ProgramData\435E
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

vivacitas83 02.07.2012 18:26
ok, hier nun das aktuelle log:

Code:

All processes killed
========== OTL ==========
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Prefs.js: "Ask.com" removed from browser.search.defaultengine
Prefs.js: "Ask.com" removed from browser.search.defaultenginename
Prefs.js: "Ask.com" removed from browser.search.order.1
HKU\S-1-5-21-1824515743-1129300623-418782207-1000\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1824515743-1129300623-418782207-1000\Software\Microsoft\Internet Explorer\URLSearchHooks\\{ff88a983-649d-4207-9336-9b999280b436} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{ff88a983-649d-4207-9336-9b999280b436}\ not found.
HKEY_USERS\S-1-5-21-1824515743-1129300623-418782207-1000\Software\Microsoft\Internet Explorer\SearchScopes\\DefaultScope| /E : value set successfully!
Registry key HKEY_USERS\S-1-5-21-1824515743-1129300623-418782207-1000\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}\ not found.
Registry key HKEY_USERS\S-1-5-21-1824515743-1129300623-418782207-1000\Software\Microsoft\Internet Explorer\SearchScopes\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{afdbddaa-5d3f-42ee-b79c-185a7020515b}\ not found.
Registry key HKEY_USERS\S-1-5-21-1824515743-1129300623-418782207-1000\Software\Microsoft\Internet Explorer\SearchScopes\{C0B6FD25-BB4E-4108-921C-0848B2E7E369}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{C0B6FD25-BB4E-4108-921C-0848B2E7E369}\ not found.
Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Internet Explorer\Toolbar\\Locked deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1824515743-1129300623-418782207-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{D4027C7F-154A-4066-A1AD-4243D8127440} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{D4027C7F-154A-4066-A1AD-4243D8127440}\ not found.
Registry value HKEY_USERS\S-1-5-21-1824515743-1129300623-418782207-1000\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{FF88A983-649D-4207-9336-9B999280B436} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{FF88A983-649D-4207-9336-9B999280B436}\ not found.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\Cdrom\\AutoRun|DWORD:1 /E : value set successfully!
C:\autoexec.bat moved successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d2da28b-a951-11e1-b494-001bb1166a05}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2d2da28b-a951-11e1-b494-001bb1166a05}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d2da28b-a951-11e1-b494-001bb1166a05}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2d2da28b-a951-11e1-b494-001bb1166a05}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d2da29d-a951-11e1-b494-001bb1166a05}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2d2da29d-a951-11e1-b494-001bb1166a05}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{2d2da29d-a951-11e1-b494-001bb1166a05}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{2d2da29d-a951-11e1-b494-001bb1166a05}\ not found.
File F:\AutoRun.exe not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50f77daf-c1ab-11e0-9326-001bb1166a05}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50f77daf-c1ab-11e0-9326-001bb1166a05}\ not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{50f77daf-c1ab-11e0-9326-001bb1166a05}\ not found.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{50f77daf-c1ab-11e0-9326-001bb1166a05}\ not found.
File F:\setup_vmc_lite.exe /checkApplicationPresence not found.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ deleted successfully.
Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\F\ not found.
File F:\AutoRun.exe not found.
Folder move failed. C:\88a3095b5aeba41de7\Graphics scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\3082 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\3076 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\2070 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\2052 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1055 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1053 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1049 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1046 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1045 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1044 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1043 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1042 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1041 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1040 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1038 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1037 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1036 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1035 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1033 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1032 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1031 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1030 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1029 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1028 scheduled to be moved on reboot.
Folder move failed. C:\88a3095b5aeba41de7\1025 scheduled to be moved on reboot.
C:\88a3095b5aeba41de7 folder moved successfully.
C:\ProgramData\435E folder moved successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 56468 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Gast
->Temp folder emptied: 7138420 bytes
->Temporary Internet Files folder emptied: 37163814 bytes
->FireFox cache emptied: 1023170825 bytes
->Flash cache emptied: 60696 bytes
 
User: Public
 
User: Sandra
->Temp folder emptied: 8462794 bytes
->Temporary Internet Files folder emptied: 10729074 bytes
->Java cache emptied: 1663712 bytes
->FireFox cache emptied: 155077942 bytes
->Flash cache emptied: 60023 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 0 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 38591358 bytes
%systemroot%\system32\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 18139064 bytes
%systemroot%\system32\config\systemprofile\AppData\LocalLow\Sun\Java\Deployment folder emptied: 743 bytes
RecycleBin emptied: 357112 bytes
 
Total Files Cleaned = 1,240.00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Gast
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Sandra
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0.00 mb
 
C:\windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.53.1 log created on 07022012_185131

Files\Folders moved on Reboot...
File\Folder C:\88a3095b5aeba41de7\Graphics not found!
File\Folder C:\88a3095b5aeba41de7\3082 not found!
File\Folder C:\88a3095b5aeba41de7\3076 not found!
File\Folder C:\88a3095b5aeba41de7\2070 not found!
File\Folder C:\88a3095b5aeba41de7\2052 not found!
File\Folder C:\88a3095b5aeba41de7\1055 not found!
File\Folder C:\88a3095b5aeba41de7\1053 not found!
File\Folder C:\88a3095b5aeba41de7\1049 not found!
File\Folder C:\88a3095b5aeba41de7\1046 not found!
File\Folder C:\88a3095b5aeba41de7\1045 not found!
File\Folder C:\88a3095b5aeba41de7\1044 not found!
File\Folder C:\88a3095b5aeba41de7\1043 not found!
File\Folder C:\88a3095b5aeba41de7\1042 not found!
File\Folder C:\88a3095b5aeba41de7\1041 not found!
File\Folder C:\88a3095b5aeba41de7\1040 not found!
File\Folder C:\88a3095b5aeba41de7\1038 not found!
File\Folder C:\88a3095b5aeba41de7\1037 not found!
File\Folder C:\88a3095b5aeba41de7\1036 not found!
File\Folder C:\88a3095b5aeba41de7\1035 not found!
File\Folder C:\88a3095b5aeba41de7\1033 not found!
File\Folder C:\88a3095b5aeba41de7\1032 not found!
File\Folder C:\88a3095b5aeba41de7\1031 not found!
File\Folder C:\88a3095b5aeba41de7\1030 not found!
File\Folder C:\88a3095b5aeba41de7\1029 not found!
File\Folder C:\88a3095b5aeba41de7\1028 not found!
File\Folder C:\88a3095b5aeba41de7\1025 not found!

PendingFileRenameOperations files...
File C:\88a3095b5aeba41de7\Graphics not found!
File C:\88a3095b5aeba41de7\3082 not found!
File C:\88a3095b5aeba41de7\3076 not found!
File C:\88a3095b5aeba41de7\2070 not found!
File C:\88a3095b5aeba41de7\2052 not found!
File C:\88a3095b5aeba41de7\1055 not found!
File C:\88a3095b5aeba41de7\1053 not found!
File C:\88a3095b5aeba41de7\1049 not found!
File C:\88a3095b5aeba41de7\1046 not found!
File C:\88a3095b5aeba41de7\1045 not found!
File C:\88a3095b5aeba41de7\1044 not found!
File C:\88a3095b5aeba41de7\1043 not found!
File C:\88a3095b5aeba41de7\1042 not found!
File C:\88a3095b5aeba41de7\1041 not found!
File C:\88a3095b5aeba41de7\1040 not found!
File C:\88a3095b5aeba41de7\1038 not found!
File C:\88a3095b5aeba41de7\1037 not found!
File C:\88a3095b5aeba41de7\1036 not found!
File C:\88a3095b5aeba41de7\1035 not found!
File C:\88a3095b5aeba41de7\1033 not found!
File C:\88a3095b5aeba41de7\1032 not found!
File C:\88a3095b5aeba41de7\1031 not found!
File C:\88a3095b5aeba41de7\1030 not found!
File C:\88a3095b5aeba41de7\1029 not found!
File C:\88a3095b5aeba41de7\1028 not found!
File C:\88a3095b5aeba41de7\1025 not found!

Registry entries deleted on Reboot...
War´s das? Weiss man warum das passiert?:heulen:

cosinus 03.07.2012 11:35
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

vivacitas83 03.07.2012 12:38
Puhh, das wird echt kompliziert. Hoffe dies ist das richtige:


