Antivir Fund gefährlich ? Lohnt eine Suche oder eher das System neu aufspielen ?

muffin0815 · 07.04.2012, 17:16

Zitat:

Sagmal gehörst du auch zur der Fraktion, die sich Serien und Kinofilme über dubiose Portale anschaut?

Mit nichten !!! Dieser Erscheinung der Neuzeit habe ich schon lange abgedankt !
Auf dem Laptop liefen noch nie Serien oder Kino Filme oder irgend welche Streams auser Youtoub und Facebook!

das Divx kommt zu 100 Prozent von Youtoub oder Facebook ! oder habe ich mir über Mail eingefangen das zeug anders kann ich mir das nicht erklähren.
Da ich eigentlich mit dem Laptop nur Mails und meine Einkauftätigkeiten erledig.
Daher dachte ich eigentlich ist Sicher mein Laptopp bis zum Avirafund !
Auf jeden fall werd ich schauen das ich diesen Player los bekomme !
Muss ich da Mozilla deinstallieren und neu aufspielen ??? !

Gruß und schöne Ostern auch noch

cosinus · 07.04.2012, 18:29

Nein ist schon, war nur eine Warnung für den Fall der Fälle, weil ich DivX bei dir gesehen habe

entspann dich

Mach einen OTL-Fix, beende alle evtl. geöffneten Programme, auch Virenscanner deaktivieren (!), starte OTL und kopiere folgenden Text in die "Custom Scan/Fixes" Box (unten in OTL): (das ":OTL" muss mitkopiert werden!!!)

Hinweis: Falls Du Deinen Benutzernamen unkenntlich gemacht hast, musst Du das Ausgesternte in Deinen richtigen Benutzernamen wieder verwandeln, sonst funktioniert das Script nicht!!

Code:

ATTFilter

:OTL
IE - HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\SOFTWARE\Microsoft\Internet Explorer\Main,Start Page = http://start.icq.com/
IE - HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\..\URLSearchHook:  - No CLSID value found
IE - HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\..\URLSearchHook: {855F3B16-6D32-4fe6-8A56-BBB695989046} - C:\Programme\ICQ6Toolbar\ICQToolBar.dll (ICQ)
IE - HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\..\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}: "URL" = http://search.icq.com/search/results.php?q={searchTerms}&ch_id=osd
FF - prefs.js..browser.search.defaultenginename: "ICQ Search"
FF - prefs.js..keyword.URL: "http://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q="
[2012.04.03 16:38:43 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Users\Fässi Nutzer\AppData\Roaming\mozilla\Firefox\Profiles\7c6jnqz6.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
[2012.04.05 20:27:15 | 000,000,950 | ---- | M] () -- C:\Users\Fässi Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7c6jnqz6.default\searchplugins\icqplugin.xml
[2009.10.13 10:45:12 | 000,000,000 | ---D | M] ("ICQ Toolbar") -- C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}
O6 - HKLM\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System: NoHotStart = 0
O32 - Unable to read "AutoRun" value or value not present!
O32 - AutoRun File - [2006.09.18 23:43:36 | 000,000,024 | ---- | M] () - C:\autoexec.bat -- [ NTFS ]
@Alternate Data Stream - 147 bytes -> C:\ProgramData\TEMP:DFC5A2B2
@Alternate Data Stream - 142 bytes -> C:\ProgramData\TEMP:B1E5544A
@Alternate Data Stream - 114 bytes -> C:\ProgramData\TEMP:A8ADE5D8
:Files
C:\Programme\ICQ6Toolbar
:Commands
[purity]
[emptytemp]
[emptyflash]
[resethosts]

Klick dann oben links auf den Button Fix!
Das Logfile müsste geöffnet werden, wenn Du nach dem Fixen auf ok klickst, poste das bitte. Evtl. wird der Rechner neu gestartet.

Die mit diesem Script gefixten Einträge, Dateien und Ordner werden zur Sicherheit nicht vollständig gelöscht, es wird eine Sicherheitskopie auf der Systempartition im Ordner "_OTL" erstellt.

Hinweis: Das obige Script ist nur für diesen einen User in dieser Situtation erstellt worden. Es ist auf keinen anderen Rechner portierbar und darf nicht anderweitig verwandt werden, da es das System nachhaltig schädigen kann!

muffin0815 · 07.04.2012, 18:54

So hier der log :

Code:

ATTFilter

All processes killed
========== OTL ==========
HKU\S-1-5-21-1895092649-2944749539-1579830581-1006\SOFTWARE\Microsoft\Internet Explorer\Main\\Start Page| /E : value set successfully!
Registry value HKEY_USERS\S-1-5-21-1895092649-2944749539-1579830581-1006\Software\Microsoft\Internet Explorer\URLSearchHooks\\ deleted successfully.
Registry value HKEY_USERS\S-1-5-21-1895092649-2944749539-1579830581-1006\Software\Microsoft\Internet Explorer\URLSearchHooks\\{855F3B16-6D32-4fe6-8A56-BBB695989046} deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{855F3B16-6D32-4fe6-8A56-BBB695989046}\ deleted successfully.
C:\Programme\ICQ6Toolbar\ICQToolBar.dll moved successfully.
Registry key HKEY_USERS\S-1-5-21-1895092649-2944749539-1579830581-1006\Software\Microsoft\Internet Explorer\SearchScopes\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ deleted successfully.
Registry key HKEY_LOCAL_MACHINE\SOFTWARE\Classes\CLSID\{6552C7DD-90A4-4387-B795-F8F96747DE19}\ not found.
Prefs.js: "ICQ Search" removed from browser.search.defaultenginename
Prefs.js: "hxxp://search.icq.com/search/afe_results.php?ch_id=afex&tb_ver=1.4.7&q=" removed from keyword.URL
Folder C:\Users\Fässi Nutzer\AppData\Roaming\mozilla\Firefox\Profiles\7c6jnqz6.default\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\ not found.
C:\Users\Fässi Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7c6jnqz6.default\searchplugins\icqplugin.xml moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\search_engine folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\META-INF folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults\preferences folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\defaults folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\components folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07}\chrome folder moved successfully.
C:\Programme\Mozilla Firefox\extensions\{800b5000-a755-47e1-992b-48a1c1357f07} folder moved successfully.
Registry value HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\policies\System\\NoHotStart deleted successfully.
File  not found.
C:\autoexec.bat moved successfully.
ADS C:\ProgramData\TEMP:DFC5A2B2 deleted successfully.
ADS C:\ProgramData\TEMP:B1E5544A deleted successfully.
ADS C:\ProgramData\TEMP:A8ADE5D8 deleted successfully.
========== FILES ==========
File\Folder C:\Programme\ICQ6Toolbar not found.
========== COMMANDS ==========
 
[EMPTYTEMP]
 
User: All Users
 
User: Default
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 33170 bytes
 
User: Default User
->Temp folder emptied: 0 bytes
->Temporary Internet Files folder emptied: 0 bytes
 
User: Fässi
->Temp folder emptied: 1554374586 bytes
->Temporary Internet Files folder emptied: 75858324 bytes
->Java cache emptied: 35594022 bytes
->FireFox cache emptied: 227636292 bytes
->Flash cache emptied: 93768 bytes
 
User: Fässi Nutzer
->Temp folder emptied: 5149215 bytes
->Temporary Internet Files folder emptied: 2710639 bytes
->Java cache emptied: 0 bytes
->FireFox cache emptied: 60843704 bytes
->Flash cache emptied: 707 bytes
 
User: Public
 
User: Sandra
->Temp folder emptied: 8662303 bytes
->Temporary Internet Files folder emptied: 49074119 bytes
->Java cache emptied: 31492502 bytes
->FireFox cache emptied: 482041770 bytes
->Flash cache emptied: 8951 bytes
 
%systemdrive% .tmp files removed: 0 bytes
%systemroot% .tmp files removed: 24 bytes
%systemroot%\System32 .tmp files removed: 0 bytes
%systemroot%\System32\drivers .tmp files removed: 0 bytes
Windows Temp folder emptied: 230347144 bytes
RecycleBin emptied: 0 bytes
 
Total Files Cleaned = 2.636,00 mb
 
 
[EMPTYFLASH]
 
User: All Users
 
User: Default
 
User: Default User
 
User: Fässi
->Flash cache emptied: 0 bytes
 
User: Fässi Nutzer
->Flash cache emptied: 0 bytes
 
User: Public
 
User: Sandra
->Flash cache emptied: 0 bytes
 
Total Flash Files Cleaned = 0,00 mb
 
C:\Windows\System32\drivers\etc\Hosts moved successfully.
HOSTS file reset successfully
 
OTL by OldTimer - Version 3.2.39.2 log created on 04072012_193946

Files\Folders moved on Reboot...

Registry entries deleted on Reboot...

cosinus · 07.04.2012, 19:02

Bitte nun (im normalen Windows-Modus) dieses Tool von Kaspersky (TDSS-Killer) ausführen und das Log posten Anleitung und Downloadlink hier => http://www.trojaner-board.de/82358-t...entfernen.html

Hinweis: Bitte den Virenscanner abstellen bevor du den TDSS-Killer ausführst, denn v.a. Avira meldet im TDSS-Tool oft einen Fehalalrm!

Das Tool so einstellen wie unten im Bild angegeben - klick auf change parameters und setze die Haken wie im folgenden Screenshot abgebildet,
Dann auf Start Scan klicken und wenn es durch ist auf den Button Report klicken um das Log anzuzeigen. Dieses bitte komplett posten.
Wenn du das Log nicht findest oder den Inhalt kopieren und in dein Posting übertragen kannst, dann schau bitte direkt auf deiner Windows-Systempartition (meistens Laufwerk C

nach, da speichert der TDSS-Killer seine Logs.

Hinweis: Bitte nichts voreilig mit dem TDSS-Killer löschen! Falls Objekte vom TDSS-Killer bemängelt werden, alle mit der Aktion "skip" behandeln und hier nur das Log posten!

muffin0815 · 07.04.2012, 19:25

Code:

