Trojaner-Board
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   JavaScript Virus JS/RunForest.B eingefangen (https://www.trojaner-board.de/118726-javascript-virus-js-runforest-b-eingefangen.html)

purplehaze 06.07.2012 18:31
JavaScript Virus JS/RunForest.B eingefangen
 
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo zusammen,

ich habe mir anscheinend einen Virus eingefangen und es wäre schön wenn mir jemand helfen könnte. Mein AntiVir ist heute routeinemässig gelaufen (was es alle 2 Tage tut) und hat folgenden Viurs entdeckt (5 mal, scheint ein JavaScript Virus zu sein)

JS/RunForest.B

Hier das komplette Logfile:

Code:


Avira Free Antivirus
Erstellungsdatum der Reportdatei: Freitag, 6. Juli 2012  18:00

Es wird nach 3841399 Virenstämmen gesucht.

Das Programm läuft als uneingeschränkte Vollversion.
Online-Dienste stehen zur Verfügung.

Lizenznehmer  : Avira AntiVir Personal - Free Antivirus
Seriennummer  : 0000149996-ADJIE-0000001
Plattform      : Windows 7 Professional
Windowsversion : (Service Pack 1)  [6.1.7601]
Boot Modus    : Normal gebootet
Benutzername  : SYSTEM
Computername  : WOHNZIMMER

Versionsinformationen:
BUILD.DAT      : 12.0.0.1125    41829 Bytes  02.05.2012 16:34:00
AVSCAN.EXE    : 12.3.0.15    466896 Bytes  08.05.2012 20:26:59
AVSCAN.DLL    : 12.3.0.15      66256 Bytes  08.05.2012 20:26:59
LUKE.DLL      : 12.3.0.15      68304 Bytes  08.05.2012 20:26:59
AVSCPLR.DLL    : 12.3.0.14      97032 Bytes  08.05.2012 20:26:59
AVREG.DLL      : 12.3.0.17    232200 Bytes  10.05.2012 20:26:52
VBASE000.VDF  : 7.10.0.0    19875328 Bytes  06.11.2009 10:49:21
VBASE001.VDF  : 7.11.0.0    13342208 Bytes  14.12.2010 07:56:15
VBASE002.VDF  : 7.11.19.170 14374912 Bytes  20.12.2011 07:56:21
VBASE003.VDF  : 7.11.21.238  4472832 Bytes  01.02.2012 18:51:00
VBASE004.VDF  : 7.11.26.44  4329472 Bytes  28.03.2012 18:01:46
VBASE005.VDF  : 7.11.34.116  4034048 Bytes  29.06.2012 08:08:48
VBASE006.VDF  : 7.11.34.117    2048 Bytes  29.06.2012 08:08:48
VBASE007.VDF  : 7.11.34.118    2048 Bytes  29.06.2012 08:08:48
VBASE008.VDF  : 7.11.34.119    2048 Bytes  29.06.2012 08:08:48
VBASE009.VDF  : 7.11.34.120    2048 Bytes  29.06.2012 08:08:48
VBASE010.VDF  : 7.11.34.121    2048 Bytes  29.06.2012 08:08:48
VBASE011.VDF  : 7.11.34.122    2048 Bytes  29.06.2012 08:08:48
VBASE012.VDF  : 7.11.34.123    2048 Bytes  29.06.2012 08:08:48
VBASE013.VDF  : 7.11.34.124    2048 Bytes  29.06.2012 08:08:48
VBASE014.VDF  : 7.11.34.201  169472 Bytes  02.07.2012 11:20:13
VBASE015.VDF  : 7.11.35.19    122368 Bytes  04.07.2012 16:23:46
VBASE016.VDF  : 7.11.35.20      2048 Bytes  04.07.2012 16:23:55
VBASE017.VDF  : 7.11.35.21      2048 Bytes  04.07.2012 16:23:55
VBASE018.VDF  : 7.11.35.22      2048 Bytes  04.07.2012 16:23:55
VBASE019.VDF  : 7.11.35.23      2048 Bytes  04.07.2012 16:23:55
VBASE020.VDF  : 7.11.35.24      2048 Bytes  04.07.2012 16:23:55
VBASE021.VDF  : 7.11.35.25      2048 Bytes  04.07.2012 16:23:55
VBASE022.VDF  : 7.11.35.26      2048 Bytes  04.07.2012 16:23:55
VBASE023.VDF  : 7.11.35.27      2048 Bytes  04.07.2012 16:23:55
VBASE024.VDF  : 7.11.35.28      2048 Bytes  04.07.2012 16:23:55
VBASE025.VDF  : 7.11.35.29      2048 Bytes  04.07.2012 16:23:55
VBASE026.VDF  : 7.11.35.30      2048 Bytes  04.07.2012 16:23:55
VBASE027.VDF  : 7.11.35.31      2048 Bytes  04.07.2012 16:23:55
VBASE028.VDF  : 7.11.35.32      2048 Bytes  04.07.2012 16:23:55
VBASE029.VDF  : 7.11.35.33      2048 Bytes  04.07.2012 16:23:55
VBASE030.VDF  : 7.11.35.34      2048 Bytes  04.07.2012 16:23:55
VBASE031.VDF  : 7.11.35.64    93696 Bytes  05.07.2012 16:24:17
Engineversion  : 8.2.10.104
AEVDF.DLL      : 8.1.2.8      106867 Bytes  01.06.2012 17:43:41
AESCRIPT.DLL  : 8.1.4.32      455034 Bytes  05.07.2012 16:24:20
AESCN.DLL      : 8.1.8.2      131444 Bytes  14.03.2012 18:51:04
AESBX.DLL      : 8.2.5.12      606578 Bytes  14.06.2012 20:02:53
AERDL.DLL      : 8.1.9.15      639348 Bytes  31.01.2012 07:55:37
AEPACK.DLL    : 8.2.16.22    807288 Bytes  21.06.2012 20:04:14
AEOFFICE.DLL  : 8.1.2.40      201082 Bytes  28.06.2012 20:03:14
AEHEUR.DLL    : 8.1.4.64    5009782 Bytes  05.07.2012 16:24:20
AEHELP.DLL    : 8.1.23.2      258422 Bytes  28.06.2012 20:03:13
AEGEN.DLL      : 8.1.5.30      422261 Bytes  14.06.2012 20:02:50
AEEXP.DLL      : 8.1.0.60      86388 Bytes  05.07.2012 16:24:20
AEEMU.DLL      : 8.1.3.0      393589 Bytes  31.01.2012 07:55:34
AECORE.DLL    : 8.1.25.10    201080 Bytes  31.05.2012 17:46:33
AEBB.DLL      : 8.1.1.0        53618 Bytes  31.01.2012 07:55:33
AVWINLL.DLL    : 12.3.0.15      27344 Bytes  08.05.2012 20:26:58
AVPREF.DLL    : 12.3.0.15      51920 Bytes  08.05.2012 20:26:59
AVREP.DLL      : 12.3.0.15    179208 Bytes  08.05.2012 20:26:59
AVARKT.DLL    : 12.3.0.15    211408 Bytes  08.05.2012 20:26:59
AVEVTLOG.DLL  : 12.3.0.15    169168 Bytes  08.05.2012 20:26:59
SQLITE3.DLL    : 3.7.0.1      398288 Bytes  08.05.2012 20:26:59
AVSMTP.DLL    : 12.3.0.15      63440 Bytes  08.05.2012 20:26:59
NETNT.DLL      : 12.3.0.15      17104 Bytes  08.05.2012 20:26:59
RCIMAGE.DLL    : 12.3.0.15    4447952 Bytes  08.05.2012 20:26:58
RCTEXT.DLL    : 12.3.0.15      98512 Bytes  08.05.2012 20:26:58

Konfiguration für den aktuellen Suchlauf:
Job Name..............................: Schnelle Systemprüfung
Konfigurationsdatei...................: D:\programme\avira\antivir desktop\quicksysscan.avp
Protokollierung.......................: standard
Primäre Aktion........................: interaktiv
Sekundäre Aktion......................: ignorieren
Durchsuche Masterbootsektoren.........: ein
Durchsuche Bootsektoren...............: ein
Bootsektoren..........................: C:,
Durchsuche aktive Programme...........: ein
Durchsuche Registrierung..............: ein
Suche nach Rootkits...................: aus
Integritätsprüfung von Systemdateien..: aus
Datei Suchmodus.......................: Intelligente Dateiauswahl
Durchsuche Archive....................: ein
Rekursionstiefe einschränken..........: 20
Archiv Smart Extensions...............: ein
Makrovirenheuristik...................: ein
Dateiheuristik........................: erweitert
Abweichende Gefahrenkategorien........: +PCK,+PFS,+SPR,

Beginn des Suchlaufs: Freitag, 6. Juli 2012  18:00

Der Suchlauf über die Masterbootsektoren wird begonnen:
Masterbootsektor HD0
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über die Bootsektoren wird begonnen:
Bootsektor 'C:\'
    [INFO]      Es wurde kein Virus gefunden!

Der Suchlauf über gestartete Prozesse wird begonnen:
Durchsuche Prozess 'avscan.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'OUTLOOK.EXE' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'firefox.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SteamService.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfimon.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'brccMCtl.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamgui.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'BrMfcWnd.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avgnt.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Rainlendar2.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SpotifyWebHelper.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Steam.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'Skype.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'rundll32.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'mbamservice.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'GoogleUpdate.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'SDWinSec.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'avguard.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'armsvc.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'aavus.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'sched.exe' - '1' Modul(e) wurden durchsucht
Durchsuche Prozess 'nvSCPAPISvr.exe' - '1' Modul(e) wurden durchsucht

Der Suchlauf auf Verweise zu ausführbaren Dateien (Registry) wird begonnen:
D:\Games\RobView\uninstall.exe
  [WARNUNG]  Die Version dieses Archives wird nicht unterstützt
Die Registry wurde durchsucht ( '2680' Dateien ).


Der Suchlauf über die ausgewählten Dateien wird begonnen:

Beginne mit der Suche in 'C:\Users\Purple'
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\0\16\ED51Bd01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\9\C9\74A68d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\B\04\69ACAd01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\E\A0\16031d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\F\50\30CE4d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00006f
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_000070
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00007c
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00008a
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00008b
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00008c
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00008d
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000a2
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000a7
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000d0
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_000327
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0003b2
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0003bf
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_000446
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_000447
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00045a
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00045b
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0005b2
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0005b3
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0005bb
  [WARNUNG]  Unerwartetes Dateiende erreicht
Beginne mit der Suche in 'C:\Windows'
Beginne mit der Suche in 'C:\Users\'
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\0\16\ED51Bd01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\9\C9\74A68d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\B\04\69ACAd01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\E\A0\16031d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\F\50\30CE4d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00006f
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_000070
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00007c
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00008a
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00008b
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00008c
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00008d
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000a2
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000a7
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0000d0
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_000327
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0003b2
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0003bf
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_000446
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_000447
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00045a
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_00045b
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0005b2
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0005b3
  [WARNUNG]  Unerwartetes Dateiende erreicht
C:\Users\Purple\AppData\LocalLow\Google\GoogleEarth\webdata\f_0005bb
  [WARNUNG]  Unerwartetes Dateiende erreicht
Beginne mit der Suche in 'C:\Program Files (x86)'

Beginne mit der Desinfektion:
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\F\50\30CE4d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '560db296.qua' verschoben!
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\E\A0\16031d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '4e879dcf.qua' verschoben!
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\B\04\69ACAd01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '1cc7c722.qua' verschoben!
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\9\C9\74A68d01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '7af088e7.qua' verschoben!
C:\Users\Purple\AppData\Local\Mozilla\Firefox\Profiles\h1qi3qrj.default\Cache\0\16\ED51Bd01
  [FUND]      Enthält Erkennungsmuster des Java-Scriptvirus JS/RunForest.B
  [HINWEIS]  Die Datei wurde ins Quarantäneverzeichnis unter dem Namen '3f60a5c9.qua' verschoben!


Ende des Suchlaufs: Freitag, 6. Juli 2012  19:24
Benötigte Zeit: 37:23 Minute(n)

Der Suchlauf wurde vollständig durchgeführt.

  32664 Verzeichnisse wurden überprüft
 385550 Dateien wurden geprüft
    10 Viren bzw. unerwünschte Programme wurden gefunden
      0 Dateien wurden als verdächtig eingestuft
      0 Dateien wurden gelöscht
      0 Viren bzw. unerwünschte Programme wurden repariert
      5 Dateien wurden in die Quarantäne verschoben
      0 Dateien wurden umbenannt
      0 Dateien konnten nicht durchsucht werden
 385540 Dateien ohne Befall
  6702 Archive wurden durchsucht
    41 Warnungen
      5 Hinweise
Der Virus wurde jetzt in Quarantäne verschoben. Es wäre nett wenn sich das jemand mal anschauen könnte und mir sagen kann, was ich am besten mache (Muss ich neu installieren? ). Was mich stutzig macht, ist dass ich beim googeln nichts finde über diesen Virus!? Ist der hier bekannt?

Greetz Purple


EDIT: Ich habe gerade noch 4 verdächtige Sachen im Task-Manager gefunden: 4 Prozesse zu denen nichts weiter angegeben ist und bei denen man auch nicht den Dateipfad öffnen kann - Beide haben keinen Benutzer und keine Beschreibung enthalten (siehe Attachment!)

Winlogon.exe
CSRSS.exe
nvxdsync.exe
nvvsvc.exe

cosinus 10.07.2012 20:54
Bitte erstmal routinemäßig einen Vollscan mit malwarebytes machen und Log posten. =>ALLE lokalen Datenträger (außer CD/DVD) überprüfen lassen!
Denk daran, dass Malwarebytes vor jedem Scan manuell aktualisiert werden muss!

Die Funde mit Malwarebytes bitte alle entfernen, sodass sie in der Quarantäne von Malwarebytes aufgehoben werden! NICHTS voreilig aus der Quarantäne entfernen!

Falls Logs aus älteren Scans mit Malwarebytes vorhanden sind, bitte auch davon alle posten!



ESET Online Scanner

  • Hier findest du eine bebilderte Anleitung zu ESET Online Scanner
  • Lade und starte Eset Online Scanner
  • Setze einen Haken bei Ja, ich bin mit den Nutzungsbedingungen einverstanden und klicke auf Starten.
  • Aktiviere die "Erkennung von eventuell unerwünschten Anwendungen" und wähle folgende Einstellungen.
  • Klicke auf Starten.
  • Die Signaturen werden heruntergeladen, der Scan beginnt automatisch.
  • Klicke am Ende des Suchlaufs auf Fertig stellen.
  • Schließe das Fenster von ESET.
  • Explorer öffnen.
  • C:\Programme\Eset\EsetOnlineScanner\log.txt (bei 64 Bit auch C:\Programme (x86)\Eset\EsetOnlineScanner\log.txt) suchen und mit Deinem Editor öffnen (bebildert).
  • Logfile hier posten.
  • Deinstallation: Systemsteuerung => Software / Programme deinstallieren => Eset Online Scanner V3 entfernen.
  • Manuell folgenden Ordner löschen und Papierkorb leeren => C:\Programme\Eset





Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log

purplehaze 11.07.2012 17:41
Hallo,

vielen Dank für die Antwort. Hier die Logs:

Malwarebytes:
Code:
Malwarebytes Anti-Malware 1.61.0.1400
www.malwarebytes.org

Datenbank Version: v2012.07.11.07

Windows 7 Service Pack 1 x64 NTFS
Internet Explorer 9.0.8112.16421
Purplehaze :: WOHNZIMMER [Administrator]

11.07.2012 17:05:32
mbam-log-2012-07-11 (17-05-32).txt

Art des Suchlaufs: Vollständiger Suchlauf
Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM
Deaktivierte Suchlaufeinstellungen: P2P
Durchsuchte Objekte: 426254
Laufzeit: 1 Stunde(n), 11 Minute(n), 19 Sekunde(n)

Infizierte Speicherprozesse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Speichermodule: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungsschlüssel: 0
(Keine bösartigen Objekte gefunden)

Infizierte Registrierungswerte: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateiobjekte der Registrierung: 0
(Keine bösartigen Objekte gefunden)

Infizierte Verzeichnisse: 0
(Keine bösartigen Objekte gefunden)

Infizierte Dateien: 0
(Keine bösartigen Objekte gefunden)

(Ende)
ESET:
Code:
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=69da130165b43c4bbb08bc953b2d7662
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-04-02 06:59:27
# local_time=2012-04-02 08:59:27 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 152583 85019669 0 0
# compatibility_mode=8192 67108863 100 0 501 501 0 0
# scanned=129186
# found=0
# cleaned=0
# scan_time=3350
ESETSmartInstaller@High as downloader log:
all ok
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=69da130165b43c4bbb08bc953b2d7662
# end=stopped
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-11 03:09:24
# local_time=2012-07-11 05:09:24 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 118521 93649205 0 0
# compatibility_mode=8192 67108863 100 0 8630037 8630037 0 0
# scanned=43
# found=0
# cleaned=0
# scan_time=9
ESETSmartInstaller@High as downloader log:
all ok
esets_scanner_update returned -1 esets_gle=53251
# version=7
# OnlineScannerApp.exe=1.0.0.1
# OnlineScanner.ocx=1.0.0.6583
# api_version=3.0.2
# EOSSerial=69da130165b43c4bbb08bc953b2d7662
# end=finished
# remove_checked=false
# archives_checked=true
# unwanted_checked=true
# unsafe_checked=false
# antistealth_checked=true
# utc_time=2012-07-11 04:38:32
# local_time=2012-07-11 06:38:32 (+0100, Mitteleuropäische Sommerzeit)
# country="Germany"
# lang=1033
# osver=6.1.7601 NT Service Pack 1
# compatibility_mode=1792 16777215 100 0 0 0 0 0
# compatibility_mode=5893 16776573 100 94 118612 93649296 0 0
# compatibility_mode=8192 67108863 100 0 8630128 8630128 0 0
# scanned=177342
# found=0
# cleaned=0
# scan_time=5267
Greetz Purple

cosinus 11.07.2012 22:22
Hätte da mal zwei Fragen bevor es weiter geht

1.) Geht der normale Modus von Windows (wieder) uneingeschränkt?
2.) Vermisst du irgendwas im Startmenü? Sind da leere Ordner unter alle Programme oder ist alles vorhanden?

purplehaze 12.07.2012 20:57
Hallo und danke für die Antwort.

1. Der normale Modus geht uneingeschränkt und ging auch die ganze Zeit ohne Probleme.

2. Da ich nicht wirklich mit dem Startmenü arbeite ist mir bisher nichts aufgefallen. Ich habe alle Ordner dort gecheckt und keiner ist leer.

Gruß Purple

cosinus 12.07.2012 21:39
adwCleaner - Toolbars und ungewollte Start-/Suchseiten aufspüren

Downloade Dir bitte AdwCleaner auf deinen Desktop.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Search.
  • Nach Ende des Suchlaufs öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[R1].txt.

purplehaze 13.07.2012 12:53
Hallo,

hier der Log:

Code:
# AdwCleaner v1.701 - Logfile created 07/13/2012 at 13:54:26
# Updated 02/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Purplehaze - WOHNZIMMER
# Running from : C:\Users\Purple\Desktop\adwcleaner.exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Found : HKLM\SOFTWARE\Classes\AppID\BHO.DLL
[x64] Key Found : HKLM\SOFTWARE\Classes\AppID\BHO.DLL

***** [Registre - GUID] *****

Key Found : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Found : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
[x64] Key Found : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[R1].txt - [1150 octets] - [13/07/2012 13:54:26]

########## EOF - \AdwCleaner[R1].txt - [1278 octets] ##########
Greetz Purple

cosinus 13.07.2012 20:35
adwCleaner - Toolbars und ungewollte Start-/Suchseiten entfernen
  • Schließe alle offenen Programme und Browser.
  • Starte die adwcleaner.exe mit einem Doppelklick.
  • Klicke auf Delete.
  • Bestätige jeweils mit Ok.
  • Dein Rechner wird neu gestartet. Nach dem Neustart öffnet sich eine Textdatei.
  • Poste mir den Inhalt mit deiner nächsten Antwort.
  • Die Logdatei findest du auch unter C:\AdwCleaner[S1].txt.

purplehaze 15.07.2012 21:34
Hallo,

heisst das, da war ne Schadsoftware auf meinem Rechner bzw. komische Einträge in der Registry? Hier der Log:

Code:
# AdwCleaner v1.702 - Logfile created 07/15/2012 at 22:31:22
# Updated 13/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Purplehaze - WOHNZIMMER
# Running from : C:\Users\Purple\Desktop\adwcleaner(1).exe
# Option [Delete]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****

Key Deleted : HKLM\SOFTWARE\Classes\AppID\BHO.DLL

***** [Registre - GUID] *****

Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\CLSID\{826D7151-8D99-434B-8540-082B8C2AE556}
Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}
Key Deleted : HKLM\SOFTWARE\Classes\TypeLib\{2D5E2D34-BED5-4B9F-9793-A31E26E6806E}
[x64] Key Deleted : HKLM\SOFTWARE\Classes\Interface\{66EEF543-A9AC-4A9D-AA3C-1ED148AC8EEE}

***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[S1].txt - [1018 octets] - [15/07/2012 22:31:22]
AdwCleaner[R1].txt - [1271 octets] - [13/07/2012 13:54:26]

########## EOF - \AdwCleaner[S1].txt - [1206 octets] ##########
Ich habe den Cleaner danach noch einmal laufen lassen. Hier der Log dafür:
Code:
# AdwCleaner v1.702 - Logfile created 07/15/2012 at 22:36:10
# Updated 13/07/2012 by Xplode
# Operating system : Windows 7 Professional Service Pack 1 (64 bits)
# User : Purplehaze - WOHNZIMMER
# Running from : C:\Users\Purple\Desktop\adwcleaner(1).exe
# Option [Search]


***** [Services] *****


***** [Files / Folders] *****


***** [Registry] *****


***** [Registre - GUID] *****


***** [Internet Browsers] *****

-\\ Internet Explorer v9.0.8112.16421

[OK] Registry is clean.

