Trojaner-Board
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Trojaner-Board (https://www.trojaner-board.de/)
-   Plagegeister aller Art und deren Bekämpfung (https://www.trojaner-board.de/plagegeister-aller-art-deren-bekaempfung/)
-   -   GVU Trojaner auf Win7 entfernen (https://www.trojaner-board.de/132832-gvu-trojaner-win7-entfernen.html)

christalex 27.03.2013 18:00
GVU Trojaner auf Win7 entfernen
 
Liste der Anhänge anzeigen (Anzahl: 1)
Hallo,

ich habe mir gestern den GVU-Trojaner eingefangen, der mein Notebook mit Win7 komplett blockierte. Bin ein absoluter Laie, der sich im Vorfeld hier quergelesen hat (und hoffentlich das Gelesene auch verstanden hat?)
Meine bisherigen Maßnahmen:
- Versuch im abgesicherten Modus zu starten - ohne Erfolg
- Versuch einer "Systemwiederherstellung" (Abgesicherter Modus mit Eingabeaufforderung) - erfolgreich und Wiederherstellungszeitpunkt 24.03.
- Zusätzlich habe ich auf einem nicht infizierten 2. Rechner eine "OTLPE-CD" gebrannt" - für alle Fälle
- auf dem infizierten System habe ich über OTL eine die beiden OTL.txt und Extras.txt erstellt, die ich als Archiv angehängt habe.

Bitte helft mir weiter!

Wie muss ich weiter vorgehen?
und
Taucht nach dem Herunterfahren aus dieser "Systemwiederherstellung-Status" wieder die GVU-Sperrseite auf? Und wie soll ich dann starten?

Vielen Dank im voraus!

cosinus 28.03.2013 15:57
Hallo und :hallo:

Hast du noch weitere Logs (mit Funden)? Malwarebytes und/oder andere Virenscanner?
Ich frage deswegen nach => http://www.trojaner-board.de/125889-...tml#post941520

Bitte keine neuen Virenscans machen sondern erst nur schon vorhandene Logs posten!

Lesestoff:
Posten in CODE-Tags
Die Logfiles anzuhängen oder sogar vorher in ein ZIP, RAR, 7Z-Archive zu packen erschwert mir massiv die Arbeit, es sei denn natürlich die Datei wäre ansonsten zu gross für das Forum. Um die Logfiles in eine CODE-Box zu stellen gehe so vor:
  • Markiere das gesamte Logfile (geht meist mit STRG+A) und kopiere es in die Zwischenablage mit STRG+C.
  • Klicke im Editor auf das #-Symbol. Es erscheinen zwei Klammerausdrücke [CODE] [/CODE].
  • Setze den Curser zwischen die CODE-Tags und drücke STRG+V.
  • Klicke auf Erweitert/Vorschau, um so prüfen, ob du es richtig gemacht hast. Wenn alles stimmt ... auf Antworten.
http://www.trojaner-board.de/picture...&pictureid=307

christalex 28.03.2013 18:34
Hallo Cosinus,

Danke für deine Hilfe.

Nein, weitere Logs habe ich nicht.

Sorry, jetzt habe ich ohne einen erneuten Scan zu starten in Avira doch noch was gefunden
Code:


Typ:        Datei
Quelle:        C:\Users\***\AppData\Local\Mozilla\Firefox\Profiles\lkickppl.default\Cache\_CACHE_001_
Status:        Infiziert
Quarantäne-Objekt:        55fd0ab8.qua
Wiederhergestellt:        NEIN
Zu Avira hochgeladen:        NEIN
Betriebssystem:        Windows XP/VISTA Workstation/Windows 7
Suchengine:        8.02.10.187
Virendefinitionsdatei:        7.11.48.156
Meldung:        HTML/Infected.WebPage.Gen2
Datum/Uhrzeit:        02.11.2012, 11:57
Ist aber schon älter.

cosinus 29.03.2013 00:38
Bevor wir uns an die Arbeit machen, möchte ich dich bitten, folgende Punkte vollständig und aufmerksam zu lesen.
  • Lies dir meine Anleitungen, die ich im Laufe dieses Strangs hier posten werde, aufmerksam durch. Frag umgehend nach, wenn dir irgendetwas unklar sein sollte, bevor du anfängst meine Anleitungen umzusetzen.

  • Solltest du bei einem Schritt Probleme haben, stoppe dort und beschreib mir das Problem so gut du kannst. Manchmal erfordert ein Schritt den vorhergehenden.

  • Bitte nur Scans durchführen zu denen du von einem Helfer aufgefordert wurdest! Installiere / Deinstalliere keine Software ohne Aufforderung!

  • Poste die Logfiles direkt in deinen Thread (bitte in CODE-Tags) und nicht als Anhang, ausser du wurdest dazu aufgefordert. Logs in Anhängen erschweren mir das Auswerten!

  • Die Logs der aufgegebenen Tools wie zB Malwarebytes sind immer zu posten - egal ob ein Fund dabei war oder nicht!

  • Beachte bitte auch => Löschen von Logfiles und andere Anfragen

Note:
Sollte ich drei Tage nichts von mir hören lassen, so melde dich bitte in diesem Strang => Erinnerung an meinem Thread.
Nervige "Wann geht es weiter" Nachrichten enden mit Schließung deines Themas. Auch ich habe ein Leben abseits des Trojaner-Boards.


Rootkitscan mit GMER

Bitte lade dir GMER Rootkit Scanner GMER herunter: (Dateiname zufällig)
  • Schließe alle anderen Programme, deaktiviere deinen Virenscanner und trenne den Rechner vom Internet bevor du GMER startest.
  • Sollte sich nach dem Start ein Fenster mit folgender Warnung öffnen:
    WARNING !!!
    GMER has found system modification, which might have been caused by ROOTKIT activity.
    Do you want to fully scan your system ?
    Unbedingt auf "No" klicken.
  • Entferne rechts den Haken bei: IAT/EAT und Show All
  • Setze den Haken bei Quickscan und entferne ihn bei allen anderen Laufwerken.
  • Starte den Scan mit "Scan".
  • Mache nichts am Computer während der Scan läuft.
  • Wenn der Scan fertig ist klicke auf Save und speichere die Logfile unter Gmer.txt auf deinem Desktop. Mit "Ok" wird GMER beendet.
Antiviren-Programm und sonstige Scanner wieder einschalten, bevor Du ins Netz gehst!


Tauchen Probleme auf?
  • Probiere alternativ den abgesicherten Modus.
  • Erhältst du einen Bluescreen, dann entferne den Haken vor Devices.


Anschließend bitte MBAR ausführen:

Malwarebytes Anti-Rootkit (MBAR)

Downloade dir bitte Malwarebytes Anti-Rootkit Malwarebytes Anti-Rootkit und speichere es auf deinem Desktop.
  • Starte bitte die mbar.exe.
  • Folge den Anweisungen auf deinem Bildschirm gemäß Anleitung zu Malwarebytes Anti-Rootkit
  • Aktualisiere unbedingt die Datenbank und erlaube dem Tool, dein System zu scannen.
  • Klicke auf den CleanUp Button und erlaube den Neustart.
  • Während dem Neustart wird MBAR die gefundenen Objekte entfernen, also bleib geduldig.
  • Nach dem Neustart starte die mbar.exe erneut.
  • Sollte nochmal was gefunden werden, wiederhole den CleanUp Prozess.
Das Tool wird im erstellten Ordner eine Logfile ( mbar-log-<Jahr-Monat-Tag>.txt ) erzeugen. Bitte poste diese hier.

Starte keine andere Datei in diesem Ordner ohne Anweisung eines Helfers

christalex 29.03.2013 13:48
Hallo Cosinus,

hier das MBAR-Logfile.
Beim 2. Scan wurde nichts mehr gefunden.

Code:
Malwarebytes Anti-Rootkit BETA 1.01.0.1021
www.malwarebytes.org

Database version: v2013.02.15.09

Windows 7 x64 NTFS
Internet Explorer 8.0.7600.16385
*** :: ***-PC [administrator]

29.03.2013 12:41:34
mbar-log-2013-03-29 (12-41-34).txt

Scan type: Quick scan
Scan options enabled: Memory | Startup | Registry | File System | Heuristics/Extra | Heuristics/Shuriken | PUP | PUM | P2P
Scan options disabled:
Objects scanned: 36314
Time elapsed: 27 minute(s), 25 second(s)

Memory Processes Detected: 1
c:\Windows\svchost.exe (Trojan.Agent) -> 3948 -> Delete on reboot.

Memory Modules Detected: 0
(No malicious items detected)

Registry Keys Detected: 23
HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\CLSID\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\TYPELIB\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\INTERFACE\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\INTERFACE\{DB1F5554-582C-4F53-82CC-458D2C04A2F1} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{3D782BB2-F2A5-11D3-BF4C-000000000000} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\INTERFACE\{DB1F5554-582C-4F53-82CC-458D2C04A2F1} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\TYPELIB\{BB7256DD-EBA9-480B-8441-A00388C2BEC3} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\MyNewsBarLauncher.IE5BarLauncher (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\MyNewsBarLauncher.IE5BarLauncher.1 (PUP.VShareRedir) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\CLASSES\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\MyNewsBarLauncher.IE5BarLauncherBHO (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXPLORER\BROWSER HELPER OBJECTS\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\CLASSES\MyNewsBarLauncher.IE5BarLauncherBHO.1 (PUP.VShareRedir) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\SETTINGS\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\STATS\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\WINDOWS\CURRENTVERSION\EXT\PREAPPROVED\{78F3A323-798E-4AEA-9A57-88F4B05FD5DD} (PUP.VShareRedir) -> Delete on reboot.

Registry Values Detected: 5
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: ;áÃzÊ;XA³0öm»Áµ -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR|{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data: VShareTB -> Delete on reboot.
HKCU\SOFTWARE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\WEBBROWSER\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data:  -> Delete on reboot.
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\TOOLBAR\{7AC3E13B-3BCA-4158-B330-F66DBB03C1B5} (PUP.VShareRedir) -> Data:  -> Delete on reboot.
HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run|svchost (Trojan.Agent) -> Data: C:\Windows\svchost.exe -> Delete on reboot.

Registry Data Items Detected: 1
HKLM\SOFTWARE\WOW6432NODE\MICROSOFT\INTERNET EXPLORER\MAIN|Start Page (Hijack.StartPage) -> Bad: (hxxp://startsear.ch/?aff=1) Good: (hxxp://www.google.com) -> Delete on reboot.

Folders Detected: 1
c:\Users\***\AppData\Roaming\loadtbs (PUP.LoadTubes) -> Delete on reboot.

Files Detected: 15
c:\Program Files (x86)\vShare.tv plugin\BarLcher.dll (PUP.VShareRedir) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\ytdl.exe (PUP.LoadTubes) -> Delete on reboot.
c:\Program Files (x86)\Mozilla Firefox\plugins\npmieze.dll (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Local\Temp\12593258.Uninstall\Uninstall.exe (Adware.Agent) -> Delete on reboot.
c:\Users\***\AppData\Local\Temp\ltsilentio\npm.dll (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Local\Temp\ltsilentio\ytdl.exe (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\Pictures\Desktop\Downloads\SoftonicDownloader_fuer_free-video-dub.exe (PUP.OfferBundler.ST) -> Delete on reboot.
c:\Windows\svchost.exe (Trojan.Agent) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\keyHash.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\config.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\domHash.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\evHash.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\uninstall.exe (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\loadtbs\updateHash.txt (PUP.LoadTubes) -> Delete on reboot.
c:\Users\***\AppData\Roaming\skype.dat (Trojan.Agent) -> Delete on reboot.

(end)

cosinus 30.03.2013 01:15
Was ist mit dem GMER-Log?

christalex 30.03.2013 09:59
Code:
GMER 2.1.19155 - hxxp://www.gmer.net
Rootkit scan 2013-03-29 10:28:40
Windows 6.1.7600  x64 \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 SAMSUNG_ rev.2AJ1 596,17GB
Running: gmer_2.1.19155.exe; Driver: C:\Users\Tewes\AppData\Local\Temp\fwdoipow.sys


---- User code sections - GMER 2.1 ----

.text  C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE[476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                      0000000077601465 2 bytes [60, 77]
.text  C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE[476] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                    00000000776014bb 2 bytes [60, 77]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                    0000000077601465 2 bytes [60, 77]
.text  C:\Program Files (x86)\Microsoft Office\Office14\MSOSYNC.EXE[2956] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                    00000000776014bb 2 bytes [60, 77]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2628] C:\Windows\syswow64\kernel32.dll!SetUnhandledExceptionFilter                0000000075d8d03c 5 bytes [33, C0, C2, 04, 00]
.text  C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                      0000000077601465 2 bytes [60, 77]
.text  C:\Program Files (x86)\Pando Networks\Media Booster\PMB.exe[2628] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                    00000000776014bb 2 bytes [60, 77]
.text  ...                                                                                                                                            * 2
.text  C:\Windows\svchost.exe[7120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69                                                          0000000077601465 2 bytes [60, 77]
.text  C:\Windows\svchost.exe[7120] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155                                                          00000000776014bb 2 bytes [60, 77]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69            0000000077601465 2 bytes [60, 77]
.text  C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe[1888] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155            00000000776014bb 2 bytes [60, 77]
.text  ...                                                                                                                                            * 2
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 69  0000000077601465 2 bytes [60, 77]
.text  C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe[5968] C:\Windows\syswow64\PSAPI.DLL!GetModuleInformation + 155  00000000776014bb 2 bytes [60, 77]
.text  ...                                                                                                                                            * 2

---- Disk sectors - GMER 2.1 ----

Disk  \Device\Harddisk0\DR0                                                                                                                          unknown MBR code

---- EOF - GMER 2.1 ----
Sorry, bin jetzt bis Montag abend unterwegs, mit eingeschränkter Internetverbindung.

cosinus 30.03.2013 15:42
Zitat:
Database version: v2013.02.15.09
Warum hast du MBAR vorher nicht aktualisiert? Ohne aktuellen Signaturen ist das Murks. Bitte MBAR nochmal scannen lassen, vorher die Signaturen updaten

christalex 31.03.2013 10:13
Hallo,
hätt ich gleich sagen sollen: hab aktuell probleme mit der dsl-verbindung. Konnte daher vor dem ersten mbar-scan nicht updaten. Bin nach dem mbar-log post nochmal mit schlechtem gewissen zu einem bekannten und von dessen verbindung aus nochmal geupdated, gescannt. Hat nichts weiter mehr gefunden

cosinus 01.04.2013 13:53
aswMBR

Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
  • Starte die aswMBR.exe - (aswMBR.exe Anleitung)
    Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
  • Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
    Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
  • Klicke auf Scan.
  • Warte bitte bis Scan finished successfully im DOS-Fenster steht.
  • Drücke auf Save Log und speichere diese auf dem Desktop.
Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).




TDSS-Killer

Downloade dir bitte TDSSKiller TDSSKiller.exe und speichere diese Datei auf dem Desktop
  • Starte die TDSSKiller.exe - Einstellen wie in der Anleitung zu TDSSKiller beschrieben.
  • Drücke Start Scan
  • Sollten infizierte Objekte gefunden werden, wähle keinesfalls Cure. Wähle Skip und klicke auf Continue.
    TDSSKiller wird eine Logfile auf deinem Systemlaufwerk speichern (Meistens C:\)
    Als Beispiel: C:\TDSSKiller.<Version_Datum_Uhrzeit>log.txt
Poste den Inhalt bitte in jedem Fall hier in deinen Thread.

christalex 01.04.2013 19:01
Hallo,
aswMBR ist abgebrochen während AVAST Engin Scan bei Verzeichnis
C:\Windows\assembly\GAC_MSIL\Microsoft.xxxx

Bis dahin keine roten Zeilen.

