| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: cmd.exe und mahmud.exe - Bundespolizei TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
30.11.2011, 23:22
| #1 |
| |  cmd.exe und mahmud.exe - Bundespolizei Trojaner Hallo, ich habe leider folgendes Problem bzw. Auffälligkeit: ich hatte vor ungefähr zwei Wochen den Bundespolizei-Trojaner (das ucash-Ding) auf meinem Laptop. Eigentlich dachte ich, ich hätte das ganz gut in den Griff bekommen bzw. hab Antiviren/Malware-Programme drüberlaufen lassen (AntiVir, Malewarebytes und AdAware). Seit dem hatte ich kein Problem mehr damit, allerdings startet in regelmäßigen Abständen jetzt immer die cmd.exe (windows/system32/cmd.exe) bzw. das Fenster blinkt für einen ganz kurzen Moment auf und verschwindet wieder (scheint aber nichts auszuführen, soweit ich das erkennen kann ist Fenster schwarz) Bin mir jetzt aber nicht sicher ob ich nicht das gleich wie hier: http://www.trojaner-board.de/105278-...r-ucash-2.html habe (was dann wohl der trojan.banker wäre, wenn ich das richtig verstanden habe). Online-Banking habe ich seit längerer Zeit nicht mehr gemacht, allerdings letztens was bei amazon bestellt... Vielen Dank für die Hilfe!! PS: Habe die cmd.exe bei VirusTotal hochgeladen, wurde aber nicht als Maleware erkannt |
|
01.12.2011, 07:43
| #2 |
  | cmd.exe und mahmud.exe - Bundespolizei Trojaner Hi,
__________________schonmal geprüft ob da eine Task im Aufgabenmanager angelegt ist...? OTL Lade Dir OTL von Oldtimer herunter (http://filepony.de/download-otl/) und speichere es auf Deinem Desktop * Doppelklick auf die OTL.exe * Vista/Win7 User: Rechtsklick auf die OTL.exe und "als Administrator ausführen" wählen * Oben findest Du ein Kästchen mit Output. Wähle bitte Minimal Output * Unter Extra Registry, wähle bitte Use SafeList * Klicke nun auf Run Scan links oben * Wenn der Scan beendet wurde werden 2 Logfiles erstellt * Poste die Logfiles hier in den Thread. chris
__________________ |
|
01.12.2011, 09:07
| #3 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner erst mal vielen dank für die schnelle Antwort.
__________________Bei dem OTL Scan kommt folgendes raus Extra.txtOTL Logfile: Code:
ATTFilter OTL Extras logfile created on: 01.12.2011 08:57:00 - Run 2
OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Mock\Desktop
Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation
Internet Explorer (Version = 7.0.6002.18005)
Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy
2,93 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 54,19% Memory free
6,07 Gb Paging File | 4,65 Gb Available in Paging File | 76,68% Paging File free
Paging file location(s): ?:\pagefile.sys [binary data]
%SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files
Drive C: | 179,48 Gb Total Space | 39,93 Gb Free Space | 22,25% Space Free | Partition Type: NTFS
Computer Name: MOCK | User Name: Mock | Logged in as Administrator.
Boot Mode: Normal | Scan Mode: Current user
Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days
========== Extra Registry (SafeList) ==========
========== File Associations ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>]
.cpl [@ = cplfile] -- C:\Windows\System32\control.exe (Microsoft Corporation)
.hlp [@ = hlpfile] -- C:\Windows\winhlp32.exe (Microsoft Corporation)
.url [@ = InternetShortcut] -- rundll32.exe ieframe.dll,OpenURL %l
[HKEY_CURRENT_USER\SOFTWARE\Classes\<extension>]
.html [@ = FirefoxHTML] -- C:\PROGRAM FILES\Mozilla Firefox\firefox.exe (Mozilla Corporation)
========== Shell Spawning ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command]
batfile [open] -- "%1" %*
cmdfile [open] -- "%1" %*
comfile [open] -- "%1" %*
cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation)
exefile [open] -- "%1" %*
helpfile [open] -- Reg Error: Key error.
hlpfile [open] -- %SystemRoot%\winhlp32.exe %1 (Microsoft Corporation)
htmlfile [edit] -- Reg Error: Key error.
htmlfile [print] -- rundll32.exe %windir%\system32\mshtml.dll,PrintHTML "%1"
inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation)
InternetShortcut [open] -- rundll32.exe ieframe.dll,OpenURL %l
piffile [open] -- "%1" %*
regfile [merge] -- Reg Error: Key error.
scrfile [config] -- "%1"
scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l
scrfile [open] -- "%1" /S
txtfile [edit] -- Reg Error: Key error.
Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1
Directory [AddToPlaylistVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --playlist-enqueue "%1" ()
Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation)
Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
Directory [PlayWithVLC] -- "C:\Program Files\VideoLAN\VLC\vlc.exe" --started-from-file --no-playlist-enqueue "%1" ()
Folder [open] -- %SystemRoot%\Explorer.exe /separate,/idlist,%I,%L (Microsoft Corporation)
Folder [explore] -- %SystemRoot%\Explorer.exe /separate,/e,/idlist,%I,%L (Microsoft Corporation)
Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation)
========== Security Center Settings ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center]
"cval" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring]
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring\McAfeeAntiSpyware]
"DisableMonitoring" = 1
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc]
"AntiVirusOverride" = 1
"AntiSpywareOverride" = 0
"FirewallOverride" = 1
"VistaSp1" = Reg Error: Unknown registry data type -- File not found
"VistaSp2" = Reg Error: Unknown registry data type -- File not found
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol]
========== Firewall Settings ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile]
"EnableFirewall" = 0
"DisableNotifications" = 0
========== Authorized Applications List ==========
========== Vista Active Open Ports Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1DB227C9-27B1-4C6B-999E-42C490BA7271}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{334B9019-922F-422F-AF7E-B6014A71AE67}" = lport=49486 | protocol=6 | dir=in | name=akamai netsession interface |
"{3690EFC6-1EC0-4859-A728-5DAEB618229B}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{3B34A9FF-9624-4C4D-9DD5-4979B7CE52ED}" = lport=5721 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{3E5243D8-93E5-49FB-8DB9-9CF21B04F31A}" = lport=1034 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{4D84FE09-4B53-4C78-849C-DB9CCE9DF133}" = lport=1034 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4003 |
"{4F08216E-068D-4E9A-93AE-70ABEB9C003E}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{57F7DF3E-B431-4D18-A1E7-8AFDCBBBAA80}" = lport=5353 | protocol=6 | dir=in | name=adobe csi cs4 |
"{5E2B7684-E40F-45DC-BBD1-91EEED476B44}" = lport=5000 | protocol=17 | dir=in | name=akamai netsession interface |
"{6D0B97FC-5272-4784-82D9-F7A655853670}" = lport=26675 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4006 |
"{6E2CF416-FF24-4AA1-9DCB-578221E12106}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{73406CD2-6F7C-419C-AAF7-0DFDC15D90C9}" = rport=5679 | protocol=17 | dir=out | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{8C2DA504-E276-4922-9958-439D35855557}" = lport=5721 | protocol=6 | dir=in | name=@%systemroot%\windowsmobile\wmdc.exe,-4002 |
"{8E6D3953-9566-4A54-BE8E-C770516B4702}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{D71E8B33-1C02-41A9-B976-4775641D4C87}" = lport=990 | protocol=6 | dir=in | svc=rapimgr | app=%systemroot%\system32\svchost.exe |
"{E4316C2D-CFAA-48ED-B511-543E7ECC9DD7}" = lport=999 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
"{EACE51EF-E68E-4BBC-999A-9C45B98AF6A1}" = lport=5678 | protocol=6 | dir=in | app=%systemroot%\windowsmobile\wmdhost.exe |
========== Vista Active Application Exception List ==========
[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules]
"{1E276B88-932B-4D8D-948C-98F00244155D}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{240F6ACE-ECAD-4725-91C7-45B933CB4794}" = protocol=17 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{4C893B30-5886-42A5-91BC-EAFCF4C4FDE9}" = protocol=6 | dir=in | app=c:\program files\itunes\itunes.exe |
"{573E4573-75B6-4DA8-8FCD-546B2E0E0095}" = dir=in | app=c:\program files\skype\phone\skype.exe |
"{7AD69C0B-449F-4ED2-B0FE-66DE8FEC6F38}" = protocol=6 | dir=in | app=c:\program files\common files\adobe\cs4servicemanager\cs4servicemanager.exe |
"{88FD1923-9682-4250-8F19-EC4F3554FC23}" = protocol=6 | dir=in | app=c:\users\mock\appdata\local\akamai\netsession_win.exe |
"{B374CD70-FFAC-4E0D-BB8F-E4D861EC8F8B}" = protocol=17 | dir=in | app=c:\users\mock\appdata\roaming\dropbox\bin\dropbox.exe |
"{B7D64ED8-AECC-45A8-9D01-52FFB7FF2F62}" = protocol=17 | dir=in | app=c:\users\mock\appdata\local\akamai\netsession_win.exe |
"{D963AE34-AFB9-4F72-9F11-0030901D5BCE}" = protocol=6 | dir=in | app=c:\users\mock\appdata\roaming\dropbox\bin\dropbox.exe |
"{F74BDF39-B1CE-4A8D-8BF0-2817D2679DBC}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"{F9C46D92-3DAE-4EDA-A1D2-C7EAD7068F51}" = protocol=17 | dir=in | app=c:\program files\itunes\itunes.exe |
"TCP Query User{5CF4B9ED-F6AF-4C94-BF79-153162F52E9E}C:\windows\system32\dplaysvr.exe" = protocol=6 | dir=in | app=c:\windows\system32\dplaysvr.exe |
"TCP Query User{F6C3F5F0-8D73-44F1-8CC6-D7DBAF8ADF3A}C:\program files\mozilla firefox\firefox.exe" = protocol=6 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{3F16CD0B-DD34-446A-AF99-F9ABE8D5B570}C:\program files\mozilla firefox\firefox.exe" = protocol=17 | dir=in | app=c:\program files\mozilla firefox\firefox.exe |
"UDP Query User{E8048E09-19A4-4E3C-95AD-33B4F0330CDB}C:\windows\system32\dplaysvr.exe" = protocol=17 | dir=in | app=c:\windows\system32\dplaysvr.exe |
========== HKEY_LOCAL_MACHINE Uninstall List ==========
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"{0001B4FD-9EA3-4D90-A79E-FD14BA3AB01D}" = PDFCreator
"{00ADFB20-AE75-46F4-AD2C-F48B15AC3100}" = Adobe Color NA Recommended Settings CS4
"{01501EBA-EC35-4F9F-8889-3BE346E5DA13}" = MSXML4 Parser
"{028ED9C4-25EE-4DEE-9CF4-91034BC89B18}" = Microsoft SQL Server 2005 Express Edition (MSSMLBIZ)
"{02E89EFC-7B07-4D5A-AA03-9EC0902914EE}" = VC 9.0 Runtime
"{03D1988F-469F-4843-8E6E-E5FE9D17889D}" = WIDCOMM Bluetooth Software 6.1.0.2200
"{052FDD78-A6EA-3187-8386-C82F4CA3A929}" = Microsoft .NET Framework 3.5 Language Pack SP1 - deu
"{05308C4E-7285-4066-BAE3-6B50DA6ED755}" = Adobe Update Manager CS4
"{054EFA56-2AC1-48F4-A883-0AB89874B972}" = Adobe Extension Manager CS4
"{07629207-FAA0-4F1A-8092-BF5085BE511F}" = Unterstützungsdateien für das Microsoft SQL Server-Setup (Englisch)
"{098727E1-775A-4450-B573-3F441F1CA243}" = kuler
"{0D2E9DCB-9938-475E-B4DD-8851738852FF}" = AIO_Scan
"{0D6013AB-A0C7-41DC-973C-E93129C9A29F}" = Adobe Color JA Extra Settings CS4
"{0D67A4E4-5BE0-4C9A-8AD8-AB552B433F23}" = Adobe Setup
"{0F723FC1-7606-4867-866C-CE80AD292DAF}" = Adobe CSI CS4
"{1618734A-3957-4ADD-8199-F973763109A8}" = Adobe Anchor Service CS4
"{16E16F01-2E2D-4248-A42F-76261C147B6C}" = Adobe Drive CS4
"{16E6D2C1-7C90-4309-8EC4-D2212690AAA4}" = AdobeColorCommonSetRGB
"{1746EA69-DCB6-4408-B5A5-E75F55439CDF}" = Scan
"{179C56A4-F57F-4561-8BBF-F911D26EB435}" = WebReg
"{1F1C2DFC-2D24-3E06-BCB8-725134ADF989}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.4148
"{1F2A5DF9-40E1-4644-ADBD-D80F347BA6C8}" = Windows Mobile-Gerätecenter
"{2018C019-30D9-4240-8C01-0865C10DCF5A}" = Unterstützung für VAIO-Präsentation
"{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"{23DD6DAA-DDEF-41F5-A527-CECF07FA2CAF}" = 1500
"{26A24AE4-039D-4CA4-87B4-2F83216020FF}" = Java(TM) 6 Update 29
"{28BE306E-5DA6-4F9C-BDB0-DBA3C8C6FFFD}" = QuickTime
"{291A772C-FFB9-4681-B720-AB2A0A620896}" = Adobe Reader for Pocket PC 2.0
"{295C31E5-3F91-498E-9623-DA24D2FA2B6A}" = T-Online WLAN-Access Finder
"{32364CEA-7855-4A3C-B674-53D8E9B97936}" = TuneUp Utilities 2012
"{3248F0A8-6813-11D6-A77B-00B0D0160060}" = Java(TM) 6 Update 6
"{326DC400-1FC4-4D7D-946D-06D1EAB93200}" = VAIO Guide
"{35D94F92-1D3A-43C5-8605-EA268B1A7BD9}" = PDF Settings CS4
"{39F6E2B4-CFE8-C30A-66E8-489651F0F34C}" = Adobe Media Player
"{3A4E8896-C2E7-4084-A4A4-B8FD1894E739}" = Adobe XMP Panels CS4
"{3B659FAD-E772-44A3-B7E7-560FF084669F}" = VAIO Smart Network
"{3C3901C5-3455-3E0A-A214-0B093A5070A6}" = Microsoft .NET Framework 4 Client Profile
"{3D2C9DE6-9ADE-4252-A241-E43723B0CE02}" = Adobe Color - Photoshop Specific CS4
"{3DA8DF9A-044E-46C4-8531-DEDBB0EE37FF}" = Adobe WinSoft Linguistics Plugin
"{3EE33958-7381-4E7B-A4F3-6E43098E9E9C}" = Browser Address Error Redirector
"{4943EFF5-229F-435D-BEA9-BE3CAEA783A7}" = Adobe Service Manager Extension
"{49F2B650-2D7B-4F59-B33D-346F63776BD3}" = DocProc
"{4A03706F-666A-4037-7777-5F2748764D10}" = Java Auto Updater
"{4cb9f93c-9edc-4be9-ae61-af128ddbecfa}" = Business Contact Manager für Outlook 2007 SP2
"{553255F3-78FD-40F1-A6F8-6882140265FE}" = Apple Application Support
"{5570C7F0-43D0-4916-8A9E-AEDD52FA86F4}" = Adobe Color EU Extra Settings CS4
"{56C049BE-79E9-4502-BEA7-9754A3E60F9B}" = neroxml
"{57B955CE-B5D3-495D-AF1B-FAEE0540BFEF}" = VAIO Data Restore Tool
"{5BEE8F1F-BD32-4553-8107-500439E43BD7}" = VAIO Update
"{5C5EE8F2-0B38-4C13-AE4E-A87A237FE718}" =
"{5ECB3A3C-980B-4D12-9724-25DCB07A1F47}" = iTunes
"{5F5867F0-2D23-4338-A206-01A76C823924}" = VAIO Energie Verwaltung
"{63C24A08-70F3-4C8E-B9FB-9F21A903801D}" = Adobe Color Video Profiles CS CS4
"{63E5CDBF-8214-4F03-84F8-CD3CE48639AD}" = Adobe Photoshop CS4 Support
"{65DA2EC9-0642-47E9-AAE2-B5267AA14D75}" = Activation Assistant for the 2007 Microsoft Office suites
"{66E6CE0C-5A1E-430C-B40A-0C90FF1804A8}" = eSupportQFolder
"{67D3F1A0-A1F2-49b7-B9EE-011277B170CD}" = HPProductAssistant
"{67F0E67A-8E93-4C2C-B29D-47C48262738A}" = Adobe Device Central CS4
"{68243FF8-83CA-466B-B2B8-9F99DA5479C4}" = AdobeColorCommonSetCMYK
"{6956856F-B6B3-4BE0-BA0B-8F495BE32033}" = Apple Software Update
"{69FDFBB6-351D-4B8C-89D8-867DC9D0A2A4}" = Windows Media Player Firefox Plugin
"{6F5E2F4A-377D-4700-B0E3-8F7F7507EA15}" = CustomerResearchQFolder
"{710f4c1c-cc18-4c49-8cbf-51240c89a1a2}" = Microsoft Visual C++ 2005 Redistributable
"{72042FA6-5609-489F-A8EA-3C2DD650F667}" = VAIO Control Center
"{72EEB695-388B-4835-8EA6-0C04545B06B9}" = Intel(R) PROSet/Wireless WiFi-Software
"{767CC44C-9BBC-438D-BAD3-FD4595DD148B}" = VC80CRTRedist - 8.0.50727.762
"{770657D0-A123-3C07-8E44-1C83EC895118}" = Microsoft Visual C++ 2005 ATL Update kb973923 - x86 8.0.50727.4053
"{786C5747-1033-0000-B58E-000000000001}" = Adobe Stock Photos 1.0
"{7A7DC702-DEDE-42A8-8722-B3BA724D546F}" = Fax
"{7B63B2922B174135AFC0E1377DD81EC2}" = DivX Codec
"{7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2 Trial
"{820D3F45-F6EE-4AAF-81EF-CE21FF21D230}" = Adobe Type Support CS4
"{83877DB1-8B77-45BC-AB43-2BAC22E093E0}" = Adobe Bridge CS4
"{842B4B72-9E8F-4962-B3C1-1C422A5C4434}" = Suite Shared Configuration CS4
"{86CE85E6-DBAC-3FFD-B977-E4B79F83C909}" = Microsoft Visual C++ 2008 Redistributable - KB2467174 - x86 9.0.30729.5570
"{87441A59-5E64-4096-A170-14EFE67200C3}" = Picture Control Utility
"{87E2B986-07E8-477a-93DC-AF0B6758B192}" = DocProcQFolder
"{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight
"{8ADFC4160D694100B5B8A22DE9DCABD9}" = DivX Player
"{8C6027FD-53DC-446D-BB75-CACD7028A134}" = HP Update
"{8EDBA74D-0686-4C99-BFDD-F894678E5101}" = Adobe Common File Installer
"{90120000-0020-0407-0000-0000000FF1CE}" = Compatibility Pack für 2007 Office System
"{9068B2BE-D93A-4C0A-861C-5E35E2C0E09E}" = Intel® Matrix Storage Manager
"{931AB7EA-3656-4BB7-864D-022B09E3DD67}" = Adobe Linguistics CS4
"{94D398EB-D2FD-4FD1-B8C4-592635E8A191}" = Adobe CMaps CS4
"{95120000-00B9-0409-0000-0000000FF1CE}" = Microsoft Application Error Reporting
"{95D08F4E-DFC2-4ce3-ACB7-8C8E206217E9}" = MarketResearch
"{96D0B6C6-5A72-4B47-8583-A87E55F5FE81}" =
"{978C25EE-5777-46e4-8988-732C297CBDBD}" = Status
"{9973498D-EA29-4A68-BE0B-C88D6E03E928}" = ArcSoft WebCam Companion 2
"{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17
"{9B1FD9CE-0776-4f0b-A6F5-C6AB7B650CDF}" = Destinations
"{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161
"{9DE1BE03-AFE2-4CDB-BFEB-D06D736CD01A}" = Apple Mobile Device Support
"{9F72EF8B-AEC9-4CA5-B483-143980AFD6FD}" = Alps Pointing-device for VAIO
"{A040AC77-C1AA-4CC9-8931-9F648AF178F6}" = VC 9.0 Runtime
"{A2101ACC-DC36-42AA-A576-6FD6A8D466DA}" = 1500_Help
"{A2BCA9F1-566C-4805-97D1-7FDC93386723}" = Adobe AIR
"{A36CD345-625C-4d6c-B3E2-76E1248CB451}" = SolutionCenter
"{A3B7C670-4A1E-4EE2-950E-C875BC1965D0}" = Copy
"{A4C6B32D-5088-40AF-B74D-CDABEF144F04}" = 1500Trb
"{A7DA438C-2E43-4C20-BFDA-C1F4A6208558}" = Setting Utility Series
"{AB5D51AE-EBC3-438D-872C-705C7C2084B0}" = DeviceManagementQFolder
"{AC76BA86-1033-F400-BA7E-000000000003}" = Adobe Acrobat 8 Standard - English, Français, Deutsch
"{B1275E23-717A-4D52-997A-1AD1E24BC7F3}" = T-Online 6.0
"{B13A7C41581B411290FBC0395694E2A9}" = DivX Converter
"{B29AD377-CC12-490A-A480-1452337C618D}" = Connect
"{B65BA85C-0A27-4BC0-A22D-A66F0E5B9494}" = Adobe Photoshop CS4
"{B7050CBDB2504B34BC2A9CA0A692CC29}" = DivX Web Player
"{B74D4E10-6884-0000-0000-000000000103}" = Adobe Bridge 1.0
"{BB4E33EC-8181-4685-96F7-8554293DEC6A}" = Adobe Output Module
"{BE77A81F-B315-4666-9BF3-AE70C0ADB057}" = BufferChm
"{C52E3EC1-048C-45E1-8D53-10B0C6509683}" = Adobe Default Language CS4
"{C716522C-3731-4667-8579-40B098294500}" = Toolbox
"{C7477742-DDB4-43E5-AC8D-0259E1E661B1}" = VAIO Event Service
"{C916D86C-AB76-49c7-B0E4-A946E0FD9BC2}" = HP Photosmart, Officejet, PSC and Deskjet All-In-One Driver Software 8.0.B
"{CB2F7EDD-9D1F-43C1-90FC-4F52EAE172A1}" = Microsoft .NET Framework 1.1
"{CB8CA439-DA83-419C-A4CF-5A0A50025144}" = Windows Mobile Device Center Driver Update
"{CC75AB5C-2110-4A7F-AF52-708680D22FE8}" = Photoshop Camera Raw
"{CE026CFE-73FE-4FED-9D5F-2C8D4DB512B0}" = TuneUp Utilities Language Pack (de-DE)
"{CE2CDD62-0124-36CA-84D3-9F4DCF5C5BD9}" = Microsoft .NET Framework 3.5 SP1
"{D103C4BA-F905-437A-8049-DB24763BBE36}" = Skype™ 4.2
"{D17D6E7A-DF1E-41E9-B8C2-0078110221A3}" = VAIO Update Merge Module x86
"{D2FCC1AE-6311-47C5-8130-C6C66D77DD71}" = Nikon Message Center
"{D60F97EC-EF06-4E1E-B0D1-C2CBABA62FA3}" = VAIO Wallpaper Contents
"{DFFC0648-BC4B-47D1-93D2-6CA6B9457641}" = OpenOffice.org 3.2
"{E06F04B9-45E6-4AC0-8083-85F7515F40F7}" = UnloadSupport
"{E09575B2-498D-4C8B-A9D2-623F78574F29}" = AIO_CDB_Software
"{E4848436-0345-47E2-B648-8B522FCDA623}" = Adobe Photoshop CS4
"{E7112940-5F8E-4918-B9FE-251F2F8DC81F}" = AIO_CDB_ProductContext
"{E78BFA60-5393-4C38-82AB-E8019E464EB4}" = Microsoft .NET Framework 1.1 German Language Pack
"{E9757890-7EC5-46C8-99AB-B00F07B6525C}" = Nikon Transfer
"{E9787678-1033-0000-8E67-000000000001}" = Adobe Help Center 1.0
"{EB21A812-671B-4D08-B974-2A347F0D8F70}" = HP Photosmart Essential
"{EB75DE50-5754-4F6F-875D-126EDF8E4CB3}" = HPSSupply
"{F007CBCE-D714-4C0B-8CE9-9B0D78116468}" = ViewNX
"{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219
"{F0E64E2E-3A60-40D8-A55D-92F6831875DA}" = Adobe Search for Help
"{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver
"{F1E63043-54FC-429B-AB2C-31AF9FBA4BC7}" = 32 Bit HP CIO Components Installer
"{F302F4F0-588D-6501-1ACF-BE3FDCC9135D}" = Adobe Community Help
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}" = Visual C++ 2008 x86 Runtime - (v9.0.30729)
"{F333A33D-125C-32A2-8DCE-5C5D14231E27}.vc_x86runtime_30729_01" = Visual C++ 2008 x86 Runtime - v9.0.30729.01
"{F46E21DF-5BE1-48E2-8390-5EEA8B25E36A}" = Microsoft SQL Server Native Client
"{F750C986-5310-3A5A-95F8-4EC71C8AC01C}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"{F850707C-B6A0-4B56-8709-F89CF8F9AC6D}" = Eraser
"{F8EF2B3F-C345-4F20-8FE4-791A20333CD5}" = Adobe ExtendScript Toolkit CS4
"{F93C84A6-0DC6-42AF-89FA-776F7C377353}" = Adobe PDF Library Files CS4
"{FCDD51BB-CAD0-4BB1-B7DF-CE86D1032794}" = Adobe Fonts All
"{FDE96E86-7780-431C-92F7-679C6A7CEC51}" = Microsoft SQL Server VSS Writer
"{FF075778-6E50-47ed-991D-3B07FD4E3250}" = TrayApp
"Activation Assistant for the 2007 Microsoft Office suites" = Activation Assistant for the 2007 Microsoft Office suites
"Adobe Acrobat 8 Standard - English, Français, Deutsch" = Adobe Acrobat 8.3.0 Standard
"Adobe Acrobat 8 Standard - English, Français, Deutsch_830" = Adobe Acrobat 8.3.0 - CPSID_83708
"Adobe AIR" = Adobe AIR
"Adobe Flash Player ActiveX" = Adobe Flash Player ActiveX
"Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin
"Adobe InDesign CS2 - {7F4C8163-F259-49A0-A018-2857A90578BC}" = Adobe InDesign CS2 Trial
"Adobe_faf656ef605427ee2f42989c3ad31b8" = Adobe Photoshop CS4
"Akamai" = Akamai NetSession Interface
"ASUS Skin" = ASUS Skin
"Avira AntiVir Desktop" = Avira Free Antivirus
"Business Contact Manager" = Business Contact Manager für Outlook 2007 SP2
"bxmig" = Favorit
"CDisplay_is1" = CDisplay 1.8
"chc.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Community Help
"com.adobe.amp.4875E02D9FB21EE389F73B8D1702B320485DF8CE.1" = Adobe Media Player
"dt icon module" =
"Eraser" = Eraser
"Free YouTube Download_is1" = Free YouTube Download version 2.10.33.324
"Free YouTube to MP3 Converter_is1" = Free YouTube to MP3 Converter version 3.2
"gtfirstboot Setting Request" =
"Guitar Pro 5_is1" = Guitar Pro 5.0
"HP Imaging Device Functions" = HP Imaging Device Functions 8.0
"HP Solution Center & Imaging Support Tools" = HP Solution Center 8.0
"HPExtendedCapabilities" = HP Customer Participation Program 8.0
"HPOCR" = HP OCR Software 8.0
"InstallShield_{20471B27-D702-4FE8-8DEC-0702CC8C0A85}" = WinDVD for VAIO
"InstallShield_{291A772C-FFB9-4681-B720-AB2A0A620896}" = Adobe Reader for Pocket PC 2.0
"LucasArts' TIE Fighter" = LucasArts' TIE Fighter
"Malwarebytes' Anti-Malware_is1" = Malwarebytes' Anti-Malware Version 1.51.2.1300
"MFU Module" =
"Microsoft .NET Framework 1.1 (1033)" = Microsoft .NET Framework 1.1
"Microsoft .NET Framework 3.5 Language Pack SP1 - deu" = Microsoft .NET Framework 3.5 Language Pack SP1 - DEU
"Microsoft .NET Framework 3.5 SP1" = Microsoft .NET Framework 3.5 SP1
"Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile
"Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack
"Microsoft SQL Server 2005" = Microsoft SQL Server 2005
"Mozilla Firefox (3.0.19)" = Mozilla Firefox (3.0.19)
"Mozilla Thunderbird (8.0)" = Mozilla Thunderbird (8.0)
"NVIDIA Drivers" = NVIDIA Drivers
"PC Tools Firewall Plus" = PC Tools Firewall Plus 6.0
"ProInst" = Intel PROSet Wireless
"Revo Uninstaller" = Revo Uninstaller 1.93
"SecureW2 EAP Suite" = SecureW2 EAP Suite 1.1.1 for Windows
"TuneUp Utilities 2012" = TuneUp Utilities 2012
"Uninstall_is1" = Uninstall 1.0.0.1
"USB Scanner" = USB Scanner
"VAIO Help and Support" =
"VAIO_My Club VAIO" = My Club VAIO
"VLC media player" = VLC media player 1.1.7
"Windows Mobile Device Handbook" = Windows Mobile®-Gerätehandbuch
"WinRAR archiver" = WinRAR
"Wise Registry Cleaner_is1" = Wise Registry Cleaner 6.14
========== HKEY_CURRENT_USER Uninstall List ==========
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall]
"Akamai" = Akamai NetSession Interface
"Dropbox" = Dropbox
========== Last 10 Event Log Errors ==========
[ Application Events ]
Error - 29.11.2011 08:05:03 | Computer Name = Mock | Source = VSS | ID = 8194
Description =
Error - 29.11.2011 08:07:26 | Computer Name = Mock | Source = Windows Search Service | ID = 3040
Description =
Error - 29.11.2011 08:09:30 | Computer Name = Mock | Source = Microsoft-Windows-RestartManager | ID = 10007
Description =
Error - 29.11.2011 08:12:22 | Computer Name = Mock | Source = VSS | ID = 8194
Description =
Error - 29.11.2011 08:29:25 | Computer Name = Mock | Source = VSS | ID = 8194
Description =
Error - 30.11.2011 06:17:36 | Computer Name = Mock | Source = WinMgmt | ID = 10
Description =
Error - 30.11.2011 06:26:37 | Computer Name = Mock | Source = WinMgmt | ID = 10
Description =
Error - 30.11.2011 17:35:56 | Computer Name = Mock | Source = Application Hang | ID = 1002
Description = Programm OTL.exe, Version 3.2.31.0 arbeitet nicht mehr mit Windows
zusammen und wurde beendet. Überprüfen Sie den Problemverlauf im Applet "Lösungen
für Probleme" in der Systemsteuerung, um nach weiteren Informationen über das Problem
zu suchen. Prozess-ID: 1300 Anfangszeit: 01ccafa7f1933750 Zeitpunkt der Beendigung:
16
Error - 01.12.2011 02:42:35 | Computer Name = Mock | Source = WinMgmt | ID = 10
Description =
Error - 01.12.2011 03:51:56 | Computer Name = Mock | Source = WinMgmt | ID = 10
Description =
[ System Events ]
Error - 30.11.2011 21:55:13 | Computer Name = Mock | Source = DCOM | ID = 10010
Description =
Error - 30.11.2011 21:55:24 | Computer Name = Mock | Source = Service Control Manager | ID = 7011
Description =
Error - 01.12.2011 02:42:01 | Computer Name = Mock | Source = PlugPlayManager | ID = 12
Description = Das Gerät "Mobile Intel(R) 45 Express Chipset Series PCI Express Root
Port - 2A41" (PCI\VEN_8086&DEV_2A41&SUBSYS_9025104D&REV_07\3&21436425&0&08) wurde
ohne vorbereitende Maßnahmen vom System entfernt.
