| |
| |||||||
Plagegeister aller Art und deren Bekämpfung: svhost Trojan.Sirefef.BRWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
 |
29.05.2012, 07:45
| #46 |
| /// Malwareteam    |  svhost Trojan.Sirefef.BR Schritt 1: FSS Downloade dir bitte Farbar's Service Scanner
__________________ Kein Asylrecht für Trojaner!  Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
29.05.2012, 19:39
| #47 |
  | svhost Trojan.Sirefef.BR im Reparaturmodus läuft das aber nicht. und ins Windows komme ich doch nicht.
__________________hier was zu dem Fehler, es kann ein Virus dort drin sein in der FLTMGR.SYS EDIT: habs hingekriegt. ausem Internet ne FLTMGR gedownloadet und ersetzt von dll-files-download.de FSS Log Geändert von PAUI (29.05.2012 um 20:31 Uhr) |
|
30.05.2012, 07:57
| #48 |
| /// Malwareteam | svhost Trojan.Sirefef.BR Mein Fehler, die FSS-Anweisung war nicht für dich!
__________________ Du hast nun die Datei aus dem Inet geladen, eingefügt und der Rechner startet wieder? Das werd ich mir für die Zukunft merken - die Änderungen, die dieser spezielle Schädling am System vornimmt, sind vielfältig und wir kennen noch längst nicht alle! Dann erstelle bitte ein neues OTL custom-log! OTL (custom) Falls noch nicht vorhanden, lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop
Code:
ATTFilter activex
netsvcs
msconfig
%SYSTEMDRIVE%\*.
%PROGRAMFILES%\*.exe
%LOCALAPPDATA%\*.exe
%systemroot%\*. /mp /s
/md5start
explorer.exe
regedit.exe
winlogon.exe
wininit.exe
userinit.exe
fltmgr.sys
/md5stop
HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\Session Manager\SubSystems|Windows /rs
HKEY_LOCAL_MACHINE\SOFTWARE\Policies\Microsoft\Windows\WindowsUpdate\AU
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\WindowsUpdate\Auto Update\Results\Install|LastSuccessTime /rs
CREATERESTOREPOINT
__________________ |
|
30.05.2012, 16:34
| #49 |
| | svhost Trojan.Sirefef.BR Also ich habe Im "Reparatur Modus" gestartet und in der Eingabeaufforderung "notepad" eingegeben. dann auf "öffnen", aufem Stick gewechselt und die Datei kopiert. dann ins Zielverzeichnis "C:/Windows/System32/Drivers" gewechselt und die Datei dort eingefügt. aber so wie es aussah war die noch nichtmal vorhanden denn es kam keine Überschreibungsmeldung. OTL LOGS |
|
31.05.2012, 07:53
| #50 |
| /// Malwareteam | svhost Trojan.Sirefef.BR Schritt 1: aswMBR Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
Schritt 2: Scan mit TDSS-Killer Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
31.05.2012, 17:52
| #51 |
| | svhost Trojan.Sirefef.BR aswMBR + TDSSKiller Logs |
|
01.06.2012, 09:47
| #52 | |
| /// Malwareteam | svhost Trojan.Sirefef.BR Combofix LÖSCHE die vorhandene Combofix.exe! Combofix darf ausschließlich ausgeführt werden, wenn dies von einem Team Mitglied angewiesen wurde!Downloade dir bitte Combofix von einem dieser Downloadspiegel Link 1 Link 2 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Bitte kopiere die Logfile direkt hier rein, nicht anhängen. Danke Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! Geändert von Larusso (02.06.2012 um 02:51 Uhr) |
|
02.06.2012, 16:07
| #53 |
| | svhost Trojan.Sirefef.BR Combofix Logfile: Code:
ATTFilter ComboFix 12-06-02.02 - Luisa 02.06.2012 16:32:09.3.2 - x64
Microsoft Windows 7 Ultimate 6.1.7600.0.1252.49.1031.18.2038.1263 [GMT 2:00]
ausgeführt von:: c:\users\Luisa\Desktop\ComboFix.exe
AV: BitDefender Antivirus *Disabled/Outdated* {982ADE23-275B-0766-37C5-DE01A484098E}
FW: BitDefender Firewall *Disabled* {A0115F06-6D34-063E-1C9A-77345A574EF5}
SP: BitDefender Antispyware *Disabled/Outdated* {234B3FC7-0161-08E8-0D75-E573DF034333}
* Neuer Wiederherstellungspunkt wurde erstellt
.
.
((((((((((((((((((((((( Dateien erstellt von 2012-05-02 bis 2012-06-02 ))))))))))))))))))))))))))))))
.
.
2012-06-02 14:41 . 2012-06-02 14:41 -------- d-----w- c:\users\Default\AppData\Local\temp
2012-05-24 00:51 . 2012-05-29 20:52 -------- d-----w- C:\FRST
2012-05-19 23:04 . 2012-05-19 23:04 -------- d-----w- c:\programdata\Malwarebytes
2012-05-19 23:04 . 2012-05-20 00:14 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware
2012-05-19 20:38 . 2012-05-19 20:38 -------- d-----w- c:\programdata\dc0d0000-285f-421f-58ff-3e3acd773491
2012-05-19 20:31 . 2012-05-19 20:31 -------- d-----w- c:\users\Luisa\AppData\Roaming\QuickScan
2012-05-19 20:30 . 2012-05-19 20:43 -------- d-----w- c:\programdata\BitDefender
2012-05-19 20:27 . 2012-05-19 20:44 155455 ----a-w- c:\programdata\bdinstall.bin
.
.
.
(((((((((((((((((((((((((((((((((((( Find3M Bericht ))))))))))))))))))))))))))))))))))))))))))))))))))))))
.
2012-05-22 22:08 . 2012-03-10 12:15 0 --sha-w- c:\windows\system32\dds_log_ad13.cmd
2012-03-08 02:14 . 2012-03-08 02:14 74752 ----a-w- c:\windows\SysWow64\RegisterIEPKEYs.exe
2012-03-08 02:14 . 2012-03-08 02:14 161792 ----a-w- c:\windows\SysWow64\msls31.dll
2012-03-08 02:14 . 2012-03-08 02:14 86528 ----a-w- c:\windows\SysWow64\iesysprep.dll
2012-03-08 02:14 . 2012-03-08 02:14 76800 ----a-w- c:\windows\SysWow64\SetIEInstalledDate.exe
2012-03-08 02:14 . 2012-03-08 02:14 74752 ----a-w- c:\windows\SysWow64\iesetup.dll
2012-03-08 02:14 . 2012-03-08 02:14 63488 ----a-w- c:\windows\SysWow64\tdc.ocx
2012-03-08 02:14 . 2012-03-08 02:14 48640 ----a-w- c:\windows\SysWow64\mshtmler.dll
2012-03-08 02:14 . 2012-03-08 02:14 367104 ----a-w- c:\windows\SysWow64\html.iec
2012-03-08 02:14 . 2012-03-08 02:14 110592 ----a-w- c:\windows\SysWow64\IEAdvpack.dll
2012-03-08 02:14 . 2012-03-08 02:14 89088 ----a-w- c:\windows\system32\RegisterIEPKEYs.exe
2012-03-08 02:14 . 2012-03-08 02:14 49664 ----a-w- c:\windows\system32\imgutil.dll
2012-03-08 02:14 . 2012-03-08 02:14 420864 ----a-w- c:\windows\SysWow64\vbscript.dll
2012-03-08 02:14 . 2012-03-08 02:14 35840 ----a-w- c:\windows\SysWow64\imgutil.dll
2012-03-08 02:14 . 2012-03-08 02:14 23552 ----a-w- c:\windows\SysWow64\licmgr10.dll
2012-03-08 02:14 . 2012-03-08 02:14 222208 ----a-w- c:\windows\system32\msls31.dll
2012-03-08 02:14 . 2012-03-08 02:14 173056 ----a-w- c:\windows\system32\ieUnatt.exe
2012-03-08 02:14 . 2012-03-08 02:14 152064 ----a-w- c:\windows\SysWow64\wextract.exe
2012-03-08 02:14 . 2012-03-08 02:14 150528 ----a-w- c:\windows\SysWow64\iexpress.exe
2012-03-08 02:14 . 2012-03-08 02:14 142848 ----a-w- c:\windows\SysWow64\ieUnatt.exe
2012-03-08 02:14 . 2012-03-08 02:14 12288 ----a-w- c:\windows\system32\mshta.exe
2012-03-08 02:14 . 2012-03-08 02:14 11776 ----a-w- c:\windows\SysWow64\mshta.exe
2012-03-08 02:14 . 2012-03-08 02:14 114176 ----a-w- c:\windows\system32\admparse.dll
2012-03-08 02:14 . 2012-03-08 02:14 101888 ----a-w- c:\windows\SysWow64\admparse.dll
2012-03-08 02:14 . 2012-03-08 02:14 91648 ----a-w- c:\windows\system32\SetIEInstalledDate.exe
2012-03-08 02:14 . 2012-03-08 02:14 85504 ----a-w- c:\windows\system32\iesetup.dll
2012-03-08 02:14 . 2012-03-08 02:14 76800 ----a-w- c:\windows\system32\tdc.ocx
2012-03-08 02:14 . 2012-03-08 02:14 603648 ----a-w- c:\windows\system32\vbscript.dll
2012-03-08 02:14 . 2012-03-08 02:14 48640 ----a-w- c:\windows\system32\mshtmler.dll
2012-03-08 02:14 . 2012-03-08 02:14 448512 ----a-w- c:\windows\system32\html.iec
2012-03-08 02:14 . 2012-03-08 02:14 30720 ----a-w- c:\windows\system32\licmgr10.dll
2012-03-08 02:14 . 2012-03-08 02:14 165888 ----a-w- c:\windows\system32\iexpress.exe
2012-03-08 02:14 . 2012-03-08 02:14 160256 ----a-w- c:\windows\system32\wextract.exe
2012-03-08 02:14 . 2012-03-08 02:14 135168 ----a-w- c:\windows\system32\IEAdvpack.dll
2012-03-08 02:14 . 2012-03-08 02:14 111616 ----a-w- c:\windows\system32\iesysprep.dll
2012-03-07 19:30 . 2012-03-07 19:30 118272 ----a-w- c:\windows\system32\drivers\cm_seramd.sys
2012-03-07 19:30 . 2012-03-07 19:30 63648 ----a-w- c:\windows\system32\drivers\smsbda.sys
2012-03-07 19:30 . 2012-03-07 19:30 133120 ----a-w- c:\windows\system32\drivers\cm_netamd.sys
2012-03-07 19:30 . 2012-03-07 19:30 112640 ----a-w- c:\windows\system32\drivers\cm_net32.sys
2012-03-07 19:30 . 2012-03-07 19:30 103680 ----a-w- c:\windows\system32\drivers\cm_ser32.sys
2012-03-07 19:30 . 2012-03-07 19:30 117888 ----a-w- c:\windows\system32\drivers\cmnsusbser.sys
.