Danach wie beschrieben mit AV Scan = none

Code:
aswMBR version 0.9.9.1771 Copyright(c) 2011 AVAST Software
Run date: 2013-04-01 19:52:04
-----------------------------
19:52:04.656    OS Version: Windows x64 6.1.7600
19:52:04.656    Number of processors: 4 586 0x2505
19:52:04.656    ComputerName: ***-PC  UserName: ***
19:53:07.147    Initialize success
19:53:18.582    AVAST engine defs: 13040100
19:53:44.930    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1
19:53:44.930    Disk 0 Vendor: SAMSUNG_ 2AJ1 Size: 610480MB BusType: 3
19:53:45.071    Disk 0 MBR read successfully
19:53:45.071    Disk 0 MBR scan
19:53:45.086    Disk 0 unknown MBR code
19:53:45.102    Disk 0 Partition 1 80 (A) 07    HPFS/NTFS NTFS          100 MB offset 2048
19:53:45.117    Disk 0 Partition 2 00    07    HPFS/NTFS NTFS      559355 MB offset 206848
19:53:45.149    Disk 0 Partition 3 00    07    HPFS/NTFS NTFS        50000 MB offset 1145765888
19:53:45.180    Disk 0 Partition 4 00    12  Compaq diag NTFS        1023 MB offset 1248165888
19:53:45.227    Disk 0 scanning C:\Windows\system32\drivers
19:53:58.268    Service scanning
19:54:29.477    Modules scanning
19:54:29.492    Disk 0 trace - called modules:
19:54:29.524    ntoskrnl.exe CLASSPNP.SYS disk.sys iaStor.sys hal.dll
19:54:29.524    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa80048f8060]
19:54:29.539    3 CLASSPNP.SYS[fffff88001a2f43f] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa8004631050]
19:54:29.539    Scan finished successfully
19:54:37.870    Disk 0 MBR has been saved successfully to "C:\Users\***\Pictures\Desktop\MBR.dat"
19:54:37.870    The log file has been saved successfully to "C:\Users\***\Pictures\Desktop\aswMBR.txt"
Beim ersten Mal nach Klick auf SaveLog Crash Dump.
Beim zweiten Mal ging's