ATTFilter

20:19:13.0790 1408	TDSS rootkit removing tool 2.7.26.0 Apr  4 2012 19:52:02
20:19:14.0211 1408	============================================================
20:19:14.0211 1408	Current date / time: 2012/04/07 20:19:14.0211
20:19:14.0211 1408	SystemInfo:
20:19:14.0211 1408	
20:19:14.0227 1408	OS Version: 6.0.6002 ServicePack: 2.0
20:19:14.0227 1408	Product type: Workstation
20:19:14.0227 1408	ComputerName: FÄSSI-LP
20:19:14.0227 1408	UserName: Fässi Nutzer
20:19:14.0227 1408	Windows directory: C:\Windows
20:19:14.0227 1408	System windows directory: C:\Windows
20:19:14.0227 1408	Processor architecture: Intel x86
20:19:14.0227 1408	Number of processors: 2
20:19:14.0227 1408	Page size: 0x1000
20:19:14.0227 1408	Boot type: Normal boot
20:19:14.0227 1408	============================================================
20:19:15.0475 1408	Drive \Device\Harddisk0\DR0 - Size: 0x25433D6000 (149.05 Gb), SectorSize: 0x200, Cylinders: 0x4C01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000050
20:19:15.0475 1408	Drive \Device\Harddisk1\DR1 - Size: 0x1DD800000 (7.46 Gb), SectorSize: 0x200, Cylinders: 0x3CD, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:19:15.0475 1408	Drive \Device\Harddisk2\DR2 - Size: 0x1DD800000 (7.46 Gb), SectorSize: 0x200, Cylinders: 0x3CD, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'W'
20:19:15.0475 1408	\Device\Harddisk0\DR0:
20:19:15.0475 1408	MBR used
20:19:15.0475 1408	\Device\Harddisk0\DR0\Partition0: MBR, Type 0x7, StartLBA 0x1400800, BlocksNum 0xA0F7924
20:19:15.0475 1408	\Device\Harddisk1\DR1:
20:19:15.0475 1408	MBR used
20:19:15.0475 1408	\Device\Harddisk1\DR1\Partition0: MBR, Type 0xB, StartLBA 0x20, BlocksNum 0xEEBFE0
20:19:15.0475 1408	\Device\Harddisk2\DR2:
20:19:15.0491 1408	MBR used
20:19:15.0491 1408	\Device\Harddisk2\DR2\Partition0: MBR, Type 0xC, StartLBA 0x20, BlocksNum 0xEEBFE0
20:19:15.0506 1408	Initialize success
20:19:15.0506 1408	============================================================
20:20:07.0891 0796	============================================================
20:20:07.0891 0796	Scan started
20:20:07.0891 0796	Mode: Manual; SigCheck; TDLFS; 
20:20:07.0891 0796	============================================================
20:20:08.0952 0796	AAV UpdateService (7eeb488346fbfa3731276c3ee8a8fd9e) C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
20:20:09.0077 0796	AAV UpdateService - ok
20:20:09.0186 0796	ACPI            (82b296ae1892fe3dbee00c9cf92f8ac7) C:\Windows\system32\drivers\acpi.sys
20:20:09.0201 0796	ACPI - ok
20:20:09.0264 0796	AdobeARMservice (62b7936f9036dd6ed36e6a7efa805dc0) C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
20:20:09.0264 0796	AdobeARMservice - ok
20:20:09.0404 0796	AdobeFlashPlayerUpdateSvc (0d4c486a24a711a45fd83acdf4d18506) C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
20:20:09.0420 0796	AdobeFlashPlayerUpdateSvc - ok
20:20:09.0529 0796	adp94xx         (2edc5bbac6c651ece337bde8ed97c9fb) C:\Windows\system32\drivers\adp94xx.sys
20:20:09.0576 0796	adp94xx - ok
20:20:09.0669 0796	adpahci         (b84088ca3cdca97da44a984c6ce1ccad) C:\Windows\system32\drivers\adpahci.sys
20:20:09.0685 0796	adpahci - ok
20:20:09.0747 0796	adpu160m        (7880c67bccc27c86fd05aa2afb5ea469) C:\Windows\system32\drivers\adpu160m.sys
20:20:09.0763 0796	adpu160m - ok
20:20:09.0825 0796	adpu320         (9ae713f8e30efc2abccd84904333df4d) C:\Windows\system32\drivers\adpu320.sys
20:20:09.0841 0796	adpu320 - ok
20:20:09.0935 0796	AeLookupSvc     (9d1fda9e086ba64e3c93c9de32461bcf) C:\Windows\System32\aelupsvc.dll
20:20:10.0106 0796	AeLookupSvc - ok
20:20:10.0231 0796	AFD             (3911b972b55fea0478476b2e777b29fa) C:\Windows\system32\drivers\afd.sys
20:20:10.0309 0796	AFD - ok
20:20:10.0356 0796	AgereModemAudio (39e435c90c9c4f780fa0ed05ca3c3a1b) C:\Windows\system32\agrsmsvc.exe
20:20:10.0434 0796	AgereModemAudio - ok
20:20:10.0621 0796	AgereSoftModem  (ce91b158fa490cf4c4d487a4130f4660) C:\Windows\system32\DRIVERS\AGRSM.sys
20:20:10.0777 0796	AgereSoftModem - ok
20:20:10.0871 0796	agp440          (ef23439cdd587f64c2c1b8825cead7d8) C:\Windows\system32\drivers\agp440.sys
20:20:10.0886 0796	agp440 - ok
20:20:10.0995 0796	aic78xx         (ae1fdf7bf7bb6c6a70f67699d880592a) C:\Windows\system32\drivers\djsvs.sys
20:20:11.0011 0796	aic78xx - ok
20:20:11.0058 0796	ALG             (a1545b731579895d8cc44fc0481c1192) C:\Windows\System32\alg.exe
20:20:11.0183 0796	ALG - ok
20:20:11.0323 0796	aliide          (90395b64600ebb4552e26e178c94b2e4) C:\Windows\system32\drivers\aliide.sys
20:20:11.0323 0796	aliide - ok
20:20:11.0417 0796	amdagp          (2b13e304c9dfdfa5eb582f6a149fa2c7) C:\Windows\system32\drivers\amdagp.sys
20:20:11.0432 0796	amdagp - ok
20:20:11.0495 0796	amdide          (0577df1d323fe75a739c787893d300ea) C:\Windows\system32\drivers\amdide.sys
20:20:11.0510 0796	amdide - ok
20:20:11.0635 0796	AmdK7           (dc487885bcef9f28eece6fac0e5ddfc5) C:\Windows\system32\drivers\amdk7.sys
20:20:11.0838 0796	AmdK7 - ok
20:20:11.0900 0796	AmdK8           (0ca0071da4315b00fc1328ca86b425da) C:\Windows\system32\drivers\amdk8.sys
20:20:11.0963 0796	AmdK8 - ok
20:20:12.0056 0796	AntiVirSchedulerService (a122d68ea2541453f787f341877cb40b) C:\Program Files\Avira\AntiVir Desktop\sched.exe
20:20:12.0072 0796	AntiVirSchedulerService - ok
20:20:12.0119 0796	AntiVirService  (2fe359edeb34efcf42574752f8aebd3f) C:\Program Files\Avira\AntiVir Desktop\avguard.exe
20:20:12.0134 0796	AntiVirService - ok
20:20:12.0228 0796	Appinfo         (c6d704c7f0434dc791aac37cac4b6e14) C:\Windows\System32\appinfo.dll
20:20:12.0306 0796	Appinfo - ok
20:20:12.0399 0796	arc             (5f673180268bb1fdb69c99b6619fe379) C:\Windows\system32\drivers\arc.sys
20:20:12.0415 0796	arc - ok
20:20:12.0540 0796	arcsas          (957f7540b5e7f602e44648c7de5a1c05) C:\Windows\system32\drivers\arcsas.sys
20:20:12.0555 0796	arcsas - ok
20:20:12.0680 0796	AsyncMac        (53b202abee6455406254444303e87be1) C:\Windows\system32\DRIVERS\asyncmac.sys
20:20:12.0727 0796	AsyncMac - ok
20:20:12.0805 0796	atapi           (1f05b78ab91c9075565a9d8a4b880bc4) C:\Windows\system32\drivers\atapi.sys
20:20:12.0821 0796	atapi - ok
20:20:12.0914 0796	athr            (f32fee7cb2ee32c1f808409bc8019701) C:\Windows\system32\DRIVERS\athr.sys
20:20:13.0039 0796	athr - ok
20:20:13.0148 0796	Ati External Event Utility (d29cae8aa91e405a569892fa3d97aa64) C:\Windows\system32\Ati2evxx.exe
20:20:13.0242 0796	Ati External Event Utility - ok
20:20:13.0398 0796	atikmdag        (e46f2fb11cfe13187a4e3ef512c0d226) C:\Windows\system32\DRIVERS\atikmdag.sys
20:20:13.0757 0796	atikmdag - ok
20:20:13.0850 0796	AtiPcie         (4aa1eb65481c392955939e735d27118b) C:\Windows\system32\DRIVERS\AtiPcie.sys
20:20:13.0897 0796	AtiPcie - ok
20:20:13.0975 0796	AudioEndpointBuilder (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
20:20:14.0022 0796	AudioEndpointBuilder - ok
20:20:14.0037 0796	Audiosrv        (68e2a1a0407a66cf50da0300852424ab) C:\Windows\System32\Audiosrv.dll
20:20:14.0069 0796	Audiosrv - ok
20:20:14.0209 0796	avgntflt        (7713e4eb0276702faa08e52a6e23f2a6) C:\Windows\system32\DRIVERS\avgntflt.sys
20:20:14.0240 0796	avgntflt - ok
20:20:14.0303 0796	avipbb          (13b02b9b969dde270cd7c351203dad3c) C:\Windows\system32\DRIVERS\avipbb.sys
20:20:14.0349 0796	avipbb - ok
20:20:14.0396 0796	avkmgr          (271cfd1a989209b1964e24d969552bf7) C:\Windows\system32\DRIVERS\avkmgr.sys
20:20:14.0412 0796	avkmgr - ok
20:20:14.0490 0796	Beep            (67e506b75bd5326a3ec7b70bd014dfb6) C:\Windows\system32\drivers\Beep.sys
20:20:14.0521 0796	Beep - ok
20:20:14.0661 0796	BFE             (c789af0f724fda5852fb9a7d3a432381) C:\Windows\System32\bfe.dll
20:20:14.0708 0796	BFE - ok
20:20:14.0786 0796	BITS            (93952506c6d67330367f7e7934b6a02f) C:\Windows\System32\qmgr.dll
20:20:14.0927 0796	BITS - ok
20:20:15.0005 0796	blbdrive - ok
20:20:15.0067 0796	bowser          (35f376253f687bde63976ccb3f2108ca) C:\Windows\system32\DRIVERS\bowser.sys
20:20:15.0114 0796	bowser - ok
20:20:15.0254 0796	BrFiltLo        (9f9acc7f7ccde8a15c282d3f88b43309) C:\Windows\system32\drivers\brfiltlo.sys
20:20:15.0285 0796	BrFiltLo - ok
20:20:15.0363 0796	BrFiltUp        (56801ad62213a41f6497f96dee83755a) C:\Windows\system32\drivers\brfiltup.sys
20:20:15.0395 0796	BrFiltUp - ok
20:20:15.0457 0796	Browser         (a3629a0c4226f9e9c72faaeebc3ad33c) C:\Windows\System32\browser.dll
20:20:15.0504 0796	Browser - ok
20:20:15.0644 0796	Brserid         (b304e75cff293029eddf094246747113) C:\Windows\system32\drivers\brserid.sys
20:20:15.0722 0796	Brserid - ok
20:20:15.0785 0796	BrSerWdm        (203f0b1e73adadbbb7b7b1fabd901f6b) C:\Windows\system32\drivers\brserwdm.sys
20:20:15.0847 0796	BrSerWdm - ok
20:20:15.0909 0796	BrUsbMdm        (bd456606156ba17e60a04e18016ae54b) C:\Windows\system32\drivers\brusbmdm.sys
20:20:15.0987 0796	BrUsbMdm - ok
20:20:16.0112 0796	BrUsbSer        (af72ed54503f717a43268b3cc5faec2e) C:\Windows\system32\drivers\brusbser.sys
20:20:16.0190 0796	BrUsbSer - ok
20:20:16.0268 0796	BthEnum         (064fbc56921051de1075495d628b815f) C:\Windows\system32\DRIVERS\BthEnum.sys
20:20:16.0331 0796	BthEnum - ok
20:20:16.0393 0796	BTHMODEM        (ad07c1ec6665b8b35741ab91200c6b68) C:\Windows\system32\drivers\bthmodem.sys
20:20:16.0471 0796	BTHMODEM - ok
20:20:16.0565 0796	BthPan          (b8c3d9ddf85fd197c3e5f849fef71144) C:\Windows\system32\DRIVERS\bthpan.sys
20:20:16.0627 0796	BthPan - ok
20:20:16.0705 0796	BTHPORT         (b24757d9154cca035e1bbd3db92966d7) C:\Windows\system32\Drivers\BTHport.sys
20:20:16.0736 0796	BTHPORT - ok
20:20:16.0799 0796	BthServ         (a4c8377fa4a994e07075107dbe2e3dce) C:\Windows\System32\bthserv.dll
20:20:16.0845 0796	BthServ - ok
20:20:16.0955 0796	BTHUSB          (d42cf5f0c7635b3f1578810fe34d9e41) C:\Windows\system32\Drivers\BTHUSB.sys
20:20:16.0970 0796	BTHUSB - ok
20:20:17.0048 0796	btwaudio        (636f45a8500c1438cfa7dee15fc5c184) C:\Windows\system32\drivers\btwaudio.sys
20:20:17.0048 0796	btwaudio - ok
20:20:17.0111 0796	btwavdt         (bf9256ff01b093a5d90bb7a35ec90410) C:\Windows\system32\drivers\btwavdt.sys
20:20:17.0111 0796	btwavdt - ok
20:20:17.0220 0796	btwrchid        (0ab8c1ac177afb27309e1072faf34a37) C:\Windows\system32\DRIVERS\btwrchid.sys
20:20:17.0235 0796	btwrchid - ok
20:20:17.0360 0796	cdfs            (7add03e75beb9e6dd102c3081d29840a) C:\Windows\system32\DRIVERS\cdfs.sys
20:20:17.0423 0796	cdfs - ok
20:20:17.0501 0796	cdrom           (6b4bffb9becd728097024276430db314) C:\Windows\system32\DRIVERS\cdrom.sys
20:20:17.0532 0796	cdrom - ok
20:20:17.0672 0796	CertPropSvc     (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
20:20:17.0719 0796	CertPropSvc - ok
20:20:17.0781 0796	circlass        (da8e0afc7baa226c538ef53ac2f90897) C:\Windows\system32\drivers\circlass.sys
20:20:17.0844 0796	circlass - ok
20:20:17.0906 0796	CLFS            (d7659d3b5b92c31e84e53c1431f35132) C:\Windows\system32\CLFS.sys
20:20:17.0937 0796	CLFS - ok
20:20:18.0000 0796	clr_optimization_v2.0.50727_32 (8ee772032e2fe80a924f3b8dd5082194) C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe
20:20:18.0015 0796	clr_optimization_v2.0.50727_32 - ok
20:20:18.0125 0796	clr_optimization_v4.0.30319_32 (c5a75eb48e2344abdc162bda79e16841) C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
20:20:18.0140 0796	clr_optimization_v4.0.30319_32 - ok
20:20:18.0249 0796	CmBatt          (99afc3795b58cc478fbbbcdc658fcb56) C:\Windows\system32\DRIVERS\CmBatt.sys
20:20:18.0296 0796	CmBatt - ok
20:20:18.0343 0796	cmdide          (45201046c776ffdaf3fc8a0029c581c8) C:\Windows\system32\drivers\cmdide.sys
20:20:18.0359 0796	cmdide - ok
20:20:18.0421 0796	Compbatt        (6afef0b60fa25de07c0968983ee4f60a) C:\Windows\system32\DRIVERS\compbatt.sys
20:20:18.0437 0796	Compbatt - ok
20:20:18.0468 0796	COMSysApp - ok
20:20:18.0515 0796	crcdisk         (2a213ae086bbec5e937553c7d9a2b22c) C:\Windows\system32\drivers\crcdisk.sys
20:20:18.0515 0796	crcdisk - ok
20:20:18.0593 0796	Crusoe          (22a7f883508176489f559ee745b5bf5d) C:\Windows\system32\drivers\crusoe.sys
20:20:18.0671 0796	Crusoe - ok
20:20:18.0749 0796	CryptSvc        (fb27772beaf8e1d28ccd825c09da939b) C:\Windows\system32\cryptsvc.dll
20:20:18.0795 0796	CryptSvc - ok
20:20:18.0873 0796	DcomLaunch      (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
20:20:18.0983 0796	DcomLaunch - ok
20:20:19.0061 0796	DfsC            (622c41a07ca7e6dd91770f50d532cb6c) C:\Windows\system32\Drivers\dfsc.sys
20:20:19.0107 0796	DfsC - ok
20:20:19.0263 0796	DFSR            (2cc3dcfb533a1035b13dcab6160ab38b) C:\Windows\system32\DFSR.exe
20:20:19.0482 0796	DFSR - ok
20:20:19.0591 0796	dg_ssudbus      (919f338fd36f47d860775368d0748780) C:\Windows\system32\DRIVERS\ssudbus.sys
20:20:19.0607 0796	dg_ssudbus - ok
20:20:19.0731 0796	Dhcp            (9028559c132146fb75eb7acf384b086a) C:\Windows\System32\dhcpcsvc.dll
20:20:19.0763 0796	Dhcp - ok
20:20:19.0872 0796	disk            (5d4aefc3386920236a548271f8f1af6a) C:\Windows\system32\drivers\disk.sys
20:20:19.0887 0796	disk - ok
20:20:19.0950 0796	Dnscache        (57d762f6f5974af0da2be88a3349baaa) C:\Windows\System32\dnsrslvr.dll
20:20:19.0997 0796	Dnscache - ok
20:20:20.0075 0796	dot3svc         (324fd74686b1ef5e7c19a8af49e748f6) C:\Windows\System32\dot3svc.dll
20:20:20.0106 0796	dot3svc - ok
20:20:20.0215 0796	DPS             (a622e888f8aa2f6b49e9bc466f0e5def) C:\Windows\system32\dps.dll
20:20:20.0262 0796	DPS - ok
20:20:20.0340 0796	drmkaud         (97fef831ab90bee128c9af390e243f80) C:\Windows\system32\drivers\drmkaud.sys
20:20:20.0371 0796	drmkaud - ok
20:20:20.0480 0796	DXGKrnl         (c68ac676b0ef30cfbb1080adce49eb1f) C:\Windows\System32\drivers\dxgkrnl.sys
20:20:20.0527 0796	DXGKrnl - ok
20:20:20.0621 0796	E1G60           (f88fb26547fd2ce6d0a5af2985892c48) C:\Windows\system32\DRIVERS\E1G60I32.sys
20:20:20.0714 0796	E1G60 - ok
20:20:20.0777 0796	EapHost         (c0b95e40d85cd807d614e264248a45b9) C:\Windows\System32\eapsvc.dll
20:20:20.0808 0796	EapHost - ok
20:20:20.0933 0796	Ecache          (7f64ea048dcfac7acf8b4d7b4e6fe371) C:\Windows\system32\drivers\ecache.sys
20:20:20.0964 0796	Ecache - ok
20:20:21.0026 0796	ehRecvr         (9be3744d295a7701eb425332014f0797) C:\Windows\ehome\ehRecvr.exe
20:20:21.0073 0796	ehRecvr - ok
20:20:21.0104 0796	ehSched         (ad1870c8e5d6dd340c829e6074bf3c3f) C:\Windows\ehome\ehsched.exe
20:20:21.0167 0796	ehSched - ok
20:20:21.0182 0796	ehstart         (c27c4ee8926e74aa72efcab24c5242c3) C:\Windows\ehome\ehstart.dll
20:20:21.0213 0796	ehstart - ok
20:20:21.0338 0796	elxstor         (e8f3f21a71720c84bcf423b80028359f) C:\Windows\system32\drivers\elxstor.sys
20:20:21.0369 0796	elxstor - ok
20:20:21.0447 0796	EMDMgmt         (4e6b23dfc917ea39306b529b773950f4) C:\Windows\system32\emdmgmt.dll
20:20:21.0572 0796	EMDMgmt - ok
20:20:21.0697 0796	epmntdrv        (539ca34fbc74ec366a0d751028c32a08) C:\Windows\system32\epmntdrv.sys
20:20:21.0713 0796	epmntdrv ( UnsignedFile.Multi.Generic ) - warning
20:20:21.0713 0796	epmntdrv - detected UnsignedFile.Multi.Generic (1)
20:20:21.0775 0796	EuGdiDrv        (1f2f4ab15ce03ecc257feb2f6dc5a013) C:\Windows\system32\EuGdiDrv.sys
20:20:21.0791 0796	EuGdiDrv ( UnsignedFile.Multi.Generic ) - warning