*************************

AdwCleaner[S1].txt - [1203 octets] - [15/07/2012 22:31:22]
AdwCleaner[R2].txt - [599 octets] - [15/07/2012 22:36:10]
AdwCleaner[R1].txt - [1271 octets] - [13/07/2012 13:54:26]

########## EOF - \AdwCleaner[R2].txt - [786 octets] ##########
Greetz Purple

cosinus 16.07.2012 14:35
Mach bitte ein neues OTL-Log. Bitte alles nach Möglichkeit hier in CODE-Tags posten.

Wird so gemacht:

[code] hier steht das Log [/code]

Und das ganze sieht dann so aus:

Code:
hier steht das Log
CustomScan mit OTL

Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop. Falls schon vorhanden, bitte die ältere vorhandene Datei durch die neu heruntergeladene Datei ersetzen, damit du auch wirklich mit einer aktuellen Version von OTL arbeitest.
Code:
netsvcs
msconfig
safebootminimal
safebootnetwork
activex
drivers32
%ALLUSERSPROFILE%\Application Data\*.
%ALLUSERSPROFILE%\Application Data\*.exe /s
%APPDATA%\*.
%APPDATA%\*.exe /s
%SYSTEMDRIVE%\*.exe
/md5start
wininit.exe
userinit.exe
eventlog.dll
scecli.dll
netlogon.dll
cngaudit.dll
ws2ifsl.sys
sceclt.dll
ntelogon.dll
winlogon.exe
logevent.dll
user32.DLL
iaStor.sys
nvstor.sys
atapi.sys
IdeChnDr.sys
viasraid.sys
AGP440.sys
vaxscsi.sys
nvatabus.sys
viamraid.sys
nvata.sys
nvgts.sys
iastorv.sys
ViPrt.sys
eNetHook.dll
ahcix86.sys
KR10N.sys
nvstor32.sys
ahcix86s.sys
/md5stop
%systemroot%\system32\drivers\*.sys /lockedfiles
%systemroot%\System32\config\*.sav
%systemroot%\*. /mp /s
%systemroot%\system32\*.dll /lockedfiles
CREATERESTOREPOINT

purplehaze 16.07.2012 18:24
Hallo,

hier das Log-File:

OTL Logfile:
Code:
OTL logfile created on: 16.07.2012 19:15:49 - Run 3
OTL by OldTimer - Version 3.2.54.0    Folder = C:\Users\Purple\Desktop
64bit- Professional Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation
Internet Explorer (Version = 9.0.8112.16421)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
 
4,00 Gb Total Physical Memory | 2,61 Gb Available Physical Memory | 65,36% Memory free
8,00 Gb Paging File | 6,46 Gb Available in Paging File | 80,84% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
 
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86)
Drive C: | 244,04 Gb Total Space | 144,99 Gb Free Space | 59,41% Space Free | Partition Type: NTFS
Drive D: | 352,03 Gb Total Space | 119,49 Gb Free Space | 33,94% Space Free | Partition Type: NTFS
Drive F: | 7,16 Gb Total Space | 0,00 Gb Free Space | 0,00% Space Free | Partition Type: UDF
Drive K: | 1,89 Gb Total Space | 0,36 Gb Free Space | 19,30% Space Free | Partition Type: FAT32
 
Computer Name: WOHNZIMMER | User Name: Purplehaze | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: All users | Quick Scan | Include 64bit Scans
Company Name Whitelist: On | Skip Microsoft Files: On | No Company Name Whitelist: On | File Age = 30 Days
 
========== Processes (SafeList) ==========
 
PRC - [2012.07.16 19:12:20 | 000,596,480 | ---- | M] (OldTimer Tools) -- C:\Users\Purple\Desktop\OTL.exe
PRC - [2012.07.10 15:36:24 | 001,192,664 | ---- | M] () -- C:\Users\Purple\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
PRC - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
PRC - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
PRC - [2012.05.08 22:26:59 | 000,348,624 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avgnt.exe
PRC - [2012.05.08 22:26:59 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\avguard.exe
PRC - [2012.05.08 22:26:59 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) -- D:\Programme\Avira\AntiVir Desktop\sched.exe
PRC - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) -- D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
PRC - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
PRC - [2009.01.26 16:31:10 | 001,153,368 | ---- | M] (Safer Networking Ltd.) -- D:\Programme\Spybot - Search & Destroy\SDWinSec.exe
PRC - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () -- D:\Programme\Steuer 2012\AAVUpdateManager\aavus.exe
 
 
========== Modules (No Company Name) ==========
 
MOD - [2012.07.10 15:36:24 | 001,192,664 | ---- | M] () -- C:\Users\Purple\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe
 
 
========== Win32 Services (SafeList) ==========
 
SRV:64bit: - [2009.07.14 03:40:01 | 000,193,536 | ---- | M] (Microsoft Corporation) [On_Demand | Stopped] -- C:\Windows\SysNative\appmgmts.dll -- (AppMgmt)
SRV - [2012.06.20 19:08:00 | 000,529,232 | ---- | M] (Valve Corporation) [On_Demand | Stopped] -- C:\Program Files (x86)\Common Files\Steam\SteamService.exe -- (Steam Client Service)
SRV - [2012.06.15 00:17:46 | 000,113,120 | ---- | M] (Mozilla Foundation) [On_Demand | Stopped] -- C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe -- (MozillaMaintenance)
SRV - [2012.05.31 14:09:52 | 000,098,576 | ---- | M] (SANDBOXIE L.T.D) [Auto | Running] -- C:\Programme\Sandboxie\SbieSvc.exe -- (SbieSvc)
SRV - [2012.05.15 12:48:00 | 001,262,400 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe -- (nvUpdatusService)
SRV - [2012.05.15 02:21:40 | 000,382,272 | ---- | M] (NVIDIA Corporation) [Auto | Running] -- C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe -- (Stereo Service)
SRV - [2012.05.08 22:26:59 | 000,110,032 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Programme\Avira\AntiVir Desktop\avguard.exe -- (AntiVirService)
SRV - [2012.05.08 22:26:59 | 000,086,224 | ---- | M] (Avira Operations GmbH & Co. KG) [Auto | Running] -- D:\Programme\Avira\AntiVir Desktop\sched.exe -- (AntiVirSchedulerService)
SRV - [2012.04.12 12:38:44 | 000,253,600 | ---- | M] (Adobe Systems Incorporated) [On_Demand | Stopped] -- C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe -- (AdobeFlashPlayerUpdateSvc)
SRV - [2012.04.04 15:56:40 | 000,654,408 | ---- | M] (Malwarebytes Corporation) [Auto | Running] -- D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe -- (MBAMService)
SRV - [2012.02.29 09:50:48 | 000,158,856 | R--- | M] (Skype Technologies) [Auto | Stopped] -- C:\Program Files (x86)\Skype\Updater\Updater.exe -- (SkypeUpdate)
SRV - [2012.01.03 15:10:42 | 000,063,928 | ---- | M] (Adobe Systems Incorporated) [Auto | Running] -- C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe -- (AdobeARMservice)
SRV - [2010.03.18 14:16:28 | 000,130,384 | ---- | M] (Microsoft Corporation) [Auto | Stopped] -- C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe -- (clr_optimization_v4.0.30319_32)
SRV - [2009.06.10 23:23:09 | 000,066,384 | ---- | M] (Microsoft Corporation) [Disabled | Stopped] -- C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe -- (clr_optimization_v2.0.50727_32)
SRV - [2008.10.24 17:35:44 | 000,128,296 | ---- | M] () [Auto | Running] -- D:\Programme\Steuer 2012\AAVUpdateManager\aavus.exe -- (AAV UpdateService)
 
 
========== Driver Services (SafeList) ==========
 
DRV:64bit: - [2012.05.22 14:26:10 | 000,147,288 | ---- | M] (Oracle Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\VBoxNetAdp.sys -- (VBoxNetAdp)
DRV:64bit: - [2012.05.08 22:26:59 | 000,132,832 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avipbb.sys -- (avipbb)
DRV:64bit: - [2012.05.08 22:26:59 | 000,098,848 | ---- | M] (Avira GmbH) [File_System | Auto | Running] -- C:\Windows\SysNative\drivers\avgntflt.sys -- (avgntflt)
DRV:64bit: - [2012.04.18 19:08:03 | 000,188,736 | ---- | M] (NVIDIA Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\nvhda64v.sys -- (NVHDA)
DRV:64bit: - [2012.04.04 15:56:40 | 000,024,904 | ---- | M] (Malwarebytes Corporation) [File_System | On_Demand | Running] -- C:\Windows\SysNative\drivers\mbam.sys -- (MBAMProtector)
DRV:64bit: - [2012.03.01 08:46:16 | 000,023,408 | ---- | M] (Microsoft Corporation) [Recognizer | Boot | Unknown] -- C:\Windows\SysNative\drivers\fs_rec.sys -- (Fs_Rec)
DRV:64bit: - [2011.09.16 17:08:07 | 000,027,760 | ---- | M] (Avira GmbH) [Kernel | System | Running] -- C:\Windows\SysNative\drivers\avkmgr.sys -- (avkmgr)
DRV:64bit: - [2011.03.11 08:41:12 | 000,107,904 | ---- | M] (Advanced Micro Devices) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsata.sys -- (amdsata)
DRV:64bit: - [2011.03.11 08:41:12 | 000,027,008 | ---- | M] (Advanced Micro Devices) [Kernel | Boot | Running] -- C:\Windows\SysNative\drivers\amdxata.sys -- (amdxata)
DRV:64bit: - [2010.11.20 15:33:35 | 000,078,720 | ---- | M] (Hewlett-Packard Company) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\HpSAMD.sys -- (HpSAMD)
DRV:64bit: - [2010.11.20 13:07:05 | 000,059,392 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\TsUsbFlt.sys -- (TsUsbFlt)
DRV:64bit: - [2009.12.01 12:31:10 | 001,155,072 | ---- | M] (C-Media Inc) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\cmudax3.sys -- (cmuda3)
DRV:64bit: - [2009.07.14 03:52:20 | 000,194,128 | ---- | M] (AMD Technologies Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\amdsbs.sys -- (amdsbs)
DRV:64bit: - [2009.07.14 03:48:04 | 000,065,600 | ---- | M] (LSI Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\lsi_sas2.sys -- (LSI_SAS2)
DRV:64bit: - [2009.07.14 03:45:55 | 000,024,656 | ---- | M] (Promise Technology) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\stexstor.sys -- (stexstor)
DRV:64bit: - [2009.07.14 02:35:32 | 000,012,288 | ---- | M] (Microsoft Corporation) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\serscan.sys -- (StillCam)
DRV:64bit: - [2009.06.10 22:34:33 | 003,286,016 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\evbda.sys -- (ebdrv)
DRV:64bit: - [2009.06.10 22:34:28 | 000,468,480 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\bxvbda.sys -- (b06bdrv)
DRV:64bit: - [2009.06.10 22:34:23 | 000,270,848 | ---- | M] (Broadcom Corporation) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\b57nd60a.sys -- (b57nd60a)
DRV:64bit: - [2009.06.10 22:31:59 | 000,031,232 | ---- | M] (Hauppauge Computer Works, Inc.) [Kernel | On_Demand | Stopped] -- C:\Windows\SysNative\drivers\hcw85cir.sys -- (hcw85cir)
DRV:64bit: - [2009.03.02 00:05:32 | 000,187,392 | ---- | M] (Realtek Corporation                                            ) [Kernel | On_Demand | Running] -- C:\Windows\SysNative\drivers\Rt64win7.sys -- (RTL8167)
DRV - [2012.05.31 14:09:50 | 000,166,576 | ---- | M] (SANDBOXIE L.T.D) [Kernel | On_Demand | Running] -- C:\Programme\Sandboxie\SbieDrv.sys -- (SbieDrv)
DRV - [2009.07.14 03:19:10 | 000,019,008 | ---- | M] (Microsoft Corporation) [File_System | On_Demand | Stopped] -- C:\Windows\SysWOW64\drivers\wimmount.sys -- (WIMMount)
 
 
========== Standard Registry (SafeList) ==========
 
 
========== Internet Explorer ==========
 
IE:64bit: - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE:64bit: - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = C:\Windows\SysWOW64\blank.htm
IE - HKLM\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKLM\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&FORM=IE8SRC
 
 
IE - HKU\.DEFAULT\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
IE - HKU\S-1-5-18\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
 
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = 7A 38 51 23 0E 02 CD 01  [binary data]
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = hxxp://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = hxxp://www.google.de/
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache = hxxp://de.msn.com/?ocid=iehp
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache AcceptLangs = de-DE
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1005\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page Redirect Cache_TIMESTAMP = C3 B6 80 2D CA 02 CD 01  [binary data]
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1005\..\SearchScopes,DefaultScope = {0633EE93-D776-472f-A0FF-E1416B8B2E3A}
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1005\..\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A}: "URL" = hxxp://www.bing.com/search?q={searchTerms}&src=IE-SearchBox&FORM=IE8SRC
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1005\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0
 
 
========== FireFox ==========
 
FF:64bit: - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF64_11_2_202_228.dll File not found
FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\SysWOW64\Macromed\Flash\NPSWF32_11_2_202_228.dll ()
FF - HKLM\Software\MozillaPlugins\@Google.com/GoogleEarthPlugin: C:\Program Files (x86)\Google\Google Earth\plugin\npgeplugin.dll (Google)
FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files (x86)\Java\jre6\bin\plugin2\npjp2.dll (Sun Microsystems, Inc.)
FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: C:\Program Files (x86)\Microsoft Silverlight\4.1.10329.0\npctrl.dll ( Microsoft Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVision: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dv.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@nvidia.com/3DVisionStreaming: C:\Program Files (x86)\NVIDIA Corporation\3D Vision\npnv3dvstreaming.dll (NVIDIA Corporation)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=3: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\@tools.google.com/Google Update;version=9: C:\Program Files (x86)\Google\Update\1.3.21.111\npGoogleUpdate3.dll (Google Inc.)
FF - HKLM\Software\MozillaPlugins\Adobe Reader: C:\Program Files (x86)\Adobe\Reader 10.0\Reader\AIR\nppdf32.dll (Adobe Systems Inc.)
 
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Components: D:\Programme\Neuer Ordner\components
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 11.0\extensions\\Plugins: D:\Programme\Neuer Ordner\plugins
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Components: D:\Programme\Firefox\components [2012.07.06 19:42:56 | 000,000,000 | ---D | M]
FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 13.0.1\extensions\\Plugins: D:\Programme\Firefox\plugins
 
 
O1 HOSTS File: ([2012.03.14 22:22:07 | 000,441,475 | R--- | M]) - C:\Windows\SysNative\drivers\etc\hosts
O1 - Hosts: 127.0.0.1        www.007guard.com
O1 - Hosts: 127.0.0.1        007guard.com
O1 - Hosts: 127.0.0.1        008i.com
O1 - Hosts: 127.0.0.1        www.008k.com
O1 - Hosts: 127.0.0.1        008k.com
O1 - Hosts: 127.0.0.1        www.00hq.com
O1 - Hosts: 127.0.0.1        00hq.com
O1 - Hosts: 127.0.0.1        010402.com
O1 - Hosts: 127.0.0.1        www.032439.com
O1 - Hosts: 127.0.0.1        032439.com
O1 - Hosts: 127.0.0.1        www.0scan.com
O1 - Hosts: 127.0.0.1        0scan.com
O1 - Hosts: 127.0.0.1        www.1000gratisproben.com
O1 - Hosts: 127.0.0.1        1000gratisproben.com
O1 - Hosts: 127.0.0.1        1001namen.com
O1 - Hosts: 127.0.0.1        www.1001namen.com
O1 - Hosts: 127.0.0.1        100888290cs.com
O1 - Hosts: 127.0.0.1        www.100888290cs.com
O1 - Hosts: 127.0.0.1        www.100sexlinks.com
O1 - Hosts: 127.0.0.1        100sexlinks.com
O1 - Hosts: 127.0.0.1        www.10sek.com
O1 - Hosts: 127.0.0.1        10sek.com
O1 - Hosts: 127.0.0.1        www.1-2005-search.com
O1 - Hosts: 127.0.0.1        1-2005-search.com
O1 - Hosts: 127.0.0.1        www.123fporn.info
O1 - Hosts: 15172 more lines...
O2:64bit: - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Programme\SnagIt\DLLx64\SnagitBHO64.dll (TechSmith Corporation)
O2 - BHO: (SnagIt Toolbar Loader) - {00C6482D-C502-44C8-8409-FCE54AD9C208} - D:\Programme\SnagIt\SnagitBHO.dll (TechSmith Corporation)
O2 - BHO: (Spybot-S&D IE Protection) - {53707962-6F74-2D53-2644-206D7942484F} - D:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O2 - BHO: (Java(tm) Plug-In SSV Helper) - {761497BB-D6F0-462C-B6EB-D4DAF1D92D43} - C:\Program Files (x86)\Java\jre6\bin\ssv.dll (Sun Microsystems, Inc.)
O3:64bit: - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Programme\SnagIt\DLLx64\SnagitIEAddin64.dll (TechSmith Corporation)
O3 - HKLM\..\Toolbar: (Snagit) - {8FF5E183-ABDE-46EB-B09E-D2AAB95CABE3} - D:\Programme\SnagIt\SnagitIEAddin.dll (TechSmith Corporation)
O4:64bit: - HKLM..\Run: [CmPCIaudio] C:\Windows\Syswow64\CMICNFG3.dll (C-Media Corporation)
O4 - HKLM..\Run: [avgnt] D:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG)
O4 - HKLM..\Run: [ControlCenter3] C:\Program Files (x86)\Brother\ControlCenter3\brctrcen.exe (Brother Industries, Ltd.)
O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] D:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation)
O4 - HKU\S-1-5-19..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-20..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1001..\Run: [Rainlendar2] D:\Programme\Rainlendar2\Rainlendar2.exe ()
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1001..\Run: [SpybotSD TeaTimer] D:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1004..\Run: [Sidebar] C:\Program Files (x86)\Windows Sidebar\Sidebar.exe (Microsoft Corporation)
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1005..\Run: [SandboxieControl] C:\Program Files\Sandboxie\SbieCtrl.exe (SANDBOXIE L.T.D)
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1005..\Run: [Spotify Web Helper] C:\Users\Purple\AppData\Roaming\Spotify\Data\SpotifyWebHelper.exe ()
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1005..\Run: [Steam] D:\Games\Steam\Steam.exe (Valve Corporation)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1001..\RunOnce: [Report] \AdwCleaner[S1].txt File not found
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - Startup: C:\Users\Purple\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Rainlendar2.lnk = D:\Programme\Rainlendar2\Rainlendar2.exe ()
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O7 - HKU\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
O8:64bit: - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Purplehaze\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8:64bit: - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Office 2007\Office12\EXCEL.EXE (Microsoft Corporation)
O8 - Extra context menu item: Free YouTube to MP3 Converter - C:\Users\Purplehaze\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm ()
O8 - Extra context menu item: Nach Microsoft E&xel exportieren - D:\Programme\Office 2007\Office12\EXCEL.EXE (Microsoft Corporation)
O9 - Extra Button: An OneNote senden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra 'Tools' menuitem : An OneNote s&enden - {2670000A-7350-4f3c-8081-5663EE0C6C49} - Reg Error: Value error. File not found
O9 - Extra Button: ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - D:\Programme\ICQ\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra 'Tools' menuitem : ICQ7.7 - {77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - D:\Programme\ICQ\ICQ7.7\ICQ.exe (ICQ, LLC.)
O9 - Extra Button: Research - {92780B25-18CC-41C8-B9BE-3C9C571A8263} - D:\Programme\Office 2007\Office12\REFIEBAR.DLL (Microsoft Corporation)
O9 - Extra 'Tools' menuitem : Spybot - Search & Destroy Configuration - {DFB852A3-47F8-48C4-A200-58CAB36FD2A2} - D:\Programme\Spybot - Search & Destroy\SDHelper.dll (Safer Networking Limited)
O1364bit: - gopher Prefix: missing
O13 - gopher Prefix: missing
O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-0016-0000-0031-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_31-windows-i586.cab (Java Plug-in 1.6.0_31)
O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.2.1
O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{F39304E9-BD06-47CD-AA7B-A161A68F321E}: DhcpNameServer = 192.168.2.1
O18:64bit: - Protocol\Handler\ms-help - No CLSID value found
O18:64bit: - Protocol\Handler\skype4com - No CLSID value found
O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\PROGRA~2\COMMON~1\Skype\SKYPE4~1.DLL (Skype Technologies)
O18:64bit: - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\Programme\Common Files\Microsoft Shared\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O18 - Protocol\Filter\text/xml {807563E5-5146-11D5-A672-00B0D022E945} - C:\PROGRA~2\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\explorer.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) - C:\Windows\SysNative\userinit.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (SystemPropertiesPerformance.exe) - C:\Windows\SysNative\SystemPropertiesPerformance.exe (Microsoft Corporation)
O20:64bit: - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O20 - HKLM Winlogon: Shell - (explorer.exe) - C:\Windows\SysWow64\explorer.exe (Microsoft Corporation)
O20 - HKLM Winlogon: UserInit - (userinit.exe) - C:\Windows\SysWow64\userinit.exe (Microsoft Corporation)
O20 - HKLM Winlogon: VMApplet - (/pagefile) -  File not found
O21:64bit: - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O21 - SSODL: WebCheck - {E6FB5E20-DE35-11CF-9C87-00AA005127ED} - No CLSID value found.
O32 - HKLM CDRom: AutoRun - 1
O34 - HKLM BootExecute: (autocheck autochk *)
O35:64bit: - HKLM\..comfile [open] -- "%1" %*
O35:64bit: - HKLM\..exefile [open] -- "%1" %*
O35 - HKLM\..comfile [open] -- "%1" %*
O35 - HKLM\..exefile [open] -- "%1" %*
O37:64bit: - HKLM\...com [@ = comfile] -- "%1" %*
O37:64bit: - HKLM\...exe [@ = exefile] -- "%1" %*
O37 - HKLM\...com [@ = comfile] -- "%1" %*
O37 - HKLM\...exe [@ = exefile] -- "%1" %*
O38 - SubSystems\\Windows: (ServerDll=winsrv:UserServerDllInitialization,3)
O38 - SubSystems\\Windows: (ServerDll=winsrv:ConServerDllInitialization,2)
O38 - SubSystems\\Windows: (ServerDll=sxssrv,4)
 