Hier das Logfile von TDSSKiller:
Code:
20:05:52.0705 8148  TDSS rootkit removing tool 2.8.16.0 Feb 11 2013 18:50:42
20:05:52.0907 8148  ============================================================
20:05:52.0907 8148  Current date / time: 2013/04/01 20:05:52.0907
20:05:52.0907 8148  SystemInfo:
20:05:52.0907 8148 
20:05:52.0907 8148  OS Version: 6.1.7600 ServicePack: 0.0
20:05:52.0907 8148  Product type: Workstation
20:05:52.0907 8148  ComputerName: ***-PC
20:05:52.0907 8148  UserName: ***
20:05:52.0907 8148  Windows directory: C:\Windows
20:05:52.0907 8148  System windows directory: C:\Windows
20:05:52.0907 8148  Running under WOW64
20:05:52.0907 8148  Processor architecture: Intel x64
20:05:52.0907 8148  Number of processors: 4
20:05:52.0907 8148  Page size: 0x1000
20:05:52.0907 8148  Boot type: Normal boot
20:05:52.0907 8148  ============================================================
20:05:53.0282 8148  Drive \Device\Harddisk0\DR0 - Size: 0x950B056000 (596.17 Gb), SectorSize: 0x200, Cylinders: 0x13001, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040
20:05:53.0282 8148  ============================================================
20:05:53.0282 8148  \Device\Harddisk0\DR0:
20:05:53.0282 8148  MBR partitions:
20:05:53.0282 8148  \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000
20:05:53.0282 8148  \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x4447D800
20:05:53.0282 8148  \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x444B0000, BlocksNum 0x61A8000
20:05:53.0282 8148  ============================================================
20:05:53.0313 8148  C: <-> \Device\Harddisk0\DR0\Partition2
20:05:53.0360 8148  D: <-> \Device\Harddisk0\DR0\Partition3
20:05:53.0360 8148  ============================================================
20:05:53.0360 8148  Initialize success
20:05:53.0360 8148  ============================================================
20:06:07.0837 7612  ============================================================
20:06:07.0837 7612  Scan started
20:06:07.0837 7612  Mode: Manual; SigCheck; TDLFS;
20:06:07.0837 7612  ============================================================
20:06:08.0164 7612  ================ Scan system memory ========================
20:06:08.0164 7612  System memory - ok
20:06:08.0164 7612  ================ Scan services =============================
20:06:08.0305 7612  [ 969C91060CBB5D17CB8440B5F78B4C51 ] 1394ohci        C:\Windows\system32\DRIVERS\1394ohci.sys
20:06:08.0414 7612  1394ohci - ok
20:06:08.0461 7612  [ 6F11E88748CDEFD2F76AA215F97DDFE5 ] ACPI            C:\Windows\system32\DRIVERS\ACPI.sys
20:06:08.0492 7612  ACPI - ok
20:06:08.0539 7612  [ 63B05A0420CE4BF0E4AF6DCC7CADA254 ] AcpiPmi        C:\Windows\system32\DRIVERS\acpipmi.sys
20:06:08.0585 7612  AcpiPmi - ok
20:06:08.0726 7612  [ EA856F4A46320389D1899B2CAA7BF40F ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe
20:06:08.0757 7612  AdobeFlashPlayerUpdateSvc - ok
20:06:08.0819 7612  [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx        C:\Windows\system32\DRIVERS\adp94xx.sys
20:06:08.0851 7612  adp94xx - ok
20:06:08.0897 7612  [ 597F78224EE9224EA1A13D6350CED962 ] adpahci        C:\Windows\system32\DRIVERS\adpahci.sys
20:06:08.0929 7612  adpahci - ok
20:06:08.0944 7612  [ E109549C90F62FB570B9540C4B148E54 ] adpu320        C:\Windows\system32\DRIVERS\adpu320.sys
20:06:08.0960 7612  adpu320 - ok
20:06:08.0991 7612  [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc    C:\Windows\System32\aelupsvc.dll
20:06:09.0053 7612  AeLookupSvc - ok
20:06:09.0100 7612  [ DB9D6C6B2CD95A9CA414D045B627422E ] AFD            C:\Windows\system32\drivers\afd.sys
20:06:09.0131 7612  AFD - ok
20:06:09.0178 7612  [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440          C:\Windows\system32\DRIVERS\agp440.sys
20:06:09.0194 7612  agp440 - ok
20:06:09.0209 7612  [ 3290D6946B5E30E70414990574883DDB ] ALG            C:\Windows\System32\alg.exe
20:06:09.0256 7612  ALG - ok
20:06:09.0303 7612  [ 5812713A477A3AD7363C7438CA2EE038 ] aliide          C:\Windows\system32\DRIVERS\aliide.sys
20:06:09.0334 7612  aliide - ok
20:06:09.0365 7612  [ 1FF8B4431C353CE385C875F194924C0C ] amdide          C:\Windows\system32\DRIVERS\amdide.sys
20:06:09.0381 7612  amdide - ok
20:06:09.0412 7612  [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8          C:\Windows\system32\DRIVERS\amdk8.sys
20:06:09.0475 7612  AmdK8 - ok
20:06:09.0506 7612  [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM          C:\Windows\system32\DRIVERS\amdppm.sys
20:06:09.0553 7612  AmdPPM - ok
20:06:09.0584 7612  [ EC7EBAB00A4D8448BAB68D1E49B4BEB9 ] amdsata        C:\Windows\system32\drivers\amdsata.sys
20:06:09.0615 7612  amdsata - ok
20:06:09.0662 7612  [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs          C:\Windows\system32\DRIVERS\amdsbs.sys
20:06:09.0693 7612  amdsbs - ok
20:06:09.0693 7612  [ DB27766102C7BF7E95140A2AA81D042E ] amdxata        C:\Windows\system32\drivers\amdxata.sys
20:06:09.0709 7612  amdxata - ok
20:06:09.0833 7612  [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe
20:06:09.0865 7612  AntiVirSchedulerService - ok
20:06:09.0911 7612  [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService  C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe
20:06:09.0927 7612  AntiVirService - ok
20:06:09.0958 7612  [ 42FD751B27FA0E9C69BB39F39E409594 ] AppID          C:\Windows\system32\drivers\appid.sys
20:06:10.0021 7612  AppID - ok
20:06:10.0052 7612  [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc        C:\Windows\System32\appidsvc.dll
20:06:10.0114 7612  AppIDSvc - ok
20:06:10.0161 7612  [ D065BE66822847B7F127D1F90158376E ] Appinfo        C:\Windows\System32\appinfo.dll
20:06:10.0208 7612  Appinfo - ok
20:06:10.0333 7612  [ A5299D04ED225D64CF07A568A3E1BF8C ] Apple Mobile Device C:\Program Files (x86)\Common Files\Apple\Mobile Device Support\AppleMobileDeviceService.exe
20:06:10.0348 7612  Apple Mobile Device - ok
20:06:10.0379 7612  [ C484F8CEB1717C540242531DB7845C4E ] arc            C:\Windows\system32\DRIVERS\arc.sys
20:06:10.0395 7612  arc - ok
20:06:10.0426 7612  [ 019AF6924AEFE7839F61C830227FE79C ] arcsas          C:\Windows\system32\DRIVERS\arcsas.sys
20:06:10.0442 7612  arcsas - ok
20:06:10.0473 7612  [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac        C:\Windows\system32\DRIVERS\asyncmac.sys
20:06:10.0567 7612  AsyncMac - ok
20:06:10.0598 7612  [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi          C:\Windows\system32\DRIVERS\atapi.sys
20:06:10.0629 7612  atapi - ok
20:06:10.0676 7612  [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll
20:06:10.0754 7612  AudioEndpointBuilder - ok
20:06:10.0769 7612  [ 07721A77180EDD4D39CCB865BF63C7FD ] AudioSrv        C:\Windows\System32\Audiosrv.dll
20:06:10.0801 7612  AudioSrv - ok
20:06:10.0863 7612  [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt        C:\Windows\system32\DRIVERS\avgntflt.sys
20:06:10.0894 7612  avgntflt - ok
20:06:10.0941 7612  [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb          C:\Windows\system32\DRIVERS\avipbb.sys
20:06:10.0972 7612  avipbb - ok
20:06:11.0003 7612  [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr          C:\Windows\system32\DRIVERS\avkmgr.sys
20:06:11.0019 7612  avkmgr - ok
20:06:11.0081 7612  [ 8DFA2EC772F97ED02B384DB88641B367 ] AVM IGD CTRL Service C:\Program Files (x86)\FRITZ!DSL\IGDCTRL.EXE
20:06:11.0128 7612  AVM IGD CTRL Service ( UnsignedFile.Multi.Generic ) - warning
20:06:11.0128 7612  AVM IGD CTRL Service - detected UnsignedFile.Multi.Generic (1)
20:06:11.0175 7612  [ B20B5FA5CA050E9926E4D1DB81501B32 ] AxInstSV        C:\Windows\System32\AxInstSV.dll
20:06:11.0237 7612  AxInstSV - ok
20:06:11.0284 7612  [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv        C:\Windows\system32\DRIVERS\bxvbda.sys
20:06:11.0347 7612  b06bdrv - ok
20:06:11.0393 7612  [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a        C:\Windows\system32\DRIVERS\b57nd60a.sys
20:06:11.0440 7612  b57nd60a - ok
20:06:11.0487 7612  [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC          C:\Windows\System32\bdesvc.dll
20:06:11.0534 7612  BDESVC - ok
20:06:11.0565 7612  [ 16A47CE2DECC9B099349A5F840654746 ] Beep            C:\Windows\system32\drivers\Beep.sys
20:06:11.0659 7612  Beep - ok
20:06:11.0721 7612  [ 4992C609A6315671463E30F6512BC022 ] BFE            C:\Windows\System32\bfe.dll
20:06:11.0799 7612  BFE - ok
20:06:11.0861 7612  [ 7F0C323FE3DA28AA4AA1BDA3F575707F ] BITS            C:\Windows\System32\qmgr.dll
20:06:11.0971 7612  BITS - ok
20:06:12.0002 7612  [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive        C:\Windows\system32\DRIVERS\blbdrive.sys
20:06:12.0049 7612  blbdrive - ok
20:06:12.0127 7612  [ EBBCD5DFBB1DE70E8F4AF8FA59E401FD ] Bonjour Service C:\Program Files\Bonjour\mDNSResponder.exe
20:06:12.0158 7612  Bonjour Service - ok
20:06:12.0189 7612  [ 19D20159708E152267E53B66677A4995 ] bowser          C:\Windows\system32\DRIVERS\bowser.sys
20:06:12.0236 7612  bowser - ok
20:06:12.0283 7612  [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo        C:\Windows\system32\DRIVERS\BrFiltLo.sys
20:06:12.0361 7612  BrFiltLo - ok
20:06:12.0392 7612  [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp        C:\Windows\system32\DRIVERS\BrFiltUp.sys
20:06:12.0423 7612  BrFiltUp - ok
20:06:12.0470 7612  [ 6B054C67AAA87843504E8E3C09102009 ] Browser        C:\Windows\System32\browser.dll
20:06:12.0501 7612  Browser - ok
20:06:12.0532 7612  [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid        C:\Windows\System32\Drivers\Brserid.sys
20:06:12.0579 7612  Brserid - ok
20:06:12.0610 7612  [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm        C:\Windows\System32\Drivers\BrSerWdm.sys
20:06:12.0657 7612  BrSerWdm - ok
20:06:12.0688 7612  [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm        C:\Windows\System32\Drivers\BrUsbMdm.sys
20:06:12.0751 7612  BrUsbMdm - ok
20:06:12.0782 7612  [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer        C:\Windows\System32\Drivers\BrUsbSer.sys
20:06:12.0829 7612  BrUsbSer - ok
20:06:12.0860 7612  [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM        C:\Windows\system32\DRIVERS\bthmodem.sys
20:06:12.0907 7612  BTHMODEM - ok
20:06:12.0953 7612  [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv        C:\Windows\system32\bthserv.dll
20:06:13.0031 7612  bthserv - ok
20:06:13.0063 7612  [ B8BD2BB284668C84865658C77574381A ] cdfs            C:\Windows\system32\DRIVERS\cdfs.sys
20:06:13.0156 7612  cdfs - ok
20:06:13.0203 7612  [ 83D2D75E1EFB81B3450C18131443F7DB ] cdrom          C:\Windows\system32\DRIVERS\cdrom.sys
20:06:13.0250 7612  cdrom - ok
20:06:13.0281 7612  [ 312E2F82AF11E79906898AC3E3D58A1F ] CertPropSvc    C:\Windows\System32\certprop.dll
20:06:13.0343 7612  CertPropSvc - ok
20:06:13.0375 7612  [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass        C:\Windows\system32\DRIVERS\circlass.sys
20:06:13.0437 7612  circlass - ok
20:06:13.0468 7612  [ FE1EC06F2253F691FE36217C592A0206 ] CLFS            C:\Windows\system32\CLFS.sys
20:06:13.0499 7612  CLFS - ok
20:06:13.0562 7612  [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:06:13.0593 7612  clr_optimization_v2.0.50727_32 - ok
20:06:13.0640 7612  [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe
20:06:13.0655 7612  clr_optimization_v2.0.50727_64 - ok
20:06:13.0718 7612  [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:06:13.0733 7612  clr_optimization_v4.0.30319_32 - ok
20:06:13.0765 7612  [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe
20:06:13.0780 7612  clr_optimization_v4.0.30319_64 - ok
20:06:13.0811 7612  [ 50F92C943F18B070F166D019DFAB3D9A ] clwvd          C:\Windows\system32\DRIVERS\clwvd.sys
20:06:13.0827 7612  clwvd - ok
20:06:13.0843 7612  [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt          C:\Windows\system32\DRIVERS\CmBatt.sys
20:06:13.0874 7612  CmBatt - ok
20:06:13.0921 7612  [ E19D3F095812725D88F9001985B94EDD ] cmdide          C:\Windows\system32\DRIVERS\cmdide.sys
20:06:13.0936 7612  cmdide - ok
20:06:13.0967 7612  [ CA7720B73446FDDEC5C69519C1174C98 ] CNG            C:\Windows\system32\Drivers\cng.sys
20:06:14.0045 7612  CNG - ok
20:06:14.0077 7612  [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt        C:\Windows\system32\DRIVERS\compbatt.sys
20:06:14.0092 7612  Compbatt - ok
20:06:14.0123 7612  [ F26B3A86F6FA87CA360B879581AB4123 ] CompositeBus    C:\Windows\system32\DRIVERS\CompositeBus.sys
20:06:14.0170 7612  CompositeBus - ok
20:06:14.0201 7612  COMSysApp - ok
20:06:14.0217 7612  [ 1C827878A998C18847245FE1F34EE597 ] crcdisk        C:\Windows\system32\DRIVERS\crcdisk.sys
20:06:14.0233 7612  crcdisk - ok
20:06:14.0264 7612  [ BAF19B633933A9FB4883D27D66C39E9A ] CryptSvc        C:\Windows\system32\cryptsvc.dll
20:06:14.0326 7612  CryptSvc - ok
20:06:14.0389 7612  [ BA8E5B2291C01EF71CA80E25F0C79D55 ] ctxusbm        C:\Windows\system32\DRIVERS\ctxusbm.sys
20:06:14.0404 7612  ctxusbm - ok
20:06:14.0435 7612  [ 7266972E86890E2B30C0C322E906B027 ] DcomLaunch      C:\Windows\system32\rpcss.dll
20:06:14.0498 7612  DcomLaunch - ok
20:06:14.0545 7612  [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc      C:\Windows\System32\defragsvc.dll
20:06:14.0654 7612  defragsvc - ok
20:06:14.0716 7612  [ 1523251B9D8A5D84DE0CD23418847824 ] de_serv        C:\Program Files (x86)\Common Files\AVM\de_serv.exe
20:06:14.0763 7612  de_serv ( UnsignedFile.Multi.Generic ) - warning
20:06:14.0763 7612  de_serv - detected UnsignedFile.Multi.Generic (1)
20:06:14.0810 7612  [ 9C253CE7311CA60FC11C774692A13208 ] DfsC            C:\Windows\system32\Drivers\dfsc.sys
20:06:14.0841 7612  DfsC - ok
20:06:14.0903 7612  [ CE3B9562D997F69B330D181A8875960F ] Dhcp            C:\Windows\system32\dhcpcore.dll
20:06:14.0950 7612  Dhcp - ok
20:06:14.0981 7612  [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache        C:\Windows\system32\drivers\discache.sys
20:06:15.0044 7612  discache - ok
20:06:15.0075 7612  [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk            C:\Windows\system32\DRIVERS\disk.sys
20:06:15.0091 7612  Disk - ok
20:06:15.0122 7612  [ 85CF424C74A1D5EC33533E1DBFF9920A ] Dnscache        C:\Windows\System32\dnsrslvr.dll
20:06:15.0153 7612  Dnscache - ok
20:06:15.0184 7612  [ 14452ACDB09B70964C8C21BF80A13ACB ] dot3svc        C:\Windows\System32\dot3svc.dll
20:06:15.0278 7612  dot3svc - ok
20:06:15.0325 7612  [ B42ED0320C6E41102FDE0005154849BB ] Dot4            C:\Windows\system32\DRIVERS\Dot4.sys
20:06:15.0356 7612  Dot4 - ok
20:06:15.0403 7612  [ 85135AD27E79B689335C08167D917CDE ] Dot4Print      C:\Windows\system32\DRIVERS\Dot4Prt.sys
20:06:15.0434 7612  Dot4Print - ok
20:06:15.0481 7612  [ FD05A02B0370BC3000F402E543CA5814 ] dot4usb        C:\Windows\system32\DRIVERS\dot4usb.sys
20:06:15.0527 7612  dot4usb - ok
20:06:15.0559 7612  [ 8C2BA6BEA949EE6E68385F5692BAFB94 ] DPS            C:\Windows\system32\dps.dll
20:06:15.0637 7612  DPS - ok
20:06:15.0683 7612  [ 9B19F34400D24DF84C858A421C205754 ] drmkaud        C:\Windows\system32\drivers\drmkaud.sys
20:06:15.0730 7612  drmkaud - ok
20:06:15.0793 7612  [ 1633B9ABF52784A1331476397A48CBEF ] DXGKrnl        C:\Windows\System32\drivers\dxgkrnl.sys
20:06:15.0824 7612  DXGKrnl - ok
20:06:15.0855 7612  [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost        C:\Windows\System32\eapsvc.dll
20:06:15.0964 7612  EapHost - ok
20:06:16.0058 7612  [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv          C:\Windows\system32\DRIVERS\evbda.sys
20:06:16.0151 7612  ebdrv - ok
20:06:16.0183 7612  [ 156F6159457D0AA7E59B62681B56EB90 ] EFS            C:\Windows\System32\lsass.exe
20:06:16.0229 7612  EFS - ok
20:06:16.0292 7612  [ 47C071994C3F649F23D9CD075AC9304A ] ehRecvr        C:\Windows\ehome\ehRecvr.exe
20:06:16.0339 7612  ehRecvr - ok
20:06:16.0370 7612  [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched        C:\Windows\ehome\ehsched.exe
20:06:16.0432 7612  ehSched - ok
20:06:16.0479 7612  [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor        C:\Windows\system32\DRIVERS\elxstor.sys
20:06:16.0510 7612  elxstor - ok
20:06:16.0541 7612  [ 34A3C54752046E79A126E15C51DB409B ] ErrDev          C:\Windows\system32\DRIVERS\errdev.sys
20:06:16.0588 7612  ErrDev - ok
20:06:16.0651 7612  [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem    C:\Windows\system32\es.dll
20:06:16.0713 7612  EventSystem - ok
20:06:16.0760 7612  [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat          C:\Windows\system32\drivers\exfat.sys
20:06:16.0822 7612  exfat - ok
20:06:16.0853 7612  [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat        C:\Windows\system32\drivers\fastfat.sys
20:06:16.0931 7612  fastfat - ok
20:06:16.0963 7612  [ D607B2F1BEE3992AA6C2C92C0A2F0855 ] Fax            C:\Windows\system32\fxssvc.exe
20:06:17.0025 7612  Fax - ok
20:06:17.0072 7612  [ D765D19CD8EF61F650C384F62FAC00AB ] fdc            C:\Windows\system32\DRIVERS\fdc.sys
20:06:17.0119 7612  fdc - ok
20:06:17.0150 7612  [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost        C:\Windows\system32\fdPHost.dll
20:06:17.0243 7612  fdPHost - ok
20:06:17.0259 7612  [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub        C:\Windows\system32\fdrespub.dll
20:06:17.0306 7612  FDResPub - ok
20:06:17.0353 7612  [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo        C:\Windows\system32\drivers\fileinfo.sys