.
((((((((((((((((((((((((((((( SnapShot@2012-05-24_21.54.47 )))))))))))))))))))))))))))))))))))))))))
.
+ 2012-05-24 21:46 . 2012-05-25 22:18 83016 c:\windows\system32\wdi\SuspendPerformanceDiagnostics_SystemData_S3.bin
+ 2009-10-14 05:16 . 2012-06-02 14:44 28012 c:\windows\system32\wdi\ShutdownPerformanceDiagnostics_SystemData.bin
+ 2009-07-14 05:10 . 2012-06-02 14:44 39136 c:\windows\system32\wdi\BootPerformanceDiagnostics_SystemData.bin
+ 2010-11-01 17:11 . 2012-06-02 14:44 10460 c:\windows\system32\wdi\{86432a0b-3c7d-4ddf-a89c-172faa90485d}\S-1-5-21-2020745923-3351992433-2440261903-1000_UserData.bin
- 2011-03-18 21:29 . 2012-05-19 23:07 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
+ 2011-03-18 21:29 . 2012-05-27 13:54 67584 c:\windows\system32\LogFiles\Srt\bootstat.dat
+ 2011-01-13 02:18 . 2012-05-24 22:38 6242 c:\windows\system32\wdi\ERCQueuedResolutions.dat
- 2012-05-24 21:54 . 2012-05-24 21:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
+ 2012-06-02 14:42 . 2012-06-02 14:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive1.dat
- 2012-05-24 21:54 . 2012-05-24 21:54 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
+ 2012-06-02 14:42 . 2012-06-02 14:42 2048 c:\windows\ServiceProfiles\LocalService\AppData\Local\lastalive0.dat
- 2009-07-14 02:36 . 2012-05-24 11:53 616008 c:\windows\system32\perfh009.dat
+ 2009-07-14 02:36 . 2012-06-02 14:34 616008 c:\windows\system32\perfh009.dat
+ 2009-07-14 17:58 . 2012-06-02 14:34 654166 c:\windows\system32\perfh007.dat
- 2009-07-14 17:58 . 2012-05-24 11:53 654166 c:\windows\system32\perfh007.dat
+ 2009-07-14 02:36 . 2012-06-02 14:34 106388 c:\windows\system32\perfc009.dat
- 2009-07-14 02:36 . 2012-05-24 11:53 106388 c:\windows\system32\perfc009.dat
- 2009-07-14 17:58 . 2012-05-24 11:53 130006 c:\windows\system32\perfc007.dat
+ 2009-07-14 17:58 . 2012-06-02 14:34 130006 c:\windows\system32\perfc007.dat
- 2009-07-14 05:38 . 2012-05-20 00:14 262144 c:\windows\system32\config\systemprofile\ntuser.dat
+ 2009-07-14 05:38 . 2012-05-29 20:52 262144 c:\windows\system32\config\systemprofile\ntuser.dat
- 2009-07-14 05:01 . 2012-05-24 21:53 274392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2009-07-14 05:01 . 2012-06-02 14:41 274392 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-System.dat
+ 2011-05-11 01:18 . 2012-05-25 11:43 1115636 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2020745923-3351992433-2440261903-1000-12288.dat
- 2011-05-11 01:18 . 2012-05-24 21:53 1115636 c:\windows\ServiceProfiles\LocalService\AppData\Local\FontCache-S-1-5-21-2020745923-3351992433-2440261903-1000-12288.dat
- 2009-07-14 02:34 . 2012-04-05 06:13 10485760 c:\windows\system32\SMI\Store\Machine\schema.dat
+ 2009-07-14 02:34 . 2012-05-29 21:00 10485760 c:\windows\system32\SMI\Store\Machine\schema.dat
.
(((((((((((((((((((((((((((( Autostartpunkte der Registrierung ))))))))))))))))))))))))))))))))))))))))
.
.
*Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt.
REGEDIT4
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system]
"ConsentPromptBehaviorAdmin"= 0 (0x0)
"ConsentPromptBehaviorUser"= 3 (0x3)
"EnableUIADesktopToggle"= 0 (0x0)
"PromptOnSecureDesktop"= 0 (0x0)
.
[HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\explorer]
"HideSCAHealth"= 1 (0x1)
.
R2 clr_optimization_v4.0.30319_32;Microsoft .NET Framework NGEN v4.0.30319_X86;c:\windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe [2010-03-18 130384]
R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576]
R2 pcouffin;Uiusys;c:\windows\system32\svchost.exe [2009-07-14 27136]
R2 UI Assistant Service;UI Assistant Service;c:\program files (x86)\T-Mobile Internet Manager 03\AssistantServices.exe [2009-03-30 241664]
R3 Arrakis3;BitDefender Arrakis Server;c:\program files\Common Files\BitDefender\BitDefender Arrakis Server\bin\arrakis3.exe [2009-10-19 278224]
R3 BDFM;BDFM;c:\windows\system32\DRIVERS\bdfm.sys [x]
R3 cmnsusbser;Mobile Connector USB Device for Legacy Serial Communication LCT2053s;c:\windows\system32\DRIVERS\cmnsusbser.sys [x]
R3 massfilter;ZTE Mass Storage Filter Driver;c:\windows\system32\DRIVERS\massfilter.sys [x]
R3 SrvHsfHDA;SrvHsfHDA;c:\windows\system32\DRIVERS\VSTAZL6.SYS [x]
R3 SrvHsfV92;SrvHsfV92;c:\windows\system32\DRIVERS\VSTDPV6.SYS [x]
R3 SrvHsfWinac;SrvHsfWinac;c:\windows\system32\DRIVERS\VSTCNXT6.SYS [x]
R3 WatAdminSvc;Windows-Aktivierungstechnologieservice;c:\windows\system32\Wat\WatAdminSvc.exe [x]
R3 zghsmdm;ZTE General Handset USB Modem Proprietary;c:\windows\system32\DRIVERS\zghsmdm.sys [x]
R3 ZTEusbnet;ZTE USB-NDIS miniport;c:\windows\system32\DRIVERS\ZTEusbnet.sys [x]
R3 ZTEusbvoice;ZTE VoUSB Port;c:\windows\system32\DRIVERS\ZTEusbvoice.sys [x]
S1 BdfNdisf;BitDefender Firewall NDIS 6 Filter Driver;c:\windows\system32\DRIVERS\BdfNdisf6.sys [x]
S1 bdfwfpf;bdfwfpf;c:\program files\Common Files\BitDefender\BitDefender Firewall\bdfwfpf.sys [2010-11-01 89680]
S1 vwififlt;Virtual WiFi Filter Driver;c:\windows\system32\DRIVERS\vwififlt.sys [x]
S2 BDVEDISK;BDVEDISK;c:\program files\BitDefender\BitDefender 2010\bdvedisk.sys [2010-01-19 103944]
S2 HsfXAudioService;HsfXAudioService;c:\windows\system32\svchost.exe [2009-07-14 27136]
S2 VMCService;Vodafone Mobile Connect Service;c:\program files (x86)\Vodafone\Vodafone Mobile Connect\Bin\VMCService.exe [2009-04-20 9216]
S2 WTGService;WTGService;c:\program files (x86)\XSManager\WTGService.exe [2010-04-12 329168]
S2 XS Stick Service;XS Stick Service;c:\windows\service4g.exe [2010-04-30 145064]
S3 CAXHWAZL;CAXHWAZL;c:\windows\system32\DRIVERS\CAXHWAZL.sys [x]
S3 RTL8023x64;Realtek 10/100-Netzwerkkartenfamilie-NDIS-x64-Treiber;c:\windows\system32\DRIVERS\Rtnic64.sys [x]
.
.
Inhalt des "geplante Tasks" Ordners
.
2012-05-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2020745923-3351992433-2440261903-1000Core.job
- c:\users\Luisa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-10 16:07]
.
2012-05-30 c:\windows\Tasks\FacebookUpdateTaskUserS-1-5-21-2020745923-3351992433-2440261903-1000UA.job
- c:\users\Luisa\AppData\Local\Facebook\Update\FacebookUpdate.exe [2012-03-10 16:07]
.
.
--------- x86-64 -----------
.
.
[HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run]
"BDAgent"="c:\program files\BitDefender\BitDefender 2010\bdagent.exe" [2011-05-15 1699152]
"IgfxTray"="c:\windows\system32\igfxtray.exe" [2009-09-23 165912]
"HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2009-09-23 385560]
"Persistence"="c:\windows\system32\igfxpers.exe" [2009-09-23 363544]
"Apoint"="c:\program files\Apoint2K\Apoint.exe" [2007-10-25 241664]
.