Code:
13:28:32.0663 6012        TDSS rootkit removing tool 2.7.44.0 Jul  2 2012 20:01:08
13:28:32.0942 6012        ============================================================
13:28:32.0942 6012        Current date / time: 2012/07/03 13:28:32.0942
13:28:32.0942 6012        SystemInfo:
13:28:32.0942 6012       
13:28:32.0942 6012        OS Version: 6.1.7601 ServicePack: 1.0
13:28:32.0942 6012        Product type: Workstation
13:28:32.0942 6012        ComputerName: SANDRA-NOTEBOOK
13:28:32.0942 6012        UserName: Sandra
13:28:32.0942 6012        Windows directory: C:\windows
13:28:32.0942 6012        System windows directory: C:\windows
13:28:32.0942 6012        Processor architecture: Intel x86
13:28:32.0942 6012        Number of processors: 4
13:28:32.0942 6012        Page size: 0x1000
13:28:32.0942 6012        Boot type: Normal boot
13:28:32.0942 6012        ============================================================
13:28:33.0610 6012        Drive \Device\Harddisk0\DR0 - Size: 0x7470C06000 (465.76 Gb), SectorSize: 0x200, Cylinders: 0xED81, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
13:28:33.0613 6012        ============================================================
13:28:33.0613 6012        \Device\Harddisk0\DR0:
13:28:33.0613 6012        MBR partitions:
13:28:33.0613 6012        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x2800800, BlocksNum 0x32000
13:28:33.0613 6012        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x2832800, BlocksNum 0x12E00000
13:28:33.0629 6012        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x15633000, BlocksNum 0x24D52800
13:28:33.0629 6012        ============================================================
13:28:33.0660 6012        C: <-> \Device\Harddisk0\DR0\Partition1
13:28:33.0744 6012        D: <-> \Device\Harddisk0\DR0\Partition2
13:28:33.0744 6012        ============================================================
13:28:33.0744 6012        Initialize success
13:28:33.0744 6012        ============================================================
13:29:26.0587 0716        ============================================================
13:29:26.0587 0716        Scan started
13:29:26.0587 0716        Mode: Manual; SigCheck; TDLFS;
13:29:26.0587 0716        ============================================================
13:29:27.0237 0716        !SASCORE        (c0393eb99a6c72c6bef9bfc4a72b33a6) C:\Program Files\SUPERAntiSpyware\SASCORE.EXE
13:29:27.0278 0716        !SASCORE - ok
13:29:27.0510 0716        1394ohci        (1b133875b8aa8ac48969bd3458afe9f5) C:\windows\system32\drivers\1394ohci.sys
13:29:27.0577 0716        1394ohci - ok
13:29:27.0646 0716        ACPI            (cea80c80bed809aa0da6febc04733349) C:\windows\system32\drivers\ACPI.sys
13:29:27.0662 0716        ACPI - ok
13:29:27.0703 0716        AcpiPmi        (1efbc664abff416d1d07db115dcb264f) C:\windows\system32\drivers\acpipmi.sys
13:29:27.0791 0716        AcpiPmi - ok
13:29:27.0950 0716        Ad-Aware Service (09e61047b0cef21559cfcedf4f14d216) C:\Program Files\Ad-Aware Antivirus\AdAwareService.exe
13:29:27.0980 0716        Ad-Aware Service - ok
13:29:28.0075 0716        adp94xx        (21e785ebd7dc90a06391141aac7892fb) C:\windows\system32\DRIVERS\adp94xx.sys
13:29:28.0097 0716        adp94xx - ok
13:29:28.0118 0716        adpahci        (0c676bc278d5b59ff5abd57bbe9123f2) C:\windows\system32\DRIVERS\adpahci.sys
13:29:28.0136 0716        adpahci - ok
13:29:28.0147 0716        adpu320        (7c7b5ee4b7b822ec85321fe23a27db33) C:\windows\system32\DRIVERS\adpu320.sys
13:29:28.0162 0716        adpu320 - ok
13:29:28.0194 0716        AeLookupSvc    (8b5eefeec1e6d1a72a06c526628ad161) C:\windows\System32\aelupsvc.dll
13:29:28.0252 0716        AeLookupSvc - ok
13:29:28.0334 0716        AFD            (9ebbba55060f786f0fcaa3893bfa2806) C:\windows\system32\drivers\afd.sys
13:29:28.0384 0716        AFD - ok
13:29:28.0438 0716        agp440          (507812c3054c21cef746b6ee3d04dd6e) C:\windows\system32\drivers\agp440.sys
13:29:28.0450 0716        agp440 - ok
13:29:28.0504 0716        aic78xx        (8b30250d573a8f6b4bd23195160d8707) C:\windows\system32\DRIVERS\djsvs.sys
13:29:28.0517 0716        aic78xx - ok
13:29:28.0581 0716        ALG            (18a54e132947cd98fea9accc57f98f13) C:\windows\System32\alg.exe
13:29:28.0648 0716        ALG - ok
13:29:28.0688 0716        aliide          (0d40bcf52ea90fc7df2aeab6503dea44) C:\windows\system32\drivers\aliide.sys
13:29:28.0700 0716        aliide - ok
13:29:28.0738 0716        amdagp          (3c6600a0696e90a463771c7422e23ab5) C:\windows\system32\drivers\amdagp.sys
13:29:28.0750 0716        amdagp - ok
13:29:28.0782 0716        amdide          (cd5914170297126b6266860198d1d4f0) C:\windows\system32\drivers\amdide.sys
13:29:28.0794 0716        amdide - ok
13:29:28.0830 0716        AmdK8          (00dda200d71bac534bf56a9db5dfd666) C:\windows\system32\DRIVERS\amdk8.sys
13:29:28.0885 0716        AmdK8 - ok
13:29:28.0909 0716        AmdPPM          (3cbf30f5370fda40dd3e87df38ea53b6) C:\windows\system32\DRIVERS\amdppm.sys
13:29:28.0948 0716        AmdPPM - ok
13:29:28.0994 0716        amdsata        (d320bf87125326f996d4904fe24300fc) C:\windows\system32\drivers\amdsata.sys
13:29:29.0007 0716        amdsata - ok
13:29:29.0035 0716        amdsbs          (ea43af0c423ff267355f74e7a53bdaba) C:\windows\system32\DRIVERS\amdsbs.sys
13:29:29.0050 0716        amdsbs - ok
13:29:29.0061 0716        amdxata        (46387fb17b086d16dea267d5be23a2f2) C:\windows\system32\drivers\amdxata.sys
13:29:29.0072 0716        amdxata - ok
13:29:29.0120 0716        androidusb      (dd8d9c597af7cd2f6b70a3d6a4a1acea) C:\windows\system32\Drivers\ssadadb.sys
13:29:29.0173 0716        androidusb - ok
13:29:29.0306 0716        AntiVirSchedulerService (c27d46b06d340293670450fce9dfb166) C:\Program Files\Avira\AntiVir Desktop\sched.exe
13:29:29.0316 0716        AntiVirSchedulerService - ok
13:29:29.0356 0716        AntiVirService  (72d90e56563165984224493069c69ed4) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
13:29:29.0367 0716        AntiVirService - ok
13:29:29.0420 0716        AppID          (aea177f783e20150ace5383ee368da19) C:\windows\system32\drivers\appid.sys
13:29:29.0534 0716        AppID - ok
13:29:29.0584 0716        AppIDSvc        (62a9c86cb6085e20db4823e4e97826f5) C:\windows\System32\appidsvc.dll
13:29:29.0646 0716        AppIDSvc - ok
13:29:29.0698 0716        Appinfo        (fb1959012294d6ad43e5304df65e3c26) C:\windows\System32\appinfo.dll
13:29:29.0747 0716        Appinfo - ok
13:29:29.0785 0716        arc            (2932004f49677bd84dbc72edb754ffb3) C:\windows\system32\DRIVERS\arc.sys
13:29:29.0798 0716        arc - ok
13:29:29.0815 0716        arcsas          (5d6f36c46fd283ae1b57bd2e9feb0bc7) C:\windows\system32\DRIVERS\arcsas.sys
13:29:29.0828 0716        arcsas - ok
13:29:29.0864 0716        AsyncMac        (add2ade1c2b285ab8378d2daaf991481) C:\windows\system32\DRIVERS\asyncmac.sys
13:29:29.0971 0716        AsyncMac - ok
13:29:30.0026 0716        atapi          (338c86357871c167a96ab976519bf59e) C:\windows\system32\drivers\atapi.sys
13:29:30.0038 0716        atapi - ok
13:29:30.0119 0716        AudioEndpointBuilder (ce3b4e731638d2ef62fcb419be0d39f0) C:\windows\System32\Audiosrv.dll
13:29:30.0168 0716        AudioEndpointBuilder - ok
13:29:30.0173 0716        Audiosrv        (ce3b4e731638d2ef62fcb419be0d39f0) C:\windows\System32\Audiosrv.dll
13:29:30.0207 0716        Audiosrv - ok
13:29:30.0243 0716        avgntflt        (1e4114685de1ffa9675e09c6a1fb3f4b) C:\windows\system32\DRIVERS\avgntflt.sys
13:29:30.0254 0716        avgntflt - ok
13:29:30.0300 0716        avipbb          (0f78d3dae6dedd99ae54c9491c62adf2) C:\windows\system32\DRIVERS\avipbb.sys
13:29:30.0313 0716        avipbb - ok
13:29:30.0360 0716        AxInstSV        (6e30d02aac9cac84f421622e3a2f6178) C:\windows\System32\AxInstSV.dll
13:29:30.0434 0716        AxInstSV - ok
13:29:30.0527 0716        b06bdrv        (1a231abec60fd316ec54c66715543cec) C:\windows\system32\DRIVERS\bxvbdx.sys
13:29:30.0586 0716        b06bdrv - ok
13:29:30.0641 0716        b57nd60x        (bd8869eb9cde6bbe4508d869929869ee) C:\windows\system32\DRIVERS\b57nd60x.sys
13:29:30.0680 0716        b57nd60x - ok
13:29:30.0931 0716        BCM43XX        (55bbdde1cbd3fa79ea88baaa051d9735) C:\windows\system32\DRIVERS\bcmwl6.sys
13:29:30.0986 0716        BCM43XX - ok
13:29:31.0152 0716        BDESVC          (ee1e9c3bb8228ae423dd38db69128e71) C:\windows\System32\bdesvc.dll
13:29:31.0218 0716        BDESVC - ok
13:29:31.0294 0716        Beep            (505506526a9d467307b3c393dedaf858) C:\windows\system32\drivers\Beep.sys
13:29:31.0345 0716        Beep - ok
13:29:31.0416 0716        BFE            (1e2bac209d184bb851e1a187d8a29136) C:\windows\System32\bfe.dll
13:29:31.0469 0716        BFE - ok
13:29:31.0549 0716        BITS            (e585445d5021971fae10393f0f1c3961) C:\windows\System32\qmgr.dll
13:29:31.0602 0716        BITS - ok
13:29:31.0652 0716        blbdrive        (2287078ed48fcfc477b05b20cf38f36f) C:\windows\system32\DRIVERS\blbdrive.sys
13:29:31.0683 0716        blbdrive - ok
13:29:31.0739 0716        BMLoad          (d002033c1a37f6af51b5f0ba6d0211bc) C:\windows\system32\drivers\BMLoad.sys
13:29:31.0757 0716        BMLoad ( UnsignedFile.Multi.Generic ) - warning
13:29:31.0757 0716        BMLoad - detected UnsignedFile.Multi.Generic (1)
13:29:31.0800 0716        bowser          (8f2da3028d5fcbd1a060a3de64cd6506) C:\windows\system32\DRIVERS\bowser.sys
13:29:31.0844 0716        bowser - ok
13:29:31.0861 0716        BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\windows\system32\DRIVERS\BrFiltLo.sys
13:29:31.0944 0716        BrFiltLo - ok
13:29:31.0966 0716        BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\windows\system32\DRIVERS\BrFiltUp.sys
13:29:32.0006 0716        BrFiltUp - ok
13:29:32.0063 0716        Browser        (6e11f33d14d020f58d5e02e4d67dfa19) C:\windows\System32\browser.dll
13:29:32.0105 0716        Browser - ok
13:29:32.0142 0716        Brserid        (845b8ce732e67f3b4133164868c666ea) C:\windows\System32\Drivers\Brserid.sys
13:29:32.0202 0716        Brserid - ok
13:29:32.0219 0716        BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\windows\System32\Drivers\BrSerWdm.sys
13:29:32.0251 0716        BrSerWdm - ok
13:29:32.0283 0716        BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\windows\System32\Drivers\BrUsbMdm.sys
13:29:32.0317 0716        BrUsbMdm - ok
13:29:32.0335 0716        BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\windows\System32\Drivers\BrUsbSer.sys
13:29:32.0372 0716        BrUsbSer - ok
13:29:32.0426 0716        BthEnum        (2865a5c8e98c70c605f417908cebb3a4) C:\windows\system32\drivers\BthEnum.sys
13:29:32.0485 0716        BthEnum - ok
13:29:32.0500 0716        BTHMODEM        (ed3df7c56ce0084eb2034432fc56565a) C:\windows\system32\DRIVERS\bthmodem.sys
13:29:32.0538 0716        BTHMODEM - ok
13:29:32.0572 0716        BthPan          (ad1872e5829e8a2c3b5b4b641c3eab0e) C:\windows\system32\DRIVERS\bthpan.sys