20:06:17.0368 7612  FileInfo - ok
20:06:17.0384 7612  [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace      C:\Windows\system32\drivers\filetrace.sys
20:06:17.0431 7612  Filetrace - ok
20:06:17.0462 7612  [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk        C:\Windows\system32\DRIVERS\flpydisk.sys
20:06:17.0509 7612  flpydisk - ok
20:06:17.0540 7612  [ F7866AF72ABBAF84B1FA5AA195378C59 ] FltMgr          C:\Windows\system32\drivers\fltmgr.sys
20:06:17.0540 7612  FltMgr - ok
20:06:17.0587 7612  [ CB5E4B9C319E3C6BB363EB7E58A4A051 ] FontCache      C:\Windows\system32\FntCache.dll
20:06:17.0649 7612  FontCache - ok
20:06:17.0727 7612  [ 8D89E3131C27FDD6932189CB785E1B7A ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe
20:06:17.0743 7612  FontCache3.0.0.0 - ok
20:06:17.0774 7612  [ D43703496149971890703B4B1B723EAC ] FsDepends      C:\Windows\system32\drivers\FsDepends.sys
20:06:17.0789 7612  FsDepends - ok
20:06:17.0805 7612  [ D3E3F93D67821A2DB2B3D9FAC2DC2064 ] Fs_Rec          C:\Windows\system32\drivers\Fs_Rec.sys
20:06:17.0821 7612  Fs_Rec - ok
20:06:17.0852 7612  [ AE87BA80D0EC3B57126ED2CDC15B24ED ] fvevol          C:\Windows\system32\DRIVERS\fvevol.sys
20:06:17.0867 7612  fvevol - ok
20:06:17.0899 7612  [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx        C:\Windows\system32\DRIVERS\gagp30kx.sys
20:06:17.0930 7612  gagp30kx - ok
20:06:17.0961 7612  [ 8E98D21EE06192492A5671A6144D092F ] GEARAspiWDM    C:\Windows\system32\DRIVERS\GEARAspiWDM.sys
20:06:17.0977 7612  GEARAspiWDM - ok
20:06:18.0023 7612  [ FE5AB4525BC2EC68B9119A6E5D40128B ] gpsvc          C:\Windows\System32\gpsvc.dll
20:06:18.0117 7612  gpsvc - ok
20:06:18.0195 7612  [ F02A533F517EB38333CB12A9E8963773 ] gupdate        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
20:06:18.0211 7612  gupdate - ok
20:06:18.0226 7612  [ F02A533F517EB38333CB12A9E8963773 ] gupdatem        C:\Program Files (x86)\Google\Update\GoogleUpdate.exe
20:06:18.0242 7612  gupdatem - ok
20:06:18.0273 7612  [ 5D4BC124FAAE6730AC002CDB67BF1A1C ] gusvc          C:\Program Files (x86)\Google\Common\Google Updater\GoogleUpdaterService.exe
20:06:18.0289 7612  gusvc - ok
20:06:18.0304 7612  [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir        C:\Windows\system32\drivers\hcw85cir.sys
20:06:18.0351 7612  hcw85cir - ok
20:06:18.0382 7612  [ 6410F6F415B2A5A9037224C41DA8BF12 ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys
20:06:18.0445 7612  HdAudAddService - ok
20:06:18.0476 7612  [ 0A49913402747A0B67DE940FB42CBDBB ] HDAudBus        C:\Windows\system32\DRIVERS\HDAudBus.sys
20:06:18.0491 7612  HDAudBus - ok
20:06:18.0523 7612  [ B6AC71AAA2B10848F57FC49D55A651AF ] HECIx64        C:\Windows\system32\DRIVERS\HECIx64.sys
20:06:18.0538 7612  HECIx64 - ok
20:06:18.0554 7612  [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt        C:\Windows\system32\DRIVERS\HidBatt.sys
20:06:18.0585 7612  HidBatt - ok
20:06:18.0601 7612  [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth          C:\Windows\system32\DRIVERS\hidbth.sys
20:06:18.0663 7612  HidBth - ok
20:06:18.0710 7612  [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr          C:\Windows\system32\DRIVERS\hidir.sys
20:06:18.0757 7612  HidIr - ok
20:06:18.0772 7612  [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv        C:\Windows\system32\hidserv.dll
20:06:18.0866 7612  hidserv - ok
20:06:18.0913 7612  [ B3BF6B5B50006DEF50B66306D99FCF6F ] HidUsb          C:\Windows\system32\DRIVERS\hidusb.sys
20:06:18.0959 7612  HidUsb - ok
20:06:18.0991 7612  [ EFA58EDE58DD74388FFD04CB32681518 ] hkmsvc          C:\Windows\system32\kmsvc.dll
20:06:19.0053 7612  hkmsvc - ok
20:06:19.0084 7612  [ 046B2673767CA626E2CFB7FDF735E9E8 ] HomeGroupListener C:\Windows\system32\ListSvc.dll
20:06:19.0100 7612  HomeGroupListener - ok
20:06:19.0131 7612  [ 06A7422224D9865A5613710A089987DF ] HomeGroupProvider C:\Windows\system32\provsvc.dll
20:06:19.0162 7612  HomeGroupProvider - ok
20:06:19.0287 7612  [ 0A3C6AA4A9FC38C20BA4EAC2C3351C05 ] hpqcxs08        C:\Program Files (x86)\HP\Digital Imaging\bin\hpqcxs08.dll
20:06:19.0318 7612  hpqcxs08 ( UnsignedFile.Multi.Generic ) - warning
20:06:19.0318 7612  hpqcxs08 - detected UnsignedFile.Multi.Generic (1)
20:06:19.0365 7612  [ F3F72A2A86C22610BCA5439FA789DD52 ] hpqddsvc        C:\Program Files (x86)\HP\Digital Imaging\bin\hpqddsvc.dll
20:06:19.0396 7612  hpqddsvc ( UnsignedFile.Multi.Generic ) - warning
20:06:19.0396 7612  hpqddsvc - detected UnsignedFile.Multi.Generic (1)
20:06:19.0427 7612  [ 0886D440058F203EBA0E1825E4355914 ] HpSAMD          C:\Windows\system32\DRIVERS\HpSAMD.sys
20:06:19.0443 7612  HpSAMD - ok
20:06:19.0521 7612  [ D972F48D0CE396759B788693CD665926 ] HPSLPSVC        C:\Program Files (x86)\HP\Digital Imaging\bin\HPSLPSVC64.DLL
20:06:19.0583 7612  HPSLPSVC ( UnsignedFile.Multi.Generic ) - warning
20:06:19.0583 7612  HPSLPSVC - detected UnsignedFile.Multi.Generic (1)
20:06:19.0630 7612  [ CEE049CAC4EFA7F4E1E4AD014414A5D4 ] HTTP            C:\Windows\system32\drivers\HTTP.sys
20:06:19.0724 7612  HTTP - ok
20:06:19.0739 7612  [ F17766A19145F111856378DF337A5D79 ] hwpolicy        C:\Windows\system32\drivers\hwpolicy.sys
20:06:19.0755 7612  hwpolicy - ok
20:06:19.0786 7612  [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt        C:\Windows\system32\DRIVERS\i8042prt.sys
20:06:19.0802 7612  i8042prt - ok
20:06:19.0849 7612  [ ABBF174CB394F5C437410A788B7E404A ] iaStor          C:\Windows\system32\DRIVERS\iaStor.sys
20:06:19.0864 7612  iaStor - ok
20:06:19.0942 7612  [ 31A0E93CDF29007D6C6FFFB632F375ED ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe
20:06:19.0958 7612  IAStorDataMgrSvc - ok
20:06:19.0989 7612  [ B75E45C564E944A2657167D197AB29DA ] iaStorV        C:\Windows\system32\drivers\iaStorV.sys
20:06:20.0005 7612  iaStorV - ok
20:06:20.0067 7612  [ 6F95324909B502E2651442C1548AB12F ] IDriverT        C:\Program Files (x86)\Common Files\InstallShield\Driver\1050\Intel 32\IDriverT.exe
20:06:20.0098 7612  IDriverT ( UnsignedFile.Multi.Generic ) - warning
20:06:20.0098 7612  IDriverT - detected UnsignedFile.Multi.Generic (1)
20:06:20.0176 7612  [ 2F2BE70D3E02B6FA877921AB9516D43C ] idsvc          C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe
20:06:20.0207 7612  idsvc - ok
20:06:20.0426 7612  [ 677AA5991026A65ADA128C4B59CF2BAD ] igfx            C:\Windows\system32\DRIVERS\igdkmd64.sys
20:06:20.0691 7612  igfx - ok
20:06:20.0738 7612  [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp          C:\Windows\system32\DRIVERS\iirsp.sys
20:06:20.0753 7612  iirsp - ok
20:06:20.0800 7612  [ C5B4683680DF085B57BC53E5EF34861F ] IKEEXT          C:\Windows\System32\ikeext.dll
20:06:20.0894 7612  IKEEXT - ok
20:06:20.0941 7612  [ DD587A55390ED2295BCE6D36AD567DA9 ] Impcd          C:\Windows\system32\DRIVERS\Impcd.sys
20:06:20.0987 7612  Impcd - ok
20:06:21.0081 7612  [ 98220284537E9C96561406F99BE48086 ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys
20:06:21.0143 7612  IntcAzAudAddService - ok
20:06:21.0190 7612  [ 03C74719D48056A1078F3A51CEB76BAA ] IntcDAud        C:\Windows\system32\DRIVERS\IntcDAud.sys
20:06:21.0190 7612  IntcDAud - ok
20:06:21.0221 7612  [ F00F20E70C6EC3AA366910083A0518AA ] intelide        C:\Windows\system32\DRIVERS\intelide.sys
20:06:21.0221 7612  intelide - ok
20:06:21.0253 7612  [ ADA036632C664CAA754079041CF1F8C1 ] intelppm        C:\Windows\system32\DRIVERS\intelppm.sys
20:06:21.0268 7612  intelppm - ok
20:06:21.0299 7612  [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum      C:\Windows\system32\ipbusenum.dll
20:06:21.0362 7612  IPBusEnum - ok
20:06:21.0393 7612  [ 722DD294DF62483CECAAE6E094B4D695 ] IpFilterDriver  C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:06:21.0455 7612  IpFilterDriver - ok
20:06:21.0502 7612  [ F8E058D17363EC580E4B7232778B6CB5 ] iphlpsvc        C:\Windows\System32\iphlpsvc.dll
20:06:21.0596 7612  iphlpsvc - ok
20:06:21.0611 7612  [ E2B4A4494DB7CB9B89B55CA268C337C5 ] IPMIDRV        C:\Windows\system32\DRIVERS\IPMIDrv.sys
20:06:21.0643 7612  IPMIDRV - ok
20:06:21.0658 7612  [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT          C:\Windows\system32\drivers\ipnat.sys
20:06:21.0705 7612  IPNAT - ok
20:06:21.0752 7612  [ 0F261EC4F514926177C70C1832374231 ] iPod Service    C:\Program Files\iPod\bin\iPodService.exe
20:06:21.0783 7612  iPod Service - ok
20:06:21.0830 7612  [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM          C:\Windows\system32\drivers\irenum.sys
20:06:21.0877 7612  IRENUM - ok
20:06:21.0908 7612  [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp          C:\Windows\system32\DRIVERS\isapnp.sys
20:06:21.0923 7612  isapnp - ok
20:06:21.0939 7612  [ FA4D2557DE56D45B0A346F93564BE6E1 ] iScsiPrt        C:\Windows\system32\DRIVERS\msiscsi.sys
20:06:21.0955 7612  iScsiPrt - ok
20:06:21.0986 7612  [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass        C:\Windows\system32\DRIVERS\kbdclass.sys
20:06:22.0001 7612  kbdclass - ok
20:06:22.0048 7612  [ 6DEF98F8541E1B5DCEB2C822A11F7323 ] kbdhid          C:\Windows\system32\DRIVERS\kbdhid.sys
20:06:22.0079 7612  kbdhid - ok
20:06:22.0095 7612  [ 156F6159457D0AA7E59B62681B56EB90 ] KeyIso          C:\Windows\system32\lsass.exe
20:06:22.0111 7612  KeyIso - ok
20:06:22.0142 7612  [ 4F4B5FDE429416877DE7143044582EB5 ] KSecDD          C:\Windows\system32\Drivers\ksecdd.sys
20:06:22.0157 7612  KSecDD - ok
20:06:22.0173 7612  [ 6F40465A44ECDC1731BEFAFEC5BDD03C ] KSecPkg        C:\Windows\system32\Drivers\ksecpkg.sys
20:06:22.0189 7612  KSecPkg - ok
20:06:22.0204 7612  [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk        C:\Windows\system32\drivers\ksthunk.sys
20:06:22.0282 7612  ksthunk - ok
20:06:22.0313 7612  [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm          C:\Windows\system32\msdtckrm.dll
20:06:22.0407 7612  KtmRm - ok
20:06:22.0454 7612  [ 48686C29856F46443952A831424F8D6F ] L1C            C:\Windows\system32\DRIVERS\L1C62x64.sys
20:06:22.0454 7612  L1C - ok
20:06:22.0485 7612  [ 81F1D04D4D0E433099365127375FD501 ] LanmanServer    C:\Windows\system32\srvsvc.dll
20:06:22.0547 7612  LanmanServer - ok
20:06:22.0594 7612  [ 27026EAC8818E8A6C00A1CAD2F11D29A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll
20:06:22.0657 7612  LanmanWorkstation - ok
20:06:22.0703 7612  [ 1538831CF8AD2979A04C423779465827 ] lltdio          C:\Windows\system32\DRIVERS\lltdio.sys
20:06:22.0766 7612  lltdio - ok
20:06:22.0813 7612  [ C1185803384AB3FEED115F79F109427F ] lltdsvc        C:\Windows\System32\lltdsvc.dll
20:06:22.0875 7612  lltdsvc - ok
20:06:22.0906 7612  [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts        C:\Windows\System32\lmhsvc.dll
20:06:22.0969 7612  lmhosts - ok
20:06:23.0047 7612  [ 1E2F802846EB944E0333EFEE7C9532A8 ] LMS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe
20:06:23.0062 7612  LMS - ok
20:06:23.0109 7612  [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC          C:\Windows\system32\DRIVERS\lsi_fc.sys
20:06:23.0125 7612  LSI_FC - ok
20:06:23.0156 7612  [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS        C:\Windows\system32\DRIVERS\lsi_sas.sys
20:06:23.0156 7612  LSI_SAS - ok
20:06:23.0187 7612  [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2        C:\Windows\system32\DRIVERS\lsi_sas2.sys
20:06:23.0203 7612  LSI_SAS2 - ok
20:06:23.0249 7612  [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI        C:\Windows\system32\DRIVERS\lsi_scsi.sys
20:06:23.0265 7612  LSI_SCSI - ok
20:06:23.0312 7612  [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv          C:\Windows\system32\drivers\luafv.sys
20:06:23.0390 7612  luafv - ok
20:06:23.0421 7612  [ F84C8F1000BC11E3B7B23CBD3BAFF111 ] Mcx2Svc        C:\Windows\system32\Mcx2Svc.dll
20:06:23.0468 7612  Mcx2Svc - ok
20:06:23.0515 7612  [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas        C:\Windows\system32\DRIVERS\megasas.sys
20:06:23.0530 7612  megasas - ok
20:06:23.0561 7612  [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR          C:\Windows\system32\DRIVERS\MegaSR.sys
20:06:23.0577 7612  MegaSR - ok
20:06:23.0624 7612  Microsoft SharePoint Workspace Audit Service - ok
20:06:23.0671 7612  [ E40E80D0304A73E8D269F7141D77250B ] MMCSS          C:\Windows\system32\mmcss.dll
20:06:23.0733 7612  MMCSS - ok
20:06:23.0749 7612  [ 800BA92F7010378B09F9ED9270F07137 ] Modem          C:\Windows\system32\drivers\modem.sys
20:06:23.0795 7612  Modem - ok
20:06:23.0842 7612  [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor        C:\Windows\system32\DRIVERS\monitor.sys
20:06:23.0905 7612  monitor - ok
20:06:23.0936 7612  [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass        C:\Windows\system32\DRIVERS\mouclass.sys
20:06:23.0951 7612  mouclass - ok
20:06:23.0983 7612  [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid          C:\Windows\system32\DRIVERS\mouhid.sys
20:06:24.0014 7612  mouhid - ok
20:06:24.0029 7612  [ 791AF66C4D0E7C90A3646066386FB571 ] mountmgr        C:\Windows\system32\drivers\mountmgr.sys
20:06:24.0045 7612  mountmgr - ok
20:06:24.0123 7612  [ 8A7C8F4C713E70D73946833D76B77035 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe
20:06:24.0139 7612  MozillaMaintenance - ok
20:06:24.0170 7612  [ 609D1D87649ECC19796F4D76D4C15CEA ] mpio            C:\Windows\system32\DRIVERS\mpio.sys
20:06:24.0185 7612  mpio - ok
20:06:24.0201 7612  [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv          C:\Windows\system32\drivers\mpsdrv.sys
20:06:24.0263 7612  mpsdrv - ok
20:06:24.0295 7612  [ AECAB449567D1846DAD63ECE49E893E3 ] MpsSvc          C:\Windows\system32\mpssvc.dll
20:06:24.0373 7612  MpsSvc - ok
20:06:24.0388 7612  [ 30524261BB51D96D6FCBAC20C810183C ] MRxDAV          C:\Windows\system32\drivers\mrxdav.sys
20:06:24.0451 7612  MRxDAV - ok
20:06:24.0482 7612  [ 040D62A9D8AD28922632137ACDD984F2 ] mrxsmb          C:\Windows\system32\DRIVERS\mrxsmb.sys
20:06:24.0529 7612  mrxsmb - ok
20:06:24.0575 7612  [ F0067552F8F9B33D7C59403AB808A3CB ] mrxsmb10        C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:06:24.0622 7612  mrxsmb10 - ok
20:06:24.0653 7612  [ 3C142D31DE9F2F193218A53FE2632051 ] mrxsmb20        C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:06:24.0700 7612  mrxsmb20 - ok
20:06:24.0731 7612  [ 5C37497276E3B3A5488B23A326A754B7 ] msahci          C:\Windows\system32\DRIVERS\msahci.sys
20:06:24.0763 7612  msahci - ok
20:06:24.0794 7612  [ 8D27B597229AED79430FB9DB3BCBFBD0 ] msdsm          C:\Windows\system32\DRIVERS\msdsm.sys
20:06:24.0809 7612  msdsm - ok
20:06:24.0825 7612  [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC          C:\Windows\System32\msdtc.exe
20:06:24.0856 7612  MSDTC - ok
20:06:24.0903 7612  [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs            C:\Windows\system32\drivers\Msfs.sys
20:06:24.0965 7612  Msfs - ok
20:06:24.0997 7612  [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf      C:\Windows\System32\drivers\mshidkmdf.sys
20:06:25.0075 7612  mshidkmdf - ok
20:06:25.0106 7612  [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv        C:\Windows\system32\DRIVERS\msisadrv.sys
20:06:25.0106 7612  msisadrv - ok
20:06:25.0137 7612  [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI        C:\Windows\system32\iscsiexe.dll
20:06:25.0231 7612  MSiSCSI - ok
20:06:25.0231 7612  msiserver - ok
20:06:25.0277 7612  [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV        C:\Windows\system32\drivers\MSKSSRV.sys
20:06:25.0355 7612  MSKSSRV - ok
20:06:25.0371 7612  [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK        C:\Windows\system32\drivers\MSPCLOCK.sys
20:06:25.0418 7612  MSPCLOCK - ok
20:06:25.0433 7612  [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM          C:\Windows\system32\drivers\MSPQM.sys
20:06:25.0480 7612  MSPQM - ok
20:06:25.0511 7612  [ 89CB141AA8616D8C6A4610FA26C60964 ] MsRPC          C:\Windows\system32\drivers\MsRPC.sys
20:06:25.0558 7612  MsRPC - ok
20:06:25.0589 7612  [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios        C:\Windows\system32\DRIVERS\mssmbios.sys
20:06:25.0589 7612  mssmbios - ok
20:06:25.0621 7612  [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE          C:\Windows\system32\drivers\MSTEE.sys
20:06:25.0683 7612  MSTEE - ok
20:06:25.0714 7612  [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig        C:\Windows\system32\DRIVERS\MTConfig.sys
20:06:25.0761 7612  MTConfig - ok
20:06:25.0792 7612  [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup            C:\Windows\system32\Drivers\mup.sys
20:06:25.0808 7612  Mup - ok
20:06:25.0839 7612  [ 4987E079A4530FA737A128BE54B63B12 ] napagent        C:\Windows\system32\qagentRT.dll
20:06:25.0917 7612  napagent - ok
20:06:25.0964 7612  [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP    C:\Windows\system32\DRIVERS\nwifi.sys
20:06:26.0011 7612  NativeWifiP - ok
20:06:26.0057 7612  [ CAD515DBD07D082BB317D9928CE8962C ] NDIS            C:\Windows\system32\drivers\ndis.sys
20:06:26.0089 7612  NDIS - ok
20:06:26.0104 7612  [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap        C:\Windows\system32\DRIVERS\ndiscap.sys
20:06:26.0182 7612  NdisCap - ok
20:06:26.0229 7612  [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi        C:\Windows\system32\DRIVERS\ndistapi.sys
20:06:26.0307 7612  NdisTapi - ok
20:06:26.0338 7612  [ F105BA1E22BF1F2EE8F005D4305E4BEC ] Ndisuio        C:\Windows\system32\DRIVERS\ndisuio.sys