NetSvcs:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
 
MsConfig:64bit - StartUpReg: Adobe ARM - hkey= - key= - C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe (Adobe Systems Incorporated)
MsConfig:64bit - StartUpReg: Guard.Mail.ru.gui - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: ICQ - hkey= - key= - D:\Programme\ICQ\ICQ7.7\ICQ.exe (ICQ, LLC.)
MsConfig:64bit - StartUpReg: KiesHelper - hkey= - key= - D:\Programme\Kies\KiesHelper.exe (Samsung)
MsConfig:64bit - StartUpReg: KiesTrayAgent - hkey= - key= - D:\Programme\Kies\KiesTrayAgent.exe (Samsung Electronics Co., Ltd.)
MsConfig:64bit - StartUpReg: NapsterShell - hkey= - key= -  File not found
MsConfig:64bit - StartUpReg: Skype - hkey= - key= - C:\Program Files (x86)\Skype\Phone\Skype.exe (Skype Technologies S.A.)
MsConfig:64bit - StartUpReg: SunJavaUpdateSched - hkey= - key= - C:\Program Files (x86)\Common Files\Java\Java Update\jusched.exe (Sun Microsystems, Inc.)
MsConfig:64bit - State: "startup" - Reg Error: Key error.
 
SafeBootMin:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootMin:64bit: Base - Driver Group
SafeBootMin:64bit: Boot Bus Extender - Driver Group
SafeBootMin:64bit: Boot file system - Driver Group
SafeBootMin:64bit: File system - Driver Group
SafeBootMin:64bit: Filter - Driver Group
SafeBootMin:64bit: HelpSvc - Service
SafeBootMin:64bit: PCI Configuration - Driver Group
SafeBootMin:64bit: PNP Filter - Driver Group
SafeBootMin:64bit: Primary disk - Driver Group
SafeBootMin:64bit: sacsvr - Service
SafeBootMin:64bit: SCSI Class - Driver Group
SafeBootMin:64bit: System Bus Extender - Driver Group
SafeBootMin:64bit: vmms - Service
SafeBootMin:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootMin: Base - Driver Group
SafeBootMin: Boot Bus Extender - Driver Group
SafeBootMin: Boot file system - Driver Group
SafeBootMin: File system - Driver Group
SafeBootMin: Filter - Driver Group
SafeBootMin: HelpSvc - Service
SafeBootMin: PCI Configuration - Driver Group
SafeBootMin: PNP Filter - Driver Group
SafeBootMin: Primary disk - Driver Group
SafeBootMin: sacsvr - Service
SafeBootMin: SCSI Class - Driver Group
SafeBootMin: System Bus Extender - Driver Group
SafeBootMin: vmms - Service
SafeBootMin: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootMin: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootMin: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootMin: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootMin: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootMin: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootMin: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootMin: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootMin: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootMin: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootMin: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootMin: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootMin: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootMin: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootMin: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootMin: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootMin: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
SafeBootNet:64bit: AppMgmt - C:\Windows\SysNative\appmgmts.dll (Microsoft Corporation)
SafeBootNet:64bit: Base - Driver Group
SafeBootNet:64bit: Boot Bus Extender - Driver Group
SafeBootNet:64bit: Boot file system - Driver Group
SafeBootNet:64bit: File system - Driver Group
SafeBootNet:64bit: Filter - Driver Group
SafeBootNet:64bit: HelpSvc - Service
SafeBootNet:64bit: Messenger - Service
SafeBootNet:64bit: NDIS Wrapper - Driver Group
SafeBootNet:64bit: NetBIOSGroup - Driver Group
SafeBootNet:64bit: NetDDEGroup - Driver Group
SafeBootNet:64bit: Network - Driver Group
SafeBootNet:64bit: NetworkProvider - Driver Group
SafeBootNet:64bit: PCI Configuration - Driver Group
SafeBootNet:64bit: PNP Filter - Driver Group
SafeBootNet:64bit: PNP_TDI - Driver Group
SafeBootNet:64bit: Primary disk - Driver Group
SafeBootNet:64bit: rdsessmgr - Service
SafeBootNet:64bit: sacsvr - Service
SafeBootNet:64bit: SCSI Class - Driver Group
SafeBootNet:64bit: Streams Drivers - Driver Group
SafeBootNet:64bit: System Bus Extender - Driver Group
SafeBootNet:64bit: TDI - Driver Group
SafeBootNet:64bit: vmms - Service
SafeBootNet:64bit: WudfUsbccidDriver - Driver
SafeBootNet:64bit: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet:64bit: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet:64bit: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet:64bit: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet:64bit: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet:64bit: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet:64bit: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet:64bit: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet:64bit: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet:64bit: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet:64bit: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet:64bit: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet:64bit: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet:64bit: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet:64bit: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet:64bit: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet:64bit: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet:64bit: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet:64bit: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet:64bit: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet:64bit: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet:64bit: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
SafeBootNet: Base - Driver Group
SafeBootNet: Boot Bus Extender - Driver Group
SafeBootNet: Boot file system - Driver Group
SafeBootNet: File system - Driver Group
SafeBootNet: Filter - Driver Group
SafeBootNet: HelpSvc - Service
SafeBootNet: Messenger - Service
SafeBootNet: NDIS Wrapper - Driver Group
SafeBootNet: NetBIOSGroup - Driver Group
SafeBootNet: NetDDEGroup - Driver Group
SafeBootNet: Network - Driver Group
SafeBootNet: NetworkProvider - Driver Group
SafeBootNet: PCI Configuration - Driver Group
SafeBootNet: PNP Filter - Driver Group
SafeBootNet: PNP_TDI - Driver Group
SafeBootNet: Primary disk - Driver Group
SafeBootNet: rdsessmgr - Service
SafeBootNet: sacsvr - Service
SafeBootNet: SCSI Class - Driver Group
SafeBootNet: Streams Drivers - Driver Group
SafeBootNet: System Bus Extender - Driver Group
SafeBootNet: TDI - Driver Group
SafeBootNet: vmms - Service
SafeBootNet: WudfUsbccidDriver - Driver
SafeBootNet: {36FC9E60-C465-11CF-8056-444553540000} - Universal Serial Bus controllers
SafeBootNet: {4D36E965-E325-11CE-BFC1-08002BE10318} - CD-ROM Drive
SafeBootNet: {4D36E967-E325-11CE-BFC1-08002BE10318} - DiskDrive
SafeBootNet: {4D36E969-E325-11CE-BFC1-08002BE10318} - Standard floppy disk controller
SafeBootNet: {4D36E96A-E325-11CE-BFC1-08002BE10318} - Hdc
SafeBootNet: {4D36E96B-E325-11CE-BFC1-08002BE10318} - Keyboard
SafeBootNet: {4D36E96F-E325-11CE-BFC1-08002BE10318} - Mouse
SafeBootNet: {4D36E972-E325-11CE-BFC1-08002BE10318} - Net
SafeBootNet: {4D36E973-E325-11CE-BFC1-08002BE10318} - NetClient
SafeBootNet: {4D36E974-E325-11CE-BFC1-08002BE10318} - NetService
SafeBootNet: {4D36E975-E325-11CE-BFC1-08002BE10318} - NetTrans
SafeBootNet: {4D36E977-E325-11CE-BFC1-08002BE10318} - PCMCIA Adapters
SafeBootNet: {4D36E97B-E325-11CE-BFC1-08002BE10318} - SCSIAdapter
SafeBootNet: {4D36E97D-E325-11CE-BFC1-08002BE10318} - System
SafeBootNet: {4D36E980-E325-11CE-BFC1-08002BE10318} - Floppy disk drive
SafeBootNet: {50DD5230-BA8A-11D1-BF5D-0000F805F530} - Smart card readers
SafeBootNet: {533C5B84-EC70-11D2-9505-00C04F79DEAF} - Volume shadow copy
SafeBootNet: {6BDD1FC1-810F-11D0-BEC7-08002BE2092F} - IEEE 1394 Bus host controllers
SafeBootNet: {71A27CDD-812A-11D0-BEC7-08002BE2092F} - Volume
SafeBootNet: {745A17A0-74D3-11D0-B6FE-00A0C90F57DA} - Human Interface Devices
SafeBootNet: {D48179BE-EC20-11D1-B6B8-00C04FA372A7} - SBP2 IEEE 1394 Devices
SafeBootNet: {D94EE5D8-D189-4994-83D2-F68D7D41B0E6} - SecurityDevices
 
ActiveX:64bit: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX:64bit: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX:64bit: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX:64bit: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX:64bit: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX:64bit: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX:64bit: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX:64bit: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX:64bit: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX:64bit: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX:64bit: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX:64bit: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX:64bit: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\System32\ie4uinit.exe -BaseSettings
ActiveX:64bit: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\system32\Rundll32.exe C:\Windows\system32\mscories.dll,Install
ActiveX:64bit: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX:64bit: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX:64bit: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX:64bit: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX:64bit: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX:64bit: {FEBEF00C-046D-438D-8A88-BF94A6C9E703} - .NET Framework
ActiveX:64bit: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX:64bit: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\System32\ie4uinit.exe -UserIconConfig
ActiveX:64bit: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\iedkcs32.dll",BrandIEActiveSetup SIGNUP
ActiveX: {08B0E5C0-4FCB-11CF-AAA5-00401C608500} - Java (Sun)
ActiveX: {22d6f312-b0f6-11d0-94ab-0080c74c7e95} - Microsoft Windows Media Player 12.0
ActiveX: {25FFAAD0-F4A3-4164-95FF-4461E9F35D51} - .NET Framework
ActiveX: {2C7339CF-2B09-4501-B3F3-F3508C9228ED} - %SystemRoot%\system32\regsvr32.exe /s /n /i:/UserInstall %SystemRoot%\system32\themeui.dll
ActiveX: {3af36230-a269-11d1-b5bf-0000f8051515} - Offline Browsing Pack
ActiveX: {44BBA840-CC51-11CF-AAFA-00AA00B6015C} - "%ProgramFiles(x86)%\Windows Mail\WinMail.exe" OCInstallUserConfigOE
ActiveX: {44BBA855-CC51-11CF-AAFA-00AA00B6015F} - DirectDrawEx
ActiveX: {45ea75a0-a269-11d1-b5bf-0000f8051515} - Internet Explorer Help
ActiveX: {4f645220-306d-11d2-995d-00c04f98bbc9} - Microsoft Windows Script 5.6
ActiveX: {5fd399c0-a70a-11d1-9948-00c04f98bbc9} - Internet Explorer Setup Tools
ActiveX: {630b1da0-b465-11d1-9948-00c04f98bbc9} - Browsing Enhancements
ActiveX: {6BF52A52-394A-11d3-B153-00C04F79FAA6} - Microsoft Windows Media Player
ActiveX: {6fab99d0-bab8-11d1-994a-00c04f98bbc9} - MSN Site Access
ActiveX: {7790769C-0471-11d2-AF11-00C04FA35D02} - Address Book 7
ActiveX: {7C028AF8-F614-47B3-82DA-BA94E41B1089} - .NET Framework
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4340} - regsvr32.exe /s /n /i:U shell32.dll
ActiveX: {89820200-ECBD-11cf-8B85-00AA005B4383} - C:\Windows\SysWOW64\ie4uinit.exe -BaseSettings
ActiveX: {89B4C1CD-B018-4511-B0A1-5476DBF70820} - C:\Windows\SysWOW64\Rundll32.exe C:\Windows\SysWOW64\mscories.dll,Install
ActiveX: {9381D8F2-0288-11D0-9501-00AA00B911A5} - Dynamic HTML Data Binding
ActiveX: {A8D647C8-65AC-409F-B7B2-3C0FEE1A32F2} - C:\Program Files (x86)\PixiePack Codec Pack\InstallerHelper.exe
ActiveX: {C9E9A340-D1F1-11D0-821E-444553540600} - Internet Explorer Core Fonts
ActiveX: {de5aed00-a4bf-11d1-9948-00c04f98bbc9} - HTML Help
ActiveX: {E92B03AB-B707-11d2-9CBD-0000F87A369E} - Active Directory Service Interface
ActiveX: {F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4} - .NET Framework
ActiveX: >{22d6f312-b0f6-11d0-94ab-0080c74c7e95} - %SystemRoot%\system32\unregmp2.exe /ShowWMP
ActiveX: >{26923b43-4d38-484f-9b9e-de460746276c} - C:\Windows\SysWOW64\ie4uinit.exe -UserIconConfig
ActiveX: >{60B49E34-C7CC-11D0-8953-00A0C90347FF} - "C:\Windows\SysWOW64\rundll32.exe" "C:\Windows\SysWOW64\iedkcs32.dll",BrandIEActiveSetup SIGNUP
 
Drivers32:64bit: msacm.l3acm - C:\Windows\System32\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: msacm.l3acm - C:\Windows\SysWOW64\l3codeca.acm (Fraunhofer Institut Integrierte Schaltungen IIS)
Drivers32: vidc.cvid - C:\Windows\SysWow64\iccvid.dll (Radius Inc.)
Drivers32: vidc.dvsd - C:\Windows\SysWow64\mcdvd_32.dll (MainConcept)
Drivers32: vidc.iv31 - C:\Windows\SysWOW64\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.iv32 - C:\Windows\SysWOW64\ir32_32.dll (Intel(R) Corporation)
Drivers32: vidc.mjpg - C:\Windows\SysWow64\mcmjpg32.dll (MainConcept)
Drivers32: VIDC.MP42 - C:\Windows\SysWow64\Mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MP43 - C:\Windows\SysWow64\Mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.MPG4 - C:\Windows\SysWow64\Mpg4c32.dll (Microsoft Corporation)
Drivers32: VIDC.ZMBV - C:\Windows\SysWow64\zmbv.dll ()
 
CREATERESTOREPOINT
Restore point Set: OTL Restore Point
 
========== Files/Folders - Created Within 30 Days ==========
 
[2012.07.11 20:40:31 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\NVIDIA Corporation
[2012.07.11 17:45:08 | 000,000,000 | ---D | C] -- C:\ProgramData\TERA
[2012.07.11 17:44:16 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TERA
[2012.07.11 17:04:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware
[2012.07.11 17:04:19 | 000,024,904 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\SysNative\drivers\mbam.sys
[2012.07.06 19:42:57 | 000,000,000 | ---D | C] -- C:\Program Files (x86)\Mozilla Maintenance Service
[2012.07.06 19:42:57 | 000,000,000 | ---D | C] -- C:\ProgramData\Mozilla
[2012.06.22 17:59:34 | 000,000,000 | ---D | C] -- C:\Users\Purplehaze\AppData\Local\Chromium
[2012.06.21 23:28:07 | 000,000,000 | ---D | C] -- C:\Users\Purplehaze\AppData\Local\Funcom
[2012.06.21 23:28:06 | 000,000,000 | ---D | C] -- C:\ProgramData\media center programs
[2012.06.21 23:28:04 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Funcom
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files - Modified Within 30 Days ==========
 
[2012.07.16 16:28:02 | 000,013,584 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-1.C7483456-A289-439d-8115-601632D005A0
[2012.07.16 16:28:02 | 000,013,584 | -H-- | M] () -- C:\Windows\SysNative\7B296FB0-376B-497e-B012-9C450E1B7327-5P-0.C7483456-A289-439d-8115-601632D005A0
[2012.07.16 16:20:28 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat
[2012.07.16 16:20:23 | 3220,627,456 | -HS- | M] () -- C:\hiberfil.sys
[2012.07.12 08:30:57 | 000,342,904 | ---- | M] () -- C:\Windows\SysNative\FNTCACHE.DAT
[2012.07.11 20:42:19 | 000,001,734 | ---- | M] () -- C:\Windows\Sandboxie.ini
[2012.07.11 17:44:16 | 000,000,755 | ---- | M] () -- C:\Users\Purplehaze\Desktop\TERA.lnk
[2012.07.03 13:13:59 | 000,006,608 | ---- | M] () -- C:\bootsqm.dat
[2012.06.24 13:36:15 | 001,498,506 | ---- | M] () -- C:\Windows\SysNative\PerfStringBackup.INI
[2012.06.24 13:36:15 | 000,653,928 | ---- | M] () -- C:\Windows\SysNative\perfh007.dat
[2012.06.24 13:36:15 | 000,615,810 | ---- | M] () -- C:\Windows\SysNative\perfh009.dat
[2012.06.24 13:36:15 | 000,129,800 | ---- | M] () -- C:\Windows\SysNative\perfc007.dat
[2012.06.24 13:36:15 | 000,106,190 | ---- | M] () -- C:\Windows\SysNative\perfc009.dat
[1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ]
 
========== Files Created - No Company Name ==========
 
[2012.07.11 17:44:16 | 000,000,755 | ---- | C] () -- C:\Users\Purplehaze\Desktop\TERA.lnk
[2012.07.03 13:13:59 | 000,006,608 | ---- | C] () -- C:\bootsqm.dat
[2012.06.11 21:49:17 | 000,001,734 | ---- | C] () -- C:\Windows\Sandboxie.ini
[2012.05.15 02:21:50 | 000,423,744 | ---- | C] () -- C:\Windows\SysWow64\nvStreaming.exe
[2012.04.18 19:28:31 | 000,204,857 | ---- | C] () -- C:\Windows\SysWow64\InstallHelp.dll
[2012.04.18 19:28:31 | 000,111,308 | ---- | C] () -- C:\Windows\SysWow64\GMTUninstall.exe
[2012.03.31 20:20:25 | 000,000,000 | ---- | C] () -- C:\Users\Purplehaze\defogger_reenable
[2012.03.19 19:32:47 | 000,000,425 | ---- | C] () -- C:\Windows\BRWMARK.INI
[2012.03.14 20:29:45 | 000,143,360 | ---- | C] () -- C:\Windows\SysWow64\VmixP6.dll
[2012.03.14 20:29:45 | 000,000,232 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.cfl
[2012.03.14 20:29:40 | 000,002,754 | ---- | C] () -- C:\Windows\cmudax3.ini
[2012.03.14 20:29:40 | 000,002,123 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.cfg
[2012.03.14 20:29:40 | 000,000,149 | ---- | C] () -- C:\Windows\Cmicnfg3.ini.imi
[2012.01.31 02:15:44 | 000,030,568 | ---- | C] () -- C:\Windows\MusiccityDownload.exe
[2012.01.31 02:15:42 | 000,974,848 | ---- | C] () -- C:\Windows\SysWow64\cis-2.4.dll
[2012.01.31 02:15:42 | 000,081,920 | ---- | C] () -- C:\Windows\SysWow64\issacapi_bs-2.3.dll
[2012.01.31 02:15:42 | 000,065,536 | ---- | C] () -- C:\Windows\SysWow64\issacapi_pe-2.3.dll
[2012.01.31 02:15:42 | 000,057,344 | ---- | C] () -- C:\Windows\SysWow64\issacapi_se-2.3.dll
 