13:29:32.0608 0716        BthPan - ok
13:29:32.0663 0716        BTHPORT        (c2fbf6d271d9a94d839c416bf186ead9) C:\windows\System32\Drivers\BTHport.sys
13:29:32.0711 0716        BTHPORT - ok
13:29:32.0770 0716        bthserv        (1df19c96eef6c29d1c3e1a8678e07190) C:\windows\system32\bthserv.dll
13:29:32.0824 0716        bthserv - ok
13:29:32.0864 0716        BTHUSB          (c81e9413a25a439f436b1d4b6a0cf9e9) C:\windows\System32\Drivers\BTHUSB.sys
13:29:32.0890 0716        BTHUSB - ok
13:29:32.0945 0716        btwampfl        (ad1aa3b85f1b9125e31935df98266b37) C:\windows\system32\drivers\btwampfl.sys
13:29:32.0961 0716        btwampfl - ok
13:29:33.0001 0716        btwaudio        (d146b5897a47500444bfa1f2cb2e3173) C:\windows\system32\drivers\btwaudio.sys
13:29:33.0013 0716        btwaudio - ok
13:29:33.0082 0716        btwavdt        (1f9cd885f1c548be93962ccabdb632e4) C:\windows\system32\DRIVERS\btwavdt.sys
13:29:33.0095 0716        btwavdt - ok
13:29:33.0254 0716        btwdins        (765c410d031b9d55bfe09fe3f233262a) C:\Program Files\WIDCOMM\Bluetooth Software\btwdins.exe
13:29:33.0272 0716        btwdins - ok
13:29:33.0307 0716        btwl2cap        (de53089f0678cb5f0afeb867acb0fb05) C:\windows\system32\DRIVERS\btwl2cap.sys
13:29:33.0317 0716        btwl2cap - ok
13:29:33.0348 0716        btwrchid        (a2d6c7b7b62a6c42dcb01204a6bd6fc2) C:\windows\system32\DRIVERS\btwrchid.sys
13:29:33.0358 0716        btwrchid - ok
13:29:33.0407 0716        cdfs            (77ea11b065e0a8ab902d78145ca51e10) C:\windows\system32\DRIVERS\cdfs.sys
13:29:33.0454 0716        cdfs - ok
13:29:33.0505 0716        cdrom          (be167ed0fdb9c1fa1133953c18d5a6c9) C:\windows\system32\DRIVERS\cdrom.sys
13:29:33.0533 0716        cdrom - ok
13:29:33.0573 0716        CertPropSvc    (319c6b309773d063541d01df8ac6f55f) C:\windows\System32\certprop.dll
13:29:33.0621 0716        CertPropSvc - ok
13:29:33.0660 0716        circlass        (3fe3fe94a34df6fb06e6418d0f6a0060) C:\windows\system32\DRIVERS\circlass.sys
13:29:33.0695 0716        circlass - ok
13:29:33.0757 0716        CLFS            (635181e0e9bbf16871bf5380d71db02d) C:\windows\system32\CLFS.sys
13:29:33.0772 0716        CLFS - ok
13:29:33.0859 0716        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
13:29:33.0871 0716        clr_optimization_v2.0.50727_32 - ok
13:29:33.0964 0716        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
13:29:33.0989 0716        clr_optimization_v4.0.30319_32 - ok
13:29:34.0012 0716        CmBatt          (dea805815e587dad1dd2c502220b5616) C:\windows\system32\DRIVERS\CmBatt.sys
13:29:34.0042 0716        CmBatt - ok
13:29:34.0071 0716        cmdide          (c537b1db64d495b9b4717b4d6d9edbf2) C:\windows\system32\drivers\cmdide.sys
13:29:34.0083 0716        cmdide - ok
13:29:34.0168 0716        CNG            (6427525d76f61d0c519b008d3680e8e7) C:\windows\system32\Drivers\cng.sys
13:29:34.0190 0716        CNG - ok
13:29:34.0239 0716        Compbatt        (a6023d3823c37043986713f118a89bee) C:\windows\system32\DRIVERS\compbatt.sys
13:29:34.0250 0716        Compbatt - ok
13:29:34.0318 0716        CompositeBus    (cbe8c58a8579cfe5fccf809e6f114e89) C:\windows\system32\drivers\CompositeBus.sys
13:29:34.0347 0716        CompositeBus - ok
13:29:34.0360 0716        COMSysApp - ok
13:29:34.0378 0716        crcdisk        (2c4ebcfc84a9b44f209dff6c6e6c61d1) C:\windows\system32\DRIVERS\crcdisk.sys
13:29:34.0390 0716        crcdisk - ok
13:29:34.0437 0716        CryptSvc        (06e771aa596b8761107ab57e99f128d7) C:\windows\system32\cryptsvc.dll
13:29:34.0493 0716        CryptSvc - ok
13:29:34.0678 0716        cvhsvc          (72794d112cbaff3bc0c29bf7350d4741) C:\Program Files\Common Files\Microsoft Shared\Virtualization Handler\CVHSVC.EXE
13:29:34.0703 0716        cvhsvc - ok
13:29:34.0791 0716        DcomLaunch      (7660f01d3b38aca1747e397d21d790af) C:\windows\system32\rpcss.dll
13:29:34.0830 0716        DcomLaunch - ok
13:29:34.0883 0716        defragsvc      (8d6e10a2d9a5eed59562d9b82cf804e1) C:\windows\System32\defragsvc.dll
13:29:34.0934 0716        defragsvc - ok
13:29:35.0004 0716        DfsC            (f024449c97ec1e464aaffda18593db88) C:\windows\system32\Drivers\dfsc.sys
13:29:35.0033 0716        DfsC - ok
13:29:35.0100 0716        Dhcp            (e9e01eb683c132f7fa27cd607b8a2b63) C:\windows\system32\dhcpcore.dll
13:29:35.0153 0716        Dhcp - ok
13:29:35.0185 0716        discache        (1a050b0274bfb3890703d490f330c0da) C:\windows\system32\drivers\discache.sys
13:29:35.0228 0716        discache - ok
13:29:35.0261 0716        Disk            (565003f326f99802e68ca78f2a68e9ff) C:\windows\system32\DRIVERS\disk.sys
13:29:35.0273 0716        Disk - ok
13:29:35.0320 0716        Dnscache        (33ef4861f19a0736b11314aad9ae28d0) C:\windows\System32\dnsrslvr.dll
13:29:35.0368 0716        Dnscache - ok
13:29:35.0422 0716        dot3svc        (366ba8fb4b7bb7435e3b9eacb3843f67) C:\windows\System32\dot3svc.dll
13:29:35.0468 0716        dot3svc - ok
13:29:35.0512 0716        DPS            (8ec04ca86f1d68da9e11952eb85973d6) C:\windows\system32\dps.dll
13:29:35.0572 0716        DPS - ok
13:29:35.0612 0716        drmkaud        (b918e7c5f9bf77202f89e1a9539f2eb4) C:\windows\system32\drivers\drmkaud.sys
13:29:35.0650 0716        drmkaud - ok
13:29:35.0833 0716        DXGKrnl        (23f5d28378a160352ba8f817bd8c71cb) C:\windows\System32\drivers\dxgkrnl.sys
13:29:35.0889 0716        DXGKrnl - ok
13:29:35.0920 0716        EapHost        (8600142fa91c1b96367d3300ad0f3f3a) C:\windows\System32\eapsvc.dll
13:29:35.0970 0716        EapHost - ok
13:29:36.0229 0716        ebdrv          (024e1b5cac09731e4d868e64dbfb4ab0) C:\windows\system32\DRIVERS\evbdx.sys
13:29:36.0311 0716        ebdrv - ok
13:29:36.0457 0716        EFS            (81951f51e318aecc2d68559e47485cc4) C:\windows\System32\lsass.exe
13:29:36.0509 0716        EFS - ok
13:29:36.0609 0716        ehRecvr        (a8c362018efc87beb013ee28f29c0863) C:\windows\ehome\ehRecvr.exe
13:29:36.0665 0716        ehRecvr - ok
13:29:36.0702 0716        ehSched        (d389bff34f80caede417bf9d1507996a) C:\windows\ehome\ehsched.exe
13:29:36.0727 0716        ehSched - ok
13:29:36.0853 0716        elxstor        (0ed67910c8c326796faa00b2bf6d9d3c) C:\windows\system32\DRIVERS\elxstor.sys
13:29:36.0875 0716        elxstor - ok
13:29:36.0914 0716        ErrDev          (8fc3208352dd3912c94367a206ab3f11) C:\windows\system32\drivers\errdev.sys
13:29:36.0946 0716        ErrDev - ok
13:29:37.0009 0716        EventSystem    (f6916efc29d9953d5d0df06882ae8e16) C:\windows\system32\es.dll
13:29:37.0060 0716        EventSystem - ok
13:29:37.0131 0716        ewusbnet        (7c18a6c99f4119d361a5ca028e788648) C:\windows\system32\DRIVERS\ewusbnet.sys
13:29:37.0174 0716        ewusbnet - ok
13:29:37.0205 0716        exfat          (2dc9108d74081149cc8b651d3a26207f) C:\windows\system32\drivers\exfat.sys
13:29:37.0260 0716        exfat - ok
13:29:37.0288 0716        fastfat        (7e0ab74553476622fb6ae36f73d97d35) C:\windows\system32\drivers\fastfat.sys
13:29:37.0320 0716        fastfat - ok
13:29:37.0414 0716        Fax            (967ea5b213e9984cbe270205df37755b) C:\windows\system32\fxssvc.exe
13:29:37.0470 0716        Fax - ok
13:29:37.0526 0716        fdc            (e817a017f82df2a1f8cfdbda29388b29) C:\windows\system32\DRIVERS\fdc.sys
13:29:37.0557 0716        fdc - ok
13:29:37.0591 0716        fdPHost        (f3222c893bd2f5821a0179e5c71e88fb) C:\windows\system32\fdPHost.dll
13:29:37.0636 0716        fdPHost - ok
13:29:37.0658 0716        FDResPub        (7dbe8cbfe79efbdeb98c9fb08d3a9a5b) C:\windows\system32\fdrespub.dll
13:29:37.0706 0716        FDResPub - ok
13:29:37.0739 0716        FileInfo        (6cf00369c97f3cf563be99be983d13d8) C:\windows\system32\drivers\fileinfo.sys
13:29:37.0751 0716        FileInfo - ok
13:29:37.0755 0716        Filetrace      (42c51dc94c91da21cb9196eb64c45db9) C:\windows\system32\drivers\filetrace.sys
13:29:37.0798 0716        Filetrace - ok
13:29:37.0834 0716        flpydisk        (87907aa70cb3c56600f1c2fb8841579b) C:\windows\system32\DRIVERS\flpydisk.sys
13:29:37.0865 0716        flpydisk - ok
13:29:37.0902 0716        FltMgr          (7520ec808e0c35e0ee6f841294316653) C:\windows\system32\drivers\fltmgr.sys
13:29:37.0916 0716        FltMgr - ok
13:29:38.0019 0716        FontCache      (b3a5ec6b6b6673db7e87c2bcdbddc074) C:\windows\system32\FntCache.dll
13:29:38.0077 0716        FontCache - ok
13:29:38.0149 0716        FontCache3.0.0.0 (e56f39f6b7fda0ac77a79b0fd3de1a2f) C:\windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
13:29:38.0159 0716        FontCache3.0.0.0 - ok
13:29:38.0205 0716        FsDepends      (1a16b57943853e598cff37fe2b8cbf1d) C:\windows\system32\drivers\FsDepends.sys
13:29:38.0218 0716        FsDepends - ok
13:29:38.0258 0716        fssfltr        (b74b0578fd1d3f897e95f2a2b69ea051) C:\windows\system32\DRIVERS\fssfltr.sys
13:29:38.0269 0716        fssfltr - ok
13:29:38.0450 0716        fsssvc          (206ad9a89bf05dfa1621f1fc7b82592d) C:\Program Files\Windows Live\Family Safety\fsssvc.exe
13:29:38.0474 0716        fsssvc - ok
13:29:38.0548 0716        FsUsbExDisk    (cbe5f69a5e5b918225f420ba748f3742) C:\windows\system32\FsUsbExDisk.SYS
13:29:38.0570 0716        FsUsbExDisk ( UnsignedFile.Multi.Generic ) - warning
13:29:38.0570 0716        FsUsbExDisk - detected UnsignedFile.Multi.Generic (1)
13:29:38.0643 0716        FsUsbExService  (96633419f4a1e37acb89b45ebccfe001) C:\windows\system32\FsUsbExService.Exe
13:29:38.0655 0716        FsUsbExService - ok
13:29:38.0681 0716        Fs_Rec          (7dae5ebcc80e45d3253f4923dc424d05) C:\windows\system32\drivers\Fs_Rec.sys
13:29:38.0692 0716        Fs_Rec - ok
13:29:38.0751 0716        fvevol          (8a73e79089b282100b9393b644cb853b) C:\windows\system32\DRIVERS\fvevol.sys
13:29:38.0768 0716        fvevol - ok
13:29:38.0806 0716        gagp30kx        (65ee0c7a58b65e74ae05637418153938) C:\windows\system32\DRIVERS\gagp30kx.sys
13:29:38.0819 0716        gagp30kx - ok
13:29:38.0892 0716        gpsvc          (e897eaf5ed6ba41e081060c9b447a673) C:\windows\System32\gpsvc.dll
13:29:38.0945 0716        gpsvc - ok
13:29:38.0980 0716        hcw85cir        (c44e3c2bab6837db337ddee7544736db) C:\windows\system32\drivers\hcw85cir.sys
13:29:39.0032 0716        hcw85cir - ok
13:29:39.0113 0716        HdAudAddService (a5ef29d5315111c80a5c1abad14c8972) C:\windows\system32\drivers\HdAudio.sys
13:29:39.0145 0716        HdAudAddService - ok
13:29:39.0188 0716        HDAudBus        (9036377b8a6c15dc2eec53e489d159b5) C:\windows\system32\drivers\HDAudBus.sys
13:29:39.0219 0716        HDAudBus - ok
13:29:39.0252 0716        HidBatt        (1d58a7f3e11a9731d0eaaaa8405acc36) C:\windows\system32\DRIVERS\HidBatt.sys
13:29:39.0287 0716        HidBatt - ok
13:29:39.0310 0716        HidBth          (89448f40e6df260c206a193a4683ba78) C:\windows\system32\DRIVERS\hidbth.sys
13:29:39.0338 0716        HidBth - ok
13:29:39.0364 0716        HidIr          (cf50b4cf4a4f229b9f3c08351f99ca5e) C:\windows\system32\DRIVERS\hidir.sys