20:06:26.0401 7612  Ndisuio - ok
20:06:26.0432 7612  [ 557DFAB9CA1FCB036AC77564C010DAD3 ] NdisWan        C:\Windows\system32\DRIVERS\ndiswan.sys
20:06:26.0463 7612  NdisWan - ok
20:06:26.0479 7612  [ 659B74FB74B86228D6338D643CD3E3CF ] NDProxy        C:\Windows\system32\drivers\NDProxy.sys
20:06:26.0541 7612  NDProxy - ok
20:06:26.0588 7612  [ D5AC41AE382738483FAFFBD7E373D49A ] Net Driver HPZ12 C:\Windows\system32\HPZinw12.dll
20:06:26.0619 7612  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
20:06:26.0619 7612  Net Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
20:06:26.0650 7612  [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS        C:\Windows\system32\DRIVERS\netbios.sys
20:06:26.0713 7612  NetBIOS - ok
20:06:26.0744 7612  [ 9162B273A44AB9DCE5B44362731D062A ] NetBT          C:\Windows\system32\DRIVERS\netbt.sys
20:06:26.0791 7612  NetBT - ok
20:06:26.0822 7612  [ 156F6159457D0AA7E59B62681B56EB90 ] Netlogon        C:\Windows\system32\lsass.exe
20:06:26.0837 7612  Netlogon - ok
20:06:26.0869 7612  [ 847D3AE376C0817161A14A82C8922A9E ] Netman          C:\Windows\System32\netman.dll
20:06:26.0931 7612  Netman - ok
20:06:26.0962 7612  [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm        C:\Windows\System32\netprofm.dll
20:06:27.0040 7612  netprofm - ok
20:06:27.0071 7612  [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:06:27.0103 7612  NetTcpPortSharing - ok
20:06:27.0134 7612  [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960        C:\Windows\system32\DRIVERS\nfrd960.sys
20:06:27.0149 7612  nfrd960 - ok
20:06:27.0165 7612  [ D9A0CE66046D6EFA0C61BAA885CBA0A8 ] NlaSvc          C:\Windows\System32\nlasvc.dll
20:06:27.0243 7612  NlaSvc - ok
20:06:27.0290 7612  [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs            C:\Windows\system32\drivers\Npfs.sys
20:06:27.0337 7612  Npfs - ok
20:06:27.0383 7612  [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi            C:\Windows\system32\nsisvc.dll
20:06:27.0461 7612  nsi - ok
20:06:27.0461 7612  [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy        C:\Windows\system32\drivers\nsiproxy.sys
20:06:27.0524 7612  nsiproxy - ok
20:06:27.0602 7612  [ 184C189D4FC416978550FC599BB4EDDA ] Ntfs            C:\Windows\system32\drivers\Ntfs.sys
20:06:27.0664 7612  Ntfs - ok
20:06:27.0695 7612  [ 9899284589F75FA8724FF3D16AED75C1 ] Null            C:\Windows\system32\drivers\Null.sys
20:06:27.0742 7612  Null - ok
20:06:27.0789 7612  [ 786DB821BFD57C0551DBBE4F75384A7D ] nusb3hub        C:\Windows\system32\DRIVERS\nusb3hub.sys
20:06:27.0836 7612  nusb3hub - ok
20:06:27.0883 7612  [ DAA8005CAF745042BB427A1ED7433354 ] nusb3xhc        C:\Windows\system32\DRIVERS\nusb3xhc.sys
20:06:27.0898 7612  nusb3xhc - ok
20:06:28.0148 7612  [ 589FEBA7A8E3EB0C3DF254ABABA3A257 ] nvlddmkm        C:\Windows\system32\DRIVERS\nvlddmkm.sys
20:06:28.0335 7612  nvlddmkm - ok
20:06:28.0382 7612  [ 273B73BF8F214154B6C499C9842CA3A2 ] nvpciflt        C:\Windows\system32\DRIVERS\nvpciflt.sys
20:06:28.0382 7612  nvpciflt - ok
20:06:28.0413 7612  [ A4D9C9A608A97F59307C2F2600EDC6A4 ] nvraid          C:\Windows\system32\drivers\nvraid.sys
20:06:28.0429 7612  nvraid - ok
20:06:28.0460 7612  [ 6C1D5F70E7A6A3FD1C90D840EDC048B9 ] nvstor          C:\Windows\system32\drivers\nvstor.sys
20:06:28.0475 7612  nvstor - ok
20:06:28.0507 7612  [ 03055FDFD0F9F17E95E27F6193CE4EB9 ] nvsvc          C:\Windows\system32\nvvsvc.exe
20:06:28.0522 7612  nvsvc - ok
20:06:28.0616 7612  [ 9C42974EF3DAB4D3B38E5F26F311645A ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Updatus\daemonu.exe
20:06:28.0663 7612  nvUpdatusService - ok
20:06:28.0709 7612  [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp          C:\Windows\system32\DRIVERS\nv_agp.sys
20:06:28.0741 7612  nv_agp - ok
20:06:28.0756 7612  [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394        C:\Windows\system32\DRIVERS\ohci1394.sys
20:06:28.0787 7612  ohci1394 - ok
20:06:28.0850 7612  [ 9D10F99A6712E28F8ACD5641E3A7EA6B ] ose            C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:06:28.0865 7612  ose - ok
20:06:29.0006 7612  [ 61BFFB5F57AD12F83AB64B7181829B34 ] osppsvc        C:\Program Files\Common Files\Microsoft Shared\OfficeSoftwareProtectionPlatform\OSPPSVC.EXE
20:06:29.0177 7612  osppsvc - ok
20:06:29.0193 7612  [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc        C:\Windows\system32\pnrpsvc.dll
20:06:29.0224 7612  p2pimsvc - ok
20:06:29.0255 7612  [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc          C:\Windows\system32\p2psvc.dll
20:06:29.0287 7612  p2psvc - ok
20:06:29.0318 7612  [ 0086431C29C35BE1DBC43F52CC273887 ] Parport        C:\Windows\system32\DRIVERS\parport.sys
20:06:29.0365 7612  Parport - ok
20:06:29.0396 7612  [ 90061B1ACFE8CCAA5345750FFE08D8B8 ] partmgr        C:\Windows\system32\drivers\partmgr.sys
20:06:29.0411 7612  partmgr - ok
20:06:29.0427 7612  [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc          C:\Windows\System32\pcasvc.dll
20:06:29.0474 7612  PcaSvc - ok
20:06:29.0521 7612  [ 81B5E63131090879AD6EF9F32109B88D ] pccsmcfd        C:\Windows\system32\DRIVERS\pccsmcfdx64.sys
20:06:29.0552 7612  pccsmcfd - ok
20:06:29.0583 7612  [ F36F6504009F2FB0DFD1B17A116AD74B ] pci            C:\Windows\system32\DRIVERS\pci.sys
20:06:29.0599 7612  pci - ok
20:06:29.0630 7612  [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide          C:\Windows\system32\DRIVERS\pciide.sys
20:06:29.0645 7612  pciide - ok
20:06:29.0677 7612  [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia          C:\Windows\system32\DRIVERS\pcmcia.sys
20:06:29.0692 7612  pcmcia - ok
20:06:29.0708 7612  [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw            C:\Windows\system32\drivers\pcw.sys
20:06:29.0723 7612  pcw - ok
20:06:29.0739 7612  [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH          C:\Windows\system32\drivers\peauth.sys
20:06:29.0817 7612  PEAUTH - ok
20:06:29.0864 7612  [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost        C:\Windows\SysWow64\perfhost.exe
20:06:29.0895 7612  PerfHost - ok
20:06:29.0957 7612  [ 557E9A86F65F0DE18C9B6751DFE9D3F1 ] pla            C:\Windows\system32\pla.dll
20:06:30.0035 7612  pla - ok
20:06:30.0067 7612  [ 98B1721B8718164293B9701B98C52D77 ] PlugPlay        C:\Windows\system32\umpnpmgr.dll
20:06:30.0113 7612  PlugPlay - ok
20:06:30.0160 7612  [ 37F6046CDC630442D7DC087501FF6FC6 ] Pml Driver HPZ12 C:\Windows\system32\HPZipm12.dll
20:06:30.0191 7612  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - warning
20:06:30.0191 7612  Pml Driver HPZ12 - detected UnsignedFile.Multi.Generic (1)
20:06:30.0207 7612  [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg    C:\Windows\system32\pnrpauto.dll
20:06:30.0254 7612  PNRPAutoReg - ok
20:06:30.0285 7612  [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc        C:\Windows\system32\pnrpsvc.dll
20:06:30.0301 7612  PNRPsvc - ok
20:06:30.0347 7612  [ 166EB40D1F5B47E615DE3D0FFFE5F243 ] PolicyAgent    C:\Windows\System32\ipsecsvc.dll
20:06:30.0425 7612  PolicyAgent - ok
20:06:30.0457 7612  [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power          C:\Windows\system32\umpo.dll
20:06:30.0535 7612  Power - ok
20:06:30.0566 7612  [ 27CC19E81BA5E3403C48302127BDA717 ] PptpMiniport    C:\Windows\system32\DRIVERS\raspptp.sys
20:06:30.0644 7612  PptpMiniport - ok
20:06:30.0691 7612  [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor      C:\Windows\system32\DRIVERS\processr.sys
20:06:30.0737 7612  Processor - ok
20:06:30.0769 7612  [ 97293447431311C06703368AD0F6C4BE ] ProfSvc        C:\Windows\system32\profsvc.dll
20:06:30.0815 7612  ProfSvc - ok
20:06:30.0831 7612  [ 156F6159457D0AA7E59B62681B56EB90 ] ProtectedStorage C:\Windows\system32\lsass.exe
20:06:30.0847 7612  ProtectedStorage - ok
20:06:30.0878 7612  [ EE992183BD8EAEFD9973F352E587A299 ] Psched          C:\Windows\system32\DRIVERS\pacer.sys
20:06:30.0909 7612  Psched - ok
20:06:30.0956 7612  [ A6A7AD767BF5141665F5C675F671B3E1 ] PSI_SVC_2      c:\Program Files (x86)\Common Files\Protexis\License Service\PsiService_2.exe
20:06:30.0987 7612  PSI_SVC_2 - ok
20:06:31.0034 7612  [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300          C:\Windows\system32\DRIVERS\ql2300.sys
20:06:31.0081 7612  ql2300 - ok
20:06:31.0112 7612  [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx          C:\Windows\system32\DRIVERS\ql40xx.sys
20:06:31.0112 7612  ql40xx - ok
20:06:31.0143 7612  [ 906191634E99AEA92C4816150BDA3732 ] QWAVE          C:\Windows\system32\qwave.dll
20:06:31.0174 7612  QWAVE - ok
20:06:31.0190 7612  [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv        C:\Windows\system32\drivers\qwavedrv.sys
20:06:31.0221 7612  QWAVEdrv - ok
20:06:31.0252 7612  [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd          C:\Windows\system32\DRIVERS\rasacd.sys
20:06:31.0346 7612  RasAcd - ok
20:06:31.0393 7612  [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn    C:\Windows\system32\DRIVERS\AgileVpn.sys
20:06:31.0455 7612  RasAgileVpn - ok
20:06:31.0471 7612  [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto        C:\Windows\System32\rasauto.dll
20:06:31.0533 7612  RasAuto - ok
20:06:31.0549 7612  [ 87A6E852A22991580D6D39ADC4790463 ] Rasl2tp        C:\Windows\system32\DRIVERS\rasl2tp.sys
20:06:31.0611 7612  Rasl2tp - ok
20:06:31.0642 7612  [ 47394ED3D16D053F5906EFE5AB51CC83 ] RasMan          C:\Windows\System32\rasmans.dll
20:06:31.0705 7612  RasMan - ok
20:06:31.0720 7612  [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe        C:\Windows\system32\DRIVERS\raspppoe.sys
20:06:31.0783 7612  RasPppoe - ok
20:06:31.0829 7612  [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp        C:\Windows\system32\DRIVERS\rassstp.sys
20:06:31.0892 7612  RasSstp - ok
20:06:31.0923 7612  [ 3BAC8142102C15D59A87757C1D41DCE5 ] rdbss          C:\Windows\system32\DRIVERS\rdbss.sys
20:06:31.0985 7612  rdbss - ok
20:06:32.0001 7612  [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus          C:\Windows\system32\DRIVERS\rdpbus.sys
20:06:32.0048 7612  rdpbus - ok
20:06:32.0079 7612  [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD          C:\Windows\system32\DRIVERS\RDPCDD.sys
20:06:32.0157 7612  RDPCDD - ok
20:06:32.0188 7612  [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD        C:\Windows\system32\drivers\rdpencdd.sys
20:06:32.0235 7612  RDPENCDD - ok
20:06:32.0266 7612  [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP        C:\Windows\system32\drivers\rdprefmp.sys
20:06:32.0313 7612  RDPREFMP - ok
20:06:32.0344 7612  [ 447DE7E3DEA39D422C1504F245B668B1 ] RDPWD          C:\Windows\system32\drivers\RDPWD.sys
20:06:32.0407 7612  RDPWD - ok
20:06:32.0453 7612  [ 634B9A2181D98F15941236886164EC8B ] rdyboost        C:\Windows\system32\drivers\rdyboost.sys
20:06:32.0485 7612  rdyboost - ok
20:06:32.0516 7612  [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess    C:\Windows\System32\mprdim.dll
20:06:32.0578 7612  RemoteAccess - ok
20:06:32.0609 7612  [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry  C:\Windows\system32\regsvc.dll
20:06:32.0656 7612  RemoteRegistry - ok
20:06:32.0750 7612  [ F12A68ED55053940CADD59CA5E3468DD ] RichVideo      C:\Program Files (x86)\CyberLink\Shared files\RichVideo.exe
20:06:32.0781 7612  RichVideo ( UnsignedFile.Multi.Generic ) - warning
20:06:32.0781 7612  RichVideo - detected UnsignedFile.Multi.Generic (1)
20:06:32.0828 7612  [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper    C:\Windows\System32\RpcEpMap.dll
20:06:32.0921 7612  RpcEptMapper - ok
20:06:32.0953 7612  [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator      C:\Windows\system32\locator.exe
20:06:32.0984 7612  RpcLocator - ok
20:06:33.0015 7612  [ 7266972E86890E2B30C0C322E906B027 ] RpcSs          C:\Windows\system32\rpcss.dll
20:06:33.0077 7612  RpcSs - ok
20:06:33.0109 7612  [ DDC86E4F8E7456261E637E3552E804FF ] rspndr          C:\Windows\system32\DRIVERS\rspndr.sys
20:06:33.0171 7612  rspndr - ok
20:06:33.0233 7612  [ 44ED82612403021E36998E1ECB1198F1 ] RSUSBSTOR      C:\Windows\System32\Drivers\RtsUStor.sys
20:06:33.0265 7612  RSUSBSTOR - ok
20:06:33.0296 7612  [ BAEFEE35D27A5440D35092CE10267BEC ] RTL8167        C:\Windows\system32\DRIVERS\Rt64win7.sys
20:06:33.0327 7612  RTL8167 - ok
20:06:33.0405 7612  [ A5986B46C4348CB35EBB98F220948DF7 ] rtl8192se      C:\Windows\system32\DRIVERS\rtl8192se.sys
20:06:33.0452 7612  rtl8192se - ok
20:06:33.0467 7612  [ 156F6159457D0AA7E59B62681B56EB90 ] SamSs          C:\Windows\system32\lsass.exe
20:06:33.0483 7612  SamSs - ok
20:06:33.0514 7612  [ E3BBB89983DAF5622C1D50CF49F28227 ] sbp2port        C:\Windows\system32\DRIVERS\sbp2port.sys
20:06:33.0530 7612  sbp2port - ok
20:06:33.0577 7612  [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr        C:\Windows\System32\SCardSvr.dll
20:06:33.0639 7612  SCardSvr - ok
20:06:33.0655 7612  [ C94DA20C7E3BA1DCA269BC8460D98387 ] scfilter        C:\Windows\system32\DRIVERS\scfilter.sys
20:06:33.0748 7612  scfilter - ok
20:06:33.0795 7612  [ 624D0F5FF99428BB90A5B8A4123E918E ] Schedule        C:\Windows\system32\schedsvc.dll
20:06:33.0857 7612  Schedule - ok
20:06:33.0873 7612  [ 312E2F82AF11E79906898AC3E3D58A1F ] SCPolicySvc    C:\Windows\System32\certprop.dll
20:06:33.0920 7612  SCPolicySvc - ok
20:06:33.0935 7612  [ 765A27C3279CE11D14CB9E4F5869FCA5 ] SDRSVC          C:\Windows\System32\SDRSVC.dll
20:06:33.0982 7612  SDRSVC - ok
20:06:34.0013 7612  [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv          C:\Windows\system32\drivers\secdrv.sys
20:06:34.0060 7612  secdrv - ok
20:06:34.0091 7612  [ 463B386EBC70F98DA5DFF85F7E654346 ] seclogon        C:\Windows\system32\seclogon.dll
20:06:34.0138 7612  seclogon - ok
20:06:34.0169 7612  [ C32AB8FA018EF34C0F113BD501436D21 ] SENS            C:\Windows\System32\sens.dll
20:06:34.0216 7612  SENS - ok
20:06:34.0247 7612  [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc        C:\Windows\system32\sensrsvc.dll
20:06:34.0294 7612  SensrSvc - ok
20:06:34.0325 7612  [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum        C:\Windows\system32\DRIVERS\serenum.sys
20:06:34.0357 7612  Serenum - ok
20:06:34.0403 7612  [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial          C:\Windows\system32\DRIVERS\serial.sys
20:06:34.0450 7612  Serial - ok
20:06:34.0481 7612  [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse        C:\Windows\system32\DRIVERS\sermouse.sys
20:06:34.0544 7612  sermouse - ok
20:06:34.0606 7612  [ 9D38320BB32230349379DF5DDBBF7FCE ] ServiceLayer    C:\Program Files (x86)\PC Connectivity Solution\ServiceLayer.exe
20:06:34.0622 7612  ServiceLayer ( UnsignedFile.Multi.Generic ) - warning
20:06:34.0622 7612  ServiceLayer - detected UnsignedFile.Multi.Generic (1)
20:06:34.0669 7612  [ C3BC61CE47FF6F4E88AB8A3B429A36AF ] SessionEnv      C:\Windows\system32\sessenv.dll
20:06:34.0731 7612  SessionEnv - ok
20:06:34.0778 7612  [ A554811BCD09279536440C964AE35BBF ] sffdisk        C:\Windows\system32\DRIVERS\sffdisk.sys
20:06:34.0809 7612  sffdisk - ok
20:06:34.0856 7612  [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc        C:\Windows\system32\DRIVERS\sffp_mmc.sys
20:06:34.0887 7612  sffp_mmc - ok
20:06:34.0918 7612  [ 178298F767FE638C9FEDCBDEF58BB5E4 ] sffp_sd        C:\Windows\system32\DRIVERS\sffp_sd.sys
20:06:34.0934 7612  sffp_sd - ok
20:06:34.0981 7612  [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy        C:\Windows\system32\DRIVERS\sfloppy.sys
20:06:34.0996 7612  sfloppy - ok
20:06:35.0043 7612  [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess    C:\Windows\System32\ipnathlp.dll
20:06:35.0137 7612  SharedAccess - ok
20:06:35.0168 7612  [ 0298AC45D0EFFFB2DB4BAA7DD186E7BF ] ShellHWDetection C:\Windows\System32\shsvcs.dll
20:06:35.0215 7612  ShellHWDetection - ok
20:06:35.0246 7612  [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2        C:\Windows\system32\DRIVERS\SiSRaid2.sys
20:06:35.0261 7612  SiSRaid2 - ok
20:06:35.0277 7612  [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4        C:\Windows\system32\DRIVERS\sisraid4.sys
20:06:35.0293 7612  SiSRaid4 - ok
20:06:35.0355 7612  [ 17EAB7852FF9F15FBAAB4E95EFC0B812 ] SkypeUpdate    C:\Program Files (x86)\Skype\Updater\Updater.exe
20:06:35.0371 7612  SkypeUpdate - ok
20:06:35.0402 7612  [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb            C:\Windows\system32\DRIVERS\smb.sys
20:06:35.0495 7612  Smb - ok
20:06:35.0542 7612  [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP        C:\Windows\System32\snmptrap.exe
20:06:35.0573 7612  SNMPTRAP - ok
20:06:35.0589 7612  [ B9E31E5CACDFE584F34F730A677803F9 ] spldr          C:\Windows\system32\drivers\spldr.sys
20:06:35.0620 7612  spldr - ok
20:06:35.0651 7612  [ 567977DC43CC13C4C35ED7084C0B84D5 ] Spooler        C:\Windows\System32\spoolsv.exe
20:06:35.0698 7612  Spooler - ok
20:06:35.0761 7612  [ 913D843498553A1BC8F8DBAD6358E49F ] sppsvc          C:\Windows\system32\sppsvc.exe
20:06:35.0839 7612  sppsvc - ok
20:06:35.0870 7612  [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify    C:\Windows\system32\sppuinotify.dll
20:06:35.0917 7612  sppuinotify - ok
20:06:35.0948 7612  [ 2408C0366D96BCDF63E8F1C78E4A29C5 ] srv            C:\Windows\system32\DRIVERS\srv.sys
20:06:35.0979 7612  srv - ok
20:06:36.0026 7612  [ 76548F7B818881B47D8D1AE1BE9C11F8 ] srv2            C:\Windows\system32\DRIVERS\srv2.sys