Error - 01.12.2011 02:42:36 | Computer Name = Mock | Source = Service Control Manager | ID = 7000
Description =
Error - 01.12.2011 02:42:36 | Computer Name = Mock | Source = Service Control Manager | ID = 7000
Description =
Error - 01.12.2011 02:42:52 | Computer Name = Mock | Source = Service Control Manager | ID = 7026
Description =
Error - 01.12.2011 03:51:18 | Computer Name = Mock | Source = PlugPlayManager | ID = 12
Description = Das Gerät "Mobile Intel(R) 45 Express Chipset Series PCI Express Root
Port - 2A41" (PCI\VEN_8086&DEV_2A41&SUBSYS_9025104D&REV_07\3&21436425&0&08) wurde
ohne vorbereitende Maßnahmen vom System entfernt.
Error - 01.12.2011 03:51:57 | Computer Name = Mock | Source = Service Control Manager | ID = 7000
Description =
Error - 01.12.2011 03:51:57 | Computer Name = Mock | Source = Service Control Manager | ID = 7000
Description =
Error - 01.12.2011 03:51:57 | Computer Name = Mock | Source = Service Control Manager | ID = 7026
Description =
< End of report >
_________________ und OTL.txt OTL Logfile: Code:
ATTFilter OTL logfile created on: 01.12.2011 08:57:00 - Run 2 OTL by OldTimer - Version 3.2.31.0 Folder = C:\Users\Mock\Desktop Windows Vista Business Edition Service Pack 2 (Version = 6.0.6002) - Type = NTWorkstation Internet Explorer (Version = 7.0.6002.18005) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 2,93 Gb Total Physical Memory | 1,59 Gb Available Physical Memory | 54,19% Memory free 6,07 Gb Paging File | 4,65 Gb Available in Paging File | 76,68% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files Drive C: | 179,48 Gb Total Space | 39,93 Gb Free Space | 22,25% Space Free | Partition Type: NTFS Computer Name: MOCK | User Name: Mock | Logged in as Administrator. Boot Mode: Normal | Scan Mode: Current user Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Processes (SafeList) ========== PRC - C:\Users\Mock\Desktop\OTL.exe (OldTimer Tools) PRC - C:\Programme\Mozilla Thunderbird\thunderbird.exe (Mozilla Messaging) PRC - C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software) PRC - C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe (TuneUp Software) PRC - C:\Programme\Avira\AntiVir Desktop\avshadow.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) PRC - C:\Programme\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation) PRC - C:\Programme\Sony\VAIO Update 5\VAIOUpdt.exe (Sony Corporation) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) PRC - C:\Programme\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) PRC - C:\Programme\Microsoft SQL Server\90\Shared\sqlbrowser.exe (Microsoft Corporation) PRC - C:\Programme\Mozilla Firefox\firefox.exe (Mozilla Corporation) PRC - C:\Programme\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools) PRC - C:\Programme\PC Tools Firewall Plus\FWService.exe (PC Tools) PRC - C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) PRC - C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) PRC - C:\Windows\explorer.exe (Microsoft Corporation) PRC - C:\Windows\System32\conime.exe (Microsoft Corporation) PRC - C:\Programme\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation) PRC - C:\Programme\Sony\VAIO Event Service\VESMgrSub.exe (Sony Corporation) PRC - C:\Programme\Sony\VAIO Power Management\SPMgr.exe (Sony Corporation) PRC - C:\Programme\Sony\VAIO Power Management\SPMService.exe (Sony Corporation) PRC - C:\Windows\RTKAUDIOSERVICE.EXE (Realtek Semiconductor) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) PRC - C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) PRC - C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.) PRC - C:\Programme\Apoint\ApntEx.exe (Alps Electric Co., Ltd.) PRC - C:\Programme\Apoint\ApMsgFwd.exe (Alps Electric Co., Ltd.) PRC - C:\Programme\Windows Defender\MSASCui.exe (Microsoft Corporation) ========== Modules (No Company Name) ========== MOD - C:\Programme\Mozilla Thunderbird\mozjs.dll () MOD - C:\Programme\Mozilla Thunderbird\nsldap32v60.dll () MOD - C:\Programme\Mozilla Thunderbird\nsldappr32v60.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityMode#\09d9d35b68b4fe07c1d2f25e2533f21e\System.IdentityModel.Selectors.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.IdentityModel\dbcb4baf3d2ed9e62645bd332fc221f2\System.IdentityModel.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Runtime.Seri#\4b4c359912c1241246f50a4c47dbab3c\System.Runtime.Serialization.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\SMDiagnostics\a800035f1686fdb0b7a019b954a37cfe\SMDiagnostics.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.ServiceModel\6b2ee1fdc6a182722db04af9c3cd10c3\System.ServiceModel.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Web\e00630ec1e225a2376fdd430645e20f7\System.Web.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Configuration\40da9084d0863e07d7ce55953833b8b0\System.Configuration.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Xml\c1c06a392871267db27f7cbc40e1c4fb\System.Xml.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Windows.Forms\1363115565fff5a641243a48f396f107\System.Windows.Forms.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System.Drawing\367c4043efc2f32d843cb588b0dc97fc\System.Drawing.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\System\f9c36ea806e77872dce891c77b68fac3\System.ni.dll () MOD - C:\Windows\assembly\NativeImages_v2.0.50727_32\mscorlib\b6632a8b2f276a8e31f5b0f6b2006cd1\mscorlib.ni.dll () MOD - C:\Windows\assembly\GAC_MSIL\System.ServiceModel.resources\3.0.0.0_de_b77a5c561934e089\System.ServiceModel.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\mscorlib.resources\2.0.0.0_de_b77a5c561934e089\mscorlib.resources.dll () MOD - C:\Windows\assembly\GAC_MSIL\SPMDam\3.0.0.4140__1b3c579b6925895f\SPMDam.dll () MOD - C:\Windows\assembly\GAC_MSIL\SPMCommon\3.0.0.4140__e3c7096ba83f9295\SPMCommon.dll () ========== Win32 Services (SafeList) ========== SRV - (Nero BackItUp Scheduler 4.0) -- File not found SRV - (TuneUp.UtilitiesSvc) -- C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe (TuneUp Software) SRV - (Akamai) -- c:\program files\common files\akamai/netsession_win_d768ebc.dll () SRV - (AntiVirSchedulerService) -- C:\Program Files\Avira\AntiVir Desktop\sched.exe (Avira Operations GmbH & Co. KG) SRV - (AntiVirService) -- C:\Program Files\Avira\AntiVir Desktop\avguard.exe (Avira Operations GmbH & Co. KG) SRV - (VUAgent) -- C:\Program Files\Sony\VAIO Update Common\VUAgent.exe (Sony Corporation) SRV - (MBAMService) -- C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe (Malwarebytes Corporation) SRV - (FLEXnet Licensing Service) -- C:\Program Files\Common Files\Macrovision Shared\FLEXnet Publisher\FNPLicensingService.exe (Acresso Software Inc.) SRV - (PCToolsFirewallPlus) -- C:\Programme\PC Tools Firewall Plus\FWService.exe (PC Tools) SRV - (EvtEng) Intel(R) -- C:\Programme\Intel\WiFi\bin\EvtEng.exe (Intel(R) Corporation) SRV - (RegSrvc) Intel(R) -- C:\Programme\Common Files\Intel\WirelessCommon\RegSrvc.exe (Intel(R) Corporation) SRV - (BcmSqlStartupSvc) -- C:\Program Files\Microsoft Small Business\Business Contact Manager\BcmSqlStartupSvc.exe (Microsoft Corporation) SRV - (NSUService) -- C:\Program Files\Sony\Network Utility\NSUService.exe (Sony Corporation) SRV - (VAIO Event Service) -- C:\Programme\Sony\VAIO Event Service\VESMgr.exe (Sony Corporation) SRV - (VAIO Power Management) -- C:\Program Files\Sony\VAIO Power Management\SPMService.exe (Sony Corporation) SRV - (RtkAudioService) -- C:\Windows\RTKAUDIOSERVICE.EXE (Realtek Semiconductor) SRV - (IAANTMON) Intel(R) -- C:\Programme\Intel\Intel Matrix Storage Manager\IAANTmon.exe (Intel Corporation) SRV - (WinDefend) -- C:\Programme\Windows Defender\MpSvc.dll (Microsoft Corporation) SRV - (WcesComm) -- C:\Windows\WindowsMobile\wcescomm.dll (Microsoft Corporation) SRV - (RapiMgr) -- C:\Windows\WindowsMobile\rapimgr.dll (Microsoft Corporation) SRV - (IviRegMgr) -- C:\Programme\Common Files\InterVideo\RegMgr\iviRegMgr.exe (InterVideo) ========== Driver Services (SafeList) ========== DRV - (TuneUpUtilitiesDrv) -- C:\Programme\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys (TuneUp Software) DRV - (avipbb) -- C:\Windows\System32\drivers\avipbb.sys (Avira GmbH) DRV - (avgntflt) -- C:\Windows\System32\drivers\avgntflt.sys (Avira GmbH) DRV - (avkmgr) -- C:\Windows\System32\drivers\avkmgr.sys (Avira GmbH) DRV - (MBAMProtector) -- C:\Windows\System32\drivers\mbam.sys (Malwarebytes Corporation) DRV - (sptd) -- C:\Windows\System32\Drivers\sptd.sys () DRV - (ssmdrv) -- C:\Windows\System32\drivers\ssmdrv.sys (Avira GmbH) DRV - (pctplfw) -- C:\Windows\System32\drivers\pctplfw.sys (PC Tools) DRV - (pctNDIS) -- C:\Windows\System32\drivers\pctNdis.sys (PC Tools) DRV - (PCTFW-PacketFilter) -- C:\Windows\System32\drivers\pctNdis-PacketFilter.sys (PC Tools) DRV - (PCTFW-DNS) -- C:\Windows\System32\drivers\pctNdis-DNS.sys (PC Tools) DRV - (pctgntdi) -- C:\Windows\System32\drivers\pctgntdi.sys (PC Tools) DRV - (PCTAppEvent) -- C:\Windows\System32\drivers\PCTAppEvent.sys (PC Tools) DRV - (ZYXEL750) -- C:\Windows\System32\drivers\WLANUTG.SYS (Texas Instruments) DRV - (NETw5v32) Intel(R) -- C:\Windows\System32\drivers\NETw5v32.sys (Intel Corporation) DRV - (mcdbus) -- C:\Windows\System32\drivers\mcdbus.sys (MagicISO, Inc.) DRV - (DNE) -- C:\Windows\System32\drivers\dne2000.sys (Deterministic Networks, Inc.) DRV - (nvlddmkm) -- C:\Windows\System32\drivers\nvlddmkm.sys (NVIDIA Corporation) DRV - (DMICall) -- C:\Windows\System32\drivers\DMICall.sys (Sony Corporation) DRV - (e1yexpress) Intel(R) -- C:\Windows\System32\drivers\e1y6032.sys (Intel Corporation) DRV - (risdptsk) -- C:\Windows\System32\drivers\risdptsk.sys (REDC) DRV - (rimsptsk) -- C:\Windows\System32\drivers\rimsptsk.sys (REDC) DRV - (ApfiltrService) -- C:\Windows\System32\drivers\Apfiltr.sys (Alps Electric Co., Ltd.) DRV - (shpf) -- C:\Windows\system32\DRIVERS\shpf.sys (Sony Corporation) DRV - (TPM) -- C:\Windows\System32\drivers\tpm.sys (Microsoft Corporation) DRV - (SPI) -- C:\Windows\System32\drivers\SonyPI.sys (Sony Corporation) DRV - (SFEP) -- C:\Windows\System32\drivers\SFEP.sys (Sony Corporation) DRV - (WimFltr) -- C:\Windows\System32\drivers\WimFltr.sys (Microsoft Corporation) DRV - (regi) -- C:\Windows\System32\drivers\regi.sys (InterVideo) DRV - (CVirtA) -- C:\Windows\System32\drivers\CVirtA.sys (Cisco Systems, Inc.) DRV - (XAudio) -- C:\Windows\System32\drivers\XAudio.sys (Conexant Systems, Inc.) DRV - (MTOnlPktAlyX) -- C:\Programme\T-Online\T-Online_Software_6\Basis-Software\Basis1\MTOnlPktAlyx.sys (Deutsche Telekom AG AG, Marmiko IT-Solutions GmbH) DRV - (VNUSB) -- C:\Windows\System32\drivers\VNUSB.sys (OLYMPUS IMAGING CORP.) ========== Standard Registry (SafeList) ========== ========== Internet Explorer ========== IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com IE - HKLM\SOFTWARE\Microsoft\Internet Explorer\Main,Local Page = %SystemRoot%\system32\blank.htm IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Page_URL = hxxp://www.club-vaio.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Default_Secondary_Page_URL = [Binary data over 100 bytes] IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Bar = hxxp://www.google.com/ie IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Search Page = hxxp://www.google.com IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = about:blank IE - HKCU\SOFTWARE\Microsoft\Internet Explorer\Main,StartPageCache = 1 IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyEnable" = 0 ========== FireFox ========== FF - prefs.js..browser.search.useDBForOrder: true FF - prefs.js..browser.startup.homepage: "en.wikipedia.org/" FF - prefs.js..extensions.enabledItems: {ACAA314B-EEBA-48e4-AD47-84E31C44796C}:1.0.1 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA}:6.0.20 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA}:6.0.22 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA}:6.0.23 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA}:6.0.24 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA}:6.0.26 FF - prefs.js..extensions.enabledItems: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA}:6.0.29 FF - prefs.js..extensions.enabledItems: {ada4b710-8346-4b82-8199-5de2b400a6ae}:1.9.9.4.3 FF - prefs.js..network.proxy.autoconfig_url: "hxxp://pac.lrz-muenchen.de/" FF - HKLM\Software\MozillaPlugins\@adobe.com/FlashPlayer: C:\Windows\system32\Macromed\Flash\NPSWF32.dll () FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=: File not found FF - HKLM\Software\MozillaPlugins\@Apple.com/iTunes,version=1.0: C:\Program Files\iTunes\Mozilla Plugins\npitunes.dll () FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Browser Plugin,version=1.0.0: C:\Program Files\DivX\DivX Web Player\npdivx32.dll (DivX,Inc.) FF - HKLM\Software\MozillaPlugins\@divx.com/DivX Player Plugin,version=1.0.0: C:\Program Files\DivX\DivX Player\npDivxPlayerPlugin.dll (DivX, Inc) FF - HKLM\Software\MozillaPlugins\@java.com/JavaPlugin: C:\Program Files\Java\jre6\bin\new_plugin\npjp2.dll (Sun Microsystems, Inc.) FF - HKLM\Software\MozillaPlugins\@Microsoft.com/NpCtrl,version=1.0: c:\Program Files\Microsoft Silverlight\4.0.60831.0\npctrl.dll ( Microsoft Corporation) FF - HKLM\Software\MozillaPlugins\@microsoft.com/WPF,version=3.5: c:\Windows\Microsoft.NET\Framework\v3.5\Windows Presentation Foundation\NPWPF.dll (Microsoft Corporation) FF - HKEY_LOCAL_MACHINE\software\mozilla\Firefox\Extensions\\{8AA36F4F-6DC7-4c06-77AF-5035170634FE}: C:\ProgramData\Swiss Academic Software\Citavi Picker\Firefox [2011.06.20 22:41:39 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Components: C:\PROGRAM FILES\Mozilla Firefox\components [2010.05.31 12:27:19 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Firefox 3.0.19\extensions\\Plugins: C:\PROGRAM FILES\Mozilla Firefox\plugins [2011.06.21 08:50:46 | 000,000,000 | ---D | M] FF - HKEY_LOCAL_MACHINE\software\mozilla\Mozilla Thunderbird 8.0\extensions\\Components: C:\Program Files\Mozilla Thunderbird\components [2011.08.23 19:37:58 | 000,000,000 | ---D | M] [2010.11.26 21:18:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mock\AppData\Roaming\mozilla\Extensions [2010.11.26 21:18:42 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mock\AppData\Roaming\mozilla\Extensions\{3550f703-e582-4d05-9a08-453d09bdfdc6} [2011.11.30 11:41:40 | 000,000,000 | ---D | M] (No name found) -- C:\Users\Mock\AppData\Roaming\mozilla\Firefox\Profiles\0ad0zd7d.default\extensions [2010.08.07 11:42:26 | 000,000,000 | ---D | M] (Microsoft .NET Framework Assistant) -- C:\Users\Mock\AppData\Roaming\mozilla\Firefox\Profiles\0ad0zd7d.default\extensions\{20a82645-c095-46ed-80e3-08825760534b} [2011.04.06 22:27:52 | 000,000,000 | ---D | M] ("DVDVideoSoft Menu") -- C:\Users\Mock\AppData\Roaming\mozilla\Firefox\Profiles\0ad0zd7d.default\extensions\{ACAA314B-EEBA-48e4-AD47-84E31C44796C} [2011.11.29 13:29:34 | 000,000,000 | ---D | M] (ReminderFox) -- C:\Users\Mock\AppData\Roaming\mozilla\Firefox\Profiles\0ad0zd7d.default\extensions\{ada4b710-8346-4b82-8199-5de2b400a6ae} [2011.04.12 19:41:15 | 000,002,059 | ---- | M] () -- C:\Users\Mock\AppData\Roaming\Mozilla\Firefox\Profiles\0ad0zd7d.default\searchplugins\daemon-search.xml [2011.11.17 10:34:35 | 000,000,000 | ---D | M] (No name found) -- C:\Programme\Mozilla Firefox\extensions [2008.10.13 00:29:35 | 000,000,000 | ---D | M] (Firefox Companion for eBay) -- C:\Programme\Mozilla Firefox\extensions\{62760FD6-B943-48C9-AB09-F99C6FE96088} [2010.06.05 09:12:26 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.10.31 12:25:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.18 14:35:43 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.23 15:11:37 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.06.21 09:22:41 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011.11.17 10:34:35 | 000,000,000 | ---D | M] (Java Console) -- C:\Programme\Mozilla Firefox\extensions\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2010.06.05 09:12:26 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0020-ABCDEFFEDCBA} [2010.10.31 12:25:37 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0022-ABCDEFFEDCBA} [2011.01.18 14:35:43 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0023-ABCDEFFEDCBA} [2011.02.23 15:11:37 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0024-ABCDEFFEDCBA} [2011.06.21 09:22:41 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0026-ABCDEFFEDCBA} [2011.11.17 10:34:35 | 000,000,000 | ---D | M] (Java Console) -- C:\PROGRAM FILES\MOZILLA FIREFOX\EXTENSIONS\{CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} [2011.10.03 05:06:04 | 000,476,904 | ---- | M] (Sun Microsystems, Inc.) -- C:\Program Files\mozilla firefox\plugins\npdeployJava1.dll [2008.11.27 05:56:37 | 000,001,392 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\amazondotcom-de.xml [2008.11.27 05:56:37 | 000,002,344 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\eBay-de.xml [2008.11.27 05:56:37 | 000,006,805 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\leo_ende_de.xml [2008.11.27 05:56:37 | 000,000,986 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\wikipedia-de.xml [2008.11.27 05:56:37 | 000,000,801 | ---- | M] () -- C:\Program Files\mozilla firefox\searchplugins\yahoo-de.xml O1 HOSTS File: ([2010.12.25 17:04:34 | 000,000,762 | ---- | M]) - C:\Windows\System32\drivers\etc\hosts O1 - Hosts: 127.0.0.1 localhost O1 - Hosts: 127.0.0.1 activate.adobe.com O2 - BHO: (Adobe PDF Reader) - {06849E9F-C8D7-4D59-B87D-784B7D6BE0B3} - C:\Programme\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelper.dll (Adobe Systems Incorporated) O2 - BHO: (Adobe PDF Conversion Toolbar Helper) - {AE7CD045-E861-484f-8273-0445EE161910} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - No CLSID value found. O3 - HKLM\..\Toolbar: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found. O3 - HKCU\..\Toolbar\WebBrowser: (Adobe PDF) - {47833539-D0C5-4125-9FA8-0819E2EAAC93} - C:\Programme\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O4 - HKLM..\Run: [] File not found O4 - HKLM..\Run: [00PCTFW] C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe (PC Tools) O4 - HKLM..\Run: [AdobeCS4ServiceManager] C:\Program Files\Common Files\Adobe\CS4ServiceManager\CS4ServiceManager.exe (Adobe Systems Incorporated) O4 - HKLM..\Run: [Apoint] C:\Programme\Apoint\Apoint.exe (Alps Electric Co., Ltd.) O4 - HKLM..\Run: [avgnt] C:\Program Files\Avira\AntiVir Desktop\avgnt.exe (Avira Operations GmbH & Co. KG) O4 - HKLM..\Run: [IAAnotif] C:\Programme\Intel\Intel Matrix Storage Manager\IAAnotif.exe (Intel Corporation) O4 - HKLM..\Run: [Malwarebytes' Anti-Malware] C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe (Malwarebytes Corporation) O4 - HKLM..\Run: [NvCplDaemon] C:\Windows\System32\NvCpl.dll (NVIDIA Corporation) O4 - HKLM..\Run: [RtHDVCpl] C:\Windows\RtHDVCpl.exe (Realtek Semiconductor) O4 - HKLM..\Run: [Windows Defender] C:\Program Files\Windows Defender\MSASCui.exe (Microsoft Corporation) O4 - HKCU..\Run: [Akamai NetSession Interface] C:\Users\Mock\AppData\Local\Akamai\netsession_win.exe (Akamai Technologies, Inc) O4 - HKCU..\Run: [Eraser] C:\Program Files\Eraser\Eraser.exe (The Eraser Project) O4 - HKCU..