13:29:39.0395 0716        HidIr - ok
13:29:39.0437 0716        hidserv        (2bc6f6a1992b3a77f5f41432ca6b3b6b) C:\windows\system32\hidserv.dll
13:29:39.0485 0716        hidserv - ok
13:29:39.0524 0716        HidUsb          (10c19f8290891af023eaec0832e1eb4d) C:\windows\system32\DRIVERS\hidusb.sys
13:29:39.0557 0716        HidUsb - ok
13:29:39.0587 0716        hkmsvc          (196b4e3f4cccc24af836ce58facbb699) C:\windows\system32\kmsvc.dll
13:29:39.0616 0716        hkmsvc - ok
13:29:39.0669 0716        HomeGroupListener (6658f4404de03d75fe3ba09f7aba6a30) C:\windows\system32\ListSvc.dll
13:29:39.0714 0716        HomeGroupListener - ok
13:29:39.0767 0716        HomeGroupProvider (dbc02d918fff1cad628acbe0c0eaa8e8) C:\windows\system32\provsvc.dll
13:29:39.0813 0716        HomeGroupProvider - ok
13:29:39.0848 0716        HpSAMD          (295fdc419039090eb8b49ffdbb374549) C:\windows\system32\drivers\HpSAMD.sys
13:29:39.0861 0716        HpSAMD - ok
13:29:39.0939 0716        HTTP            (871917b07a141bff43d76d8844d48106) C:\windows\system32\drivers\HTTP.sys
13:29:39.0971 0716        HTTP - ok
13:29:40.0022 0716        hwdatacard      (988c0a49f09d75d3341cb419141793c1) C:\windows\system32\DRIVERS\ewusbmdm.sys
13:29:40.0074 0716        hwdatacard - ok
13:29:40.0114 0716        hwpolicy        (0c4e035c7f105f1299258c90886c64c5) C:\windows\system32\drivers\hwpolicy.sys
13:29:40.0125 0716        hwpolicy - ok
13:29:40.0169 0716        hwusbdev        (a259d3619aa23d4562581067f85e2006) C:\windows\system32\DRIVERS\ewusbdev.sys
13:29:40.0214 0716        hwusbdev - ok
13:29:40.0270 0716        i8042prt        (f151f0bdc47f4a28b1b20a0818ea36d6) C:\windows\system32\drivers\i8042prt.sys
13:29:40.0285 0716        i8042prt - ok
13:29:40.0344 0716        iaStor          (eb3a2c773e202ced30595bbfad24febf) C:\windows\system32\DRIVERS\iaStor.sys
13:29:40.0362 0716        iaStor - ok
13:29:40.0423 0716        iaStorV        (5cd5f9a5444e6cdcb0ac89bd62d8b76e) C:\windows\system32\drivers\iaStorV.sys
13:29:40.0441 0716        iaStorV - ok
13:29:40.0582 0716        idsvc          (c521d7eb6497bb1af6afa89e322fb43c) C:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
13:29:40.0610 0716        idsvc - ok
13:29:40.0981 0716        igfx            (ad626f6964f4d364d226c39e06872dd3) C:\windows\system32\DRIVERS\igdkmd32.sys
13:29:41.0070 0716        igfx - ok
13:29:41.0244 0716        iirsp          (4173ff5708f3236cf25195fecd742915) C:\windows\system32\DRIVERS\iirsp.sys
13:29:41.0257 0716        iirsp - ok
13:29:41.0349 0716        IKEEXT          (f95622f161474511b8d80d6b093aa610) C:\windows\System32\ikeext.dll
13:29:41.0399 0716        IKEEXT - ok
13:29:41.0463 0716        Impcd          (e3c36ac5ae87ec970ae8ea2a93d59ae1) C:\windows\system32\DRIVERS\Impcd.sys
13:29:41.0517 0716        Impcd - ok
13:29:41.0782 0716        IntcAzAudAddService (f4427e5df32cde359b2e2e5512d18001) C:\windows\system32\drivers\RTKVHDA.sys
13:29:41.0856 0716        IntcAzAudAddService - ok
13:29:42.0039 0716        intelide        (a0f12f2c9ba6c72f3987ce780e77c130) C:\windows\system32\drivers\intelide.sys
13:29:42.0050 0716        intelide - ok
13:29:42.0114 0716        intelppm        (3b514d27bfc4accb4037bc6685f766e0) C:\windows\system32\DRIVERS\intelppm.sys
13:29:42.0141 0716        intelppm - ok
13:29:42.0184 0716        IPBusEnum      (acb364b9075a45c0736e5c47be5cae19) C:\windows\system32\ipbusenum.dll
13:29:42.0217 0716        IPBusEnum - ok
13:29:42.0236 0716        IpFilterDriver  (709d1761d3b19a932ff0238ea6d50200) C:\windows\system32\DRIVERS\ipfltdrv.sys
13:29:42.0280 0716        IpFilterDriver - ok
13:29:42.0361 0716        iphlpsvc        (4d65a07b795d6674312f879d09aa7663) C:\windows\System32\iphlpsvc.dll
13:29:42.0408 0716        iphlpsvc - ok
13:29:42.0438 0716        IPMIDRV        (4bd7134618c1d2a27466a099062547bf) C:\windows\system32\drivers\IPMIDrv.sys
13:29:42.0469 0716        IPMIDRV - ok
13:29:42.0504 0716        IPNAT          (a5fa468d67abcdaa36264e463a7bb0cd) C:\windows\system32\drivers\ipnat.sys
13:29:42.0537 0716        IPNAT - ok
13:29:42.0554 0716        IRENUM          (42996cff20a3084a56017b7902307e9f) C:\windows\system32\drivers\irenum.sys
13:29:42.0616 0716        IRENUM - ok
13:29:42.0665 0716        isapnp          (1f32bb6b38f62f7df1a7ab7292638a35) C:\windows\system32\drivers\isapnp.sys
13:29:42.0678 0716        isapnp - ok
13:29:42.0730 0716        iScsiPrt        (cb7a9abb12b8415bce5d74994c7ba3ae) C:\windows\system32\drivers\msiscsi.sys
13:29:42.0746 0716        iScsiPrt - ok
13:29:42.0769 0716        kbdclass        (adef52ca1aeae82b50df86b56413107e) C:\windows\system32\drivers\kbdclass.sys
13:29:42.0781 0716        kbdclass - ok
13:29:42.0819 0716        kbdhid          (9e3ced91863e6ee98c24794d05e27a71) C:\windows\system32\drivers\kbdhid.sys
13:29:42.0852 0716        kbdhid - ok
13:29:42.0889 0716        KeyIso          (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
13:29:42.0902 0716        KeyIso - ok
13:29:42.0927 0716        KSecDD          (f4647bb23db9038a7536cf6b68f4207f) C:\windows\system32\Drivers\ksecdd.sys
13:29:42.0939 0716        KSecDD - ok
13:29:42.0979 0716        KSecPkg        (e73cae53bbb72ba26918492c6b4c229d) C:\windows\system32\Drivers\ksecpkg.sys
13:29:42.0992 0716        KSecPkg - ok
13:29:43.0034 0716        KtmRm          (89a7b9cc98d0d80c6f31b91c0a310fcd) C:\windows\system32\msdtckrm.dll
13:29:43.0081 0716        KtmRm - ok
13:29:43.0140 0716        LanmanServer    (d64af876d53eca3668bb97b51b4e70ab) C:\windows\system32\srvsvc.dll
13:29:43.0183 0716        LanmanServer - ok
13:29:43.0221 0716        LanmanWorkstation (58405e4f68ba8e4057c6e914f326aba2) C:\windows\System32\wkssvc.dll
13:29:43.0264 0716        LanmanWorkstation - ok
13:29:43.0316 0716        lltdio          (f7611ec07349979da9b0ae1f18ccc7a6) C:\windows\system32\DRIVERS\lltdio.sys
13:29:43.0368 0716        lltdio - ok
13:29:43.0409 0716        lltdsvc        (5700673e13a2117fa3b9020c852c01e2) C:\windows\System32\lltdsvc.dll
13:29:43.0454 0716        lltdsvc - ok
13:29:43.0496 0716        lmhosts        (55ca01ba19d0006c8f2639b6c045e08b) C:\windows\System32\lmhsvc.dll
13:29:43.0543 0716        lmhosts - ok
13:29:43.0571 0716        LSI_FC          (eb119a53ccf2acc000ac71b065b78fef) C:\windows\system32\DRIVERS\lsi_fc.sys
13:29:43.0584 0716        LSI_FC - ok
13:29:43.0600 0716        LSI_SAS        (8ade1c877256a22e49b75d1cc9161f9c) C:\windows\system32\DRIVERS\lsi_sas.sys
13:29:43.0612 0716        LSI_SAS - ok
13:29:43.0636 0716        LSI_SAS2        (dc9dc3d3daa0e276fd2ec262e38b11e9) C:\windows\system32\DRIVERS\lsi_sas2.sys
13:29:43.0648 0716        LSI_SAS2 - ok
13:29:43.0657 0716        LSI_SCSI        (0a036c7d7cab643a7f07135ac47e0524) C:\windows\system32\DRIVERS\lsi_scsi.sys
13:29:43.0670 0716        LSI_SCSI - ok
13:29:43.0695 0716        luafv          (6703e366cc18d3b6e534f5cf7df39cee) C:\windows\system32\drivers\luafv.sys
13:29:43.0743 0716        luafv - ok
13:29:43.0801 0716        massfilter      (f0435fe3c1ec2659d2bbf073ca0752ee) C:\windows\system32\DRIVERS\massfilter.sys
13:29:43.0848 0716        massfilter - ok
13:29:43.0898 0716        Mcx2Svc        (bfb9ee8ee977efe85d1a3105abef6dd1) C:\windows\system32\Mcx2Svc.dll
13:29:43.0914 0716        Mcx2Svc - ok
13:29:43.0944 0716        megasas        (0fff5b045293002ab38eb1fd1fc2fb74) C:\windows\system32\DRIVERS\megasas.sys
13:29:43.0956 0716        megasas - ok
13:29:44.0010 0716        MegaSR          (dcbab2920c75f390caf1d29f675d03d6) C:\windows\system32\DRIVERS\MegaSR.sys
13:29:44.0026 0716        MegaSR - ok
13:29:44.0050 0716        MMCSS          (146b6f43a673379a3c670e86d89be5ea) C:\windows\system32\mmcss.dll
13:29:44.0103 0716        MMCSS - ok
13:29:44.0127 0716        Modem          (f001861e5700ee84e2d4e52c712f4964) C:\windows\system32\drivers\modem.sys
13:29:44.0177 0716        Modem - ok
13:29:44.0218 0716        monitor        (79d10964de86b292320e9dfe02282a23) C:\windows\system32\DRIVERS\monitor.sys
13:29:44.0254 0716        monitor - ok
13:29:44.0292 0716        mouclass        (fb18cc1d4c2e716b6b903b0ac0cc0609) C:\windows\system32\DRIVERS\mouclass.sys
13:29:44.0304 0716        mouclass - ok
13:29:44.0341 0716        mouhid          (2c388d2cd01c9042596cf3c8f3c7b24d) C:\windows\system32\DRIVERS\mouhid.sys
13:29:44.0355 0716        mouhid - ok
13:29:44.0402 0716        mountmgr        (fc8771f45ecccfd89684e38842539b9b) C:\windows\system32\drivers\mountmgr.sys
13:29:44.0414 0716        mountmgr - ok
13:29:44.0531 0716        MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files\Mozilla Maintenance Service\maintenanceservice.exe
13:29:44.0544 0716        MozillaMaintenance - ok
13:29:44.0588 0716        mpio            (2d699fb6e89ce0d8da14ecc03b3edfe0) C:\windows\system32\drivers\mpio.sys
13:29:44.0602 0716        mpio - ok
13:29:44.0632 0716        mpsdrv          (ad2723a7b53dd1aacae6ad8c0bfbf4d0) C:\windows\system32\drivers\mpsdrv.sys
13:29:44.0679 0716        mpsdrv - ok
13:29:44.0744 0716        MpsSvc          (9835584e999d25004e1ee8e5f3e3b881) C:\windows\system32\mpssvc.dll
13:29:44.0798 0716        MpsSvc - ok
13:29:44.0835 0716        MRxDAV          (ceb46ab7c01c9f825f8cc6babc18166a) C:\windows\system32\drivers\mrxdav.sys
13:29:44.0875 0716        MRxDAV - ok
13:29:44.0932 0716        mrxsmb          (5d16c921e3671636c0eba3bbaac5fd25) C:\windows\system32\DRIVERS\mrxsmb.sys
13:29:44.0982 0716        mrxsmb - ok
13:29:45.0033 0716        mrxsmb10        (6d17a4791aca19328c685d256349fefc) C:\windows\system32\DRIVERS\mrxsmb10.sys
13:29:45.0060 0716        mrxsmb10 - ok
13:29:45.0086 0716        mrxsmb20        (b81f204d146000be76651a50670a5e9e) C:\windows\system32\DRIVERS\mrxsmb20.sys
13:29:45.0111 0716        mrxsmb20 - ok
13:29:45.0139 0716        msahci          (012c5f4e9349e711e11e0f19a8589f0a) C:\windows\system32\drivers\msahci.sys
13:29:45.0150 0716        msahci - ok
13:29:45.0196 0716        msdsm          (55055f8ad8be27a64c831322a780a228) C:\windows\system32\drivers\msdsm.sys
13:29:45.0210 0716        msdsm - ok
13:29:45.0241 0716        MSDTC          (e1bce74a3bd9902b72599c0192a07e27) C:\windows\System32\msdtc.exe
13:29:45.0271 0716        MSDTC - ok
13:29:45.0318 0716        Msfs            (daefb28e3af5a76abcc2c3078c07327f) C:\windows\system32\drivers\Msfs.sys
13:29:45.0364 0716        Msfs - ok
13:29:45.0386 0716        mshidkmdf      (3e1e5767043c5af9367f0056295e9f84) C:\windows\System32\drivers\mshidkmdf.sys
13:29:45.0433 0716        mshidkmdf - ok
13:29:45.0465 0716        msisadrv        (0a4e5757ae09fa9622e3158cc1aef114) C:\windows\system32\drivers\msisadrv.sys
13:29:45.0476 0716        msisadrv - ok
13:29:45.0535 0716        MSiSCSI        (90f7d9e6b6f27e1a707d4a297f077828) C:\windows\system32\iscsiexe.dll
13:29:45.0584 0716        MSiSCSI - ok
13:29:45.0587 0716        msiserver - ok
13:29:45.0634 0716        MSKSSRV        (8c0860d6366aaffb6c5bb9df9448e631) C:\windows\system32\drivers\MSKSSRV.sys