========== LOP Check ==========
 
[2012.03.29 19:54:50 | 000,000,000 | ---D | M] -- C:\Users\Purple\AppData\Roaming\com.Rhapsody.Napster5
[2012.03.29 22:35:29 | 000,000,000 | ---D | M] -- C:\Users\Purple\AppData\Roaming\DVDVideoSoft
[2012.07.13 07:44:13 | 000,000,000 | ---D | M] -- C:\Users\Purple\AppData\Roaming\ICQ
[2012.04.09 11:32:24 | 000,000,000 | ---D | M] -- C:\Users\Purple\AppData\Roaming\ImgBurn
[2012.07.12 20:31:24 | 000,000,000 | ---D | M] -- C:\Users\Purple\AppData\Roaming\Spotify
[2012.04.18 21:25:22 | 000,000,000 | ---D | M] -- C:\Users\Purple\AppData\Roaming\Tropico 4 Demo
[2012.03.29 22:35:26 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\DVDVideoSoft
[2012.03.29 22:35:22 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.14 22:46:05 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\ICQ
[2012.03.14 22:11:25 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\ICQ Search
[2012.03.14 22:22:06 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\ImgBurn
[2012.03.14 23:22:15 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Samsung
[2009.07.14 07:08:49 | 000,001,134 | ---- | M] () -- C:\Windows\Tasks\SCHEDLGU.TXT
 
========== Purity Check ==========
 
 
 
========== Custom Scans ==========
 
< %ALLUSERSPROFILE%\Application Data\*. >
 
< %ALLUSERSPROFILE%\Application Data\*.exe /s >
 
< %APPDATA%\*. >
[2012.03.29 19:54:45 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Adobe
[2012.03.14 20:55:18 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Avira
[2012.03.29 22:35:26 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\DVDVideoSoft
[2012.03.29 22:35:22 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\DVDVideoSoftIEHelpers
[2012.03.14 22:46:05 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\ICQ
[2012.03.14 22:11:25 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\ICQ Search
[2012.03.14 20:07:45 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Identities
[2012.03.14 22:22:06 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\ImgBurn
[2012.03.14 20:21:35 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Macromedia
[2012.04.02 19:13:09 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Malwarebytes
[2009.07.14 20:18:34 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Media Center Programs
[2012.03.14 23:22:19 | 000,000,000 | --SD | M] -- C:\Users\Purplehaze\AppData\Roaming\Microsoft
[2012.07.06 19:41:21 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Mozilla
[2012.03.14 23:22:15 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Samsung
[2012.03.14 23:50:04 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Skype
[2012.03.14 21:52:22 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\vlc
[2012.03.14 22:06:08 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\Winamp
[2012.03.14 23:24:07 | 000,000,000 | ---D | M] -- C:\Users\Purplehaze\AppData\Roaming\WinRAR
 
< %APPDATA%\*.exe /s >
 
< %SYSTEMDRIVE%\*.exe >
 
< MD5 for: AGP440.SYS  >
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\drivers\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\SysNative\DriverStore\FileRepository\machine.inf_amd64_neutral_a2f120466549d68b\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7600.16385_none_1607dee2d861e021\AGP440.sys
[2009.07.14 03:52:21 | 000,061,008 | ---- | M] (Microsoft Corporation) MD5=608C14DBA7299D8CB6ED035A68A15799 -- C:\Windows\winsxs\amd64_machine.inf_31bf3856ad364e35_6.1.7601.17514_none_1838f2aad55063bb\AGP440.sys
 
< MD5 for: ATAPI.SYS  >
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\drivers\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\SysNative\DriverStore\FileRepository\mshdc.inf_amd64_neutral_aad30bdeec04ea5e\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7600.16385_none_392d19c13b3ad543\atapi.sys
[2009.07.14 03:52:21 | 000,024,128 | ---- | M] (Microsoft Corporation) MD5=02062C0B390B7729EDC9E69C680A6F3C -- C:\Windows\winsxs\amd64_mshdc.inf_31bf3856ad364e35_6.1.7601.17514_none_3b5e2d89382958dd\atapi.sys
 
< MD5 for: CNGAUDIT.DLL  >
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\SysWOW64\cngaudit.dll
[2009.07.14 03:15:06 | 000,012,288 | ---- | M] (Microsoft Corporation) MD5=50BA656134F78AF64E4DD3C8B6FEFD7E -- C:\Windows\winsxs\x86_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_e83a414890e8132b\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\SysNative\cngaudit.dll
[2009.07.14 03:40:20 | 000,018,944 | ---- | M] (Microsoft Corporation) MD5=86FE1B1F8FD42CD0DB641AB1CDB13093 -- C:\Windows\winsxs\amd64_microsoft-windows-cngaudit-dll_31bf3856ad364e35_6.1.7600.16385_none_4458dccc49458461\cngaudit.dll
 
< MD5 for: IASTORV.SYS  >
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_668286aa35d55928\iaStorV.sys
[2010.11.20 15:33:38 | 000,410,496 | ---- | M] (Intel Corporation) MD5=3DF4395A7CF8B7A72A5F4606366B8C2D -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17514_none_0d3757e79e6784d0\iaStorV.sys
[2011.03.11 08:19:16 | 000,410,496 | ---- | M] (Intel Corporation) MD5=5B3DE7208E5000D5B451B9D290D2579C -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.21680_none_0d714416b7c182d5\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\drivers\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\SysNative\DriverStore\FileRepository\iastorv.inf_amd64_neutral_0bcee2057afcc090\iaStorV.sys
[2011.03.11 08:41:26 | 000,410,496 | ---- | M] (Intel Corporation) MD5=AAAF44DB3BD0B9D1FB6969B23ECC8366 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7601.17577_none_0cf9793d9e95787b\iaStorV.sys
[2011.03.11 08:23:00 | 000,410,496 | ---- | M] (Intel Corporation) MD5=B75E45C564E944A2657167D197AB29DA -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16778_none_0b141c81a16e25e6\iaStorV.sys
[2011.03.11 08:25:49 | 000,410,496 | ---- | M] (Intel Corporation) MD5=BFDC9D75698800CFE4D1698BF2750EA2 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.20921_none_0bccc8c8ba6985c1\iaStorV.sys
[2009.07.14 03:48:04 | 000,410,688 | ---- | M] (Intel Corporation) MD5=D83EFB6FD45DF9D55E9A1AFC63640D50 -- C:\Windows\winsxs\amd64_iastorv.inf_31bf3856ad364e35_6.1.7600.16385_none_0b06441fa1790136\iaStorV.sys
 
< MD5 for: NETLOGON.DLL  >
[2009.07.14 03:41:52 | 000,692,736 | ---- | M] (Microsoft Corporation) MD5=956D030D375F207B22FB111E06EF9C35 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_59aca8ea51aaeefe\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\SysNative\netlogon.dll
[2010.11.20 15:27:22 | 000,695,808 | ---- | M] (Microsoft Corporation) MD5=AA339DD8BB128EF66660DFBBB59043D3 -- C:\Windows\winsxs\amd64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_5bddbcb24e997298\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\SysWOW64\netlogon.dll
[2010.11.20 14:20:28 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=C1809B9907ADEDAF16F50C894100883B -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7601.17514_none_6632670482fa3493\netlogon.dll
[2009.07.14 03:16:02 | 000,563,712 | ---- | M] (Microsoft Corporation) MD5=EAA75D9000B71F10EEC04D2AE6C60E81 -- C:\Windows\winsxs\wow64_microsoft-windows-security-netlogon_31bf3856ad364e35_6.1.7600.16385_none_6401533c860bb0f9\netlogon.dll
 
< MD5 for: NVSTOR.SYS  >
[2009.07.14 03:45:45 | 000,167,488 | ---- | M] (NVIDIA Corporation) MD5=477DC4D6DEB99BE37084C9AC6D013DA1 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16385_none_95cfb4ced8afab0e\nvstor.sys
[2011.03.11 08:23:06 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=6C1D5F70E7A6A3FD1C90D840EDC048B9 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.16778_none_95dd8d30d8a4cfbe\nvstor.sys
[2011.03.11 08:25:53 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=AE274836BA56518E279087363A781214 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7600.20921_none_96963977f1a02f99\nvstor.sys
[2011.03.11 08:19:21 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=D23C7E8566DA2B8A7C0DBBB761D54888 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.21680_none_983ab4c5eef82cad\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\drivers\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_0276fc3b3ea60d41\nvstor.sys
[2011.03.11 08:41:34 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=DAB0E87525C10052BF65F06152F37E4A -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17577_none_97c2e9ecd5cc2253\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\SysNative\DriverStore\FileRepository\nvraid.inf_amd64_neutral_dd659ed032d28a14\nvstor.sys
[2010.11.20 15:33:48 | 000,166,272 | ---- | M] (NVIDIA Corporation) MD5=F7CD50FE7139F07E77DA8AC8033D1832 -- C:\Windows\winsxs\amd64_nvraid.inf_31bf3856ad364e35_6.1.7601.17514_none_9800c896d59e2ea8\nvstor.sys
 
< MD5 for: SCECLI.DLL  >
[2009.07.14 03:16:13 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=26073302DAEA83CC5B944C546D6B47D2 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9e577e55272d37b4\scecli.dll
[2009.07.14 03:41:53 | 000,232,448 | ---- | M] (Microsoft Corporation) MD5=398712DDDAEFB85EDF61DF6A07B65C79 -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7600.16385_none_9402d402f2cc75b9\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\SysWOW64\scecli.dll
[2010.11.20 14:21:04 | 000,175,616 | ---- | M] (Microsoft Corporation) MD5=8124944EC89D6A1815E4E53F5B96AAF4 -- C:\Windows\winsxs\wow64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_a088921d241bbb4e\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\SysNative\scecli.dll
[2010.11.20 15:27:25 | 000,232,960 | ---- | M] (Microsoft Corporation) MD5=ED78427259134C63ED69804D2132B86C -- C:\Windows\winsxs\amd64_microsoft-windows-s..urationengineclient_31bf3856ad364e35_6.1.7601.17514_none_9633e7caefbaf953\scecli.dll
 
< MD5 for: USER32.DLL  >
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\SysWOW64\user32.dll
[2010.11.20 14:08:57 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=5E0DB2D8B2750543CD2EBB9EA8E6CDD3 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_35b31c02b85ccb6e\user32.dll
[2009.07.14 03:41:56 | 001,008,640 | ---- | M] (Microsoft Corporation) MD5=72D7B3EA16946E8F0CF7458150031CC6 -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_292d5de8870d85d9\user32.dll
[2009.07.14 03:11:24 | 000,833,024 | ---- | M] (Microsoft Corporation) MD5=E8B0FFC209E504CB7E79FC24E6C085F0 -- C:\Windows\winsxs\wow64_microsoft-windows-user32_31bf3856ad364e35_6.1.7600.16385_none_3382083abb6e47d4\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\SysNative\user32.dll
[2010.11.20 15:27:27 | 001,008,128 | ---- | M] (Microsoft Corporation) MD5=FE70103391A64039A921DBFFF9C7AB1B -- C:\Windows\winsxs\amd64_microsoft-windows-user32_31bf3856ad364e35_6.1.7601.17514_none_2b5e71b083fc0973\user32.dll
 
< MD5 for: USERINIT.EXE  >
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\SysWOW64\userinit.exe
[2010.11.20 14:17:48 | 000,026,624 | ---- | M] (Microsoft Corporation) MD5=61AC3EFDFACFDD3F0F11DD4FD4044223 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_de3024012ff21116\userinit.exe
[2009.07.14 03:14:43 | 000,026,112 | ---- | M] (Microsoft Corporation) MD5=6DE80F60D7DE9CE6B8C2DDFDF79EF175 -- C:\Windows\winsxs\x86_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_dbff103933038d7c\userinit.exe
[2009.07.14 03:39:48 | 000,030,208 | ---- | M] (Microsoft Corporation) MD5=6F8F1376A13114CC10C0E69274F5A4DE -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7600.16385_none_381dabbceb60feb2\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\SysNative\userinit.exe
[2010.11.20 15:25:24 | 000,030,720 | ---- | M] (Microsoft Corporation) MD5=BAFE84E637BF7388C96EF48D4D3FDD53 -- C:\Windows\winsxs\amd64_microsoft-windows-userinit_31bf3856ad364e35_6.1.7601.17514_none_3a4ebf84e84f824c\userinit.exe
 
< MD5 for: WININIT.EXE  >
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\SysNative\wininit.exe
[2009.07.14 03:39:52 | 000,129,024 | ---- | M] (Microsoft Corporation) MD5=94355C28C1970635A31B3FE52EB7CEBA -- C:\Windows\winsxs\amd64_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_8ce7aa761e01ad49\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\SysWOW64\wininit.exe
[2009.07.14 03:14:45 | 000,096,256 | ---- | M] (Microsoft Corporation) MD5=B5C5DCAD3899512020D135600129D665 -- C:\Windows\winsxs\x86_microsoft-windows-wininit_31bf3856ad364e35_6.1.7600.16385_none_30c90ef265a43c13\wininit.exe
 
< MD5 for: WINLOGON.EXE  >
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\SysNative\winlogon.exe
[2010.11.20 15:25:30 | 000,390,656 | ---- | M] (Microsoft Corporation) MD5=1151B1BAA6F350B1DB6598E0FEA7C457 -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7601.17514_none_cde90685eb910636\winlogon.exe
[2009.07.14 03:39:52 | 000,389,120 | ---- | M] (Microsoft Corporation) MD5=132328DF455B0028F13BF0ABEE51A63A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16385_none_cbb7f2bdeea2829c\winlogon.exe
[2009.10.28 09:01:57 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=A93D41A4D4B0D91C072D11DD8AF266DE -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.20560_none_cc522fd507b468f8\winlogon.exe
[2009.10.28 08:24:40 | 000,389,632 | ---- | M] (Microsoft Corporation) MD5=DA3E2A6FA9660CC75B471530CE88453A -- C:\Windows\winsxs\amd64_microsoft-windows-winlogon_31bf3856ad364e35_6.1.7600.16447_none_cbe534e7ee8042ad\winlogon.exe
 
< MD5 for: WS2IFSL.SYS  >
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\SysNative\drivers\ws2ifsl.sys
[2009.07.14 02:10:33 | 000,021,504 | ---- | M] (Microsoft Corporation) MD5=6BCC1D7D2FD2453957C5479A32364E52 -- C:\Windows\winsxs\amd64_microsoft-windows-w..rastructure-ws2ifsl_31bf3856ad364e35_6.1.7600.16385_none_ab7b927be17eace8\ws2ifsl.sys
 
< %systemroot%\system32\drivers\*.sys /lockedfiles >
 
< %systemroot%\System32\config\*.sav >
 
< %systemroot%\*. /mp /s >
 
< %systemroot%\system32\*.dll /lockedfiles >
 
<          >

< End of report >
--- --- ---

[/code]

cosinus 17.07.2012 09:11
Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Code:
:OTL
IE - HKU\S-1-5-21-2334818258-559614140-964264766-1001\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1001..\Run: [SpybotSD TeaTimer] D:\Programme\Spybot - Search & Destroy\TeaTimer.exe (Safer-Networking Ltd.)
O4 - HKU\S-1-5-19..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-20..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1001..\RunOnce: [Report] \AdwCleaner[S1].txt File not found
O4 - HKU\S-1-5-21-2334818258-559614140-964264766-1004..\RunOnce: [mctadmin] C:\Windows\System32\mctadmin.exe File not found
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktop = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoActiveDesktopChanges = 1
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorAdmin = 0
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: ConsentPromptBehaviorUser = 3
O7 - HKU\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoInternetOpenWith = 1
O7 - HKU\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoRecentDocsNetHood = 1
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]
Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

purplehaze 17.07.2012 18:04
Hallo,
es hatte sich kein Log geöffnet. Ich habe im Ordner c:\_OTL ein Log gefunden. Ist dies das richtige?

Code:
All processes killed
========== OTL ==========
Registry key HKEY_USERS\S-1-5-21-2334818258-559614140-964264766-1001\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Registry value HKEY_USERS\S-1-5-21-2334818258-559614140-964264766-1001\Software\Microsoft\Windows\CurrentVersion\Run\\SpybotSD TeaTimer deleted successfully.
D:\Programme\Spybot - Search & Destroy\TeaTimer.exe moved successfully.
Registry value HKEY_USERS\S-1-5-19\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-20\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2334818258-559614140-964264766-1001\Software\Microsoft\Windows\CurrentVersion\RunOnce\\Report deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2334818258-559614140-964264766-1004\Software\Microsoft\Windows\CurrentVersion\RunOnce\\mctadmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktop deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoActiveDesktopChanges deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorAdmin deleted successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\ConsentPromptBehaviorUser deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoInternetOpenWith deleted successfully.
Registry value HKEY_USERS\S-1-5-21-2334818258-559614140-964264766-1001\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer\\NoRecentDocsNetHood deleted successfully.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
->Flash cache emptied: 56466 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Purple
->Temp folder emptied: 227542553 bytes
->Temporary Internet Files folder emptied: 76007071 bytes
->Java cache emptied: 31902291 bytes
->FireFox cache emptied: 223838756 bytes
->Flash cache emptied: 56941 bytes
 
User: Purplehaze
->Temp folder emptied: 378438411 bytes
->Temporary Internet Files folder emptied: 17601407 bytes
->Java cache emptied: 391141 bytes
->Flash cache emptied: 895 bytes
 
User: UpdatusUser
 
User: UpdatusUser.wohnzimmer
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 200704 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32 (64bit) .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 319941480 bytes
%systemroot%\sysnative\config\systemprofile\AppData\Local\Microsoft\Windows\Temporary Internet Files folder emptied: 36014487 bytes
RecycleBin emptied: 97214 bytes
 
Total Files Cleaned = 1.251,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
->Flash cache emptied: 0 bytes
 
User: Default User
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Purple
->Flash cache emptied: 0 bytes
 
User: Purplehaze
->Flash cache emptied: 0 bytes
 
User: UpdatusUser
 
User: UpdatusUser.wohnzimmer
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.54.0 log created on 07172012_185846

Files\Folders moved on Reboot...
File move failed. C:\Users\Purple\AppData\Local\Temp\FXSAPIDebugLogFile.txt scheduled to be moved on reboot.