NETSVCS BENÖTIGT REPARATUR - Derzeitig vorhandene Einträge:
AeLookupSvc
CertPropSvc
SCPolicySvc
lanmanserver
gpsvc
IKEEXT
AudioSrv
FastUserSwitchingCompatibility
Ias
Irmon
Nla
Ntmssvc
NWCWorkstation
Nwsapagent
Rasauto
Rasman
Remoteaccess
SENS
Sharedaccess
SRService
Tapisrv
Wmi
WmdmPmSp
ATWPKT2
atfsd
ctaud2k
umpusbxp
pcouffin
pktfilter
axsnmsvc
p1110vid
rslinx
oracleoradb10g_home1isql*plus
nmwcdcm
LVRS
NTSIM
proxyhostservice
NICSer_WPC54G
wintabservice
wampmysqld
sonicwall_netextender
cltnetcnservice
service1
tnbrlds
adobeactivefilemonitor4.0
omsad
transcode360
icraplus
DfwWebAgent
CTMFLT
Ncrc710
lbrtfdc
atitunep
nvlddmkm
rt2500
atikmdag
vxsvc
symantecantibotfilter
TCtrlIO
sscdmdfl
driverhardwarev2
hidgame
cvslock
ofcservice
tunnelguardservice
adihdaudaddservice
procexp90
VirtualCam
Wpsnuio
fsaua
mfcom
mf
rtl8187Se
automate5
EpmShd
PolarUSB
admjoy
SenFiltService
wscsvc
zebrmdfl
Ld51ocnucsnp
k56
icdsptsv
btwaudio
v2imount
freesshdservice
bt3cusb
elnkfwppservice
ZSMC211
Rawwan
elosystemservice
lxdm_device
se44nd5
LUsbFilt
ipsraidn
Si3132
sfhlp02
pdlnslea
tng-dtmg
acedrv07
rppkt
iviregmgr
ccevtmgr
ASFWHide
ql10wnt
se27nd5
dktknsrv
evteng
AF15BDA
stac97
sdbus
websenseusagemonitor
license
MA8032U
vncdrv
Airgo
U81xmdm
scarddrv
pctavsvc
flashcomadmin
tosrfhid
slservice
service
nmservice
lanusb
nic1394
roxliveshare9
z800mdm
epsonbidirectionalagent
rt73
proxyhostmirrordisplay
iAimFP6
avgcoresvc
sandboxu
cicsclient
profos
cwcwdm
pcctlcom
mskservice
lcs
avgascln
db2licd
smapint
SNC
mssql$microsoftsmlbiz
tsdhd
asc
elservice
ipodsrv
racsvc
oracleorahome92tnslistener
siskp
Cam5603C
iaimfp3
pserve
portio
dladresn
NETGEAR_MA111
cwcspud
PQNTDrv
adpu160m
zebrceb
ql1280
dlcf_device
tomcatcws3
AVRec
a8djusb
gusvc
S7oppilx
vetmonnt
aswrdr
clientservice
avgclean
nscirda
USBCCID
SrvcEKIOMngr
FINEPIX_PCC
speedfan
ixiaendpoint
HFACSVC
anbmservice
ilicensesvc
se2Bunic
mcafeeframework
SRS_SSCFilter
regsrvc
mi-raysat_3dsMax2008_32
https-admserv61
mferkdk
SprintRcAppSvc
sfman
webupdate
toside
CX23880
smbios
dmisrv
statusagent
dpc_srv_webcast
dm1service
sifilter
WLAN_USB
bthpan
kpfwsvc
wacomkey
VHidMinidrv
mctskshd.exe
AsuhfivrO
purendis
pdlnemap
epson_pm_rpcv4_01
tos_sps32
mbr
lgsnd_filter
itchfltr
incdrm
atalk
szkg
iolo_srv
MREMP50a64
WmFilter
CdaC15BA
changer
tfsndres
Mtlstrm
FVNETusb
s616bus
retrolauncher
nwcworkstation
midisyn
FireTDI
oraclexeclragent
enxpsvc
mcmispupdmgr
atimpab
AR5523
l8042pr2
cpucoolserver
networkx
CXTUNE
richvideo
svchost
apphostsvc
rnadirectory
PGPsdkDriver
cebdaldr
citrixwmiservice
dnserver32
sony_ssm.sys
db2jds
qmofiltr
Mvc25U870_VID_1262&PID_25FD
idrivert
aalogger
nsm1mdfl
avgio
hamachi
ISAMSvc
nimcdlbk
psimsvc
lvusbsta
A88xXBar
lxcr_device
pelmouse
scramby
nvax
vmkbd2
lxbs_device
RMSvc
SNPSTD3
Si3132r5
ss_mdfl
pdlnatcm
ceepwrsvc
eectrl
taphss
SlWdmSup
trlokom_rmhsvc
hpn
iaimtv2
vsbus
StarOpen
SbieDrv
SunkFilt39
iaimfp1
BCMTPM
UDFReadr
dwusbdnt
asmagent
RESMGR
whoisd32
msloop
n3900
dvd43llh
tosrfcom
videX32
se59mgmt
pca
savscan
navapel
USBAAPL
susbser
hsvcmod
ersvc
sysaudio
epfwtdi
BUFADPT
awservice
vhidmini
grmnusb
lhidusb
maxbackserviceint
USIUDF
symlcbrd
lvpr2mon
cercsr6
rmedia
hibernation
lxcccustomerconnect
HSXHWBS2
vpcbus
PcdrNt
hcwPVRP2
Subsonic
stllssvr
symevent
DniVad
rxfilter
psdistributionagent
amon
MXOFX
zpsc
SrvcSSIOMngr
igniteservice.exe
sr
hclinetd
se44mdm
vnxservice
msdv
st330service
sonytvc
epson_pm_rpcv2_01
vwkernel
W700mdm
pcampr5
USB28xxOEM
PdiPorts
gameenum
win32sl
sfcure01
PCASp50
mpe
sysmonlog
avp
msmframework
purgeieservice
A88xEnc
thkeys
cxpt_service
ups
wg3n
aswlsvc
Stltrk2k
pdlndtdl
db2remotecmd
adiusbaw
cidaemon
MA_CMIDI
wltwo51b
wmp54gssvc
cportclm
psdvdisk
SQLBrowser
SE26bus
FTDIBUS
zumbus
e1express
z800mdfl
lpds
parvdm
rollbackclientservice
snpstd2
qbcfmonitorservice
wuolservice
T6963C
dbustrcm
sbpci
NWSIPX32
dlapoolm
smartlinkservice
deltafw
captureservice
WINUSB
oracleorahome90agent
ISODrive
apache2
ASMMAP
dcstor32
pilogsrv
cpqarray
mqdmbus
CT20XUT.DLL
SrvcEPIOMngr
FiltUSBEMPIA
btwrchid
govsrv
USBModem
STV672
oracleorahome811cmadmin
w810mdfl
anio
vstor2-ws60
slip
tfsnifs
MSFWHLPR
DLH5X
PSSdk23
vmsprog
pivotmou
simbad
nim32
StickyMesger
RMCAST
DeviceScanner
RadProbe
spcsutilityservice
ARCSOFTVIRTUALCAPTURE
wg6n
slabbus
ALABULK
NeroMediaHomeService.4
NWSAP
se27unic
vvdsvc
razerusb
ntuneservice
msfwsvc
timounter
SE26mdfl
s117obex
pdlnctdl
srtspx
ppmoucls
pcnet
tiumfwl
persfw
npkcmsvc
ino_flpy
aeclienthostservice
elnkupdateservice
WinFl32
SE27obex
perc2
w800mgmt
crauto
cachemgr
siside
VAIOMediaPlatform-MusicServer-HTTP
RAPIProtocol
actser
procexp100
vulfntrs
websenseclientdeployservice
s217mgmt
TVALG
ADSMService
pdreli
commserver
pmj151la
lxcj_device
pxfhserd
Dfs
pdlnatdl
sandradatasrv
clnt_clientman
s217nd5
plscsi
fix
elbycdfl
ZDCNDIS5
antivirscheduler
SE2Emdfl
digitizer
iwebmsg
usbser
ql2100
risdptsk
MSW_USB
snareiis
wg111nd5
AR5416
CX88AUD
bb-run
ovmsmaccessmanager
SymIM
konfig
AX88772
pdlnacom
ql1080
irmon
sbservice
ufad-ws60
vzupsvc
wmdmpmsp
kservice
mcstrm
fgdxbus
rupsd
lxrsii1s
srvdpi
qbposdbservices
mksvirmonsvc
hpconfig
mssql$sony_mediamgr
ATMsrvc
UlSata
thotkey
cpqalert
rkhdrv31
DCamUSBGrandTek
Tb2RCAssist
ps2
symappcore
X4HSX32
RDID1027
isapisearch
tmcomm
qcdonner
caili
TryAndDecideService
moufiltr
dmboot
Alpham2
mnsframework
MtxDma0
s7oppitx
lwwlicenseservice
euq_monitor
windrvNT
vaiomediaplatform-integratedserver-upnp
DMUSBUSBDCam
nhcDriverDevice
acrotray
usbcm
nwdls
mcontrol
googledesktopmanager
pdlnepkt
fireport
tapvpn
tvichw32
wm
ofcpfwsvc
SecureStorageService
hsfhwbs2
ntsvcmgr
vet-rec
regdefend
s217mdfl
snoopfree
uphclean
QPSched
oracleformsserver-forms60server-oraform
lemsgt
arrayssl_vpn_service3,0,1,9
vmnetadapter
tcsd_win32.exe
btwhid
aamqdispatcher
ntsyslog
IntelC51
avfilter
EL90X
shdserv
ICAM5USB
wap3gx
ssrtln
vproeventmonitor
dxdebug
slapd-config52
ProcObsrv
SaiClass
mfehidk
JiaoCap
RivaTuner32
sis315
mnmdd
NWFILTER
mcshield
btwdins
WD_FireWire_HID
wwnetdde
nimcdldu
ativraxx
se58unic
tosrfbnp
SaiNtHid
mod7700
irda
WMIService
usbaudio
usbmate
lxcz_device
eabusb
thinkpadmodemservice
usbatapi2000
btnhnd
vci
winpppoverethernet
sprtsvc_dellsupportcenter
se2Cunic
NetTcpActivator
dlcj_device
client32
DcLps
ptserial
VIAPFD
fsma
se59nd5
nimxdfk
hpqcxs08
acedrv05
ASNDIS5
dladresm
cdr4_xp
ELmou
cwafadmincontroller
c34nb4c5
AlKernel
tapeware
vsapint
meiudf
elaunidr
tmmbd
FontCache3.0.0.0.