13:29:45.0676 0716        MSKSSRV - ok
13:29:45.0696 0716        MSPCLOCK        (3ea8b949f963562cedbb549eac0c11ce) C:\windows\system32\drivers\MSPCLOCK.sys
13:29:45.0739 0716        MSPCLOCK - ok
13:29:45.0757 0716        MSPQM          (f456e973590d663b1073e9c463b40932) C:\windows\system32\drivers\MSPQM.sys
13:29:45.0787 0716        MSPQM - ok
13:29:45.0818 0716        MsRPC          (0e008fc4819d238c51d7c93e7b41e560) C:\windows\system32\drivers\MsRPC.sys
13:29:45.0832 0716        MsRPC - ok
13:29:45.0876 0716        mssmbios        (fc6b9ff600cc585ea38b12589bd4e246) C:\windows\system32\drivers\mssmbios.sys
13:29:45.0888 0716        mssmbios - ok
13:29:45.0910 0716        MSTEE          (b42c6b921f61a6e55159b8be6cd54a36) C:\windows\system32\drivers\MSTEE.sys
13:29:45.0940 0716        MSTEE - ok
13:29:45.0961 0716        MTConfig        (33599130f44e1f34631cea241de8ac84) C:\windows\system32\DRIVERS\MTConfig.sys
13:29:45.0997 0716        MTConfig - ok
13:29:46.0022 0716        Mup            (159fad02f64e6381758c990f753bcc80) C:\windows\system32\Drivers\mup.sys
13:29:46.0034 0716        Mup - ok
13:29:46.0091 0716        napagent        (61d57a5d7c6d9afe10e77dae6e1b445e) C:\windows\system32\qagentRT.dll
13:29:46.0140 0716        napagent - ok
13:29:46.0214 0716        NativeWifiP    (26384429fcd85d83746f63e798ab1480) C:\windows\system32\DRIVERS\nwifi.sys
13:29:46.0234 0716        NativeWifiP - ok
13:29:46.0328 0716        NDIS            (e7c54812a2aaf43316eb6930c1ffa108) C:\windows\system32\drivers\ndis.sys
13:29:46.0351 0716        NDIS - ok
13:29:46.0391 0716        NdisCap        (0e1787aa6c9191d3d319e8bafe86f80c) C:\windows\system32\DRIVERS\ndiscap.sys
13:29:46.0432 0716        NdisCap - ok
13:29:46.0461 0716        NdisTapi        (e4a8aec125a2e43a9e32afeea7c9c888) C:\windows\system32\DRIVERS\ndistapi.sys
13:29:46.0506 0716        NdisTapi - ok
13:29:46.0551 0716        Ndisuio        (d8a65dafb3eb41cbb622745676fcd072) C:\windows\system32\DRIVERS\ndisuio.sys
13:29:46.0601 0716        Ndisuio - ok
13:29:46.0638 0716        NdisWan        (38fbe267e7e6983311179230facb1017) C:\windows\system32\DRIVERS\ndiswan.sys
13:29:46.0688 0716        NdisWan - ok
13:29:46.0727 0716        NDProxy        (a4bdc541e69674fbff1a8ff00be913f2) C:\windows\system32\drivers\NDProxy.sys
13:29:46.0774 0716        NDProxy - ok
13:29:46.0823 0716        NetBIOS        (80b275b1ce3b0e79909db7b39af74d51) C:\windows\system32\DRIVERS\netbios.sys
13:29:46.0870 0716        NetBIOS - ok
13:29:46.0921 0716        NetBT          (280122ddcf04b378edd1ad54d71c1e54) C:\windows\system32\DRIVERS\netbt.sys
13:29:46.0967 0716        NetBT - ok
13:29:46.0999 0716        Netlogon        (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
13:29:47.0013 0716        Netlogon - ok
13:29:47.0084 0716        Netman          (7cccfca7510684768da22092d1fa4db2) C:\windows\System32\netman.dll
13:29:47.0131 0716        Netman - ok
13:29:47.0157 0716        netprofm        (8c338238c16777a802d6a9211eb2ba50) C:\windows\System32\netprofm.dll
13:29:47.0204 0716        netprofm - ok
13:29:47.0291 0716        NetTcpPortSharing (f476ec40033cdb91efbe73eb99b8362d) C:\windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
13:29:47.0302 0716        NetTcpPortSharing - ok
13:29:47.0348 0716        nfrd960        (1d85c4b390b0ee09c7a46b91efb2c097) C:\windows\system32\DRIVERS\nfrd960.sys
13:29:47.0361 0716        nfrd960 - ok
13:29:47.0409 0716        NlaSvc          (912084381d30d8b89ec4e293053f4710) C:\windows\System32\nlasvc.dll
13:29:47.0456 0716        NlaSvc - ok
13:29:47.0562 0716        nlsX86cc        (40f7172bc27a2e4197962aa0758c62d4) C:\windows\system32\nlssrv32.exe
13:29:47.0584 0716        nlsX86cc ( UnsignedFile.Multi.Generic ) - warning
13:29:47.0584 0716        nlsX86cc - detected UnsignedFile.Multi.Generic (1)
13:29:47.0608 0716        Npfs            (1db262a9f8c087e8153d89bef3d2235f) C:\windows\system32\drivers\Npfs.sys
13:29:47.0652 0716        Npfs - ok
13:29:47.0683 0716        nsi            (ba387e955e890c8a88306d9b8d06bf17) C:\windows\system32\nsisvc.dll
13:29:47.0714 0716        nsi - ok
13:29:47.0742 0716        nsiproxy        (e9a0a4d07e53d8fea2bb8387a3293c58) C:\windows\system32\drivers\nsiproxy.sys
13:29:47.0791 0716        nsiproxy - ok
13:29:47.0908 0716        Ntfs            (81189c3d7763838e55c397759d49007a) C:\windows\system32\drivers\Ntfs.sys
13:29:47.0939 0716        Ntfs - ok
13:29:47.0962 0716        Null            (f9756a98d69098dca8945d62858a812c) C:\windows\system32\drivers\Null.sys
13:29:47.0992 0716        Null - ok
13:29:48.0054 0716        NVHDA          (8571011b62ce0207fa1dc95d88308f1d) C:\windows\system32\drivers\nvhda32v.sys
13:29:48.0066 0716        NVHDA - ok
13:29:48.0797 0716        nvlddmkm        (f0280a7b9c6483ba7aaa42c0866f1c4a) C:\windows\system32\DRIVERS\nvlddmkm.sys
13:29:49.0091 0716        nvlddmkm - ok
13:29:49.0290 0716        nvraid          (b3e25ee28883877076e0e1ff877d02e0) C:\windows\system32\drivers\nvraid.sys
13:29:49.0303 0716        nvraid - ok
13:29:49.0346 0716        nvstor          (4380e59a170d88c4f1022eff6719a8a4) C:\windows\system32\drivers\nvstor.sys
13:29:49.0360 0716        nvstor - ok
13:29:49.0423 0716        nvsvc          (805d826a6f2521a020f65f87103d8a32) C:\windows\system32\nvvsvc.exe
13:29:49.0438 0716        nvsvc - ok
13:29:49.0488 0716        nv_agp          (5a0983915f02bae73267cc2a041f717d) C:\windows\system32\drivers\nv_agp.sys
13:29:49.0501 0716        nv_agp - ok
13:29:49.0552 0716        ohci1394        (08a70a1f2cdde9bb49b885cb817a66eb) C:\windows\system32\drivers\ohci1394.sys
13:29:49.0588 0716        ohci1394 - ok
13:29:49.0723 0716        OpenVPNService  (ec322186d8fce3d632f3f597d67747dd) C:\Program Files\OpenVPN\bin\openvpnserv.exe
13:29:49.0742 0716        OpenVPNService ( UnsignedFile.Multi.Generic ) - warning
13:29:49.0742 0716        OpenVPNService - detected UnsignedFile.Multi.Generic (1)
13:29:49.0821 0716        ose            (9d10f99a6712e28f8acd5641e3a7ea6b) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
13:29:49.0832 0716        ose - ok
13:29:50.0219 0716        osppsvc        (358a9cca612c68eb2f07ddad4ce1d8d7) C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
13:29:50.0310 0716        osppsvc - ok
13:29:50.0460 0716        p2pimsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\windows\system32\pnrpsvc.dll
13:29:50.0507 0716        p2pimsvc - ok
13:29:50.0563 0716        p2psvc          (59c3ddd501e39e006dac31bf55150d91) C:\windows\system32\p2psvc.dll
13:29:50.0580 0716        p2psvc - ok
13:29:50.0641 0716        Parport        (2ea877ed5dd9713c5ac74e8ea7348d14) C:\windows\system32\DRIVERS\parport.sys
13:29:50.0667 0716        Parport - ok
13:29:50.0702 0716        partmgr        (3f34a1b4c5f6475f320c275e63afce9b) C:\windows\system32\drivers\partmgr.sys
13:29:50.0713 0716        partmgr - ok
13:29:50.0723 0716        Parvdm          (eb0a59f29c19b86479d36b35983daadc) C:\windows\system32\DRIVERS\parvdm.sys
13:29:50.0737 0716        Parvdm - ok
13:29:50.0775 0716        PcaSvc          (358ab7956d3160000726574083dfc8a6) C:\windows\System32\pcasvc.dll
13:29:50.0794 0716        PcaSvc - ok
13:29:50.0842 0716        pci            (673e55c3498eb970088e812ea820aa8f) C:\windows\system32\drivers\pci.sys
13:29:50.0856 0716        pci - ok
13:29:50.0873 0716        pciide          (afe86f419014db4e5593f69ffe26ce0a) C:\windows\system32\drivers\pciide.sys
13:29:50.0884 0716        pciide - ok
13:29:50.0921 0716        pcmcia          (f396431b31693e71e8a80687ef523506) C:\windows\system32\DRIVERS\pcmcia.sys
13:29:50.0936 0716        pcmcia - ok
13:29:50.0955 0716        pcw            (250f6b43d2b613172035c6747aeeb19f) C:\windows\system32\drivers\pcw.sys
13:29:50.0966 0716        pcw - ok
13:29:51.0027 0716        PEAUTH          (9e0104ba49f4e6973749a02bf41344ed) C:\windows\system32\drivers\peauth.sys
13:29:51.0093 0716        PEAUTH - ok
13:29:51.0239 0716        pla            (414bba67a3ded1d28437eb66aeb8a720) C:\windows\system32\pla.dll
13:29:51.0292 0716        pla - ok
13:29:51.0454 0716        PlugPlay        (ec7bc28d207da09e79b3e9faf8b232ca) C:\windows\system32\umpnpmgr.dll
13:29:51.0514 0716        PlugPlay - ok
13:29:51.0537 0716        PNRPAutoReg    (63ff8572611249931eb16bb8eed6afc8) C:\windows\system32\pnrpauto.dll
13:29:51.0570 0716        PNRPAutoReg - ok
13:29:51.0615 0716        PNRPsvc        (82a8521ddc60710c3d3d3e7325209bec) C:\windows\system32\pnrpsvc.dll
13:29:51.0632 0716        PNRPsvc - ok
13:29:51.0694 0716        PolicyAgent    (53946b69ba0836bd95b03759530c81ec) C:\windows\System32\ipsecsvc.dll
13:29:51.0728 0716        PolicyAgent - ok
13:29:51.0771 0716        Power          (f87d30e72e03d579a5199ccb3831d6ea) C:\windows\system32\umpo.dll
13:29:51.0802 0716        Power - ok
13:29:51.0885 0716        PptpMiniport    (631e3e205ad6d86f2aed6a4a8e69f2db) C:\windows\system32\DRIVERS\raspptp.sys
13:29:51.0917 0716        PptpMiniport - ok
13:29:51.0930 0716        Processor      (85b1e3a0c7585bc4aae6899ec6fcf011) C:\windows\system32\DRIVERS\processr.sys
13:29:51.0943 0716        Processor - ok
13:29:51.0971 0716        ProfSvc        (cadefac453040e370a1bdff3973be00d) C:\windows\system32\profsvc.dll
13:29:52.0021 0716        ProfSvc - ok
13:29:52.0043 0716        ProtectedStorage (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
13:29:52.0057 0716        ProtectedStorage - ok
13:29:52.0109 0716        Psched          (6270ccae2a86de6d146529fe55b3246a) C:\windows\system32\DRIVERS\pacer.sys
13:29:52.0154 0716        Psched - ok
13:29:52.0287 0716        ql2300          (ab95ecf1f6659a60ddc166d8315b0751) C:\windows\system32\DRIVERS\ql2300.sys
13:29:52.0327 0716        ql2300 - ok
13:29:52.0478 0716        ql40xx          (b4dd51dd25182244b86737dc51af2270) C:\windows\system32\DRIVERS\ql40xx.sys
13:29:52.0492 0716        ql40xx - ok
13:29:52.0531 0716        QWAVE          (31ac809e7707eb580b2bdb760390765a) C:\windows\system32\qwave.dll
13:29:52.0564 0716        QWAVE - ok
13:29:52.0586 0716        QWAVEdrv        (584078ca1b95ca72df2a27c336f9719d) C:\windows\system32\drivers\qwavedrv.sys
13:29:52.0624 0716        QWAVEdrv - ok
13:29:52.0644 0716        RasAcd          (30a81b53c766d0133bb86d234e5556ab) C:\windows\system32\DRIVERS\rasacd.sys
13:29:52.0687 0716        RasAcd - ok
13:29:52.0717 0716        RasAgileVpn    (57ec4aef73660166074d8f7f31c0d4fd) C:\windows\system32\DRIVERS\AgileVpn.sys
13:29:52.0760 0716        RasAgileVpn - ok
13:29:52.0802 0716        RasAuto        (a60f1839849c0c00739787fd5ec03f13) C:\windows\System32\rasauto.dll
13:29:52.0835 0716        RasAuto - ok
13:29:52.0884 0716        Rasl2tp        (d9f91eafec2815365cbe6d167e4e332a) C:\windows\system32\DRIVERS\rasl2tp.sys
13:29:52.0926 0716        Rasl2tp - ok
13:29:52.0976 0716        RasMan          (cb9e04dc05eacf5b9a36ca276d475006) C:\windows\System32\rasmans.dll
13:29:53.0008 0716        RasMan - ok
13:29:53.0049 0716        RasPppoe        (0fe8b15916307a6ac12bfb6a63e45507) C:\windows\system32\DRIVERS\raspppoe.sys