\Run: [NSUFloatingUI] C:\Program Files\Sony\Network Utility\LANUtil.exe (Sony Corporation) O4 - Startup: C:\Users\Mock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\Adobe Gamma.lnk = C:\Programme\Common Files\Adobe\Calibration\Adobe Gamma Loader.exe (Adobe Systems, Inc.) O7 - HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\Explorer: NoDriveTypeAutoRun = 145 O8 - Extra context menu item: An vorhandenes PDF anfügen - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Ausgewählte Verknüpfungen in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Auswahl in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Bild an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie_ctx.htm () O8 - Extra context menu item: Free YouTube Download - C:\Users\Mock\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubedownload.htm () O8 - Extra context menu item: In Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Nach Microsoft E&xel exportieren - res://C:\PROGRA~1\MICROS~1\Office12\EXCEL.EXE/3000 File not found O8 - Extra context menu item: Seite an &Bluetooth-Gerät senden... - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O8 - Extra context menu item: Verknüpfungsziel in Adobe PDF konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O8 - Extra context menu item: Verknüpfungsziel in vorhandene PDF-Datei konvertieren - C:\Program Files\Adobe\Acrobat 8.0\Acrobat\AcroIEFavClient.dll (Adobe Systems Incorporated) O9 - Extra Button: @C:\Windows\WindowsMobile\INetRepl.dll,-222 - {2EAF5BB1-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra 'Tools' menuitem : @C:\Windows\WindowsMobile\INetRepl.dll,-223 - {2EAF5BB2-070F-11D3-9307-00C04FAE2D4F} - C:\Windows\WindowsMobile\INetRepl.dll (Microsoft Corporation) O9 - Extra Button: @btrez.dll,-4015 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O9 - Extra 'Tools' menuitem : @btrez.dll,-12650 - {CCA281CA-C863-46ef-9331-5C8D4460577F} - C:\Programme\WIDCOMM\Bluetooth Software\btsendto_ie.htm () O13 - gopher Prefix: missing O16 - DPF: {8AD9C840-044E-11D1-B3E9-00805F499D93} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-0016-0000-0029-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O16 - DPF: {CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} hxxp://java.sun.com/update/1.6.0/jinstall-1_6_0_29-windows-i586.cab (Java Plug-in 1.6.0_29) O17 - HKLM\System\CCS\Services\Tcpip\Parameters: DhcpNameServer = 192.168.178.1 O17 - HKLM\System\CCS\Services\Tcpip\Parameters\Interfaces\{52965E3B-500A-4AE9-B258-7897E0E4ED09}: DhcpNameServer = 192.168.178.1 O18 - Protocol\Handler\skype4com {FFC8B962-9B40-4DFF-9458-1830C7DD7F5D} - C:\Programme\Common Files\Skype\Skype4COM.dll (Skype Technologies) O20 - HKLM Winlogon: Shell - (explorer.exe) -C:\Windows\explorer.exe (Microsoft Corporation) O20 - HKLM Winlogon: UserInit - (C:\Windows\system32\userinit.exe) -C:\Windows\System32\userinit.exe (Microsoft Corporation) O20 - Winlogon\Notify\VESWinlogon: DllName - (VESWinlogon.dll) - C:\Windows\System32\VESWinlogon.dll (Sony Corporation) O24 - Desktop WallPaper: C:\Users\Mock\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O24 - Desktop BackupWallPaper: C:\Users\Mock\AppData\Roaming\Microsoft\Windows Photo Gallery\Hintergrundbild der Windows-Fotogalerie.jpg O27 - HKLM IFEO\presentationhost.exe: Debugger - C:\Program Files\TuneUp Utilities 2012\TUAutoReactivator32.exe (TuneUp Software) O32 - HKLM CDRom: AutoRun - 1 O32 - AutoRun File - [2006.09.18 22:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ] O33 - MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\Shell - "" = AutoRun O33 - MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\Shell\AutoRun\command - "" = E:\setup\rsrc\Autorun.exe O33 - MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\Shell\dinstall\command - "" = E:\Directx\dxsetup.exe O33 - MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\Shell - "" = AutoRun O33 - MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\Shell\AutoRun\command - "" = G:\setup\rsrc\Autorun.exe O33 - MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe O34 - HKLM BootExecute: (autocheck autochk *) O35 - HKLM\..comfile [open] -- "%1" %* O35 - HKLM\..exefile [open] -- "%1" %* O37 - HKLM\...com [@ = comfile] -- "%1" %* O37 - HKLM\...exe [@ = exefile] -- "%1" %* ========== Files/Folders - Created Within 30 Days ========== [2011.11.30 22:35:02 | 000,584,192 | ---- | C] (OldTimer Tools) -- C:\Users\Mock\Desktop\OTL.exe [2011.11.30 22:14:37 | 000,000,000 | ---D | C] -- C:\Users\Mock\Desktop\cmd [2011.11.30 18:10:31 | 000,000,000 | ---D | C] -- C:\Users\Mock\Desktop\computerspiele entwickler werden - fragezeichen [2011.11.29 13:03:03 | 000,000,000 | ---D | C] -- C:\Users\Mock\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Revo Uninstaller [2011.11.29 13:03:02 | 000,000,000 | ---D | C] -- C:\Program Files\VS Revo Group [2011.11.29 12:58:24 | 000,000,000 | ---D | C] -- C:\ProgramData\{83C3B2FD-37EA-4C06-A228-E9B5E32FF0B1} [2011.11.29 12:57:17 | 002,617,176 | ---- | C] (VS Revo Group Ltd.) -- C:\Users\Mock\Desktop\revosetup193.exe [2011.11.29 12:49:51 | 000,031,552 | ---- | C] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2011.11.29 12:49:50 | 000,021,312 | ---- | C] (TuneUp Software) -- C:\Windows\System32\authuitu.dll [2011.11.29 12:49:41 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012 [2011.11.29 12:49:13 | 000,000,000 | ---D | C] -- C:\Users\Mock\AppData\Roaming\TuneUp Software [2011.11.29 12:48:41 | 000,000,000 | ---D | C] -- C:\Program Files\TuneUp Utilities 2012 [2011.11.29 12:47:49 | 000,000,000 | ---D | C] -- C:\ProgramData\TuneUp Software [2011.11.29 12:46:17 | 000,000,000 | -HSD | C] -- C:\ProgramData\{32364CEA-7855-4A3C-B674-53D8E9B97936} [2011.11.29 12:45:12 | 026,489,760 | ---- | C] (TuneUp Software) -- C:\Users\Mock\Desktop\TuneUpUtilities2012_de-DE.exe [2011.11.29 12:43:34 | 000,000,000 | ---D | C] -- C:\Users\Mock\AppData\Local\PackageAware [2011.11.27 21:28:52 | 000,000,000 | ---D | C] -- C:\Windows\pss [2011.11.26 18:59:48 | 000,101,720 | ---- | C] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys [2011.11.26 18:58:33 | 000,000,000 | ---D | C] -- C:\Users\Mock\AppData\Roaming\Malwarebytes [2011.11.26 18:58:20 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Malwarebytes' Anti-Malware [2011.11.26 18:58:19 | 000,000,000 | ---D | C] -- C:\ProgramData\Malwarebytes [2011.11.26 18:58:14 | 000,022,216 | ---- | C] (Malwarebytes Corporation) -- C:\Windows\System32\drivers\mbam.sys [2011.11.26 18:58:14 | 000,000,000 | ---D | C] -- C:\Program Files\Malwarebytes' Anti-Malware [2011.11.26 18:51:40 | 009,852,544 | ---- | C] (Malwarebytes Corporation ) -- C:\Users\Mock\Desktop\mbam-setup-1.51.2.1300.exe [2011.11.24 12:11:06 | 000,000,000 | ---D | C] -- C:\Users\Mock\AppData\Roaming\Avira [2011.11.24 12:05:46 | 000,000,000 | ---D | C] -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Avira [2011.11.24 12:05:36 | 000,028,520 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\ssmdrv.sys [2011.11.24 12:05:35 | 000,134,344 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avipbb.sys [2011.11.24 12:05:35 | 000,074,640 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avgntflt.sys [2011.11.24 12:05:35 | 000,036,000 | ---- | C] (Avira GmbH) -- C:\Windows\System32\drivers\avkmgr.sys [2011.11.24 12:05:30 | 000,000,000 | ---D | C] -- C:\ProgramData\Avira [2011.11.24 12:05:30 | 000,000,000 | ---D | C] -- C:\Program Files\Avira [2011.11.17 10:34:33 | 000,157,472 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaws.exe [2011.11.17 10:34:33 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\javaw.exe [2011.11.17 10:34:33 | 000,145,184 | ---- | C] (Sun Microsystems, Inc.) -- C:\Windows\System32\java.exe [2011.11.11 14:45:12 | 000,000,000 | ---D | C] -- C:\Users\Mock\Desktop\League_of_Extraordinary_Gentlemen_V2 [2011.11.11 14:45:06 | 000,000,000 | ---D | C] -- C:\Users\Mock\Desktop\The_League_of_Extraordinary_Gentlemen_Vol_3_-__Century_1910 [2011.11.11 14:44:57 | 000,000,000 | ---D | C] -- C:\Users\Mock\Desktop\The_League_of_Extraordinary_Gentlemen__-_The_Black_Dossier [2011.11.11 10:29:59 | 000,000,000 | ---D | C] -- C:\Users\Mock\AppData\Local\Akamai [2011.11.03 20:50:51 | 000,000,000 | ---D | C] -- C:\Users\Mock\dwhelper [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files - Modified Within 30 Days ========== [2011.12.01 08:56:35 | 000,040,993 | ---- | M] () -- C:\ProgramData\nvModes.dat [2011.12.01 08:56:35 | 000,040,993 | ---- | M] () -- C:\ProgramData\nvModes.001 [2011.12.01 08:56:21 | 000,732,432 | ---- | M] () -- C:\Windows\System32\perfh007.dat [2011.12.01 08:56:21 | 000,681,988 | ---- | M] () -- C:\Windows\System32\perfh009.dat [2011.12.01 08:56:21 | 000,170,640 | ---- | M] () -- C:\Windows\System32\perfc007.dat [2011.12.01 08:56:21 | 000,138,366 | ---- | M] () -- C:\Windows\System32\perfc009.dat [2011.12.01 08:51:15 | 000,003,616 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-1.C7483456-A289-439d-8115-601632D005A0 [2011.12.01 08:51:15 | 000,003,616 | ---- | M] () -- C:\Windows\System32\7B296FB0-376B-497e-B012-9C450E1B7327-2P-0.C7483456-A289-439d-8115-601632D005A0 [2011.12.01 08:51:11 | 000,067,584 | --S- | M] () -- C:\Windows\bootstat.dat [2011.12.01 07:47:29 | 000,000,012 | ---- | M] () -- C:\Windows\bthservsdp.dat [2011.11.30 22:35:06 | 000,584,192 | ---- | M] (OldTimer Tools) -- C:\Users\Mock\Desktop\OTL.exe [2011.11.29 23:32:53 | 000,000,227 | ---- | M] () -- C:\Users\Mock\Desktop\good bad worse.rtf [2011.11.29 19:02:47 | 004,031,101 | ---- | M] () -- C:\Users\Mock\Desktop\System der politischen Oekonomie.pdf [2011.11.29 19:01:32 | 000,052,836 | ---- | M] () -- C:\Users\Mock\Desktop\Georg_Franck_Wien.pdf [2011.11.29 13:09:26 | 000,001,594 | ---- | M] () -- C:\Windows\VPNUnInstall.MIF [2011.11.29 12:57:23 | 002,617,176 | ---- | M] (VS Revo Group Ltd.) -- C:\Users\Mock\Desktop\revosetup193.exe [2011.11.29 12:45:50 | 026,489,760 | ---- | M] (TuneUp Software) -- C:\Users\Mock\Desktop\TuneUpUtilities2012_de-DE.exe [2011.11.28 16:12:12 | 000,000,853 | ---- | M] () -- C:\Users\Mock\Desktop\berliner staatsbib - werbung.rtf [2011.11.27 13:34:41 | 000,003,805 | ---- | M] () -- C:\Users\Mock\Desktop\werner herzog.rtf [2011.11.26 18:59:47 | 000,101,720 | ---- | M] (Sunbelt Software) -- C:\Windows\System32\drivers\SBREDrv.sys [2011.11.26 18:51:59 | 009,852,544 | ---- | M] (Malwarebytes Corporation ) -- C:\Users\Mock\Desktop\mbam-setup-1.51.2.1300.exe [2011.11.24 11:05:25 | 084,419,032 | ---- | M] () -- C:\Users\Mock\Desktop\avira_free_antivirus_de.exe [2011.11.22 18:55:54 | 000,401,796 | ---- | M] () -- C:\Users\Mock\Desktop\Kreatives_Schreiben_M_Falkenberg.pdf [2011.11.21 15:42:57 | 000,128,915 | ---- | M] () -- C:\Users\Mock\Desktop\das kapital - neu lesen.pdf [2011.11.21 15:36:11 | 000,004,446 | ---- | M] () -- C:\Users\Mock\Desktop\kapital.rtf [2011.11.18 14:13:54 | 000,031,552 | ---- | M] (TuneUp Software) -- C:\Windows\System32\TURegOpt.exe [2011.11.18 14:13:54 | 000,021,312 | ---- | M] (TuneUp Software) -- C:\Windows\System32\authuitu.dll [2011.11.13 11:11:53 | 000,414,368 | ---- | M] (Adobe Systems Incorporated) -- C:\Windows\System32\FlashPlayerCPLApp.cpl [2011.11.07 23:41:35 | 000,002,735 | ---- | M] () -- C:\Users\Mock\Desktop\versprechen - krimi.rtf [2011.11.06 14:43:37 | 000,648,692 | ---- | M] () -- C:\Users\Mock\Desktop\IJN_carrier_Amagi_capsized_off_Kure_in_1946.jpg [2011.11.05 13:47:52 | 000,023,522 | ---- | M] () -- C:\Users\Mock\Desktop\alan moore - behind the painted smile.rtf [2 C:\Windows\System32\*.tmp files -> C:\Windows\System32\*.tmp -> ] [1 C:\Windows\*.tmp files -> C:\Windows\*.tmp -> ] ========== Files Created - No Company Name ========== [2011.11.29 23:32:52 | 000,000,227 | ---- | C] () -- C:\Users\Mock\Desktop\good bad worse.rtf [2011.11.29 19:02:47 | 004,031,101 | ---- | C] () -- C:\Users\Mock\Desktop\System der politischen Oekonomie.pdf [2011.11.29 19:00:14 | 000,052,836 | ---- | C] () -- C:\Users\Mock\Desktop\Georg_Franck_Wien.pdf [2011.11.29 13:06:38 | 000,001,594 | ---- | C] () -- C:\Windows\VPNUnInstall.MIF [2011.11.29 12:49:41 | 000,001,877 | ---- | C] () -- C:\ProgramData\Microsoft\Windows\Start Menu\Programs\TuneUp Utilities 2012.lnk [2011.11.28 16:12:12 | 000,000,853 | ---- | C] () -- C:\Users\Mock\Desktop\berliner staatsbib - werbung.rtf [2011.11.27 13:01:01 | 000,003,805 | ---- | C] () -- C:\Users\Mock\Desktop\werner herzog.rtf [2011.11.24 11:02:56 | 084,419,032 | ---- | C] () -- C:\Users\Mock\Desktop\avira_free_antivirus_de.exe [2011.11.22 18:47:24 | 000,401,796 | ---- | C] () -- C:\Users\Mock\Desktop\Kreatives_Schreiben_M_Falkenberg.pdf [2011.11.21 15:42:57 | 000,128,915 | ---- | C] () -- C:\Users\Mock\Desktop\das kapital - neu lesen.pdf [2011.11.21 15:33:51 | 000,004,446 | ---- | C] () -- C:\Users\Mock\Desktop\kapital.rtf [2011.11.07 23:40:06 | 000,002,735 | ---- | C] () -- C:\Users\Mock\Desktop\versprechen - krimi.rtf [2011.11.06 14:43:37 | 000,648,692 | ---- | C] () -- C:\Users\Mock\Desktop\IJN_carrier_Amagi_capsized_off_Kure_in_1946.jpg [2011.11.05 13:47:52 | 000,023,522 | ---- | C] () -- C:\Users\Mock\Desktop\alan moore - behind the painted smile.rtf [2011.05.02 20:37:40 | 000,000,146 | ---- | C] () -- C:\Windows\WININIT.INI [2011.01.24 16:05:30 | 000,164,247 | ---- | C] () -- C:\Windows\hpoins19.dat [2011.01.24 16:04:47 | 000,026,952 | ---- | C] () -- C:\Windows\hpomdl19.dat [2011.01.02 02:38:12 | 000,000,268 | RH-- | C] () -- C:\Users\Mock\AppData\Roaming\manual [2011.01.02 02:38:12 | 000,000,268 | RH-- | C] () -- C:\ProgramData\AccountTypes [2011.01.02 02:38:12 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdw.DAT [2011.01.02 02:35:39 | 000,000,268 | RH-- | C] () -- C:\ProgramData\vhosts [2011.01.02 02:35:39 | 000,000,268 | RH-- | C] () -- C:\Users\Mock\AppData\Roaming\laserjet [2011.01.02 02:35:39 | 000,000,020 | -H-- | C] () -- C:\ProgramData\PKP_DLdu.DAT [2010.09.25 23:11:28 | 000,000,000 | ---- | C] () -- C:\Windows\System32\Access.dat [2010.09.08 15:44:17 | 000,116,224 | ---- | C] () -- C:\Windows\System32\pdfcmnnt.dll [2010.03.16 15:59:24 | 000,000,054 | ---- | C] () -- C:\Windows\System32\rp_stats.dat [2010.03.16 15:59:24 | 000,000,039 | ---- | C] () -- C:\Windows\System32\rp_rules.dat [2010.01.09 23:37:57 | 000,267,031 | ---- | C] () -- C:\Users\Mock\AppData\Local\khlptqub_nav.dat [2010.01.09 23:37:57 | 000,003,497 | ---- | C] () -- C:\Users\Mock\AppData\Local\khlptqub.dat [2010.01.09 23:37:57 | 000,003,084 | ---- | C] () -- C:\Users\Mock\AppData\Local\khlptqub_navps.dat [2009.12.16 20:13:07 | 000,002,560 | ---- | C] () -- C:\Windows\_MSRSTRT.EXE [2009.10.20 21:17:47 | 000,107,612 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchema.bin [2009.10.20 21:17:46 | 000,117,248 | ---- | C] () -- C:\Windows\System32\EhStorAuthn.dll [2009.10.20 21:17:00 | 000,062,976 | ---- | C] () -- C:\Windows\System32\PrintBrmUi.exe [2009.10.01 11:12:34 | 000,047,104 | ---- | C] () -- C:\Windows\System32\KMVIDC32.DLL [2009.10.01 00:41:21 | 000,000,090 | ---- | C] () -- C:\Users\Mock\AppData\Local\yseqcc.bat [2009.06.21 23:55:50 | 000,000,466 | RHS- | C] () -- C:\ProgramData\ntuser.pol [2009.04.24 19:38:15 | 000,000,532 | ---- | C] () -- C:\Users\Mock\AppData\Roaming\wklnhst.dat [2009.03.07 00:20:56 | 000,000,092 | ---- | C] () -- C:\Users\Mock\AppData\Local\fusioncache.dat [2009.01.30 18:41:10 | 000,000,056 | -H-- | C] () -- C:\ProgramData\ezsidmv.dat [2008.10.25 22:53:36 | 000,000,162 | ---- | C] () -- C:\Windows\nsreg.dat [2008.10.13 02:04:01 | 000,018,904 | ---- | C] () -- C:\Windows\System32\StructuredQuerySchemaTrivial.bin [2008.10.13 01:01:47 | 000,051,712 | ---- | C] () -- C:\Users\Mock\AppData\Local\DCBC2A71-70D8-4DAN-EHR8-E0D61DEA3FDF.ini [2008.10.07 11:32:08 | 000,000,680 | ---- | C] () -- C:\Users\Mock\AppData\Local\d3d9caps.dat [2008.09.19 22:57:34 | 003,596,288 | ---- | C] () -- C:\Windows\System32\qt-dx331.dll [2008.09.19 22:54:18 | 000,012,288 | ---- | C] () -- C:\Windows\System32\DivXWMPExtType.dll [2008.08.05 08:02:20 | 000,000,000 | ---- | C] () -- C:\Windows\VAIOUpdt.INI [2008.08.05 07:49:27 | 000,000,209 | ---- | C] () -- C:\Windows\ODBCINST.INI [2008.07.09 09:29:34 | 000,040,993 | ---- | C] () -- C:\ProgramData\nvModes.dat [2008.07.09 09:29:34 | 000,040,993 | ---- | C] () -- C:\ProgramData\nvModes.001 [2008.07.09 08:42:37 | 000,000,012 | ---- | C] () -- C:\Windows\bthservsdp.dat [2008.06.25 01:07:22 | 002,192,024 | ---- | C] () -- C:\Windows\System32\igkrng500.bin [2008.06.25 01:07:02 | 000,147,172 | ---- | C] () -- C:\Windows\System32\igfcg550.bin [2008.06.25 01:06:56 | 000,492,496 | ---- | C] () -- C:\Windows\System32\igcompkrng500.bin [2008.01.21 09:31:48 | 000,732,432 | ---- | C] () -- C:\Windows\System32\perfh007.dat [2008.01.21 09:31:48 | 000,290,748 | ---- | C] () -- C:\Windows\System32\perfi007.dat [2008.01.21 09:31:48 | 000,170,640 | ---- | C] () -- C:\Windows\System32\perfc007.dat [2008.01.21 09:31:48 | 000,036,916 | ---- | C] () -- C:\Windows\System32\perfd007.dat [2007.10.30 09:44:52 | 000,393,216 | ---- | C] () -- C:\Windows\System32\btwhidcs.dll [2007.04.16 02:24:16 | 000,023,752 | ---- | C] () -- C:\Windows\System32\providers.bin [2006.11.02 13:56:48 | 000,067,584 | --S- | C] () -- C:\Windows\bootstat.dat [2006.11.02 13:47:43 | 002,509,432 | ---- | C] () -- C:\Windows\System32\FNTCACHE.DAT [2006.11.02 11:33:01 | 000,681,988 | ---- | C] () -- C:\Windows\System32\perfh009.dat [2006.11.02 11:33:01 | 000,287,440 | ---- | C] () -- C:\Windows\System32\perfi009.dat [2006.11.02 11:33:01 | 000,138,366 | ---- | C] () -- C:\Windows\System32\perfc009.dat [2006.11.02 11:33:01 | 000,030,674 | ---- | C] () -- C:\Windows\System32\perfd009.dat [2006.11.02 11:25:26 | 000,557,568 | ---- | C] () -- C:\Windows\System32\hpotscl1.dll [2006.11.02 11:23:21 | 000,215,943 | ---- | C] () -- C:\Windows\System32\dssec.dat [2006.11.02 09:58:30 | 000,043,131 | ---- | C] () -- C:\Windows\mib.bin [2006.11.02 09:19:00 | 000,000,741 | ---- | C] () -- C:\Windows\System32\NOISE.DAT [2006.11.02 08:40:29 | 000,013,750 | ---- | C] () -- C:\Windows\System32\pacerprf.ini [2006.11.02 08:25:31 | 000,673,088 | ---- | C] () -- C:\Windows\System32\mlang.dat [2006.04.17 09:14:00 | 000,097,388 | ---- | C] () -- C:\Windows\System32\drivers\Fwusb1b.bin [2001.11.14 12:56:00 | 001,802,240 | ---- | C] () -- C:\Windows\System32\lcppn21.dll [2000.08.29 08:40:10 | 000,006,137 | ---- | C] () -- C:\Windows\System32\E1.ini [2000.08.02 14:47:20 | 000,026,112 | ---- | C] () -- C:\Windows\RunUnDrv.exe ========== Alternate Data Streams ========== @Alternate Data Stream - 172 bytes -> C:\Users\Mock\Desktop\Immatrikulationsbescheinigung.JPG:3or4kl4x13tuuug3Byamue2s4b @Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B606BA34 @Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:C31F31E6 < End of report > Geändert von martin2und3 (01.12.2011 um 09:16 Uhr) |
|
01.12.2011, 09:44
| #4 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner Hi, wir setzen doch nicht etwa nicht lizensierte SW ein? O1 - Hosts: 127.0.0.1 activate.adobe.com Bitte den Inhalt (nicht ausführen) von folgender Datei posten: C:\Users\Mock\AppData\Local\yseqcc.bat Dateien Online überprüfen lassen:
Code:
ATTFilter C:\Windows\RunUnDrv.exe
Reste einer alten Infektionsind auch noch drauf...
 Code:
ATTFilter :OTL
O2 - BHO: (no name) - {CA6319C0-31B7-401E-A518-A07C3DB8F777} - No CLSID value found.
O3 - HKCU\..\Toolbar\WebBrowser: (no name) - {32099AAC-C132-4136-9E9A-4E364A424E17} - No CLSID value found.