PendingFileRenameOperations files...
[2012.03.15 00:08:37 | 000,000,000 | ---- | M] () C:\Users\Purple\AppData\Local\Temp\FXSAPIDebugLogFile.txt : Unable to obtain MD5

Registry entries deleted on Reboot...

cosinus 18.07.2012 15:36
Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C:) nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

http://saved.im/mtkwmtcxexhp/setting...8_16-25-18.jpg

purplehaze 18.07.2012 18:25
Hallöchen :)

Hier der LOg - No threats found:

Code:
19:23:13.0379 3448        TDSS rootkit removing tool 2.7.46.0 Jul 16 2012 22:10:11
19:23:13.0467 3448        ============================================================
19:23:13.0467 3448        Current date / time: 2012/07/18 19:23:13.0467
19:23:13.0467 3448        SystemInfo:
19:23:13.0467 3448       
19:23:13.0467 3448        OS Version: 6.1.7601 ServicePack: 1.0
19:23:13.0467 3448        Product type: Workstation
19:23:13.0467 3448        ComputerName: WOHNZIMMER
19:23:13.0467 3448        UserName: Purplehaze
19:23:13.0467 3448        Windows directory: C:\Windows
19:23:13.0467 3448        System windows directory: C:\Windows
19:23:13.0467 3448        Running under WOW64
19:23:13.0467 3448        Processor architecture: Intel x64
19:23:13.0467 3448        Number of processors: 4
19:23:13.0467 3448        Page size: 0x1000
19:23:13.0467 3448        Boot type: Normal boot
19:23:13.0467 3448        ============================================================
19:23:14.0512 3448        Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
19:23:14.0518 3448        ============================================================
19:23:14.0518 3448        \Device\Harddisk0\DR0:
19:23:14.0518 3448        MBR partitions:
19:23:14.0518 3448        \Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
19:23:14.0518 3448        \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x1E816000
19:23:14.0518 3448        \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x1E848800, BlocksNum 0x2C00F000
19:23:14.0518 3448        ============================================================
19:23:14.0547 3448        C: <-> \Device\Harddisk0\DR0\Partition1
19:23:14.0618 3448        D: <-> \Device\Harddisk0\DR0\Partition2
19:23:14.0618 3448        ============================================================
19:23:14.0618 3448        Initialize success
19:23:14.0618 3448        ============================================================
19:24:45.0735 4608        ============================================================
19:24:45.0735 4608        Scan started
19:24:45.0735 4608        Mode: Manual; SigCheck; TDLFS;
19:24:45.0735 4608        ============================================================
19:24:46.0973 4608        1394ohci        (a87d604aea360176311474c87a63bb88) C:\Windows\system32\drivers\1394ohci.sys
19:24:47.0086 4608        1394ohci - ok
19:24:47.0213 4608        AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) D:\Programme\Steuer 2012\AAVUpdateManager\aavus.exe
19:24:47.0225 4608        AAV UpdateService - ok
19:24:47.0272 4608        ACPI            (d81d9e70b8a6dd14d42d7b4efa65d5f2) C:\Windows\system32\drivers\ACPI.sys
19:24:47.0291 4608        ACPI - ok
19:24:47.0315 4608        AcpiPmi        (99f8e788246d495ce3794d7e7821d2ca) C:\Windows\system32\drivers\acpipmi.sys
19:24:47.0379 4608        AcpiPmi - ok
19:24:47.0481 4608        AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe
19:24:47.0489 4608        AdobeARMservice - ok
19:24:47.0672 4608        AdobeFlashPlayerUpdateSvc (0d4c486a24a711a45fd83acdf4d18506) C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
19:24:47.0708 4608        AdobeFlashPlayerUpdateSvc - ok
19:24:47.0768 4608        adp94xx        (2f6b34b83843f0c5118b63ac634f5bf4) C:\Windows\system32\DRIVERS\adp94xx.sys
19:24:47.0791 4608        adp94xx - ok
19:24:47.0838 4608        adpahci        (597f78224ee9224ea1a13d6350ced962) C:\Windows\system32\DRIVERS\adpahci.sys
19:24:47.0852 4608        adpahci - ok
19:24:47.0862 4608        adpu320        (e109549c90f62fb570b9540c4b148e54) C:\Windows\system32\DRIVERS\adpu320.sys
19:24:47.0874 4608        adpu320 - ok
19:24:47.0893 4608        AeLookupSvc    (4b78b431f225fd8624c5655cb1de7b61) C:\Windows\System32\aelupsvc.dll
19:24:48.0024 4608        AeLookupSvc - ok
19:24:48.0084 4608        AFD            (1c7857b62de5994a75b054a9fd4c3825) C:\Windows\system32\drivers\afd.sys
19:24:48.0131 4608        AFD - ok
19:24:48.0170 4608        agp440          (608c14dba7299d8cb6ed035a68a15799) C:\Windows\system32\drivers\agp440.sys
19:24:48.0180 4608        agp440 - ok
19:24:48.0198 4608        ALG            (3290d6946b5e30e70414990574883ddb) C:\Windows\System32\alg.exe
19:24:48.0227 4608        ALG - ok
19:24:48.0249 4608        aliide          (5812713a477a3ad7363c7438ca2ee038) C:\Windows\system32\drivers\aliide.sys
19:24:48.0258 4608        aliide - ok
19:24:48.0260 4608        amdide          (1ff8b4431c353ce385c875f194924c0c) C:\Windows\system32\drivers\amdide.sys
19:24:48.0270 4608        amdide - ok
19:24:48.0311 4608        AmdK8          (7024f087cff1833a806193ef9d22cda9) C:\Windows\system32\DRIVERS\amdk8.sys
19:24:48.0338 4608        AmdK8 - ok
19:24:48.0342 4608        AmdPPM          (1e56388b3fe0d031c44144eb8c4d6217) C:\Windows\system32\DRIVERS\amdppm.sys
19:24:48.0364 4608        AmdPPM - ok
19:24:48.0405 4608        amdsata        (d4121ae6d0c0e7e13aa221aa57ef2d49) C:\Windows\system32\drivers\amdsata.sys
19:24:48.0416 4608        amdsata - ok
19:24:48.0444 4608        amdsbs          (f67f933e79241ed32ff46a4f29b5120b) C:\Windows\system32\DRIVERS\amdsbs.sys
19:24:48.0458 4608        amdsbs - ok
19:24:48.0471 4608        amdxata        (540daf1cea6094886d72126fd7c33048) C:\Windows\system32\drivers\amdxata.sys
19:24:48.0481 4608        amdxata - ok
19:24:48.0604 4608        AntiVirSchedulerService (466a0d95960dad3222c896d2cea99993) D:\Programme\Avira\AntiVir Desktop\sched.exe
19:24:48.0614 4608        AntiVirSchedulerService - ok
19:24:48.0651 4608        AntiVirService  (a489be6bb0aa1ff406b488b60542314b) D:\Programme\Avira\AntiVir Desktop\avguard.exe
19:24:48.0659 4608        AntiVirService - ok
19:24:48.0733 4608        AppID          (89a69c3f2f319b43379399547526d952) C:\Windows\system32\drivers\appid.sys
19:24:48.0842 4608        AppID - ok
19:24:48.0866 4608        AppIDSvc        (0bc381a15355a3982216f7172f545de1) C:\Windows\System32\appidsvc.dll
19:24:48.0903 4608        AppIDSvc - ok
19:24:48.0938 4608        Appinfo        (3977d4a871ca0d4f2ed1e7db46829731) C:\Windows\System32\appinfo.dll
19:24:48.0973 4608        Appinfo - ok
19:24:49.0016 4608        AppMgmt        (4aba3e75a76195a3e38ed2766c962899) C:\Windows\System32\appmgmts.dll
19:24:49.0057 4608        AppMgmt - ok
19:24:49.0096 4608        arc            (c484f8ceb1717c540242531db7845c4e) C:\Windows\system32\DRIVERS\arc.sys
19:24:49.0106 4608        arc - ok
19:24:49.0112 4608        arcsas          (019af6924aefe7839f61c830227fe79c) C:\Windows\system32\DRIVERS\arcsas.sys
19:24:49.0124 4608        arcsas - ok
19:24:49.0141 4608        AsyncMac        (769765ce2cc62867468cea93969b2242) C:\Windows\system32\DRIVERS\asyncmac.sys
19:24:49.0184 4608        AsyncMac - ok
19:24:49.0206 4608        atapi          (02062c0b390b7729edc9e69c680a6f3c) C:\Windows\system32\drivers\atapi.sys
19:24:49.0215 4608        atapi - ok
19:24:49.0286 4608        AudioEndpointBuilder (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
19:24:49.0340 4608        AudioEndpointBuilder - ok
19:24:49.0344 4608        AudioSrv        (f23fef6d569fce88671949894a8becf1) C:\Windows\System32\Audiosrv.dll
19:24:49.0375 4608        AudioSrv - ok
19:24:49.0418 4608        avgntflt        (26e38b5a58c6c55fafbc563eeddb0867) C:\Windows\system32\DRIVERS\avgntflt.sys
19:25:04.0436 4608        avgntflt - ok
19:25:04.0487 4608        avipbb          (9d1f00beff84cbbf46d7f052bc7e0565) C:\Windows\system32\DRIVERS\avipbb.sys
19:25:04.0500 4608        avipbb - ok
19:25:04.0518 4608        avkmgr          (248db59fc86de44d2779f4c7fb1a567d) C:\Windows\system32\DRIVERS\avkmgr.sys
19:25:04.0528 4608        avkmgr - ok
19:25:04.0571 4608        AxInstSV        (a6bf31a71b409dfa8cac83159e1e2aff) C:\Windows\System32\AxInstSV.dll
19:25:04.0645 4608        AxInstSV - ok
19:25:04.0704 4608        b06bdrv        (3e5b191307609f7514148c6832bb0842) C:\Windows\system32\DRIVERS\bxvbda.sys
19:25:04.0741 4608        b06bdrv - ok
19:25:04.0786 4608        b57nd60a        (b5ace6968304a3900eeb1ebfd9622df2) C:\Windows\system32\DRIVERS\b57nd60a.sys
19:25:04.0811 4608        b57nd60a - ok
19:25:04.0846 4608        BDESVC          (fde360167101b4e45a96f939f388aeb0) C:\Windows\System32\bdesvc.dll
19:25:04.0875 4608        BDESVC - ok
19:25:04.0877 4608        Beep            (16a47ce2decc9b099349a5f840654746) C:\Windows\system32\drivers\Beep.sys
19:25:04.0920 4608        Beep - ok
19:25:04.0991 4608        BFE            (82974d6a2fd19445cc5171fc378668a4) C:\Windows\System32\bfe.dll
19:25:05.0024 4608        BFE - ok
19:25:05.0088 4608        BITS            (1ea7969e3271cbc59e1730697dc74682) C:\Windows\System32\qmgr.dll
19:25:05.0147 4608        BITS - ok
19:25:05.0235 4608        blbdrive        (61583ee3c3a17003c4acd0475646b4d3) C:\Windows\system32\DRIVERS\blbdrive.sys
19:25:05.0252 4608        blbdrive - ok
19:25:05.0274 4608        bowser          (6c02a83164f5cc0a262f4199f0871cf5) C:\Windows\system32\DRIVERS\bowser.sys
19:25:05.0297 4608        bowser - ok
19:25:05.0313 4608        BrFiltLo        (f09eee9edc320b5e1501f749fde686c8) C:\Windows\system32\DRIVERS\BrFiltLo.sys
19:25:05.0372 4608        BrFiltLo - ok
19:25:05.0375 4608        BrFiltUp        (b114d3098e9bdb8bea8b053685831be6) C:\Windows\system32\DRIVERS\BrFiltUp.sys
19:25:05.0387 4608        BrFiltUp - ok
19:25:05.0413 4608        Browser        (8ef0d5c41ec907751b8429162b1239ed) C:\Windows\System32\browser.dll
19:25:05.0452 4608        Browser - ok
19:25:05.0702 4608        Brserid        (43bea8d483bf1870f018e2d02e06a5bd) C:\Windows\System32\Drivers\Brserid.sys
19:25:05.0750 4608        Brserid - ok
19:25:05.0770 4608        BrSerWdm        (a6eca2151b08a09caceca35c07f05b42) C:\Windows\System32\Drivers\BrSerWdm.sys
19:25:05.0793 4608        BrSerWdm - ok
19:25:05.0797 4608        BrUsbMdm        (b79968002c277e869cf38bd22cd61524) C:\Windows\System32\Drivers\BrUsbMdm.sys
19:25:05.0813 4608        BrUsbMdm - ok
19:25:05.0817 4608        BrUsbSer        (a87528880231c54e75ea7a44943b38bf) C:\Windows\System32\Drivers\BrUsbSer.sys
19:25:05.0829 4608        BrUsbSer - ok
19:25:05.0840 4608        BTHMODEM        (9da669f11d1f894ab4eb69bf546a42e8) C:\Windows\system32\DRIVERS\bthmodem.sys
19:25:05.0866 4608        BTHMODEM - ok
19:25:05.0893 4608        bthserv        (95f9c2976059462cbbf227f7aab10de9) C:\Windows\system32\bthserv.dll
19:25:05.0930 4608        bthserv - ok
19:25:05.0958 4608        cdfs            (b8bd2bb284668c84865658c77574381a) C:\Windows\system32\DRIVERS\cdfs.sys
19:25:05.0985 4608        cdfs - ok
19:25:06.0030 4608        cdrom          (f036ce71586e93d94dab220d7bdf4416) C:\Windows\system32\DRIVERS\cdrom.sys
19:25:06.0043 4608        cdrom - ok
19:25:06.0071 4608        CertPropSvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
19:25:06.0098 4608        CertPropSvc - ok
19:25:06.0114 4608        circlass        (d7cd5c4e1b71fa62050515314cfb52cf) C:\Windows\system32\DRIVERS\circlass.sys
19:25:06.0135 4608        circlass - ok
19:25:06.0163 4608        CLFS            (fe1ec06f2253f691fe36217c592a0206) C:\Windows\system32\CLFS.sys
19:25:06.0209 4608        CLFS - ok
19:25:06.0313 4608        clr_optimization_v2.0.50727_32 (d88040f816fda31c3b466f0fa0918f29) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
19:25:06.0323 4608        clr_optimization_v2.0.50727_32 - ok
19:25:06.0383 4608        clr_optimization_v2.0.50727_64 (d1ceea2b47cb998321c579651ce3e4f8) C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
19:25:06.0393 4608        clr_optimization_v2.0.50727_64 - ok
19:25:06.0499 4608        clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
19:25:06.0508 4608        clr_optimization_v4.0.30319_32 - ok
19:25:06.0596 4608        clr_optimization_v4.0.30319_64 (c6f9af94dcd58122a4d7e89db6bed29d) C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
19:25:06.0606 4608        clr_optimization_v4.0.30319_64 - ok
19:25:06.0639 4608        CmBatt          (0840155d0bddf1190f84a663c284bd33) C:\Windows\system32\DRIVERS\CmBatt.sys
19:25:06.0659 4608        CmBatt - ok
19:25:06.0684 4608        cmdide          (e19d3f095812725d88f9001985b94edd) C:\Windows\system32\drivers\cmdide.sys
19:25:06.0694 4608        cmdide - ok
19:25:06.0774 4608        cmuda3          (2835bf2a864cde9184c80cf4e6a485f9) C:\Windows\system32\drivers\cmudax3.sys
19:25:11.0438 4608        cmuda3 - ok
19:25:11.0477 4608        CNG            (9ac4f97c2d3e93367e2148ea940cd2cd) C:\Windows\system32\Drivers\cng.sys
19:25:11.0512 4608        CNG - ok
19:25:11.0524 4608        Compbatt        (102de219c3f61415f964c88e9085ad14) C:\Windows\system32\DRIVERS\compbatt.sys
19:25:11.0536 4608        Compbatt - ok
19:25:11.0559 4608        CompositeBus    (03edb043586cceba243d689bdda370a8) C:\Windows\system32\drivers\CompositeBus.sys
19:25:11.0581 4608        CompositeBus - ok
19:25:11.0596 4608        COMSysApp - ok
19:25:11.0600 4608        crcdisk        (1c827878a998c18847245fe1f34ee597) C:\Windows\system32\DRIVERS\crcdisk.sys
19:25:11.0610 4608        crcdisk - ok
19:25:11.0641 4608        CryptSvc        (4f5414602e2544a4554d95517948b705) C:\Windows\system32\cryptsvc.dll
19:25:11.0688 4608        CryptSvc - ok
19:25:11.0729 4608        CSC            (54da3dfd29ed9f1619b6f53f3ce55e49) C:\Windows\system32\drivers\csc.sys
19:25:11.0786 4608        CSC - ok
19:25:11.0836 4608        CscService      (3ab183ab4d2c79dcf459cd2c1266b043) C:\Windows\System32\cscsvc.dll
19:25:11.0870 4608        CscService - ok
19:25:11.0915 4608        DcomLaunch      (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
19:25:11.0958 4608        DcomLaunch - ok
19:25:12.0010 4608        defragsvc      (3cec7631a84943677aa8fa8ee5b6b43d) C:\Windows\System32\defragsvc.dll
19:25:12.0045 4608        defragsvc - ok
19:25:12.0157 4608        DfsC            (9bb2ef44eaa163b29c4a4587887a0fe4) C:\Windows\system32\Drivers\dfsc.sys
19:25:12.0194 4608        DfsC - ok
19:25:12.0243 4608        Dhcp            (43d808f5d9e1a18e5eeb5ebc83969e4e) C:\Windows\system32\dhcpcore.dll
19:25:12.0270 4608        Dhcp - ok
19:25:12.0286 4608        discache        (13096b05847ec78f0977f2c0f79e9ab3) C:\Windows\system32\drivers\discache.sys
19:25:12.0315 4608        discache - ok
19:25:12.0338 4608        Disk            (9819eee8b5ea3784ec4af3b137a5244c) C:\Windows\system32\DRIVERS\disk.sys
19:25:12.0350 4608        Disk - ok
19:25:12.0381 4608        Dnscache        (16835866aaa693c7d7fceba8fff706e4) C:\Windows\System32\dnsrslvr.dll
19:25:12.0413 4608        Dnscache - ok
19:25:12.0465 4608        dot3svc        (b1fb3ddca0fdf408750d5843591afbc6) C:\Windows\System32\dot3svc.dll
19:25:12.0508 4608        dot3svc - ok
19:25:12.0540 4608        DPS            (b26f4f737e8f9df4f31af6cf31d05820) C:\Windows\system32\dps.dll
19:25:12.0575 4608        DPS - ok
19:25:12.0610 4608        drmkaud        (9b19f34400d24df84c858a421c205754) C:\Windows\system32\drivers\drmkaud.sys
19:25:12.0627 4608        drmkaud - ok
19:25:12.0686 4608        DXGKrnl        (f5bee30450e18e6b83a5012c100616fd) C:\Windows\System32\drivers\dxgkrnl.sys
19:25:12.0715 4608        DXGKrnl - ok
19:25:12.0733 4608        EapHost        (e2dda8726da9cb5b2c4000c9018a9633) C:\Windows\System32\eapsvc.dll
19:25:12.0776 4608        EapHost - ok
19:25:12.0942 4608        ebdrv          (dc5d737f51be844d8c82c695eb17372f) C:\Windows\system32\DRIVERS\evbda.sys
19:25:13.0024 4608        ebdrv - ok
19:25:13.0217 4608        EFS            (c118a82cd78818c29ab228366ebf81c3) C:\Windows\System32\lsass.exe
19:25:13.0250 4608        EFS - ok
19:25:13.0346 4608        ehRecvr        (c4002b6b41975f057d98c439030cea07) C:\Windows\ehome\ehRecvr.exe
19:25:13.0416 4608        ehRecvr - ok
19:25:13.0442 4608        ehSched        (4705e8ef9934482c5bb488ce28afc681) C:\Windows\ehome\ehsched.exe
19:25:13.0469 4608        ehSched - ok
19:25:13.0592 4608        elxstor        (0e5da5369a0fcaea12456dd852545184) C:\Windows\system32\DRIVERS\elxstor.sys
19:25:13.0616 4608        elxstor - ok
19:25:13.0635 4608        ErrDev          (34a3c54752046e79a126e15c51db409b) C:\Windows\system32\drivers\errdev.sys
19:25:13.0661 4608        ErrDev - ok
19:25:13.0711 4608        EventSystem    (4166f82be4d24938977dd1746be9b8a0) C:\Windows\system32\es.dll
19:25:13.0754 4608        EventSystem - ok
19:25:13.0778 4608        exfat          (a510c654ec00c1e9bdd91eeb3a59823b) C:\Windows\system32\drivers\exfat.sys