20:06:36.0073 7612  srv2 - ok
20:06:36.0104 7612  [ 0AF6E19D39C70844C5CAA8FB0183C36E ] srvnet          C:\Windows\system32\DRIVERS\srvnet.sys
20:06:36.0135 7612  srvnet - ok
20:06:36.0166 7612  [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV        C:\Windows\System32\ssdpsrv.dll
20:06:36.0275 7612  SSDPSRV - ok
20:06:36.0275 7612  [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc        C:\Windows\system32\sstpsvc.dll
20:06:36.0322 7612  SstpSvc - ok
20:06:36.0385 7612  [ 47A0A473AD1822E9E6C76E519BD0A023 ] Stereo Service  C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe
20:06:36.0400 7612  Stereo Service - ok
20:06:36.0431 7612  [ F3817967ED533D08327DC73BC4D5542A ] stexstor        C:\Windows\system32\DRIVERS\stexstor.sys
20:06:36.0447 7612  stexstor - ok
20:06:36.0509 7612  [ 52D0E33B681BD0F33FDC08812FEE4F7D ] stisvc          C:\Windows\System32\wiaservc.dll
20:06:36.0572 7612  stisvc - ok
20:06:36.0587 7612  [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum          C:\Windows\system32\DRIVERS\swenum.sys
20:06:36.0603 7612  swenum - ok
20:06:36.0650 7612  [ E08E46FDD841B7184194011CA1955A0B ] swprv          C:\Windows\System32\swprv.dll
20:06:36.0712 7612  swprv - ok
20:06:36.0759 7612  [ 064A2530A4A7C7CEC1BE6A1945645BE4 ] SynTP          C:\Windows\system32\DRIVERS\SynTP.sys
20:06:36.0775 7612  SynTP - ok
20:06:36.0806 7612  [ 3C1284516A62078FB68F768DE4F1A7BE ] SysMain        C:\Windows\system32\sysmain.dll
20:06:36.0868 7612  SysMain - ok
20:06:36.0899 7612  [ 238935C3CF2854886DC7CBB2A0E2CC66 ] TabletInputService C:\Windows\System32\TabSvc.dll
20:06:36.0962 7612  TabletInputService - ok
20:06:36.0977 7612  [ 884264AC597B690C5707C89723BB8E7B ] TapiSrv        C:\Windows\System32\tapisrv.dll
20:06:37.0055 7612  TapiSrv - ok
20:06:37.0087 7612  [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS            C:\Windows\System32\tbssvc.dll
20:06:37.0133 7612  TBS - ok
20:06:37.0211 7612  [ 624C5B3AA4C99B3184BB922D9ECE3FF0 ] Tcpip          C:\Windows\system32\drivers\tcpip.sys
20:06:37.0258 7612  Tcpip - ok
20:06:37.0289 7612  [ 624C5B3AA4C99B3184BB922D9ECE3FF0 ] TCPIP6          C:\Windows\system32\DRIVERS\tcpip.sys
20:06:37.0336 7612  TCPIP6 - ok
20:06:37.0352 7612  [ 76D078AF6F587B162D50210F761EB9ED ] tcpipreg        C:\Windows\system32\drivers\tcpipreg.sys
20:06:37.0399 7612  tcpipreg - ok
20:06:37.0430 7612  [ 3371D21011695B16333A3934340C4E7C ] TDPIPE          C:\Windows\system32\drivers\tdpipe.sys
20:06:37.0461 7612  TDPIPE - ok
20:06:37.0492 7612  [ 7518F7BCFD4B308ABC9192BACAF6C970 ] TDTCP          C:\Windows\system32\drivers\tdtcp.sys
20:06:37.0523 7612  TDTCP - ok
20:06:37.0555 7612  [ 079125C4B17B01FCAEEBCE0BCB290C0F ] tdx            C:\Windows\system32\DRIVERS\tdx.sys
20:06:37.0617 7612  tdx - ok
20:06:37.0648 7612  [ C448651339196C0E869A355171875522 ] TermDD          C:\Windows\system32\DRIVERS\termdd.sys
20:06:37.0664 7612  TermDD - ok
20:06:37.0695 7612  [ 0F05EC2887BFE197AD82A13287D2F404 ] TermService    C:\Windows\System32\termsrv.dll
20:06:37.0804 7612  TermService - ok
20:06:37.0804 7612  TFsExDisk - ok
20:06:37.0835 7612  [ F0344071948D1A1FA732231785A0664C ] Themes          C:\Windows\system32\themeservice.dll
20:06:37.0851 7612  Themes - ok
20:06:37.0882 7612  [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER    C:\Windows\system32\mmcss.dll
20:06:37.0913 7612  THREADORDER - ok
20:06:37.0945 7612  [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks          C:\Windows\System32\trkwks.dll
20:06:38.0007 7612  TrkWks - ok
20:06:38.0069 7612  [ 840F7FB849F5887A49BA18C13B2DA920 ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe
20:06:38.0116 7612  TrustedInstaller - ok
20:06:38.0147 7612  [ 61B96C26131E37B24E93327A0BD1FB95 ] tssecsrv        C:\Windows\system32\DRIVERS\tssecsrv.sys
20:06:38.0225 7612  tssecsrv - ok
20:06:38.0272 7612  [ 3836171A2CDF3AF8EF10856DB9835A70 ] tunnel          C:\Windows\system32\DRIVERS\tunnel.sys
20:06:38.0319 7612  tunnel - ok
20:06:38.0350 7612  [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35          C:\Windows\system32\DRIVERS\uagp35.sys
20:06:38.0350 7612  uagp35 - ok
20:06:38.0381 7612  [ D47BAEAD86C65D4F4069D7CE0A4EDCEB ] udfs            C:\Windows\system32\DRIVERS\udfs.sys
20:06:38.0444 7612  udfs - ok
20:06:38.0491 7612  [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect      C:\Windows\system32\UI0Detect.exe
20:06:38.0522 7612  UI0Detect - ok
20:06:38.0569 7612  [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx        C:\Windows\system32\DRIVERS\uliagpkx.sys
20:06:38.0584 7612  uliagpkx - ok
20:06:38.0615 7612  [ EAB6C35E62B1B0DB0D1B48B671D3A117 ] umbus          C:\Windows\system32\DRIVERS\umbus.sys
20:06:38.0631 7612  umbus - ok
20:06:38.0662 7612  [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass          C:\Windows\system32\DRIVERS\umpass.sys
20:06:38.0709 7612  UmPass - ok
20:06:38.0849 7612  [ AF905F4966CFC8B973623AB150CD4B2B ] UNS            C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe
20:06:38.0896 7612  UNS - ok
20:06:38.0927 7612  [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost        C:\Windows\System32\upnphost.dll
20:06:38.0990 7612  upnphost - ok
20:06:39.0068 7612  [ 43228F8EDD1B0BCDD3145AD246E63D39 ] USBAAPL64      C:\Windows\system32\Drivers\usbaapl64.sys
20:06:39.0099 7612  USBAAPL64 - ok
20:06:39.0146 7612  [ 7B6A127C93EE590E4D79A5F2A76FE46F ] usbccgp        C:\Windows\system32\DRIVERS\usbccgp.sys
20:06:39.0177 7612  usbccgp - ok
20:06:39.0209 7612  [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir          C:\Windows\system32\DRIVERS\usbcir.sys
20:06:39.0272 7612  usbcir - ok
20:06:39.0303 7612  [ 92969BA5AC44E229C55A332864F79677 ] usbehci        C:\Windows\system32\drivers\usbehci.sys
20:06:39.0318 7612  usbehci - ok
20:06:39.0334 7612  [ E7DF1CFD28CA86B35EF5ADD0735CEEF3 ] usbhub          C:\Windows\system32\DRIVERS\usbhub.sys
20:06:39.0381 7612  usbhub - ok
20:06:39.0396 7612  [ F1BB1E55F1E7A65C5839CCC7B36D773E ] usbohci        C:\Windows\system32\drivers\usbohci.sys
20:06:39.0443 7612  usbohci - ok
20:06:39.0474 7612  [ 73188F58FB384E75C4063D29413CEE3D ] usbprint        C:\Windows\system32\DRIVERS\usbprint.sys
20:06:39.0537 7612  usbprint - ok
20:06:39.0584 7612  [ AAA2513C8AED8B54B189FD0C6B1634C0 ] usbscan        C:\Windows\system32\DRIVERS\usbscan.sys
20:06:39.0630 7612  usbscan - ok
20:06:39.0662 7612  [ F39983647BC1F3E6100778DDFE9DCE29 ] USBSTOR        C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:06:39.0693 7612  USBSTOR - ok
20:06:39.0708 7612  [ BC3070350A491D84B518D7CCA9ABD36F ] usbuhci        C:\Windows\system32\drivers\usbuhci.sys
20:06:39.0755 7612  usbuhci - ok
20:06:39.0786 7612  [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms          C:\Windows\System32\uxsms.dll
20:06:39.0849 7612  UxSms - ok
20:06:39.0880 7612  [ 156F6159457D0AA7E59B62681B56EB90 ] VaultSvc        C:\Windows\system32\lsass.exe
20:06:39.0911 7612  VaultSvc - ok
20:06:39.0942 7612  [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot        C:\Windows\system32\DRIVERS\vdrvroot.sys
20:06:39.0974 7612  vdrvroot - ok
20:06:39.0989 7612  [ 44D73E0BBC1D3C8981304BA15135C2F2 ] vds            C:\Windows\System32\vds.exe
20:06:40.0036 7612  vds - ok
20:06:40.0067 7612  [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga            C:\Windows\system32\DRIVERS\vgapnp.sys
20:06:40.0114 7612  vga - ok
20:06:40.0130 7612  [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave        C:\Windows\System32\drivers\vga.sys
20:06:40.0208 7612  VgaSave - ok
20:06:40.0239 7612  [ C82E748660F62A242B2DFAC1442F22A4 ] vhdmp          C:\Windows\system32\DRIVERS\vhdmp.sys
20:06:40.0254 7612  vhdmp - ok
20:06:40.0286 7612  [ E5689D93FFE4E5D66C0178761240DD54 ] viaide          C:\Windows\system32\DRIVERS\viaide.sys
20:06:40.0301 7612  viaide - ok
20:06:40.0332 7612  [ 2B1A3DAE2B4E70DBBA822B7A03FBD4A3 ] volmgr          C:\Windows\system32\DRIVERS\volmgr.sys
20:06:40.0332 7612  volmgr - ok
20:06:40.0364 7612  [ 99B0CBB569CA79ACAED8C91461D765FB ] volmgrx        C:\Windows\system32\drivers\volmgrx.sys
20:06:40.0379 7612  volmgrx - ok
20:06:40.0395 7612  [ 58F82EED8CA24B461441F9C3E4F0BF5C ] volsnap        C:\Windows\system32\DRIVERS\volsnap.sys
20:06:40.0426 7612  volsnap - ok
20:06:40.0457 7612  [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid        C:\Windows\system32\DRIVERS\vsmraid.sys
20:06:40.0473 7612  vsmraid - ok
20:06:40.0535 7612  [ 787898BF9FB6D7BD87A36E2D95C899BA ] VSS            C:\Windows\system32\vssvc.exe
20:06:40.0598 7612  VSS - ok
20:06:40.0629 7612  [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus        C:\Windows\system32\DRIVERS\vwifibus.sys
20:06:40.0644 7612  vwifibus - ok
20:06:40.0676 7612  [ 6A3D66263414FF0D6FA754C646612F3F ] vwififlt        C:\Windows\system32\DRIVERS\vwififlt.sys
20:06:40.0707 7612  vwififlt - ok
20:06:40.0738 7612  [ 6A638FC4BFDDC4D9B186C28C91BD1A01 ] vwifimp        C:\Windows\system32\DRIVERS\vwifimp.sys
20:06:40.0785 7612  vwifimp - ok
20:06:40.0832 7612  [ 1C9D80CC3849B3788048078C26486E1A ] W32Time        C:\Windows\system32\w32time.dll
20:06:40.0894 7612  W32Time - ok
20:06:40.0941 7612  [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen        C:\Windows\system32\DRIVERS\wacompen.sys
20:06:40.0956 7612  WacomPen - ok
20:06:41.0003 7612  [ 47CA49400643EFFD3F1C9A27E1D69324 ] WANARP          C:\Windows\system32\DRIVERS\wanarp.sys
20:06:41.0081 7612  WANARP - ok
20:06:41.0097 7612  [ 47CA49400643EFFD3F1C9A27E1D69324 ] Wanarpv6        C:\Windows\system32\DRIVERS\wanarp.sys
20:06:41.0144 7612  Wanarpv6 - ok
20:06:41.0190 7612  [ 878C947C69EE89E4DBFF9DBD6155C15D ] watchmi        C:\Program Files (x86)\watchmi\TvdService.exe
20:06:41.0222 7612  watchmi ( UnsignedFile.Multi.Generic ) - warning
20:06:41.0222 7612  watchmi - detected UnsignedFile.Multi.Generic (1)
20:06:41.0268 7612  [ 5AB1BB85BD8B5089CC5D64200DEDAE68 ] wbengine        C:\Windows\system32\wbengine.exe
20:06:41.0331 7612  wbengine - ok
20:06:41.0378 7612  [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc        C:\Windows\System32\wbiosrvc.dll
20:06:41.0424 7612  WbioSrvc - ok
20:06:41.0471 7612  [ DD1BAE8EBFC653824D29CCF8C9054D68 ] wcncsvc        C:\Windows\System32\wcncsvc.dll
20:06:41.0502 7612  wcncsvc - ok
20:06:41.0534 7612  [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll
20:06:41.0565 7612  WcsPlugInService - ok
20:06:41.0596 7612  [ 72889E16FF12BA0F235467D6091B17DC ] Wd              C:\Windows\system32\DRIVERS\wd.sys
20:06:41.0612 7612  Wd - ok
20:06:41.0658 7612  [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000        C:\Windows\system32\drivers\Wdf01000.sys
20:06:41.0690 7612  Wdf01000 - ok
20:06:41.0705 7612  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost  C:\Windows\system32\wdi.dll
20:06:41.0768 7612  WdiServiceHost - ok
20:06:41.0768 7612  [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost  C:\Windows\system32\wdi.dll
20:06:41.0783 7612  WdiSystemHost - ok
20:06:41.0830 7612  [ 733006127F235BE7C35354EBEE7B9A7B ] WebClient      C:\Windows\System32\webclnt.dll
20:06:41.0861 7612  WebClient - ok
20:06:41.0892 7612  [ C749025A679C5103E575E3B48E092C43 ] Wecsvc          C:\Windows\system32\wecsvc.dll
20:06:41.0924 7612  Wecsvc - ok
20:06:41.0939 7612  [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport  C:\Windows\System32\wercplsupport.dll
20:06:41.0986 7612  wercplsupport - ok
20:06:42.0017 7612  [ 6D137963730144698CBD10F202E9F251 ] WerSvc          C:\Windows\System32\WerSvc.dll
20:06:42.0095 7612  WerSvc - ok
20:06:42.0142 7612  [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf          C:\Windows\system32\DRIVERS\wfplwf.sys
20:06:42.0204 7612  WfpLwf - ok
20:06:42.0220 7612  [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount        C:\Windows\system32\drivers\wimmount.sys
20:06:42.0220 7612  WIMMount - ok
20:06:42.0251 7612  WinDefend - ok
20:06:42.0251 7612  WinHttpAutoProxySvc - ok
20:06:42.0298 7612  [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt        C:\Windows\system32\wbem\WMIsvc.dll
20:06:42.0376 7612  Winmgmt - ok
20:06:42.0438 7612  [ 41FBB751936B387F9179E7F03A74FE29 ] WinRM          C:\Windows\system32\WsmSvc.dll
20:06:42.0501 7612  WinRM - ok
20:06:42.0563 7612  [ 817EAFF5D38674EDD7713B9DFB8E9791 ] WinUsb          C:\Windows\system32\DRIVERS\WinUsb.sys
20:06:42.0579 7612  WinUsb - ok
20:06:42.0626 7612  [ 4C69A8E2E159C1C59BC4B688E9DD7F8C ] WisLMSvc        C:\Program Files (x86)\Launch Manager\WisLMSvc.exe
20:06:42.0657 7612  WisLMSvc - ok
20:06:42.0688 7612  [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc        C:\Windows\System32\wlansvc.dll
20:06:42.0735 7612  Wlansvc - ok
20:06:42.0828 7612  [ 06C8FA1CF39DE6A735B54D906BA791C6 ] wlcrasvc        C:\Program Files\Windows Live\Mesh\wlcrasvc.exe
20:06:42.0844 7612  wlcrasvc - ok
20:06:42.0906 7612  [ 7E47C328FC4768CB8BEAFBCFAFA70362 ] wlidsvc        C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:06:42.0953 7612  wlidsvc - ok
20:06:43.0000 7612  [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi        C:\Windows\system32\DRIVERS\wmiacpi.sys
20:06:43.0031 7612  WmiAcpi - ok
20:06:43.0078 7612  [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv        C:\Windows\system32\wbem\WmiApSrv.exe
20:06:43.0109 7612  wmiApSrv - ok
20:06:43.0156 7612  WMPNetworkSvc - ok
20:06:43.0187 7612  [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc          C:\Windows\System32\wpcsvc.dll
20:06:43.0203 7612  WPCSvc - ok
20:06:43.0218 7612  [ 2E57DDF2880A7E52E76F41C7E96D327B ] WPDBusEnum      C:\Windows\system32\wpdbusenum.dll
20:06:43.0265 7612  WPDBusEnum - ok
20:06:43.0281 7612  [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl        C:\Windows\system32\drivers\ws2ifsl.sys
20:06:43.0359 7612  ws2ifsl - ok
20:06:43.0406 7612  [ 8F9F3969933C02DA96EB0F84576DB43E ] wscsvc          C:\Windows\System32\wscsvc.dll
20:06:43.0437 7612  wscsvc - ok
20:06:43.0452 7612  WSearch - ok
20:06:43.0530 7612  [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv        C:\Windows\system32\wuaueng.dll
20:06:43.0593 7612  wuauserv - ok
20:06:43.0608 7612  [ 7CADC74271DD6461C452C271B30BD378 ] WudfPf          C:\Windows\system32\drivers\WudfPf.sys
20:06:43.0671 7612  WudfPf - ok
20:06:43.0686 7612  [ 3B197AF0FFF08AA66B6B2241CA538D64 ] WUDFRd          C:\Windows\system32\DRIVERS\WUDFRd.sys
20:06:43.0764 7612  WUDFRd - ok
20:06:43.0796 7612  [ B551D6637AA0E132C18AC6E504F7B79B ] wudfsvc        C:\Windows\System32\WUDFSvc.dll
20:06:43.0874 7612  wudfsvc - ok
20:06:43.0905 7612  [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc        C:\Windows\System32\wwansvc.dll
20:06:43.0952 7612  WwanSvc - ok
20:06:43.0983 7612  ================ Scan global ===============================
20:06:44.0014 7612  [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll
20:06:44.0045 7612  [ 79CDA06F75AD5373DD447F57575C4400 ] C:\Windows\system32\winsrv.dll
20:06:44.0045 7612  [ 79CDA06F75AD5373DD447F57575C4400 ] C:\Windows\system32\winsrv.dll
20:06:44.0092 7612  [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll
20:06:44.0123 7612  [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe
20:06:44.0123 7612  [Global] - ok
20:06:44.0123 7612  ================ Scan MBR ==================================
20:06:44.0139 7612  [ 8B790A79784018D2B00DC944072570F8 ] \Device\Harddisk0\DR0
20:06:46.0385 7612  \Device\Harddisk0\DR0 - ok
20:06:46.0385 7612  ================ Scan VBR ==================================
20:06:46.0385 7612  [ 378F052D5D58AFD217EDB9FDB50FCF80 ] \Device\Harddisk0\DR0\Partition1
20:06:46.0385 7612  \Device\Harddisk0\DR0\Partition1 - ok
20:06:46.0416 7612  [ 7AD2168EF754372BEDB27DE016F9039D ] \Device\Harddisk0\DR0\Partition2
20:06:46.0416 7612  \Device\Harddisk0\DR0\Partition2 - ok
20:06:46.0448 7612  [ 1468261406A3B7F63BE7E920F56B5AA6 ] \Device\Harddisk0\DR0\Partition3
20:06:46.0448 7612  \Device\Harddisk0\DR0\Partition3 - ok
20:06:46.0448 7612  ============================================================
20:06:46.0448 7612  Scan finished
20:06:46.0448 7612  ============================================================
20:06:46.0448 7736  Detected object count: 11
20:06:46.0448 7736  Actual detected object count: 11
20:07:32.0421 7736  AVM IGD CTRL Service ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0421 7736  AVM IGD CTRL Service ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  de_serv ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  de_serv ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  hpqcxs08 ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  hpqcxs08 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  hpqddsvc ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  hpqddsvc ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  HPSLPSVC ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  HPSLPSVC ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  Net Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  Pml Driver HPZ12 ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0436 7736  ServiceLayer ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0436 7736  ServiceLayer ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:32.0452 7736  watchmi ( UnsignedFile.Multi.Generic ) - skipped by user
20:07:32.0452 7736  watchmi ( UnsignedFile.Multi.Generic ) - User select action: Skip
20:07:43.0497 6712  Deinitialize success