O4 - HKLM..\Run: [] File not found
O33 - MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\Shell - "" = AutoRun
O33 - MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\Shell\AutoRun\command - "" = E:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\Shell\dinstall\command - "" = E:\Directx\dxsetup.exe
O33 - MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\Shell - "" = AutoRun
O33 - MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\Shell\AutoRun\command - "" = G:\setup\rsrc\Autorun.exe
O33 - MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\Shell\dinstall\command - "" = G:\Directx\dxsetup.exe
[2010.01.09 23:37:57 | 000,267,031 | ---- | C] () -- C:\Users\Mock\AppData\Local\khlptqub_nav.dat
[2010.01.09 23:37:57 | 000,003,497 | ---- | C] () -- C:\Users\Mock\AppData\Local\khlptqub.dat
[2010.01.09 23:37:57 | 000,003,084 | ---- | C] () -- C:\Users\Mock\AppData\Local\khlptqub_navps.dat
@Alternate Data Stream - 112 bytes -> C:\ProgramData\TEMP:B606BA34
@Alternate Data Stream - 110 bytes -> C:\ProgramData\TEMP:C31F31E6
:Commands
[emptytemp]
[EMPTYFLASH]
[Reboot]
chris
__________________  Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden  ) |
|
01.12.2011, 10:02
| #5 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner okay, hier erst mal das Ergebnis von VT zur RunUnDrv.exe 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is goodware. 0 VT Community user(s) with a total of 0 reputation credit(s) say(s) this sample is malware. File name: RunUnDrv.exe Submission date: 2011-12-01 08:41:49 (UTC) Current status: queued queued analysing finished Result: 1/ 43 (2.3%) VT Community not reviewed Safety score: - Compact Print results Antivirus Version Last Update Result AhnLab-V3 2011.11.30.00 2011.11.30 - AntiVir 7.11.18.142 2011.12.01 - Antiy-AVL 2.0.3.7 2011.12.01 - Avast 6.0.1289.0 2011.11.30 - AVG 10.0.0.1190 2011.11.30 - BitDefender 7.2 2011.12.01 - ByteHero 1.0.0.1 2011.11.29 - CAT-QuickHeal 12.00 2011.12.01 - ClamAV 0.97.3.0 2011.12.01 - Commtouch 5.3.2.6 2011.12.01 - Comodo 10797 2011.12.01 - DrWeb 5.0.2.03300 2011.12.01 - Emsisoft 5.1.0.11 2011.12.01 - eSafe 7.0.17.0 2011.11.30 Win32.Malware eTrust-Vet 37.0.9596 2011.11.30 - F-Prot 4.6.5.141 2011.11.29 - F-Secure 9.0.16440.0 2011.12.01 - Fortinet 4.3.388.0 2011.12.01 - GData 22.292/22.543 2011.12.01 - Ikarus T3.1.1.109.0 2011.12.01 - Jiangmin 13.0.900 2011.11.30 - K7AntiVirus 9.119.5570 2011.11.30 - Kaspersky 9.0.0.837 2011.12.01 - McAfee 5.400.0.1158 2011.12.01 - McAfee-GW-Edition 2010.1D 2011.12.01 - Microsoft 1.7903 2011.12.01 - NOD32 6668 2011.11.29 - Norman 6.07.13 2011.11.30 - nProtect 2011-12-01.01 2011.12.01 - Panda 10.0.3.5 2011.11.30 - PCTools 8.0.0.5 2011.12.01 - Prevx 3.0 2011.12.01 - Rising 23.86.03.01 2011.12.01 - Sophos 4.71.0 2011.12.01 - SUPERAntiSpyware 4.40.0.1006 2011.12.01 - Symantec 20111.2.0.82 2011.12.01 - TheHacker 6.7.0.1.352 2011.11.30 - TrendMicro 9.500.0.1008 2011.12.01 - TrendMicro-HouseCall 9.500.0.1008 2011.12.01 - VBA32 3.12.16.4 2011.12.01 - VIPRE 11186 2011.12.01 - ViRobot 2011.12.1.4802 2011.12.01 - VirusBuster 14.1.93.0 2011.11.30 - Additional information Show all MD5 : 36ed1e6cf0e94ff49c5dc8fcffedc7ea SHA1 : 1eec6ed7292db8c8c9e1cf766b8f87c2fbfdab4b SHA256: e84f8c7be8db133ebb7b063b14d6d7278daa5af4f6962e35806f5f7820e3b8ba ssdeep: 384:8Zoc4n9T+TJKoDlU36dobGsudZ7R+4HvTZe3mgMz:8Zoc8+hKd7QPHvA3mg File size : 26112 bytes First seen: 2009-01-31 15:57:17 Last seen : 2011-12-01 08:41:49 TrID: Win32 Executable MS Visual C++ (generic) (63.0%) Win32 Executable Generic (14.2%) Win32 Dynamic Link Library (generic) (12.6%) Clipper DOS Executable (3.3%) Generic Win/DOS Executable (3.3%) sigcheck: publisher....: n/a copyright....: n/a product......: n/a description..: n/a original name: n/a internal name: n/a file version.: n/a comments.....: n/a signers......: - signing date.: - verified.....: Unsigned PEiD: InstallShield 2000 PEInfo: PE structure information [[ basic data ]] entrypointaddress: 0x18C0 timedatestamp....: 0x39881859 (Wed Aug 02 12:47:21 2000) machinetype......: 0x14c (I386) [[ 3 section(s) ]] name, viradd, virsiz, rawdsiz, ntropy, md5 .text, 0x1000, 0x2F36, 0x3000, 6.38, c7585e40ff94551847bf9a5642e559ac .rdata, 0x4000, 0x866, 0xA00, 4.68, 4995e5f32a7868a0e6ce1d7552ce9985 .data, 0x5000, 0x2C18, 0x2800, 0.80, 9691b26a510b127e9baf2d702d2aedcb [[ 2 import(s) ]] KERNEL32.dll: GetACP, DeleteFileA, CopyFileA, GetTempFileNameA, GetTempPathA, FreeLibrary, SetErrorMode, GetProcAddress, LoadLibraryA, MultiByteToWideChar, FreeEnvironmentStringsA, VirtualAlloc, HeapAlloc, GetLastError, GetFileAttributesA, ExitProcess, TerminateProcess, GetCurrentProcess, SetFileAttributesA, GetModuleHandleA, GetStartupInfoA, GetCommandLineA, GetVersion, GetCPInfo, GetPrivateProfileStringA, GetOEMCP, UnhandledExceptionFilter, GetModuleFileNameA, GetStringTypeW, HeapFree, FreeEnvironmentStringsW, GetEnvironmentStrings, GetEnvironmentStringsW, WideCharToMultiByte, SetHandleCount, GetStdHandle, GetFileType, HeapDestroy, HeapCreate, VirtualFree, RtlUnwind, WriteFile, LCMapStringA, LCMapStringW, GetStringTypeA USER32.dll: GetTopWindow, MessageBoxA, wsprintfA ExifTool: file metadata CodeSize: 12288 EntryPoint: 0x18c0 FileSize: 26 kB FileType: Win32 EXE ImageVersion: 0.0 InitializedDataSize: 14336 LinkerVersion: 5.1 MIMEType: application/octet-stream MachineType: Intel 386 or later, and compatibles OSVersion: 4.0 PEType: PE32 Subsystem: Windows GUI SubsystemVersion: 4.0 TimeStamp: 2000:08:02 14:47:21+02:00 UninitializedDataSize: 0 VT Community 0 This file has never been reviewed by any VT Community member. Be the first one to comment on it! bin mir gerade nicht ganz sicher wie ich den Inhalt der yseqcc.bat posten soll ohne sie ausversehen auszuführen.. geht das irgendwie mit "öffnen mit" oder wie mache ich das? oder kann ich die einfach mit nem doppelklick öffnen? |
|
01.12.2011, 10:11
| #6 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner und hier noch das Ergebnis von OTL All processes killed ========== OTL ========== Registry key HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{CA6319C0-31B7-401E-A518-A07C3DB8F777}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{CA6319C0-31B7-401E-A518-A07C3DB8F777}\ deleted successfully. Registry value HKEY_CURRENT_USER\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser\\{32099AAC-C132-4136-9E9A-4E364A424E17} deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{32099AAC-C132-4136-9E9A-4E364A424E17}\ not found. Registry value HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run\\ deleted successfully. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\ not found. File E:\setup\rsrc\Autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{5cfe6009-c8fc-11df-a7a2-baa264f0f35a}\ not found. File E:\Directx\dxsetup.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\ deleted successfully. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dba770ca-794c-11de-bc3d-001a80d630c1}\ not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dba770ca-794c-11de-bc3d-001a80d630c1}\ not found. File G:\setup\rsrc\Autorun.exe not found. Registry key HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Explorer\MountPoints2\{dba770ca-794c-11de-bc3d-001a80d630c1}\ not found. Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{dba770ca-794c-11de-bc3d-001a80d630c1}\ not found. File G:\Directx\dxsetup.exe not found. C:\Users\Mock\AppData\Local\khlptqub_nav.dat moved successfully. C:\Users\Mock\AppData\Local\khlptqub.dat moved successfully. C:\Users\Mock\AppData\Local\khlptqub_navps.dat moved successfully. ADS C:\ProgramData\TEMP:B606BA34 deleted successfully. ADS C:\ProgramData\TEMP:C31F31E6 deleted successfully. ========== COMMANDS ========== [EMPTYTEMP] User: Administrator User: All Users User: Default ->Temp folder emptied: 16498 bytes ->Temporary Internet Files folder emptied: 33170 bytes ->Flash cache emptied: 41818 bytes User: Default User ->Temp folder emptied: 0 bytes ->Temporary Internet Files folder emptied: 0 bytes ->Flash cache emptied: 0 bytes User: Mock ->Temp folder emptied: 96621174 bytes ->Temporary Internet Files folder emptied: 9484700 bytes ->Java cache emptied: 10974745 bytes ->FireFox cache emptied: 97057368 bytes ->Flash cache emptied: 427749 bytes User: Public %systemdrive% .tmp files removed: 0 bytes %systemroot% .tmp files removed: 0 bytes %systemroot%\System32 .tmp files removed: 1249280 bytes %systemroot%\System32\drivers .tmp files removed: 0 bytes Windows Temp folder emptied: 12040444 bytes RecycleBin emptied: 871425696 bytes Total Files Cleaned = 1.048,00 mb [EMPTYFLASH] User: Administrator User: All Users User: Default ->Flash cache emptied: 0 bytes User: Default User ->Flash cache emptied: 0 bytes User: Mock ->Flash cache emptied: 0 bytes User: Public Total Flash Files Cleaned = 0,00 mb OTL by OldTimer - Version 3.2.31.0 log created on 12012011_100250 Files\Folders moved on Reboot... Registry entries deleted on Reboot... |
|
01.12.2011, 19:35
| #7 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner Hi, prüfen wir noch auf Rootkit... TDSS-Killer Download und Anweisung unter: Wie werden Schadprogramme der Familie Rootkit.Win32.TDSS bekämpft? Entpacke alle Dateien in einem eigenen Verzeichnis (z. B: C:\TDSS)! Aufruf über den Explorer duch Doppelklick auf die TDSSKiller.exe. Nach dem Start erscheint ein Fenster, dort dann "Start Scan". Wenn der Scan fertig ist bitte "Report" anwählen. Es öffnet sich ein Fenster, den Text abkopieren und hier posten... aswMBR Von http://filepony.de/download-aswmbr/ die aswMBR.exe runterladen und auf dem Desktop speichern.
chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
02.12.2011, 00:21
| #8 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner Hi, hier der Report vom TDSS - Scan: 23:28:51.0274 5052 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44 23:28:53.0317 5052 ============================================================ 23:28:53.0317 5052 Current date / time: 2011/12/01 23:28:53.0317 23:28:53.0317 5052 SystemInfo: 23:28:53.0317 5052 23:28:53.0317 5052 OS Version: 6.0.6002 ServicePack: 2.0 23:28:53.0317 5052 Product type: Workstation 23:28:53.0317 5052 ComputerName: MOCK 23:28:53.0317 5052 UserName: Mock 23:28:53.0317 5052 Windows directory: C:\Windows 23:28:53.0317 5052 System windows directory: C:\Windows 23:28:53.0317 5052 Processor architecture: Intel x86 23:28:53.0317 5052 Number of processors: 2 23:28:53.0317 5052 Page size: 0x1000 23:28:53.0317 5052 Boot type: Normal boot 23:28:53.0317 5052 ============================================================ 23:28:53.0770 5052 Initialize success 23:29:04.0050 5608 ============================================================ 23:29:04.0050 5608 Scan started 23:29:04.0050 5608 Mode: Manual; 23:29:04.0050 5608 ============================================================ 23:29:04.0518 5608 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys 23:29:04.0518 5608 ACPI - ok 23:29:04.0658 5608 adfs (6d7f09cd92a9fef3a8efce66231fdd79) C:\Windows\system32\drivers\adfs.sys 23:29:04.0674 5608 adfs - ok 23:29:04.0877 5608 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys 23:29:04.0892 5608 adp94xx - ok 23:29:05.0033 5608 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys 23:29:05.0048 5608 adpahci - ok 23:29:05.0080 5608 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys 23:29:05.0095 5608 adpu160m - ok 23:29:05.0126 5608 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys 23:29:05.0142 5608 adpu320 - ok 23:29:05.0267 5608 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys 23:29:05.0298 5608 AFD - ok 23:29:05.0407 5608 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys 23:29:05.0407 5608 agp440 - ok 23:29:05.0454 5608 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys 23:29:05.0470 5608 aic78xx - ok 23:29:05.0641 5608 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys 23:29:05.0657 5608 aliide - ok 23:29:05.0719 5608 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys 23:29:05.0735 5608 amdagp - ok 23:29:05.0797 5608 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys 23:29:05.0813 5608 amdide - ok 23:29:05.0891 5608 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys 23:29:05.0906 5608 AmdK7 - ok 23:29:05.0984 5608 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys 23:29:06.0000 5608 AmdK8 - ok 23:29:06.0094 5608 ApfiltrService (9325e49d555d8f12ce1735227dbb3d80) C:\Windows\system32\DRIVERS\Apfiltr.sys 23:29:06.0109 5608 ApfiltrService - ok 23:29:06.0265 5608 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys 23:29:06.0281 5608 arc - ok 23:29:06.0343 5608 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys 23:29:06.0359 5608 arcsas - ok 23:29:06.0468 5608 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys 23:29:06.0484 5608 AsyncMac - ok 23:29:06.0530 5608 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys 23:29:06.0546 5608 atapi - ok 23:29:06.0624 5608 avgntflt (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys 23:29:06.0624 5608 avgntflt - ok 23:29:06.0702 5608 avipbb (912d23140cd05980f6cdae790ddafc8d) C:\Windows\system32\DRIVERS\avipbb.sys 23:29:06.0702 5608 avipbb - ok 23:29:06.0780 5608 avkmgr (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys 23:29:06.0796 5608 avkmgr - ok 23:29:06.0874 5608 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys 23:29:06.0889 5608 Beep - ok 23:29:06.0967 5608 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys 23:29:06.0983 5608 blbdrive - ok 23:29:07.0061 5608 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys 23:29:07.0061 5608 bowser - ok 23:29:07.0139 5608 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys 23:29:07.0139 5608 BrFiltLo - ok 23:29:07.0186 5608 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys 23:29:07.0201 5608 BrFiltUp - ok 23:29:07.0248 5608 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys 23:29:07.0264 5608 Brserid - ok 23:29:07.0310 5608 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys 23:29:07.0326 5608 BrSerWdm - ok 23:29:07.0388 5608 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys 23:29:07.0388 5608 BrUsbMdm - ok 23:29:07.0420 5608 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys 23:29:07.0420 5608 BrUsbSer - ok 23:29:07.0513 5608 BthEnum (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys 23:29:07.0529 5608 BthEnum - ok 23:29:07.0591 5608 BTHMODEM (9a966a8e86d1771911ae34a20d11bff3) C:\Windows\system32\DRIVERS\bthmodem.sys 23:29:07.0591 5608 BTHMODEM - ok 23:29:07.0669 5608 BthPan (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys 23:29:07.0669 5608 BthPan - ok 23:29:07.0763 5608 BTHPORT (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32\Drivers\BTHport.sys 23:29:07.0778 5608 BTHPORT - ok 23:29:07.0856 5608 BTHUSB (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32\Drivers\BTHUSB.sys 23:29:07.0872 5608 BTHUSB - ok 23:29:07.0950 5608 btwaudio (7f256d9fff384faa40df5db1cb8531d9) C:\Windows\system32\drivers\btwaudio.sys 23:29:07.0966 5608 btwaudio - ok 23:29:08.0075 5608 btwavdt (d87d990131aaabb27d4046790292366d) C:\Windows\system32\drivers\btwavdt.sys 23:29:08.0090 5608 btwavdt - ok 23:29:08.0122 5608 btwl2cap (d02f4d18aa4a38f781beefeb1892e144) C:\Windows\system32\DRIVERS\btwl2cap.sys 23:29:08.0122 5608 btwl2cap - ok 23:29:08.0278 5608 btwrchid (e1771c0fb49e747ab2b2d29da50510f9) C:\Windows\system32\DRIVERS\btwrchid.sys 23:29:08.0293 5608 btwrchid - ok 23:29:08.0340 5608 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys 23:29:08.0340 5608 cdfs - ok 23:29:08.0449 5608 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys 23:29:08.0465 5608 cdrom - ok 23:29:08.0496 5608 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys 23:29:08.0512 5608 circlass - ok 23:29:08.0558 5608 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys 23:29:08.0574 5608 CLFS - ok 23:29:08.0730 5608 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys 23:29:08.0730 5608 CmBatt - ok 23:29:08.0761 5608 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys 23:29:08.0777 5608 cmdide - ok 23:29:08.0792 5608 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys 23:29:08.0808 5608 Compbatt - ok 23:29:08.0870 5608 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys 23:29:08.0886 5608 crcdisk - ok 23:29:08.0917 5608 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys 23:29:08.0933 5608 Crusoe - ok 23:29:09.0011 5608 CSC (9bdb2e89be8d0ef37b1f25c3d3fc192c) C:\Windows\system32\drivers\csc.sys 23:29:09.0042 5608 CSC - ok 23:29:09.0151 5608 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys 23:29:09.0151 5608 CVirtA - ok 23:29:09.0198 5608 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys 23:29:09.0214 5608 DfsC - ok 23:29:09.0370 5608 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys 23:29:09.0370 5608 disk - ok 23:29:09.0494 5608 DMICall (f206e28ed74c491fd5d7c0a1119ce37f) C:\Windows\system32\DRIVERS\DMICall.sys 23:29:09.0510 5608 DMICall - ok 23:29:09.0572 5608 DNE (694616f813fb627a32c9e32dec133078) C:\Windows\system32\DRIVERS\dne2000.sys 23:29:09.0604 5608 DNE - ok 23:29:09.0713 5608 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys 23:29:09.0728 5608 Dot4 - ok 23:29:09.0760 5608 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys 23:29:09.0775 5608 Dot4Print - ok 23:29:09.0869 5608 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys 23:29:09.0869 5608 dot4usb - ok 23:29:09.0931 5608 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys 23:29:09.0947 5608 drmkaud - ok 23:29:10.0056 5608 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys 23:29:10.0072 5608 DXGKrnl - ok 23:29:10.0181 5608 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys 23:29:10.0196 5608 E1G60 - ok 23:29:10.0259 5608 e1yexpress (76a02bc4e8008a8cbaf5cc7efb9df839) C:\Windows\system32\DRIVERS\e1y6032.sys 23:29:10.0274 5608 e1yexpress - ok 23:29:10.0384 5608 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys 23:29:10.0399 5608 Ecache - ok 23:29:10.0477 5608 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys 23:29:10.0493 5608 elxstor - ok 23:29:10.0602 5608 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys 23:29:10.0618 5608 ErrDev - ok 23:29:10.0711 5608 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys 23:29:10.0727 5608 exfat - ok 23:29:10.0805 5608 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys 23:29:10.0820 5608 fastfat - ok 23:29:10.0914 5608 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys 23:29:10.0914 5608 fdc - ok 23:29:11.0008 5608 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys 23:29:11.0023 5608 FileInfo - ok 23:29:11.0070 5608 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys 23:29:11.0086 5608 Filetrace - ok 23:29:11.0179 5608 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys 23:29:11.0195 5608 flpydisk - ok 23:29:11.0273 5608 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys 23:29:11.0288 5608 FltMgr - ok 23:29:11.0382 5608 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys 23:29:11.0382 5608 Fs_Rec - ok 23:29:11.0444 5608 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys 23:29:11.0460 5608 gagp30kx - ok 23:29:11.0491 5608 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 23:29:11.0507 5608 GEARAspiWDM - ok 23:29:11.0600 5608 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys 23:29:11.0616 5608 HdAudAddService - ok 23:29:11.0710 5608 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys 23:29:11.0710 5608 HDAudBus - ok 23:29:11.0788 5608 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys 23:29:11.0803 5608 HidBth - ok 23:29:11.0834 5608 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys 23:29:11.0850 5608 HidIr - ok 23:29:11.0944 5608 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys 23:29:11.0959 5608 HidUsb - ok 23:29:12.0022 5608 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys 23:29:12.0037 5608 HpCISSs - ok 23:29:12.0162 5608 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS 23:29:12.0178 5608 HSFHWAZL - ok 23:29:12.0271 5608 HSF_DPV (53229dcf431d76434816cd29251168a0) C:\Windows\system32\DRIVERS\HSX_DPV.sys 23:29:12.0318 5608 HSF_DPV - ok 23:29:12.0412 5608 HSXHWAZL (31f949d452201f2f0af0c88d7db512cd) C:\Windows\system32\DRIVERS\HSXHWAZL.sys 23:29:12.0427 5608 HSXHWAZL - ok 23:29:12.0490 5608 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys 23:29:12.0552 5608 HTTP - ok 23:29:12.0646 5608 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys 23:29:12.0661 5608 i2omp - ok 23:29:12.0770 5608 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys 23:29:12.0770 5608 i8042prt - ok 23:29:12.0817 5608 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys 23:29:12.0833 5608 iaStor - ok 23:29:12.0958 5608 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys 23:29:12.0973 5608 iaStorV - ok 23:29:13.0098 5608 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys 23:29:13.0114 5608 iirsp - ok 23:29:13.0238 5608 IntcAzAudAddService (fbbe3f1697d393be685cd6192b1ec95a) C:\Windows\system32\drivers\RTKVHDA.sys 23:29:13.0316 5608 IntcAzAudAddService - ok 23:29:13.0426 5608 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys 23:29:13.0426 5608 intelide - ok 23:29:13.0472 5608 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys 23:29:13.0472 5608 intelppm - ok 23:29:13.0628 5608 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys 23:29:13.0628 5608 IpFilterDriver - ok 23:29:13.0660 5608 IpInIp - ok 23:29:13.0691 5608 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys 23:29:13.0691 5608 IPMIDRV - ok 23:29:13.0738 5608 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys 23:29:13.0738 5608 IPNAT - ok 23:29:13.0878 5608 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys 23:29:13.0894 5608 IRENUM - ok 23:29:13.0925 5608 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys 23:29:13.0940 5608 isapnp - ok 23:29:13.0972 5608 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys 23:29:13.0987 5608 iScsiPrt - ok 23:29:14.0081 5608 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys 23:29:14.0081 5608 iteatapi - ok 23:29:14.0128 5608 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys 23:29:14.0143 5608 iteraid - ok 23:29:14.0252 5608 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys 23:29:14.0268 5608 kbdclass - ok 23:29:14.0284 5608 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\drivers\kbdhid.sys 23:29:14.0284 5608 kbdhid - ok 23:29:14.0346 5608 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys 23:29:14.0377 5608 KSecDD - ok 23:29:14.0502 5608 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys 23:29:14.0518 5608 lltdio - ok 23:29:14.0580 5608 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys 23:29:14.0580 5608 LSI_FC - ok 23:29:14.0627 5608 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys 23:29:14.0642 5608 LSI_SAS - ok 23:29:14.0736 5608 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys 23:29:14.0752 5608 LSI_SCSI - ok 23:29:14.0783 5608 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys 23:29:14.0798 5608 luafv - ok 23:29:14.0845 5608 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\Windows\system32\drivers\mbam.sys 23:29:14.0845 5608 MBAMProtector - ok 23:29:14.0939 5608 mcdbus (8fd868e32459ece2a1bb0169f513d31e) C:\Windows\system32\DRIVERS\mcdbus.sys 23:29:14.0954 5608 mcdbus - ok 23:29:14.0986 5608 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys 23:29:15.0001 5608 mdmxsdk - ok 23:29:15.0110 5608 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys 23:29:15.0110 5608 megasas - ok 23:29:15.0173 5608 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys 23:29:15.0188 5608 MegaSR - ok 23:29:15.0313 5608 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys 23:29:15.0329 5608 Modem - ok 23:29:15.0344 5608 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys 23:29:15.0344 5608 monitor - ok 23:29:15.0391 5608 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys 23:29:15.0391 5608 mouclass - ok 23:29:15.0469 5608 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys 23:29:15.0485 5608 mouhid - ok 23:29:15.0516 5608 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys 23:29:15.0532 5608 MountMgr - ok 23:29:15.0594 5608 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys 23:29:15.0610 5608 mpio - ok 23:29:15.0688 5608 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys 23:29:15.0703 5608 mpsdrv - ok 23:29:15.0734 5608 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys 23:29:15.0750 5608 Mraid35x - ok 23:29:15.0812 5608 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys 23:29:15.0828 5608 MRxDAV - ok 23:29:15.0906 5608 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys 23:29:15.0922 5608 mrxsmb - ok 23:29:15.0968 5608 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys 23:29:15.0984 5608 mrxsmb10 - ok 23:29:16.0093 5608 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 23:29:16.0109 5608 mrxsmb20 - ok 23:29:16.0140 5608 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys 23:29:16.0156 5608 msahci - ok 23:29:16.0249 5608 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys 23:29:16.0265 5608 msdsm - ok 23:29:16.0327 5608 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys 23:29:16.0343 5608 Msfs - ok 23:29:16.0436 5608 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys 23:29:16.0436 5608 msisadrv - ok 23:29:16.0499 5608 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys 23:29:16.0499 5608 MSKSSRV - ok 23:29:16.0530 5608 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys 23:29:16.0530 5608 MSPCLOCK - ok 23:29:16.0561 5608 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys 23:29:16.0577 5608 MSPQM - ok 23:29:16.0655 5608 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys 23:29:16.0655 5608 MsRPC - ok 23:29:16.0717 5608 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys 23:29:16.0717 5608 mssmbios - ok 23:29:16.0795 5608 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys 23:29:16.0811 5608 MSTEE - ok 23:29:16.0904 5608 MTOnlPktAlyX (493138c4f4119e938427da02486f09cb) C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS 23:29:16.0920 5608 MTOnlPktAlyX - ok 23:29:17.0029 5608 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys 23:29:17.0029 5608 Mup - ok 23:29:17.0107 5608 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys 23:29:17.0123 5608 NativeWifiP - ok 23:29:17.0294 5608 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys 23:29:17.0294 5608 NDIS - ok 23:29:17.0404 5608 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys 23:29:17.0404 5608 NdisTapi - ok 23:29:17.0435 5608 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys 23:29:17.0450 5608 Ndisuio - ok 23:29:17.0482 5608 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys 23:29:17.0497 5608 NdisWan - ok 23:29:17.0591 5608 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys 23:29:17.0591 5608 NDProxy - ok 23:29:17.0731 5608 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys 23:29:17.0731 5608 NetBIOS - ok 23:29:17.0778 5608 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys 23:29:17.0809 5608 netbt - ok 23:29:18.0059 5608 NETw5v32 (f0c42e0cdce558d658fa53a222b4ccb1) C:\Windows\system32\DRIVERS\NETw5v32.sys 23:29:18.0215 5608 NETw5v32 - ok 23:29:18.0308 5608 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys 23:29:18.0308 5608 nfrd960 - ok 23:29:18.0355 5608 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys 23:29:18.0355 5608 Npfs - ok 23:29:18.0371 5608 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys 23:29:18.0371 5608 nsiproxy - ok 23:29:18.0449 5608 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys 23:29:18.0480 5608 Ntfs - ok 23:29:18.0574 5608 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys 23:29:18.0574 5608 ntrigdigi - ok 23:29:18.0620 5608 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys 23:29:18.0620 5608 Null - ok 23:29:18.0886 5608 nvlddmkm (aafafe8671c79859b68129a367f29ba7) C:\Windows\system32\DRIVERS\nvlddmkm.sys 23:29:19.0135 5608 nvlddmkm - ok 23:29:19.0260 5608 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys 23:29:19.0276 5608 nvraid - ok 23:29:19.0291 5608 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys 23:29:19.0307 5608 nvstor - ok 23:29:19.0369 5608 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys 23:29:19.0385 5608 nv_agp - ok 23:29:19.0432 5608 NwlnkFlt - ok 23:29:19.0447 5608 NwlnkFwd - ok 23:29:19.0494 5608 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys 23:29:19.0510 5608 ohci1394 - ok 23:29:19.0572 5608 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys 23:29:19.0572 5608 Parport - ok 23:29:19.0650 5608 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys 23:29:19.0666 5608 partmgr - ok 23:29:19.0712 5608 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys 23:29:19.0712 5608 Parvdm - ok 23:29:19.0790 5608 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys 23:29:19.0806 5608 pci - ok 23:29:19.0868 5608 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys 23:29:19.0884 5608 pciide - ok 23:29:19.0978 5608 pcmcia (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys 23:29:19.0993 5608 pcmcia - ok 23:29:20.0056 5608 PCTAppEvent (cc174f32cc9c18ea3109c4b0fc2ca8df) C:\Windows\system32\drivers\PCTAppEvent.sys 23:29:20.0071 5608 PCTAppEvent - ok 23:29:20.0180 5608 PCTFW-DNS (0afd401e45033c6264080989647989d2) C:\Windows\system32\drivers\pctNdis-DNS.sys 23:29:20.0180 5608 PCTFW-DNS - ok 23:29:20.0305 5608 PCTFW-PacketFilter (4a7ef973fcd9c6cad6040ebb61262a5c) C:\Windows\system32\drivers\pctNdis-PacketFilter.sys 23:29:20.0321 5608 PCTFW-PacketFilter - ok 23:29:20.0508 5608 pctgntdi (39e8623f9f29dbc9e053a696d85f8ac6) C:\Windows\System32\drivers\pctgntdi.sys 23:29:20.0524 5608 pctgntdi - ok 23:29:20.0648 5608 pctNDIS (8bbe917bc4da64b0ba8db33d4c0e0b7d) C:\Windows\system32\DRIVERS\pctNdis.sys 23:29:20.0664 5608 pctNDIS - ok 23:29:20.0742 5608 pctplfw (6d74df36716a458619a62dd764fc4f8b) C:\Windows\System32\drivers\pctplfw.sys 23:29:20.0758 5608 pctplfw - ok 23:29:20.0898 5608 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys 23:29:20.0945 5608 PEAUTH - ok 23:29:21.0148 5608 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys 23:29:21.0148 5608 PptpMiniport - ok 23:29:21.0179 5608 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys 23:29:21.0194 5608 Processor - ok 23:29:21.0241 5608 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys 23:29:21.0241 5608 PSched - ok 23:29:21.0350 5608 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\Windows\system32\Drivers\PxHelp20.sys 23:29:21.0382 5608 PxHelp20 - ok 23:29:21.0460 5608 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys 23:29:21.0506 5608 ql2300 - ok 23:29:21.0600 5608 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys 23:29:21.0616 5608 ql40xx - ok 23:29:21.0647 5608 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys 23:29:21.0662 5608 QWAVEdrv - ok 23:29:21.0772 5608 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys 23:29:21.0787 5608 RasAcd - ok 23:29:21.0834 5608 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys 23:29:21.0850 5608 Rasl2tp - ok 23:29:21.0943 5608 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys 23:29:21.0943 5608 RasPppoe - ok 23:29:21.0990 5608 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys 23:29:22.0006 5608 RasSstp - ok 23:29:22.0099 5608 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys 23:29:22.0130 5608 rdbss - ok 23:29:22.0177 5608 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys 23:29:22.0177 5608 RDPCDD - ok 23:29:22.0271 5608 rdpdr (943b18305eae3935598a9b4a3d560b4c) C:\Windows\system32\DRIVERS\rdpdr.sys 23:29:22.0302 5608 rdpdr - ok 23:29:22.0318 5608 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys 23:29:22.0318 5608 RDPENCDD - ok 23:29:22.0396 5608 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys 23:29:22.0411 5608 RDPWD - ok 23:29:22.0505 5608 regi (001b4278407f4303efc902a2b16f2453) C:\Windows\system32\drivers\regi.sys 23:29:22.0505 5608 regi - ok 23:29:22.0583 5608 RFCOMM (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys 23:29:22.0598 5608 RFCOMM - ok 23:29:22.0708 5608 rimsptsk (f2993908be03181c781228daadc55230) C:\Windows\system32\DRIVERS\rimsptsk.sys 23:29:22.0723 5608 rimsptsk - ok 23:29:22.0739 5608 risdptsk (cd6e3947724b337f9bc1524b710231eb) C:\Windows\system32\DRIVERS\risdptsk.sys 23:29:22.0754 5608 risdptsk - ok 23:29:22.0817 5608 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys 23:29:22.0832 5608 rspndr - ok 23:29:23.0020 5608 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys 23:29:23.0035 5608 sbp2port - ok 23:29:23.0191 5608 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys 23:29:23.0207 5608 sdbus - ok 23:29:23.0254 5608 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 23:29:23.0254 5608 secdrv - ok 23:29:23.0394 5608 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys 23:29:23.0410 5608 Serenum - ok 23:29:23.0472 5608 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys 23:29:23.0488 5608 Serial - ok 23:29:23.0503 5608 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys 23:29:23.0519 5608 sermouse - ok 23:29:23.0628 5608 SFEP (8b7c1768d2cde2e02e09a66563ddfd16) C:\Windows\system32\DRIVERS\SFEP.sys 23:29:23.0628 5608 SFEP - ok 23:29:23.0706 5608 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys 23:29:23.0706 5608 sffdisk - ok 23:29:23.0831 5608 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys 23:29:23.0831 5608 sffp_mmc - ok 23:29:23.0909 5608 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys 23:29:23.0924 5608 sffp_sd - ok 23:29:23.0940 5608 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys 23:29:23.0940 5608 sfloppy - ok 23:29:24.0049 5608 shpf (fd165f1309e8da2a969fbbb16635e459) C:\Windows\system32\DRIVERS\shpf.sys 23:29:24.0065 5608 shpf - ok 23:29:24.0112 5608 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys 23:29:24.0127 5608 sisagp - ok 23:29:24.0190 5608 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys 23:29:24.0205 5608 SiSRaid2 - ok 23:29:24.0252 5608 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys 23:29:24.0252 5608 SiSRaid4 - ok 23:29:24.0346 5608 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys 23:29:24.0346 5608 Smb - ok 23:29:24.0439 5608 SPI (225a17c6ad0207a058d728c0fa87e61d) C:\Windows\system32\DRIVERS\SonyPI.sys 23:29:24.0439 5608 SPI - ok 23:29:24.0486 5608 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys 23:29:24.0486 5608 spldr - ok 23:29:24.0548 5608 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys 23:29:24.0548 5608 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505 23:29:24.0548 5608 sptd ( LockedFile.Multi.Generic ) - warning 23:29:24.0548 5608 sptd - detected LockedFile.Multi.Generic (1) 23:29:24.0658 5608 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys 23:29:24.0673 5608 srv - ok 23:29:24.0720 5608 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys 23:29:24.0736 5608 srv2 - ok 23:29:24.0814 5608 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys 23:29:24.0814 5608 srvnet - ok 23:29:24.0892 5608 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys 23:29:24.0907 5608 ssmdrv - ok 23:29:25.0048 5608 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys 23:29:25.0048 5608 swenum - ok 23:29:25.0094 5608 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys 23:29:25.0110 5608 Symc8xx - ok 23:29:25.0204 5608 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys 23:29:25.0219 5608 Sym_hi - ok 23:29:25.0266 5608 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys 23:29:25.0266 5608 Sym_u3 - ok 23:29:25.0422 5608 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys 23:29:25.0469 5608 Tcpip - ok 23:29:25.0594 5608 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys 23:29:25.0609 5608 Tcpip6 - ok 23:29:25.0703 5608 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys 23:29:25.0718 5608 tcpipreg - ok 23:29:25.0750 5608 TcUsb (53900527fa5e2ccc818c5894383772d1) C:\Windows\system32\Drivers\tcusb.sys 23:29:25.0765 5608 TcUsb - ok 23:29:25.0859 5608 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys 23:29:25.0874 5608 TDPIPE - ok 23:29:25.0906 5608 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys 23:29:25.0906 5608 TDTCP - ok 23:29:25.0952 5608 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys 23:29:25.0952 5608 tdx - ok 23:29:26.0046 5608 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys 23:29:26.0062 5608 TermDD - ok 23:29:26.0171 5608 TPM (cb258c2f726f1be73c507022be33ebb3) C:\Windows\system32\drivers\tpm.sys 23:29:26.0171 5608 TPM - ok 23:29:26.0264 5608 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys 23:29:26.0264 5608 tssecsrv - ok 23:29:26.0358 5608 TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys 23:29:26.0358 5608 TuneUpUtilitiesDrv - ok 23:29:26.0452 5608 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys 23:29:26.0452 5608 tunmp - ok 23:29:26.0530 5608 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys 23:29:26.0530 5608 tunnel - ok 23:29:26.0608 5608 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys 23:29:26.0623 5608 uagp35 - ok 23:29:26.0686 5608 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys 23:29:26.0701 5608 udfs - ok 23:29:26.0764 5608 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys 23:29:26.0779 5608 uliagpkx - ok 23:29:26.0842 5608 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys 23:29:26.0857 5608 uliahci - ok 23:29:26.0920 5608 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys 23:29:26.0935 5608 UlSata - ok 23:29:27.0013 5608 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys 23:29:27.0029 5608 ulsata2 - ok 23:29:27.0091 5608 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys 23:29:27.0107 5608 umbus - ok 23:29:27.0200 5608 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\Windows\system32\Drivers\usbaapl.sys 23:29:27.0216 5608 USBAAPL - ok 23:29:27.0294 5608 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys 23:29:27.0310 5608 usbccgp - ok 23:29:27.0388 5608 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys 23:29:27.0419 5608 usbcir - ok 23:29:27.0481 5608 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys 23:29:27.0481 5608 usbehci - ok 23:29:27.0559 5608 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys 23:29:27.0590 5608 usbhub - ok 23:29:27.0653 5608 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys 23:29:27.0668 5608 usbohci - ok 23:29:27.0746 5608 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys 23:29:27.0746 5608 usbprint - ok 23:29:27.0840 5608 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys 23:29:27.0840 5608 usbscan - ok 23:29:27.0918 5608 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS 23:29:27.0918 5608 USBSTOR - ok 23:29:27.0996 5608 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys 23:29:28.0012 5608 usbuhci - ok 23:29:28.0043 5608 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys 23:29:28.0058 5608 usbvideo - ok 23:29:28.0105 5608 usb_rndisx (35c9095fa7076466afbfc5b9ec4b779e) C:\Windows\system32\DRIVERS\usb8023x.sys 23:29:28.0105 5608 usb_rndisx - ok 23:29:28.0230 5608 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys 23:29:28.0246 5608 vga - ok 23:29:28.0277 5608 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys 23:29:28.0292 5608 VgaSave - ok 23:29:28.0370 5608 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys 23:29:28.0386 5608 viaagp - ok 23:29:28.0417 5608 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys 23:29:28.0433 5608 ViaC7 - ok 23:29:28.0480 5608 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys 23:29:28.0495 5608 viaide - ok 23:29:28.0589 5608 VNUSB (ae01e1ed5a81e0d268b91b4a6de5a872) C:\Windows\system32\DRIVERS\VNUSB.sys 23:29:28.0604 5608 VNUSB - ok 23:29:28.0667 5608 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys 23:29:28.0698 5608 volmgr - ok 23:29:28.0792 5608 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys 23:29:28.0807 5608 volmgrx - ok 23:29:28.0885 5608 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys 23:29:28.0901 5608 volsnap - ok 23:29:28.0979 5608 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys 23:29:29.0010 5608 vsmraid - ok 23:29:29.0119 5608 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys 23:29:29.0119 5608 WacomPen - ok 23:29:29.0197 5608 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 23:29:29.0213 5608 Wanarp - ok 23:29:29.0228 5608 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 23:29:29.0228 5608 Wanarpv6 - ok 23:29:29.0322 5608 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys 23:29:29.0322 5608 Wd - ok 23:29:29.0416 5608 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys 23:29:29.0447 5608 Wdf01000 - ok 23:29:29.0556 5608 WimFltr (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\Windows\system32\DRIVERS\wimfltr.sys 23:29:29.0556 5608 WimFltr - ok 23:29:29.0650 5608 winachsf (6d2350bb6e77e800fc4be4e5b7a2e89a) C:\Windows\system32\DRIVERS\HSX_CNXT.sys 23:29:29.0696 5608 winachsf - ok 23:29:29.0806 5608 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys 23:29:29.0821 5608 WmiAcpi - ok 23:29:29.0915 5608 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys 23:29:29.0930 5608 ws2ifsl - ok 23:29:30.0024 5608 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys 23:29:30.0040 5608 WUDFRd - ok 23:29:30.0118 5608 XAudio (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys 23:29:30.0118 5608 XAudio - ok 23:29:30.0196 5608 yukonwlh (04e268adfc81964c49dc0c082d520f7e) C:\Windows\system32\DRIVERS\yk60x86.sys 23:29:30.0227 5608 yukonwlh - ok 23:29:30.0336 5608 ZYXEL750 (1fd4be45f40f7534472b7b23fa223f6e) C:\Windows\system32\DRIVERS\WlanUTG.sys 23:29:30.0367 5608 ZYXEL750 - ok 23:29:30.0445 5608 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0 23:29:30.0476 5608 \Device\Harddisk0\DR0 - ok 23:29:30.0476 5608 Boot (0x1200) (cfb49b55e14d706fe9e9c2112c6a139c) \Device\Harddisk0\DR0\Partition0 23:29:30.0476 5608 \Device\Harddisk0\DR0\Partition0 - ok 23:29:30.0476 5608 ============================================================ 23:29:30.0476 5608 Scan finished 23:29:30.0476 5608 ============================================================ 23:29:30.0586 5120 Detected object count: 1 23:29:30.0586 5120 Actual detected object count: 1 23:30:19.0124 5120 C:\Windows\system32\Drivers\sptd.sys - copied to quarantine 23:30:19.0124 5120 sptd ( LockedFile.Multi.Generic ) - User select action: Quarantine 23:30:23.0446 2224 ============================================================ 23:30:23.0446 2224 Scan started 23:30:23.0446 2224 Mode: Manual; 23:30:23.0446 2224 ============================================================ 23:30:23.0695 2224 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys 23:30:23.0695 2224 ACPI - ok 23:30:23.0742 2224 adfs (6d7f09cd92a9fef3a8efce66231fdd79) C:\Windows\system32\drivers\adfs.sys 23:30:23.0742 2224 adfs - ok 23:30:23.0851 2224 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys 23:30:23.0867 2224 adp94xx - ok 23:30:23.0898 2224 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys 23:30:23.0914 2224 adpahci - ok 23:30:24.0023 2224 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys 23:30:24.0023 2224 adpu160m - ok 23:30:24.0054 2224 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys 23:30:24.0054 2224 adpu320 - ok 23:30:24.0101 2224 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys 23:30:24.0101 2224 AFD - ok 23:30:24.0210 2224 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys 23:30:24.0210 2224 agp440 - ok 23:30:24.0257 2224 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys 23:30:24.0257 2224 aic78xx - ok 23:30:24.0304 2224 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys 23:30:24.0304 2224 aliide - ok 23:30:24.0335 2224 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys 23:30:24.0335 2224 amdagp - ok 23:30:24.0428 2224 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys 23:30:24.0428 2224 amdide - ok 23:30:24.0460 2224 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys 23:30:24.0460 2224 AmdK7 - ok 23:30:24.0491 2224 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys 23:30:24.0491 2224 AmdK8 - ok 23:30:24.0600 2224 ApfiltrService (9325e49d555d8f12ce1735227dbb3d80) C:\Windows\system32\DRIVERS\Apfiltr.sys 23:30:24.0600 2224 ApfiltrService - ok 23:30:24.0662 2224 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys 23:30:24.0662 2224 arc - ok 23:30:24.0694 2224 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys 23:30:24.0709 2224 arcsas - ok 23:30:24.0818 2224 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys 23:30:24.0834 2224 AsyncMac - ok 23:30:24.0865 2224 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys 23:30:24.0865 2224 atapi - ok 23:30:24.0912 2224 avgntflt (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys 23:30:24.0912 2224 avgntflt - ok 23:30:25.0006 2224 avipbb (912d23140cd05980f6cdae790ddafc8d) C:\Windows\system32\DRIVERS\avipbb.sys 23:30:25.0021 2224 avipbb - ok 23:30:25.0052 2224 avkmgr (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys 23:30:25.0052 2224 avkmgr - ok 23:30:25.0099 2224 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys 23:30:25.0099 2224 Beep - ok 23:30:25.0208 2224 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys 23:30:25.0208 2224 blbdrive - ok 23:30:25.0255 2224 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys 23:30:25.0255 2224 bowser - ok 23:30:25.0286 2224 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys 23:30:25.0286 2224 BrFiltLo - ok 23:30:25.0364 2224 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys 23:30:25.0364 2224 BrFiltUp - ok 23:30:25.0396 2224 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys 23:30:25.0396 2224 Brserid - ok 23:30:25.0427 2224 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys 23:30:25.0427 2224 BrSerWdm - ok 23:30:25.0474 2224 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys 23:30:25.0474 2224 BrUsbMdm - ok 23:30:25.0552 2224 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys 23:30:25.0567 2224 BrUsbSer - ok 23:30:25.0598 2224 BthEnum (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys 23:30:25.0598 2224 BthEnum - ok 23:30:25.0630 2224 BTHMODEM (9a966a8e86d1771911ae34a20d11bff3) C:\Windows\system32\DRIVERS\bthmodem.sys 23:30:25.0645 2224 BTHMODEM - ok 23:30:25.0739 2224 BthPan (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys 23:30:25.0754 2224 BthPan - ok 23:30:25.0801 2224 BTHPORT (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32\Drivers\BTHport.sys 23:30:25.0817 2224 BTHPORT - ok 23:30:25.0895 2224 BTHUSB (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32\Drivers\BTHUSB.sys 23:30:25.0895 2224 BTHUSB - ok 23:30:25.0942 2224 btwaudio (7f256d9fff384faa40df5db1cb8531d9) C:\Windows\system32\drivers\btwaudio.sys 23:30:25.0942 2224 btwaudio - ok 23:30:25.0973 2224 btwavdt (d87d990131aaabb27d4046790292366d) C:\Windows\system32\drivers\btwavdt.sys 23:30:25.0973 2224 btwavdt - ok 23:30:26.0066 2224 btwl2cap (d02f4d18aa4a38f781beefeb1892e144) C:\Windows\system32\DRIVERS\btwl2cap.sys 23:30:26.0066 2224 btwl2cap - ok 23:30:26.0113 2224 btwrchid (e1771c0fb49e747ab2b2d29da50510f9) C:\Windows\system32\DRIVERS\btwrchid.sys 23:30:26.0113 2224 btwrchid - ok 23:30:26.0160 2224 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys 23:30:26.0160 2224 cdfs - ok 23:30:26.0254 2224 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys 23:30:26.0269 2224 cdrom - ok 23:30:26.0300 2224 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys 23:30:26.0316 2224 circlass - ok 23:30:26.0410 2224 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys 23:30:26.0410 2224 CLFS - ok 23:30:26.0456 2224 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys 23:30:26.0456 2224 CmBatt - ok 23:30:26.0534 2224 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys 23:30:26.0534 2224 cmdide - ok 23:30:26.0566 2224 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys 23:30:26.0566 2224 Compbatt - ok 23:30:26.0581 2224 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys 23:30:26.0581 2224 crcdisk - ok 23:30:26.0644 2224 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys 23:30:26.0644 2224 Crusoe - ok 23:30:26.0753 2224 CSC (9bdb2e89be8d0ef37b1f25c3d3fc192c) C:\Windows\system32\drivers\csc.sys 23:30:26.0753 2224 CSC - ok 23:30:26.0815 2224 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys 23:30:26.0815 2224 CVirtA - ok 23:30:26.0909 2224 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys 23:30:26.0924 2224 DfsC - ok 23:30:26.0971 2224 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys 23:30:26.0971 2224 disk - ok 23:30:27.0018 2224 DMICall (f206e28ed74c491fd5d7c0a1119ce37f) C:\Windows\system32\DRIVERS\DMICall.sys 23:30:27.0034 2224 DMICall - ok 23:30:27.0112 2224 DNE (694616f813fb627a32c9e32dec133078) C:\Windows\system32\DRIVERS\dne2000.sys 23:30:27.0112 2224 DNE - ok 23:30:27.0174 2224 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys 23:30:27.0174 2224 Dot4 - ok 23:30:27.0221 2224 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys 23:30:27.0221 2224 Dot4Print - ok 23:30:27.0299 2224 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys 23:30:27.0299 2224 dot4usb - ok 23:30:27.0361 2224 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys 23:30:27.0361 2224 drmkaud - ok 23:30:27.0455 2224 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys 23:30:27.0470 2224 DXGKrnl - ok 23:30:27.0533 2224 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys 23:30:27.0533 2224 E1G60 - ok 23:30:27.0595 2224 e1yexpress (76a02bc4e8008a8cbaf5cc7efb9df839) C:\Windows\system32\DRIVERS\e1y6032.sys 23:30:27.0611 2224 e1yexpress - ok 23:30:27.0658 2224 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys 23:30:27.0658 2224 Ecache - ok 23:30:27.0704 2224 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys 23:30:27.0704 2224 elxstor - ok 23:30:27.0782 2224 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys 23:30:27.0782 2224 ErrDev - ok 23:30:27.0860 2224 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys 23:30:27.0860 2224 exfat - ok 23:30:27.0938 2224 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys 23:30:27.0938 2224 fastfat - ok 23:30:28.0001 2224 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys 23:30:28.0001 2224 fdc - ok 23:30:28.0063 2224 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys 23:30:28.0063 2224 FileInfo - ok 23:30:28.0110 2224 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys 23:30:28.0110 2224 Filetrace - ok 23:30:28.0188 2224 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys 23:30:28.0188 2224 flpydisk - ok 23:30:28.0282 2224 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys 23:30:28.0282 2224 FltMgr - ok 23:30:28.0344 2224 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys 23:30:28.0344 2224 Fs_Rec - ok 23:30:28.0406 2224 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys 23:30:28.0406 2224 gagp30kx - ok 23:30:28.0438 2224 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 23:30:28.0438 2224 GEARAspiWDM - ok 23:30:28.0531 2224 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys 23:30:28.0531 2224 HdAudAddService - ok 23:30:28.0672 2224 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys 23:30:28.0687 2224 HDAudBus - ok 