19:25:13.0815 4608        exfat - ok
19:25:13.0825 4608        fastfat        (0adc83218b66a6db380c330836f3e36d) C:\Windows\system32\drivers\fastfat.sys
19:25:13.0911 4608        fastfat - ok
19:25:13.0979 4608        Fax            (dbefd454f8318a0ef691fdd2eaab44eb) C:\Windows\system32\fxssvc.exe
19:25:14.0008 4608        Fax - ok
19:25:14.0026 4608        fdc            (d765d19cd8ef61f650c384f62fac00ab) C:\Windows\system32\DRIVERS\fdc.sys
19:25:14.0049 4608        fdc - ok
19:25:14.0067 4608        fdPHost        (0438cab2e03f4fb61455a7956026fe86) C:\Windows\system32\fdPHost.dll
19:25:14.0104 4608        fdPHost - ok
19:25:14.0129 4608        FDResPub        (802496cb59a30349f9a6dd22d6947644) C:\Windows\system32\fdrespub.dll
19:25:14.0159 4608        FDResPub - ok
19:25:14.0163 4608        FileInfo        (655661be46b5f5f3fd454e2c3095b930) C:\Windows\system32\drivers\fileinfo.sys
19:25:14.0174 4608        FileInfo - ok
19:25:14.0176 4608        Filetrace      (5f671ab5bc87eea04ec38a6cd5962a47) C:\Windows\system32\drivers\filetrace.sys
19:25:14.0209 4608        Filetrace - ok
19:25:14.0213 4608        flpydisk        (c172a0f53008eaeb8ea33fe10e177af5) C:\Windows\system32\DRIVERS\flpydisk.sys
19:25:14.0223 4608        flpydisk - ok
19:25:14.0266 4608        FltMgr          (da6b67270fd9db3697b20fce94950741) C:\Windows\system32\drivers\fltmgr.sys
19:25:14.0286 4608        FltMgr - ok
19:25:14.0354 4608        FontCache      (5c4cb4086fb83115b153e47add961a0c) C:\Windows\system32\FntCache.dll
19:25:14.0448 4608        FontCache - ok
19:25:14.0510 4608        FontCache3.0.0.0 (a8b7f3818ab65695e3a0bb3279f6dce6) C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
19:25:14.0520 4608        FontCache3.0.0.0 - ok
19:25:14.0594 4608        FsDepends      (d43703496149971890703b4b1b723eac) C:\Windows\system32\drivers\FsDepends.sys
19:25:14.0604 4608        FsDepends - ok
19:25:14.0618 4608        Fs_Rec          (6bd9295cc032dd3077c671fccf579a7b) C:\Windows\system32\drivers\Fs_Rec.sys
19:25:14.0627 4608        Fs_Rec - ok
19:25:14.0659 4608        fvevol          (1f7b25b858fa27015169fe95e54108ed) C:\Windows\system32\DRIVERS\fvevol.sys
19:25:14.0682 4608        fvevol - ok
19:25:14.0711 4608        gagp30kx        (8c778d335c9d272cfd3298ab02abe3b6) C:\Windows\system32\DRIVERS\gagp30kx.sys
19:25:14.0721 4608        gagp30kx - ok
19:25:14.0776 4608        gpsvc          (277bbc7e1aa1ee957f573a10eca7ef3a) C:\Windows\System32\gpsvc.dll
19:25:14.0821 4608        gpsvc - ok
19:25:14.0916 4608        gupdate        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:25:14.0924 4608        gupdate - ok
19:25:14.0926 4608        gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
19:25:14.0934 4608        gupdatem - ok
19:25:14.0946 4608        hcw85cir        (f2523ef6460fc42405b12248338ab2f0) C:\Windows\system32\drivers\hcw85cir.sys
19:25:14.0987 4608        hcw85cir - ok
19:25:15.0038 4608        HdAudAddService (975761c778e33cd22498059b91e7373a) C:\Windows\system32\drivers\HdAudio.sys
19:25:15.0102 4608        HdAudAddService - ok
19:25:15.0139 4608        HDAudBus        (97bfed39b6b79eb12cddbfeed51f56bb) C:\Windows\system32\drivers\HDAudBus.sys
19:25:15.0165 4608        HDAudBus - ok
19:25:15.0182 4608        HidBatt        (78e86380454a7b10a5eb255dc44a355f) C:\Windows\system32\DRIVERS\HidBatt.sys
19:25:15.0204 4608        HidBatt - ok
19:25:15.0209 4608        HidBth          (7fd2a313f7afe5c4dab14798c48dd104) C:\Windows\system32\DRIVERS\hidbth.sys
19:25:15.0225 4608        HidBth - ok
19:25:15.0229 4608        HidIr          (0a77d29f311b88cfae3b13f9c1a73825) C:\Windows\system32\DRIVERS\hidir.sys
19:25:15.0241 4608        HidIr - ok
19:25:15.0260 4608        hidserv        (bd9eb3958f213f96b97b1d897dee006d) C:\Windows\system32\hidserv.dll
19:25:15.0293 4608        hidserv - ok
19:25:15.0340 4608        HidUsb          (9592090a7e2b61cd582b612b6df70536) C:\Windows\system32\drivers\hidusb.sys
19:25:15.0350 4608        HidUsb - ok
19:25:15.0368 4608        hkmsvc          (387e72e739e15e3d37907a86d9ff98e2) C:\Windows\system32\kmsvc.dll
19:25:15.0403 4608        hkmsvc - ok
19:25:15.0436 4608        HomeGroupListener (efdfb3dd38a4376f93e7985173813abd) C:\Windows\system32\ListSvc.dll
19:25:15.0483 4608        HomeGroupListener - ok
19:25:15.0510 4608        HomeGroupProvider (908acb1f594274965a53926b10c81e89) C:\Windows\system32\provsvc.dll
19:25:15.0551 4608        HomeGroupProvider - ok
19:25:15.0577 4608        HpSAMD          (39d2abcd392f3d8a6dce7b60ae7b8efc) C:\Windows\system32\drivers\HpSAMD.sys
19:25:15.0586 4608        HpSAMD - ok
19:25:15.0657 4608        HTTP            (0ea7de1acb728dd5a369fd742d6eee28) C:\Windows\system32\drivers\HTTP.sys
19:25:15.0708 4608        HTTP - ok
19:25:15.0727 4608        hwpolicy        (a5462bd6884960c9dc85ed49d34ff392) C:\Windows\system32\drivers\hwpolicy.sys
19:25:15.0737 4608        hwpolicy - ok
19:25:15.0774 4608        i8042prt        (fa55c73d4affa7ee23ac4be53b4592d3) C:\Windows\system32\drivers\i8042prt.sys
19:25:15.0786 4608        i8042prt - ok
19:25:15.0811 4608        iaStorV        (aaaf44db3bd0b9d1fb6969b23ecc8366) C:\Windows\system32\drivers\iaStorV.sys
19:25:15.0836 4608        iaStorV - ok
19:25:15.0934 4608        idsvc          (5988fc40f8db5b0739cd1e3a5d0d78bd) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
19:25:15.0965 4608        idsvc - ok
19:25:15.0999 4608        iirsp          (5c18831c61933628f5bb0ea2675b9d21) C:\Windows\system32\DRIVERS\iirsp.sys
19:25:16.0008 4608        iirsp - ok
19:25:16.0059 4608        IKEEXT          (fcd84c381e0140af901e58d48882d26b) C:\Windows\System32\ikeext.dll
19:25:16.0182 4608        IKEEXT - ok
19:25:16.0209 4608        intelide        (f00f20e70c6ec3aa366910083a0518aa) C:\Windows\system32\drivers\intelide.sys
19:25:16.0219 4608        intelide - ok
19:25:16.0250 4608        intelppm        (ada036632c664caa754079041cf1f8c1) C:\Windows\system32\DRIVERS\intelppm.sys
19:25:16.0268 4608        intelppm - ok
19:25:16.0290 4608        IPBusEnum      (098a91c54546a3b878dad6a7e90a455b) C:\Windows\system32\ipbusenum.dll
19:25:16.0323 4608        IPBusEnum - ok
19:25:16.0342 4608        IpFilterDriver  (c9f0e1bd74365a8771590e9008d22ab6) C:\Windows\system32\DRIVERS\ipfltdrv.sys
19:25:16.0381 4608        IpFilterDriver - ok
19:25:16.0420 4608        iphlpsvc        (a34a587fffd45fa649fba6d03784d257) C:\Windows\System32\iphlpsvc.dll
19:25:16.0485 4608        iphlpsvc - ok
19:25:16.0592 4608        IPMIDRV        (0fc1aea580957aa8817b8f305d18ca3a) C:\Windows\system32\drivers\IPMIDrv.sys
19:25:16.0612 4608        IPMIDRV - ok
19:25:16.0618 4608        IPNAT          (af9b39a7e7b6caa203b3862582e9f2d0) C:\Windows\system32\drivers\ipnat.sys
19:25:16.0651 4608        IPNAT - ok
19:25:16.0659 4608        IRENUM          (3abf5e7213eb28966d55d58b515d5ce9) C:\Windows\system32\drivers\irenum.sys
19:25:16.0706 4608        IRENUM - ok
19:25:16.0721 4608        isapnp          (2f7b28dc3e1183e5eb418df55c204f38) C:\Windows\system32\drivers\isapnp.sys
19:25:16.0731 4608        isapnp - ok
19:25:16.0760 4608        iScsiPrt        (d931d7309deb2317035b07c9f9e6b0bd) C:\Windows\system32\drivers\msiscsi.sys
19:25:16.0780 4608        iScsiPrt - ok
19:25:16.0807 4608        kbdclass        (bc02336f1cba7dcc7d1213bb588a68a5) C:\Windows\system32\drivers\kbdclass.sys
19:25:16.0817 4608        kbdclass - ok
19:25:16.0852 4608        kbdhid          (0705eff5b42a9db58548eec3b26bb484) C:\Windows\system32\drivers\kbdhid.sys
19:25:16.0868 4608        kbdhid - ok
19:25:16.0893 4608        KeyIso          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:25:16.0903 4608        KeyIso - ok
19:25:16.0920 4608        KSecDD          (97a7070aea4c058b6418519e869a63b4) C:\Windows\system32\Drivers\ksecdd.sys
19:25:16.0932 4608        KSecDD - ok
19:25:16.0954 4608        KSecPkg        (26c43a7c2862447ec59deda188d1da07) C:\Windows\system32\Drivers\ksecpkg.sys
19:25:16.0967 4608        KSecPkg - ok
19:25:16.0981 4608        ksthunk        (6869281e78cb31a43e969f06b57347c4) C:\Windows\system32\drivers\ksthunk.sys
19:25:17.0016 4608        ksthunk - ok
19:25:17.0053 4608        KtmRm          (6ab66e16aa859232f64deb66887a8c9c) C:\Windows\system32\msdtckrm.dll
19:25:17.0098 4608        KtmRm - ok
19:25:17.0120 4608        LanmanServer    (d9f42719019740baa6d1c6d536cbdaa6) C:\Windows\system32\srvsvc.dll
19:25:17.0155 4608        LanmanServer - ok
19:25:17.0182 4608        LanmanWorkstation (851a1382eed3e3a7476db004f4ee3e1a) C:\Windows\System32\wkssvc.dll
19:25:17.0217 4608        LanmanWorkstation - ok
19:25:17.0233 4608        lltdio          (1538831cf8ad2979a04c423779465827) C:\Windows\system32\DRIVERS\lltdio.sys
19:25:17.0268 4608        lltdio - ok
19:25:17.0293 4608        lltdsvc        (c1185803384ab3feed115f79f109427f) C:\Windows\System32\lltdsvc.dll
19:25:17.0334 4608        lltdsvc - ok
19:25:17.0338 4608        lmhosts        (f993a32249b66c9d622ea5592a8b76b8) C:\Windows\System32\lmhsvc.dll
19:25:17.0374 4608        lmhosts - ok
19:25:17.0389 4608        LSI_FC          (1a93e54eb0ece102495a51266dcdb6a6) C:\Windows\system32\DRIVERS\lsi_fc.sys
19:25:17.0401 4608        LSI_FC - ok
19:25:17.0422 4608        LSI_SAS        (1047184a9fdc8bdbff857175875ee810) C:\Windows\system32\DRIVERS\lsi_sas.sys
19:25:17.0432 4608        LSI_SAS - ok
19:25:17.0438 4608        LSI_SAS2        (30f5c0de1ee8b5bc9306c1f0e4a75f93) C:\Windows\system32\DRIVERS\lsi_sas2.sys
19:25:17.0448 4608        LSI_SAS2 - ok
19:25:17.0456 4608        LSI_SCSI        (0504eacaff0d3c8aed161c4b0d369d4a) C:\Windows\system32\DRIVERS\lsi_scsi.sys
19:25:17.0465 4608        LSI_SCSI - ok
19:25:17.0487 4608        luafv          (43d0f98e1d56ccddb0d5254cff7b356e) C:\Windows\system32\drivers\luafv.sys
19:25:17.0526 4608        luafv - ok
19:25:17.0584 4608        MBAMProtector  (dbc08862a71459e74f7538b432c114cc) C:\Windows\system32\drivers\mbam.sys
19:25:17.0602 4608        MBAMProtector - ok
19:25:17.0674 4608        MBAMService    (ba400ed640bca1eae5c727ae17c10207) D:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe
19:25:17.0690 4608        MBAMService - ok
19:25:17.0713 4608        Mcx2Svc        (0be09cd858abf9df6ed259d57a1a1663) C:\Windows\system32\Mcx2Svc.dll
19:25:17.0733 4608        Mcx2Svc - ok
19:25:17.0735 4608        megasas        (a55805f747c6edb6a9080d7c633bd0f4) C:\Windows\system32\DRIVERS\megasas.sys
19:25:17.0747 4608        megasas - ok
19:25:17.0758 4608        MegaSR          (baf74ce0072480c3b6b7c13b2a94d6b3) C:\Windows\system32\DRIVERS\MegaSR.sys
19:25:17.0772 4608        MegaSR - ok
19:25:17.0797 4608        MMCSS          (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
19:25:17.0831 4608        MMCSS - ok
19:25:17.0834 4608        Modem          (800ba92f7010378b09f9ed9270f07137) C:\Windows\system32\drivers\modem.sys
19:25:17.0872 4608        Modem - ok
19:25:17.0899 4608        monitor        (b03d591dc7da45ece20b3b467e6aadaa) C:\Windows\system32\DRIVERS\monitor.sys
19:25:17.0926 4608        monitor - ok
19:25:17.0954 4608        mouclass        (7d27ea49f3c1f687d357e77a470aea99) C:\Windows\system32\drivers\mouclass.sys
19:25:17.0965 4608        mouclass - ok
19:25:17.0997 4608        mouhid          (d3bf052c40b0c4166d9fd86a4288c1e6) C:\Windows\system32\DRIVERS\mouhid.sys
19:25:18.0014 4608        mouhid - ok
19:25:18.0038 4608        mountmgr        (32e7a3d591d671a6df2db515a5cbe0fa) C:\Windows\system32\drivers\mountmgr.sys
19:25:18.0047 4608        mountmgr - ok
19:25:18.0149 4608        MozillaMaintenance (15d5398eed42c2504bb3d4fc875c15d1) C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
19:25:18.0159 4608        MozillaMaintenance - ok
19:25:18.0186 4608        mpio            (a44b420d30bd56e145d6a2bc8768ec58) C:\Windows\system32\drivers\mpio.sys
19:25:18.0200 4608        mpio - ok
19:25:18.0215 4608        mpsdrv          (6c38c9e45ae0ea2fa5e551f2ed5e978f) C:\Windows\system32\drivers\mpsdrv.sys
19:25:18.0249 4608        mpsdrv - ok
19:25:18.0309 4608        MpsSvc          (54ffc9c8898113ace189d4aa7199d2c1) C:\Windows\system32\mpssvc.dll
19:25:18.0356 4608        MpsSvc - ok
19:25:18.0383 4608        MRxDAV          (dc722758b8261e1abafd31a3c0a66380) C:\Windows\system32\drivers\mrxdav.sys
19:25:18.0401 4608        MRxDAV - ok
19:25:18.0426 4608        mrxsmb          (a5d9106a73dc88564c825d317cac68ac) C:\Windows\system32\DRIVERS\mrxsmb.sys
19:25:18.0456 4608        mrxsmb - ok
19:25:18.0469 4608        mrxsmb10        (d711b3c1d5f42c0c2415687be09fc163) C:\Windows\system32\DRIVERS\mrxsmb10.sys
19:25:18.0493 4608        mrxsmb10 - ok
19:25:18.0520 4608        mrxsmb20        (9423e9d355c8d303e76b8cfbd8a5c30c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
19:25:18.0532 4608        mrxsmb20 - ok
19:25:18.0569 4608        msahci          (c25f0bafa182cbca2dd3c851c2e75796) C:\Windows\system32\drivers\msahci.sys
19:25:18.0579 4608        msahci - ok
19:25:18.0592 4608        msdsm          (db801a638d011b9633829eb6f663c900) C:\Windows\system32\drivers\msdsm.sys
19:25:18.0614 4608        msdsm - ok
19:25:18.0635 4608        MSDTC          (de0ece52236cfa3ed2dbfc03f28253a8) C:\Windows\System32\msdtc.exe
19:25:18.0657 4608        MSDTC - ok
19:25:18.0674 4608        Msfs            (aa3fb40e17ce1388fa1bedab50ea8f96) C:\Windows\system32\drivers\Msfs.sys
19:25:18.0702 4608        Msfs - ok
19:25:18.0706 4608        mshidkmdf      (f9d215a46a8b9753f61767fa72a20326) C:\Windows\System32\drivers\mshidkmdf.sys
19:25:18.0739 4608        mshidkmdf - ok
19:25:18.0754 4608        msisadrv        (d916874bbd4f8b07bfb7fa9b3ccae29d) C:\Windows\system32\drivers\msisadrv.sys
19:25:18.0764 4608        msisadrv - ok
19:25:18.0799 4608        MSiSCSI        (808e98ff49b155c522e6400953177b08) C:\Windows\system32\iscsiexe.dll
19:25:18.0838 4608        MSiSCSI - ok
19:25:18.0840 4608        msiserver - ok
19:25:18.0858 4608        MSKSSRV        (49ccf2c4fea34ffad8b1b59d49439366) C:\Windows\system32\drivers\MSKSSRV.sys
19:25:18.0897 4608        MSKSSRV - ok
19:25:18.0907 4608        MSPCLOCK        (bdd71ace35a232104ddd349ee70e1ab3) C:\Windows\system32\drivers\MSPCLOCK.sys
19:25:18.0946 4608        MSPCLOCK - ok
19:25:18.0948 4608        MSPQM          (4ed981241db27c3383d72092b618a1d0) C:\Windows\system32\drivers\MSPQM.sys
19:25:18.0981 4608        MSPQM - ok
19:25:19.0014 4608        MsRPC          (759a9eeb0fa9ed79da1fb7d4ef78866d) C:\Windows\system32\drivers\MsRPC.sys
19:25:19.0032 4608        MsRPC - ok
19:25:19.0045 4608        mssmbios        (0eed230e37515a0eaee3c2e1bc97b288) C:\Windows\system32\drivers\mssmbios.sys
19:25:19.0055 4608        mssmbios - ok
19:25:19.0061 4608        MSTEE          (2e66f9ecb30b4221a318c92ac2250779) C:\Windows\system32\drivers\MSTEE.sys
19:25:19.0094 4608        MSTEE - ok
19:25:19.0098 4608        MTConfig        (7ea404308934e675bffde8edf0757bcd) C:\Windows\system32\DRIVERS\MTConfig.sys
19:25:19.0114 4608        MTConfig - ok
19:25:19.0125 4608        Mup            (f9a18612fd3526fe473c1bda678d61c8) C:\Windows\system32\Drivers\mup.sys
19:25:19.0135 4608        Mup - ok
19:25:19.0176 4608        napagent        (582ac6d9873e31dfa28a4547270862dd) C:\Windows\system32\qagentRT.dll
19:25:19.0215 4608        napagent - ok
19:25:19.0262 4608        NativeWifiP    (1ea3749c4114db3e3161156ffffa6b33) C:\Windows\system32\DRIVERS\nwifi.sys
19:25:19.0315 4608        NativeWifiP - ok
19:25:19.0391 4608        NDIS            (79b47fd40d9a817e932f9d26fac0a81c) C:\Windows\system32\drivers\ndis.sys
19:25:19.0420 4608        NDIS - ok
19:25:19.0456 4608        NdisCap        (9f9a1f53aad7da4d6fef5bb73ab811ac) C:\Windows\system32\DRIVERS\ndiscap.sys
19:25:19.0485 4608        NdisCap - ok
19:25:19.0497 4608        NdisTapi        (30639c932d9fef22b31268fe25a1b6e5) C:\Windows\system32\DRIVERS\ndistapi.sys
19:25:19.0540 4608        NdisTapi - ok
19:25:19.0559 4608        Ndisuio        (136185f9fb2cc61e573e676aa5402356) C:\Windows\system32\DRIVERS\ndisuio.sys
19:25:19.0596 4608        Ndisuio - ok
19:25:19.0625 4608        NdisWan        (53f7305169863f0a2bddc49e116c2e11) C:\Windows\system32\DRIVERS\ndiswan.sys
19:25:19.0672 4608        NdisWan - ok
19:25:19.0698 4608        NDProxy        (015c0d8e0e0421b4cfd48cffe2825879) C:\Windows\system32\drivers\NDProxy.sys
19:25:19.0735 4608        NDProxy - ok
19:25:19.0745 4608        NetBIOS        (86743d9f5d2b1048062b14b1d84501c4) C:\Windows\system32\DRIVERS\netbios.sys
19:25:19.0784 4608        NetBIOS - ok
19:25:19.0811 4608        NetBT          (09594d1089c523423b32a4229263f068) C:\Windows\system32\DRIVERS\netbt.sys
19:25:19.0850 4608        NetBT - ok
19:25:19.0875 4608        Netlogon        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:25:19.0887 4608        Netlogon - ok