cosinus 01.04.2013 23:17
Dann bitte jetzt Combofix ausführen:

Scan mit Combofix
WARNUNG an die MITLESER:
Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!

Downloade dir bitte Combofix vom folgenden Downloadspiegel: Link
  • WICHTIG: Speichere Combofix auf deinem Desktop.
  • Deaktiviere bitte alle deine Antivirensoftware sowie Malware/Spyware Scanner. Diese können Combofix bei der Arbeit stören. Combofix meckert auch manchmal trotzdem noch, das kannst du dann ignorieren, mir aber bitte mitteilen.
  • Starte die Combofix.exe und folge den Anweisungen auf dem Bildschirm.
  • Während Combofix läuft bitte nicht am Computer arbeiten, die Maus bewegen oder ins Combofixfenster klicken!
  • Wenn Combofix fertig ist, wird es ein Logfile erstellen.
  • Bitte poste die C:\Combofix.txt in deiner nächsten Antwort (möglichst in CODE-Tags).
Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten
Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.
starte den Rechner einfach neu. Dies sollte das Problem beheben.

christalex 02.04.2013 07:18
hier das Combofix-Log
Code:
ComboFix 13-04-01.01 - *** 02.04.2013  8:02.1.4 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.3893.2236 [GMT 2:00]
ausgeführt von:: c:\users\***\Pictures\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((  Weitere Löschungen  ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\IsUn0407.exe
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-03-02 bis 2013-04-02  ))))))))))))))))))))))))))))))
.
.
2013-04-02 06:11 . 2013-04-02 06:11        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2013-04-02 06:11 . 2013-04-02 06:11        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-04-02 06:05 . 2013-04-02 06:05        76232        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{91F013F4-0AB9-4B0D-BE05-EE7877DA5028}\offreg.dll
2013-04-01 18:05 . 2013-04-01 18:05        208216        ----a-w-        c:\windows\system32\drivers\36876970.sys
2013-03-29 11:12 . 2013-03-29 11:12        --------        d-----w-        c:\programdata\Malwarebytes
2013-03-27 18:53 . 2013-03-27 18:53        --------        d-----w-        C:\GVU
2013-03-26 18:31 . 2013-03-26 18:31        --------        d-----w-        c:\windows\SysWow64\searchplugins
2013-03-26 18:31 . 2013-03-26 18:31        --------        d-----w-        c:\windows\SysWow64\Extensions
2013-03-25 20:16 . 2013-03-25 20:16        --------        d-----w-        c:\programdata\BrowserProtect
2013-03-25 20:16 . 2013-03-27 14:32        --------        d-----w-        c:\users\***\AppData\Roaming\BabSolution
2013-03-05 05:45 . 2013-02-19 02:57        9162192        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{91F013F4-0AB9-4B0D-BE05-EE7877DA5028}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-15 17:07 . 2012-04-02 17:56        693976        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-15 17:07 . 2011-12-02 22:12        73432        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-20 719672]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2011-05-22 102400]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-02-17 39408]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-01-31 17147528]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2012-11-11 3093624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HotkeyApp"="c:\program files (x86)\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]
"LMgrVolOSD"="c:\program files (x86)\Launch Manager\OSD.exe" [2009-12-11 348960]
"Wbutton"="c:\program files (x86)\Launch Manager\Wbutton.exe" [2010-06-21 436264]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2010-10-29 136488]
"LexwareInfoService"="c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"iWareV3"="c:\program files (x86)\MouseDriver\OfficeMouse.exe" [2009-03-27 507904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2011-04-25 305088]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Startcenter.lnk - c:\program files (x86)\FRITZ!DSL\StCenter.exe [2011-2-21 679936]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-05-24 246304]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-10-27 24680]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-15 27760]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2010-07-14 87600]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-27 236136]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-10 2320920]
S2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe [2010-12-06 62464]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-10-29 31088]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-18 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-03-04 75816]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-03-02 1098784]
S3 WisLMSvc;WisLMSvc;c:\program files (x86)\Launch Manager\WisLMSvc.exe [2009-10-23 118560]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 17:07]
.
2013-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 16:53]
.
2013-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 16:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-02 11465320]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-09-02 2120808]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://webaccess.krones.com/vpn/index.html
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
Trusted Zone: krones.com\webaccess
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\lkickppl.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFOB6&ctid=CT2319825&SearchSource=2&q=
FF - ExtSQL: 2013-03-27 15:32; ffxtlbr@delta.com; c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\lkickppl.default\extensions\ffxtlbr@delta.com
FF - ExtSQL: !HIDDEN! 2011-03-06 16:53; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
URLSearchHooks-{40c3cc16-7269-4b32-9531-17f2950fb06f} - (no file)
Toolbar-{DFEFCDEE-CF1A-4FC8-88AD-129872198372} - (no file)
Wow6432Node-HKLM-Run-NPSStartup - (no file)
SafeBoot-BsScanner
HKLM-Run-SynTPEnh - c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe
AddRemove-FRITZ!DSL - c:\windows\IsUn0407.exe
AddRemove-LEGO Creator - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-04-02  08:15:24
ComboFix-quarantined-files.txt  2013-04-02 06:15
.
Vor Suchlauf: 10 Verzeichnis(se), 484.585.611.264 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 489.593.651.200 Bytes frei
.
- - End Of File - - F6B58420424FE1BA98D5B94A1E05FB69

cosinus 02.04.2013 10:54
Combofix-Skript
WARNUNG für die MITLESER:
Folgendes ComboFix Skript ist ausschließlich für diesen User in dieser Situtation erstellt worden.
Auf keinen Fall auf anderen Rechnern anwenden, das kann andere Systeme nachhaltig schädigen!

  • Lösche die vorhandene Combofix.exe von deinem Desktop und lade das Programm von folgenden Download-Spiegel neu herunter: Link
  • Speichere es erneut auf dem Desktop (nicht woanders hin, das ist wichtig)!
  • Drücke die Windows + R Taste --> notepad (hinein schreiben) --> OK
  • Kopiere nun den Text aus der folgenden Codebox komplett in das leere Textdokument.
    Code:
    Filelook::
    c:\windows\system32\drivers\36876970.sys

    Dirlook::
    C:\GVU
    c:\windows\SysWow64\searchplugins
    c:\windows\SysWow64\Extensions
    c:\programdata\BrowserProtect
    c:\users\***\AppData\Roaming\BabSolution
  • Speichere dies als CFScript.txt auf deinem Desktop.
  • Wichtig: Stelle deine Anti Viren Software temporär ab. Dies kann ComboFix nämlich bei der Arbeit behindern.
    Danach wieder anstellen nicht vergessen!
  • Schließe alle laufenden Programme damit ComboFix ungehindert arbeiten kann.
  • Ziehe CFScript.txt in die ComboFix.exe wie in diesem Bild:
  • Mache nichts am Computer, bewege nicht die Maus über das ComboFix-Fenster oder klicke in dieses hinein. Dies kann dazu führen, dass ComboFix sich aufhängt.
  • Wenn ComboFix fertig ist wird es ein Log erstellen: C:\ComboFix.txt
    Bitte füge es hier als Antwort (in CODE-Tags mit dem #-Button des Editors) ein.

Hinweis:
Suspect:: und Collect::
Falls im Skript diese Anweisungen enthalten sind, sollen Dateien zur Analyse eingeschickt werden. Es erscheint eine Message-Box, nachdem Combofix fertig ist. Klicke OK und folge den Aufforderungen/Anweisungen, um die Dateien hochzuladen. Teile mir unbedingt mit, ob der Upload geklappt hat!

christalex 02.04.2013 20:07
Hallo,

hier das 2. Combofix-Log.
Ich habe das CF-Script erst wieder personalisiert (letzte Zeile) und das Log hier wieder entpersonalisiert. Richtig so?