23:30:28.0781 2224 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys 23:30:28.0781 2224 HidBth - ok 23:30:28.0828 2224 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys 23:30:28.0828 2224 HidIr - ok 23:30:28.0937 2224 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys 23:30:28.0937 2224 HidUsb - ok 23:30:28.0999 2224 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys 23:30:29.0015 2224 HpCISSs - ok 23:30:29.0124 2224 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS 23:30:29.0140 2224 HSFHWAZL - ok 23:30:29.0218 2224 HSF_DPV (53229dcf431d76434816cd29251168a0) C:\Windows\system32\DRIVERS\HSX_DPV.sys 23:30:29.0233 2224 HSF_DPV - ok 23:30:29.0327 2224 HSXHWAZL (31f949d452201f2f0af0c88d7db512cd) C:\Windows\system32\DRIVERS\HSXHWAZL.sys 23:30:29.0327 2224 HSXHWAZL - ok 23:30:29.0405 2224 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys 23:30:29.0405 2224 HTTP - ok 23:30:29.0498 2224 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys 23:30:29.0498 2224 i2omp - ok 23:30:29.0545 2224 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys 23:30:29.0545 2224 i8042prt - ok 23:30:29.0639 2224 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys 23:30:29.0639 2224 iaStor - ok 23:30:29.0717 2224 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys 23:30:29.0717 2224 iaStorV - ok 23:30:29.0826 2224 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys 23:30:29.0826 2224 iirsp - ok 23:30:29.0966 2224 IntcAzAudAddService (fbbe3f1697d393be685cd6192b1ec95a) C:\Windows\system32\drivers\RTKVHDA.sys 23:30:29.0998 2224 IntcAzAudAddService - ok 23:30:30.0076 2224 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys 23:30:30.0076 2224 intelide - ok 23:30:30.0122 2224 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys 23:30:30.0122 2224 intelppm - ok 23:30:30.0216 2224 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys 23:30:30.0216 2224 IpFilterDriver - ok 23:30:30.0247 2224 IpInIp - ok 23:30:30.0278 2224 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys 23:30:30.0278 2224 IPMIDRV - ok 23:30:30.0325 2224 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys 23:30:30.0325 2224 IPNAT - ok 23:30:30.0419 2224 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys 23:30:30.0419 2224 IRENUM - ok 23:30:30.0466 2224 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys 23:30:30.0466 2224 isapnp - ok 23:30:30.0544 2224 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys 23:30:30.0544 2224 iScsiPrt - ok 23:30:30.0590 2224 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys 23:30:30.0590 2224 iteatapi - ok 23:30:30.0668 2224 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys 23:30:30.0684 2224 iteraid - ok 23:30:30.0715 2224 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys 23:30:30.0731 2224 kbdclass - ok 23:30:30.0762 2224 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\drivers\kbdhid.sys 23:30:30.0762 2224 kbdhid - ok 23:30:30.0856 2224 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys 23:30:30.0871 2224 KSecDD - ok 23:30:30.0934 2224 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys 23:30:30.0934 2224 lltdio - ok 23:30:31.0027 2224 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys 23:30:31.0027 2224 LSI_FC - ok 23:30:31.0074 2224 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys 23:30:31.0074 2224 LSI_SAS - ok 23:30:31.0136 2224 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys 23:30:31.0136 2224 LSI_SCSI - ok 23:30:31.0230 2224 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys 23:30:31.0230 2224 luafv - ok 23:30:31.0261 2224 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\Windows\system32\drivers\mbam.sys 23:30:31.0277 2224 MBAMProtector - ok 23:30:31.0324 2224 mcdbus (8fd868e32459ece2a1bb0169f513d31e) C:\Windows\system32\DRIVERS\mcdbus.sys 23:30:31.0324 2224 mcdbus - ok 23:30:31.0402 2224 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys 23:30:31.0417 2224 mdmxsdk - ok 23:30:31.0464 2224 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys 23:30:31.0464 2224 megasas - ok 23:30:31.0542 2224 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys 23:30:31.0558 2224 MegaSR - ok 23:30:31.0620 2224 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys 23:30:31.0620 2224 Modem - ok 23:30:31.0682 2224 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys 23:30:31.0682 2224 monitor - ok 23:30:31.0714 2224 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys 23:30:31.0714 2224 mouclass - ok 23:30:31.0760 2224 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys 23:30:31.0760 2224 mouhid - ok 23:30:31.0838 2224 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys 23:30:31.0838 2224 MountMgr - ok 23:30:31.0885 2224 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys 23:30:31.0885 2224 mpio - ok 23:30:31.0963 2224 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys 23:30:31.0979 2224 mpsdrv - ok 23:30:32.0041 2224 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys 23:30:32.0041 2224 Mraid35x - ok 23:30:32.0135 2224 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys 23:30:32.0135 2224 MRxDAV - ok 23:30:32.0166 2224 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys 23:30:32.0166 2224 mrxsmb - ok 23:30:32.0244 2224 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys 23:30:32.0244 2224 mrxsmb10 - ok 23:30:32.0353 2224 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 23:30:32.0353 2224 mrxsmb20 - ok 23:30:32.0400 2224 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys 23:30:32.0400 2224 msahci - ok 23:30:32.0478 2224 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys 23:30:32.0478 2224 msdsm - ok 23:30:32.0540 2224 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys 23:30:32.0556 2224 Msfs - ok 23:30:32.0618 2224 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys 23:30:32.0618 2224 msisadrv - ok 23:30:32.0650 2224 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys 23:30:32.0650 2224 MSKSSRV - ok 23:30:32.0681 2224 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys 23:30:32.0681 2224 MSPCLOCK - ok 23:30:32.0712 2224 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys 23:30:32.0712 2224 MSPQM - ok 23:30:32.0806 2224 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys 23:30:32.0821 2224 MsRPC - ok 23:30:32.0868 2224 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys 23:30:32.0868 2224 mssmbios - ok 23:30:32.0962 2224 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys 23:30:32.0962 2224 MSTEE - ok 23:30:33.0040 2224 MTOnlPktAlyX (493138c4f4119e938427da02486f09cb) C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS 23:30:33.0040 2224 MTOnlPktAlyX - ok 23:30:33.0118 2224 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys 23:30:33.0118 2224 Mup - ok 23:30:33.0180 2224 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys 23:30:33.0180 2224 NativeWifiP - ok 23:30:33.0414 2224 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys 23:30:33.0430 2224 NDIS - ok 23:30:33.0601 2224 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys 23:30:33.0601 2224 NdisTapi - ok 23:30:33.0773 2224 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys 23:30:33.0773 2224 Ndisuio - ok 23:30:33.0929 2224 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys 23:30:33.0929 2224 NdisWan - ok 23:30:34.0007 2224 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys 23:30:34.0007 2224 NDProxy - ok 23:30:34.0085 2224 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys 23:30:34.0085 2224 NetBIOS - ok 23:30:34.0132 2224 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys 23:30:34.0132 2224 netbt - ok 23:30:34.0288 2224 NETw5v32 (f0c42e0cdce558d658fa53a222b4ccb1) C:\Windows\system32\DRIVERS\NETw5v32.sys 23:30:34.0319 2224 NETw5v32 - ok 23:30:34.0428 2224 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys 23:30:34.0428 2224 nfrd960 - ok 23:30:34.0459 2224 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys 23:30:34.0475 2224 Npfs - ok 23:30:34.0522 2224 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys 23:30:34.0522 2224 nsiproxy - ok 23:30:34.0615 2224 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys 23:30:34.0631 2224 Ntfs - ok 23:30:34.0724 2224 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys 23:30:34.0724 2224 ntrigdigi - ok 23:30:34.0771 2224 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys 23:30:34.0771 2224 Null - ok 23:30:35.0052 2224 nvlddmkm (aafafe8671c79859b68129a367f29ba7) C:\Windows\system32\DRIVERS\nvlddmkm.sys 23:30:35.0161 2224 nvlddmkm - ok 23:30:35.0317 2224 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys 23:30:35.0317 2224 nvraid - ok 23:30:35.0333 2224 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys 23:30:35.0333 2224 nvstor - ok 23:30:35.0364 2224 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys 23:30:35.0364 2224 nv_agp - ok 23:30:35.0458 2224 NwlnkFlt - ok 23:30:35.0473 2224 NwlnkFwd - ok 23:30:35.0504 2224 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys 23:30:35.0504 2224 ohci1394 - ok 23:30:35.0551 2224 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys 23:30:35.0551 2224 Parport - ok 23:30:35.0598 2224 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys 23:30:35.0598 2224 partmgr - ok 23:30:35.0692 2224 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys 23:30:35.0692 2224 Parvdm - ok 23:30:35.0754 2224 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys 23:30:35.0754 2224 pci - ok 23:30:35.0848 2224 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys 23:30:35.0848 2224 pciide - ok 23:30:35.0910 2224 pcmcia (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys 23:30:35.0910 2224 pcmcia - ok 23:30:35.0988 2224 PCTAppEvent (cc174f32cc9c18ea3109c4b0fc2ca8df) C:\Windows\system32\drivers\PCTAppEvent.sys 23:30:35.0988 2224 PCTAppEvent - ok 23:30:36.0019 2224 PCTFW-DNS (0afd401e45033c6264080989647989d2) C:\Windows\system32\drivers\pctNdis-DNS.sys 23:30:36.0035 2224 PCTFW-DNS - ok 23:30:36.0082 2224 PCTFW-PacketFilter (4a7ef973fcd9c6cad6040ebb61262a5c) C:\Windows\system32\drivers\pctNdis-PacketFilter.sys 23:30:36.0082 2224 PCTFW-PacketFilter - ok 23:30:36.0128 2224 pctgntdi (39e8623f9f29dbc9e053a696d85f8ac6) C:\Windows\System32\drivers\pctgntdi.sys 23:30:36.0128 2224 pctgntdi - ok 23:30:36.0206 2224 pctNDIS (8bbe917bc4da64b0ba8db33d4c0e0b7d) C:\Windows\system32\DRIVERS\pctNdis.sys 23:30:36.0206 2224 pctNDIS - ok 23:30:36.0269 2224 pctplfw (6d74df36716a458619a62dd764fc4f8b) C:\Windows\System32\drivers\pctplfw.sys 23:30:36.0269 2224 pctplfw - ok 23:30:36.0362 2224 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys 23:30:36.0378 2224 PEAUTH - ok 23:30:36.0472 2224 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys 23:30:36.0487 2224 PptpMiniport - ok 23:30:36.0550 2224 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys 23:30:36.0550 2224 Processor - ok 23:30:36.0581 2224 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys 23:30:36.0596 2224 PSched - ok 23:30:36.0659 2224 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\Windows\system32\Drivers\PxHelp20.sys 23:30:36.0659 2224 PxHelp20 - ok 23:30:36.0799 2224 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys 23:30:36.0815 2224 ql2300 - ok 23:30:36.0893 2224 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys 23:30:36.0893 2224 ql40xx - ok 23:30:36.0940 2224 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys 23:30:36.0955 2224 QWAVEdrv - ok 23:30:36.0986 2224 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys 23:30:36.0986 2224 RasAcd - ok 23:30:37.0080 2224 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys 23:30:37.0080 2224 Rasl2tp - ok 23:30:37.0142 2224 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys 23:30:37.0158 2224 RasPppoe - ok 23:30:37.0236 2224 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys 23:30:37.0236 2224 RasSstp - ok 23:30:37.0314 2224 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys 23:30:37.0314 2224 rdbss - ok 23:30:37.0423 2224 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys 23:30:37.0423 2224 RDPCDD - ok 23:30:37.0470 2224 rdpdr (943b18305eae3935598a9b4a3d560b4c) C:\Windows\system32\DRIVERS\rdpdr.sys 23:30:37.0470 2224 rdpdr - ok 23:30:37.0579 2224 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys 23:30:37.0579 2224 RDPENCDD - ok 23:30:37.0626 2224 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys 23:30:37.0626 2224 RDPWD - ok 23:30:37.0735 2224 regi (001b4278407f4303efc902a2b16f2453) C:\Windows\system32\drivers\regi.sys 23:30:37.0735 2224 regi - ok 23:30:37.0813 2224 RFCOMM (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys 23:30:37.0813 2224 RFCOMM - ok 23:30:37.0907 2224 rimsptsk (f2993908be03181c781228daadc55230) C:\Windows\system32\DRIVERS\rimsptsk.sys 23:30:37.0907 2224 rimsptsk - ok 23:30:37.0938 2224 risdptsk (cd6e3947724b337f9bc1524b710231eb) C:\Windows\system32\DRIVERS\risdptsk.sys 23:30:37.0938 2224 risdptsk - ok 23:30:37.0985 2224 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys 23:30:37.0985 2224 rspndr - ok 23:30:38.0078 2224 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys 23:30:38.0078 2224 sbp2port - ok 23:30:38.0125 2224 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys 23:30:38.0125 2224 sdbus - ok 23:30:38.0172 2224 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 23:30:38.0172 2224 secdrv - ok 23:30:38.0203 2224 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys 23:30:38.0203 2224 Serenum - ok 23:30:38.0297 2224 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys 23:30:38.0297 2224 Serial - ok 23:30:38.0312 2224 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys 23:30:38.0312 2224 sermouse - ok 23:30:38.0359 2224 SFEP (8b7c1768d2cde2e02e09a66563ddfd16) C:\Windows\system32\DRIVERS\SFEP.sys 23:30:38.0359 2224 SFEP - ok 23:30:38.0390 2224 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys 23:30:38.0406 2224 sffdisk - ok 23:30:38.0484 2224 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys 23:30:38.0484 2224 sffp_mmc - ok 23:30:38.0500 2224 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys 23:30:38.0500 2224 sffp_sd - ok 23:30:38.0515 2224 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys 23:30:38.0515 2224 sfloppy - ok 23:30:38.0562 2224 shpf (fd165f1309e8da2a969fbbb16635e459) C:\Windows\system32\DRIVERS\shpf.sys 23:30:38.0578 2224 shpf - ok 23:30:38.0671 2224 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys 23:30:38.0671 2224 sisagp - ok 23:30:38.0702 2224 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys 23:30:38.0702 2224 SiSRaid2 - ok 23:30:38.0734 2224 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys 23:30:38.0734 2224 SiSRaid4 - ok 23:30:38.0843 2224 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys 23:30:38.0843 2224 Smb - ok 23:30:38.0890 2224 SPI (225a17c6ad0207a058d728c0fa87e61d) C:\Windows\system32\DRIVERS\SonyPI.sys 23:30:38.0890 2224 SPI - ok 23:30:38.0921 2224 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys 23:30:38.0921 2224 spldr - ok 23:30:39.0030 2224 sptd (cdddec541bc3c96f91ecb48759673505) C:\Windows\system32\Drivers\sptd.sys 23:30:39.0030 2224 Suspicious file (NoAccess): C:\Windows\system32\Drivers\sptd.sys. md5: cdddec541bc3c96f91ecb48759673505 23:30:39.0046 2224 sptd ( LockedFile.Multi.Generic ) - warning 23:30:39.0046 2224 sptd - detected LockedFile.Multi.Generic (1) 23:30:39.0139 2224 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys 23:30:39.0139 2224 srv - ok 23:30:39.0217 2224 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys 23:30:39.0217 2224 srv2 - ok 23:30:39.0295 2224 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys 23:30:39.0295 2224 srvnet - ok 23:30:39.0358 2224 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys 23:30:39.0358 2224 ssmdrv - ok 23:30:39.0467 2224 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys 23:30:39.0467 2224 swenum - ok 23:30:39.0514 2224 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys 23:30:39.0514 2224 Symc8xx - ok 23:30:39.0607 2224 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys 23:30:39.0607 2224 Sym_hi - ok 23:30:39.0638 2224 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys 23:30:39.0638 2224 Sym_u3 - ok 23:30:39.0794 2224 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys 23:30:39.0810 2224 Tcpip - ok 23:30:39.0935 2224 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys 23:30:39.0950 2224 Tcpip6 - ok 23:30:40.0044 2224 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys 23:30:40.0044 2224 tcpipreg - ok 23:30:40.0091 2224 TcUsb (53900527fa5e2ccc818c5894383772d1) C:\Windows\system32\Drivers\tcusb.sys 23:30:40.0091 2224 TcUsb - ok 23:30:40.0122 2224 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys 23:30:40.0122 2224 TDPIPE - ok 23:30:40.0216 2224 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys 23:30:40.0216 2224 TDTCP - ok 23:30:40.0262 2224 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys 23:30:40.0278 2224 tdx - ok 23:30:40.0309 2224 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys 23:30:40.0309 2224 TermDD - ok 23:30:40.0434 2224 TPM (cb258c2f726f1be73c507022be33ebb3) C:\Windows\system32\drivers\tpm.sys 23:30:40.0434 2224 TPM - ok 23:30:40.0496 2224 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys 23:30:40.0496 2224 tssecsrv - ok 23:30:40.0590 2224 TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys 23:30:40.0590 2224 TuneUpUtilitiesDrv - ok 23:30:40.0668 2224 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys 23:30:40.0668 2224 tunmp - ok 23:30:40.0730 2224 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys 23:30:40.0730 2224 tunnel - ok 23:30:40.0808 2224 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys 23:30:40.0808 2224 uagp35 - ok 23:30:40.0871 2224 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys 23:30:40.0871 2224 udfs - ok 23:30:40.0949 2224 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys 23:30:40.0949 2224 uliagpkx - ok 23:30:41.0027 2224 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys 23:30:41.0027 2224 uliahci - ok 23:30:41.0089 2224 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys 23:30:41.0089 2224 UlSata - ok 23:30:41.0167 2224 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys 23:30:41.0167 2224 ulsata2 - ok 23:30:41.0230 2224 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys 23:30:41.0230 2224 umbus - ok 23:30:41.0292 2224 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\Windows\system32\Drivers\usbaapl.sys 23:30:41.0292 2224 USBAAPL - ok 23:30:41.0386 2224 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys 23:30:41.0386 2224 usbccgp - ok 23:30:41.0448 2224 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys 23:30:41.0448 2224 usbcir - ok 23:30:41.0510 2224 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys 23:30:41.0526 2224 usbehci - ok 23:30:41.0573 2224 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys 23:30:41.0573 2224 usbhub - ok 23:30:41.0635 2224 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys 23:30:41.0635 2224 usbohci - ok 23:30:41.0713 2224 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys 23:30:41.0713 2224 usbprint - ok 23:30:41.0776 2224 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys 23:30:41.0776 2224 usbscan - ok 23:30:41.0854 2224 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS 23:30:41.0854 2224 USBSTOR - ok 23:30:41.0885 2224 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys 23:30:41.0900 2224 usbuhci - ok 23:30:41.0932 2224 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys 23:30:41.0932 2224 usbvideo - ok 23:30:42.0010 2224 usb_rndisx (35c9095fa7076466afbfc5b9ec4b779e) C:\Windows\system32\DRIVERS\usb8023x.sys 23:30:42.0010 2224 usb_rndisx - ok 23:30:42.0103 2224 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys 23:30:42.0103 2224 vga - ok 23:30:42.0166 2224 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys 23:30:42.0166 2224 VgaSave - ok 23:30:42.0212 2224 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys 23:30:42.0212 2224 viaagp - ok 23:30:42.0290 2224 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys 23:30:42.0290 2224 ViaC7 - ok 23:30:42.0353 2224 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys 23:30:42.0353 2224 viaide - ok 23:30:42.0431 2224 VNUSB (ae01e1ed5a81e0d268b91b4a6de5a872) C:\Windows\system32\DRIVERS\VNUSB.sys 23:30:42.0446 2224 VNUSB - ok 23:30:42.0493 2224 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys 23:30:42.0509 2224 volmgr - ok 23:30:42.0602 2224 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys 23:30:42.0602 2224 volmgrx - ok 23:30:42.0665 2224 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys 23:30:42.0665 2224 volsnap - ok 23:30:42.0758 2224 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys 23:30:42.0758 2224 vsmraid - ok 23:30:42.0836 2224 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys 23:30:42.0836 2224 WacomPen - ok 23:30:42.0930 2224 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 23:30:42.0946 2224 Wanarp - ok 23:30:42.0946 2224 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 23:30:42.0946 2224 Wanarpv6 - ok 23:30:43.0039 2224 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys 23:30:43.0039 2224 Wd - ok 23:30:43.0133 2224 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys 23:30:43.0148 2224 Wdf01000 - ok 23:30:43.0242 2224 WimFltr (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\Windows\system32\DRIVERS\wimfltr.sys 23:30:43.0242 2224 WimFltr - ok 23:30:43.0336 2224 winachsf (6d2350bb6e77e800fc4be4e5b7a2e89a) C:\Windows\system32\DRIVERS\HSX_CNXT.sys 23:30:43.0351 2224 winachsf - ok 23:30:43.0523 2224 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys 23:30:43.0523 2224 WmiAcpi - ok 23:30:43.0601 2224 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys 23:30:43.0601 2224 ws2ifsl - ok 23:30:43.0694 2224 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys 23:30:43.0694 2224 WUDFRd - ok 23:30:43.0757 2224 XAudio (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys 23:30:43.0757 2224 XAudio - ok 23:30:43.0835 2224 yukonwlh (04e268adfc81964c49dc0c082d520f7e) C:\Windows\system32\DRIVERS\yk60x86.sys 23:30:43.0835 2224 yukonwlh - ok 23:30:43.0944 2224 ZYXEL750 (1fd4be45f40f7534472b7b23fa223f6e) C:\Windows\system32\DRIVERS\WlanUTG.sys 23:30:43.0944 2224 ZYXEL750 - ok 23:30:44.0022 2224 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0 23:30:44.0053 2224 \Device\Harddisk0\DR0 - ok 23:30:44.0053 2224 Boot (0x1200) (cfb49b55e14d706fe9e9c2112c6a139c) \Device\Harddisk0\DR0\Partition0 23:30:44.0069 2224 \Device\Harddisk0\DR0\Partition0 - ok 23:30:44.0069 2224 ============================================================ 23:30:44.0069 2224 Scan finished 23:30:44.0069 2224 ============================================================ 23:30:44.0084 4536 Detected object count: 1 23:30:44.0084 4536 Actual detected object count: 1 23:30:52.0430 4536 C:\Windows\system32\Drivers\sptd.sys - copied to quarantine 23:30:52.0446 4536 sptd ( LockedFile.Multi.Generic ) - User select action: Quarantine ____________________ und hier das aswMBR Log: aswMBR version 0.9.8.986 Copyright(c) 2011 AVAST Software Run date: 2011-12-01 23:34:37 ----------------------------- 23:34:37.829 OS Version: Windows 6.0.6002 Service Pack 2 23:34:37.829 Number of processors: 2 586 0x1706 23:34:37.829 ComputerName: MOCK UserName: Mock 23:34:38.640 Initialize success 23:34:42.961 AVAST engine defs: 11120101 23:34:45.145 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 23:34:45.145 Disk 0 Vendor: TOSHIBA_ LB01 Size: 190782MB BusType: 3 23:34:47.204 Disk 0 MBR read successfully 23:34:47.204 Disk 0 MBR scan 23:34:47.235 Disk 0 Windows VISTA default MBR code 23:34:47.251 Disk 0 scanning sectors +390719920 23:34:47.360 Disk 0 scanning C:\Windows\system32\drivers 23:35:04.364 Service scanning 23:35:05.285 Service sptd C:\Windows\System32\Drivers\sptd.sys **LOCKED** 32 23:35:05.893 Modules scanning 23:35:15.425 Disk 0 trace - called modules: 23:35:15.471 ntkrnlpa.exe CLASSPNP.SYS disk.sys shpf.sys acpi.sys hal.dll iaStor.sys sphm.sys >>UNKNOWN [0x85878938]<< 23:35:15.471 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x86aca6e0] 23:35:15.487 3 CLASSPNP.SYS[8a7a38b3] -> nt!IofCallDriver -> [0x86acac38] 23:35:15.503 5 shpf.sys[8a753cdd] -> nt!IofCallDriver -> [0x85f33408] 23:35:15.518 7 acpi.sys[807b76bc] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0x85969028] 23:35:16.423 AVAST engine scan C:\Windows 23:35:20.697 AVAST engine scan C:\Windows\system32 23:38:45.806 AVAST engine scan C:\Windows\system32\drivers 23:39:01.921 AVAST engine scan C:\Users\Mock 00:08:17.234 AVAST engine scan C:\ProgramData 00:12:40.209 Scan finished successfully 00:21:04.151 Disk 0 MBR has been saved successfully to "C:\Users\Mock\Desktop\MBR.dat" 00:21:04.151 The log file has been saved successfully to "C:\Users\Mock\Desktop\aswMBR.txt" |
|
02.12.2011, 07:24
| #9 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner Hi, SPTD.SYS entfernen Normalerweise gehört die Datei sptd.sys zu Daemontools bzw. Alcohol180, wird aber bei deren deinstallation nicht mit entfernt, daher: Zur vollautomatischen Deinstallation von SPTD.SYS kannst Du ein SPTD Entfernungstool (http://www.duplexsecure.com/en/downloads) nutzen. Beachte die unterschiedlichen Versionen für 32bit und 64bit Systeme. Starte die Datei und wählen Uninstall aus. Anschließend neu booten. Eventuell muss dann Nero neu installiert bzw. repariert werden. Bitte den MBR nochmal prüfen (wenn kein 64-Bit System)...
Danach nochmal den TDSS-Killer ausführen und Log posten... chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) Geändert von Chris4You (02.12.2011 um 07:31 Uhr) |