19:25:19.0932 4608        Netman          (847d3ae376c0817161a14a82c8922a9e) C:\Windows\System32\netman.dll
19:25:19.0977 4608        Netman - ok
19:25:20.0006 4608        netprofm        (5f28111c648f1e24f7dbc87cdeb091b8) C:\Windows\System32\netprofm.dll
19:25:20.0051 4608        netprofm - ok
19:25:20.0122 4608        NetTcpPortSharing (3e5a36127e201ddf663176b66828fafe) C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
19:25:20.0131 4608        NetTcpPortSharing - ok
19:25:20.0166 4608        nfrd960        (77889813be4d166cdab78ddba990da92) C:\Windows\system32\DRIVERS\nfrd960.sys
19:25:20.0176 4608        nfrd960 - ok
19:25:20.0219 4608        NlaSvc          (1ee99a89cc788ada662441d1e9830529) C:\Windows\System32\nlasvc.dll
19:25:20.0256 4608        NlaSvc - ok
19:25:20.0260 4608        Npfs            (1e4c4ab5c9b8dd13179bbdc75a2a01f7) C:\Windows\system32\drivers\Npfs.sys
19:25:20.0288 4608        Npfs - ok
19:25:20.0297 4608        nsi            (d54bfdf3e0c953f823b3d0bfe4732528) C:\Windows\system32\nsisvc.dll
19:25:20.0336 4608        nsi - ok
19:25:20.0340 4608        nsiproxy        (e7f5ae18af4168178a642a9247c63001) C:\Windows\system32\drivers\nsiproxy.sys
19:25:20.0370 4608        nsiproxy - ok
19:25:20.0461 4608        Ntfs            (a2f74975097f52a00745f9637451fdd8) C:\Windows\system32\drivers\Ntfs.sys
19:25:20.0504 4608        Ntfs - ok
19:25:20.0762 4608        Null            (9899284589f75fa8724ff3d16aed75c1) C:\Windows\system32\drivers\Null.sys
19:25:20.0799 4608        Null - ok
19:25:20.0844 4608        NVHDA          (102806b360d0e6bc6e55bf47ef655d43) C:\Windows\system32\drivers\nvhda64v.sys
19:25:20.0864 4608        NVHDA - ok
19:25:21.0383 4608        nvlddmkm        (ba0b4889c40380a01ecdf84c227a89c9) C:\Windows\system32\DRIVERS\nvlddmkm.sys
19:25:21.0782 4608        nvlddmkm - ok
19:25:22.0067 4608        nvraid          (0a92cb65770442ed0dc44834632f66ad) C:\Windows\system32\drivers\nvraid.sys
19:25:22.0090 4608        nvraid - ok
19:25:22.0098 4608        nvstor          (dab0e87525c10052bf65f06152f37e4a) C:\Windows\system32\drivers\nvstor.sys
19:25:22.0110 4608        nvstor - ok
19:25:22.0174 4608        nvsvc          (06633cf95bea62164c3bfca24bce6b11) C:\Windows\system32\nvvsvc.exe
19:25:22.0196 4608        nvsvc - ok
19:25:22.0338 4608        nvUpdatusService (53b629ce436b110c5689c2f6439e567b) C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe
19:25:22.0362 4608        nvUpdatusService - ok
19:25:22.0631 4608        nv_agp          (270d7cd42d6e3979f6dd0146650f0e05) C:\Windows\system32\drivers\nv_agp.sys
19:25:22.0643 4608        nv_agp - ok
19:25:22.0778 4608        odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files (x86)\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
19:25:22.0801 4608        odserv - ok
19:25:22.0821 4608        ohci1394        (3589478e4b22ce21b41fa1bfc0b8b8a0) C:\Windows\system32\drivers\ohci1394.sys
19:25:22.0836 4608        ohci1394 - ok
19:25:22.0879 4608        ose            (5a432a042dae460abe7199b758e8606c) C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
19:25:22.0938 4608        ose - ok
19:25:22.0967 4608        p2pimsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
19:25:23.0002 4608        p2pimsvc - ok
19:25:23.0034 4608        p2psvc          (927463ecb02179f88e4b9a17568c63c3) C:\Windows\system32\p2psvc.dll
19:25:23.0047 4608        p2psvc - ok
19:25:23.0088 4608        Parport        (0086431c29c35be1dbc43f52cc273887) C:\Windows\system32\DRIVERS\parport.sys
19:25:23.0100 4608        Parport - ok
19:25:23.0131 4608        partmgr        (e9766131eeade40a27dc27d2d68fba9c) C:\Windows\system32\drivers\partmgr.sys
19:25:23.0143 4608        partmgr - ok
19:25:23.0172 4608        PcaSvc          (3aeaa8b561e63452c655dc0584922257) C:\Windows\System32\pcasvc.dll
19:25:23.0204 4608        PcaSvc - ok
19:25:23.0231 4608        pci            (94575c0571d1462a0f70bde6bd6ee6b3) C:\Windows\system32\drivers\pci.sys
19:25:23.0252 4608        pci - ok
19:25:23.0264 4608        pciide          (b5b8b5ef2e5cb34df8dcf8831e3534fa) C:\Windows\system32\drivers\pciide.sys
19:25:23.0274 4608        pciide - ok
19:25:23.0293 4608        pcmcia          (b2e81d4e87ce48589f98cb8c05b01f2f) C:\Windows\system32\DRIVERS\pcmcia.sys
19:25:23.0315 4608        pcmcia - ok
19:25:23.0319 4608        pcw            (d6b9c2e1a11a3a4b26a182ffef18f603) C:\Windows\system32\drivers\pcw.sys
19:25:23.0331 4608        pcw - ok
19:25:23.0364 4608        PEAUTH          (68769c3356b3be5d1c732c97b9a80d6e) C:\Windows\system32\drivers\peauth.sys
19:25:23.0403 4608        PEAUTH - ok
19:25:23.0479 4608        PeerDistSvc    (b9b0a4299dd2d76a4243f75fd54dc680) C:\Windows\system32\peerdistsvc.dll
19:25:23.0541 4608        PeerDistSvc - ok
19:25:23.0711 4608        PerfHost        (e495e408c93141e8fc72dc0c6046ddfa) C:\Windows\SysWow64\perfhost.exe
19:25:23.0729 4608        PerfHost - ok
19:25:23.0963 4608        pla            (c7cf6a6e137463219e1259e3f0f0dd6c) C:\Windows\system32\pla.dll
19:25:24.0020 4608        pla - ok
19:25:24.0051 4608        PlugPlay        (25fbdef06c4d92815b353f6e792c8129) C:\Windows\system32\umpnpmgr.dll
19:25:24.0133 4608        PlugPlay - ok
19:25:24.0145 4608        PNRPAutoReg    (7195581cec9bb7d12abe54036acc2e38) C:\Windows\system32\pnrpauto.dll
19:25:24.0166 4608        PNRPAutoReg - ok
19:25:24.0180 4608        PNRPsvc        (3eac4455472cc2c97107b5291e0dcafe) C:\Windows\system32\pnrpsvc.dll
19:25:24.0194 4608        PNRPsvc - ok
19:25:24.0231 4608        PolicyAgent    (4f15d75adf6156bf56eced6d4a55c389) C:\Windows\System32\ipsecsvc.dll
19:25:24.0358 4608        PolicyAgent - ok
19:25:24.0387 4608        Power          (6ba9d927dded70bd1a9caded45f8b184) C:\Windows\system32\umpo.dll
19:25:24.0422 4608        Power - ok
19:25:24.0541 4608        PptpMiniport    (f92a2c41117a11a00be01ca01a7fcde9) C:\Windows\system32\DRIVERS\raspptp.sys
19:25:24.0569 4608        PptpMiniport - ok
19:25:24.0596 4608        Processor      (0d922e23c041efb1c3fac2a6f943c9bf) C:\Windows\system32\DRIVERS\processr.sys
19:25:24.0618 4608        Processor - ok
19:25:24.0663 4608        ProfSvc        (53e83f1f6cf9d62f32801cf66d8352a8) C:\Windows\system32\profsvc.dll
19:25:24.0708 4608        ProfSvc - ok
19:25:24.0735 4608        ProtectedStorage (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:25:24.0745 4608        ProtectedStorage - ok
19:25:24.0780 4608        Psched          (0557cf5a2556bd58e26384169d72438d) C:\Windows\system32\DRIVERS\pacer.sys
19:25:24.0819 4608        Psched - ok
19:25:24.0901 4608        ql2300          (a53a15a11ebfd21077463ee2c7afeef0) C:\Windows\system32\DRIVERS\ql2300.sys
19:25:24.0944 4608        ql2300 - ok
19:25:25.0204 4608        ql40xx          (4f6d12b51de1aaeff7dc58c4d75423c8) C:\Windows\system32\DRIVERS\ql40xx.sys
19:25:25.0217 4608        ql40xx - ok
19:25:25.0239 4608        QWAVE          (906191634e99aea92c4816150bda3732) C:\Windows\system32\qwave.dll
19:25:25.0270 4608        QWAVE - ok
19:25:25.0274 4608        QWAVEdrv        (76707bb36430888d9ce9d705398adb6c) C:\Windows\system32\drivers\qwavedrv.sys
19:25:25.0288 4608        QWAVEdrv - ok
19:25:25.0290 4608        RasAcd          (5a0da8ad5762fa2d91678a8a01311704) C:\Windows\system32\DRIVERS\rasacd.sys
19:25:25.0319 4608        RasAcd - ok
19:25:25.0348 4608        RasAgileVpn    (7ecff9b22276b73f43a99a15a6094e90) C:\Windows\system32\DRIVERS\AgileVpn.sys
19:25:25.0377 4608        RasAgileVpn - ok
19:25:25.0391 4608        RasAuto        (8f26510c5383b8dbe976de1cd00fc8c7) C:\Windows\System32\rasauto.dll
19:25:25.0424 4608        RasAuto - ok
19:25:25.0440 4608        Rasl2tp        (471815800ae33e6f1c32fb1b97c490ca) C:\Windows\system32\DRIVERS\rasl2tp.sys
19:25:25.0481 4608        Rasl2tp - ok
19:25:25.0514 4608        RasMan          (ee867a0870fc9e4972ba9eaad35651e2) C:\Windows\System32\rasmans.dll
19:25:25.0549 4608        RasMan - ok
19:25:25.0555 4608        RasPppoe        (855c9b1cd4756c5e9a2aa58a15f58c25) C:\Windows\system32\DRIVERS\raspppoe.sys
19:25:25.0590 4608        RasPppoe - ok
19:25:25.0618 4608        RasSstp        (e8b1e447b008d07ff47d016c2b0eeecb) C:\Windows\system32\DRIVERS\rassstp.sys
19:25:25.0655 4608        RasSstp - ok
19:25:25.0688 4608        rdbss          (77f665941019a1594d887a74f301fa2f) C:\Windows\system32\DRIVERS\rdbss.sys
19:25:25.0731 4608        rdbss - ok
19:25:25.0747 4608        rdpbus          (302da2a0539f2cf54d7c6cc30c1f2d8d) C:\Windows\system32\DRIVERS\rdpbus.sys
19:25:25.0766 4608        rdpbus - ok
19:25:25.0770 4608        RDPCDD          (cea6cc257fc9b7715f1c2b4849286d24) C:\Windows\system32\DRIVERS\RDPCDD.sys
19:25:25.0805 4608        RDPCDD - ok
19:25:25.0836 4608        RDPDR          (1b6163c503398b23ff8b939c67747683) C:\Windows\system32\drivers\rdpdr.sys
19:25:25.0856 4608        RDPDR - ok
19:25:25.0868 4608        RDPENCDD        (bb5971a4f00659529a5c44831af22365) C:\Windows\system32\drivers\rdpencdd.sys
19:25:25.0907 4608        RDPENCDD - ok
19:25:25.0911 4608        RDPREFMP        (216f3fa57533d98e1f74ded70113177a) C:\Windows\system32\drivers\rdprefmp.sys
19:25:25.0938 4608        RDPREFMP - ok
19:25:25.0963 4608        RDPWD          (e61608aa35e98999af9aaeeea6114b0a) C:\Windows\system32\drivers\RDPWD.sys
19:25:26.0008 4608        RDPWD - ok
19:25:26.0049 4608        rdyboost        (34ed295fa0121c241bfef24764fc4520) C:\Windows\system32\drivers\rdyboost.sys
19:25:26.0071 4608        rdyboost - ok
19:25:26.0092 4608        RemoteAccess    (254fb7a22d74e5511c73a3f6d802f192) C:\Windows\System32\mprdim.dll
19:25:26.0133 4608        RemoteAccess - ok
19:25:26.0161 4608        RemoteRegistry  (e4d94f24081440b5fc5aa556c7c62702) C:\Windows\system32\regsvc.dll
19:25:26.0202 4608        RemoteRegistry - ok
19:25:26.0239 4608        RpcEptMapper    (e4dc58cf7b3ea515ae917ff0d402a7bb) C:\Windows\System32\RpcEpMap.dll
19:25:26.0276 4608        RpcEptMapper - ok
19:25:26.0295 4608        RpcLocator      (d5ba242d4cf8e384db90e6a8ed850b8c) C:\Windows\system32\locator.exe
19:25:26.0317 4608        RpcLocator - ok
19:25:26.0356 4608        RpcSs          (5c627d1b1138676c0a7ab2c2c190d123) C:\Windows\system32\rpcss.dll
19:25:26.0387 4608        RpcSs - ok
19:25:26.0422 4608        rspndr          (ddc86e4f8e7456261e637e3552e804ff) C:\Windows\system32\DRIVERS\rspndr.sys
19:25:26.0452 4608        rspndr - ok
19:25:26.0493 4608        RTL8167        (abcb5a38a0d85bdf69b7877e1ad1eed5) C:\Windows\system32\DRIVERS\Rt64win7.sys
19:25:26.0536 4608        RTL8167 - ok
19:25:26.0555 4608        s3cap          (e60c0a09f997826c7627b244195ab581) C:\Windows\system32\drivers\vms3cap.sys
19:25:26.0575 4608        s3cap - ok
19:25:26.0602 4608        SamSs          (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:25:26.0612 4608        SamSs - ok
19:25:26.0719 4608        SbieDrv        (51c44ad397f33423761ec78d07fdbd12) C:\Program Files\Sandboxie\SbieDrv.sys
19:25:26.0733 4608        SbieDrv - ok
19:25:26.0788 4608        SbieSvc        (99025c05c7b404db93a7f00644769064) C:\Program Files\Sandboxie\SbieSvc.exe
19:25:26.0797 4608        SbieSvc - ok
19:25:26.0831 4608        sbp2port        (ac03af3329579fffb455aa2daabbe22b) C:\Windows\system32\drivers\sbp2port.sys
19:25:26.0842 4608        sbp2port - ok
19:25:26.0989 4608        SBSDWSCService  (794d4b48dfb6e999537c7c3947863463) D:\Programme\Spybot - Search & Destroy\SDWinSec.exe
19:25:27.0024 4608        SBSDWSCService - ok
19:25:27.0063 4608        SCardSvr        (9b7395789e3791a3b6d000fe6f8b131e) C:\Windows\System32\SCardSvr.dll
19:25:27.0112 4608        SCardSvr - ok
19:25:27.0135 4608        scfilter        (253f38d0d7074c02ff8deb9836c97d2b) C:\Windows\system32\DRIVERS\scfilter.sys
19:25:27.0166 4608        scfilter - ok
19:25:27.0239 4608        Schedule        (262f6592c3299c005fd6bec90fc4463a) C:\Windows\system32\schedsvc.dll
19:25:27.0295 4608        Schedule - ok
19:25:27.0321 4608        SCPolicySvc    (f17d1d393bbc69c5322fbfafaca28c7f) C:\Windows\System32\certprop.dll
19:25:27.0346 4608        SCPolicySvc - ok
19:25:27.0379 4608        SDRSVC          (6ea4234dc55346e0709560fe7c2c1972) C:\Windows\System32\SDRSVC.dll
19:25:27.0428 4608        SDRSVC - ok
19:25:27.0518 4608        secdrv          (3ea8a16169c26afbeb544e0e48421186) C:\Windows\system32\drivers\secdrv.sys
19:25:27.0551 4608        secdrv - ok
19:25:27.0573 4608        seclogon        (bc617a4e1b4fa8df523a061739a0bd87) C:\Windows\system32\seclogon.dll
19:25:27.0606 4608        seclogon - ok
19:25:27.0629 4608        SENS            (c32ab8fa018ef34c0f113bd501436d21) C:\Windows\System32\sens.dll
19:25:27.0666 4608        SENS - ok
19:25:27.0676 4608        SensrSvc        (0336cffafaab87a11541f1cf1594b2b2) C:\Windows\system32\sensrsvc.dll
19:25:27.0702 4608        SensrSvc - ok
19:25:27.0706 4608        Serenum        (cb624c0035412af0debec78c41f5ca1b) C:\Windows\system32\DRIVERS\serenum.sys
19:25:27.0727 4608        Serenum - ok
19:25:27.0733 4608        Serial          (c1d8e28b2c2adfaec4ba89e9fda69bd6) C:\Windows\system32\DRIVERS\serial.sys
19:25:27.0749 4608        Serial - ok
19:25:27.0770 4608        sermouse        (1c545a7d0691cc4a027396535691c3e3) C:\Windows\system32\DRIVERS\sermouse.sys
19:25:27.0786 4608        sermouse - ok
19:25:27.0809 4608        SessionEnv      (0b6231bf38174a1628c4ac812cc75804) C:\Windows\system32\sessenv.dll
19:25:27.0844 4608        SessionEnv - ok
19:25:27.0860 4608        sffdisk        (a554811bcd09279536440c964ae35bbf) C:\Windows\system32\drivers\sffdisk.sys
19:25:27.0879 4608        sffdisk - ok
19:25:27.0883 4608        sffp_mmc        (ff414f0baefeba59bc6c04b3db0b87bf) C:\Windows\system32\drivers\sffp_mmc.sys
19:25:27.0897 4608        sffp_mmc - ok
19:25:27.0899 4608        sffp_sd        (dd85b78243a19b59f0637dcf284da63c) C:\Windows\system32\drivers\sffp_sd.sys
19:25:27.0920 4608        sffp_sd - ok
19:25:27.0922 4608        sfloppy        (a9d601643a1647211a1ee2ec4e433ff4) C:\Windows\system32\DRIVERS\sfloppy.sys
19:25:27.0936 4608        sfloppy - ok
19:25:27.0979 4608        SharedAccess    (b95f6501a2f8b2e78c697fec401970ce) C:\Windows\System32\ipnathlp.dll
19:25:28.0024 4608        SharedAccess - ok
19:25:28.0063 4608        ShellHWDetection (aaf932b4011d14052955d4b212a4da8d) C:\Windows\System32\shsvcs.dll
19:25:28.0092 4608        ShellHWDetection - ok
19:25:28.0114 4608        SiSRaid2        (843caf1e5fde1ffd5ff768f23a51e2e1) C:\Windows\system32\DRIVERS\SiSRaid2.sys
19:25:28.0125 4608        SiSRaid2 - ok
19:25:28.0133 4608        SiSRaid4        (6a6c106d42e9ffff8b9fcb4f754f6da4) C:\Windows\system32\DRIVERS\sisraid4.sys
19:25:28.0143 4608        SiSRaid4 - ok
19:25:28.0198 4608        SkypeUpdate    (6128e98eaaed364ed1a32708d2fd22cb) C:\Program Files (x86)\Skype\Updater\Updater.exe
19:25:28.0206 4608        SkypeUpdate - ok
19:25:28.0219 4608        Smb            (548260a7b8654e024dc30bf8a7c5baa4) C:\Windows\system32\DRIVERS\smb.sys
19:25:28.0260 4608        Smb - ok
19:25:28.0299 4608        SNMPTRAP        (6313f223e817cc09aa41811daa7f541d) C:\Windows\System32\snmptrap.exe
19:25:28.0317 4608        SNMPTRAP - ok
19:25:28.0321 4608        spldr          (b9e31e5cacdfe584f34f730a677803f9) C:\Windows\system32\drivers\spldr.sys
19:25:28.0331 4608        spldr - ok
19:25:28.0368 4608        Spooler        (b96c17b5dc1424d56eea3a99e97428cd) C:\Windows\System32\spoolsv.exe
19:25:28.0401 4608        Spooler - ok
19:25:28.0565 4608        sppsvc          (e17e0188bb90fae42d83e98707efa59c) C:\Windows\system32\sppsvc.exe
19:25:28.0641 4608        sppsvc - ok
19:25:28.0840 4608        sppuinotify    (93d7d61317f3d4bc4f4e9f8a96a7de45) C:\Windows\system32\sppuinotify.dll
19:25:28.0875 4608        sppuinotify - ok
19:25:28.0973 4608        srv            (441fba48bff01fdb9d5969ebc1838f0b) C:\Windows\system32\DRIVERS\srv.sys
19:25:29.0008 4608        srv - ok
19:25:29.0043 4608        srv2            (b4adebbf5e3677cce9651e0f01f7cc28) C:\Windows\system32\DRIVERS\srv2.sys
19:25:29.0065 4608        srv2 - ok
19:25:29.0092 4608        srvnet          (27e461f0be5bff5fc737328f749538c3) C:\Windows\system32\DRIVERS\srvnet.sys
19:25:29.0125 4608        srvnet - ok
19:25:29.0165 4608        ssadbus        (8f8324ed1de63ffc7b1a02cd2d963c72) C:\Windows\system32\DRIVERS\ssadbus.sys
19:25:29.0198 4608        ssadbus - ok
19:25:29.0233 4608        ssadmdfl        (58221efcb74167b73667f0024c661ce0) C:\Windows\system32\DRIVERS\ssadmdfl.sys
19:25:29.0254 4608        ssadmdfl - ok
19:25:29.0274 4608        ssadmdm        (4da7c71bfac5ad71255b7e4cab980163) C:\Windows\system32\DRIVERS\ssadmdm.sys
19:25:29.0305 4608        ssadmdm - ok
19:25:29.0346 4608        sscdbus        (ed161b91fdf7eaa39469d72d463d5f4e) C:\Windows\system32\DRIVERS\sscdbus.sys
19:25:29.0358 4608        sscdbus - ok