13:29:53.0101 0716        RasPppoe - ok
13:29:53.0133 0716        RasSstp        (44101f495a83ea6401d886e7fd70096b) C:\windows\system32\DRIVERS\rassstp.sys
13:29:53.0177 0716        RasSstp - ok
13:29:53.0233 0716        rdbss          (d528bc58a489409ba40334ebf96a311b) C:\windows\system32\DRIVERS\rdbss.sys
13:29:53.0263 0716        rdbss - ok
13:29:53.0282 0716        rdpbus          (0d8f05481cb76e70e1da06ee9f0da9df) C:\windows\system32\DRIVERS\rdpbus.sys
13:29:53.0309 0716        rdpbus - ok
13:29:53.0350 0716        RDPCDD          (23dae03f29d253ae74c44f99e515f9a1) C:\windows\system32\DRIVERS\RDPCDD.sys
13:29:53.0392 0716        RDPCDD - ok
13:29:53.0431 0716        RDPENCDD        (5a53ca1598dd4156d44196d200c94b8a) C:\windows\system32\drivers\rdpencdd.sys
13:29:53.0479 0716        RDPENCDD - ok
13:29:53.0497 0716        RDPREFMP        (44b0a53cd4f27d50ed461dae0c0b4e1f) C:\windows\system32\drivers\rdprefmp.sys
13:29:53.0540 0716        RDPREFMP - ok
13:29:53.0593 0716        RDPWD          (f031683e6d1fea157abb2ff260b51e61) C:\windows\system32\drivers\RDPWD.sys
13:29:53.0641 0716        RDPWD - ok
13:29:53.0686 0716        rdyboost        (518395321dc96fe2c9f0e96ac743b656) C:\windows\system32\drivers\rdyboost.sys
13:29:53.0700 0716        rdyboost - ok
13:29:53.0742 0716        RemoteAccess    (7b5e1419717fac363a31cc302895217a) C:\windows\System32\mprdim.dll
13:29:53.0785 0716        RemoteAccess - ok
13:29:53.0827 0716        RemoteRegistry  (cb9a8683f4ef2bf99e123d79950d7935) C:\windows\system32\regsvc.dll
13:29:53.0877 0716        RemoteRegistry - ok
13:29:53.0950 0716        Rezip          (f85ae59a52885f4b09aadafb23001a3b) C:\windows\SYSTEM32\Rezip.exe
13:29:53.0980 0716        Rezip ( UnsignedFile.Multi.Generic ) - warning
13:29:53.0980 0716        Rezip - detected UnsignedFile.Multi.Generic (1)
13:29:54.0041 0716        RFCOMM          (cb928d9e6daf51879dd6ba8d02f01321) C:\windows\system32\DRIVERS\rfcomm.sys
13:29:54.0058 0716        RFCOMM - ok
13:29:54.0219 0716        RichVideo      (7ccaebcab6fc1ed0206c07e083e79207) C:\Program Files\CyberLink\Shared files\RichVideo.exe
13:29:54.0231 0716        RichVideo - ok
13:29:54.0260 0716        RpcEptMapper    (78d072f35bc45d9e4e1b61895c152234) C:\windows\System32\RpcEpMap.dll
13:29:54.0308 0716        RpcEptMapper - ok
13:29:54.0354 0716        RpcLocator      (94d36c0e44677dd26981d2bfeef2a29d) C:\windows\system32\locator.exe
13:29:54.0380 0716        RpcLocator - ok
13:29:54.0444 0716        RpcSs          (7660f01d3b38aca1747e397d21d790af) C:\windows\system32\rpcss.dll
13:29:54.0477 0716        RpcSs - ok
13:29:54.0518 0716        rspndr          (032b0d36ad92b582d869879f5af5b928) C:\windows\system32\DRIVERS\rspndr.sys
13:29:54.0563 0716        rspndr - ok
13:29:54.0605 0716        RTL8167        (7dfd48e24479b68b258d8770121155a0) C:\windows\system32\DRIVERS\Rt86win7.sys
13:29:54.0635 0716        RTL8167 - ok
13:29:54.0698 0716        rtport          (41ce6b172542a9a227e34a45881e1d2a) C:\windows\system32\drivers\rtport.sys
13:29:54.0708 0716        rtport - ok
13:29:54.0733 0716        SABI            (6e5fbb7cbaec47038b945d5e9b144a64) C:\windows\system32\Drivers\SABI.sys
13:29:54.0777 0716        SABI - ok
13:29:54.0799 0716        SamSs          (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
13:29:54.0812 0716        SamSs - ok
13:29:54.0905 0716        SASDIFSV        (39763504067962108505bff25f024345) C:\Program Files\SUPERAntiSpyware\SASDIFSV.SYS
13:29:54.0915 0716        SASDIFSV - ok
13:29:54.0937 0716        SASKUTIL        (77b9fc20084b48408ad3e87570eb4a85) C:\Program Files\SUPERAntiSpyware\SASKUTIL.SYS
13:29:54.0948 0716        SASKUTIL - ok
13:29:55.0226 0716        SBAMSvc        (bce943896289a91ad75cc5652620b1c6) C:\Program Files\Ad-Aware Antivirus\SBAMSvc.exe
13:29:55.0296 0716        SBAMSvc - ok
13:29:55.0471 0716        sbapifs        (3fff8cda4d2f29ca06f1557e85163c30) C:\windows\system32\DRIVERS\sbapifs.sys
13:29:55.0482 0716        sbapifs - ok
13:29:55.0566 0716        SbFw            (bcf3ba30c1cfa2942cf26c31384b37c7) C:\windows\system32\drivers\SbFw.sys
13:29:55.0581 0716        SbFw - ok
13:29:55.0634 0716        SBFWIMCL        (1dcad90cc9c0ddc7d060fd97854f8518) C:\windows\system32\DRIVERS\sbfwim.sys
13:29:55.0645 0716        SBFWIMCL - ok
13:29:55.0648 0716        SBFWIMCLMP      (1dcad90cc9c0ddc7d060fd97854f8518) C:\windows\system32\DRIVERS\SBFWIM.sys
13:29:55.0660 0716        SBFWIMCLMP - ok
13:29:55.0699 0716        sbhips          (1afd7178ab9c4fce2d332da7aa474fa6) C:\windows\system32\drivers\sbhips.sys
13:29:55.0710 0716        sbhips - ok
13:29:55.0759 0716        sbp2port        (05d860da1040f111503ac416ccef2bca) C:\windows\system32\drivers\sbp2port.sys
13:29:55.0772 0716        sbp2port - ok
13:29:55.0807 0716        SBRE            (1fd538c4feb36b793d2121f20bbdc16f) C:\windows\system32\drivers\SBREdrv.sys
13:29:55.0819 0716        SBRE - ok
13:29:55.0876 0716        sbwtis          (9bdf801a6c78e3f1e6fa1c5ca90baa8a) C:\windows\system32\DRIVERS\sbwtis.sys
13:29:55.0887 0716        sbwtis - ok
13:29:55.0918 0716        SCardSvr        (8fc518ffe9519c2631d37515a68009c4) C:\windows\System32\SCardSvr.dll
13:29:55.0966 0716        SCardSvr - ok
13:29:55.0994 0716        scfilter        (0693b5ec673e34dc147e195779a4dcf6) C:\windows\system32\DRIVERS\scfilter.sys
13:29:56.0022 0716        scfilter - ok
13:29:56.0119 0716        Schedule        (a04bb13f8a72f8b6e8b4071723e4e336) C:\windows\system32\schedsvc.dll
13:29:56.0178 0716        Schedule - ok
13:29:56.0213 0716        SCPolicySvc    (319c6b309773d063541d01df8ac6f55f) C:\windows\System32\certprop.dll
13:29:56.0240 0716        SCPolicySvc - ok
13:29:56.0462 0716        ScrybeUpdater  (b60e9769655ddee8368e3abb6668e076) C:\Program Files\Synaptics\Scrybe\Service\ScrybeUpdater.exe
13:29:56.0492 0716        ScrybeUpdater - ok
13:29:56.0631 0716        SDRSVC          (08236c4bce5edd0a0318a438af28e0f7) C:\windows\System32\SDRSVC.dll
13:29:56.0671 0716        SDRSVC - ok
13:29:56.0745 0716        secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\windows\system32\drivers\secdrv.sys
13:29:56.0791 0716        secdrv - ok
13:29:56.0822 0716        seclogon        (a59b3a4442c52060cc7a85293aa3546f) C:\windows\system32\seclogon.dll
13:29:56.0856 0716        seclogon - ok
13:29:56.0877 0716        SENS            (dcb7fcdcc97f87360f75d77425b81737) C:\windows\System32\sens.dll
13:29:56.0928 0716        SENS - ok
13:29:56.0960 0716        SensrSvc        (50087fe1ee447009c9cc2997b90de53f) C:\windows\system32\sensrsvc.dll
13:29:56.0981 0716        SensrSvc - ok
13:29:57.0025 0716        Serenum        (9ad8b8b515e3df6acd4212ef465de2d1) C:\windows\system32\DRIVERS\serenum.sys
13:29:57.0051 0716        Serenum - ok
13:29:57.0096 0716        Serial          (5fb7fcea0490d821f26f39cc5ea3d1e2) C:\windows\system32\DRIVERS\serial.sys
13:29:57.0125 0716        Serial - ok
13:29:57.0176 0716        sermouse        (79bffb520327ff916a582dfea17aa813) C:\windows\system32\DRIVERS\sermouse.sys
13:29:57.0212 0716        sermouse - ok
13:29:57.0263 0716        SessionEnv      (4ae380f39a0032eab7dd953030b26d28) C:\windows\system32\sessenv.dll
13:29:57.0293 0716        SessionEnv - ok
13:29:57.0336 0716        sffdisk        (9f976e1eb233df46fce808d9dea3eb9c) C:\windows\system32\drivers\sffdisk.sys
13:29:57.0352 0716        sffdisk - ok
13:29:57.0367 0716        sffp_mmc        (932a68ee27833cfd57c1639d375f2731) C:\windows\system32\drivers\sffp_mmc.sys
13:29:57.0402 0716        sffp_mmc - ok
13:29:57.0427 0716        sffp_sd        (6d4ccaedc018f1cf52866bbbaa235982) C:\windows\system32\drivers\sffp_sd.sys
13:29:57.0456 0716        sffp_sd - ok
13:29:57.0484 0716        sfloppy        (db96666cc8312ebc45032f30b007a547) C:\windows\system32\DRIVERS\sfloppy.sys
13:29:57.0511 0716        sfloppy - ok
13:29:57.0592 0716        Sftfs          (d9b734638dd8dba9d59aad3189cd0fad) C:\windows\system32\DRIVERS\Sftfslh.sys
13:29:57.0615 0716        Sftfs - ok
13:29:57.0759 0716        sftlist        (cb73bc422c07fb611f194da18d1e7f36) C:\Program Files\Microsoft Application Virtualization Client\sftlist.exe
13:29:57.0776 0716        sftlist - ok
13:29:57.0853 0716        Sftplay        (2f61bd46c0bff4eb36e1e359ca17bfc5) C:\windows\system32\DRIVERS\Sftplaylh.sys
13:29:57.0866 0716        Sftplay - ok
13:29:57.0920 0716        Sftredir        (518bac0179f94304f422696b47c0ec12) C:\windows\system32\DRIVERS\Sftredirlh.sys
13:29:57.0929 0716        Sftredir - ok
13:29:57.0965 0716        Sftvol          (747325236d88b3f05ffd27ff9ec711c5) C:\windows\system32\DRIVERS\Sftvollh.sys
13:29:57.0974 0716        Sftvol - ok
13:29:58.0041 0716        sftvsa          (a5812f0281ca5081bf696626f9bf324d) C:\Program Files\Microsoft Application Virtualization Client\sftvsa.exe
13:29:58.0053 0716        sftvsa - ok
13:29:58.0099 0716        SharedAccess    (d1a079a0de2ea524513b6930c24527a2) C:\windows\System32\ipnathlp.dll
13:29:58.0155 0716        SharedAccess - ok
13:29:58.0214 0716        ShellHWDetection (414da952a35bf5d50192e28263b40577) C:\windows\System32\shsvcs.dll
13:29:58.0270 0716        ShellHWDetection - ok
13:29:58.0306 0716        sisagp          (2565cac0dc9fe0371bdce60832582b2e) C:\windows\system32\drivers\sisagp.sys
13:29:58.0318 0716        sisagp - ok
13:29:58.0366 0716        SiSRaid2        (a9f0486851becb6dda1d89d381e71055) C:\windows\system32\DRIVERS\SiSRaid2.sys
13:29:58.0378 0716        SiSRaid2 - ok
13:29:58.0399 0716        SiSRaid4        (3727097b55738e2f554972c3be5bc1aa) C:\windows\system32\DRIVERS\sisraid4.sys
13:29:58.0412 0716        SiSRaid4 - ok
13:29:58.0496 0716        SkypeUpdate    (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files\Skype\Updater\Updater.exe
13:29:58.0506 0716        SkypeUpdate - ok
13:29:58.0522 0716        Smb            (3e21c083b8a01cb70ba1f09303010fce) C:\windows\system32\DRIVERS\smb.sys
13:29:58.0554 0716        Smb - ok
13:29:58.0603 0716        SNMPTRAP        (6a984831644eca1a33ffeae4126f4f37) C:\windows\System32\snmptrap.exe
13:29:58.0616 0716        SNMPTRAP - ok
13:29:58.0643 0716        spldr          (95cf1ae7527fb70f7816563cbc09d942) C:\windows\system32\drivers\spldr.sys
13:29:58.0654 0716        spldr - ok
13:29:58.0719 0716        Spooler        (866a43013535dc8587c258e43579c764) C:\windows\System32\spoolsv.exe
13:29:58.0772 0716        Spooler - ok
13:29:59.0021 0716        sppsvc          (cf87a1de791347e75b98885214ced2b8) C:\windows\system32\sppsvc.exe
13:29:59.0085 0716        sppsvc - ok
13:29:59.0214 0716        sppuinotify    (b0180b20b065d89232a78a40fe56eaa6) C:\windows\system32\sppuinotify.dll
13:29:59.0264 0716        sppuinotify - ok
13:29:59.0359 0716        srv            (e4c2764065d66ea1d2d3ebc28fe99c46) C:\windows\system32\DRIVERS\srv.sys
13:29:59.0414 0716        srv - ok
13:29:59.0438 0716        srv2            (03f0545bd8d4c77fa0ae1ceedfcc71ab) C:\windows\system32\DRIVERS\srv2.sys
13:29:59.0475 0716        srv2 - ok