|
02.12.2011, 10:30
| #10 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner hi, hier der Report von MBRChreck MBRCheck, version 1.2.3 (c) 2010, AD Command-line: Windows Version: Windows Vista Business Edition Windows Information: Service Pack 2 (build 6002), 32-bit Base Board Manufacturer: Sony Corporation BIOS Manufacturer: INSYDE System Manufacturer: Sony Corporation System Product Name: VGN-Z11MN_B Logical Drives Mask: 0x00000004 Kernel Drivers (total 163): 0x82400000 \SystemRoot\system32\ntkrnlpa.exe 0x827BA000 \SystemRoot\system32\hal.dll 0x80407000 \SystemRoot\system32\kdcom.dll 0x8040E000 \SystemRoot\system32\mcupdate_GenuineIntel.dll 0x8047E000 \SystemRoot\system32\PSHED.dll 0x8048F000 \SystemRoot\system32\BOOTVID.dll 0x80497000 \SystemRoot\system32\CLFS.SYS 0x804D8000 \SystemRoot\system32\CI.dll 0x80603000 \SystemRoot\system32\drivers\Wdf01000.sys 0x8067F000 \SystemRoot\system32\drivers\WDFLDR.SYS 0x8068C000 \SystemRoot\system32\drivers\acpi.sys 0x806D2000 \SystemRoot\system32\drivers\WMILIB.SYS 0x806DB000 \SystemRoot\system32\drivers\msisadrv.sys 0x806E3000 \SystemRoot\system32\drivers\pci.sys 0x8070A000 \SystemRoot\System32\drivers\partmgr.sys 0x80719000 \SystemRoot\system32\DRIVERS\compbatt.sys 0x8071C000 \SystemRoot\system32\DRIVERS\BATTC.SYS 0x80726000 \SystemRoot\system32\drivers\volmgr.sys 0x80735000 \SystemRoot\System32\drivers\volmgrx.sys 0x8077F000 \SystemRoot\system32\DRIVERS\pcmcia.sys 0x807AC000 \SystemRoot\System32\drivers\mountmgr.sys 0x82A08000 \SystemRoot\system32\DRIVERS\iaStor.sys 0x82AD6000 \SystemRoot\system32\drivers\fltmgr.sys 0x82B08000 \SystemRoot\system32\drivers\fileinfo.sys 0x82B22000 \SystemRoot\System32\Drivers\ksecdd.sys 0x8A20E000 \SystemRoot\system32\drivers\ndis.sys 0x8A319000 \SystemRoot\system32\drivers\msrpc.sys 0x8A344000 \SystemRoot\system32\drivers\NETIO.SYS 0x8A40E000 \SystemRoot\System32\Drivers\Ntfs.sys 0x8A51E000 \SystemRoot\system32\drivers\volsnap.sys 0x8A557000 \SystemRoot\System32\Drivers\spldr.sys 0x8A55F000 \SystemRoot\system32\DRIVERS\shpf.sys 0x8A563000 \SystemRoot\System32\Drivers\mup.sys 0x8A572000 \SystemRoot\System32\drivers\ecache.sys 0x8A599000 \SystemRoot\system32\drivers\disk.sys 0x8A5AA000 \SystemRoot\system32\drivers\CLASSPNP.SYS 0x8A5CB000 \SystemRoot\system32\drivers\crcdisk.sys 0x8DED3000 \SystemRoot\system32\DRIVERS\tunnel.sys 0x8DEDE000 \SystemRoot\system32\DRIVERS\tunmp.sys 0x8DEE7000 \SystemRoot\system32\DRIVERS\intelppm.sys 0x8DEF6000 \SystemRoot\system32\DRIVERS\CmBatt.sys 0x8E208000 \SystemRoot\system32\DRIVERS\nvlddmkm.sys 0x8E94B000 \SystemRoot\system32\DRIVERS\nvBridge.kmd 0x8EC03000 \SystemRoot\system32\DRIVERS\igdkmd32.sys 0x8F2E7000 \SystemRoot\System32\drivers\dxgkrnl.sys 0x8F387000 \SystemRoot\System32\drivers\watchdog.sys 0x8F393000 \SystemRoot\system32\DRIVERS\e1y6032.sys 0x8F3CD000 \SystemRoot\system32\DRIVERS\usbuhci.sys 0x8E94D000 \SystemRoot\system32\DRIVERS\USBPORT.SYS 0x8F3D8000 \SystemRoot\system32\DRIVERS\usbehci.sys 0x8DEFA000 \SystemRoot\system32\DRIVERS\HDAudBus.sys 0x8F60E000 \SystemRoot\system32\DRIVERS\NETw5v32.sys 0x8FA21000 \SystemRoot\system32\DRIVERS\i8042prt.sys 0x8FA34000 \SystemRoot\system32\DRIVERS\kbdclass.sys 0x8FA3F000 \SystemRoot\system32\DRIVERS\Apfiltr.sys 0x8FA6B000 \SystemRoot\system32\DRIVERS\mouclass.sys 0x8FA76000 \SystemRoot\system32\DRIVERS\SonyPI.sys 0x8FA7A000 \SystemRoot\system32\DRIVERS\SFEP.sys 0x8FA7D000 \SystemRoot\system32\DRIVERS\wmiacpi.sys 0x8FA86000 \SystemRoot\system32\DRIVERS\msiscsi.sys 0x8FAB5000 \SystemRoot\system32\DRIVERS\storport.sys 0x8FAF6000 \SystemRoot\system32\DRIVERS\TDI.SYS 0x8FB01000 \SystemRoot\system32\DRIVERS\rasl2tp.sys 0x8FB18000 \SystemRoot\system32\DRIVERS\ndistapi.sys 0x8FB23000 \SystemRoot\system32\DRIVERS\ndiswan.sys 0x8FB46000 \SystemRoot\system32\DRIVERS\raspppoe.sys 0x8FB55000 \SystemRoot\system32\DRIVERS\raspptp.sys 0x8FB69000 \SystemRoot\system32\DRIVERS\rassstp.sys 0x8FC0E000 \SystemRoot\system32\DRIVERS\rdpdr.sys 0x8FC97000 \SystemRoot\system32\DRIVERS\termdd.sys 0x8FCA7000 \SystemRoot\system32\DRIVERS\pctNdis.sys 0x8FCB4000 \SystemRoot\system32\DRIVERS\swenum.sys 0x8FCB6000 \SystemRoot\system32\DRIVERS\ks.sys 0x8FCE0000 \SystemRoot\system32\DRIVERS\mssmbios.sys 0x8FCEA000 \SystemRoot\system32\DRIVERS\umbus.sys 0x8FCF7000 \SystemRoot\system32\DRIVERS\usbhub.sys 0x8FD2C000 \SystemRoot\System32\Drivers\NDProxy.SYS 0x90206000 \SystemRoot\system32\drivers\RTKVHDA.sys 0x9040F000 \SystemRoot\system32\drivers\portcls.sys 0x9043C000 \SystemRoot\system32\drivers\drmk.sys 0x90479000 \SystemRoot\System32\Drivers\Fs_Rec.SYS 0x90482000 \SystemRoot\System32\Drivers\Null.SYS 0x90489000 \SystemRoot\System32\Drivers\Beep.SYS 0x90490000 \SystemRoot\System32\drivers\vga.sys 0x9049C000 \SystemRoot\System32\drivers\VIDEOPRT.SYS 0x904BD000 \SystemRoot\System32\DRIVERS\RDPCDD.sys 0x904C5000 \SystemRoot\system32\drivers\rdpencdd.sys 0x904CD000 \SystemRoot\System32\Drivers\Msfs.SYS 0x904D8000 \SystemRoot\System32\Drivers\Npfs.SYS 0x904E6000 \SystemRoot\System32\DRIVERS\rasacd.sys 0x904EF000 \SystemRoot\System32\drivers\tcpip.sys 0x905D9000 \SystemRoot\System32\drivers\fwpkclnt.sys 0x90461000 \SystemRoot\system32\DRIVERS\tdx.sys 0x8FD3D000 \??\C:\Windows\System32\drivers\pctgntdi.sys 0x8FD74000 \ArcName\multi(0)disk(0)rdisk(0)partition(2)\Windows\system32\drivers\PctWfpFilter.sys 0x8FD91000 \SystemRoot\system32\DRIVERS\smb.sys 0x8FDA5000 \SystemRoot\system32\drivers\afd.sys 0x8FB7E000 \SystemRoot\System32\DRIVERS\netbt.sys 0x8FBB0000 \SystemRoot\system32\DRIVERS\pacer.sys 0x8FDED000 \SystemRoot\system32\DRIVERS\netbios.sys 0x8FBC6000 \SystemRoot\system32\DRIVERS\wanarp.sys 0x905F4000 \SystemRoot\system32\DRIVERS\ssmdrv.sys 0x8E98B000 \SystemRoot\system32\DRIVERS\rdbss.sys 0x8FC00000 \SystemRoot\system32\drivers\nsiproxy.sys 0x905FA000 \SystemRoot\system32\DRIVERS\DMICall.sys 0x8DF87000 \SystemRoot\system32\drivers\csc.sys 0x8FBD9000 \SystemRoot\System32\Drivers\dfsc.sys 0x8FBF0000 \SystemRoot\system32\DRIVERS\avkmgr.sys 0x8F3E7000 \SystemRoot\system32\DRIVERS\usbccgp.sys 0x905FB000 \SystemRoot\system32\DRIVERS\USBD.SYS 0x8E9C7000 \SystemRoot\system32\DRIVERS\avipbb.sys 0x8A37F000 \SystemRoot\System32\Drivers\usbvideo.sys 0x8F600000 \SystemRoot\System32\Drivers\crashdmp.sys 0x8DE00000 \SystemRoot\System32\Drivers\dump_iaStor.sys 0x8E9EC000 \SystemRoot\System32\Drivers\BTHUSB.sys 0x9940B000 \SystemRoot\System32\Drivers\bthport.sys 0x97850000 \SystemRoot\System32\win32k.sys 0x9948B000 \SystemRoot\System32\drivers\Dxapi.sys 0x99495000 \SystemRoot\system32\DRIVERS\rfcomm.sys 0x994BE000 \SystemRoot\system32\DRIVERS\BthEnum.sys 0x994C8000 \SystemRoot\system32\DRIVERS\bthpan.sys 0x994E2000 \SystemRoot\system32\drivers\btwavdt.sys 0x99553000 \SystemRoot\system32\drivers\btwaudio.sys 0x995D3000 \SystemRoot\system32\DRIVERS\btwl2cap.sys 0x995DD000 \SystemRoot\system32\DRIVERS\btwrchid.sys 0x995E0000 \SystemRoot\system32\DRIVERS\HIDCLASS.SYS 0x995F0000 \SystemRoot\system32\DRIVERS\HIDPARSE.SYS 0x8DFE2000 \SystemRoot\system32\DRIVERS\monitor.sys 0x97A70000 \SystemRoot\System32\TSDDD.dll 0x97A90000 \SystemRoot\System32\cdd.dll 0x97AA0000 \SystemRoot\System32\ATMFD.DLL 0x8A5E1000 \SystemRoot\system32\drivers\luafv.sys 0x8A3A0000 \SystemRoot\system32\DRIVERS\avgntflt.sys 0xAC80C000 \SystemRoot\system32\drivers\spsys.sys 0xAC8BC000 \SystemRoot\system32\DRIVERS\lltdio.sys 0xAC8CC000 \SystemRoot\system32\DRIVERS\nwifi.sys 0xAC8F6000 \SystemRoot\system32\DRIVERS\ndisuio.sys 0xAC900000 \SystemRoot\system32\DRIVERS\rspndr.sys 0xAC913000 \SystemRoot\system32\drivers\HTTP.sys 0xAC980000 \SystemRoot\System32\DRIVERS\srvnet.sys 0xAC99D000 \SystemRoot\system32\DRIVERS\bowser.sys 0xAC9B6000 \SystemRoot\System32\drivers\mpsdrv.sys 0xAC9CB000 \SystemRoot\system32\DRIVERS\mrxsmb.sys 0x8A3B9000 \SystemRoot\system32\DRIVERS\mrxsmb10.sys 0x82B93000 \SystemRoot\system32\DRIVERS\mrxsmb20.sys 0x82BAB000 \SystemRoot\System32\DRIVERS\srv2.sys 0xAF804000 \SystemRoot\System32\DRIVERS\srv.sys 0xAF86B000 \SystemRoot\System32\Drivers\adfs.SYS 0xAF87C000 \SystemRoot\system32\DRIVERS\mdmxsdk.sys 0xAF880000 \??\C:\Windows\system32\drivers\PCTAppEvent.sys 0xAF894000 \SystemRoot\system32\drivers\peauth.sys 0xAF972000 \SystemRoot\system32\drivers\regi.sys 0xAF974000 \SystemRoot\System32\Drivers\secdrv.SYS 0xAF97E000 \SystemRoot\System32\drivers\tcpipreg.sys 0xAF98A000 \SystemRoot\system32\DRIVERS\xaudio.sys 0xAF992000 \??\C:\Windows\system32\drivers\pctNdis-PacketFilter.sys 0xAF9A2000 \??\C:\Windows\System32\drivers\pctplfw.sys 0xAF9BD000 \??\C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys 0xAF9BE000 \SystemRoot\System32\Drivers\PxHelp20.sys 0xAF9E0000 \SystemRoot\system32\DRIVERS\GEARAspiWDM.sys 0xAF9E6000 \SystemRoot\system32\DRIVERS\cdfs.sys 0xAF9FC000 \??\C:\Windows\system32\drivers\mbam.sys 0x773D0000 \Windows\System32\ntdll.dll Processes (total 85): 0 System Idle Process 4 System 512 C:\Windows\System32\smss.exe 648 csrss.exe 704 C:\Windows\System32\wininit.exe 712 csrss.exe 748 C:\Windows\System32\services.exe 760 C:\Windows\System32\lsass.exe 768 C:\Windows\System32\lsm.exe 804 C:\Windows\System32\winlogon.exe 984 C:\Windows\System32\svchost.exe 1036 C:\Windows\System32\nvvsvc.exe 1064 C:\Windows\System32\svchost.exe 1116 C:\Windows\System32\svchost.exe 1192 C:\Windows\System32\svchost.exe 1220 C:\Windows\System32\svchost.exe 1288 C:\Windows\System32\svchost.exe 1364 C:\Windows\System32\audiodg.exe 1396 C:\Windows\System32\SLsvc.exe 1504 C:\Windows\System32\svchost.exe 1584 C:\Windows\System32\rundll32.exe 1616 C:\Windows\RTKAUDIOSERVICE.EXE 1796 C:\Windows\System32\svchost.exe 1932 C:\Windows\System32\wlanext.exe 2036 C:\Windows\System32\spoolsv.exe 292 C:\Program Files\Avira\AntiVir Desktop\sched.exe 328 C:\Windows\System32\svchost.exe 1688 C:\Windows\System32\svchost.exe 1784 C:\Program Files\Avira\AntiVir Desktop\avguard.exe 316 C:\Windows\System32\dwm.exe 2076 C:\Windows\explorer.exe 2096 C:\Windows\System32\taskeng.exe 2108 C:\Windows\System32\svchost.exe 2148 C:\Program Files\Intel\WiFi\bin\EvtEng.exe 2440 C:\Program Files\Windows Defender\MSASCui.exe 2488 C:\Program Files\Apoint\Apoint.exe 2496 C:\Program Files\Intel\Intel Matrix Storage Manager\IAAnotif.exe 2584 C:\Program Files\PC Tools Firewall Plus\FirewallGUI.exe 2600 C:\Program Files\Avira\AntiVir Desktop\avgnt.exe 2608 C:\Program Files\Malwarebytes' Anti-Malware\mbamgui.exe 2880 C:\Windows\System32\svchost.exe 2916 C:\Program Files\Intel\Intel Matrix Storage Manager\IAANTmon.exe 3008 C:\Windows\System32\svchost.exe 3036 C:\Program Files\PC Tools Firewall Plus\FWService.exe 3068 C:\Windows\System32\svchost.exe 3096 C:\Windows\System32\svchost.exe 3316 C:\Program Files\Common Files\Intel\WirelessCommon\RegSrvc.exe 3332 C:\Program Files\Microsoft SQL Server\90\Shared\sqlbrowser.exe 3348 C:\Windows\System32\svchost.exe 3472 C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesService32.exe 3508 C:\Program Files\Sony\VAIO Event Service\VESMgr.exe 3532 C:\Program Files\Sony\VAIO Power Management\SPMService.exe 3596 C:\Windows\System32\svchost.exe 3616 C:\Windows\System32\drivers\XAudio.exe 3728 dllhost.exe 3944 C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesApp32.exe 4004 C:\Program Files\Sony\VAIO Event Service\VESMgrSub.exe 1712 C:\Program Files\Sony\VAIO Power Management\SPMgr.exe 1304 dllhost.exe 2636 igfxext.exe 2752 igfxsrvc.exe 2840 C:\Program Files\Avira\AntiVir Desktop\avshadow.exe 3212 C:\Program Files\Common Files\Akamai\installer_no_upload_silent.exe 1352 WmiPrvSE.exe 2244 C:\Program Files\Apoint\ApMsgFwd.exe 4224 C:\Program Files\Apoint\ApntEx.exe 4260 C:\Windows\System32\msiexec.exe 4296 C:\Windows\System32\msiexec.exe 4356 C:\Windows\System32\msiexec.exe 4592 C:\Users\Mock\AppData\Local\Akamai\netsession_win.exe 4608 C:\Windows\System32\taskeng.exe 4616 C:\Users\Mock\AppData\Local\Akamai\netsession_win.exe 5172 C:\Windows\System32\wbem\WMIADAP.exe 5340 C:\Windows\System32\taskeng.exe 5388 C:\Program Files\Sony\VAIO Update 5\VAIOUpdt.exe 5640 WmiPrvSE.exe 5700 C:\Program Files\Sony\VAIO Update Common\VUAgent.exe 4132 C:\Windows\System32\svchost.exe 4156 C:\Program Files\Malwarebytes' Anti-Malware\mbamservice.exe 1876 C:\Windows\System32\svchost.exe 2688 C:\Program Files\Mozilla Firefox\firefox.exe 5844 dllhost.exe 4440 dllhost.exe 2252 C:\Users\Mock\Desktop\MBRCheck.exe 4888 C:\Windows\System32\conime.exe \\.\C: --> \\.\PhysicalDrive0 at offset 0x00000001`b5000000 (NTFS) PhysicalDrive0 Model Number: TOSHIBAMK2546GSX_200, Rev: LB012Q Size Device Name MBR Status -------------------------------------------- 186 GB \\.\PhysicalDrive0 Windows 2008 MBR code detected SHA1: 8DF43F2BDE2D9451948FA14B5279969C777A7979 Done! _____________________ und hier das TDSS Log (hat jetzt nichts mehr gefunden): 10:25:44.0864 1576 TDSS rootkit removing tool 2.6.21.0 Nov 24 2011 12:32:44 10:25:45.0192 1576 ============================================================ 10:25:45.0192 1576 Current date / time: 2011/12/02 10:25:45.0192 10:25:45.0192 1576 SystemInfo: 10:25:45.0192 1576 10:25:45.0192 1576 OS Version: 6.0.6002 ServicePack: 2.0 10:25:45.0192 1576 Product type: Workstation 10:25:45.0192 1576 ComputerName: MOCK 10:25:45.0192 1576 UserName: Mock 10:25:45.0192 1576 Windows directory: C:\Windows 10:25:45.0192 1576 System windows directory: C:\Windows 10:25:45.0192 1576 Processor architecture: Intel x86 10:25:45.0192 1576 Number of processors: 2 10:25:45.0192 1576 Page size: 0x1000 10:25:45.0192 1576 Boot type: Normal boot 10:25:45.0192 1576 ============================================================ 10:25:57.0984 1576 Initialize success 10:26:08.0358 1528 ============================================================ 10:26:08.0358 1528 Scan started 10:26:08.0358 1528 Mode: Manual; 10:26:08.0358 1528 ============================================================ 10:26:09.0153 1528 ACPI (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys 10:26:09.0153 1528 ACPI - ok 10:26:09.0621 1528 adfs (6d7f09cd92a9fef3a8efce66231fdd79) C:\Windows\system32\drivers\adfs.sys 10:26:09.0652 1528 adfs - ok 10:26:09.0949 1528 adp94xx (04f0fcac69c7c71a3ac4eb97fafc8303) C:\Windows\system32\drivers\adp94xx.sys 10:26:09.0964 1528 adp94xx - ok 10:26:10.0089 1528 adpahci (60505e0041f7751bdbb80f88bf45c2ce) C:\Windows\system32\drivers\adpahci.sys 10:26:10.0089 1528 adpahci - ok 10:26:10.0167 1528 adpu160m (8a42779b02aec986eab64ecfc98f8bd7) C:\Windows\system32\drivers\adpu160m.sys 10:26:10.0167 1528 adpu160m - ok 10:26:10.0292 1528 adpu320 (241c9e37f8ce45ef51c3de27515ca4e5) C:\Windows\system32\drivers\adpu320.sys 10:26:10.0308 1528 adpu320 - ok 10:26:10.0386 1528 AFD (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys 10:26:10.0417 1528 AFD - ok 10:26:10.0588 1528 agp440 (13f9e33747e6b41a3ff305c37db0d360) C:\Windows\system32\drivers\agp440.sys 10:26:10.0588 1528 agp440 - ok 10:26:10.0635 1528 aic78xx (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys 10:26:10.0651 1528 aic78xx - ok 10:26:10.0760 1528 aliide (9eaef5fc9b8e351afa7e78a6fae91f91) C:\Windows\system32\drivers\aliide.sys 10:26:10.0776 1528 aliide - ok 10:26:10.0838 1528 amdagp (c47344bc706e5f0b9dce369516661578) C:\Windows\system32\drivers\amdagp.sys 10:26:10.0838 1528 amdagp - ok 10:26:10.0869 1528 amdide (9b78a39a4c173fdbc1321e0dd659b34c) C:\Windows\system32\drivers\amdide.sys 10:26:10.0885 1528 amdide - ok 10:26:10.0963 1528 AmdK7 (18f29b49ad23ecee3d2a826c725c8d48) C:\Windows\system32\drivers\amdk7.sys 10:26:10.0978 1528 AmdK7 - ok 10:26:11.0025 1528 AmdK8 (93ae7f7dd54ab986a6f1a1b37be7442d) C:\Windows\system32\drivers\amdk8.sys 10:26:11.0041 1528 AmdK8 - ok 10:26:11.0150 1528 ApfiltrService (9325e49d555d8f12ce1735227dbb3d80) C:\Windows\system32\DRIVERS\Apfiltr.sys 10:26:11.0166 1528 ApfiltrService - ok 10:26:11.0337 1528 arc (5d2888182fb46632511acee92fdad522) C:\Windows\system32\drivers\arc.sys 10:26:11.0353 1528 arc - ok 10:26:11.0400 1528 arcsas (5e2a321bd7c8b3624e41fdec3e244945) C:\Windows\system32\drivers\arcsas.sys 10:26:11.0415 1528 arcsas - ok 10:26:11.0649 1528 AsyncMac (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys 10:26:11.0665 1528 AsyncMac - ok 10:26:11.0868 1528 atapi (2d9c903dc76a66813d350a562de40ed9) C:\Windows\system32\drivers\atapi.sys 10:26:11.0868 1528 atapi - ok 10:26:12.0180 1528 avgntflt (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys 10:26:12.0195 1528 avgntflt - ok 10:26:12.0351 1528 avipbb (912d23140cd05980f6cdae790ddafc8d) C:\Windows\system32\DRIVERS\avipbb.sys 10:26:12.0367 1528 avipbb - ok 10:26:12.0476 1528 avkmgr (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys 10:26:12.0492 1528 avkmgr - ok 10:26:12.0632 1528 Beep (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys 10:26:12.0648 1528 Beep - ok 10:26:12.0757 1528 blbdrive (d4df28447741fd3d953526e33a617397) C:\Windows\system32\drivers\blbdrive.sys 10:26:12.0757 1528 blbdrive - ok 10:26:12.0897 1528 bowser (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys 10:26:12.0913 1528 bowser - ok 10:26:12.0975 1528 BrFiltLo (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys 10:26:12.0975 1528 BrFiltLo - ok 10:26:13.0084 1528 BrFiltUp (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys 10:26:13.0194 1528 BrFiltUp - ok 10:26:13.0318 1528 Brserid (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys 10:26:13.0318 1528 Brserid - ok 10:26:13.0350 1528 BrSerWdm (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys 10:26:13.0350 1528 BrSerWdm - ok 10:26:13.0459 1528 BrUsbMdm (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys 10:26:13.0474 1528 BrUsbMdm - ok 10:26:13.0552 1528 BrUsbSer (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys 10:26:13.0568 1528 BrUsbSer - ok 10:26:13.0724 1528 BthEnum (6d39c954799b63ba866910234cf7d726) C:\Windows\system32\DRIVERS\BthEnum.sys 10:26:13.0740 1528 BthEnum - ok 10:26:13.0833 1528 BTHMODEM (9a966a8e86d1771911ae34a20d11bff3) C:\Windows\system32\DRIVERS\bthmodem.sys 10:26:13.0849 1528 BTHMODEM - ok 10:26:13.0958 1528 BthPan (5904efa25f829bf84ea6fb045134a1d8) C:\Windows\system32\DRIVERS\bthpan.sys 10:26:13.0958 1528 BthPan - ok 10:26:14.0067 1528 BTHPORT (611ff3f2f095c8d4a6d4cfd9dcc09793) C:\Windows\system32\Drivers\BTHport.sys 10:26:14.0098 1528 BTHPORT - ok 10:26:14.0161 1528 BTHUSB (d330803eab2a15caec7f011f1d4cb30e) C:\Windows\system32\Drivers\BTHUSB.sys 10:26:14.0176 1528 BTHUSB - ok 10:26:14.0301 1528 btwaudio (7f256d9fff384faa40df5db1cb8531d9) C:\Windows\system32\drivers\btwaudio.sys 10:26:14.0301 1528 btwaudio - ok 10:26:14.0395 1528 btwavdt (d87d990131aaabb27d4046790292366d) C:\Windows\system32\drivers\btwavdt.sys 10:26:14.0410 1528 btwavdt - ok 10:26:14.0473 1528 btwl2cap (d02f4d18aa4a38f781beefeb1892e144) C:\Windows\system32\DRIVERS\btwl2cap.sys 10:26:14.0488 1528 btwl2cap - ok 10:26:14.0644 1528 btwrchid (e1771c0fb49e747ab2b2d29da50510f9) C:\Windows\system32\DRIVERS\btwrchid.sys 10:26:14.0660 1528 btwrchid - ok 10:26:14.0769 1528 cdfs (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys 10:26:14.0785 1528 cdfs - ok 10:26:14.0847 1528 cdrom (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys 10:26:14.0847 1528 cdrom - ok 10:26:14.0988 1528 circlass (e5d4133f37219dbcfe102bc61072589d) C:\Windows\system32\drivers\circlass.sys 10:26:15.0034 1528 circlass - ok 10:26:15.0144 1528 CLFS (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys 10:26:15.0159 1528 CLFS - ok 10:26:15.0346 1528 CmBatt (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys 10:26:15.0424 1528 CmBatt - ok 10:26:15.0565 1528 cmdide (0ca25e686a4928484e9fdabd168ab629) C:\Windows\system32\drivers\cmdide.sys 10:26:15.0565 1528 cmdide - ok 10:26:15.0736 1528 Compbatt (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys 10:26:15.0752 1528 Compbatt - ok 10:26:15.0846 1528 crcdisk (741e9dff4f42d2d8477d0fc1dc0df871) C:\Windows\system32\drivers\crcdisk.sys 10:26:15.0861 1528 crcdisk - ok 10:26:15.0892 1528 Crusoe (1f07becdca750766a96cda811ba86410) C:\Windows\system32\drivers\crusoe.sys 10:26:15.0908 1528 Crusoe - ok 10:26:16.0080 1528 CSC (9bdb2e89be8d0ef37b1f25c3d3fc192c) C:\Windows\system32\drivers\csc.sys 10:26:16.0111 1528 CSC - ok 10:26:16.0220 1528 CVirtA (b5ecadf7708960f1818c7fa015f4c239) C:\Windows\system32\DRIVERS\CVirtA.sys 10:26:16.0236 1528 CVirtA - ok 10:26:16.0298 1528 DfsC (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys 10:26:16.0314 1528 DfsC - ok 10:26:16.0454 1528 disk (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys 10:26:16.0470 1528 disk - ok 10:26:16.0641 1528 DMICall (f206e28ed74c491fd5d7c0a1119ce37f) C:\Windows\system32\DRIVERS\DMICall.sys 10:26:16.0657 1528 DMICall - ok 10:26:16.0766 1528 DNE (694616f813fb627a32c9e32dec133078) C:\Windows\system32\DRIVERS\dne2000.sys 10:26:16.0797 1528 DNE - ok 10:26:16.0875 1528 Dot4 (4f59c172c094e1a1d46463a8dc061cbd) C:\Windows\system32\DRIVERS\Dot4.sys 10:26:16.0891 1528 Dot4 - ok 10:26:16.0984 1528 Dot4Print (80bf3ba09f6f2523c8f6b7cc6dbf7bd5) C:\Windows\system32\DRIVERS\Dot4Prt.sys 10:26:17.0000 1528 Dot4Print - ok 10:26:17.0140 1528 dot4usb (c55004ca6b419b6695970dfe849b122f) C:\Windows\system32\DRIVERS\dot4usb.sys 10:26:17.0156 1528 dot4usb - ok 10:26:17.0234 1528 drmkaud (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys 10:26:17.0234 1528 drmkaud - ok 10:26:17.0406 1528 DXGKrnl (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys 10:26:17.0421 1528 DXGKrnl - ok 10:26:17.0562 1528 E1G60 (5425f74ac0c1dbd96a1e04f17d63f94c) C:\Windows\system32\DRIVERS\E1G60I32.sys 10:26:17.0577 1528 E1G60 - ok 10:26:17.0686 1528 e1yexpress (76a02bc4e8008a8cbaf5cc7efb9df839) C:\Windows\system32\DRIVERS\e1y6032.sys 10:26:17.0702 1528 e1yexpress - ok 10:26:17.0842 1528 Ecache (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys 10:26:17.0858 1528 Ecache - ok 10:26:18.0076 1528 elxstor (23b62471681a124889978f6295b3f4c6) C:\Windows\system32\drivers\elxstor.sys 10:26:18.0139 1528 elxstor - ok 10:26:18.0326 1528 ErrDev (3db974f3935483555d7148663f726c61) C:\Windows\system32\drivers\errdev.sys 10:26:18.0342 1528 ErrDev - ok 10:26:18.0654 1528 exfat (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys 10:26:18.0669 1528 exfat - ok 10:26:18.0732 1528 fastfat (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys 10:26:18.0732 1528 fastfat - ok 10:26:18.0841 1528 fdc (afe1e8b9782a0dd7fb46bbd88e43f89a) C:\Windows\system32\DRIVERS\fdc.sys 10:26:18.0841 1528 fdc - ok 10:26:18.0903 1528 FileInfo (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys 10:26:18.0919 1528 FileInfo - ok 10:26:18.0997 1528 Filetrace (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys 10:26:18.0997 1528 Filetrace - ok 10:26:19.0122 1528 flpydisk (85b7cf99d532820495d68d747fda9ebd) C:\Windows\system32\DRIVERS\flpydisk.sys 10:26:19.0137 1528 flpydisk - ok 10:26:19.0184 1528 FltMgr (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys 10:26:19.0200 1528 FltMgr - ok 10:26:19.0309 1528 Fs_Rec (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys 10:26:19.0324 1528 Fs_Rec - ok 10:26:19.0356 1528 gagp30kx (34582a6e6573d54a07ece5fe24a126b5) C:\Windows\system32\drivers\gagp30kx.sys 10:26:19.0371 1528 gagp30kx - ok 10:26:19.0418 1528 GEARAspiWDM (8182ff89c65e4d38b2de4bb0fb18564e) C:\Windows\system32\DRIVERS\GEARAspiWDM.sys 10:26:19.0418 1528 GEARAspiWDM - ok 10:26:19.0714 1528 HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys 10:26:19.0730 1528 HdAudAddService - ok 10:26:19.0902 1528 HDAudBus (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys 10:26:19.0917 1528 HDAudBus - ok 10:26:20.0089 1528 HidBth (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys 10:26:20.0104 1528 HidBth - ok 10:26:20.0182 1528 HidIr (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys 10:26:20.0182 1528 HidIr - ok 10:26:20.0245 1528 HidUsb (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys 10:26:20.0245 1528 HidUsb - ok 10:26:20.0307 1528 HpCISSs (16ee7b23a009e00d835cdb79574a91a6) C:\Windows\system32\drivers\hpcisss.sys 10:26:20.0323 1528 HpCISSs - ok 10:26:20.0557 1528 HSFHWAZL (46d67209550973257601a533e2ac5785) C:\Windows\system32\DRIVERS\VSTAZL3.SYS 10:26:20.0619 1528 HSFHWAZL - ok 10:26:20.0869 1528 HSF_DPV (53229dcf431d76434816cd29251168a0) C:\Windows\system32\DRIVERS\HSX_DPV.sys 10:26:20.0931 1528 HSF_DPV - ok 10:26:21.0352 1528 HSXHWAZL (31f949d452201f2f0af0c88d7db512cd) C:\Windows\system32\DRIVERS\HSXHWAZL.sys 10:26:21.0368 1528 HSXHWAZL - ok 10:26:21.0571 1528 HTTP (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys 10:26:21.0602 1528 HTTP - ok 10:26:21.0805 1528 i2omp (c6b032d69650985468160fc9937cf5b4) C:\Windows\system32\drivers\i2omp.sys 10:26:21.0820 1528 i2omp - ok 10:26:21.0945 1528 i8042prt (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys 10:26:21.0961 1528 i8042prt - ok 10:26:22.0023 1528 iaStor (db0cc620b27a928d968c1a1e9cd9cb87) C:\Windows\system32\DRIVERS\iaStor.sys 10:26:22.0023 1528 iaStor - ok 10:26:22.0148 1528 iaStorV (54155ea1b0df185878e0fc9ec3ac3a14) C:\Windows\system32\drivers\iastorv.sys 10:26:22.0164 1528 iaStorV - ok 10:26:22.0226 1528 iirsp (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys 10:26:22.0226 1528 iirsp - ok 10:26:22.0444 1528 IntcAzAudAddService (fbbe3f1697d393be685cd6192b1ec95a) C:\Windows\system32\drivers\RTKVHDA.sys 10:26:22.0491 1528 IntcAzAudAddService - ok 10:26:22.0616 1528 intelide (83aa759f3189e6370c30de5dc5590718) C:\Windows\system32\drivers\intelide.sys 10:26:22.0616 1528 intelide - ok 10:26:22.0710 1528 intelppm (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys 10:26:22.0710 1528 intelppm - ok 10:26:22.0819 1528 IpFilterDriver (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys 10:26:22.0819 1528 IpFilterDriver - ok 10:26:22.0912 