rimsptsk
lxrsge10s
ssfs0509
lxcc_device
WINIO
qbreminderflash
DSXUSB
LVVI500A
cfsvcs
zpnodecollector
GoogleDesktopManager-010708-104812
belmonitorservice
HabuFltr
LMS
winproxy
lexbces
CTERFXFX.DLL
TBPanel
mpservice
DynDNS_Updater_Service
el90xbc
EPSON_EB_RPCV4_01
mclserviceatl
CE3
NTACCESS
om518p
OneCareMP
wanminiportservice
giveio
SE27mdfl
qkbfiltr
pop3d32
Wuser32
wps
getPlusHelper
cdr4_2k
ntmssvc
pml
pdengine
DMICall
ini910u
kraidsvc
ATIBTXBAR
phnxvcdservice
rdsessmgr
ICAM3NT5
SerTVOutCtlr
wfxsvc
iftpsvc
TestHandler
quickbooksdb
ati2mpaa
PTDCBus
LRMINIPORT
enxpsvr
digisptiservice
s716nd5
LoopBeMidi1
MASPINT
pmshellsrv
U3sHlpDr
se59bus
zntport
pfc
bcserver
LVPrcMon
Sntnlusb
snpstd
pgsql-8.0
a016mdfl
NuidFltr
tphdexlgsvc
UCTblHid
bobo
sglfb
iksyssec
kbstuff
lfsfilt
afs2k
pdcomp
inort
dot4usb
Udfreadr_xp
mwsejcap
W55U01
BVRPMPR5
pvservice
OEM02Vfx
sit_flt
se2Eunic
ftrtsvc
rvsinst
backupexecnamingservice
mqdmmdm
stcagent
elnkservice
SWUMX51
RIOUNIV
sonywbms
ELmon
bgmainsvc
tmesrv3
catchme
mssqlserverolapservice
AtiPcie
tlntsvr
Ndisipo
M2500
issuser
ROB_V
GBDevice
hsfhwazl
vsmon
adobeactivefilemonitor5.0
SE2Bmdfl
fetnd5bv
sfdrv01
mqdmmdfl
JL2005C
datasvr2
avipbb
dnwhodisp
meraksmtp
relational
licenseservice
se2Cnd5
sentinel
rfcomm
vncmirror
stylexphelper
ctdvda2k
ithsgt
rpskt
sddmi2
pwisvc
RVIEG01
senfilt
MobilityService
atirage3
AcronisOSSReinstallSvc
tmtdi
oracleorahome811cman
ndasscsi
w810mdm
oracledbconsoleorcl
ma763004
acmservice
W8335XP
inotask
mediaviewer
usnjsvc
nm
mpfirewl
XTrapD12
wpsdrvnt
qbposdbextservices
nchssvad
avg7core
sysmgmthp
Gernuwa
windowblinds
sysdown
s3savagenb
dot4ufd
aswtdi
thpsrv
rsvchost
atiavpci
ftpds
nmap
msvad_simple
s616mdfl
toscosrv
CXAVXBAR
shuttleengine
lxdj_device
ShockMgr
jukebox3
HPSLPSVC
cdrbsvsd
forcewarewebinterface
egathdrv
VAIOMediaPlatform-MusicServer-UPnP
lp6nds35
webrootspysweeperservice
rimvserport
smartwiservice
cdmservice
lvpopflt
Exportit
nuvaud2
sp_rssrv
mksupdateint
imagedrv
cnxtdiag
snoopfreesvc
vcomm
SE2Bmdm
pdlndlpb
mfetdik
ppa3
ELkbd
NTIDrvr
dot4print
WmaCDriverV32
gdrv
tosrfusb
eamon
mks_scan
diskperf
slpmonx
dlaudf_m
pavatscheduler
XilinxPC4Driver
usbsermpt
usb20l
MRV6X32P
CX88ENC
SI3112
EACSys
mstdfrgs
wintrust
alcaudsl
lxbt_device
nipxirmu
ccs
s125mdm
cfosspeeds
ASLDRService
ssm_mdm
idebusdr
backupexecnotificationserver
icollectservice
TPwSav
riomsc
SE27mdm
scsk4
nvcap
awecho
w550mgmt
g400
nfmservice
pgfilter
dlacdbhm
Slntamr
naimagent32
tm_cfw
USA49W2KP
SlNtHal
hap16v2k
cics.region2
PCISys
superproserver
proxyserverservice
hSONYPVh
pdlndqll
Usb20Scan
Alpham1
pdrframe
tfsndrct
rslinxng
wwsecsvc
arhidfltr
smbusp
DCFS2K
wanatw
db2ntsecserver
a016obex
SRTSPL
cmdagent
tsp
fsdfwd
vclone
smservaz
roxupnpserver
HssTrayService
starwindserviceae
aliadwdm
SbcpHid
int15.sys
idechndr
merakpop3
SE2Ebus
us30service
abnetmon
gv3
vetfddnt
ATNT40K
lvckap
ASInsHelp
rampartsvc
webdriveservice
usbsermptxp
sym_u3
ssidrv
dlaudfam
pinnaclemarvinusb
VRFIL
rt61
fsbwsys
lxdmCATSCustConnectService
ZY202_XP
odysseyIM4
mnmsrvc
ar5211
aw_host
pxfhbus
sdhelper
btdriver
Appn
ipssvc
fastuserswitchingcompatibility
nv
websenselogserver
pavdrv
WmHidLo
avg7rsw
F700iob
pxfhmdfl
bcoreusb
StkAMini
sonypvs1
fasttx2k
tphkdrv
ultra
StMp3Rec
lxrjd31s
rt2870
CTDevice_Srv
macformatservice
cqmgserv
se58mdm
smwdm
dntus26
symids
avidsdmservice
bdfdll
se2Dunic
Epfwndis
iaimtv3
SiSRaid
blueletaudio
dptrackerd
nvnetbus
ami0nt
harmony
uscbs108
Intel_MIPMNMP
ufdsvc
iviaspi
transarcafsdaemon
mcmscsvc
VC4CB104
mfebopk
{95808DC4-FA4A-4c74-92FE-5B863F82066B}
ncupdatesvc
CTMMOUNT
zpcache
SE27bus
atinrvxx
oracleorahometnslistener
useraccess7
w800bus
Hotkey
SWNC8U20
oraclemtsrecoveryservice
netmnt
pdlnecfg
backupexecdevicemediaservice
perc2hib
TcUsb
z800bus
raysatxsi5_0server
rpcnet
{a7447300-8075-4b0d-83f1-3d75c8ebc623}
nvnforce
PPPoEWin
mcsysmon
bthidenum
vpn5000service
w810mgmt
HssDrv
SymIMMP
s116unic
MxlW2k
k750obex
se59unic
mssql$pinnaclesys
BlueSoleilCS
dirms_defragmentation
tbhsd
vaiomediaplatform-mobile-gateway
s217unic
USBDeviceService
NAL
issm
spmgr
spbbcsvc
SIODRV
winvnc4
ARSVC
avcgbfl
SE2Eobex
mclogmanagerservice
alertservice
aexnsclienttransport
tavsvc
tgsrvc_smartagent
DM9102
caisafe
WBHWDOCT
USR1806V
zpcollector
rtl8185
PAC7302
flutilssvc
kpf4
ac97intc
ipahelper.exe
webfilter
opcenum
id2scaps
mssqlserver
sandrathesrv
slabser
BCM43XV
nwlnkfwd
ntlmssp
DcPTP
lvcomser
s716mdm
UBHelper
se2Dnd5
vcsw
elotouchscreen
adsexpb
venturi2
xcomm
vvoice
cq_mem
DellAMBrokerService
SE26mdm
trioservice
L8042mou
CTEDSPFX.DLL
mldserv
cpqnicmgmt
MSSQL$MSSMLBIZ
ZuneWlanCfgSvc
mvserver
mcdbus
AlteraByteBlaster
se44mdfl
tdcmdpst
wacomvhid
atdisk
sqlserveragent
MTsensor
bocdrive
incdfs
iAimFP7
se58bus
swmidi
VAIOMediaPlatform-PhotoServer-HTTP
wencrservice
DcFpoint
MTC0001_ESB
houdiniserver
LPCFilter
ser2pl
ctxcpusched
PTproct
X10UIF
ssisvr32
tb2launch
Memctl
w200mdm
eaps2kbd
BRGSp50
wlluc48b
PTDCMdm
splitter
ntgrip
NICM
ntpr_nic_service2
sleepy
prevxagent
wdm_au8820
wlidsvc
IASJet
ATKFUSService
logmein
msmpsvc
a016mdm
anydvd
wzcsvc
upsentry_smart
HSX_DP
toshidpt
zebrsce
DCamUSBSQTECH
PGPwded
ctprxy2k
ctsfm2k
acdservice
iolodmv
sit_mdm
freebsd
regmanserv
ntsecure
pdlnsx25
alerter
orbmediaservice
RR2IOMod
VRADFIL
sonypvu1
ccalib8
BrScnUsb
wusb54gv2svc
CVPND
ec2007service
AGV
areschatserver
jobserver_report
TMKEmu
owstimer
olapserver
JRAID
StreamDispatcher
SE2Cmgmt
hddsvc
p1131vid
se45nd5
nwlnkipx
InterBaseServer
cdralw2k
TPM
wacommousefilter
magictuneengine
tpkmpsvc
PXRDDriver
tdsmapi
SQTECH905C
NtMtlFax
sgectl
usb_rndisx
sonicstagemonitoring
wlsetupsvc
emproxy
vmauthdservice
TOSHIBASoftModem
mcods
WavxDMgr
tones
aha154x
SMTPSVC
dlbt_device
mwsarcpkt
aolservice
LCcfltr
EU3_USB
epsonbidirectionalservice
odysseyIM3
RIOXDRV
AKSIFDH
sansaservice
RTL8169
vzcdbsvc
bt3cser
nimcrpcsu
DELL_A02
sisperf
StkScan
Spsmqvsm
lirsgt
pduip6000dmemcrdmgr
v124
snapman380
ehstart
avg7rsxp
mssql$sqlexpress
db2das00
mcpromgr
zenos1
smcservice
SaiNtSub
SfCtlCom
autostore
edspport
HIDSwvd
WGX
InterBaseGuardian
openvpnservice
sfilter
FETNDISB
palmusbd
symtdi
ghaio
tdimsys
se26unic
kmixer
rpcapd
ikfileflt
iAimTV5
PID_08A0
CamAv
SED133x
iaimfp4
SaiH040B
IFP700
lxcg_device
epfw
SE2Bbus
NxFsMon
viaagp1
mxserver
emAudio
ssdiagn
nsm1serd
vusbbus
SunkFilt
cachemanxp
mcupdmgr.exe
2wirepcp
issimon
dnsexit
TNaviSrv
arp1394
Uim_IM
dlbx_device
nimcdfxk
umxfwhlp
vmount2
Sk9920nt
cygserver
FileDisk
USBVCD
MaVctrl
eSettingsService
penrendezvous
s125obex
xpadminserver
rnadiagreceiver
epsonstatusagent2
regspy
NetMsmqActivator
ziptoa
ngdbserv
atkkeyboardservice
SimpTcp
lvuvc
omci
zebrmdmc
elagopro
tmxpflt
VX1000
dlcc_device
aec
syntp
SWMX00
MagicTune
NPPTNT
veteboot
appdrv
tmlisten
npfmntor
fcprintservice
roxliveshare
firelm01
audstub
avsvcmonitor
screadspool
cdfsvc
imonitor
zmxpzip
filechecker
wdmaud
s716mdfl
TPECioCtl
tmactmon
inport
ccdecode
xfilt
mi-raysat_3dsmax8
utilman
ulcdrhlp
filemon701
server
klblmain
FTSER2K
sprtsvc_ddoctorv2
MSFWDrv
comhost
oracleorahomedatagatherer
dcfssvc
vpcnets2
procmon10
prtg4service
omniinet
lxda_device
advantage
cwafnotesservice
nicconfigsvc
ndiscm
zd1211u(zydas)
streamip
rca
backupexecalertserver
WacomVKHid
imap4d32
sfng32
DNE
ptilink
rp32service
SilverLink
alcan5wn
websensewfreportserver
carboncopy32
SE2Dbus
CrystalSysInfo
se44obex
YahooAUService
pctoolsfirewallplus
trcboot
emitray
tsmservice
W700obex
cmuda3
s116mgmt
dac2w2k
cwafreportscheduler
NxNetMon
netwg311
wmp54gsvc
uhcd
smartscaps
pid_0928
ql1240
CTEDSPIO.DLL
rpaservice
SQLAgent$MICROSOFTSMLBIZ
CiscoVpnInstallService
lxce_device
dsNcAdpt