13:29:59.0508 0716        srvnet          (be6bd660caa6f291ae06a718a4fa8abc) C:\windows\system32\DRIVERS\srvnet.sys
13:29:59.0544 0716        srvnet - ok
13:29:59.0594 0716        ssadbus        (406776fe3c2b66796bac1a7afb9ac8a1) C:\windows\system32\DRIVERS\ssadbus.sys
13:29:59.0646 0716        ssadbus - ok
13:29:59.0673 0716        ssadmdfl        (b19532d015a5d295e2aa34bb521202cf) C:\windows\system32\DRIVERS\ssadmdfl.sys
13:29:59.0709 0716        ssadmdfl - ok
13:29:59.0743 0716        ssadmdm        (2aebf9108e6f435458b9499c27394da4) C:\windows\system32\DRIVERS\ssadmdm.sys
13:29:59.0771 0716        ssadmdm - ok
13:29:59.0825 0716        ssadserd        (28f893c9b4e98dee5ae3c24db56b1b11) C:\windows\system32\DRIVERS\ssadserd.sys
13:29:59.0848 0716        ssadserd - ok
13:29:59.0886 0716        SSDPSRV        (d887c9fd02ac9fa880f6e5027a43e118) C:\windows\System32\ssdpsrv.dll
13:29:59.0934 0716        SSDPSRV - ok
13:29:59.0979 0716        ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\windows\system32\DRIVERS\ssmdrv.sys
13:29:59.0987 0716        ssmdrv - ok
13:30:00.0002 0716        SstpSvc        (d318f23be45d5e3a107469eb64815b50) C:\windows\system32\sstpsvc.dll
13:30:00.0032 0716        SstpSvc - ok
13:30:00.0064 0716        stexstor        (db32d325c192b801df274bfd12a7e72b) C:\windows\system32\DRIVERS\stexstor.sys
13:30:00.0076 0716        stexstor - ok
13:30:00.0158 0716        StiSvc          (e1fb3706030fb4578a0d72c2fc3689e4) C:\windows\System32\wiaservc.dll
13:30:00.0181 0716        StiSvc - ok
13:30:00.0219 0716        swenum          (e58c78a848add9610a4db6d214af5224) C:\windows\system32\drivers\swenum.sys
13:30:00.0230 0716        swenum - ok
13:30:00.0282 0716        swprv          (a28bd92df340e57b024ba433165d34d7) C:\windows\System32\swprv.dll
13:30:00.0317 0716        swprv - ok
13:30:00.0482 0716        SynTP          (2185cc5be9922562108cf87f42e4bbaf) C:\windows\system32\DRIVERS\SynTP.sys
13:30:00.0520 0716        SynTP - ok
13:30:00.0743 0716        SysMain        (36650d618ca34c9d357dfd3d89b2c56f) C:\windows\system32\sysmain.dll
13:30:00.0796 0716        SysMain - ok
13:30:00.0836 0716        TabletInputService (763fecdc3d30c815fe72dd57936c6cd1) C:\windows\System32\TabSvc.dll
13:30:00.0869 0716        TabletInputService - ok
13:30:00.0954 0716        tap0901        (8cf6e2ae1707d82e904ecca68cef8b87) C:\windows\system32\DRIVERS\tap0901.sys
13:30:00.0972 0716        tap0901 - ok
13:30:01.0026 0716        TapiSrv        (613bf4820361543956909043a265c6ac) C:\windows\System32\tapisrv.dll
13:30:01.0076 0716        TapiSrv - ok
13:30:01.0102 0716        TBS            (b799d9fdb26111737f58288d8dc172d9) C:\windows\System32\tbssvc.dll
13:30:01.0154 0716        TBS - ok
13:30:01.0299 0716        Tcpip          (7fa2e0f8b072bd04b77b421480b6cc22) C:\windows\system32\drivers\tcpip.sys
13:30:01.0331 0716        Tcpip - ok
13:30:01.0358 0716        TCPIP6          (7fa2e0f8b072bd04b77b421480b6cc22) C:\windows\system32\DRIVERS\tcpip.sys
13:30:01.0390 0716        TCPIP6 - ok
13:30:01.0427 0716        tcpipBM        (dcfeb82ca988598ceb8f83148616038e) C:\windows\system32\drivers\tcpipBM.sys
13:30:01.0445 0716        tcpipBM ( UnsignedFile.Multi.Generic ) - warning
13:30:01.0445 0716        tcpipBM - detected UnsignedFile.Multi.Generic (1)
13:30:01.0485 0716        tcpipreg        (cca24162e055c3714ce5a88b100c64ed) C:\windows\system32\drivers\tcpipreg.sys
13:30:01.0527 0716        tcpipreg - ok
13:30:01.0565 0716        TDPIPE          (1cb91b2bd8f6dd367dfc2ef26fd751b2) C:\windows\system32\drivers\tdpipe.sys
13:30:01.0611 0716        TDPIPE - ok
13:30:01.0634 0716        TDTCP          (2c2c5afe7ee4f620d69c23c0617651a8) C:\windows\system32\drivers\tdtcp.sys
13:30:01.0659 0716        TDTCP - ok
13:30:01.0695 0716        tdx            (b459575348c20e8121d6039da063c704) C:\windows\system32\DRIVERS\tdx.sys
13:30:01.0740 0716        tdx - ok
13:30:01.0772 0716        TermDD          (04dbf4b01ea4bf25a9a3e84affac9b20) C:\windows\system32\drivers\termdd.sys
13:30:01.0784 0716        TermDD - ok
13:30:01.0861 0716        TermService    (382c804c92811be57829d8e550a900e2) C:\windows\System32\termsrv.dll
13:30:01.0896 0716        TermService - ok
13:30:01.0926 0716        Themes          (42fb6afd6b79d9fe07381609172e7ca4) C:\windows\system32\themeservice.dll
13:30:01.0958 0716        Themes - ok
13:30:01.0992 0716        THREADORDER    (146b6f43a673379a3c670e86d89be5ea) C:\windows\system32\mmcss.dll
13:30:02.0023 0716        THREADORDER - ok
13:30:02.0043 0716        TrkWks          (4792c0378db99a9bc2ae2de6cfff0c3a) C:\windows\System32\trkwks.dll
13:30:02.0096 0716        TrkWks - ok
13:30:02.0167 0716        TrustedInstaller (2c49b175aee1d4364b91b531417fe583) C:\windows\servicing\TrustedInstaller.exe
13:30:02.0212 0716        TrustedInstaller - ok
13:30:02.0243 0716        tssecsrv        (254bb140eee3c59d6114c1a86b636877) C:\windows\system32\DRIVERS\tssecsrv.sys
13:30:02.0293 0716        tssecsrv - ok
13:30:02.0346 0716        TsUsbFlt        (fd1d6c73e6333be727cbcc6054247654) C:\windows\system32\drivers\tsusbflt.sys
13:30:02.0370 0716        TsUsbFlt - ok
13:30:02.0429 0716        tunnel          (b2fa25d9b17a68bb93d58b0556e8c90d) C:\windows\system32\DRIVERS\tunnel.sys
13:30:02.0480 0716        tunnel - ok
13:30:02.0518 0716        uagp35          (750fbcb269f4d7dd2e420c56b795db6d) C:\windows\system32\DRIVERS\uagp35.sys
13:30:02.0530 0716        uagp35 - ok
13:30:02.0582 0716        udfs            (ee43346c7e4b5e63e54f927babbb32ff) C:\windows\system32\DRIVERS\udfs.sys
13:30:02.0613 0716        udfs - ok
13:30:02.0651 0716        UI0Detect      (8344fd4fce927880aa1aa7681d4927e5) C:\windows\system32\UI0Detect.exe
13:30:02.0680 0716        UI0Detect - ok
13:30:02.0718 0716        uliagpkx        (44e8048ace47befbfdc2e9be4cbc8880) C:\windows\system32\drivers\uliagpkx.sys
13:30:02.0731 0716        uliagpkx - ok
13:30:02.0773 0716        umbus          (d295bed4b898f0fd999fcfa9b32b071b) C:\windows\system32\drivers\umbus.sys
13:30:02.0788 0716        umbus - ok
13:30:02.0817 0716        UmPass          (7550ad0c6998ba1cb4843e920ee0feac) C:\windows\system32\DRIVERS\umpass.sys
13:30:02.0849 0716        UmPass - ok
13:30:02.0900 0716        upnphost        (833fbb672460efce8011d262175fad33) C:\windows\System32\upnphost.dll
13:30:02.0948 0716        upnphost - ok
13:30:02.0970 0716        usbccgp        (bd9c55d7023c5de374507acc7a14e2ac) C:\windows\system32\DRIVERS\usbccgp.sys
13:30:03.0018 0716        usbccgp - ok
13:30:03.0070 0716        usbcir          (04ec7cec62ec3b6d9354eee93327fc82) C:\windows\system32\drivers\usbcir.sys
13:30:03.0106 0716        usbcir - ok
13:30:03.0135 0716        usbehci        (f92de757e4b7ce9c07c5e65423f3ae3b) C:\windows\system32\drivers\usbehci.sys
13:30:03.0148 0716        usbehci - ok
13:30:03.0212 0716        usbhub          (8dc94aec6a7e644a06135ae7506dc2e9) C:\windows\system32\DRIVERS\usbhub.sys
13:30:03.0229 0716        usbhub - ok
13:30:03.0270 0716        usbohci        (e185d44fac515a18d9deddc23c2cdf44) C:\windows\system32\drivers\usbohci.sys
13:30:03.0303 0716        usbohci - ok
13:30:03.0341 0716        usbprint        (797d862fe0875e75c7cc4c1ad7b30252) C:\windows\system32\DRIVERS\usbprint.sys
13:30:03.0356 0716        usbprint - ok
13:30:03.0385 0716        usbscan        (576096ccbc07e7c4ea4f5e6686d6888f) C:\windows\system32\DRIVERS\usbscan.sys
13:30:03.0418 0716        usbscan - ok
13:30:03.0465 0716        usbser          (31181de6190b39fc8007dffd1a48ffd6) C:\windows\system32\drivers\usbser.sys
13:30:03.0521 0716        usbser - ok
13:30:03.0547 0716        USBSTOR        (f991ab9cc6b908db552166768176896a) C:\windows\system32\DRIVERS\USBSTOR.SYS
13:30:03.0600 0716        USBSTOR - ok
13:30:03.0615 0716        usbuhci        (68df884cf41cdada664beb01daf67e3d) C:\windows\system32\drivers\usbuhci.sys
13:30:03.0641 0716        usbuhci - ok
13:30:03.0700 0716        usbvideo        (45f4e7bf43db40a6c6b4d92c76cbc3f2) C:\windows\System32\Drivers\usbvideo.sys
13:30:03.0718 0716        usbvideo - ok
13:30:03.0759 0716        USB_RNDIS      (b71da871254d96d0349639d03e4c1cc1) C:\windows\system32\DRIVERS\usb8023.sys
13:30:03.0789 0716        USB_RNDIS - ok
13:30:03.0819 0716        UxSms          (081e6e1c91aec36758902a9f727cd23c) C:\windows\System32\uxsms.dll
13:30:03.0848 0716        UxSms - ok
13:30:03.0874 0716        VaultSvc        (81951f51e318aecc2d68559e47485cc4) C:\windows\system32\lsass.exe
13:30:03.0888 0716        VaultSvc - ok
13:30:03.0931 0716        vdrvroot        (a059c4c3edb09e07d21a8e5c0aabd3cb) C:\windows\system32\drivers\vdrvroot.sys
13:30:03.0943 0716        vdrvroot - ok
13:30:04.0004 0716        vds            (c3cd30495687c2a2f66a65ca6fd89be9) C:\windows\System32\vds.exe
13:30:04.0041 0716        vds - ok
13:30:04.0084 0716        vga            (17c408214ea61696cec9c66e388b14f3) C:\windows\system32\DRIVERS\vgapnp.sys
13:30:04.0100 0716        vga - ok
13:30:04.0133 0716        VgaSave        (8e38096ad5c8570a6f1570a61e251561) C:\windows\System32\drivers\vga.sys
13:30:04.0177 0716        VgaSave - ok
13:30:04.0221 0716        vhdmp          (5461686cca2fda57b024547733ab42e3) C:\windows\system32\drivers\vhdmp.sys
13:30:04.0235 0716        vhdmp - ok
13:30:04.0289 0716        viaagp          (c829317a37b4bea8f39735d4b076e923) C:\windows\system32\drivers\viaagp.sys
13:30:04.0302 0716        viaagp - ok
13:30:04.0331 0716        ViaC7          (e02f079a6aa107f06b16549c6e5c7b74) C:\windows\system32\DRIVERS\viac7.sys
13:30:04.0359 0716        ViaC7 - ok
13:30:04.0379 0716        viaide          (e43574f6a56a0ee11809b48c09e4fd3c) C:\windows\system32\drivers\viaide.sys
13:30:04.0391 0716        viaide - ok
13:30:04.0433 0716        volmgr          (4c63e00f2f4b5f86ab48a58cd990f212) C:\windows\system32\drivers\volmgr.sys
13:30:04.0445 0716        volmgr - ok
13:30:04.0478 0716        volmgrx        (b5bb72067ddddbbfb04b2f89ff8c3c87) C:\windows\system32\drivers\volmgrx.sys
13:30:04.0494 0716        volmgrx - ok
13:30:04.0553 0716        volsnap        (f497f67932c6fa693d7de2780631cfe7) C:\windows\system32\drivers\volsnap.sys
13:30:04.0568 0716        volsnap - ok
13:30:04.0626 0716        vsmraid        (9dfa0cc2f8855a04816729651175b631) C:\windows\system32\DRIVERS\vsmraid.sys
13:30:04.0641 0716        vsmraid - ok
13:30:04.0752 0716        VSS            (209a3b1901b83aeb8527ed211cce9e4c) C:\windows\system32\vssvc.exe
13:30:04.0805 0716        VSS - ok
13:30:04.0830 0716        vwifibus        (90567b1e658001e79d7c8bbd3dde5aa6) C:\windows\system32\DRIVERS\vwifibus.sys
13:30:04.0865 0716        vwifibus - ok
13:30:04.0908 0716        vwififlt        (7090d3436eeb4e7da3373090a23448f7) C:\windows\system32\DRIVERS\vwififlt.sys
13:30:04.0939 0716        vwififlt - ok
13:30:04.0988 0716        W32Time        (55187fd710e27d5095d10a472c8baf1c) C:\windows\system32\w32time.dll
13:30:05.0044 0716        W32Time - ok
13:30:05.0070 0716        WacomPen        (de3721e89c653aa281428c8a69745d90) C:\windows\system32\DRIVERS\wacompen.sys