1528 IpInIp - ok 10:26:23.0022 1528 IPMIDRV (b25aaf203552b7b3491139d582b39ad1) C:\Windows\system32\drivers\ipmidrv.sys 10:26:23.0037 1528 IPMIDRV - ok 10:26:23.0084 1528 IPNAT (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys 10:26:23.0100 1528 IPNAT - ok 10:26:23.0240 1528 IRENUM (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys 10:26:23.0240 1528 IRENUM - ok 10:26:23.0287 1528 isapnp (6c70698a3e5c4376c6ab5c7c17fb0614) C:\Windows\system32\drivers\isapnp.sys 10:26:23.0302 1528 isapnp - ok 10:26:23.0334 1528 iScsiPrt (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys 10:26:23.0334 1528 iScsiPrt - ok 10:26:23.0474 1528 iteatapi (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys 10:26:23.0490 1528 iteatapi - ok 10:26:23.0552 1528 iteraid (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys 10:26:23.0583 1528 iteraid - ok 10:26:23.0677 1528 kbdclass (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys 10:26:23.0692 1528 kbdclass - ok 10:26:23.0755 1528 kbdhid (18247836959ba67e3511b62846b9c2e0) C:\Windows\system32\drivers\kbdhid.sys 10:26:23.0755 1528 kbdhid - ok 10:26:23.0864 1528 KSecDD (86165728af9bf72d6442a894fdfb4f8b) C:\Windows\system32\Drivers\ksecdd.sys 10:26:23.0880 1528 KSecDD - ok 10:26:23.0942 1528 lltdio (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys 10:26:23.0942 1528 lltdio - ok 10:26:24.0036 1528 LSI_FC (c7e15e82879bf3235b559563d4185365) C:\Windows\system32\drivers\lsi_fc.sys 10:26:24.0051 1528 LSI_FC - ok 10:26:24.0082 1528 LSI_SAS (ee01ebae8c9bf0fa072e0ff68718920a) C:\Windows\system32\drivers\lsi_sas.sys 10:26:24.0082 1528 LSI_SAS - ok 10:26:24.0145 1528 LSI_SCSI (912a04696e9ca30146a62afa1463dd5c) C:\Windows\system32\drivers\lsi_scsi.sys 10:26:24.0145 1528 LSI_SCSI - ok 10:26:24.0285 1528 luafv (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys 10:26:24.0316 1528 luafv - ok 10:26:24.0379 1528 MBAMProtector (69a6268d7f81e53d568ab4e7e991caf3) C:\Windows\system32\drivers\mbam.sys 10:26:24.0379 1528 MBAMProtector - ok 10:26:24.0472 1528 mcdbus (8fd868e32459ece2a1bb0169f513d31e) C:\Windows\system32\DRIVERS\mcdbus.sys 10:26:24.0488 1528 mcdbus - ok 10:26:24.0566 1528 mdmxsdk (0cea2d0d3fa284b85ed5b68365114f76) C:\Windows\system32\DRIVERS\mdmxsdk.sys 10:26:24.0566 1528 mdmxsdk - ok 10:26:24.0660 1528 megasas (0001ce609d66632fa17b84705f658879) C:\Windows\system32\drivers\megasas.sys 10:26:24.0769 1528 megasas - ok 10:26:24.0878 1528 MegaSR (c252f32cd9a49dbfc25ecf26ebd51a99) C:\Windows\system32\drivers\megasr.sys 10:26:25.0050 1528 MegaSR - ok 10:26:25.0440 1528 Modem (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys 10:26:25.0455 1528 Modem - ok 10:26:25.0533 1528 monitor (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys 10:26:25.0533 1528 monitor - ok 10:26:25.0549 1528 mouclass (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys 10:26:25.0564 1528 mouclass - ok 10:26:25.0674 1528 mouhid (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys 10:26:25.0674 1528 mouhid - ok 10:26:25.0970 1528 MountMgr (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys 10:26:25.0970 1528 MountMgr - ok 10:26:26.0032 1528 mpio (511d011289755dd9f9a7579fb0b064e6) C:\Windows\system32\drivers\mpio.sys 10:26:26.0048 1528 mpio - ok 10:26:26.0157 1528 mpsdrv (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys 10:26:26.0173 1528 mpsdrv - ok 10:26:26.0391 1528 Mraid35x (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys 10:26:26.0422 1528 Mraid35x - ok 10:26:26.0578 1528 MRxDAV (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys 10:26:26.0594 1528 MRxDAV - ok 10:26:26.0703 1528 mrxsmb (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys 10:26:26.0703 1528 mrxsmb - ok 10:26:26.0953 1528 mrxsmb10 (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys 10:26:26.0968 1528 mrxsmb10 - ok 10:26:27.0249 1528 mrxsmb20 (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys 10:26:27.0265 1528 mrxsmb20 - ok 10:26:27.0436 1528 msahci (28023e86f17001f7cd9b15a5bc9ae07d) C:\Windows\system32\drivers\msahci.sys 10:26:27.0452 1528 msahci - ok 10:26:27.0577 1528 msdsm (4468b0f385a86ecddaf8d3ca662ec0e7) C:\Windows\system32\drivers\msdsm.sys 10:26:27.0592 1528 msdsm - ok 10:26:27.0733 1528 Msfs (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys 10:26:27.0733 1528 Msfs - ok 10:26:27.0811 1528 msisadrv (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys 10:26:27.0826 1528 msisadrv - ok 10:26:27.0998 1528 MSKSSRV (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys 10:26:28.0014 1528 MSKSSRV - ok 10:26:28.0544 1528 MSPCLOCK (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys 10:26:28.0560 1528 MSPCLOCK - ok 10:26:28.0638 1528 MSPQM (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys 10:26:28.0653 1528 MSPQM - ok 10:26:28.0700 1528 MsRPC (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys 10:26:28.0716 1528 MsRPC - ok 10:26:28.0840 1528 mssmbios (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys 10:26:28.0840 1528 mssmbios - ok 10:26:28.0965 1528 MSTEE (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys 10:26:28.0981 1528 MSTEE - ok 10:26:29.0184 1528 MTOnlPktAlyX (493138c4f4119e938427da02486f09cb) C:\PROGRA~1\T-Online\T-ONLI~1\BASIS-~1\Basis1\MTOnlPktAlyX.SYS 10:26:29.0199 1528 MTOnlPktAlyX - ok 10:26:29.0324 1528 Mup (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys 10:26:29.0340 1528 Mup - ok 10:26:29.0464 1528 NativeWifiP (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys 10:26:29.0480 1528 NativeWifiP - ok 10:26:29.0574 1528 NDIS (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys 10:26:29.0589 1528 NDIS - ok 10:26:29.0808 1528 NdisTapi (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys 10:26:29.0823 1528 NdisTapi - ok 10:26:29.0917 1528 Ndisuio (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys 10:26:29.0932 1528 Ndisuio - ok 10:26:29.0979 1528 NdisWan (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys 10:26:29.0995 1528 NdisWan - ok 10:26:30.0088 1528 NDProxy (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys 10:26:30.0104 1528 NDProxy - ok 10:26:30.0229 1528 NetBIOS (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys 10:26:30.0244 1528 NetBIOS - ok 10:26:30.0291 1528 netbt (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys 10:26:30.0322 1528 netbt - ok 10:26:30.0806 1528 NETw5v32 (f0c42e0cdce558d658fa53a222b4ccb1) C:\Windows\system32\DRIVERS\NETw5v32.sys 10:26:31.0009 1528 NETw5v32 - ok 10:26:31.0118 1528 nfrd960 (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys 10:26:31.0118 1528 nfrd960 - ok 10:26:31.0165 1528 Npfs (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys 10:26:31.0165 1528 Npfs - ok 10:26:31.0305 1528 nsiproxy (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys 10:26:31.0321 1528 nsiproxy - ok 10:26:31.0492 1528 Ntfs (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys 10:26:31.0539 1528 Ntfs - ok 10:26:31.0648 1528 ntrigdigi (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys 10:26:31.0664 1528 ntrigdigi - ok 10:26:31.0820 1528 Null (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys 10:26:31.0836 1528 Null - ok 10:26:32.0787 1528 nvlddmkm (aafafe8671c79859b68129a367f29ba7) C:\Windows\system32\DRIVERS\nvlddmkm.sys 10:26:33.0021 1528 nvlddmkm - ok 10:26:33.0240 1528 nvraid (2edf9e7751554b42cbb60116de727101) C:\Windows\system32\drivers\nvraid.sys 10:26:33.0255 1528 nvraid - ok 10:26:33.0427 1528 nvstor (abed0c09758d1d97db0042dbb2688177) C:\Windows\system32\drivers\nvstor.sys 10:26:33.0427 1528 nvstor - ok 10:26:33.0520 1528 nv_agp (18bbdf913916b71bd54575bdb6eeac0b) C:\Windows\system32\drivers\nv_agp.sys 10:26:33.0552 1528 nv_agp - ok 10:26:33.0567 1528 NwlnkFlt - ok 10:26:33.0598 1528 NwlnkFwd - ok 10:26:33.0786 1528 ohci1394 (6f310e890d46e246e0e261a63d9b36b4) C:\Windows\system32\DRIVERS\ohci1394.sys 10:26:33.0786 1528 ohci1394 - ok 10:26:33.0848 1528 Parport (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys 10:26:33.0864 1528 Parport - ok 10:26:34.0066 1528 partmgr (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys 10:26:34.0082 1528 partmgr - ok 10:26:34.0534 1528 Parvdm (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys 10:26:34.0550 1528 Parvdm - ok 10:26:34.0644 1528 pci (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys 10:26:34.0659 1528 pci - ok 10:26:34.0706 1528 pciide (fc175f5ddab666d7f4d17449a547626f) C:\Windows\system32\drivers\pciide.sys 10:26:34.0722 1528 pciide - ok 10:26:34.0956 1528 pcmcia (3bb2244f343b610c29c98035504c9b75) C:\Windows\system32\DRIVERS\pcmcia.sys 10:26:34.0987 1528 pcmcia - ok 10:26:35.0127 1528 PCTAppEvent (cc174f32cc9c18ea3109c4b0fc2ca8df) C:\Windows\system32\drivers\PCTAppEvent.sys 10:26:35.0143 1528 PCTAppEvent - ok 10:26:35.0408 1528 PCTFW-DNS (0afd401e45033c6264080989647989d2) C:\Windows\system32\drivers\pctNdis-DNS.sys 10:26:35.0424 1528 PCTFW-DNS - ok 10:26:35.0517 1528 PCTFW-PacketFilter (4a7ef973fcd9c6cad6040ebb61262a5c) C:\Windows\system32\drivers\pctNdis-PacketFilter.sys 10:26:35.0533 1528 PCTFW-PacketFilter - ok 10:26:35.0611 1528 pctgntdi (39e8623f9f29dbc9e053a696d85f8ac6) C:\Windows\System32\drivers\pctgntdi.sys 10:26:35.0626 1528 pctgntdi - ok 10:26:35.0767 1528 pctNDIS (8bbe917bc4da64b0ba8db33d4c0e0b7d) C:\Windows\system32\DRIVERS\pctNdis.sys 10:26:35.0782 1528 pctNDIS - ok 10:26:35.0907 1528 pctplfw (6d74df36716a458619a62dd764fc4f8b) C:\Windows\System32\drivers\pctplfw.sys 10:26:35.0923 1528 pctplfw - ok 10:26:36.0126 1528 PEAUTH (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys 10:26:36.0157 1528 PEAUTH - ok 10:26:36.0328 1528 PptpMiniport (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys 10:26:36.0344 1528 PptpMiniport - ok 10:26:36.0375 1528 Processor (2027293619dd0f047c584cf2e7df4ffd) C:\Windows\system32\drivers\processr.sys 10:26:36.0375 1528 Processor - ok 10:26:36.0562 1528 PSched (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys 10:26:36.0562 1528 PSched - ok 10:26:36.0859 1528 PxHelp20 (e42e3433dbb4cffe8fdd91eab29aea8e) C:\Windows\system32\Drivers\PxHelp20.sys 10:26:36.0874 1528 PxHelp20 - ok 10:26:37.0124 1528 ql2300 (0a6db55afb7820c99aa1f3a1d270f4f6) C:\Windows\system32\drivers\ql2300.sys 10:26:37.0186 1528 ql2300 - ok 10:26:37.0342 1528 ql40xx (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys 10:26:37.0358 1528 ql40xx - ok 10:26:37.0608 1528 QWAVEdrv (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys 10:26:37.0608 1528 QWAVEdrv - ok 10:26:37.0764 1528 RasAcd (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys 10:26:37.0764 1528 RasAcd - ok 10:26:37.0888 1528 Rasl2tp (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys 10:26:37.0904 1528 Rasl2tp - ok 10:26:37.0998 1528 RasPppoe (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys 10:26:37.0998 1528 RasPppoe - ok 10:26:38.0060 1528 RasSstp (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys 10:26:38.0076 1528 RasSstp - ok 10:26:38.0185 1528 rdbss (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys 10:26:38.0200 1528 rdbss - ok 10:26:38.0278 1528 RDPCDD (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys 10:26:38.0278 1528 RDPCDD - ok 10:26:38.0356 1528 rdpdr (943b18305eae3935598a9b4a3d560b4c) C:\Windows\system32\DRIVERS\rdpdr.sys 10:26:38.0372 1528 rdpdr - ok 10:26:38.0372 1528 RDPENCDD (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys 10:26:38.0388 1528 RDPENCDD - ok 10:26:38.0434 1528 RDPWD (30bfbdfb7f95559ede971f9ddb9a00ba) C:\Windows\system32\drivers\RDPWD.sys 10:26:38.0450 1528 RDPWD - ok 10:26:38.0653 1528 regi (001b4278407f4303efc902a2b16f2453) C:\Windows\system32\drivers\regi.sys 10:26:38.0668 1528 regi - ok 10:26:38.0824 1528 RFCOMM (6482707f9f4da0ecbab43b2e0398a101) C:\Windows\system32\DRIVERS\rfcomm.sys 10:26:38.0840 1528 RFCOMM - ok 10:26:39.0043 1528 rimsptsk (f2993908be03181c781228daadc55230) C:\Windows\system32\DRIVERS\rimsptsk.sys 10:26:39.0074 1528 rimsptsk - ok 10:26:39.0183 1528 risdptsk (cd6e3947724b337f9bc1524b710231eb) C:\Windows\system32\DRIVERS\risdptsk.sys 10:26:39.0183 1528 risdptsk - ok 10:26:39.0246 1528 rspndr (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys 10:26:39.0261 1528 rspndr - ok 10:26:39.0448 1528 sbp2port (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys 10:26:39.0448 1528 sbp2port - ok 10:26:39.0542 1528 sdbus (126ea89bcc413ee45e3004fb0764888f) C:\Windows\system32\DRIVERS\sdbus.sys 10:26:39.0542 1528 sdbus - ok 10:26:39.0620 1528 secdrv (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys 10:26:39.0620 1528 secdrv - ok 10:26:39.0667 1528 Serenum (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\drivers\serenum.sys 10:26:39.0698 1528 Serenum - ok 10:26:39.0838 1528 Serial (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\DRIVERS\serial.sys 10:26:39.0870 1528 Serial - ok 10:26:39.0916 1528 sermouse (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys 10:26:39.0948 1528 sermouse - ok 10:26:40.0057 1528 SFEP (8b7c1768d2cde2e02e09a66563ddfd16) C:\Windows\system32\DRIVERS\SFEP.sys 10:26:40.0057 1528 SFEP - ok 10:26:40.0119 1528 sffdisk (3efa810bdca87f6ecc24f9832243fe86) C:\Windows\system32\drivers\sffdisk.sys 10:26:40.0119 1528 sffdisk - ok 10:26:40.0228 1528 sffp_mmc (e95d451f7ea3e583aec75f3b3ee42dc5) C:\Windows\system32\drivers\sffp_mmc.sys 10:26:40.0244 1528 sffp_mmc - ok 10:26:40.0291 1528 sffp_sd (3d0ea348784b7ac9ea9bd9f317980979) C:\Windows\system32\drivers\sffp_sd.sys 10:26:40.0306 1528 sffp_sd - ok 10:26:40.0400 1528 sfloppy (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys 10:26:40.0400 1528 sfloppy - ok 10:26:40.0462 1528 shpf (fd165f1309e8da2a969fbbb16635e459) C:\Windows\system32\DRIVERS\shpf.sys 10:26:40.0478 1528 shpf - ok 10:26:40.0650 1528 sisagp (1d76624a09a054f682d746b924e2dbc3) C:\Windows\system32\drivers\sisagp.sys 10:26:40.0665 1528 sisagp - ok 10:26:40.0774 1528 SiSRaid2 (43cb7aa756c7db280d01da9b676cfde2) C:\Windows\system32\drivers\sisraid2.sys 10:26:40.0790 1528 SiSRaid2 - ok 10:26:40.0868 1528 SiSRaid4 (a99c6c8b0baa970d8aa59ddc50b57f94) C:\Windows\system32\drivers\sisraid4.sys 10:26:40.0884 1528 SiSRaid4 - ok 10:26:40.0993 1528 Smb (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys 10:26:41.0008 1528 Smb - ok 10:26:41.0086 1528 SPI (225a17c6ad0207a058d728c0fa87e61d) C:\Windows\system32\DRIVERS\SonyPI.sys 10:26:41.0086 1528 SPI - ok 10:26:41.0196 1528 spldr (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys 10:26:41.0196 1528 spldr - ok 10:26:41.0227 1528 sptd - ok 10:26:41.0352 1528 srv (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys 10:26:41.0383 1528 srv - ok 10:26:41.0476 1528 srv2 (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys 10:26:41.0492 1528 srv2 - ok 10:26:41.0523 1528 srvnet (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys 10:26:41.0523 1528 srvnet - ok 10:26:41.0632 1528 ssmdrv (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys 10:26:41.0648 1528 ssmdrv - ok 10:26:41.0773 1528 swenum (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys 10:26:41.0788 1528 swenum - ok 10:26:41.0913 1528 Symc8xx (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys 10:26:41.0913 1528 Symc8xx - ok 10:26:41.0991 1528 Sym_hi (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys 10:26:42.0007 1528 Sym_hi - ok 10:26:42.0069 1528 Sym_u3 (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys 10:26:42.0069 1528 Sym_u3 - ok 10:26:42.0194 1528 Tcpip (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys 10:26:42.0210 1528 Tcpip - ok 10:26:42.0615 1528 Tcpip6 (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys 10:26:42.0631 1528 Tcpip6 - ok 10:26:42.0740 1528 tcpipreg (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys 10:26:42.0756 1528 tcpipreg - ok 10:26:42.0990 1528 TcUsb (53900527fa5e2ccc818c5894383772d1) C:\Windows\system32\Drivers\tcusb.sys 10:26:43.0146 1528 TcUsb - ok 10:26:43.0208 1528 TDPIPE (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys 10:26:43.0208 1528 TDPIPE - ok 10:26:43.0302 1528 TDTCP (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys 10:26:43.0348 1528 TDTCP - ok 10:26:43.0520 1528 tdx (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys 10:26:43.0567 1528 tdx - ok 10:26:43.0723 1528 TermDD (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys 10:26:43.0723 1528 TermDD - ok 10:26:43.0863 1528 TPM (cb258c2f726f1be73c507022be33ebb3) C:\Windows\system32\drivers\tpm.sys 10:26:43.0879 1528 TPM - ok 10:26:43.0972 1528 tssecsrv (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys 10:26:43.0972 1528 tssecsrv - ok 10:26:44.0066 1528 TuneUpUtilitiesDrv (f2107c9d85ec0df116939ccce06ae697) C:\Program Files\TuneUp Utilities 2012\TuneUpUtilitiesDriver32.sys 10:26:44.0082 1528 TuneUpUtilitiesDrv - ok 10:26:44.0175 1528 tunmp (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys 10:26:44.0175 1528 tunmp - ok 10:26:44.0253 1528 tunnel (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys 10:26:44.0253 1528 tunnel - ok 10:26:44.0456 1528 uagp35 (7d33c4db2ce363c8518d2dfcf533941f) C:\Windows\system32\drivers\uagp35.sys 10:26:44.0472 1528 uagp35 - ok 10:26:44.0596 1528 udfs (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys 10:26:44.0612 1528 udfs - ok 10:26:44.0674 1528 uliagpkx (b0acfdc9e4af279e9116c03e014b2b27) C:\Windows\system32\drivers\uliagpkx.sys 10:26:44.0690 1528 uliagpkx - ok 10:26:44.0799 1528 uliahci (9224bb254f591de4ca8d572a5f0d635c) C:\Windows\system32\drivers\uliahci.sys 10:26:44.0846 1528 uliahci - ok 10:26:44.0924 1528 UlSata (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys 10:26:44.0955 1528 UlSata - ok 10:26:45.0189 1528 ulsata2 (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys 10:26:45.0205 1528 ulsata2 - ok 10:26:45.0454 1528 umbus (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys 10:26:45.0454 1528 umbus - ok 10:26:45.0564 1528 USBAAPL (e8c1b9ebac65288e1b51e8a987d98af6) C:\Windows\system32\Drivers\usbaapl.sys 10:26:45.0579 1528 USBAAPL - ok 10:26:45.0673 1528 usbccgp (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys 10:26:45.0673 1528 usbccgp - ok 10:26:45.0876 1528 usbcir (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys 10:26:45.0891 1528 usbcir - ok 10:26:46.0141 1528 usbehci (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys 10:26:46.0141 1528 usbehci - ok 10:26:46.0234 1528 usbhub (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys 10:26:46.0250 1528 usbhub - ok 10:26:46.0312 1528 usbohci (38dbc7dd6cc5a72011f187425384388b) C:\Windows\system32\drivers\usbohci.sys 10:26:46.0312 1528 usbohci - ok 10:26:46.0422 1528 usbprint (e75c4b5269091d15a2e7dc0b6d35f2f5) C:\Windows\system32\DRIVERS\usbprint.sys 10:26:46.0422 1528 usbprint - ok 10:26:46.0468 1528 usbscan (a508c9bd8724980512136b039bba65e9) C:\Windows\system32\DRIVERS\usbscan.sys 10:26:46.0500 1528 usbscan - ok 10:26:46.0609 1528 USBSTOR (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS 10:26:46.0609 1528 USBSTOR - ok 10:26:46.0640 1528 usbuhci (814d653efc4d48be3b04a307eceff56f) C:\Windows\system32\DRIVERS\usbuhci.sys 10:26:46.0656 1528 usbuhci - ok 10:26:46.0687 1528 usbvideo (e67998e8f14cb0627a769f6530bcb352) C:\Windows\system32\Drivers\usbvideo.sys 10:26:46.0687 1528 usbvideo - ok 10:26:46.0796 1528 usb_rndisx (35c9095fa7076466afbfc5b9ec4b779e) C:\Windows\system32\DRIVERS\usb8023x.sys 10:26:46.0796 1528 usb_rndisx - ok 10:26:46.0890 1528 vga (87b06e1f30b749a114f74622d013f8d4) C:\Windows\system32\DRIVERS\vgapnp.sys 10:26:46.0905 1528 vga - ok 10:26:47.0092 1528 VgaSave (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys 10:26:47.0108 1528 VgaSave - ok 10:26:47.0186 1528 viaagp (5d7159def58a800d5781ba3a879627bc) C:\Windows\system32\drivers\viaagp.sys 10:26:47.0202 1528 viaagp - ok 10:26:47.0248 1528 ViaC7 (c4f3a691b5bad343e6249bd8c2d45dee) C:\Windows\system32\drivers\viac7.sys 10:26:47.0264 1528 ViaC7 - ok 10:26:47.0358 1528 viaide (aadf5587a4063f52c2c3fed7887426fc) C:\Windows\system32\drivers\viaide.sys 10:26:47.0373 1528 viaide - ok 10:26:47.0451 1528 VNUSB (ae01e1ed5a81e0d268b91b4a6de5a872) C:\Windows\system32\DRIVERS\VNUSB.sys 10:26:47.0467 1528 VNUSB - ok 10:26:47.0607 1528 volmgr (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys 10:26:47.0623 1528 volmgr - ok 10:26:47.0685 1528 volmgrx (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys 10:26:47.0716 1528 volmgrx - ok 10:26:47.0810 1528 volsnap (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys 10:26:47.0841 1528 volsnap - ok 10:26:48.0028 1528 vsmraid (587253e09325e6bf226b299774b728a9) C:\Windows\system32\drivers\vsmraid.sys 10:26:48.0044 1528 vsmraid - ok 10:26:48.0247 1528 WacomPen (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys 10:26:48.0262 1528 WacomPen - ok 10:26:48.0340 1528 Wanarp (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 10:26:48.0356 1528 Wanarp - ok 10:26:48.0372 1528 Wanarpv6 (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys 10:26:48.0387 1528 Wanarpv6 - ok 10:26:48.0465 1528 Wd (78fe9542363f297b18c027b2d7e7c07f) C:\Windows\system32\drivers\wd.sys 10:26:48.0465 1528 Wd - ok 10:26:48.0574 1528 Wdf01000 (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys 10:26:48.0590 1528 Wdf01000 - ok 10:26:48.0918 1528 WimFltr (f9ad3a5e3fd7e0bdb18b8202b0fdd4e4) C:\Windows\system32\DRIVERS\wimfltr.sys 10:26:48.0933 1528 WimFltr - ok 10:26:49.0198 1528 winachsf (6d2350bb6e77e800fc4be4e5b7a2e89a) C:\Windows\system32\DRIVERS\HSX_CNXT.sys 10:26:49.0245 1528 winachsf - ok 10:26:49.0417 1528 WmiAcpi (2e7255d172df0b8283cdfb7b433b864e) C:\Windows\system32\DRIVERS\wmiacpi.sys 10:26:49.0417 1528 WmiAcpi - ok 10:26:49.0479 1528 ws2ifsl (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys 10:26:49.0479 1528 ws2ifsl - ok 10:26:49.0604 1528 WUDFRd (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys 10:26:49.0604 1528 WUDFRd - ok 10:26:49.0635 1528 XAudio (5a7ff9a18ff6d7e0527fe3abf9204ef8) C:\Windows\system32\DRIVERS\xaudio.sys 10:26:49.0635 1528 XAudio - ok 10:26:49.0776 1528 yukonwlh (04e268adfc81964c49dc0c082d520f7e) C:\Windows\system32\DRIVERS\yk60x86.sys 10:26:49.0807 1528 yukonwlh - ok 10:26:49.0978 1528 ZYXEL750 (1fd4be45f40f7534472b7b23fa223f6e) C:\Windows\system32\DRIVERS\WlanUTG.sys 10:26:49.0994 1528 ZYXEL750 - ok 10:26:50.0088 1528 MBR (0x1B8) (5c616939100b85e558da92b899a0fc36) \Device\Harddisk0\DR0 10:26:50.0103 1528 \Device\Harddisk0\DR0 - ok 10:26:50.0119 1528 Boot (0x1200) (cfb49b55e14d706fe9e9c2112c6a139c) \Device\Harddisk0\DR0\Partition0 10:26:50.0119 1528 \Device\Harddisk0\DR0\Partition0 - ok 10:26:50.0119 1528 ============================================================ 10:26:50.0119 1528 Scan finished 10:26:50.0119 1528 ============================================================ 10:26:50.0150 5800 Detected object count: 0 10:26:50.0150 5800 Actual detected object count: 0 |
|
02.12.2011, 11:56
| #11 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner Hi, sieht gut, was macht der Rechner (speziell die aufpoppende cmd.exe)? chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
02.12.2011, 14:32
| #12 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner hi, erst mal vielen, vielen dank!! die cmd.exe öffnet und verschwindet sich leider nach wie vor noch von selbst, aber lange nicht mehr so oft wie vorher.. vielleicht setze ich das ganze wenn ich mal zeit hab doch einfach komplett neu auf. Wenn das erstmal so alles ganz okay aussieht ist das ja vielleicht auch nicht ganz so dringend.. Nochmal vielen Dank für die gute Hilfe! |
|
02.12.2011, 16:33
| #13 |
| | cmd.exe und mahmud.exe - Bundespolizei Trojaner Hi, wir probieren noch zwei Sachen aus, von CD scannen und system "optimieren" lassen... Antivir, Rescue-CD Avira Support Dort bitte das Rescue System sowie das update dazu runterladen. Beim Start der Anwendung leere CD in den Brenner, CD brennen lassen. Zweite CD brennen mit dem ausgepackten Update. Von CD booten (Einstellung im BIOS vornehmen)... Wenn nichts mehr geht - Avira bietet Rettungs-CD zum Download an - Antivirus & Antispyware - PC-WELT bzw. bei ATI-Grafikkarten lieber die nehmen: Dr. Web-Live-CD Lade Dir das Abbild (Dr.Web CureIt! —) runter (jeweils die neuste Version, z. Z. http://download.geo.drweb.com/pub/dr...livecd-600.iso) und brenne es auf CD/DVD. Stelle dann im BIOS die Bootreihenfolge um (zuerst von CD booten), boote dann von der erstellten CD und starte Dr. Web Live CD (default). Lass dann alle Festplatten untersuchen... Bei Funden bitte Name und Pfad notieren, bevor du sie von Dr. Web beseitigen lässt... Weiter Anweisungen: Dr.Web CureIt! — Und noch: System Reparieren: Lade Dir "Advanced Windowscare Professional" von folgender Adresse: Advanced SystemCare Free 5/4/3 Download Review for Windows XP/Vista/7 - IObit Installieren auf Deutsch, Yahoo-Toolbar etc. abwählen. Erstelle einen Systemwiederherstellungspunkt (Start->Programme->Zubehör->Systemprogramme->Systemwiederherstellung->einen Wiederherstellungspunkt erstellen->weiter, Beschreibung ausdenken->Erstellen) oder lasse ihn automatisch erstellen. Lasse dann das gesamte System scannen und Bereinigen sowie Immunisieren. Damit werden einige Einträge wieder gerade gebogen, die von Trojaneren/Viren verbogen worden sind... Berichtet dann bitte noch.... chris
__________________ Don't bring me downVor dem posten beachten! Spenden (Wer spenden will, kann sich gerne melden ) |
|
| Themen zu cmd.exe und mahmud.exe - Bundespolizei Trojaner |
| adaware, bli, blinkt, bundespolizei trojaner, cmd.exe, e-banking, erkannt, erkennen, fenster, folge, folgendes, griff, hilfe!, kurze, mahmud.exe, nicht mehr, nicht sicher, nichts, online-banking, problem, schwarz, startet, trojane, trojaner, verschwindet, virus, virustotal, woche, wochen |
Linear-Darstellung