20:20:21.0791 0796	EuGdiDrv - detected UnsignedFile.Multi.Generic (1)
20:20:21.0869 0796	EventSystem     (67058c46504bc12d821f38cf99b7b28f) C:\Windows\system32\es.dll
20:20:21.0915 0796	EventSystem - ok
20:20:22.0040 0796	exfat           (22b408651f9123527bcee54b4f6c5cae) C:\Windows\system32\drivers\exfat.sys
20:20:22.0165 0796	exfat - ok
20:20:22.0227 0796	Fabs - ok
20:20:22.0290 0796	fastfat         (1e9b9a70d332103c52995e957dc09ef8) C:\Windows\system32\drivers\fastfat.sys
20:20:22.0321 0796	fastfat - ok
20:20:22.0430 0796	fdc             (63bdada84951b9c03e641800e176898a) C:\Windows\system32\DRIVERS\fdc.sys
20:20:22.0493 0796	fdc - ok
20:20:22.0571 0796	fdPHost         (6629b5f0e98151f4afdd87567ea32ba3) C:\Windows\system32\fdPHost.dll
20:20:22.0617 0796	fdPHost - ok
20:20:22.0680 0796	FDResPub        (89ed56dce8e47af40892778a5bd31fd2) C:\Windows\system32\fdrespub.dll
20:20:22.0742 0796	FDResPub - ok
20:20:22.0867 0796	FileInfo        (a8c0139a884861e3aae9cfe73b208a9f) C:\Windows\system32\drivers\fileinfo.sys
20:20:22.0883 0796	FileInfo - ok
20:20:22.0945 0796	Filetrace       (0ae429a696aecbc5970e3cf2c62635ae) C:\Windows\system32\drivers\filetrace.sys
20:20:22.0992 0796	Filetrace - ok
20:20:23.0148 0796	FirebirdServerMAGIXInstance (fff1130f7c9fa01d093a1edfc5cce8fc) C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
20:20:23.0382 0796	FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - warning
20:20:23.0382 0796	FirebirdServerMAGIXInstance - detected UnsignedFile.Multi.Generic (1)
20:20:23.0491 0796	flpydisk        (6603957eff5ec62d25075ea8ac27de68) C:\Windows\system32\DRIVERS\flpydisk.sys
20:20:23.0553 0796	flpydisk - ok
20:20:23.0631 0796	FltMgr          (01334f9ea68e6877c4ef05d3ea8abb05) C:\Windows\system32\drivers\fltmgr.sys
20:20:23.0647 0796	FltMgr - ok
20:20:23.0756 0796	FontCache       (8ce364388c8eca59b14b539179276d44) C:\Windows\system32\FntCache.dll
20:20:23.0881 0796	FontCache - ok
20:20:23.0975 0796	FontCache3.0.0.0 (c7fbdd1ed42f82bfa35167a5c9803ea3) C:\Windows\Microsoft.Net\Framework\v3.0\WPF\PresentationFontCache.exe
20:20:23.0990 0796	FontCache3.0.0.0 - ok
20:20:24.0068 0796	Fs_Rec          (65ea8b77b5851854f0c55c43fa51a198) C:\Windows\system32\drivers\Fs_Rec.sys
20:20:24.0115 0796	Fs_Rec - ok
20:20:24.0162 0796	gagp30kx        (4e1cd0a45c50a8882616cae5bf82f3c5) C:\Windows\system32\drivers\gagp30kx.sys
20:20:24.0177 0796	gagp30kx - ok
20:20:24.0224 0796	gpsvc           (cd5d0aeee35dfd4e986a5aa1500a6e66) C:\Windows\System32\gpsvc.dll
20:20:24.0287 0796	gpsvc - ok
20:20:24.0411 0796	Guard.Mail.ru   (e859ca020ed61899f3c74a8d0032d05c) C:\Program Files\Guard-ICQ\GuardICQ.exe
20:20:24.0521 0796	Guard.Mail.ru - ok
20:20:24.0614 0796	gupdate         (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
20:20:24.0630 0796	gupdate - ok
20:20:24.0630 0796	gupdatem        (f02a533f517eb38333cb12a9e8963773) C:\Program Files\Google\Update\GoogleUpdate.exe
20:20:24.0645 0796	gupdatem - ok
20:20:24.0770 0796	HdAudAddService (cb04c744be0a61b1d648faed182c3b59) C:\Windows\system32\drivers\HdAudio.sys
20:20:24.0848 0796	HdAudAddService - ok
20:20:24.0942 0796	HDAudBus        (062452b7ffd68c8c042a6261fe8dff4a) C:\Windows\system32\DRIVERS\HDAudBus.sys
20:20:25.0035 0796	HDAudBus - ok
20:20:25.0160 0796	HidBth          (1338520e78d90154ed6be8f84de5fceb) C:\Windows\system32\drivers\hidbth.sys
20:20:25.0223 0796	HidBth - ok
20:20:25.0285 0796	HidIr           (ff3160c3a2445128c5a6d9b076da519e) C:\Windows\system32\drivers\hidir.sys
20:20:25.0347 0796	HidIr - ok
20:20:25.0457 0796	hidserv         (84067081f3318162797385e11a8f0582) C:\Windows\system32\hidserv.dll
20:20:25.0472 0796	hidserv - ok
20:20:25.0581 0796	HidUsb          (cca4b519b17e23a00b826c55716809cc) C:\Windows\system32\DRIVERS\hidusb.sys
20:20:25.0628 0796	HidUsb - ok
20:20:25.0691 0796	hkmsvc          (d8ad255b37da92434c26e4876db7d418) C:\Windows\system32\kmsvc.dll
20:20:25.0769 0796	hkmsvc - ok
20:20:25.0878 0796	HpCISSs         (df353b401001246853763c4b7aaa6f50) C:\Windows\system32\drivers\hpcisss.sys
20:20:25.0893 0796	HpCISSs - ok
20:20:26.0003 0796	HTTP            (f870aa3e254628ebeafe754108d664de) C:\Windows\system32\drivers\HTTP.sys
20:20:26.0112 0796	HTTP - ok
20:20:26.0174 0796	i2omp           (324c2152ff2c61abae92d09f3cca4d63) C:\Windows\system32\drivers\i2omp.sys
20:20:26.0190 0796	i2omp - ok
20:20:26.0299 0796	i8042prt        (22d56c8184586b7a1f6fa60be5f5a2bd) C:\Windows\system32\DRIVERS\i8042prt.sys
20:20:26.0346 0796	i8042prt - ok
20:20:26.0408 0796	iaStorV         (c957bf4b5d80b46c5017bf0101e6c906) C:\Windows\system32\drivers\iastorv.sys
20:20:26.0424 0796	iaStorV - ok
20:20:26.0517 0796	ICQ Service     (58bd7551b0445f3673d96ca380f21822) C:\Program Files\ICQ6Toolbar\ICQ Service.exe
20:20:26.0533 0796	ICQ Service - ok
20:20:26.0642 0796	IDriverT        (daf66902f08796f9c694901660e5a64a) C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
20:20:26.0658 0796	IDriverT ( UnsignedFile.Multi.Generic ) - warning
20:20:26.0658 0796	IDriverT - detected UnsignedFile.Multi.Generic (1)
20:20:26.0751 0796	idsvc           (98477b08e61945f974ed9fdc4cb6bdab) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\infocard.exe
20:20:26.0861 0796	idsvc - ok
20:20:26.0939 0796	iirsp           (2d077bf86e843f901d8db709c95b49a5) C:\Windows\system32\drivers\iirsp.sys
20:20:26.0954 0796	iirsp - ok
20:20:27.0048 0796	IKEEXT          (9908d8a397b76cd8d31d0d383c5773c9) C:\Windows\System32\ikeext.dll
20:20:27.0079 0796	IKEEXT - ok
20:20:27.0329 0796	IntcAzAudAddService (b0878f280fa335ac67f056a9bfe06e04) C:\Windows\system32\drivers\RTKVHDA.sys
20:20:27.0469 0796	IntcAzAudAddService - ok
20:20:27.0563 0796	intelide        (97469037714070e45194ed318d636401) C:\Windows\system32\drivers\intelide.sys
20:20:27.0563 0796	intelide - ok
20:20:27.0687 0796	intelppm        (224191001e78c89dfa78924c3ea595ff) C:\Windows\system32\DRIVERS\intelppm.sys
20:20:27.0719 0796	intelppm - ok
20:20:27.0797 0796	IPBusEnum       (9ac218c6e6105477484c6fdbe7d409a4) C:\Windows\system32\ipbusenum.dll
20:20:27.0843 0796	IPBusEnum - ok
20:20:27.0937 0796	IpFilterDriver  (62c265c38769b864cb25b4bcf62df6c3) C:\Windows\system32\DRIVERS\ipfltdrv.sys
20:20:27.0968 0796	IpFilterDriver - ok
20:20:28.0046 0796	iphlpsvc        (1998bd97f950680bb55f55a7244679c2) C:\Windows\System32\iphlpsvc.dll
20:20:28.0124 0796	iphlpsvc - ok
20:20:28.0155 0796	IpInIp - ok
20:20:28.0218 0796	IPMIDRV         (40f34f8aba2a015d780e4b09138b6c17) C:\Windows\system32\drivers\ipmidrv.sys
20:20:28.0296 0796	IPMIDRV - ok
20:20:28.0389 0796	IPNAT           (8793643a67b42cec66490b2a0cf92d68) C:\Windows\system32\DRIVERS\ipnat.sys
20:20:28.0436 0796	IPNAT - ok
20:20:28.0530 0796	IRENUM          (109c0dfb82c3632fbd11949b73aeeac9) C:\Windows\system32\drivers\irenum.sys
20:20:28.0577 0796	IRENUM - ok
20:20:28.0655 0796	isapnp          (350fca7e73cf65bcef43fae1e4e91293) C:\Windows\system32\drivers\isapnp.sys
20:20:28.0670 0796	isapnp - ok
20:20:28.0748 0796	iScsiPrt        (232fa340531d940aac623b121a595034) C:\Windows\system32\DRIVERS\msiscsi.sys
20:20:28.0764 0796	iScsiPrt - ok
20:20:28.0826 0796	iteatapi        (bced60d16156e428f8df8cf27b0df150) C:\Windows\system32\drivers\iteatapi.sys
20:20:28.0826 0796	iteatapi - ok
20:20:28.0935 0796	iteraid         (06fa654504a498c30adca8bec4e87e7e) C:\Windows\system32\drivers\iteraid.sys
20:20:28.0951 0796	iteraid - ok
20:20:29.0029 0796	kbdclass        (37605e0a8cf00cbba538e753e4344c6e) C:\Windows\system32\DRIVERS\kbdclass.sys
20:20:29.0045 0796	kbdclass - ok
20:20:29.0123 0796	kbdhid          (d2600cb17b7408b4a83f231dc9a11ac3) C:\Windows\system32\drivers\kbdhid.sys
20:20:29.0169 0796	kbdhid - ok
20:20:29.0247 0796	KeyIso          (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:20:29.0294 0796	KeyIso - ok
20:20:29.0403 0796	KMDFMEMIO       (ebc507f129df8f0e0ca270dcfc0cf87f) C:\Windows\system32\DRIVERS\kmdfmemio.sys
20:20:29.0419 0796	KMDFMEMIO - ok
20:20:29.0544 0796	KSecDD          (2b2f1638466e8cb091400c9019cc730e) C:\Windows\system32\Drivers\ksecdd.sys
20:20:29.0591 0796	KSecDD - ok
20:20:29.0653 0796	KtmRm           (8078f8f8f7a79e2e6b494523a828c585) C:\Windows\system32\msdtckrm.dll
20:20:29.0731 0796	KtmRm - ok
20:20:29.0825 0796	LanmanServer    (1bf5eebfd518dd7298434d8c862f825d) C:\Windows\system32\srvsvc.dll
20:20:29.0887 0796	LanmanServer - ok
20:20:29.0965 0796	LanmanWorkstation (1db69705b695b987082c8baec0c6b34f) C:\Windows\System32\wkssvc.dll
20:20:30.0012 0796	LanmanWorkstation - ok
20:20:30.0090 0796	lltdio          (d1c5883087a0c3f1344d9d55a44901f6) C:\Windows\system32\DRIVERS\lltdio.sys
20:20:30.0137 0796	lltdio - ok
20:20:30.0230 0796	lltdsvc         (2d5a428872f1442631d0959a34abff63) C:\Windows\System32\lltdsvc.dll
20:20:30.0293 0796	lltdsvc - ok
20:20:30.0355 0796	lmhosts         (35d40113e4a5b961b6ce5c5857702518) C:\Windows\System32\lmhsvc.dll
20:20:30.0417 0796	lmhosts - ok
20:20:30.0511 0796	LSI_FC          (a2262fb9f28935e862b4db46438c80d2) C:\Windows\system32\drivers\lsi_fc.sys
20:20:30.0527 0796	LSI_FC - ok
20:20:30.0558 0796	LSI_SAS         (30d73327d390f72a62f32c103daf1d6d) C:\Windows\system32\drivers\lsi_sas.sys
20:20:30.0573 0796	LSI_SAS - ok
20:20:30.0651 0796	LSI_SCSI        (e1e36fefd45849a95f1ab81de0159fe3) C:\Windows\system32\drivers\lsi_scsi.sys
20:20:30.0667 0796	LSI_SCSI - ok
20:20:30.0729 0796	luafv           (8f5c7426567798e62a3b3614965d62cc) C:\Windows\system32\drivers\luafv.sys
20:20:30.0776 0796	luafv - ok
20:20:30.0839 0796	Mcx2Svc         (aef9babb8a506bc4ce0451a64aaded46) C:\Windows\system32\Mcx2Svc.dll
20:20:30.0870 0796	Mcx2Svc - ok
20:20:30.0948 0796	megasas         (d153b14fc6598eae8422a2037553adce) C:\Windows\system32\drivers\megasas.sys
20:20:30.0963 0796	megasas - ok
20:20:31.0057 0796	MMCSS           (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
20:20:31.0088 0796	MMCSS - ok
20:20:31.0166 0796	Modem           (e13b5ea0f51ba5b1512ec671393d09ba) C:\Windows\system32\drivers\modem.sys
20:20:31.0213 0796	Modem - ok
20:20:31.0291 0796	monitor         (0a9bb33b56e294f686abb7c1e4e2d8a8) C:\Windows\system32\DRIVERS\monitor.sys
20:20:31.0338 0796	monitor - ok
20:20:31.0400 0796	mouclass        (5bf6a1326a335c5298477754a506d263) C:\Windows\system32\DRIVERS\mouclass.sys
20:20:31.0416 0796	mouclass - ok
20:20:31.0478 0796	mouhid          (93b8d4869e12cfbe663915502900876f) C:\Windows\system32\DRIVERS\mouhid.sys
20:20:31.0509 0796	mouhid - ok
20:20:31.0556 0796	MountMgr        (bdafc88aa6b92f7842416ea6a48e1600) C:\Windows\system32\drivers\mountmgr.sys
20:20:31.0572 0796	MountMgr - ok
20:20:31.0650 0796	mpio            (583a41f26278d9e0ea548163d6139397) C:\Windows\system32\drivers\mpio.sys
20:20:31.0665 0796	mpio - ok
20:20:31.0743 0796	mpsdrv          (22241feba9b2defa669c8cb0a8dd7d2e) C:\Windows\system32\drivers\mpsdrv.sys
20:20:31.0775 0796	mpsdrv - ok
20:20:31.0837 0796	MpsSvc          (5de62c6e9108f14f6794060a9bdecaec) C:\Windows\system32\mpssvc.dll
20:20:31.0915 0796	MpsSvc - ok
20:20:32.0009 0796	Mraid35x        (4fbbb70d30fd20ec51f80061703b001e) C:\Windows\system32\drivers\mraid35x.sys
20:20:32.0024 0796	Mraid35x - ok
20:20:32.0102 0796	MRxDAV          (82cea0395524aacfeb58ba1448e8325c) C:\Windows\system32\drivers\mrxdav.sys
20:20:32.0133 0796	MRxDAV - ok
20:20:32.0211 0796	mrxsmb          (1e94971c4b446ab2290deb71d01cf0c2) C:\Windows\system32\DRIVERS\mrxsmb.sys
20:20:32.0258 0796	mrxsmb - ok
20:20:32.0352 0796	mrxsmb10        (4fccb34d793b116423209c0f8b7a3b03) C:\Windows\system32\DRIVERS\mrxsmb10.sys
20:20:32.0399 0796	mrxsmb10 - ok
20:20:32.0445 0796	mrxsmb20        (c3cb1b40ad4a0124d617a1199b0b9d7c) C:\Windows\system32\DRIVERS\mrxsmb20.sys
20:20:32.0461 0796	mrxsmb20 - ok
20:20:32.0523 0796	msahci          (742aed7939e734c36b7e8d6228ce26b7) C:\Windows\system32\drivers\msahci.sys
20:20:32.0539 0796	msahci - ok
20:20:32.0601 0796	msdsm           (3fc82a2ae4cc149165a94699183d3028) C:\Windows\system32\drivers\msdsm.sys
20:20:32.0617 0796	msdsm - ok
20:20:32.0726 0796	MSDTC           (fd7520cc3a80c5fc8c48852bb24c6ded) C:\Windows\System32\msdtc.exe
20:20:32.0773 0796	MSDTC - ok
20:20:32.0867 0796	Msfs            (a9927f4a46b816c92f461acb90cf8515) C:\Windows\system32\drivers\Msfs.sys
20:20:32.0913 0796	Msfs - ok
20:20:33.0007 0796	msisadrv        (0f400e306f385c56317357d6dea56f62) C:\Windows\system32\drivers\msisadrv.sys
20:20:33.0023 0796	msisadrv - ok
20:20:33.0116 0796	MSiSCSI         (85466c0757a23d9a9aecdc0755203cb2) C:\Windows\system32\iscsiexe.dll
20:20:33.0163 0796	MSiSCSI - ok
20:20:33.0225 0796	msiserver - ok
20:20:33.0335 0796	MSKSSRV         (d8c63d34d9c9e56c059e24ec7185cc07) C:\Windows\system32\drivers\MSKSSRV.sys
20:20:33.0381 0796	MSKSSRV - ok
20:20:33.0475 0796	MSPCLOCK        (1d373c90d62ddb641d50e55b9e78d65e) C:\Windows\system32\drivers\MSPCLOCK.sys
20:20:33.0522 0796	MSPCLOCK - ok
20:20:33.0584 0796	MSPQM           (b572da05bf4e098d4bba3a4734fb505b) C:\Windows\system32\drivers\MSPQM.sys
20:20:33.0631 0796	MSPQM - ok
20:20:33.0725 0796	MsRPC           (b49456d70555de905c311bcda6ec6adb) C:\Windows\system32\drivers\MsRPC.sys
20:20:33.0740 0796	MsRPC - ok
20:20:33.0849 0796	mssmbios        (e384487cb84be41d09711c30ca79646c) C:\Windows\system32\DRIVERS\mssmbios.sys
20:20:33.0849 0796	mssmbios - ok
20:20:33.0912 0796	MSTEE           (7199c1eec1e4993caf96b8c0a26bd58a) C:\Windows\system32\drivers\MSTEE.sys
20:20:33.0959 0796	MSTEE - ok
20:20:34.0021 0796	Mup             (6a57b5733d4cb702c8ea4542e836b96c) C:\Windows\system32\Drivers\mup.sys
20:20:34.0037 0796	Mup - ok
20:20:34.0130 0796	napagent        (e4eaf0c5c1b41b5c83386cf212ca9584) C:\Windows\system32\qagentRT.dll
20:20:34.0177 0796	napagent - ok
20:20:34.0286 0796	NativeWifiP     (85c44fdff9cf7e72a40dcb7ec06a4416) C:\Windows\system32\DRIVERS\nwifi.sys
20:20:34.0317 0796	NativeWifiP - ok
20:20:34.0427 0796	NAUpdate        (1bbbf640bc0e0b750537baece8d66c18) C:\Program Files\Nero\Update\NASvc.exe
20:20:34.0505 0796	NAUpdate - ok
20:20:34.0661 0796	NDIS            (1357274d1883f68300aeadd15d7bbb42) C:\Windows\system32\drivers\ndis.sys
20:20:34.0723 0796	NDIS - ok
20:20:34.0801 0796	NdisTapi        (0e186e90404980569fb449ba7519ae61) C:\Windows\system32\DRIVERS\ndistapi.sys
20:20:34.0832 0796	NdisTapi - ok
20:20:34.0895 0796	Ndisuio         (d6973aa34c4d5d76c0430b181c3cd389) C:\Windows\system32\DRIVERS\ndisuio.sys
20:20:34.0941 0796	Ndisuio - ok
20:20:35.0097 0796	NdisWan         (818f648618ae34f729fdb47ec68345c3) C:\Windows\system32\DRIVERS\ndiswan.sys
20:20:35.0144 0796	NdisWan - ok
20:20:35.0207 0796	NDProxy         (71dab552b41936358f3b541ae5997fb3) C:\Windows\system32\drivers\NDProxy.sys
20:20:35.0238 0796	NDProxy - ok
20:20:35.0300 0796	NetBIOS         (bcd093a5a6777cf626434568dc7dba78) C:\Windows\system32\DRIVERS\netbios.sys
20:20:35.0347 0796	NetBIOS - ok
20:20:35.0456 0796	netbt           (ecd64230a59cbd93c85f1cd1cab9f3f6) C:\Windows\system32\DRIVERS\netbt.sys
20:20:35.0487 0796	netbt - ok
20:20:35.0550 0796	Netlogon        (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:20:35.0565 0796	Netlogon - ok
20:20:35.0643 0796	Netman          (c8052711daecc48b982434c5116ca401) C:\Windows\System32\netman.dll
20:20:35.0706 0796	Netman - ok