13:30:05.0098 0716        WacomPen - ok
13:30:05.0149 0716        WANARP          (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
13:30:05.0195 0716        WANARP - ok
13:30:05.0198 0716        Wanarpv6        (3c3c78515f5ab448b022bdf5b8ffdd2e) C:\windows\system32\DRIVERS\wanarp.sys
13:30:05.0226 0716        Wanarpv6 - ok
13:30:05.0375 0716        WatAdminSvc    (353a04c273ec58475d8633e75ccd5604) C:\windows\system32\Wat\WatAdminSvc.exe
13:30:05.0418 0716        WatAdminSvc - ok
13:30:05.0560 0716        wbengine        (691e3285e53dca558e1a84667f13e15a) C:\windows\system32\wbengine.exe
13:30:05.0620 0716        wbengine - ok
13:30:05.0659 0716        WbioSrvc        (9614b5d29dc76ac3c29f6d2d3aa70e67) C:\windows\System32\wbiosrvc.dll
13:30:05.0680 0716        WbioSrvc - ok
13:30:05.0736 0716        wcncsvc        (34eee0dfaadb4f691d6d5308a51315dc) C:\windows\System32\wcncsvc.dll
13:30:05.0770 0716        wcncsvc - ok
13:30:05.0774 0716        WcsPlugInService (5d930b6357a6d2af4d7653bdabbf352f) C:\windows\System32\WcsPlugInService.dll
13:30:05.0813 0716        WcsPlugInService - ok
13:30:05.0867 0716        Wd              (1112a9badacb47b7c0bb0392e3158dff) C:\windows\system32\DRIVERS\wd.sys
13:30:05.0879 0716        Wd - ok
13:30:05.0925 0716        Wdf01000        (9950e3d0f08141c7e89e64456ae7dc73) C:\windows\system32\drivers\Wdf01000.sys
13:30:05.0943 0716        Wdf01000 - ok
13:30:05.0960 0716        WdiServiceHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\windows\system32\wdi.dll
13:30:06.0011 0716        WdiServiceHost - ok
13:30:06.0014 0716        WdiSystemHost  (46ef9dc96265fd0b423db72e7c38c2a5) C:\windows\system32\wdi.dll
13:30:06.0032 0716        WdiSystemHost - ok
13:30:06.0084 0716        WebClient      (a9d880f97530d5b8fee278923349929d) C:\windows\System32\webclnt.dll
13:30:06.0117 0716        WebClient - ok
13:30:06.0151 0716        Wecsvc          (760f0afe937a77cff27153206534f275) C:\windows\system32\wecsvc.dll
13:30:06.0185 0716        Wecsvc - ok
13:30:06.0203 0716        wercplsupport  (ac804569bb2364fb6017370258a4091b) C:\windows\System32\wercplsupport.dll
13:30:06.0234 0716        wercplsupport - ok
13:30:06.0267 0716        WerSvc          (08e420d873e4fd85241ee2421b02c4a4) C:\windows\System32\WerSvc.dll
13:30:06.0298 0716        WerSvc - ok
13:30:06.0330 0716        WfpLwf          (8b9a943f3b53861f2bfaf6c186168f79) C:\windows\system32\DRIVERS\wfplwf.sys
13:30:06.0362 0716        WfpLwf - ok
13:30:06.0379 0716        WIMMount        (5cf95b35e59e2a38023836fff31be64c) C:\windows\system32\drivers\wimmount.sys
13:30:06.0391 0716        WIMMount - ok
13:30:06.0517 0716        WinDefend      (3fae8f94296001c32eab62cd7d82e0fd) C:\Program Files\Windows Defender\mpsvc.dll
13:30:06.0554 0716        WinDefend - ok
13:30:06.0560 0716        WinHttpAutoProxySvc - ok
13:30:06.0642 0716        Winmgmt        (f62e510b6ad4c21eb9fe8668ed251826) C:\windows\system32\wbem\WMIsvc.dll
13:30:06.0672 0716        Winmgmt - ok
13:30:06.0800 0716        WinRM          (1b91cd34ea3a90ab6a4ef0550174f4cc) C:\windows\system32\WsmSvc.dll
13:30:06.0858 0716        WinRM - ok
13:30:06.0937 0716        WinUsb          (a67e5f9a400f3bd1be3d80613b45f708) C:\windows\system32\DRIVERS\WinUsb.sys
13:30:06.0972 0716        WinUsb - ok
13:30:07.0063 0716        Wlansvc        (16935c98ff639d185086a3529b1f2067) C:\windows\System32\wlansvc.dll
13:30:07.0090 0716        Wlansvc - ok
13:30:07.0129 0716        WmiAcpi        (0217679b8fca58714c3bf2726d2ca84e) C:\windows\system32\drivers\wmiacpi.sys
13:30:07.0162 0716        WmiAcpi - ok
13:30:07.0236 0716        wmiApSrv        (6eb6b66517b048d87dc1856ddf1f4c3f) C:\windows\system32\wbem\WmiApSrv.exe
13:30:07.0265 0716        wmiApSrv - ok
13:30:07.0439 0716        WMPNetworkSvc  (3b40d3a61aa8c21b88ae57c58ab3122e) C:\Program Files\Windows Media Player\wmpnetwk.exe
13:30:07.0476 0716        WMPNetworkSvc - ok
13:30:07.0505 0716        WPCSvc          (a2f0ec770a92f2b3f9de6d518e11409c) C:\windows\System32\wpcsvc.dll
13:30:07.0526 0716        WPCSvc - ok
13:30:07.0573 0716        WPDBusEnum      (aa53356d60af47eacc85bc617a4f3f66) C:\windows\system32\wpdbusenum.dll
13:30:07.0612 0716        WPDBusEnum - ok
13:30:07.0673 0716        ws2ifsl        (6db3276587b853bf886b69528fdb048c) C:\windows\system32\drivers\ws2ifsl.sys
13:30:07.0719 0716        ws2ifsl - ok
13:30:07.0750 0716        wscsvc          (6f5d49efe0e7164e03ae773a3fe25340) C:\windows\System32\wscsvc.dll
13:30:07.0768 0716        wscsvc - ok
13:30:07.0771 0716        WSearch - ok
13:30:07.0933 0716        wuauserv        (fc3ec24fce372c89423e015a2ac1a31e) C:\windows\system32\wuaueng.dll
13:30:07.0978 0716        wuauserv - ok
13:30:08.0154 0716        WudfPf          (e714a1c0354636837e20ccbf00888ee7) C:\windows\system32\drivers\WudfPf.sys
13:30:08.0184 0716        WudfPf - ok
13:30:08.0234 0716        WUDFRd          (1023ee888c9b47178c5293ed5336ab69) C:\windows\system32\DRIVERS\WUDFRd.sys
13:30:08.0265 0716        WUDFRd - ok
13:30:08.0315 0716        wudfsvc        (8d1e1e529a2c9e9b6a85b55a345f7629) C:\windows\System32\WUDFSvc.dll
13:30:08.0344 0716        wudfsvc - ok
13:30:08.0385 0716        WwanSvc        (ff2d745b560f7c71b31f30f4d49f73d2) C:\windows\System32\wwansvc.dll
13:30:08.0406 0716        WwanSvc - ok
13:30:08.0477 0716        yukonw7        (30b73eb97218a16cbc6de535782a1b35) C:\windows\system32\DRIVERS\yk62x86.sys
13:30:08.0529 0716        yukonw7 - ok
13:30:08.0593 0716        ZTEusbmdm6k    (b8b466103280e45e391e876f05122607) C:\windows\system32\DRIVERS\ZTEusbmdm6k.sys
13:30:08.0613 0716        ZTEusbmdm6k - ok
13:30:08.0632 0716        ZTEusbnet      (911ba85906bc7602c73441502abfb565) C:\windows\system32\DRIVERS\ZTEusbnet.sys
13:30:08.0653 0716        ZTEusbnet - ok
13:30:08.0693 0716        ZTEusbnmea      (69774b89725ddc4781e0eeb9809f3b20) C:\windows\system32\DRIVERS\ZTEusbnmea.sys
13:30:08.0740 0716        ZTEusbnmea - ok
13:30:08.0802 0716        ZTEusbser6k    (b8b466103280e45e391e876f05122607) C:\windows\system32\DRIVERS\ZTEusbser6k.sys
13:30:08.0815 0716        ZTEusbser6k - ok
13:30:08.0840 0716        ZTEusbvoice    (b8b466103280e45e391e876f05122607) C:\windows\system32\DRIVERS\ZTEusbvoice.sys
13:30:08.0852 0716        ZTEusbvoice - ok
13:30:08.0961 0716        MBR (0x1B8)    (2e5debb2116b3417023e0d6562d7ed07) \Device\Harddisk0\DR0
13:30:09.0423 0716        \Device\Harddisk0\DR0 - ok
13:30:09.0449 0716        Boot (0x1200)  (615df38242380c7ce249ecda8dfcbf11) \Device\Harddisk0\DR0\Partition0
13:30:09.0451 0716        \Device\Harddisk0\DR0\Partition0 - ok
13:30:09.0464 0716        Boot (0x1200)  (522d36ed4744732fcad88a18441f4f40) \Device\Harddisk0\DR0\Partition1
13:30:09.0466 0716        \Device\Harddisk0\DR0\Partition1 - ok
13:30:09.0492 0716        Boot (0x1200)  (d081fa005a08bca0f74d3dd515baac42) \Device\Harddisk0\DR0\Partition2
13:30:09.0494 0716        \Device\Harddisk0\DR0\Partition2 - ok
13:30:09.0494 0716        ============================================================
13:30:09.0494 0716        Scan finished
13:30:09.0494 0716        ============================================================
13:30:09.0503 4956        Detected object count: 6
13:30:09.0503 4956        Actual detected object count: 6
13:30:39.0375 4956        C:\windows\system32\drivers\BMLoad.sys - copied to quarantine
13:30:39.0375 4956        HKLM\SYSTEM\ControlSet001\services\BMLoad - will be deleted on reboot
13:30:39.0415 4956        HKLM\SYSTEM\ControlSet002\services\BMLoad - will be deleted on reboot
13:30:39.0583 4956        C:\windows\system32\drivers\BMLoad.sys - will be deleted on reboot
13:30:39.0583 4956        BMLoad ( UnsignedFile.Multi.Generic ) - User select action: Delete
13:30:39.0618 4956        C:\windows\system32\FsUsbExDisk.SYS - copied to quarantine
13:30:39.0619 4956        HKLM\SYSTEM\ControlSet001\services\FsUsbExDisk - will be deleted on reboot
13:30:39.0632 4956        HKLM\SYSTEM\ControlSet002\services\FsUsbExDisk - will be deleted on reboot
13:30:39.0635 4956        C:\windows\system32\FsUsbExDisk.SYS - will be deleted on reboot
13:30:39.0635 4956        FsUsbExDisk ( UnsignedFile.Multi.Generic ) - User select action: Delete
13:30:39.0680 4956        C:\windows\system32\nlssrv32.exe - copied to quarantine
13:30:39.0680 4956        HKLM\SYSTEM\ControlSet001\services\nlsX86cc - will be deleted on reboot
13:30:39.0695 4956        HKLM\SYSTEM\ControlSet002\services\nlsX86cc - will be deleted on reboot
13:30:39.0698 4956        C:\windows\system32\nlssrv32.exe - will be deleted on reboot
13:30:39.0698 4956        nlsX86cc ( UnsignedFile.Multi.Generic ) - User select action: Delete
13:30:39.0806 4956        C:\Program Files\OpenVPN\bin\openvpnserv.exe - copied to quarantine
13:30:39.0806 4956        HKLM\SYSTEM\ControlSet001\services\OpenVPNService - will be deleted on reboot
13:30:39.0821 4956        HKLM\SYSTEM\ControlSet002\services\OpenVPNService - will be deleted on reboot
13:30:39.0825 4956        C:\Program Files\OpenVPN\bin\openvpnserv.exe - will be deleted on reboot
13:30:39.0825 4956        OpenVPNService ( UnsignedFile.Multi.Generic ) - User select action: Delete
13:30:39.0893 4956        C:\windows\SYSTEM32\Rezip.exe - copied to quarantine
13:30:39.0894 4956        HKLM\SYSTEM\ControlSet001\services\Rezip - will be deleted on reboot
13:30:39.0912 4956        HKLM\SYSTEM\ControlSet002\services\Rezip - will be deleted on reboot
13:30:39.0915 4956        C:\windows\SYSTEM32\Rezip.exe - will be deleted on reboot
13:30:39.0915 4956        Rezip ( UnsignedFile.Multi.Generic ) - User select action: Delete
13:30:39.0945 4956        C:\windows\system32\drivers\tcpipBM.sys - copied to quarantine
13:30:39.0945 4956        HKLM\SYSTEM\ControlSet001\services\tcpipBM - will be deleted on reboot
13:30:39.0965 4956        HKLM\SYSTEM\ControlSet002\services\tcpipBM - will be deleted on reboot
13:30:39.0968 4956        C:\windows\system32\drivers\tcpipBM.sys - will be deleted on reboot
13:30:39.0968 4956        tcpipBM ( UnsignedFile.Multi.Generic ) - User select action: Delete
13:30:42.0327 0768        Deinitialize success

cosinus 03.07.2012 13:45
Code:
copied to quarantine
will be deleted on reboot
Na klasse :headbang:
Da poste ich extra du sollst jeden Eintrag so belassen wie er ist und und du löschst einfach alles

Zitat:
Puhh, das wird echt kompliziert.
Die Anleitung richtig lesen und umsetzen ist nun wirklich nicht kompliziert :balla:

vivacitas83 03.07.2012 15:17
Verzeihung, habe mich an diese Anleitung gehalten und da stand löschen, erst danach merkte ich, dass Du etwas anderes wolltest :twak:

Zitat:
Zitat von cosinus (Beitrag 856387)
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-a...entfernen.html

cosinus 03.07.2012 16:04
Nein, du hast die Anleitung nicht richtig gelesen! Das stand nichts von du sollst was löschen! Und ich hatte den Hinweis auch deutlich gepostet!

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!


Alle Zeitangaben in WEZ +1. Es ist jetzt 10:43 Uhr.

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131