19:25:29.0370 4608        sscdmdfl        (4cb09e77593dbd8d7af33b37375ca715) C:\Windows\system32\DRIVERS\sscdmdfl.sys
19:25:29.0377 4608        sscdmdfl - ok
19:25:29.0397 4608        sscdmdm        (c7b4cf53497a6e5363f3439427663882) C:\Windows\system32\DRIVERS\sscdmdm.sys
19:25:29.0418 4608        sscdmdm - ok
19:25:29.0444 4608        SSDPSRV        (51b52fbd583cde8aa9ba62b8b4298f33) C:\Windows\System32\ssdpsrv.dll
19:25:29.0475 4608        SSDPSRV - ok
19:25:29.0491 4608        SstpSvc        (ab7aebf58dad8daab7a6c45e6a8885cb) C:\Windows\system32\sstpsvc.dll
19:25:29.0518 4608        SstpSvc - ok
19:25:29.0586 4608        Steam Client Service - ok
19:25:29.0672 4608        Stereo Service  (c354621b6b94e10ae7f5cdbe745feb86) C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
19:25:29.0684 4608        Stereo Service - ok
19:25:29.0704 4608        stexstor        (f3817967ed533d08327dc73bc4d5542a) C:\Windows\system32\DRIVERS\stexstor.sys
19:25:29.0713 4608        stexstor - ok
19:25:29.0729 4608        StillCam        (decacb6921ded1a38642642685d77dac) C:\Windows\system32\DRIVERS\serscan.sys
19:25:29.0747 4608        StillCam - ok
19:25:29.0797 4608        stisvc          (8dd52e8e6128f4b2da92ce27402871c1) C:\Windows\System32\wiaservc.dll
19:25:29.0821 4608        stisvc - ok
19:25:29.0840 4608        storflt        (7785dc213270d2fc066538daf94087e7) C:\Windows\system32\drivers\vmstorfl.sys
19:25:29.0850 4608        storflt - ok
19:25:29.0872 4608        StorSvc        (c40841817ef57d491f22eb103da587cc) C:\Windows\system32\storsvc.dll
19:25:29.0889 4608        StorSvc - ok
19:25:29.0905 4608        storvsc        (d34e4943d5ac096c8edeebfd80d76e23) C:\Windows\system32\drivers\storvsc.sys
19:25:29.0915 4608        storvsc - ok
19:25:29.0942 4608        swenum          (d01ec09b6711a5f8e7e6564a4d0fbc90) C:\Windows\system32\drivers\swenum.sys
19:25:29.0952 4608        swenum - ok
19:25:29.0981 4608        swprv          (e08e46fdd841b7184194011ca1955a0b) C:\Windows\System32\swprv.dll
19:25:30.0030 4608        swprv - ok
19:25:30.0118 4608        SysMain        (bf9ccc0bf39b418c8d0ae8b05cf95b7d) C:\Windows\system32\sysmain.dll
19:25:30.0209 4608        SysMain - ok
19:25:30.0416 4608        TabletInputService (e3c61fd7b7c2557e1f1b0b4cec713585) C:\Windows\System32\TabSvc.dll
19:25:30.0442 4608        TabletInputService - ok
19:25:30.0467 4608        TapiSrv        (40f0849f65d13ee87b9a9ae3c1dd6823) C:\Windows\System32\tapisrv.dll
19:25:30.0512 4608        TapiSrv - ok
19:25:30.0563 4608        TBS            (1be03ac720f4d302ea01d40f588162f6) C:\Windows\System32\tbssvc.dll
19:25:30.0600 4608        TBS - ok
19:25:30.0752 4608        Tcpip          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\drivers\tcpip.sys
19:25:30.0803 4608        Tcpip - ok
19:25:31.0182 4608        TCPIP6          (acb82bda8f46c84f465c1afa517dc4b9) C:\Windows\system32\DRIVERS\tcpip.sys
19:25:31.0213 4608        TCPIP6 - ok
19:25:31.0469 4608        tcpipreg        (df687e3d8836bfb04fcc0615bf15a519) C:\Windows\system32\drivers\tcpipreg.sys
19:25:31.0508 4608        tcpipreg - ok
19:25:31.0532 4608        TDPIPE          (3371d21011695b16333a3934340c4e7c) C:\Windows\system32\drivers\tdpipe.sys
19:25:31.0559 4608        TDPIPE - ok
19:25:31.0579 4608        TDTCP          (51c5eceb1cdee2468a1748be550cfbc8) C:\Windows\system32\drivers\tdtcp.sys
19:25:31.0600 4608        TDTCP - ok
19:25:31.0639 4608        tdx            (ddad5a7ab24d8b65f8d724f5c20fd806) C:\Windows\system32\DRIVERS\tdx.sys
19:25:31.0676 4608        tdx - ok
19:25:31.0696 4608        TermDD          (561e7e1f06895d78de991e01dd0fb6e5) C:\Windows\system32\drivers\termdd.sys
19:25:31.0708 4608        TermDD - ok
19:25:31.0758 4608        TermService    (2e648163254233755035b46dd7b89123) C:\Windows\System32\termsrv.dll
19:25:31.0805 4608        TermService - ok
19:25:31.0825 4608        Themes          (f0344071948d1a1fa732231785a0664c) C:\Windows\system32\themeservice.dll
19:25:31.0852 4608        Themes - ok
19:25:31.0872 4608        THREADORDER    (e40e80d0304a73e8d269f7141d77250b) C:\Windows\system32\mmcss.dll
19:25:31.0901 4608        THREADORDER - ok
19:25:31.0915 4608        TrkWks          (7e7afd841694f6ac397e99d75cead49d) C:\Windows\System32\trkwks.dll
19:25:31.0952 4608        TrkWks - ok
19:25:31.0991 4608        TrustedInstaller (773212b2aaa24c1e31f10246b15b276c) C:\Windows\servicing\TrustedInstaller.exe
19:25:32.0038 4608        TrustedInstaller - ok
19:25:32.0065 4608        tssecsrv        (ce18b2cdfc837c99e5fae9ca6cba5d30) C:\Windows\system32\DRIVERS\tssecsrv.sys
19:25:32.0090 4608        tssecsrv - ok
19:25:32.0125 4608        TsUsbFlt        (d11c783e3ef9a3c52c0ebe83cc5000e9) C:\Windows\system32\drivers\tsusbflt.sys
19:25:32.0165 4608        TsUsbFlt - ok
19:25:32.0206 4608        tunnel          (3566a8daafa27af944f5d705eaa64894) C:\Windows\system32\DRIVERS\tunnel.sys
19:25:32.0245 4608        tunnel - ok
19:25:32.0266 4608        uagp35          (b4dd609bd7e282bfc683cec7eaaaad67) C:\Windows\system32\DRIVERS\uagp35.sys
19:25:32.0276 4608        uagp35 - ok
19:25:32.0311 4608        udfs            (ff4232a1a64012baa1fd97c7b67df593) C:\Windows\system32\DRIVERS\udfs.sys
19:25:32.0354 4608        udfs - ok
19:25:32.0368 4608        UI0Detect      (3cbdec8d06b9968aba702eba076364a1) C:\Windows\system32\UI0Detect.exe
19:25:32.0379 4608        UI0Detect - ok
19:25:32.0397 4608        uliagpkx        (4bfe1bc28391222894cbf1e7d0e42320) C:\Windows\system32\drivers\uliagpkx.sys
19:25:32.0407 4608        uliagpkx - ok
19:25:32.0438 4608        umbus          (dc54a574663a895c8763af0fa1ff7561) C:\Windows\system32\drivers\umbus.sys
19:25:32.0459 4608        umbus - ok
19:25:32.0471 4608        UmPass          (b2e8e8cb557b156da5493bbddcc1474d) C:\Windows\system32\DRIVERS\umpass.sys
19:25:32.0493 4608        UmPass - ok
19:25:32.0520 4608        UmRdpService    (a293dcd756d04d8492a750d03b9a297c) C:\Windows\System32\umrdp.dll
19:25:32.0545 4608        UmRdpService - ok
19:25:32.0569 4608        upnphost        (d47ec6a8e81633dd18d2436b19baf6de) C:\Windows\System32\upnphost.dll
19:25:32.0676 4608        upnphost - ok
19:25:32.0719 4608        usbaudio        (82e8f44688e6fac57b5b7c6fc7adbc2a) C:\Windows\system32\drivers\usbaudio.sys
19:25:32.0739 4608        usbaudio - ok
19:25:32.0764 4608        usbccgp        (6f1a3157a1c89435352ceb543cdb359c) C:\Windows\system32\DRIVERS\usbccgp.sys
19:25:32.0834 4608        usbccgp - ok
19:25:32.0866 4608        usbcir          (af0892a803fdda7492f595368e3b68e7) C:\Windows\system32\drivers\usbcir.sys
19:25:32.0877 4608        usbcir - ok
19:25:32.0905 4608        usbehci        (c025055fe7b87701eb042095df1a2d7b) C:\Windows\system32\DRIVERS\usbehci.sys
19:25:32.0924 4608        usbehci - ok
19:25:32.0959 4608        usbhub          (287c6c9410b111b68b52ca298f7b8c24) C:\Windows\system32\DRIVERS\usbhub.sys
19:25:32.0983 4608        usbhub - ok
19:25:33.0006 4608        usbohci        (9840fc418b4cbd632d3d0a667a725c31) C:\Windows\system32\drivers\usbohci.sys
19:25:33.0022 4608        usbohci - ok
19:25:33.0040 4608        usbprint        (73188f58fb384e75c4063d29413cee3d) C:\Windows\system32\DRIVERS\usbprint.sys
19:25:33.0059 4608        usbprint - ok
19:25:33.0065 4608        USBSTOR        (fed648b01349a3c8395a5169db5fb7d6) C:\Windows\system32\DRIVERS\USBSTOR.SYS
19:25:33.0094 4608        USBSTOR - ok
19:25:33.0116 4608        usbuhci        (62069a34518bcf9c1fd9e74b3f6db7cd) C:\Windows\system32\DRIVERS\usbuhci.sys
19:25:33.0141 4608        usbuhci - ok
19:25:33.0166 4608        UxSms          (edbb23cbcf2cdf727d64ff9b51a6070e) C:\Windows\System32\uxsms.dll
19:25:33.0206 4608        UxSms - ok
19:25:33.0217 4608        VaultSvc        (c118a82cd78818c29ab228366ebf81c3) C:\Windows\system32\lsass.exe
19:25:33.0227 4608        VaultSvc - ok
19:25:33.0276 4608        VBoxDrv        (ba20a718e25228b9d69d72e4f19edeb5) C:\Windows\system32\DRIVERS\VBoxDrv.sys
19:25:33.0295 4608        VBoxDrv - ok
19:25:33.0327 4608        VBoxNetAdp      (48630b4530c80aaf3dde9633e4291d8c) C:\Windows\system32\DRIVERS\VBoxNetAdp.sys
19:25:33.0338 4608        VBoxNetAdp - ok
19:25:33.0356 4608        VBoxNetFlt      (8b86a00d13e2dcbfe320061f3435faff) C:\Windows\system32\DRIVERS\VBoxNetFlt.sys
19:25:33.0375 4608        VBoxNetFlt - ok
19:25:33.0418 4608        VBoxUSBMon      (cec73cea22b7258c0a8f2354dc49d25c) C:\Windows\system32\DRIVERS\VBoxUSBMon.sys
19:25:33.0430 4608        VBoxUSBMon - ok
19:25:33.0461 4608        vdrvroot        (c5c876ccfc083ff3b128f933823e87bd) C:\Windows\system32\drivers\vdrvroot.sys
19:25:33.0473 4608        vdrvroot - ok
19:25:33.0512 4608        vds            (8d6b481601d01a456e75c3210f1830be) C:\Windows\System32\vds.exe
19:25:33.0549 4608        vds - ok
19:25:33.0586 4608        vga            (da4da3f5e02943c2dc8c6ed875de68dd) C:\Windows\system32\DRIVERS\vgapnp.sys
19:25:33.0598 4608        vga - ok
19:25:33.0610 4608        VgaSave        (53e92a310193cb3c03bea963de7d9cfc) C:\Windows\System32\drivers\vga.sys
19:25:33.0643 4608        VgaSave - ok
19:25:33.0672 4608        vhdmp          (2ce2df28c83aeaf30084e1b1eb253cbb) C:\Windows\system32\drivers\vhdmp.sys
19:25:33.0692 4608        vhdmp - ok
19:25:33.0717 4608        viaide          (e5689d93ffe4e5d66c0178761240dd54) C:\Windows\system32\drivers\viaide.sys
19:25:33.0727 4608        viaide - ok
19:25:33.0756 4608        vmbus          (86ea3e79ae350fea5331a1303054005f) C:\Windows\system32\drivers\vmbus.sys
19:25:33.0778 4608        vmbus - ok
19:25:33.0795 4608        VMBusHID        (7de90b48f210d29649380545db45a187) C:\Windows\system32\drivers\VMBusHID.sys
19:25:33.0811 4608        VMBusHID - ok
19:25:33.0829 4608        volmgr          (d2aafd421940f640b407aefaaebd91b0) C:\Windows\system32\drivers\volmgr.sys
19:25:33.0838 4608        volmgr - ok
19:25:33.0872 4608        volmgrx        (a255814907c89be58b79ef2f189b843b) C:\Windows\system32\drivers\volmgrx.sys
19:25:33.0891 4608        volmgrx - ok
19:25:33.0911 4608        volsnap        (0d08d2f3b3ff84e433346669b5e0f639) C:\Windows\system32\drivers\volsnap.sys
19:25:33.0930 4608        volsnap - ok
19:25:33.0963 4608        vsmraid        (5e2016ea6ebaca03c04feac5f330d997) C:\Windows\system32\DRIVERS\vsmraid.sys
19:25:33.0985 4608        vsmraid - ok
19:25:34.0075 4608        VSS            (b60ba0bc31b0cb414593e169f6f21cc2) C:\Windows\system32\vssvc.exe
19:25:34.0139 4608        VSS - ok
19:25:34.0399 4608        vwifibus        (36d4720b72b5c5d9cb2b9c29e9df67a1) C:\Windows\System32\drivers\vwifibus.sys
19:25:34.0422 4608        vwifibus - ok
19:25:34.0456 4608        W32Time        (1c9d80cc3849b3788048078c26486e1a) C:\Windows\system32\w32time.dll
19:25:34.0489 4608        W32Time - ok
19:25:34.0495 4608        WacomPen        (4e9440f4f152a7b944cb1663d3935a3e) C:\Windows\system32\DRIVERS\wacompen.sys
19:25:34.0514 4608        WacomPen - ok
19:25:34.0561 4608        WANARP          (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
19:25:34.0596 4608        WANARP - ok
19:25:34.0604 4608        Wanarpv6        (356afd78a6ed4457169241ac3965230c) C:\Windows\system32\DRIVERS\wanarp.sys
19:25:34.0629 4608        Wanarpv6 - ok
19:25:34.0719 4608        wbengine        (78f4e7f5c56cb9716238eb57da4b6a75) C:\Windows\system32\wbengine.exe
19:25:34.0817 4608        wbengine - ok
19:25:35.0045 4608        WbioSrvc        (3aa101e8edab2db4131333f4325c76a3) C:\Windows\System32\wbiosrvc.dll
19:25:35.0069 4608        WbioSrvc - ok
19:25:35.0102 4608        wcncsvc        (7368a2afd46e5a4481d1de9d14848edd) C:\Windows\System32\wcncsvc.dll
19:25:35.0124 4608        wcncsvc - ok
19:25:35.0139 4608        WcsPlugInService (20f7441334b18cee52027661df4a6129) C:\Windows\System32\WcsPlugInService.dll
19:25:35.0157 4608        WcsPlugInService - ok
19:25:35.0247 4608        Wd              (72889e16ff12ba0f235467d6091b17dc) C:\Windows\system32\DRIVERS\wd.sys
19:25:35.0256 4608        Wd - ok
19:25:35.0286 4608        Wdf01000        (441bd2d7b4f98134c3a4f9fa570fd250) C:\Windows\system32\drivers\Wdf01000.sys
19:25:35.0305 4608        Wdf01000 - ok
19:25:35.0319 4608        WdiServiceHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
19:25:35.0395 4608        WdiServiceHost - ok
19:25:35.0397 4608        WdiSystemHost  (bf1fc3f79b863c914687a737c2f3d681) C:\Windows\system32\wdi.dll
19:25:35.0413 4608        WdiSystemHost - ok
19:25:35.0444 4608        WebClient      (3db6d04e1c64272f8b14eb8bc4616280) C:\Windows\System32\webclnt.dll
19:25:35.0471 4608        WebClient - ok
19:25:35.0495 4608        Wecsvc          (c749025a679c5103e575e3b48e092c43) C:\Windows\system32\wecsvc.dll
19:25:35.0545 4608        Wecsvc - ok
19:25:35.0563 4608        wercplsupport  (7e591867422dc788b9e5bd337a669a08) C:\Windows\System32\wercplsupport.dll
19:25:35.0592 4608        wercplsupport - ok
19:25:35.0627 4608        WerSvc          (6d137963730144698cbd10f202e9f251) C:\Windows\System32\WerSvc.dll
19:25:35.0657 4608        WerSvc - ok
19:25:35.0760 4608        WfpLwf          (611b23304bf067451a9fdee01fbdd725) C:\Windows\system32\DRIVERS\wfplwf.sys
19:25:35.0788 4608        WfpLwf - ok
19:25:35.0791 4608        WIMMount        (05ecaec3e4529a7153b3136ceb49f0ec) C:\Windows\system32\drivers\wimmount.sys
19:25:35.0801 4608        WIMMount - ok
19:25:35.0833 4608        WinDefend - ok
19:25:35.0836 4608        WinHttpAutoProxySvc - ok
19:25:35.0928 4608        Winmgmt        (19b07e7e8915d701225da41cb3877306) C:\Windows\system32\wbem\WMIsvc.dll
19:25:35.0959 4608        Winmgmt - ok
19:25:36.0063 4608        WinRM          (bcb1310604aa415c4508708975b3931e) C:\Windows\system32\WsmSvc.dll
19:25:36.0133 4608        WinRM - ok
19:25:36.0403 4608        WinUsb          (fe88b288356e7b47b74b13372add906d) C:\Windows\system32\DRIVERS\WinUsb.sys
19:25:36.0415 4608        WinUsb - ok
19:25:36.0477 4608        Wlansvc        (4fada86e62f18a1b2f42ba18ae24e6aa) C:\Windows\System32\wlansvc.dll
19:25:36.0567 4608        Wlansvc - ok
19:25:36.0588 4608        WmiAcpi        (f6ff8944478594d0e414d3f048f0d778) C:\Windows\system32\drivers\wmiacpi.sys
19:25:36.0602 4608        WmiAcpi - ok
19:25:36.0688 4608        wmiApSrv        (38b84c94c5a8af291adfea478ae54f93) C:\Windows\system32\wbem\WmiApSrv.exe
19:25:36.0719 4608        wmiApSrv - ok
19:25:36.0766 4608        WMPNetworkSvc - ok
19:25:36.0793 4608        WPCSvc          (96c6e7100d724c69fcf9e7bf590d1dca) C:\Windows\System32\wpcsvc.dll
19:25:36.0815 4608        WPCSvc - ok
19:25:36.0834 4608        WPDBusEnum      (93221146d4ebbf314c29b23cd6cc391d) C:\Windows\system32\wpdbusenum.dll
19:25:36.0864 4608        WPDBusEnum - ok
19:25:36.0879 4608        ws2ifsl        (6bcc1d7d2fd2453957c5479a32364e52) C:\Windows\system32\drivers\ws2ifsl.sys
19:25:36.0916 4608        ws2ifsl - ok
19:25:36.0936 4608        wscsvc          (e8b1fe6669397d1772d8196df0e57a9e) C:\Windows\System32\wscsvc.dll
19:25:36.0958 4608        wscsvc - ok
19:25:36.0959 4608        WSearch - ok
19:25:37.0067 4608        wuauserv        (d9ef901dca379cfe914e9fa13b73b4c4) C:\Windows\system32\wuaueng.dll
19:25:37.0131 4608        wuauserv - ok
19:25:37.0397 4608        WudfPf          (d3381dc54c34d79b22cee0d65ba91b7c) C:\Windows\system32\drivers\WudfPf.sys
19:25:37.0434 4608        WudfPf - ok
19:25:37.0463 4608        WUDFRd          (cf8d590be3373029d57af80914190682) C:\Windows\system32\DRIVERS\WUDFRd.sys
19:25:37.0506 4608        WUDFRd - ok
19:25:37.0526 4608        wudfsvc        (7a95c95b6c4cf292d689106bcae49543) C:\Windows\System32\WUDFSvc.dll
19:25:37.0555 4608        wudfsvc - ok
19:25:37.0598 4608        WwanSvc        (9a3452b3c2a46c073166c5cf49fad1ae) C:\Windows\System32\wwansvc.dll
19:25:37.0659 4608        WwanSvc - ok
19:25:37.0696 4608        MBR (0x1B8)    (a36c5e4f47e84449ff07ed3517b43a31) \Device\Harddisk0\DR0
19:25:37.0913 4608        \Device\Harddisk0\DR0 - ok
19:25:37.0915 4608        Boot (0x1200)  (52d2b46529db2992ebba6ac3d55fe68a) \Device\Harddisk0\DR0\Partition0
19:25:37.0915 4608        \Device\Harddisk0\DR0\Partition0 - ok
19:25:37.0934 4608        Boot (0x1200)  (20b4563b5b0e05b2f8081bcedb7ae2ac) \Device\Harddisk0\DR0\Partition1
19:25:37.0934 4608        \Device\Harddisk0\DR0\Partition1 - ok
19:25:37.0952 4608        Boot (0x1200)  (fae516ddc204a069fb0eeadd81172662) \Device\Harddisk0\DR0\Partition2
19:25:37.0952 4608        \Device\Harddisk0\DR0\Partition2 - ok
19:25:37.0954 4608        ============================================================
19:25:37.0954 4608        Scan finished
19:25:37.0954 4608        ============================================================
19:25:37.0959 3952        Detected object count: 0
19:25:37.0959 3952        Actual detected object count: 0

Greetz Purple


Alle Zeitangaben in WEZ +1. Es ist jetzt 08:54 Uhr.
Seite 1 von 2 1 2
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131