20:20:35.0768 0796	netprofm        (2ef3bbe22e5a5acd1428ee387a0d0172) C:\Windows\System32\netprofm.dll
20:20:35.0831 0796	netprofm - ok
20:20:35.0909 0796	NetTcpPortSharing (d6c4e4a39a36029ac0813d476fbd0248) C:\Windows\Microsoft.NET\Framework\v3.0\Windows Communication Foundation\SMSvcHost.exe
20:20:35.0924 0796	NetTcpPortSharing - ok
20:20:36.0096 0796	NETw2v32        (6e9edc1020b319e7676387b8cdf2398c) C:\Windows\system32\DRIVERS\NETw2v32.sys
20:20:36.0345 0796	NETw2v32 - ok
20:20:36.0392 0796	nfrd960         (2e7fb731d4790a1bc6270accefacb36e) C:\Windows\system32\drivers\nfrd960.sys
20:20:36.0408 0796	nfrd960 - ok
20:20:36.0470 0796	NlaSvc          (2997b15415f9bbe05b5a4c1c85e0c6a2) C:\Windows\System32\nlasvc.dll
20:20:36.0517 0796	NlaSvc - ok
20:20:36.0626 0796	Npfs            (d36f239d7cce1931598e8fb90a0dbc26) C:\Windows\system32\drivers\Npfs.sys
20:20:36.0689 0796	Npfs - ok
20:20:36.0751 0796	nsi             (8bb86f0c7eea2bded6fe095d0b4ca9bd) C:\Windows\system32\nsisvc.dll
20:20:36.0798 0796	nsi - ok
20:20:36.0876 0796	nsiproxy        (609773e344a97410ce4ebf74a8914fcf) C:\Windows\system32\drivers\nsiproxy.sys
20:20:36.0907 0796	nsiproxy - ok
20:20:37.0001 0796	Ntfs            (6a4a98cee84cf9e99564510dda4baa47) C:\Windows\system32\drivers\Ntfs.sys
20:20:37.0094 0796	Ntfs - ok
20:20:37.0203 0796	ntrigdigi       (e875c093aec0c978a90f30c9e0dfbb72) C:\Windows\system32\drivers\ntrigdigi.sys
20:20:37.0266 0796	ntrigdigi - ok
20:20:37.0344 0796	Null            (c5dbbcda07d780bda9b685df333bb41e) C:\Windows\system32\drivers\Null.sys
20:20:37.0375 0796	Null - ok
20:20:37.0437 0796	nvraid          (e69e946f80c1c31c53003bfbf50cbb7c) C:\Windows\system32\drivers\nvraid.sys
20:20:37.0437 0796	nvraid - ok
20:20:37.0500 0796	nvstor          (9e0ba19a28c498a6d323d065db76dffc) C:\Windows\system32\drivers\nvstor.sys
20:20:37.0515 0796	nvstor - ok
20:20:37.0578 0796	nv_agp          (07c186427eb8fcc3d8d7927187f260f7) C:\Windows\system32\drivers\nv_agp.sys
20:20:37.0593 0796	nv_agp - ok
20:20:37.0671 0796	NwlnkFlt - ok
20:20:37.0703 0796	NwlnkFwd - ok
20:20:37.0827 0796	odserv          (785f487a64950f3cb8e9f16253ba3b7b) C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
20:20:37.0843 0796	odserv - ok
20:20:37.0968 0796	ohci1394        (be32da025a0be1878f0ee8d6d9386cd5) C:\Windows\system32\DRIVERS\ohci1394.sys
20:20:38.0046 0796	ohci1394 - ok
20:20:38.0124 0796	ose             (5a432a042dae460abe7199b758e8606c) C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
20:20:38.0139 0796	ose - ok
20:20:38.0233 0796	p2pimsvc        (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:20:38.0358 0796	p2pimsvc - ok
20:20:38.0405 0796	p2psvc          (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:20:38.0436 0796	p2psvc - ok
20:20:38.0576 0796	Parport         (0fa9b5055484649d63c303fe404e5f4d) C:\Windows\system32\drivers\parport.sys
20:20:38.0639 0796	Parport - ok
20:20:38.0763 0796	partmgr         (57389fa59a36d96b3eb09d0cb91e9cdc) C:\Windows\system32\drivers\partmgr.sys
20:20:38.0779 0796	partmgr - ok
20:20:38.0826 0796	Parvdm          (4f9a6a8a31413180d0fcb279ad5d8112) C:\Windows\system32\drivers\parvdm.sys
20:20:38.0888 0796	Parvdm - ok
20:20:38.0951 0796	PcaSvc          (c6276ad11f4bb49b58aa1ed88537f14a) C:\Windows\System32\pcasvc.dll
20:20:39.0029 0796	PcaSvc - ok
20:20:39.0138 0796	pci             (941dc1d19e7e8620f40bbc206981efdb) C:\Windows\system32\drivers\pci.sys
20:20:39.0153 0796	pci - ok
20:20:39.0200 0796	pciide          (1636d43f10416aeb483bc6001097b26c) C:\Windows\system32\drivers\pciide.sys
20:20:39.0216 0796	pciide - ok
20:20:39.0278 0796	pcmcia          (e6f3fb1b86aa519e7698ad05e58b04e5) C:\Windows\system32\DRIVERS\pcmcia.sys
20:20:39.0309 0796	pcmcia - ok
20:20:39.0387 0796	PEAUTH          (6349f6ed9c623b44b52ea3c63c831a92) C:\Windows\system32\drivers\peauth.sys
20:20:39.0559 0796	PEAUTH - ok
20:20:39.0777 0796	pla             (b1689df169143f57053f795390c99db3) C:\Windows\system32\pla.dll
20:20:39.0933 0796	pla - ok
20:20:39.0980 0796	PlugPlay        (c5e7f8a996ec0a82d508fd9064a5569e) C:\Windows\system32\umpnpmgr.dll
20:20:40.0027 0796	PlugPlay - ok
20:20:40.0136 0796	PMBDeviceInfoProvider (627fa58adc043704f9d14ca44340956f) C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
20:20:40.0167 0796	PMBDeviceInfoProvider - ok
20:20:40.0292 0796	PNRPAutoReg     (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:20:40.0323 0796	PNRPAutoReg - ok
20:20:40.0355 0796	PNRPsvc         (0c8e8e61ad1eb0b250b846712c917506) C:\Windows\system32\p2psvc.dll
20:20:40.0401 0796	PNRPsvc - ok
20:20:40.0511 0796	PolicyAgent     (d0494460421a03cd5225cca0059aa146) C:\Windows\System32\ipsecsvc.dll
20:20:40.0589 0796	PolicyAgent - ok
20:20:40.0698 0796	PptpMiniport    (ecfffaec0c1ecd8dbc77f39070ea1db1) C:\Windows\system32\DRIVERS\raspptp.sys
20:20:40.0745 0796	PptpMiniport - ok
20:20:40.0823 0796	Processor       (0e3cef5d28b40cf273281d620c50700a) C:\Windows\system32\drivers\processr.sys
20:20:40.0885 0796	Processor - ok
20:20:40.0963 0796	ProfSvc         (0508faa222d28835310b7bfca7a77346) C:\Windows\system32\profsvc.dll
20:20:41.0010 0796	ProfSvc - ok
20:20:41.0103 0796	ProtectedStorage (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:20:41.0135 0796	ProtectedStorage - ok
20:20:41.0197 0796	PSched          (99514faa8df93d34b5589187db3aa0ba) C:\Windows\system32\DRIVERS\pacer.sys
20:20:41.0244 0796	PSched - ok
20:20:41.0291 0796	PSI             (1df21f001f3a94eba4a2950c70cc358f) C:\Windows\system32\DRIVERS\psi_mf.sys
20:20:41.0306 0796	PSI - ok
20:20:41.0400 0796	ql2300          (ccdac889326317792480c0a67156a1ec) C:\Windows\system32\drivers\ql2300.sys
20:20:41.0462 0796	ql2300 - ok
20:20:41.0556 0796	ql40xx          (81a7e5c076e59995d54bc1ed3a16e60b) C:\Windows\system32\drivers\ql40xx.sys
20:20:41.0571 0796	ql40xx - ok
20:20:41.0634 0796	QWAVE           (e9ecae663f47e6cb43962d18ab18890f) C:\Windows\system32\qwave.dll
20:20:41.0681 0796	QWAVE - ok
20:20:41.0743 0796	QWAVEdrv        (9f5e0e1926014d17486901c88eca2db7) C:\Windows\system32\drivers\qwavedrv.sys
20:20:41.0759 0796	QWAVEdrv - ok
20:20:41.0899 0796	R300            (e46f2fb11cfe13187a4e3ef512c0d226) C:\Windows\system32\DRIVERS\atikmdag.sys
20:20:42.0008 0796	R300 - ok
20:20:42.0133 0796	RapiMgr         (70dbdab246c18b78e2200d6401d038be) C:\Windows\WindowsMobile\rapimgr.dll
20:20:42.0180 0796	RapiMgr - ok
20:20:42.0258 0796	RasAcd          (147d7f9c556d259924351feb0de606c3) C:\Windows\system32\DRIVERS\rasacd.sys
20:20:42.0305 0796	RasAcd - ok
20:20:42.0351 0796	RasAuto         (f6a452eb4ceadbb51c9e0ee6b3ecef0f) C:\Windows\System32\rasauto.dll
20:20:42.0383 0796	RasAuto - ok
20:20:42.0461 0796	Rasl2tp         (a214adbaf4cb47dd2728859ef31f26b0) C:\Windows\system32\DRIVERS\rasl2tp.sys
20:20:42.0507 0796	Rasl2tp - ok
20:20:42.0601 0796	RasMan          (75d47445d70ca6f9f894b032fbc64fcf) C:\Windows\System32\rasmans.dll
20:20:42.0648 0796	RasMan - ok
20:20:42.0726 0796	RasPppoe        (509a98dd18af4375e1fc40bc175f1def) C:\Windows\system32\DRIVERS\raspppoe.sys
20:20:42.0757 0796	RasPppoe - ok
20:20:42.0851 0796	RasSstp         (2005f4a1e05fa09389ac85840f0a9e4d) C:\Windows\system32\DRIVERS\rassstp.sys
20:20:42.0897 0796	RasSstp - ok
20:20:42.0991 0796	rdbss           (b14c9d5b9add2f84f70570bbbfaa7935) C:\Windows\system32\DRIVERS\rdbss.sys
20:20:43.0038 0796	rdbss - ok
20:20:43.0116 0796	RDPCDD          (89e59be9a564262a3fb6c4f4f1cd9899) C:\Windows\system32\DRIVERS\RDPCDD.sys
20:20:43.0147 0796	RDPCDD - ok
20:20:43.0241 0796	rdpdr           (e8bd98d46f2ed77132ba927fccb47d8b) C:\Windows\system32\drivers\rdpdr.sys
20:20:43.0319 0796	rdpdr - ok
20:20:43.0365 0796	RDPENCDD        (9d91fe5286f748862ecffa05f8a0710c) C:\Windows\system32\drivers\rdpencdd.sys
20:20:43.0412 0796	RDPENCDD - ok
20:20:43.0537 0796	RDPWD           (79c6df8477250f5c54f7c5ae1d6b814e) C:\Windows\system32\drivers\RDPWD.sys
20:20:43.0584 0796	RDPWD - ok
20:20:43.0662 0796	RemoteAccess    (bcdd6b4804d06b1f7ebf29e53a57ece9) C:\Windows\System32\mprdim.dll
20:20:43.0709 0796	RemoteAccess - ok
20:20:43.0787 0796	RemoteRegistry  (9e6894ea18daff37b63e1005f83ae4ab) C:\Windows\system32\regsvc.dll
20:20:43.0833 0796	RemoteRegistry - ok
20:20:43.0896 0796	RFCOMM          (7ec90c316177ba3f1bce92005264b447) C:\Windows\system32\DRIVERS\rfcomm.sys
20:20:43.0974 0796	RFCOMM - ok
20:20:44.0099 0796	RichVideo       (2af094b1ce4725e4551f38fda2348637) C:\Program Files\CyberLink\Shared Files\RichVideo.exe
20:20:44.0130 0796	RichVideo ( UnsignedFile.Multi.Generic ) - warning
20:20:44.0130 0796	RichVideo - detected UnsignedFile.Multi.Generic (1)
20:20:44.0208 0796	RpcLocator      (5123f83cbc4349d065534eeb6bbdc42b) C:\Windows\system32\locator.exe
20:20:44.0255 0796	RpcLocator - ok
20:20:44.0333 0796	RpcSs           (3b5b4d53fec14f7476ca29a20cc31ac9) C:\Windows\system32\rpcss.dll
20:20:44.0411 0796	RpcSs - ok
20:20:44.0567 0796	rspndr          (9c508f4074a39e8b4b31d27198146fad) C:\Windows\system32\DRIVERS\rspndr.sys
20:20:44.0598 0796	rspndr - ok
20:20:44.0660 0796	RTL8023xp       (959ef612d2ccfdb6d9e443f8e3655013) C:\Windows\system32\DRIVERS\Rtnicxp.sys
20:20:44.0754 0796	RTL8023xp - ok
20:20:44.0832 0796	SamSs           (a3e186b4b935905b829219502557314e) C:\Windows\system32\lsass.exe
20:20:44.0847 0796	SamSs - ok
20:20:44.0941 0796	SbFw            (9c9bcc79aef0aa97f16766c498002d36) C:\Windows\system32\drivers\SbFw.sys
20:20:44.0957 0796	SbFw - ok
20:20:45.0081 0796	SBFWIMCL        (f27b38d70b7621378161d6f48be04d2c) C:\Windows\system32\DRIVERS\sbfwim.sys
20:20:45.0081 0796	SBFWIMCL - ok
20:20:45.0128 0796	SBFWIMCLMP      (f27b38d70b7621378161d6f48be04d2c) C:\Windows\system32\DRIVERS\SBFWIM.sys
20:20:45.0144 0796	SBFWIMCLMP - ok
20:20:45.0191 0796	sbhips          (53e5e7dc26bb920b97f258bbd52abfdc) C:\Windows\system32\drivers\sbhips.sys
20:20:45.0206 0796	sbhips - ok
20:20:45.0269 0796	sbp2port        (3ce8f073a557e172b330109436984e30) C:\Windows\system32\drivers\sbp2port.sys
20:20:45.0284 0796	sbp2port - ok
20:20:45.0331 0796	SBRE - ok
20:20:45.0471 0796	SbTis           (6468e2973e04525decc105947ddd0d34) C:\Windows\system32\drivers\sbtis.sys
20:20:45.0471 0796	SbTis - ok
20:20:45.0534 0796	SCardSvr        (77b7a11a0c3d78d3386398fbbea1b632) C:\Windows\System32\SCardSvr.dll
20:20:45.0581 0796	SCardSvr - ok
20:20:45.0643 0796	Schedule        (1a58069db21d05eb2ab58ee5753ebe8d) C:\Windows\system32\schedsvc.dll
20:20:45.0752 0796	Schedule - ok
20:20:45.0846 0796	SCPolicySvc     (312ec3e37a0a1f2006534913e37b4423) C:\Windows\System32\certprop.dll
20:20:45.0877 0796	SCPolicySvc - ok
20:20:45.0955 0796	sdbus           (4339a2585708c7d9b0c0ce5aad3dd6ff) C:\Windows\system32\DRIVERS\sdbus.sys
20:20:46.0033 0796	sdbus - ok
20:20:46.0095 0796	SDRSVC          (716313d9f6b0529d03f726d5aaf6f191) C:\Windows\System32\SDRSVC.dll
20:20:46.0158 0796	SDRSVC - ok
20:20:46.0267 0796	SeaPort         (271077b91d7ad1b616f8afdfe8e3f981) C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
20:20:46.0283 0796	SeaPort - ok
20:20:46.0407 0796	secdrv          (90a3935d05b494a5a39d37e71f09a677) C:\Windows\system32\drivers\secdrv.sys
20:20:46.0485 0796	secdrv - ok
20:20:46.0548 0796	seclogon        (fd5199d4d8a521005e4b5ee7fe00fa9b) C:\Windows\system32\seclogon.dll
20:20:46.0610 0796	seclogon - ok
20:20:46.0719 0796	Secunia Update Agent - ok
20:20:47.0000 0796	SENS            (a9bbab5759771e523f55563d6cbe140f) C:\Windows\System32\sens.dll
20:20:47.0047 0796	SENS - ok
20:20:47.0219 0796	Ser2pl          (b97e1d0e59a128394f24e9f31e227ef2) C:\Windows\system32\DRIVERS\ser2pl.sys
20:20:47.0281 0796	Ser2pl - ok
20:20:47.0359 0796	Serenum         (68e44e331d46f0fb38f0863a84cd1a31) C:\Windows\system32\DRIVERS\serenum.sys
20:20:47.0406 0796	Serenum - ok
20:20:47.0484 0796	Serial          (c70d69a918b178d3c3b06339b40c2e1b) C:\Windows\system32\drivers\serial.sys
20:20:47.0546 0796	Serial - ok
20:20:47.0640 0796	sermouse        (8af3d28a879bf75db53a0ee7a4289624) C:\Windows\system32\drivers\sermouse.sys
20:20:47.0671 0796	sermouse - ok
20:20:47.0733 0796	SessionEnv      (d2193326f729b163125610dbf3e17d57) C:\Windows\system32\sessenv.dll
20:20:47.0780 0796	SessionEnv - ok
20:20:47.0827 0796	sffdisk         (103b79418da647736ee95645f305f68a) C:\Windows\system32\drivers\sffdisk.sys
20:20:47.0905 0796	sffdisk - ok
20:20:47.0967 0796	sffp_mmc        (8fd08a310645fe872eeec6e08c6bf3ee) C:\Windows\system32\drivers\sffp_mmc.sys
20:20:48.0045 0796	sffp_mmc - ok
20:20:48.0108 0796	sffp_sd         (9cfa05fcfcb7124e69cfc812b72f9614) C:\Windows\system32\drivers\sffp_sd.sys
20:20:48.0186 0796	sffp_sd - ok
20:20:48.0248 0796	sfloppy         (46ed8e91793b2e6f848015445a0ac188) C:\Windows\system32\drivers\sfloppy.sys
20:20:48.0326 0796	sfloppy - ok
20:20:48.0451 0796	SharedAccess    (e1499bd0ff76b1b2fbbf1af339d91165) C:\Windows\System32\ipnathlp.dll
20:20:48.0498 0796	SharedAccess - ok
20:20:48.0545 0796	ShellHWDetection (c7230fbee14437716701c15be02c27b8) C:\Windows\System32\shsvcs.dll
20:20:48.0623 0796	ShellHWDetection - ok
20:20:48.0701 0796	sisagp          (d2a595d6eebeeaf4334f8e50efbc9931) C:\Windows\system32\drivers\sisagp.sys
20:20:48.0716 0796	sisagp - ok
20:20:48.0779 0796	SiSRaid2        (cedd6f4e7d84e9f98b34b3fe988373aa) C:\Windows\system32\drivers\sisraid2.sys
20:20:48.0794 0796	SiSRaid2 - ok
20:20:48.0857 0796	SiSRaid4        (df843c528c4f69d12ce41ce462e973a7) C:\Windows\system32\drivers\sisraid4.sys
20:20:48.0872 0796	SiSRaid4 - ok
20:20:49.0075 0796	slsvc           (862bb4cbc05d80c5b45be430e5ef872f) C:\Windows\system32\SLsvc.exe
20:20:49.0356 0796	slsvc - ok
20:20:49.0449 0796	SLUINotify      (6edc422215cd78aa8a9cde6b30abbd35) C:\Windows\system32\SLUINotify.dll
20:20:49.0481 0796	SLUINotify - ok
20:20:49.0621 0796	Smb             (7b75299a4d201d6a6533603d6914ab04) C:\Windows\system32\DRIVERS\smb.sys
20:20:49.0730 0796	Smb - ok
20:20:49.0902 0796	SNMPTRAP        (2a146a055b4401c16ee62d18b8e2a032) C:\Windows\System32\snmptrap.exe
20:20:49.0933 0796	SNMPTRAP - ok
20:20:50.0011 0796	spldr           (7aebdeef071fe28b0eef2cdd69102bff) C:\Windows\system32\drivers\spldr.sys
20:20:50.0027 0796	spldr - ok
20:20:50.0089 0796	Spooler         (8554097e5136c3bf9f69fe578a1b35f4) C:\Windows\System32\spoolsv.exe
20:20:50.0151 0796	Spooler - ok
20:20:50.0214 0796	SQLWriter       (54902536aad0e9b99bc65f89c0caf93f) C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
20:20:50.0229 0796	SQLWriter - ok
20:20:50.0339 0796	srv             (41987f9fc0e61adf54f581e15029ad91) C:\Windows\system32\DRIVERS\srv.sys
20:20:50.0385 0796	srv - ok
20:20:50.0432 0796	srv2            (ff33aff99564b1aa534f58868cbe41ef) C:\Windows\system32\DRIVERS\srv2.sys
20:20:50.0463 0796	srv2 - ok
20:20:50.0495 0796	srvnet          (7605c0e1d01a08f3ecd743f38b834a44) C:\Windows\system32\DRIVERS\srvnet.sys
20:20:50.0526 0796	srvnet - ok
20:20:50.0588 0796	SSDPSRV         (03d50b37234967433a5ea5ba72bc0b62) C:\Windows\System32\ssdpsrv.dll
20:20:50.0635 0796	SSDPSRV - ok
20:20:50.0760 0796	ssmdrv          (a36ee93698802cd899f98bfd553d8185) C:\Windows\system32\DRIVERS\ssmdrv.sys
20:20:50.0775 0796	ssmdrv - ok
20:20:50.0838 0796	SstpSvc         (6f1a32e7b7b30f004d9a20afadb14944) C:\Windows\system32\sstpsvc.dll
20:20:50.0869 0796	SstpSvc - ok