dlcq_device
wg5n
quickhealfirewall
mcafeeantispyware
tabletservice
ovt519
tfsnudfa
DKbFltr
sqlagent$sony_mediamgr
CTSBLFX.DLL
avhook
sscdserd
xpagentserver
tvicport
symdns
wlluc48
tvtnetwk
rwbackupsrv
tvs
iteatapi
useraccess
se44mgmt
vstor2
imaservice
icepack
swmsflt
cpqdmi
AtiHdmiService
MobilePreInstallerService
XFX_program
JiaoIO
atimtag
VRcore
MXOPSWD
rtport
hwdatacard
traprcvr
winss
utscsi
tosrfec
aclient
bcftdi
oracle_load_balancer_60_client-forms6ip14
tpsrv
cmudau
VSP1284D
nalntservice
papycpu2
ATIBTCAP
radiosvr
DumaNT
WinVd32
sit_prt
gs30s
Si3114r5
pcidump
genregistrar
dvd-ram_service
dmio
uisp
pwd_2K
snapman
w300bus
stirusb
SaiNtBus
IOSLINK
WmUsbHid
hap17v2k
ssm_mdfl
hcf_msft
GMSIPCI
ageresoftmodem
avsinc
trackcam4
vmnetdhcp
zpjobq
ibmpmdrv
F700iat
psasrv
TIEHDUSB
rtl8023
w550mdfl
ooclevercacheagent
ccpwdsvc
WaveFDE
ntcharge
ozoneinstallerservice
iisadmin
symantecantibotdriver
VrAcFil
contentindex
NVENET
cisvc
yukonwxp
rrrspy
IPSECSHM
s125mdfl
UimBus
Wbutton
SE2Dmdm
nvsmu
Ndismeetro
mbmiodrvr
defragfs
vxd
IBMTPCHK
cwbrxd
mgactrl
klif
cavasm
NMSAccessU
GENERICDRV
backupclientsvc
tandpl
pnrouter
jaguar
navex15
swwd
oracleorahomemanagementserver
ipsec
digictrl
bhmonitorservice
ATIVTUTW
ONSIO
dlcg_device
niorbk
openldap-slapd
pdagent
nmwcdcj
mysqlinventime
MA8032M
hsxhwazl
se59mdm
mail2ec
se58nd5
advservice
EAWDMFD
wltrysvc
z800mgmt
sptisrv
GTF32BUS
rt2500usb
unrealircd
pgpsdkservice
PCDCODEC
SQLAgent$LG_LP2
NWUSBPort
GoToAssist
VCIDRV
se44bus
w550mdm
ovsecurityserver
WSIMD
update
Anydlc
papyjoy
abp480n5
servicelayer
stunnel
odclientservice
atierecord
olcamsrv
pelusblf
z525obex
upsmonservice
belgium_id_card_service
pmsveh
GoBack2K
AVCamUSB20
w22n51
snac
arkbcfltr
mysql
RimSerPort
ABVPN2K
b57w2k
liveupdate
SQLAgent$MICROSOFTBCM
amusbprt
sonicatheaterinstallerservice
a8djavs
FET5X86V
sisidex
eeyeevnt
fah@c:+fah+fah-service+fah502-console.exe
USBMN1X1
UpdateCenterService
FVXSCSI
starwindservice
s116obex
regmon701
ichaud
penclass
akshhl
minilog
SiRemFil
smrt
nvstor32
cwafadminmonitor
vaiomediaplatform-integratedserver-appserver
KR3NPXP
Maplom
bdfsdrv
digirefresh
symantecantibotshim
hpqwmiex
adsservice
qconsvc
rupsmon
iSMBIOS
dpti2o
DivisCTP
WmXlCore
proxyhostdriver
bmwebcfg
SE27mgmt
mediamaxxlservice
messenger
bufserv
dklogger
adobeversioncue
bcm4sbxp
WcesComm
avupdsvc
automate6
SiSGbeXP
roxupnprenderer
Cam5603D
EPOWER
BCMModem
cpqfcalm
pdlndoem
vaiomediaplatform-musicserver-appserver
MQAC
ibmcicstransactiongateway
Ktp
mcproxy
GV600_4
idisw2km
acsvc
AmeLanPc
pav_service
k750mgmt
lvsrvlauncher
tdrpman
rootmodem
mohfilt
stylexpservice
truecrypt
EpmPsd
VX3000
NWDHCP
acprfmgrsvc
csctl50
KS0108
centennialiptransferagent
avgtdi
pcradminserver
beatjamupnpmusicserver
dot4
ipinip
epstnt01
sysaidagent
MS1000
emupia
astcc
gemserv
hf30service
isdrv120
CBN
procexp111
eventclientmultiplexer
obvious
w800mdm
foldersize
tvtfilter
Blfp
KR10N
HpqRemHid
w200mgmt
qfcoresvc
dbmang
mdm
irsir
ctxcpuusync
yediex
pdscheduler
backupexecrpcservice
s117unic
protexislicensing
Cardex
remoterecord
backuplauncher
ELacpi
cqcpu
s716bus
wmp54gv4svc
se2Bnd5
lvhidsvc
pinger
nvport
pageserver
wkscfgsrv
AppnApi
pav_security
pmem
autocomplete
ati2mtaa
incdpass
crystalaps
sfrem01
Machnm32
mi-raysat_3dsmax9_32
BASFND
coste
clsched
delldmi
wmccdsls
erecoveryservice
agentsrv
k750mdm
Mtlmnt5
LVCap138
adminserver
savrtpel
WUSB54GPV4SRV
gearsecurity
megamonitorsrv
se58obex
soma
hdthermal
xusb21
BcmSqlStartupSvc
Sunkfiltp
rapapp
wpdusb
ireike
scdemu
noipducservice
netsvc
httpfilter
twdns
sympxsvc
hpzius12
SE2Cobex
w29n51
tunmp
aswupdsv
SMNDIS5
msftesql
sthda
vpnva
btwusb
EACSvrMngr
pdfcreatormessages
fsssvc
SWNC8U51
ss_mdm
MaRdPnp
aracpi
motmodem
mfesmfk
SRTSP
artdhcp
PDExchange
ikhfile
avcgbdr
cvintdrv
EMSCR
CTAudSvcService
s116mdfl
iPassPeriodicUpdateApp
steamdvr
serialkeys
application
dcsloader
pnkbstrk
SiS7018
ni_nic
ma_cmidi_installerservice
WaveEnrollmentService
nsm1bus
mscsptisrv
artourservice
iaimfp0
dmprimer
ZSMC303
sbhooksvc
webrootenterpriseupdateservice
pxfhmdm
bc_ip_f
Nmea
MREMPR5
tnidriver
btnetfilter
UPATC
websensecommunicationagent
personalsecuredriveservice
kl1
se26nd5
z525mgmt
npapimon
U81xmgmt
Wtcls2k
datunidr
pgpserv
drvnddm
ispwdsvc
wdelmgr20
pcx1unic
tng-dts
pavfnsvr
OVT511Plus
TUWinStylerThemeSvc
dac960nt
rbfilter
zunenetworksvc
tosrfbd
PAR1284
Cap7134
AMDPCI
z800obex
amdk7
oracle%oracle_home_service%clientcache80
vwlogger
V0070VID
ipassconnectengine
cpqvcagent
plsremotesvc
c-dillacdac11ba
nmwcd
awlegacy
Pnp680r
ms_mpu401
inspect
LHidFilt
PCDRSRVC
ifp800
GTPTSER
pciSd
es1371
SABSVC
dsncservice
SWUMX20
wcontrol
pdlnsv25
cpqrcmc
se59obex
atchksrv
viaudio
BootScreen
mcvsrte
streamloadservice
LHidKe
ctac32k
BRCMDECO
USRpdA
W8100PCI
orbpvr
ser2plms
SANDRA
symndis
dlaifs_m
rtm
{834170a7-af3b-4d34-a757-e05eb29ee96d}
ctljystk
symproxysvc
PD0620VID
imonnt
CoachUsb
lmimaint
s116mdm
wmi
Eplpdx02
aswmon2
a016bus
NwSapAgent
agnfilt
regservice
IBM_LLC2
nfsds
winpowermanager
cobbmservice
websenseuserservice
si3114r
vpcusb
fssfltr
SE2Cbus
bdss
PGPdisk
ghoststartservice
atixsaudio
armoucfltr
O2SCBUS
aic78xx
CA561
ARPolicy
viaagp
videoacceleratorengine
raidmsvr
SE2Cmdfl
ATSWPDRV
tfsncofs
cpsvc
USB_NDIS_51
sndsrvc
iaantmon
EIO_XP
CVPNDRVA
icam4usb
vcdsecs
bc_filter
oraclewebassistant
toddsrv
ivscheduler
pae_1394
mindrepair
lvtuner
PSI_SVC_2
pcandis5
tng-doba
NWHOST
vmparport
ESDCR
eloggersvc6
oracle_load_balancer_60_client-forms6i
cpqarry2
passthru
DVDVRRdr_xp
VCAM
spupdsvc
prfldsvc
dnetc
rp_fws
SiS300i
SetupSys
DSDrv4
yukonwlh
msftpsvc
LEX_AS_NIC_SERVICE_YNOS
atksgt
emu10k1
picturetaker
avgntflt
axskbus
UWProSys
filterservice
mfeapfk
LMouKE
btaudio
igateway
smservauth
cpuz132
cccredmgr
ZDPNDIS5
SWNC5E00
antivirservice
MRESP50
P17xfi
bwsvc
eskerlicensecontrol
GT890x
DevUpper
tme3srv
F700imd
nipsvc
C-Dilla
sysplant
RushTopDevice
backupexecagentaccelerator
s616unic
RTSTOR
siswlsvc
KMW_SYS
MRESP50a64
hcwPP2
lvprcsrv
NVR0Dev
iap
RTLE8023xp
haspnt
tfsnpool
lvmvdrv
WNIPROT5
LVBulk
s24eventmonitor
SeaPort
ScanUSBEMPIA
defwatch
websensecamserver
teefer2
lhidflt2
MREMP50
cxlpt
iwebcal
sr_service
SECYPUSB
bgsvcgen
ss_bus
s24trans
dwmrcs
epoxusdm
mirrorv3
AsIO
guardian2
NITaggerService
roxwatch
fa_scheduler
oracleservicelocalora
usbbus
revudfservice
oracleorahome92pagingserver
vmnetuserif
ANC
blueletscoaudio
atmeltpm
TMHIDSRV
dlpwd
{85ccb53b-23d8-4e73-b1b7-9ddb71827d9b}
twotrack
basic2
npkcusb
c-dillasrv
RSAFAL
uiusys
Tablet2k
NEOFLTR_600_13319
NETMDUSB
RTL8023xp
paamsrv
vzfw
aspi32
acnusvc
enodpl
wceusbsh
backupexecagentbrowser
ctusfsyn
LUsbKbd
sit_bus
U81xmdfl
rtl8029
usprserv
E1000
SE2Bobex
VNUSB
cics.region1
trufos
pwkntmon
FreshIO
ccsetmgr
MailService
cxusb
cimnotify
nscservice
AEADIFilters
SGIR
usnsvc
tsscoreservice
SMCB000
USA49W
prosync1
PhilCam8116_XP
icm10blk
SndTDriverV32
ntiopnp
lxcf_device
slave
CTEXFIFX.DLL
SDdriver
WmBEnum
websenserealtimeanalyzer
OEM02Afx
NCPro
FETNDIS
AIRPLUS
USB_RNDIS
VC6SecS
MaxtorFrontPanel1
kodakccs
TClass2k
CAMFLT
BLKWGU(Belkin)
omnidrv
Cam5607
vulfnths
netdetect
authsyssvc
bdpredir
gbpoll
PBADRV
alcxwdm
hpci
wandrv
vmusb
IntelC53
HpqKbFiltr
cm102u32
NWADI
remotelyanywhere
3compxe
KMW_USB
pdlncbas
avc
TPPWRIF
wmccds
nvenetfd
AEAudioService
aexnsclient
XBCD
dashsvc
CTEAPSFX.DLL
tpkd
ypcservice
Cinemsup
symredrv
Intels51
nabtsfec
servicemgr
entech
p17xfilt
us30sys
symmpi
dmusic
TermService
wuauserv
BITS
ShellHWDetection
LogonHours
PCAudit
helpsvc
uploadmgr
iphlpsvc
seclogon
AppInfo
msiscsi
MMCSS
winmgmt
SessionEnv
browser
EapHost
schedule
hkmsvc
wercplsupport
ProfSvc
Themes
BDESVC
AppMgmt
.
HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows NT\CurrentVersion\Svchost - NetSvcs
.
.
------- Zusätzlicher Suchlauf -------
.
uLocal Page = c:\windows\system32\blank.htm
uStart Page = hxxp://www.google.de/
mStart Page = about:blank
mLocal Page = c:\windows\SysWOW64\blank.htm
uInternet Settings,ProxyServer = http=127.0.0.1:60465
IE: Free YouTube to Mp3 Converter - c:\users\Luisa\AppData\Roaming\DVDVideoSoftIEHelpers\freeyoutubetomp3converter.htm
TCP: DhcpNameServer = 192.168.0.1
FF - ProfilePath - c:\users\Luisa\AppData\Roaming\Mozilla\Firefox\Profiles\161hpcsf.default\
FF - prefs.js: browser.search.defaulturl - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=3&q={searchTerms}
FF - prefs.js: browser.startup.homepage - Google
FF - prefs.js: keyword.URL - hxxp://search.conduit.com/ResultsExt.aspx?ctid=CT2269050&SearchSource=2&q=
FF - prefs.js: network.proxy.http - 127.0.0.1
FF - prefs.js: network.proxy.http_port - 60465
FF - prefs.js: network.proxy.type - 0
FF - user.js: network.http.max-persistent-connections-per-server - 4
FF - user.js: nglayout.initialpaint.delay - 600
FF - user.js: content.notify.interval - 600000
FF - user.js: content.max.tokenizing.time - 1800000
FF - user.js: content.switch.threshold - 600000
.
- - - - Entfernte verwaiste Registrierungseinträge - - - -
.
Toolbar-{cc05a3e3-64c3-4af2-bfc1-af0d66b69065} - (no file)
Toolbar-{30F9B915-B755-4826-820B-08FBA6BD249D} - (no file)
.
.
"ServiceDll"="%systemroot%\system32\W700mdfl.dll"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\services\fah@c:+fah+fah-service+fah502-console.exe]
.
--------------------- Gesperrte Registrierungsschluessel ---------------------
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\Approved Extensions]
@Denied: (2) (LocalSystem)
"{381FFDE8-2394-4F90-B10D-FC6124A40F8C}"=hex:51,66,7a,6c,4c,1d,38,12,86,fe,0c,
3c,a6,6d,fe,0a,ce,1b,bf,21,21,fa,4b,98
"{18DF081C-E8AD-4283-A596-FA578C2EBDC3}"=hex:51,66,7a,6c,4c,1d,38,12,72,0b,cc,
1c,9f,a6,ed,07,da,80,b9,17,89,70,f9,d7
.
[HKEY_USERS\.Default\Software\Microsoft\Internet Explorer\ApprovedExtensionsMigration]
@Denied: (2) (LocalSystem)
"Timestamp"=hex:6c,28,b2,06,26,fe,cc,01
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}]
@Denied: (A 2) (Everyone)
@="FlashBroker"
"LocalizedString"="@c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe,-101"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\Elevation]
"Enabled"=dword:00000001
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\LocalServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\FlashUtil11e_ActiveX.exe"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{A483C63A-CDBC-426E-BF93-872502E8144E}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Shockwave Flash Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\MiscStatus]
@="0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ProgID]
@="ShockwaveFlash.ShockwaveFlash.10"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB6E-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="ShockwaveFlash.ShockwaveFlash"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}]
@Denied: (A 2) (Everyone)
@="Macromedia Flash Factory Object"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\InprocServer32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx"
"ThreadingModel"="Apartment"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ProgID]
@="FlashFactory.FlashFactory.1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\ToolboxBitmap32]
@="c:\\Windows\\SysWOW64\\Macromed\\Flash\\Flash11e.ocx, 1"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\TypeLib]
@="{D27CDB6B-AE6D-11cf-96B8-444553540000}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\Version]
@="1.0"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\CLSID\{D27CDB70-AE6D-11cf-96B8-444553540000}\VersionIndependentProgID]
@="FlashFactory.FlashFactory"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}]
@Denied: (A 2) (Everyone)
@="IFlashBroker4"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\ProxyStubClsid32]
@="{00020424-0000-0000-C000-000000000046}"
.
[HKEY_LOCAL_MACHINE\software\Classes\Wow6432Node\Interface\{E3F2C3CB-5EB8-4A04-B22C-7E3B4B6AF30F}\TypeLib]
@="{FAB3E735-69C7-453B-A446-B6823C6DF1C9}"
"Version"="1.0"
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0000\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0001\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0002\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0003\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\Class\{4D36E96D-E325-11CE-BFC1-08002BE10318}\0004\AllUserSettings]
@Denied: (A) (Users)
@Denied: (A) (Everyone)
@Allowed: (B 1 2 3 4 5) (S-1-5-20)
"BlindDial"=dword:00000000
.
[HKEY_LOCAL_MACHINE\system\ControlSet002\Control\PCW\Security]
@Denied: (Full) (Everyone)
.
------------------------ Weitere laufende Prozesse ------------------------
.
c:\program files (x86)\Common Files\Nero\Nero BackItUp 4\NBService.exe
c:\windows\starter4g.exe
.
**************************************************************************
.
Zeit der Fertigstellung: 2012-06-02 17:05:21 - PC wurde neu gestartet
ComboFix-quarantined-files.txt 2012-06-02 15:05
.
Vor Suchlauf: 9 Verzeichnis(se), 99.767.496.704 Bytes frei
Nach Suchlauf: 10 Verzeichnis(se), 99.381.825.536 Bytes frei
.
- - End Of File - - 771B2698649CC58F3DD3377804A0BE6A
|
|
04.06.2012, 15:28
| #54 | |
| /// Malwareteam | svhost Trojan.Sirefef.BR Schritt 1: xPUD-Stick erstellen Downloade dir bitte Download UNetbootin, Universal Netboot Installer from SourceForge.net & http://noahdfear.net/downloads/boota...xpud-0.9.2.iso auf deinem Desktop.
Schritt 2: xPUD (driver.sh) Downloade dir bitte Noahdfear's driver.sh Speichere diese auf den xPUD USB Stick. Starte deinen Rechner neu auf.
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
04.06.2012, 18:46
| #55 |
| | svhost Trojan.Sirefef.BR Funktioniert nicht Computer sagt wenn ich vom Stick Booten will, "Datenträger entfernen Neustart: Taste drücken. geht das nich auch von ner Knoppix Live DVD? da hab ich eine da. |
|
04.06.2012, 23:08
| #56 |
| /// Malwareteam | svhost Trojan.Sirefef.BR Kann ich dir nicht sagen - nie getestet. Versuchs einfach mal! 