Code:
ComboFix 13-04-02.01 - *** 02.04.2013  20:48:35.2.4 - x64
Microsoft Windows 7 Home Premium  6.1.7600.0.1252.49.1031.18.3893.2437 [GMT 2:00]
ausgeführt von:: c:\users\***\Pictures\Desktop\ComboFix.exe
Benutzte Befehlsschalter :: c:\users\***\Pictures\Desktop\CFScript.txt
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Outdated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
(((((((((((((((((((((((  Dateien erstellt von 2013-03-02 bis 2013-04-02  ))))))))))))))))))))))))))))))
.
.
2013-04-02 18:56 . 2013-04-02 18:56        --------        d-----w-        c:\users\UpdatusUser\AppData\Local\temp
2013-04-02 18:56 . 2013-04-02 18:56        --------        d-----w-        c:\users\Default\AppData\Local\temp
2013-04-01 18:05 . 2013-04-01 18:05        208216        ----a-w-        c:\windows\system32\drivers\36876970.sys
2013-03-29 11:12 . 2013-03-29 11:12        --------        d-----w-        c:\programdata\Malwarebytes
2013-03-27 18:53 . 2013-03-27 18:53        --------        d-----w-        C:\GVU
2013-03-26 18:31 . 2013-03-26 18:31        --------        d-----w-        c:\windows\SysWow64\searchplugins
2013-03-26 18:31 . 2013-03-26 18:31        --------        d-----w-        c:\windows\SysWow64\Extensions
2013-03-25 20:16 . 2013-03-25 20:16        --------        d-----w-        c:\programdata\BrowserProtect
2013-03-25 20:16 . 2013-03-27 14:32        --------        d-----w-        c:\users\***\AppData\Roaming\BabSolution
2013-03-05 05:45 . 2013-02-19 02:57        9162192        ----a-w-        c:\programdata\Microsoft\Windows Defender\Definition Updates\{91F013F4-0AB9-4B0D-BE05-EE7877DA5028}\mpengine.dll
.
.
.
((((((((((((((((((((((((((((((((((((  Find3M Bericht  ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2013-03-15 17:07 . 2012-04-02 17:56        693976        ----a-w-        c:\windows\SysWow64\FlashPlayerApp.exe
2013-03-15 17:07 . 2011-12-02 22:12        73432        ----a-w-        c:\windows\SysWow64\FlashPlayerCPLApp.cpl
.
.
((((((((((((((((((((((((((((((((((((((((((((  Look  )))))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
.
--- c:\windows\system32\drivers\36876970.sys ---
Company: Kaspersky Lab, GERT
File Description: Kaspersky Lab Mini Driver
File Version: 2.8.4.0 built by: WinDDK
Product Name: Kaspersky Lab Mini Driver
Copyright: Copyright (c) Kaspersky Lab, GERT
Original Filename: klmd.sys
File size: 208216
Created time: 2013-04-01 18:05
Modified time: 2013-04-01 18:05
MD5: F146E2BA475893DD77B2370DC1211FC6
SHA1: B34C5CDBC9597694131FD20562DB201F62E6D1FE
.
---- Directory of C:\GVU ----
.
2013-03-27 18:53 . 2013-03-27 16:35        124382        ----a-w-        c:\gvu\Extras.Txt
2013-03-27 18:53 . 2013-03-27 16:34        115766        ----a-w-        c:\gvu\OTL.Txt
.
---- Directory of c:\programdata\BrowserProtect ----
.
2013-03-25 20:17 . 2013-03-04 12:32        36290        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.crx
2013-03-25 20:16 . 2013-03-26 16:45        4033        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\bl
2013-03-25 20:16 . 2013-03-27 14:27        42520        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\BrowserProtect.settings
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\20
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\21
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\22
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\23
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\10
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\11
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\12
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\13
2013-03-25 20:16 . 2013-03-27 14:27        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\00
2013-03-25 20:16 . 2013-03-27 14:27        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\01
2013-03-25 20:16 . 2013-03-27 14:25        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\02
2013-03-25 20:16 . 2013-03-27 14:27        8        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\traking_settings\03
2013-03-06 01:50 . 2013-03-06 01:50        120        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\components\BrowserProtect-3.6.xpt
2013-03-06 01:45 . 2013-03-25 20:17        925        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\install.rdf
2013-02-19 04:59 . 2013-03-25 20:17        228        ----a-w-        c:\programdata\BrowserProtect\2.6.1125.80\{c16c1ccb-7046-4e5c-a2f3-533ad2fec8e8}\FirefoxExtension\content\overlay.xul
.
---- Directory of c:\users\***\AppData\Roaming\BabSolution ----
.
2013-03-25 20:16 . 2013-02-25 12:51        376427        ----a-w-        c:\users\***\AppData\Roaming\BabSolution\CR\Delta.crx
.
---- Directory of c:\windows\SysWow64\Extensions ----
.
.
---- Directory of c:\windows\SysWow64\searchplugins ----
.
.
.
((((((((((((((((((((((((((((  Autostartpunkte der Registrierung  ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"OfficeSyncProcess"="c:\program files (x86)\Microsoft Office\Office14\MSOSYNC.EXE" [2012-01-20 719672]
"AutoStartNPSAgent"="c:\program files (x86)\Samsung\Samsung New PC Studio\NPSAgent.exe" [2011-05-22 102400]
"swg"="c:\program files (x86)\Google\GoogleToolbarNotifier\GoogleToolbarNotifier.exe" [2011-02-17 39408]
"Skype"="c:\program files (x86)\Skype\Phone\Skype.exe" [2012-01-31 17147528]
"Pando Media Booster"="c:\program files (x86)\Pando Networks\Media Booster\PMB.exe" [2012-11-11 3093624]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run]
"HotkeyApp"="c:\program files (x86)\Launch Manager\HotkeyApp.exe" [2009-12-14 200704]
"LMgrVolOSD"="c:\program files (x86)\Launch Manager\OSD.exe" [2009-12-11 348960]
"Wbutton"="c:\program files (x86)\Launch Manager\Wbutton.exe" [2010-06-21 436264]
"NUSB3MON"="c:\program files (x86)\Renesas Electronics\USB 3.0 Host Controller Driver\Application\nusb3mon.exe" [2010-04-27 113288]
"CLMLServer"="c:\program files (x86)\CyberLink\Power2Go\CLMLSvc.exe" [2009-11-02 103720]
"YouCam Mirage"="c:\program files (x86)\CyberLink\YouCam\YCMMirage.exe" [2010-10-29 136488]
"LexwareInfoService"="c:\program files (x86)\Common Files\Lexware\Update Manager\LxUpdateManager.exe" [2010-09-15 339312]
"BCSSync"="c:\program files (x86)\Microsoft Office\Office14\BCSSync.exe" [2010-03-13 91520]
"Adobe Reader Speed Launcher"="c:\program files (x86)\Adobe\Reader 9.0\Reader\Reader_sl.exe" [2012-12-19 41208]
"Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-12-03 946352]
"iWareV3"="c:\program files (x86)\MouseDriver\OfficeMouse.exe" [2009-03-27 507904]
"avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-08-08 348664]
"APSDaemon"="c:\program files (x86)\Common Files\Apple\Apple Application Support\APSDaemon.exe" [2012-11-28 59280]
"ConnectionCenter"="c:\program files (x86)\Citrix\ICA Client\concentr.exe" [2011-04-25 305088]
"SunJavaUpdateSched"="c:\program files (x86)\Common Files\Java\Java Update\jusched.exe" [2012-09-17 254896]
"iTunesHelper"="c:\program files (x86)\iTunes\iTunesHelper.exe" [2012-12-12 152544]
.
c:\users\***\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\
FRITZ!DSL Startcenter.lnk - c:\program files (x86)\FRITZ!DSL\StCenter.exe [2011-2-21 679936]
.
c:\programdata\Microsoft\Windows\Start Menu\Programs\Startup\
HP Digital Imaging Monitor.lnk - c:\program files (x86)\HP\Digital Imaging\bin\hpqtra08.exe [2009-5-21 275768]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows]
"LoadAppInit_DLLs"=1 (0x1)
"AppInit_DLLs"=c:\windows\SysWOW64\nvinit.dll
.
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-01-31 158856]
R2 watchmi;watchmi service;c:\program files (x86)\watchmi\TvdService.exe [2010-12-06 62464]
R3 RSUSBSTOR;RtsUStor.Sys Realtek USB Card Reader;c:\windows\System32\Drivers\RtsUStor.sys [2010-05-24 246304]
R3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2009-06-10 187392]
R3 TFsExDisk;TFsExDisk;c:\windows\System32\Drivers\TFsExDisk.sys [x]
R3 USBAAPL64;Apple Mobile USB Driver;c:\windows\system32\Drivers\usbaapl64.sys [2012-09-28 53760]
R4 wlcrasvc;Windows Live Mesh remote connections service;c:\program files\Windows Live\Mesh\wlcrasvc.exe [2010-09-23 57184]
S0 nvpciflt;nvpciflt;c:\windows\system32\DRIVERS\nvpciflt.sys [2010-10-27 24680]
S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2011-12-15 27760]
S1 ctxusbm;Citrix USB Monitor Driver;c:\windows\system32\DRIVERS\ctxusbm.sys [2010-07-14 87600]
S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-05-09 86224]
S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2010-03-04 13336]
S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2010-10-27 236136]
S2 UNS;Intel(R) Management & Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2009-12-10 2320920]
S3 clwvd;CyberLink WebCam Virtual Driver;c:\windows\system32\DRIVERS\clwvd.sys [2010-10-29 31088]
S3 HECIx64;Intel(R) Management Engine Interface;c:\windows\system32\DRIVERS\HECIx64.sys [2009-09-18 56344]
S3 Impcd;Impcd;c:\windows\system32\DRIVERS\Impcd.sys [2010-02-27 158976]
S3 IntcDAud;Intel(R) Display Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2010-06-21 287232]
S3 L1C;NDIS Miniport Driver for Atheros AR813x/AR815x PCI-E Ethernet Controller;c:\windows\system32\DRIVERS\L1C62x64.sys [2010-03-04 75816]
S3 nusb3hub;Renesas Electronics USB 3.0 Hub Driver;c:\windows\system32\DRIVERS\nusb3hub.sys [2010-09-30 80384]
S3 nusb3xhc;Renesas Electronics USB 3.0 Host Controller Driver;c:\windows\system32\DRIVERS\nusb3xhc.sys [2010-09-30 180736]
S3 rtl8192se;Realtek Wireless LAN 802.11n PCI-E NIC NT Driver;c:\windows\system32\DRIVERS\rtl8192se.sys [2010-03-02 1098784]
S3 WisLMSvc;WisLMSvc;c:\program files (x86)\Launch Manager\WisLMSvc.exe [2009-10-23 118560]
.
.
[HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\svchost]
hpdevmgmt        REG_MULTI_SZ          hpqcxs08 hpqddsvc
.
Inhalt des "geplante Tasks" Ordners
.
2013-04-02 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-04-02 17:07]
.
2013-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 16:53]
.
2013-04-02 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files (x86)\Google\Update\GoogleUpdate.exe [2011-02-17 16:53]
.
.
--------- X64 Entries -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"SynTPEnh"="c:\program files (x86)\Synaptics\SynTP\SynTPEnh.exe" [BU]
"RtHDVCpl"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2010-09-02 11465320]
"RtHDVBg"="c:\program files\Realtek\Audio\HDA\RAVBg64.exe" [2010-09-02 2120808]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2010-08-25 161304]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2010-08-25 386584]
"Persistence"="c:\windows\system32\igfxpers.exe" [2010-08-25 415256]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Windows]
"AppInit_DLLs"=c:\windows\System32\nvinitx.dll
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = https://webaccess.krones.com/vpn/index.html
mStart Page = hxxp://www.google.com
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyOverride = *.local
IE: An OneNote s&enden - c:\progra~2\MICROS~2\Office14\ONBttnIE.dll/105
IE: Free YouTube Download - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm
IE: Free YouTube to MP3 Converter - c:\users\***\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
IE: Nach Microsoft E&xcel exportieren - c:\progra~2\MICROS~2\Office14\EXCEL.EXE/3000
IE: {{0B65DCC9-1740-43dc-B19C-4F309FB6A6CA} - hxxp://rover.ebay.com/rover/1/707-37276-17534-31/4
Trusted Zone: krones.com\webaccess
TCP: DhcpNameServer = 192.168.178.1
FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\lkickppl.default\
FF - prefs.js: browser.search.selectedEngine -
FF - prefs.js: browser.startup.homepage - hxxp://www.t-online.de/
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?SSPV=FFOB6&ctid=CT2319825&SearchSource=2&q=
FF - ExtSQL: 2013-03-27 15:32; ffxtlbr@delta.com; c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\lkickppl.default\extensions\ffxtlbr@delta.com
FF - ExtSQL: !HIDDEN! 2011-03-06 16:53; smartwebprinting@hp.com; c:\program files (x86)\HP\Digital Imaging\Smart Web Printing\MozillaAddOn3
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{DFEFCDEE-CF1A-4FC8-88AD-129872198372} - (no file)
AddRemove-FRITZ!DSL - c:\windows\IsUn0407.exe
AddRemove-LEGO Creator - c:\windows\IsUn0407.exe
.
.
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.htm\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.html\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.shtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xht\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_USERS\.Default\Software\Microsoft\Windows\CurrentVersion\Explorer\FileExts\.xhtml\UserChoice]
@Denied: (2) (LocalSystem)
"Progid"="ChromeHTML"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\system32\\Macromed\\Flash\\FlashUtil64_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil32_11_6_602_180_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{73C9DFA0-750D-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.11"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash32_11_6_602_180.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}]
@Denied: (A 2) (Everyone)
@="IFlashBroker5"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{6AE38AE0-750C-11E1-B0C4-0800200C9A66}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Office\Common\Smart Tag\Actions\{B7EFF951-E52F-45CC-9EF7-57124F2177CC}]
@Denied: (A) (Everyone)
"Solution"="{15727DE6-F92D-4E46-ACB4-0E2C58B31A18}"
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3]
@Denied: (A) (Everyone)
.
[HKEY_LOCAL_MACHINE\software\Wow6432Node\Microsoft\Schema Library\ActionsPane3\0]
"Key"="ActionsPane3"
"Location"="c:\\Program Files (x86)\\Common Files\\Microsoft Shared\\VSTO\\ActionsPane3.xsd"
.
[HKEY_LOCAL_MACHINE\system\ControlSet001\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
Zeit der Fertigstellung: 2013-04-02  20:59:01
ComboFix-quarantined-files.txt  2013-04-02 18:59
ComboFix2.txt  2013-04-02 06:15
.
Vor Suchlauf: 14 Verzeichnis(se), 489.621.315.584 Bytes frei
Nach Suchlauf: 15 Verzeichnis(se), 489.322.672.128 Bytes frei
.
- - End Of File - - D93515D6BACA48055F9E8218E9EBDA2F


Alle Zeitangaben in WEZ +1. Es ist jetzt 23:04 Uhr.
Seite 1 von 3 1 23
100 Beiträge dieses Themas auf einer Seite anzeigen

Copyright ©2000-2025, Trojaner-Board


Search Engine Optimization by vBSEO ©2011, Crawlability, Inc.

1 2 3 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21 22 23 24 25 26 27 28 29 30 31 32 33 34 35 36 37 38 39 40 41 42 43 44 45 46 47 48 49 50 51 52 53 54 55 56 57 58 59 60 61 62 63 64 65 66 67 68 69 70 71 72 73 74 75 76 77 78 79 80 81 82 83 84 85 86 87 88 89 90 91 92 93 94 95 96 97 98 99 100 101 102 103 104 105 106 107 108 109 110 111 112 113 114 115 116 117 118 119 120 121 122 123 124 125 126 127 128 129 130 131