20:20:50.0931 0796	ssudmdm         (8f299012ef58246f1c98de7b7e48dbf0) C:\Windows\system32\DRIVERS\ssudmdm.sys
20:20:50.0947 0796	ssudmdm - ok
20:20:51.0025 0796	StarOpen - ok
20:20:51.0087 0796	StillCam        (ef70b3d22b4bffda6ea851ecb063efaa) C:\Windows\system32\DRIVERS\serscan.sys
20:20:51.0119 0796	StillCam - ok
20:20:51.0197 0796	stisvc          (5de7d67e49b88f5f07f3e53c4b92a352) C:\Windows\System32\wiaservc.dll
20:20:51.0290 0796	stisvc - ok
20:20:51.0415 0796	swenum          (7ba58ecf0c0a9a69d44b3dca62becf56) C:\Windows\system32\DRIVERS\swenum.sys
20:20:51.0431 0796	swenum - ok
20:20:51.0493 0796	swprv           (f21fd248040681cca1fb6c9a03aaa93d) C:\Windows\System32\swprv.dll
20:20:51.0524 0796	swprv - ok
20:20:51.0587 0796	Symc8xx         (192aa3ac01df071b541094f251deed10) C:\Windows\system32\drivers\symc8xx.sys
20:20:51.0602 0796	Symc8xx - ok
20:20:51.0680 0796	Sym_hi          (8c8eb8c76736ebaf3b13b633b2e64125) C:\Windows\system32\drivers\sym_hi.sys
20:20:51.0696 0796	Sym_hi - ok
20:20:51.0758 0796	Sym_u3          (8072af52b5fd103bbba387a1e49f62cb) C:\Windows\system32\drivers\sym_u3.sys
20:20:51.0774 0796	Sym_u3 - ok
20:20:51.0883 0796	SynTP           (c1777074592bbb55b1f1a2fbc7a60498) C:\Windows\system32\DRIVERS\SynTP.sys
20:20:51.0899 0796	SynTP - ok
20:20:51.0977 0796	SysMain         (9a51b04e9886aa4ee90093586b0ba88d) C:\Windows\system32\sysmain.dll
20:20:52.0070 0796	SysMain - ok
20:20:52.0148 0796	TabletInputService (2dca225eae15f42c0933e998ee0231c3) C:\Windows\System32\TabSvc.dll
20:20:52.0211 0796	TabletInputService - ok
20:20:52.0320 0796	TapiSrv         (d7673e4b38ce21ee54c59eeeb65e2483) C:\Windows\System32\tapisrv.dll
20:20:52.0367 0796	TapiSrv - ok
20:20:52.0445 0796	TBS             (cb05822cd9cc6c688168e113c603dbe7) C:\Windows\System32\tbssvc.dll
20:20:52.0491 0796	TBS - ok
20:20:52.0632 0796	Tcpip           (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\drivers\tcpip.sys
20:20:52.0725 0796	Tcpip - ok
20:20:52.0819 0796	Tcpip6          (814a1c66fbd4e1b310a517221f1456bf) C:\Windows\system32\DRIVERS\tcpip.sys
20:20:52.0897 0796	Tcpip6 - ok
20:20:53.0006 0796	tcpipreg        (608c345a255d82a6289c2d468eb41fd7) C:\Windows\system32\drivers\tcpipreg.sys
20:20:53.0084 0796	tcpipreg - ok
20:20:53.0193 0796	TDPIPE          (5dcf5e267be67a1ae926f2df77fbcc56) C:\Windows\system32\drivers\tdpipe.sys
20:20:53.0256 0796	TDPIPE - ok
20:20:53.0303 0796	TDTCP           (389c63e32b3cefed425b61ed92d3f021) C:\Windows\system32\drivers\tdtcp.sys
20:20:53.0334 0796	TDTCP - ok
20:20:53.0459 0796	tdx             (76b06eb8a01fc8624d699e7045303e54) C:\Windows\system32\DRIVERS\tdx.sys
20:20:53.0490 0796	tdx - ok
20:20:53.0583 0796	TermDD          (3cad38910468eab9a6479e2f01db43c7) C:\Windows\system32\DRIVERS\termdd.sys
20:20:53.0599 0796	TermDD - ok
20:20:53.0771 0796	TermService     (bb95da09bef6e7a131bff3ba5032090d) C:\Windows\System32\termsrv.dll
20:20:53.0880 0796	TermService - ok
20:20:53.0958 0796	Themes          (c7230fbee14437716701c15be02c27b8) C:\Windows\system32\shsvcs.dll
20:20:53.0989 0796	Themes - ok
20:20:54.0051 0796	THREADORDER     (1076ffcffaae8385fd62dfcb25ac4708) C:\Windows\system32\mmcss.dll
20:20:54.0083 0796	THREADORDER - ok
20:20:54.0223 0796	TlntSvr         (5e1bc006cb4a26507d4512795cf08373) C:\Windows\System32\tlntsvr.exe
20:20:54.0285 0796	TlntSvr - ok
20:20:54.0348 0796	TrkWks          (ec74e77d0eb004bd3a809b5f8fb8c2ce) C:\Windows\System32\trkwks.dll
20:20:54.0395 0796	TrkWks - ok
20:20:54.0426 0796	TrustedInstaller (97d9d6a04e3ad9b6c626b9931db78dba) C:\Windows\servicing\TrustedInstaller.exe
20:20:54.0473 0796	TrustedInstaller - ok
20:20:54.0551 0796	tssecsrv        (dcf0f056a2e4f52287264f5ab29cf206) C:\Windows\system32\DRIVERS\tssecsrv.sys
20:20:54.0597 0796	tssecsrv - ok
20:20:54.0675 0796	tunmp           (caecc0120ac49e3d2f758b9169872d38) C:\Windows\system32\DRIVERS\tunmp.sys
20:20:54.0691 0796	tunmp - ok
20:20:54.0785 0796	tunnel          (300db877ac094feab0be7688c3454a9c) C:\Windows\system32\DRIVERS\tunnel.sys
20:20:54.0800 0796	tunnel - ok
20:20:54.0878 0796	uagp35          (c3ade15414120033a36c0f293d4a4121) C:\Windows\system32\drivers\uagp35.sys
20:20:54.0894 0796	uagp35 - ok
20:20:55.0019 0796	udfs            (d9728af68c4c7693cb100b8441cbdec6) C:\Windows\system32\DRIVERS\udfs.sys
20:20:55.0050 0796	udfs - ok
20:20:55.0097 0796	UI0Detect       (ecef404f62863755951e09c802c94ad5) C:\Windows\system32\UI0Detect.exe
20:20:55.0159 0796	UI0Detect - ok
20:20:55.0221 0796	uliagpkx        (75e6890ebfce0841d3291b02e7a8bdb0) C:\Windows\system32\drivers\uliagpkx.sys
20:20:55.0221 0796	uliagpkx - ok
20:20:55.0315 0796	uliahci         (3cd4ea35a6221b85dcc25daa46313f8d) C:\Windows\system32\drivers\uliahci.sys
20:20:55.0331 0796	uliahci - ok
20:20:55.0393 0796	UlSata          (8514d0e5cd0534467c5fc61be94a569f) C:\Windows\system32\drivers\ulsata.sys
20:20:55.0409 0796	UlSata - ok
20:20:55.0471 0796	ulsata2         (38c3c6e62b157a6bc46594fada45c62b) C:\Windows\system32\drivers\ulsata2.sys
20:20:55.0487 0796	ulsata2 - ok
20:20:55.0565 0796	umbus           (32cff9f809ae9aed85464492bf3e32d2) C:\Windows\system32\DRIVERS\umbus.sys
20:20:55.0611 0796	umbus - ok
20:20:55.0689 0796	upnphost        (68308183f4ae0be7bf8ecd07cb297999) C:\Windows\System32\upnphost.dll
20:20:55.0736 0796	upnphost - ok
20:20:55.0845 0796	usbccgp         (caf811ae4c147ffcd5b51750c7f09142) C:\Windows\system32\DRIVERS\usbccgp.sys
20:20:55.0861 0796	usbccgp - ok
20:20:55.0939 0796	usbcir          (e9476e6c486e76bc4898074768fb7131) C:\Windows\system32\drivers\usbcir.sys
20:20:56.0017 0796	usbcir - ok
20:20:56.0095 0796	usbehci         (79e96c23a97ce7b8f14d310da2db0c9b) C:\Windows\system32\DRIVERS\usbehci.sys
20:20:56.0126 0796	usbehci - ok
20:20:56.0204 0796	usbhub          (4673bbcb006af60e7abddbe7a130ba42) C:\Windows\system32\DRIVERS\usbhub.sys
20:20:56.0251 0796	usbhub - ok
20:20:56.0345 0796	usbohci         (ce697fee0d479290d89bec80dfe793b7) C:\Windows\system32\DRIVERS\usbohci.sys
20:20:56.0376 0796	usbohci - ok
20:20:56.0438 0796	usbprint        (b51e52acf758be00ef3a58ea452fe360) C:\Windows\system32\drivers\usbprint.sys
20:20:56.0501 0796	usbprint - ok
20:20:56.0579 0796	USBSTOR         (be3da31c191bc222d9ad503c5224f2ad) C:\Windows\system32\DRIVERS\USBSTOR.SYS
20:20:56.0594 0796	USBSTOR - ok
20:20:56.0672 0796	usbuhci         (325dbbacb8a36af9988ccf40eac228cc) C:\Windows\system32\DRIVERS\usbuhci.sys
20:20:56.0750 0796	usbuhci - ok
20:20:56.0813 0796	UxSms           (1509e705f3ac1d474c92454a5c2dd81f) C:\Windows\System32\uxsms.dll
20:20:56.0844 0796	UxSms - ok
20:20:56.0922 0796	vds             (cd88d1b7776dc17a119049742ec07eb4) C:\Windows\System32\vds.exe
20:20:57.0031 0796	vds - ok
20:20:57.0187 0796	vga             (7d92be0028ecdedec74617009084b5ef) C:\Windows\system32\DRIVERS\vgapnp.sys
20:20:57.0249 0796	vga - ok
20:20:57.0312 0796	VgaSave         (2e93ac0a1d8c79d019db6c51f036636c) C:\Windows\System32\drivers\vga.sys
20:20:57.0343 0796	VgaSave - ok
20:20:57.0390 0796	viaagp          (045d9961e591cf0674a920b6ba3ba5cb) C:\Windows\system32\drivers\viaagp.sys
20:20:57.0405 0796	viaagp - ok
20:20:57.0468 0796	ViaC7           (56a4de5f02f2e88182b0981119b4dd98) C:\Windows\system32\drivers\viac7.sys
20:20:57.0530 0796	ViaC7 - ok
20:20:57.0608 0796	viaide          (fd2e3175fcada350c7ab4521dca187ec) C:\Windows\system32\drivers\viaide.sys
20:20:57.0624 0796	viaide - ok
20:20:57.0717 0796	volmgr          (69503668ac66c77c6cd7af86fbdf8c43) C:\Windows\system32\drivers\volmgr.sys
20:20:57.0733 0796	volmgr - ok
20:20:57.0811 0796	volmgrx         (23e41b834759917bfd6b9a0d625d0c28) C:\Windows\system32\drivers\volmgrx.sys
20:20:57.0842 0796	volmgrx - ok
20:20:57.0873 0796	volsnap         (147281c01fcb1df9252de2a10d5e7093) C:\Windows\system32\drivers\volsnap.sys
20:20:57.0905 0796	volsnap - ok
20:20:57.0967 0796	vsmraid         (d984439746d42b30fc65a4c3546c6829) C:\Windows\system32\drivers\vsmraid.sys
20:20:57.0983 0796	vsmraid - ok
20:20:58.0107 0796	VSS             (db3d19f850c6eb32bdcb9bc0836acddb) C:\Windows\system32\vssvc.exe
20:20:58.0248 0796	VSS - ok
20:20:58.0326 0796	W32Time         (96ea68b9eb310a69c25ebb0282b2b9de) C:\Windows\system32\w32time.dll
20:20:58.0373 0796	W32Time - ok
20:20:58.0482 0796	WacomPen        (48dfee8f1af7c8235d4e626f0c4fe031) C:\Windows\system32\drivers\wacompen.sys
20:20:58.0544 0796	WacomPen - ok
20:20:58.0622 0796	Wanarp          (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:20:58.0638 0796	Wanarp - ok
20:20:58.0653 0796	Wanarpv6        (55201897378cca7af8b5efd874374a26) C:\Windows\system32\DRIVERS\wanarp.sys
20:20:58.0669 0796	Wanarpv6 - ok
20:20:58.0747 0796	WcesComm        (779f9c90d3fe9c70b6ffd8ef035f3e83) C:\Windows\WindowsMobile\wcescomm.dll
20:20:58.0809 0796	WcesComm - ok
20:20:58.0903 0796	wcncsvc         (a3cd60fd826381b49f03832590e069af) C:\Windows\System32\wcncsvc.dll
20:20:58.0934 0796	wcncsvc - ok
20:20:59.0028 0796	WcsPlugInService (11bcb7afcdd7aadacb5746f544d3a9c7) C:\Windows\System32\WcsPlugInService.dll
20:20:59.0075 0796	WcsPlugInService - ok
20:20:59.0153 0796	Wd              (afc5ad65b991c1e205cf25cfdbf7a6f4) C:\Windows\system32\drivers\wd.sys
20:20:59.0168 0796	Wd - ok
20:20:59.0277 0796	Wdf01000        (b6f0a7ad6d4bd325fbcd8bac96cd8d96) C:\Windows\system32\drivers\Wdf01000.sys
20:20:59.0324 0796	Wdf01000 - ok
20:20:59.0402 0796	WdiServiceHost  (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
20:20:59.0449 0796	WdiServiceHost - ok
20:20:59.0449 0796	WdiSystemHost   (abfc76b48bb6c96e3338d8943c5d93b5) C:\Windows\system32\wdi.dll
20:20:59.0496 0796	WdiSystemHost - ok
20:20:59.0543 0796	WebClient       (04c37d8107320312fbae09926103d5e2) C:\Windows\System32\webclnt.dll
20:20:59.0574 0796	WebClient - ok
20:20:59.0636 0796	Wecsvc          (ae3736e7e8892241c23e4ebbb7453b60) C:\Windows\system32\wecsvc.dll
20:20:59.0730 0796	Wecsvc - ok
20:20:59.0808 0796	wercplsupport   (670ff720071ed741206d69bd995ea453) C:\Windows\System32\wercplsupport.dll
20:20:59.0839 0796	wercplsupport - ok
20:20:59.0870 0796	WerSvc          (32b88481d3b326da6deb07b1d03481e7) C:\Windows\System32\WerSvc.dll
20:20:59.0917 0796	WerSvc - ok
20:20:59.0979 0796	WinDefend       (4575aa12561c5648483403541d0d7f2b) C:\Program Files\Windows Defender\mpsvc.dll
20:20:59.0995 0796	WinDefend - ok
20:21:00.0120 0796	WinDriver6      (94e4312d546048bf31604a8b2ad13fc0) C:\Windows\system32\drivers\windrvr6.sys
20:21:00.0182 0796	WinDriver6 - ok
20:21:00.0198 0796	WinHttpAutoProxySvc - ok
20:21:00.0213 0796	WINIO - ok
20:21:00.0338 0796	Winmgmt         (6b2a1d0e80110e3d04e6863c6e62fd8a) C:\Windows\system32\wbem\WMIsvc.dll
20:21:00.0354 0796	Winmgmt - ok
20:21:00.0463 0796	WinRM           (7cfe68bdc065e55aa5e8421607037511) C:\Windows\system32\WsmSvc.dll
20:21:00.0557 0796	WinRM - ok
20:21:00.0666 0796	winusb          (676f4b665bdd8053eaa53ac1695b8074) C:\Windows\system32\DRIVERS\winusb.sys
20:21:00.0713 0796	winusb - ok
20:21:00.0822 0796	Wlansvc         (c008405e4feeb069e30da1d823910234) C:\Windows\System32\wlansvc.dll
20:21:00.0915 0796	Wlansvc - ok
20:21:01.0025 0796	wlidsvc         (5144ae67d60ec653f97ddf3feed29e77) C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE
20:21:01.0149 0796	wlidsvc - ok
20:21:01.0305 0796	WmiAcpi         (701a9f884a294327e9141d73746ee279) C:\Windows\system32\drivers\wmiacpi.sys
20:21:01.0368 0796	WmiAcpi - ok
20:21:01.0477 0796	wmiApSrv        (43be3875207dcb62a85c8c49970b66cc) C:\Windows\system32\wbem\WmiApSrv.exe
20:21:01.0508 0796	wmiApSrv - ok
20:21:01.0602 0796	WMPNetworkSvc   (3978704576a121a9204f8cc49a301a9b) C:\Program Files\Windows Media Player\wmpnetwk.exe
20:21:01.0695 0796	WMPNetworkSvc - ok
20:21:01.0867 0796	WPCSvc          (cfc5a04558f5070cee3e3a7809f3ff52) C:\Windows\System32\wpcsvc.dll
20:21:01.0914 0796	WPCSvc - ok
20:21:01.0992 0796	WPDBusEnum      (801fbdb89d472b3c467eb112a0fc9246) C:\Windows\system32\wpdbusenum.dll
20:21:02.0023 0796	WPDBusEnum - ok
20:21:02.0132 0796	WpdUsb          (de9d36f91a4df3d911626643debf11ea) C:\Windows\system32\DRIVERS\wpdusb.sys
20:21:02.0148 0796	WpdUsb - ok
20:21:02.0304 0796	WPFFontCache_v0400 (dcf3e3edf5109ee8bc02fe6e1f045795) C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
20:21:02.0335 0796	WPFFontCache_v0400 - ok
20:21:02.0413 0796	ws2ifsl         (e3a3cb253c0ec2494d4a61f5e43a389c) C:\Windows\system32\drivers\ws2ifsl.sys
20:21:02.0444 0796	ws2ifsl - ok
20:21:02.0522 0796	wscsvc          (1ca6c40261ddc0425987980d0cd2aaab) C:\Windows\System32\wscsvc.dll
20:21:02.0569 0796	wscsvc - ok
20:21:02.0678 0796	WSDPrintDevice  (4422ac5ed8d4c2f0db63e71d4c069dd7) C:\Windows\system32\DRIVERS\WSDPrint.sys
20:21:02.0709 0796	WSDPrintDevice - ok
20:21:02.0756 0796	WSearch - ok
20:21:02.0897 0796	wuauserv        (6298277b73c77fa99106b271a7525163) C:\Windows\system32\wuaueng.dll
20:21:03.0084 0796	wuauserv - ok
20:21:03.0209 0796	WUDFRd          (ac13cb789d93412106b0fb6c7eb2bcb6) C:\Windows\system32\DRIVERS\WUDFRd.sys
20:21:03.0255 0796	WUDFRd - ok
20:21:03.0489 0796	wudfsvc         (575a4190d989f64732119e4114045a4f) C:\Windows\System32\WUDFSvc.dll
20:21:03.0521 0796	wudfsvc - ok
20:21:03.0614 0796	yukonwlh        (04e268adfc81964c49dc0c082d520f7e) C:\Windows\system32\DRIVERS\yk60x86.sys
20:21:03.0661 0796	yukonwlh - ok
20:21:03.0677 0796	MBR (0x1B8)     (61a349592c4728853f4a90ff78f7628e) \Device\Harddisk0\DR0
20:21:04.0176 0796	\Device\Harddisk0\DR0 - ok
20:21:04.0176 0796	MBR (0x1B8)     (65e858a8a0293be11a920b0bc99d695e) \Device\Harddisk1\DR1
20:21:05.0237 0796	\Device\Harddisk1\DR1 - ok
20:21:05.0237 0796	MBR (0x1B8)     (65e858a8a0293be11a920b0bc99d695e) \Device\Harddisk2\DR2
20:21:09.0683 0796	\Device\Harddisk2\DR2 - ok
20:21:09.0683 0796	Boot (0x1200)   (d1e2cd8194e7965c77b404912505b2bf) \Device\Harddisk0\DR0\Partition0
20:21:09.0683 0796	\Device\Harddisk0\DR0\Partition0 - ok
20:21:09.0698 0796	Boot (0x1200)   (09a87539c4d9481f7c6a37f44a13f2a3) \Device\Harddisk1\DR1\Partition0
20:21:09.0698 0796	\Device\Harddisk1\DR1\Partition0 - ok
20:21:09.0698 0796	Boot (0x1200)   (ce330dc435a261a08fc1df4061628af4) \Device\Harddisk2\DR2\Partition0
20:21:09.0714 0796	\Device\Harddisk2\DR2\Partition0 - ok
20:21:09.0714 0796	============================================================
20:21:09.0714 0796	Scan finished
20:21:09.0714 0796	============================================================
20:21:09.0714 3808	Detected object count: 5
20:21:09.0714 3808	Actual detected object count: 5
20:21:51.0563 3808	epmntdrv ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808	epmntdrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:21:51.0563 3808	EuGdiDrv ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808	EuGdiDrv ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:21:51.0563 3808	FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808	FirebirdServerMAGIXInstance ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:21:51.0563 3808	IDriverT ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808	IDriverT ( UnsignedFile.Multi.Generic ) - User select action: Skip 
20:21:51.0563 3808	RichVideo ( UnsignedFile.Multi.Generic ) - skipped by user
20:21:51.0563 3808	RichVideo ( UnsignedFile.Multi.Generic ) - User select action: Skip