__________________ Kein Asylrecht für Trojaner! Proud Member of UNITE Hinweis: Ich bin nur werktags erreichbar! Anfragen über PM werden ignoriert! Du bist zufrieden mit uns? Dann unterstütze das Trojaner-Board! |
|
06.06.2012, 16:06
| #57 |
| | svhost Trojan.Sirefef.BR also vom stick gehts nicht, hab die sh ins iso hinzugefügt per poweriso und dann auf cd gebrannt. mal schauen. also auf die cd konnte ich nicht drauf zugreifen führe grade die sh vom stick aus. Wed Jun 6 17:12:08 UTC 2012 Driver report for /mnt/sda2/Windows/System32/drivers 64edd3f59db321947969fdf1dd747323 1394bus.sys Microsoft Corporation 1b00662092f9f9568b995902f0cc40d5 1394ohci.sys Microsoft Corporation 63b05a0420ce4bf0e4af6dcc7cada254 acpipmi.sys Microsoft Corporation 6f11e88748cdefd2f76aa215f97ddfe5 acpi.sys Microsoft Corporation 2f6b34b83843f0c5118b63ac634f5bf4 adp94xx.sys Adaptec 597f78224ee9224ea1a13d6350ced962 adpahci.sys Adaptec e109549c90f62fb570b9540c4b148e54 adpu320.sys Adaptec db9d6c6b2cd95a9ca414d045b627422e afd.sys Microsoft Corporation 7ecff9b22276b73f43a99a15a6094e90 agilevpn.sys Microsoft Corporation 608c14dba7299d8cb6ed035a68a15799 AGP440.sys Microsoft Corporation 5812713a477a3ad7363c7438ca2ee038 aliide.sys Acer Laboratories 1ff8b4431c353ce385c875f194924c0c amdide.sys Microsoft Corporation 7024f087cff1833a806193ef9d22cda9 amdk8.sys Microsoft Corporation 1e56388b3fe0d031c44144eb8c4d6217 amdppm.sys Microsoft Corporation ec7ebab00a4d8448bab68d1e49b4beb9 amdsata.sys Advanced Micro Devices f67f933e79241ed32ff46a4f29b5120b amdsbs.sys AMD Technologies db27766102c7bf7e95140a2aa81d042e amdxata.sys Advanced Micro Devices 811b8e15d5e5c7df0271e6720fe8c1bb Apfiltr.sys Alps Electric 42fd751b27fa0e9c69bb39f39e409594 appid.sys Microsoft Corporation 019af6924aefe7839f61c830227fe79c arcsas.sys Adaptec c484f8ceb1717c540242531db7845c4e arc.sys Adaptec 769765ce2cc62867468cea93969b2242 asyncmac.sys Microsoft Corporation 02062c0b390b7729edc9e69c680a6f3c atapi.sys Microsoft Corporation aa2186f7944104a16d6ed176ed462cec ataport.sys Microsoft Corporation 8c56e93749ba53a4b645963d3439e01e athrx.sys Atheros Communications b5ace6968304a3900eeb1ebfd9622df2 b57nd60a.sys Broadcom Corporation f4de2ae7a9e1badac70bc71ea2c17612 battc.sys Microsoft Corporation f050e487a787239c182c279ca97e8cf4 bdfm.sys ?baStringFileInfoBl&CompanyNameBitDefenderS.R.L.Bucharest,ROMANIA/FileDescriptionBitDefenderActiveVirusControlFilterDrivert*FileVersion...,RELEASE,builtby:WinDDKtInternalNameBDFM.SYSx*LegalCopyrightBitDefenderS.R.L.A llrightsreserved.:tOriginalFilenameBDFM.SYSNProductNameBitDefenderAntiVirus*ProductVersionDVarFileInfo$Translationt* cd211cfa62cab0d4c18b5cb8337f57c2 BdfNdisf6.sys tH`DDVS_VERSION_INFOr?bStringFileInfoB@CompanyNameBitDefenderLLCz)FileDescriptionBitDefenderFirewallNDISFilterDriverTFileVersion...builtby:WinDDK<Inte rnalNamebdfndisf.sys`LegalCopyrightCopyright(C)BitDefenderLLCDOriginalFilenamebdfndisf.sys>ProductNameBitDefendernProductVersion...DVarFileInfo$Transl ation* abd97bfb299713a51fe36aaab71f73a2 bdfsfltr.sys tH`LLVS_VERSION_INFO?baStringFileInfoBbCompanyNameBitDefenderv'FileDescriptionBitDefenderAntiVirusFSfilterdriverr)FileVersion...,RELEASE,builtby:WinDD K:rInternalNameBDFSFLTR.SYSTLegalCopyrightCopyrightBitDefenderBrOriginalFilenameBDFSFLTR.SYSJProductNameBitDefenderOnAccess,ProductVersion.DVarFileInf o$Translationt* f647cdf4123b7e24e33a313e5bffefc1 bdhv.sys ?baStringFileInfoBl&CompanyNameBitDefenderS.R.L.Bucharest,ROMANIAx(FileDescriptionBitDefenderAntiVirusHypervisordriverr)FileVersion...,RELEASE,builtby :WinDDKtInternalNameBDHV.SYSx*LegalCopyrightBitDefenderS.R.L.Allrightsreserved.:tOriginalFilenameBDHV.SYSNProductNameBitDefenderAntiVirus*ProductVersi onDVarFileInfo$Translationtp( b89deff4817b4cc6fc2bcd8f83b4e75d BDVEDISK.sys tH`$$VS_VERSION_INFOrr?bStringFileInfo`BbCompanyNameBitDefenderTFileDescriptionFileVaultDiskDriverj%FileVersion...FreeBuildbuiltby:WinDDK:rInternalNam eBDVEDISK.SYSRLegalCopyrightCopyrightBitDefenderBrOriginalFilenameBDVEDISK.SYSBProductNameBitDefenderCorenProductVersion...DVarFileInfo$Translationt* 16a47ce2decc9b099349a5f840654746 beep.sys Microsoft Corporation 61583ee3c3a17003c4acd0475646b4d3 blbdrive.sys Microsoft Corporation 19d20159708e152267e53b66677a4995 bowser.sys Microsoft Corporation f09eee9edc320b5e1501f749fde686c8 BrFiltLo.sys Brother Industries b114d3098e9bdb8bea8b053685831be6 BrFiltUp.sys Brother Industries 5c2f352a4e961d72518261257aae204b bridge.sys Microsoft Corporation 43bea8d483bf1870f018e2d02e06a5bd BrSerId.sys Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries Brother Industries a6eca2151b08a09caceca35c07f05b42 BrSerWdm.sys Brother Industries b79968002c277e869cf38bd22cd61524 BrUsbMdm.sys Brother Industries a87528880231c54e75ea7a44943b38bf BrUsbSer.sys Brother Industries 9da669f11d1f894ab4eb69bf546a42e8 bthmodem.sys Microsoft Corporation 3e5b191307609f7514148c6832bb0842 bxvbda.sys Broadcom Corporation a6ea7a3fc4b00f48535b506db1e86efd CAX_CNXT.sys Conexant 26c5d00321937e49b6bc91029947d094 CAX_DPV.sys Conexant d1787e11c6a0078ddeaf8cf3ee2ab293 CAXHWAZL.sys Conexant b8bd2bb284668c84865658c77574381a cdfs.sys Microsoft Corporation 83d2d75e1efb81b3450c18131443f7db cdrom.sys Microsoft Corporation 5c8fd0d456d442d38bb7fd3dd2a524e5 CHDRT64.sys Conexant d7cd5c4e1b71fa62050515314cfb52cf circlass.sys Microsoft Corporation 62f1ed63f0cb0b5a2f65d15a6490c2fd Classpnp.sys Microsoft Corporation 0840155d0bddf1190f84a663c284bd33 CmBatt.sys Microsoft Corporation e19d3f095812725d88f9001985b94edd cmdide.sys CMD Technology 8be938fe04e3a9d091f379c1d5f4b873 cm_net32.sys tt[aMOFDATANDISMOFRESOURCEVS_VERSION_INFOtt?LStringFileInfobCommentsDCompanyNameC-motechCo.,Ltd.ZFileDescriptionUSBNDISMiniportDrivervFileVersion...tInternalNamecmusbnetbLegalCopyrightCopyright(c)C-motechCo.,Ltd.(LegalTrademarksBrOriginalFilenamecmusbnet.sysPrivateBuildd"ProductNameC-motechUSBNDISMiniportDriver:vProductVersion...SpecialBuild<bCommentsDCompanyNameC-motechCo.,Ltd.ZFileDescriptionUSBNDISMiniportDrivervFileVersion...n'InternalNameC-motechProprietaryUSBDeviceDriverbLegalCopyrightCopyright(c)C-motechCo.,Ltd.(LegalTrademarksBrOriginalFilenamecmusbnet.sysPrivateBuildv+ProductNameC-motechCo.,Ltd.USBNDISMiniportDriver:vProductVersion...SpecialBuildHVarFileInfo(bTranslationt f749e9cabb1572649715ec69bd68ca4e cm_netamd.sys tt[aMOFDATANDISMOFRESOURCEVS_VERSION_INFOtt?LStringFileInfobCommentsDCompanyNameC-motechCo.,Ltd.ZFileDescriptionUSBNDISMiniportDrivervFileVersion...tInternalNamecmusbnetbLegalCopyrightCopyright(c)C-motechCo.,Ltd.(LegalTrademarksBrOriginalFilenamecmusbnet.sysPrivateBuildd"ProductNameC-motechUSBNDISMiniportDriver:vProductVersion...SpecialBuild<bCommentsDCompanyNameC-motechCo.,Ltd.ZFileDescriptionUSBNDISMiniportDrivervFileVersion...n'InternalNameC-motechProprietaryUSBDeviceDriverbLegalCopyrightCopyright(c)C-motechCo.,Ltd.(LegalTrademarksBrOriginalFilenamecmusbnet.sysPrivateBuildv+ProductNameC-motechCo.,Ltd.USBNDISMiniportDriver:vProductVersion...SpecialBuildHVarFileInfo(bTranslationt 2b3b8cbea1ba1bce5700607fbdb31034 cmnsusbser.sys tHllVS_VERSION_INFO?StringFileInfoZbBCompanyNameMobileConnectorfFileDescriptionUSBModem/SerialDeviceDrivervFileVersion....aInternalNameusbserLLegalCopyrightCopyright-FOriginalFilenamecmnsusbser.sys^ProductNameUSBModem/SerialDeviceDriver:vProductVersion...FbBCompanyNameMobileConnectorZFileDescriptionUSB/SerialDeviceDrivervFileVersion...DInternalNameUSBDeviceDriverLLegalCopyrightCopyright-FOriginalFilenamecmnsusbser.sysDProductNameUSB-SerialDriver:vProductVersion...HVarFileInfo(bTranslationt* 33f77f7cb2c2efe34b3bc9cc716f73f3 cm_ser32.sys tH`yVS_VERSION_INFO?FStringFileInfobDCompanyNameC-motechCo.,Ltd.fFileDescriptionUSBModem/SerialDeviceDrivervFileVersion...tInternalNamecmusbserdLegalCopyrightCopyright(C)C-motechCo.,Ltd.BrOriginalFilenamecmusbser.sysp(ProductNameC-motechUSBModem/SerialDeviceDriver:vProductVersion...bDCompanyNameC-motechCo.,Ltd.ZFileDescriptionUSB/SerialDeviceDrivervFileVersion...VInternalNameC-motechUSBDeviceDrivern%LegalCopyrightCopyright(C)C-motechCo.,Ltd.BrOriginalFilenameqcusbser.sysh$ProductNameC-motechCo.,Ltd.USB-SerialDriver:vProductVersion...HVarFileInfo(bTranslationt* e9e160fed596d6555de17bc7a78aa424 