cosinus · 08.04.2012, 15:45

Dann bitte jetzt CF ausführen:

ComboFix

Ein Leitfaden und Tutorium zur Nutzung von ComboFix

Lade dir ComboFix hier herunter auf deinen Desktop.

Schliesse alle Programme, vor allem dein Antivirenprogramm und andere Hintergrundwächter sowie deinen Internetbrowser.

Starte combofix.exe von deinem Desktop aus, bestätige die Warnmeldungen, führe die Updates durch (falls vorgeschlagen), installiere die Wiederherstellungskonsole (falls vorgeschlagen) und lass dein System durchsuchen.
Vermeide es auch während Combofix läuft die Maus und Tastatur zu benutzen.

Im Anschluss öffnet sich automatisch eine combofix.txt, diesen Inhalt bitte kopieren ([Strg]a, [Strg]c) und in deinen Beitrag einfügen ([Strg]v). Die Datei findest du außerdem unter: C:\ComboFix.txt.

Wichtiger Hinweis:

Combofix darf ausschließlich ausgeführt werden, wenn ein Kompetenzler dies ausdrücklich empfohlen hat!

Es sollte nie auf eigene Initiative hin ausgeführt werden! Eine falsche Benutzung kann ernsthafte Computerprobleme nach sich ziehen und eine Bereinigung der Infektion noch erschweren.

Solltest du nach der Ausführung von Combofix Probleme beim Starten von Anwendungen haben und Meldungen erhalten wie

Zitat:

Es wurde versucht, einen Registrierungsschlüssel einem ungültigen Vorgang zu unterziehen, der zum Löschen markiert wurde.

startest du Windows dann manuell neu und die Fehlermeldungen sollten nicht mehr auftauchen.

muffin0815 · 08.04.2012, 17:01

[code]
Combofix Logfile:

Code:

ATTFilter

ComboFix 12-04-07.04 - Fässi Nutzer 08.04.2012  17:40:54.1.2 - x86
Microsoft® Windows Vista™ Home Premium   6.0.6002.2.1252.49.1031.18.1789.894 [GMT 2:00]
ausgeführt von:: c:\users\Fõssi Nutzer\Desktop\ComboFix.exe
AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C}
SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691}
SP: Windows Defender *Enabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46}
.
.
((((((((((((((((((((((((((((((((((((   Weitere Löschungen   ))))))))))))))))))))))))))))))))))))))))))))))))
.
.
c:\windows\security\Database\tmp.edb
c:\windows\system32\dv
c:\windows\system32\MSDCSC
c:\windows\system32\MSDCSC\winlogon.exe
c:\windows\system32\system32
c:\windows\system32\system32\3DAudio.ax
c:\windows\system32\system32\avrt.dll
c:\windows\system32\system32\cis-2.4.dll
c:\windows\system32\system32\issacapi_bs-2.3.dll
c:\windows\system32\system32\issacapi_pe-2.3.dll
c:\windows\system32\system32\issacapi_se-2.3.dll
c:\windows\system32\system32\MACXMLProto.dll
c:\windows\system32\system32\MaDRM.dll
c:\windows\system32\system32\MaJGUILib.dll
c:\windows\system32\system32\MAMACExtract.dll
c:\windows\system32\system32\MASetupCleaner.exe
c:\windows\system32\system32\MaXMLProto.dll
c:\windows\system32\system32\mfplat.dll
c:\windows\system32\system32\MK_Lyric.dll
c:\windows\system32\system32\MSCLib.dll
c:\windows\system32\system32\MSFLib.dll
c:\windows\system32\system32\MSLUR71.dll
c:\windows\system32\system32\msvcp60.dll
c:\windows\system32\system32\MTTELECHIP.dll
c:\windows\system32\system32\MTXSYNCICON.dll
c:\windows\system32\system32\muzaf1.dll
c:\windows\system32\system32\muzapp.dll
c:\windows\system32\system32\muzapp.exe
c:\windows\system32\system32\muzdecode.ax
c:\windows\system32\system32\muzeffect.ax
c:\windows\system32\system32\muzmp4sp.ax
c:\windows\system32\system32\muzmpgsp.ax
c:\windows\system32\system32\muzoggsp.ax
c:\windows\system32\system32\muzwmts.dll
c:\windows\system32\system32\psapi.dll
.
.
(((((((((((((((((((((((   Dateien erstellt von 2012-03-08 bis 2012-04-08  ))))))))))))))))))))))))))))))
.
.
2012-04-07 17:39 . 2012-04-07 17:39	--------	d-----w-	C:\_OTL
2012-04-07 15:19 . 2012-03-14 02:15	6582328	----a-w-	c:\programdata\Microsoft\Windows Defender\Definition Updates\{2D0EE6D8-4ED1-4AFD-BA67-A597BD181089}\mpengine.dll
2012-04-06 07:00 . 2012-04-06 07:00	--------	d-----w-	c:\users\Fässi\AppData\Roaming\NeroDigital
2012-04-02 18:27 . 2012-04-02 18:27	--------	d-----w-	c:\program files\ESET
2012-04-02 15:04 . 2012-04-02 15:04	--------	d-----w-	c:\users\Fässi\AppData\Roaming\Malwarebytes
2012-04-02 14:56 . 2012-04-02 14:56	--------	d-----w-	c:\programdata\Malwarebytes
2012-04-02 14:56 . 2011-12-10 13:24	20464	----a-w-	c:\windows\system32\drivers\mbam.sys
2012-04-02 14:56 . 2012-04-02 14:56	--------	d-----w-	c:\program files\Malwarebytes' Anti-Malware
2012-03-31 20:06 . 2012-03-31 20:06	--------	d-----w-	c:\program files\icq
2012-03-31 20:06 . 2012-03-31 20:06	--------	d-----w-	c:\program files\Guard-ICQ
2012-03-31 20:04 . 2012-03-31 20:07	--------	d-----w-	c:\program files\ICQ7.7
2012-03-31 17:54 . 2012-03-31 17:53	637848	----a-w-	c:\windows\system32\npdeployJava1.dll
2012-03-31 17:45 . 2012-03-31 17:45	--------	d-----w-	c:\program files\Secunia
2012-03-31 17:44 . 2012-03-31 17:44	--------	d-----w-	c:\program files\FileHippo.com
2012-03-31 15:12 . 2012-03-31 15:12	--------	d-----w-	c:\users\Fässi Nutzer
2012-03-30 19:08 . 2012-03-30 19:38	418464	----a-w-	c:\windows\system32\FlashPlayerApp.exe
2012-03-30 19:07 . 2012-03-30 20:11	--------	d-----w-	c:\users\Sandra\AppData\Local\adaware
2012-03-30 19:05 . 2012-03-30 19:05	--------	d-----w-	c:\users\Sandra\AppData\Roaming\Ad-Aware Antivirus
2012-03-30 18:40 . 2012-03-30 18:40	--------	d-----w-	c:\users\Fässi\AppData\Local\adaware
2012-03-30 18:39 . 2011-04-05 15:35	94040	----a-w-	c:\windows\system32\drivers\sbhips.sys
2012-03-30 18:39 . 2011-04-05 15:35	78936	----a-w-	c:\windows\system32\drivers\sbtis.sys
2012-03-30 18:37 . 2011-02-08 07:14	69208	----a-w-	c:\windows\system32\drivers\SbFwIm.sys
2012-03-30 18:37 . 2011-04-05 15:35	221784	----a-w-	c:\windows\system32\drivers\SbFw.sys
2012-03-30 18:32 . 2012-03-30 18:32	--------	d-----w-	c:\program files\Toolbar Cleaner
2012-03-28 17:15 . 2012-03-28 17:15	--------	d-----w-	c:\users\Fässi\AppData\Roaming\Help
2012-03-28 17:11 . 2012-03-28 17:11	--------	d-----w-	c:\users\Fässi\AppData\Roaming\TeamViewer
2012-03-19 17:27 . 2012-03-19 17:27	592824	----a-w-	c:\program files\Mozilla Firefox\gkmedias.dll
2012-03-19 17:27 . 2012-03-19 17:27	44472	----a-w-	c:\program files\Mozilla Firefox\mozglue.dll
2012-03-15 18:10 . 2012-03-15 18:10	--------	d-----w-	c:\users\Fässi\Ausbilder
2012-03-14 19:00 . 2012-02-02 15:16	2044416	----a-w-	c:\windows\system32\win32k.sys
2012-03-14 19:00 . 2012-02-14 15:45	219648	----a-w-	c:\windows\system32\d3d10_1core.dll
2012-03-14 19:00 . 2012-02-13 14:12	1172480	----a-w-	c:\windows\system32\d3d10warp.dll
2012-03-14 19:00 . 2012-02-13 13:44	1068544	----a-w-	c:\windows\system32\DWrite.dll
2012-03-14 19:00 . 2012-02-14 15:45	160768	----a-w-	c:\windows\system32\d3d10_1.dll
2012-03-14 19:00 . 2012-02-13 13:47	683008	----a-w-	c:\windows\system32\d2d1.dll
2012-03-14 18:59 . 2012-01-31 10:59	2409784	----a-w-	c:\program files\Windows Mail\OESpamFilter.dat
2012-03-14 18:57 . 2012-01-09 15:54	613376	----a-w-	c:\windows\system32\rdpencom.dll
2012-03-14 18:57 . 2012-01-09 13:58	180736	----a-w-	c:\windows\system32\drivers\rdpwd.sys
.
.
.
((((((((((((((((((((((((((((((((((((   Find3M Bericht   ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-03-31 17:53 . 2010-05-18 09:48	567696	----a-w-	c:\windows\system32\deployJava1.dll
2012-03-30 19:38 . 2011-06-29 16:36	70304	----a-w-	c:\windows\system32\FlashPlayerCPLApp.cpl
2012-02-23 08:18 . 2009-10-03 08:58	237072	------w-	c:\windows\system32\MpSigStub.exe
2012-02-15 17:31 . 2011-10-16 10:25	137416	----a-w-	c:\windows\system32\drivers\avipbb.sys
2012-01-13 17:47 . 2012-01-13 17:30	102400	----a-w-	c:\windows\system32\Setup.dll
2009-08-07 12:57 . 2009-09-21 12:03	1456640	----a-w-	c:\program files\Common Files\Falk Navi-Manager.msi
2009-09-25 16:41 . 2009-09-25 16:41	1044480	----a-w-	c:\program files\mozilla firefox\plugins\libdivx.dll
2009-09-25 16:41 . 2009-09-25 16:41	200704	----a-w-	c:\program files\mozilla firefox\plugins\ssldivx.dll
2012-03-19 17:27 . 2011-05-02 17:26	97208	----a-w-	c:\program files\mozilla firefox\components\browsercomps.dll
.
.
((((((((((((((((((((((((((((   Autostartpunkte der Registrierung   ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. 
REGEDIT4
.
[HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"WindowsWelcomeCenter"="oobefldr.dll" [2009-04-11 2153472]
"FileHippo.com"="c:\program files\FileHippo.com\UpdateChecker.exe" [2012-03-26 306688]
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"RtHDVCpl"="RtHDVCpl.exe" [2008-07-08 6273568]
"Iomega Home Storage Manager"="c:\program files\Iomega\Home Storage Manager\Iomega Discovery.exe" [2009-10-27 152936]
"avgnt"="c:\program files\Avira\AntiVir Desktop\avgnt.exe" [2011-10-11 258512]
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"EnableUIADesktopToggle"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\drivers32]
"aux"=wdmaud.drv
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Adobe ARM]
2012-01-03 07:37	843712	----a-w-	c:\program files\Common Files\Adobe\ARM\1.0\AdobeARM.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\Device Detection]
2011-11-30 05:46	788368	----a-w-	c:\program files\Lidl_Fotos\dd.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\FreePDF Assistant]
2011-02-23 20:19	371200	----a-w-	c:\program files\FreePDF_XP\fpassist.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PDFPrint]
2011-12-16 11:54	220744	----a-w-	c:\program files\pdf24\pdf24.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\PMBVolumeWatcher]
2009-11-04 16:20	597792	----a-w-	c:\program files\Sony\PMB\PMBVolumeWatcher.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\shared tools\msconfig\startupreg\TrayServer]
2008-08-07 14:18	90112	----a-w-	c:\program files\MAGIX\Video_deluxe_16\Trayserver.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\run-]
"SunJavaUpdateSched"="c:\program files\Common Files\Java\Java Update\jusched.exe"
"StartCCC"=c:\program files\ATI Technologies\ATI.ACE\Core-Static\CLIStart.exe
"Windows Mobile-based device management"=%windir%\WindowsMobile\wmdSync.exe
.
[HKEY_LOCAL_MACHINE\software\microsoft\security center\Svc\S-1-5-21-1895092649-2944749539-1579830581-1003]
"EnableNotificationsRef"=dword:00000001
.
R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 253600]
S2 AAV UpdateService;AAV UpdateService;c:\program files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe [2008-10-24 128296]
S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-01-03 63928]
.
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows nt\currentversion\svchost]
bthsvcs	REG_MULTI_SZ   	BthServ
WindowsMobile	REG_MULTI_SZ   	wcescomm rapimgr
LocalServiceRestricted	REG_MULTI_SZ   	WcesComm RapiMgr
LocalServiceAndNoImpersonation	REG_MULTI_SZ   	FontCache
.
Inhalt des "geplante Tasks" Ordners
.
2012-04-08 c:\windows\Tasks\Adobe Flash Player Updater.job
- c:\windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe [2012-03-30 19:38]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineCore.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-25 18:28]
.
2012-04-08 c:\windows\Tasks\GoogleUpdateTaskMachineUA.job
- c:\program files\Google\Update\GoogleUpdate.exe [2011-08-25 18:28]
.
2012-04-08 c:\windows\Tasks\SupBackGroundTask.job
- c:\program files\Samsung\Samsung Update Plus\SUPBackGround.exe [2008-09-25 12:26]
.
2012-04-08 c:\windows\Tasks\User_Feed_Synchronization-{3936AE30-DAAA-4190-BAEA-92F1B6503585}.job
- c:\windows\system32\msfeedssync.exe [2008-05-15 07:33]
.
2012-04-07 c:\windows\Tasks\User_Feed_Synchronization-{92086986-0B9B-44CF-9687-C488A176B971}.job
- c:\windows\system32\msfeedssync.exe [2008-05-15 07:33]
.
.
------- Zusätzlicher Suchlauf -------
.
uStart Page = 
IE: Nach Microsoft E&xel exportieren - c:\progra~1\MICROS~2\Office12\EXCEL.EXE/3000
IE: {{77F665FD-3F60-4B0A-AE14-EC124B7A7FCE} - c:\program files\ICQ7.7\ICQ.exe
TCP: DhcpNameServer = 192.168.2.1
FF - ProfilePath - c:\users\Fässi Nutzer\AppData\Roaming\Mozilla\Firefox\Profiles\7c6jnqz6.default\
FF - prefs.js: browser.search.selectedEngine - Google
FF - prefs.js: browser.startup.homepage - www.google.de
pref('extensions.shownSelectionUI',true);
pref('extensions.autoDisableScopes',0);
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
AddRemove-01_Simmental - c:\program files\Samsung\USB Drivers\01_Simmental\Uninstall.exe
AddRemove-02_Siberian - c:\program files\Samsung\USB Drivers\02_Siberian\Uninstall.exe
AddRemove-03_Swallowtail - c:\program files\Samsung\USB Drivers\03_Swallowtail\Uninstall.exe
AddRemove-04_semseyite - c:\program files\Samsung\USB Drivers\04_semseyite\Uninstall.exe
AddRemove-05_Sloan - c:\program files\Samsung\USB Drivers\05_Sloan\Uninstall.exe
AddRemove-06_Spencer - c:\program files\Samsung\USB Drivers\06_Spencer\Uninstall.exe
AddRemove-07_Schorl - c:\program files\Samsung\USB Drivers\07_Schorl\Uninstall.exe
AddRemove-08_EMPChipset - c:\program files\Samsung\USB Drivers\08_EMPChipset\Uninstall.exe
AddRemove-09_Hsp - c:\program files\Samsung\USB Drivers\09_Hsp\Uninstall.exe
AddRemove-11_HSP_Plus_Default - c:\program files\Samsung\USB Drivers\11_HSP_Plus_Default\Uninstall.exe
AddRemove-16_Shrewsbury - c:\program files\Samsung\USB Drivers\16_Shrewsbury\Uninstall.exe
AddRemove-17_EMP_Chipset2 - c:\program files\Samsung\USB Drivers\17_EMP_Chipset2\Uninstall.exe
AddRemove-18_Zinia_Serial_Driver - c:\program files\Samsung\USB Drivers\18_Zinia_Serial_Driver\Uninstall.exe
AddRemove-19_VIA_driver - c:\program files\Samsung\USB Drivers\19_VIA_driver\Uninstall.exe
AddRemove-20_NXP_Driver - c:\program files\Samsung\USB Drivers\20_NXP_Driver\Uninstall.exe
AddRemove-21_Searsburg - c:\program files\Samsung\USB Drivers\21_Searsburg\Uninstall.exe
AddRemove-22_WiBro_WiMAX - c:\program files\Samsung\USB Drivers\22_WiBro_WiMAX\Uninstall.exe
AddRemove-24_flashusbdriver - c:\program files\Samsung\USB Drivers\24_flashusbdriver\Uninstall.exe
AddRemove-25_escape - c:\program files\Samsung\USB Drivers\25_escape\Uninstall.exe
.
.
.
**************************************************************************
.
catchme 0.3.1398 W2K/XP/Vista - rootkit/stealth malware detector by Gmer, hxxp://www.gmer.net
Rootkit scan 2012-04-08 17:52
Windows 6.0.6002 Service Pack 2 NTFS
.
Scanne versteckte Prozesse... 
.
Scanne versteckte Autostarteinträge... 
.
Scanne versteckte Dateien... 
.
Scan erfolgreich abgeschlossen
versteckte Dateien: 0
.
**************************************************************************
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
"MSCurrentCountry"=dword:00000004
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
Zeit der Fertigstellung: 2012-04-08  17:56:43
ComboFix-quarantined-files.txt  2012-04-08 15:56
.
Vor Suchlauf: 17 Verzeichnis(se), 31.392.206.848 Bytes frei
Nach Suchlauf: 21 Verzeichnis(se), 31.088.861.184 Bytes frei
.
- - End Of File - - DA91E15E5EC4C091BE425CD4FCBC4AD4

--- --- ---

cosinus · 08.04.2012, 17:18

Bitte nun Logs mit GMER und OSAM erstellen und posten.
GMER stürzt häufiger ab, wenn das Tool auch beim 2. Mal nicht will, lass es einfach weg und führ nur OSAM aus - die Online-Abfrage durch OSAM bitte überspringen.
Bei OSAM bitte darauf auch achten, dass Du das Log auch als *.log und nicht *.html oder so abspeicherst.

Hinweis: Zum Entpacken von OSAM bitte WinRAR oder 7zip verwenden! Stell auch unbedingt den Virenscanner ab, besonders der Scanner von McAfee meldet oft einen Fehalarm in OSAM!

Downloade dir bitte

aswMBR.exe und speichere die Datei auf deinem Desktop.

Starte die aswMBR.exe - (aswMBR.exe Anleitung)
Ab Windows Vista (oder höher) bitte mit Rechtsklick "als Administrator ausführen" starten".
Das Tool wird dich fragen, ob Du mit der aktuellen Virendefinition von AVAST! dein System scannen willst. Beantworte diese Frage bitte mit Ja. (Sollte deine Firewall fragen, bitte den Zugriff auf das Internet zulassen )
Der Download der Definitionen kann je nach Verbindung eine Weile dauern.
Klicke auf Scan.
Warte bitte bis Scan finished successfully im DOS-Fenster steht.
Drücke auf Save Log und speichere diese auf dem Desktop.

Poste mir die aswMBR.txt in deiner nächsten Antwort.

Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung

Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte der Scan abbrechen und das Programm abstürzen, dann teile mir das mit und wähle unter AV Scan die Einstellung (none).

Noch ein Hinweis: Sollte aswMBR abstürzen und es kommt eine Meldung wie "aswMBR.exe funktioniert nicht mehr, dann mach Folgendes:
Starte aswMBR neu, wähle unten links im Drop-Down-Menü (unten links im Fenster von aswMBR) bei "AV scan" (none) aus und klick nochmal auf den Scan-Button.

muffin0815 · 08.04.2012, 19:04

[code]
GMER Logfile:

Code:

ATTFilter

GMER 1.0.15.15641 - hxxp://www.gmer.net
Rootkit scan 2012-04-08 18:56:55
Windows 6.0.6002 Service Pack 2 Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0 FUJITSU_MHW2160BH_PL rev.0000001C
Running: 2veo6f2m.exe; Driver: C:\Users\FSSINU~1\AppData\Local\Temp\pgliypoc.sys


---- Kernel code sections - GMER 1.0.15 ----

?               C:\Windows\system32\Drivers\PROCEXP113.SYS                                                       Das System kann die angegebene Datei nicht finden. !
?               C:\Users\FSSINU~1\AppData\Local\Temp\catchme.sys                                                 Das System kann die angegebene Datei nicht finden. !

---- Devices - GMER 1.0.15 ----

AttachedDevice  \Driver\kbdclass \Device\KeyboardClass0                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\kbdclass \Device\KeyboardClass1                                                          Wdf01000.sys (WDF Dynamic/Microsoft Corporation)
AttachedDevice  \Driver\tdx \Device\Tcp                                                                          SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\Tcp                                                                          sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\Udp                                                                          SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\Udp                                                                          sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\RawIp                                                                        SbFw.sys (Sunbelt Personal Firewall driver/Sunbelt Software, Inc.)
AttachedDevice  \Driver\tdx \Device\RawIp                                                                        sbtis.sys (Sunbelt TDI Inspection System/Sunbelt Software, Inc.)
AttachedDevice  \FileSystem\fastfat \Fat                                                                         fltmgr.sys (Microsoft Dateisystem-Filter-Manager/Microsoft Corporation)

---- Registry - GMER 1.0.15 ----

Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00027875488f                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\00027875585f                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000278755861                      
Reg             HKLM\SYSTEM\CurrentControlSet\Services\BTHPORT\Parameters\Keys\000278755ef5                      
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00027875488f (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\00027875585f (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000278755861 (not active ControlSet)  
Reg             HKLM\SYSTEM\ControlSet003\Services\BTHPORT\Parameters\Keys\000278755ef5 (not active ControlSet)  

---- EOF - GMER 1.0.15 ----

--- --- ---

Code:

ATTFilter


OSAM Logfile:

	Code: 

 ATTFilter

  
	Report of OSAM: Autorun Manager v5.0.11926.0
hxxp://www.online-solutions.ru/en/
Saved at 19:06:12 on 08.04.2012

OS: Windows Vista Home Premium Edition Service Pack 2 (Build 6002), 32-bit
Default Browser: Mozilla Corporation Firefox 11.0

Scanner Settings
[x] Rootkits detection (hidden registry)
[x] Rootkits detection (hidden files)
[x] Retrieve files information
[x] Check Microsoft signatures

Filters
[ ] Trusted entries
[ ] Empty entries
[x] Hidden registry entries (rootkit activity)
[x] Exclusively opened files
[x] Not found files
[x] Files without detailed information
[x] Existing files
[ ] Non-startable services
[ ] Non-startable drivers
[x] Active entries
[x] Disabled entries


[Common]
-----( %SystemRoot%\Tasks )-----
"GoogleUpdateTaskMachineCore.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"GoogleUpdateTaskMachineUA.job" - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Adobe Flash Player Updater.job" - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"SupBackGroundTask.job" - ? - C:\Program Files\Samsung\Samsung Update Plus\SUPBackGround.exe  (File found, but it contains no detailed information)

[Control Panel Objects]
-----( %SystemRoot%\system32 )-----
"FlashPlayerCPLApp.cpl" - "Adobe Systems Incorporated" - C:\Windows\system32\FlashPlayerCPLApp.cpl
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Control Panel\Cpls )-----
"mlcfg32.cpl" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLCFG32.CPL

[Drivers]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"avgntflt" (avgntflt) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avgntflt.sys
"avipbb" (avipbb) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avipbb.sys
"avkmgr" (avkmgr) - "Avira GmbH" - C:\Windows\System32\DRIVERS\avkmgr.sys
"catchme" (catchme) - ? - C:\Users\FSSINU~1\AppData\Local\Temp\catchme.sys  (File not found)
"epmntdrv" (epmntdrv) - ? - C:\Windows\system32\epmntdrv.sys  (File found, but it contains no detailed information)
"EuGdiDrv" (EuGdiDrv) - ? - C:\Windows\system32\EuGdiDrv.sys  (File found, but it contains no detailed information)
"IP in IP Tunnel Driver" (IpInIp) - ? - C:\Windows\System32\DRIVERS\ipinip.sys  (File not found)
"IPX Traffic Filter Driver" (NwlnkFlt) - ? - C:\Windows\System32\DRIVERS\nwlnkflt.sys  (File not found)
"IPX Traffic Forwarder Driver" (NwlnkFwd) - ? - C:\Windows\System32\DRIVERS\nwlnkfwd.sys  (File not found)
"mbr" (mbr) - ? - C:\ComboFix\mbr.sys  (Hidden registry entry, rootkit activity | File not found)
"pgliypoc" (pgliypoc) - ? - C:\Users\FSSINU~1\AppData\Local\Temp\pgliypoc.sys  (Hidden registry entry, rootkit activity | File not found)
"PSI" (PSI) - "Secunia" - C:\Windows\System32\DRIVERS\psi_mf.sys
"SbFw" (SbFw) - "Sunbelt Software, Inc." - C:\Windows\System32\drivers\SbFw.sys
"sbhips" (sbhips) - "Sunbelt Software, Inc." - C:\Windows\System32\drivers\sbhips.sys
"SBRE" (SBRE) - ? - C:\Windows\system32\drivers\SBREdrv.sys  (File not found)
"SbTis" (SbTis) - "Sunbelt Software, Inc." - C:\Windows\System32\drivers\sbtis.sys
"ssmdrv" (ssmdrv) - "Avira GmbH" - C:\Windows\System32\DRIVERS\ssmdrv.sys
"StarOpen" (StarOpen) - ? - C:\Windows\system32\drivers\StarOpen.sys  (File not found)
"WINIO" (WINIO) - ? - C:\Program Files\MetaBench\winio.sys  (File not found)

[Explorer]
-----( HKLM\Software\Classes\Folder\shellex\ColumnHandlers )-----
{F9DB5320-233E-11D1-9F84-707F02C10627} "PDF Shell Extension" - "Adobe Systems, Inc." - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\PDFShell.dll
{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B} "{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B}" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Classes\Protocols\Filter )-----
{807563E5-5146-11D5-A672-00B0D022E945} "Microsoft Office InfoPath XML Mime Filter" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\MSOXMLMF.DLL
-----( HKLM\Software\Classes\Protocols\Handler )-----
{32505114-5902-49B2-880A-1F7738E5A384} "Data Page Plugable Protocal mso-offdap11 Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\11\OWC11.DLL
{3D9F03FA-7A94-11D3-BE81-0050048385D1} "Data Page Pluggable Protocol mso-offdap Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBCOM~1\10\OWC10.DLL
{314111c7-a502-11d2-bbca-00c04f8ec294} "HxProtocol Class" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Help\hxds.dll
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Shell Extensions\Approved )-----
{911051fa-c21c-4246-b470-070cd8df6dc4} ".cab or .zip files" - ? -   (File not found | COM-object registry key not found)
{1b24a030-9b20-49bc-97ac-1be4426f9e59} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{34449847-FD14-4fc8-A75A-7432F5181EFB} "ActiveDirectory Folder" - ? -   (File not found | COM-object registry key not found)
{0F8604A5-4ECE-4DE1-BA7D-CF10F8AA4F48} "Contacts folder" - ? -   (File not found | COM-object registry key not found)
{2C2577C2-63A7-40e3-9B7F-586602617ECB} "Explorer Query Band" - ? -   (File not found | COM-object registry key not found)
{42042206-2D85-11D3-8CFF-005004838597} "Microsoft Office HTML Icon Handler" - "Microsoft Corporation" - C:\Program Files\Microsoft Office\Office12\msohevi.dll
{993BE281-6695-4BA5-8A2A-7AACBFAAB69E} "Microsoft Office Metadata Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{00020D75-0000-0000-C000-000000000046} "Microsoft Office Outlook" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\MLSHEXT.DLL
{C41662BB-1FA0-4CE0-8DC5-9B7F8279FF97} "Microsoft Office Thumbnail Handler" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\OFFICE12\msoshext.dll
{7842554E-6BED-11D2-8CDB-B05550C10000} "Monitor Class" - "Broadcom Corporation." - C:\Windows\system32\btncopy.dll
{97F68CE3-7146-45FF-BE24-D9A7DD7CB8A2} "NeroCoverEdLiveIcons Class" - ? - D:\Programme Treiber\Nero 9\Nero CoverDesigner\CoverEdExtension.dll  (File not found)
{C9E60ED7-FEAE-477b-B6A6-7D62103A0C6B} "NeroDigitalColumnHandler" - ? -   (File not found | COM-object registry key not found)
{1CA6BBC9-E9FA-4021-822B-075DF1837B63} "NeroDigitalIconHandler" - ? -   (File not found | COM-object registry key not found)
{4FBFFA8D-F390-471a-AE46-FEB93623AD63} "NeroDigitalInfoHandler" - ? -   (File not found | COM-object registry key not found)
{846083A4-BFC6-4447-985C-6578B466A7D7} "NeroDigitalPropSheetHandler" - ? -   (File not found | COM-object registry key not found)
{EDCC595A-F0EE-4d81-B554-D5D01C7AFB87} "NeroDigitalThumbnailHandler" - ? -   (File not found | COM-object registry key not found)
{F764812A-132C-4013-9960-5CBBEB408A0E} "NeroShellExt Class" - "Nero AG" - C:\Program Files\Common Files\Nero\NeroShellExt\NeroShellExt.dll
{0006F045-0000-0000-C000-000000000046} "Outlook File Icon Extension" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\OLKFSTUB.DLL
{C8494E42-ACDD-4739-B0FB-217361E4894F} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{E29F9716-5C08-4FCD-955A-119FDB5A522D} "Sam Account Folder" - ? -   (File not found | COM-object registry key not found)
{45AC2688-0253-4ED8-97DE-B5370FA7D48A} "Shell Extension for Malware scanning" - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\shlext.dll
{5E2121EE-0300-11D4-8D3B-444553540000} "SimpleShlExt Class" - ? - C:\Program Files\ATI Technologies\ATI.ACE\Core-Static\atiacmxx.dll
{BDEADF00-C265-11D0-BCED-00A0C90AB50F} "Webordner" - "Microsoft Corporation" - C:\PROGRA~1\COMMON~1\MICROS~1\WEBFOL~1\MSONSEXT.DLL
{da67b8ad-e81b-4c70-9b91b417b5e33527} "Windows Search Shell Service" - ? -   (File not found | COM-object registry key not found)
{B41DB860-8EE4-11D2-9906-E49FADC173CA} "WinRAR" - "Alexander Roshal" - C:\Program Files\WinRAR\rarext.dll

[Internet Explorer]
-----( HKCU\Software\Microsoft\Internet Explorer\Toolbar\WebBrowser )-----
<binary data> "ITBar7Layout" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\SOFTWARE\Microsoft\Code Store Database\Distribution Units )-----
{CAFEEFAC-0017-0000-0003-ABCDEFFEDCBA} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
{CAFEEFAC-FFFF-FFFF-FFFF-ABCDEFFEDCBA} "Java Plug-in 1.7.0_03" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\npjpi170_03.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
{8AD9C840-044E-11D1-B3E9-00805F499D93} "Java Plug-in 10.3.0" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2iexp.dll / hxxp://java.sun.com/update/1.7.0/jinstall-1_7_0_03-windows-i586.cab
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Extensions )-----
"@btrez.dll,-4015" - ? - C:\Program Files\WIDCOMM\Bluetooth Software\btsendto_ie.htm
"ICQ7.7" - "ICQ, LLC." - C:\Program Files\ICQ7.7\ICQ.exe
"PokerStars" - "PokerStars" - C:\Program Files\PokerStars\PokerStarsUpdate.exe
{FF059E31-CC5A-4E2E-BF3B-96E929D65503} "Research" - "Microsoft Corporation" - C:\PROGRA~1\MICROS~2\Office12\REFIEBAR.DLL
-----( HKLM\SOFTWARE\Microsoft\Internet Explorer\Toolbar )-----
{855F3B16-6D32-4fe6-8A56-BBB695989046} "ICQToolBar" - ? -   (File not found | COM-object registry key not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects )-----
{18DF081C-E8AD-4283-A596-FA578C2EBDC3} "Adobe PDF Link Helper" - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\Acrobat\ActiveX\AcroIEHelperShim.dll
{DBC80044-A445-435b-BC74-9C25C1C588A9} "Java(tm) Plug-In 2 SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\jp2ssv.dll
{761497BB-D6F0-462C-B6EB-D4DAF1D92D43} "Java(tm) Plug-In SSV Helper" - "Oracle Corporation" - C:\Program Files\Java\jre7\bin\ssv.dll
{6EBF7485-159F-4bff-A14F-B9E3AAC4465B} "Search Helper" - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\Search Helper\SEPsearchhelperie.dll
{9030D464-4C02-4ABF-8ECC-5164760863C6} "Windows Live ID-Anmelde-Hilfsprogramm" - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WindowsLiveLogin.dll

[Logon]
-----( %APPDATA%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\Users\Fässi Nutzer\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( %AllUsersProfile%\Microsoft\Windows\Start Menu\Programs\Startup )-----
"desktop.ini" - ? - C:\ProgramData\Microsoft\Windows\Start Menu\Programs\Startup\desktop.ini
-----( HKCU\SOFTWARE\Microsoft\Windows\CurrentVersion\Run )-----
"FileHippo.com" - "FileHippo.com" - "C:\Program Files\FileHippo.com\UpdateChecker.exe" /background
-----( HKLM\SYSTEM\CurrentControlSet\Control\Terminal Server\Wds\rdpwd )-----
"StartupPrograms" - ? - rdpclip  (File not found)
-----( HKLM\Software\Microsoft\Windows\CurrentVersion\Run )-----
"avgnt" - "Avira Operations GmbH & Co. KG" - "C:\Program Files\Avira\AntiVir Desktop\avgnt.exe" /min
"Iomega Home Storage Manager" - "Iomega Corporation" - C:\Program Files\Iomega\Home Storage Manager\Iomega Discovery.exe

[Print Monitors]
-----( HKLM\SYSTEM\CurrentControlSet\Control\Print\Monitors )-----
"Microsoft Document Imaging Writer Monitor" - "Microsoft Corporation" - C:\Windows\system32\mdimon.dll
"Redirected Port" - ? - C:\Windows\system32\redmonnt.dll  (File found, but it contains no detailed information)

[Services]
-----( HKLM\SYSTEM\CurrentControlSet\Services )-----
"@C:\Program Files\Nero\Update\NASvc.exe,-200" (NAUpdate) - "Nero AG" - C:\Program Files\Nero\Update\NASvc.exe
"@c:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe,-100" (WPFFontCache_v0400) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\WPF\WPFFontCache_v0400.exe
"AAV UpdateService" (AAV UpdateService) - ? - C:\Program Files\Akademische Arbeitsgemeinschaft\AAVUpdateManager\aavus.exe
"Adobe Acrobat Update Service" (AdobeARMservice) - "Adobe Systems Incorporated" - C:\Program Files\Common Files\Adobe\ARM\1.0\armsvc.exe
"Adobe Flash Player Update Service" (AdobeFlashPlayerUpdateSvc) - "Adobe Systems Incorporated" - C:\Windows\system32\Macromed\Flash\FlashPlayerUpdateService.exe
"Avira Echtzeit Scanner" (AntiVirService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\avguard.exe
"Avira Planer" (AntiVirSchedulerService) - "Avira Operations GmbH & Co. KG" - C:\Program Files\Avira\AntiVir Desktop\sched.exe
"FABS - Helping agent for MAGIX media database" (Fabs) - "MAGIX AG" - C:\Program Files\Common Files\MAGIX Services\Database\bin\FABS.exe
"Firebird Server - MAGIX Instance" (FirebirdServerMAGIXInstance) - "MAGIX®" - C:\Program Files\Common Files\MAGIX Services\Database\bin\fbserver.exe
"Google Update-Dienst (gupdate)" (gupdate) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Google Update-Dienst (gupdatem)" (gupdatem) - "Google Inc." - C:\Program Files\Google\Update\GoogleUpdate.exe
"Guard.Mail.ru" (Guard.Mail.ru) - ? - C:\Program Files\Guard-ICQ\GuardICQ.exe
"ICQ Service" (ICQ Service) - ? - C:\Program Files\ICQ6Toolbar\ICQ Service.exe
"InstallDriver Table Manager" (IDriverT) - "Macrovision Corporation" - C:\Program Files\Common Files\InstallShield\Driver\1150\Intel 32\IDriverT.exe
"Microsoft .NET Framework NGEN v4.0.30319_X86" (clr_optimization_v4.0.30319_32) - "Microsoft Corporation" - C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe
"Microsoft Office Diagnostics Service" (odserv) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\OFFICE12\ODSERV.EXE
"Office Source Engine" (ose) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Source Engine\OSE.EXE
"PMBDeviceInfoProvider" (PMBDeviceInfoProvider) - "Sony Corporation" - C:\Program Files\Sony\PMB\PMBDeviceInfoProvider.exe
"SeaPort" (SeaPort) - "Microsoft Corporation" - C:\Program Files\Microsoft\Search Enhancement Pack\SeaPort\SeaPort.exe
"Secunia Update Agent" (Secunia Update Agent) - ? - "C:\Program Files\Secunia\PSI\sua.exe" --start-service  (File not found)
"SQL Server VSS Writer" (SQLWriter) - "Microsoft Corporation" - C:\Program Files\Microsoft SQL Server\90\Shared\sqlwriter.exe
"Windows Live ID Sign-in Assistant" (wlidsvc) - "Microsoft Corporation" - C:\Program Files\Common Files\Microsoft Shared\Windows Live\WLIDSVC.EXE

===[ Logfile end ]=========================================[ Logfile end ]===
         
 --- --- ---

If You have questions or want to get some help, You can visit hxxp://forum.online-solutions.ru

Code:

ATTFilter

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-08 19:06:22
-----------------------------
19:06:22.040    OS Version: Windows 6.0.6002 Service Pack 2
19:06:22.041    Number of processors: 2 586 0xF0D
19:06:22.042    ComputerName: FÄSSI-LP  UserName: 
19:06:23.316    Initialize success
19:16:32.041    AVAST engine defs: 12040800
19:16:40.670    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
19:16:40.674    Disk 0 Vendor: FUJITSU_MHW2160BH_PL 0000001C Size: 152627MB BusType: 3
19:16:40.972    Disk 0 MBR read successfully
19:16:40.976    Disk 0 MBR scan
19:16:41.041    Disk 0 unknown MBR code
19:16:41.170    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
19:16:41.291    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        82415 MB offset 20973568
19:16:41.485    Disk 0 scanning sectors +189759780
19:16:42.094    Disk 0 scanning C:\Windows\system32\drivers
19:18:31.064    Service scanning
19:19:01.071    Modules scanning
19:21:07.006    Disk 0 trace - called modules:
19:21:07.065    ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys PCIIDEX.SYS atapi.sys 
19:21:07.071    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x852a8ac8]
19:21:07.077    3 CLASSPNP.SYS[87da18b3] -> nt!IofCallDriver -> [0x84d6f418]
19:21:07.083    5 acpi.sys[876486bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84d54800]
19:21:07.814    AVAST engine scan C:\Windows
19:22:07.474    AVAST engine scan C:\Windows\system32
19:35:43.831    AVAST engine scan C:\Windows\system32\drivers
19:36:03.969    AVAST engine scan C:\Users\Fässi Nutzer
19:36:30.979    AVAST engine scan C:\ProgramData
19:54:24.251    Scan finished successfully
19:57:18.919    Disk 0 MBR has been saved successfully to "C:\Users\Fässi Nutzer\Desktop\MBR.dat"
19:57:18.927    The log file has been saved successfully to "C:\Users\Fässi Nutzer\Desktop\aswMBR.txt"

cosinus · 08.04.2012, 19:51

Wir sollten den MBR fixen, sichere für den Fall der Fälle ALLE wichtigen Daten, auch wenn meistens alles glatt geht.

Hinweis: Mach bitte NICHT den MBR-Fix, wenn du noch andere Betriebssysteme wie zB Ubuntu installiert hast, ein MBR-Fix mit Windows-Tools macht ein parallel installiertes (Dualboot) Linux unbootbar.
Mach den Fix auch dann nicht, wenn du zB mit TrueCrypt oder anderen Verschlüsselungsprogrammen eine Vollverschlüsselung der Windowspartition bzw. gesamten Festplatte hast

Starte nach der Datensicherung aswmbr erneut und klick auf den Button FIXMBR.

Hinweis: Bitte den Virenscanner abstellen bevor du aswMBR ausführst, denn v.a. Avira meldet darin oft einen Fehalalrm!

Anschließend Windows neu starten und ein neues Log mit aswMBR machen.

muffin0815 · 08.04.2012, 20:41

So der 2. te Log :

Code:

ATTFilter

aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software
Run date: 2012-04-08 21:06:57
-----------------------------
21:06:57.691    OS Version: Windows 6.0.6002 Service Pack 2
21:06:57.691    Number of processors: 2 586 0xF0D
21:06:57.692    ComputerName: FÄSSI-LP  UserName: 
21:07:25.143    Initialize success
21:07:32.347    AVAST engine defs: 12040800
21:07:38.213    Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IdeDeviceP0T0L0-0
21:07:38.216    Disk 0 Vendor: FUJITSU_MHW2160BH_PL 0000001C Size: 152627MB BusType: 3
21:07:38.228    Disk 0 MBR read successfully
21:07:38.231    Disk 0 MBR scan
21:07:38.249    Disk 0 Windows VISTA default MBR code
21:07:38.269    Disk 0 Partition 1 00     27 Hidden NTFS WinRE NTFS        10240 MB offset 2048
21:07:38.290    Disk 0 Partition 2 80 (A) 07    HPFS/NTFS NTFS        82415 MB offset 20973568
21:07:38.298    Disk 0 scanning sectors +189759780
21:07:38.384    Disk 0 scanning C:\Windows\system32\drivers
21:08:01.465    Service scanning
21:09:02.781    Modules scanning
21:09:46.807    Disk 0 trace - called modules:
21:09:46.851    ntoskrnl.exe CLASSPNP.SYS disk.sys acpi.sys hal.dll ataport.SYS pciide.sys 
21:09:46.858    1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0x84d748f0]
21:09:46.864    3 CLASSPNP.SYS[87dac8b3] -> nt!IofCallDriver -> [0x84d74388]
21:09:46.871    5 acpi.sys[876466bc] -> nt!IofCallDriver -> \Device\Ide\IdeDeviceP0T0L0-0[0x84d55b98]
21:09:48.821    AVAST engine scan C:\Windows
21:09:57.757    AVAST engine scan C:\Windows\system32
21:17:22.938    AVAST engine scan C:\Windows\system32\drivers
21:17:59.960    AVAST engine scan C:\Users\Fässi Nutzer
21:18:31.061    AVAST engine scan C:\ProgramData
21:35:55.914    Scan finished successfully
21:39:44.230    Disk 0 MBR has been saved successfully to "C:\Users\Fässi Nutzer\Desktop\MBR.dat"
21:39:44.237    The log file has been saved successfully to "C:\Users\Fässi Nutzer\Desktop\aswMBR2.txt"

cosinus · 08.04.2012, 20:55

Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs.
Denk dran beide Tools zu updaten vor dem Scan!!

muffin0815 · 09.04.2012, 07:44

So anbei Die Logs ,

Wusste gar nicht wieviele Cookies da im Hindergrund gespeichert sind von denen man die Quelle gar nicht kennt !

Die Trojaner agent dateien Ame und Lidl sind mir bekannt!
AME ist eine Verwaltungssoftware und Lidl eben von Lidl !

cosinus · 09.04.2012, 16:41

Zitat:

Die Trojaner agent dateien Ame und Lidl sind mir bekannt!
AME ist eine Verwaltungssoftware und Lidl eben von Lidl !

Das sind Fehlalarme

Sieht ok aus, da wurden nur Cookies gefunden.
Cookies sind keine Schädlinge direkt, aber es besteht die Gefahr der missbräuchlichen Verwendung (eindeutige Wiedererkennung zB für gezielte Werbung o.ä. => HTTP-Cookie )

Wegen Cookies und anderer Dinge im Web: Um die Pest von vornherein zu blocken (also TrackingCookies, Werbebanner etc.) müsstest du dir mal sowas wie MVPS Hosts File anschauen => Blocking Unwanted Parasites with a Hosts File - sinnvollerweise solltest du alle 4 Wochen mal bei MVPS nachsehen, ob er eine neue Hosts Datei herausgebracht hat.

Ansonsten gibt es noch gute Cookiemanager, Erweiterungen für den Firefox zB wäre da CookieCuller http://filepony.de/download-cookie_culler/
Wenn du aber damit leben kannst, dich bei jeder Browsersession überall neu einzuloggen (zB Facebook, Ebay, GMX, oder auch Trojaner-Board) dann stell den Browser einfach so ein, dass einfach alles beim Beenden des Browser inkl. Cookies gelöscht wird.

Ich halte es so, dass ich zum "wilden Surfen" den Opera-Browser oder Chromium unter meinem Linux verwende. Mein Hauptbrowser (Firefox) speichert nur die Cookies von den Sites die ich auch will, alles andere lehne ich manuell ab (der FF fragt mich immer) - die anderen Browser nehmen alles an Cookies zwar an, aber spätestens beim nächsten Start von Opera oder Chromium sind keine Cookies mehr da.

Ist dein System nun wieder in Ordnung oder gibt's noch andere Funde oder Probleme?

muffin0815 · 09.04.2012, 17:01

Ok Gut werd ich mir mal anschauen wegen den cookies !

Die 2 Dateien sind jetzt im Quarantene Ordner , muss ich die wieder frei geben ?

Wie sieht es jetzt mit meinem System aus ist wieder alles sauber oder ?
war das schlimme Malware die ich hatte ?

Gibt es noch etwas das ich beachten muss damit ich das zeug nicht wieder bekomme ? Hab mal den Thread " Anleitung zur Absicherung des Rechners"
gelesen reicht das aus wenn man sich daran haltet ?ODer was empfiehlst du ?

Ansonsten Denke ich ist alles Ok!Hoffe ich mal !

08.04.2012, 20:55	#27
cosinus /// Winkelfunktion /// TB-Süch-Tiger™	Antivir Fund gefährlich ? Lohnt eine Suche oder eher das System neu aufspielen ? Sieht ok aus. Mach bitte zur Kontrolle Vollscans mit Malwarebytes und SUPERAntiSpyware und poste die Logs. Denk dran beide Tools zu updaten vor dem Scan!! __________________ Logfiles bitte immer in CODE-Tags posten

Antivir Fund gefährlich ? Lohnt eine Suche oder eher das System neu aufspielen ?

Log-Analyse und Auswertung: Antivir Fund gefährlich ? Lohnt eine Suche oder eher das System neu aufspielen ?