cm_seramd.sys tHVS_VERSION_INFO?FStringFileInfobDCompanyNameC-motechCo.,Ltd.fFileDescriptionUSBModem/SerialDeviceDrivervFileVersion...tInternalNamecmusbserdLegalCopyrightCopyright(C)C-motechCo.,Ltd.BrOriginalFilenamecmusbser.sysp(ProductNameC-motechUSBModem/SerialDeviceDriver:vProductVersion...bDCompanyNameC-motechCo.,Ltd.ZFileDescriptionUSB/SerialDeviceDrivervFileVersion...VInternalNameC-motechUSBDeviceDrivern%LegalCopyrightCopyright(C)C-motechCo.,Ltd.BrOriginalFilenameqcusbser.sysh$ProductNameC-motechCo.,Ltd.USB-SerialDriver:vProductVersion...HVarFileInfo(bTranslationt* 937beb186a735aca91d717044a49d17e cng.sys Microsoft Corporation 102de219c3f61415f964c88e9085ad14 compbatt.sys Microsoft Corporation f26b3a86f6fa87ca360b879581ab4123 CompositeBus.sys Microsoft Corporation 965fc9d0bd1e13b02dc71b77b68092f4 CPQBttn64.sys Hewlett-Packard 3e588b60ec061686ba05d33574a344c6 crashdmp.sys Microsoft Corporation 1c827878a998c18847245fe1f34ee597 crcdisk.sys Microsoft Corporation 4a6173c2279b498cd8f57cae504564cb csc.sys Microsoft Corporation 9c253ce7311ca60fc11c774692a13208 dfsc.sys Microsoft Corporation 13096b05847ec78f0977f2c0f79e9ab3 discache.sys Microsoft Corporation 20080512f61d3210e449a1256f66a7fd Diskdump.sys Microsoft Corporation 9819eee8b5ea3784ec4af3b137a5244c disk.sys Microsoft Corporation 9b19f34400d24df84c858a421c205754 drmkaud.sys Microsoft Corporation 21d26064aedb4988f785bb4a3a2c051e drmk.sys Microsoft Corporation 839b5fe3d48e9f35b22c21a3d5103f6c Dumpata.sys Microsoft Corporation 814db88f2641691575a455cf25354098 dumpfve.sys Microsoft Corporation bf24d6f2ed97fe830bfd52b246f98e67 dxapi.sys Microsoft Corporation 1633b9abf52784a1331476397a48cbef dxgkrnl.sys Microsoft Corporation 3238b9078e0766ab5e62dc737a809adb dxgmms1.sys Microsoft Corporation fede0629ecb23650d48989517d4914da dxg.sys Microsoft Corporation edc6e9c057c9d7f83eea22b4cef5dcad E1G6032E.sys Intel Corporation 0e5da5369a0fcaea12456dd852545184 elxstor.sys Emulex 34a3c54752046e79a126e15c51db409b errdev.sys Microsoft Corporation dc5d737f51be844d8c82c695eb17372f evbda.sys Broadcom Corporation a510c654ec00c1e9bdd91eeb3a59823b exfat.sys Microsoft Corporation 0adc83218b66a6db380c330836f3e36d fastfat.sys Microsoft Corporation d765d19cd8ef61f650c384f62fac00ab fdc.sys Microsoft Corporation 655661be46b5f5f3fd454e2c3095b930 fileinfo.sys Microsoft Corporation 5f671ab5bc87eea04ec38a6cd5962a47 filetrace.sys Microsoft Corporation c172a0f53008eaeb8ea33fe10e177af5 flpydisk.sys Microsoft Corporation f7866af72abbaf84b1fa5aa195378c59 fltMgr.sys Microsoft Corporation d43703496149971890703b4b1b723eac fsdepends.sys Microsoft Corporation e95ef8547de20cf0603557c0cf7a9462 fs_rec.sys Microsoft Corporation ae87ba80d0ec3b57126ed2cdc15b24ed fvevol.sys Microsoft Corporation 50555005e22a56aef10be607472d0bdc FWPKCLNT.SYS Microsoft Corporation 8c778d335c9d272cfd3298ab02abe3b6 GAGP30KX.SYS Microsoft Corporation f2523ef6460fc42405b12248338ab2f0 hcw85cir.sys Hauppauge Computer Works 0a49913402747a0b67de940fb42cbdbb hdaudbus.sys Microsoft Corporation 6410f6f415b2a5a9037224c41da8bf12 HdAudio.sys Microsoft Corporation 78e86380454a7b10a5eb255dc44a355f hidbatt.sys Microsoft Corporation 7fd2a313f7afe5c4dab14798c48dd104 hidbth.sys Microsoft Corporation 685fec2407fc121eb937cb658b3c0f35 hidclass.sys Microsoft Corporation 0a77d29f311b88cfae3b13f9c1a73825 hidir.sys Microsoft Corporation 49ee2e52e6cd03947dad72f65367be06 hidparse.sys Microsoft Corporation b3bf6b5b50006def50b66306d99fcf6f hidusb.sys Microsoft Corporation 0886d440058f203eba0e1825e4355914 HpSAMD.sys Hewlett-Packard cee049cac4efa7f4e1e4ad014414a5d4 http.sys Microsoft Corporation f17766a19145f111856378df337a5d79 hwpolicy.sys Microsoft Corporation fa55c73d4affa7ee23ac4be53b4592d3 i8042prt.sys Microsoft Corporation b75e45c564e944a2657167d197ab29da iaStorV.sys Intel Corporation 24cc43ecdeefd4c19fbbee4951b647f1 igdkmd64.sys Intel Corporation 5c18831c61933628f5bb0ea2675b9d21 iirsp.sys Intel Corp f00f20e70c6ec3aa366910083a0518aa intelide.sys Microsoft Corporation ada036632c664caa754079041cf1f8c1 intelppm.sys Microsoft Corporation 722dd294df62483cecaae6e094b4d695 ipfltdrv.sys Microsoft Corporation e2b4a4494db7cb9b89b55ca268c337c5 IPMIDrv.sys Microsoft Corporation af9b39a7e7b6caa203b3862582e9f2d0 ipnat.sys Microsoft Corporation 05360b1ea5a2abf620d1d96ebd8bd8f1 irda.sys Microsoft Corporation 3abf5e7213eb28966d55d58b515d5ce9 irenum.sys Microsoft Corporation 2f7b28dc3e1183e5eb418df55c204f38 isapnp.sys Microsoft Corporation bc02336f1cba7dcc7d1213bb588a68a5 kbdclass.sys Microsoft Corporation 6def98f8541e1b5dceb2c822a11f7323 kbdhid.sys Microsoft Corporation 16c1b906fc5ead84769f90b736b6bf0e ksecdd.sys Microsoft Corporation 0b711550c56444879d71c7daabda6c83 ksecpkg.sys Microsoft Corporation 5c7af4a20f5bf67042b2e613d123d111 ks.sys Microsoft Corporation 6869281e78cb31a43e969f06b57347c4 ksthunk.sys Microsoft Corporation 1538831cf8ad2979a04c423779465827 lltdio.sys Microsoft Corporation 1a93e54eb0ece102495a51266dcdb6a6 lsi_fc.sys LSI Corporation 30f5c0de1ee8b5bc9306c1f0e4a75f93 lsi_sas2.sys LSI Corporation 1047184a9fdc8bdbff857175875ee810 lsi_sas.sys LSI Corporation 0504eacaff0d3c8aed161c4b0d369d4a lsi_scsi.sys LSI Corporation 43d0f98e1d56ccddb0d5254cff7b356e luafv.sys Microsoft Corporation b5e86524918ef32b32d1032e0c8e92a3 massfilter.sys bH`pVS_VERSION_INFO?b@StringFileInfobBCompanyNameZTEIncorporatedJFileDescriptionZTECDROMFilterbFileVersion...>InternalNamemassfilter.sysBLegalCopyrigh tCopyrightFOriginalFilenamemassfilter.sysBProductNameZTECDROMFilterbProductVersion...DVarFileInfo$Translationt 3c9f072f9dca856b9fb7a20cbd4281ac mcd.sys Microsoft Corporation e4f44ec214b3e381e1fc844a02926666 mdmxsdk.sys Conexant a55805f747c6edb6a9080d7c633bd0f4 megasas.sys LSI Corporation baf74ce0072480c3b6b7c13b2a94d6b3 MegaSR.sys LSI Corporation 800ba92f7010378b09f9ed9270f07137 modem.sys Microsoft Corporation b03d591dc7da45ece20b3b467e6aadaa monitor.sys Microsoft Corporation 7d27ea49f3c1f687d357e77a470aea99 mouclass.sys Microsoft Corporation d3bf052c40b0c4166d9fd86a4288c1e6 mouhid.sys Microsoft Corporation 791af66c4d0e7c90a3646066386fb571 mountmgr.sys Microsoft Corporation 609d1d87649ecc19796f4d76d4c15cea mpio.sys Microsoft Corporation 6c38c9e45ae0ea2fa5e551f2ed5e978f mpsdrv.sys Microsoft Corporation 30524261bb51d96d6fcbac20c810183c mrxdav.sys Microsoft Corporation f0067552f8f9b33d7c59403ab808a3cb mrxsmb10.sys Microsoft Corporation 3c142d31de9f2f193218a53fe2632051 mrxsmb20.sys Microsoft Corporation 040d62a9d8ad28922632137acdd984f2 mrxsmb.sys Microsoft Corporation 5c37497276e3b3a5488b23a326a754b7 msahci.sys Microsoft Corporation 8d27b597229aed79430fb9db3bcbfbd0 msdsm.sys Microsoft Corporation aa3fb40e17ce1388fa1bedab50ea8f96 msfs.sys Microsoft Corporation f9d215a46a8b9753f61767fa72a20326 mshidkmdf.sys Microsoft Corporation d916874bbd4f8b07bfb7fa9b3ccae29d msisadrv.sys Microsoft Corporation fa4d2557de56d45b0a346f93564be6e1 msiscsi.sys Microsoft Corporation 49ccf2c4fea34ffad8b1b59d49439366 mskssrv.sys Microsoft Corporation bdd71ace35a232104ddd349ee70e1ab3 mspclock.sys Microsoft Corporation 4ed981241db27c3383d72092b618a1d0 mspqm.sys Microsoft Corporation 89cb141aa8616d8c6a4610fa26c60964 msrpc.sys Microsoft Corporation 0eed230e37515a0eaee3c2e1bc97b288 mssmbios.sys Microsoft Corporation 2e66f9ecb30b4221a318c92ac2250779 mstee.sys Microsoft Corporation 7ea404308934e675bffde8edf0757bcd MTConfig.sys Microsoft Corporation f9a18612fd3526fe473c1bda678d61c8 mup.sys Microsoft Corporation 9f9a1f53aad7da4d6fef5bb73ab811ac ndiscap.sys Microsoft Corporation cad515dbd07d082bb317d9928ce8962c ndis.sys Microsoft Corporation 30639c932d9fef22b31268fe25a1b6e5 ndistapi.sys Microsoft Corporation f105ba1e22bf1f2ee8f005d4305e4bec ndisuio.sys Microsoft Corporation 557dfab9ca1fcb036ac77564c010dad3 ndiswan.sys Microsoft Corporation 659b74fb74b86228d6338d643cd3e3cf ndproxy.sys Microsoft Corporation 86743d9f5d2b1048062b14b1d84501c4 netbios.sys Microsoft Corporation 9162b273a44ab9dce5b44362731d062a netbt.sys Microsoft Corporation 02903eb9d9308541d032417acdfb975c netio.sys Microsoft Corporation 77889813be4d166cdab78ddba990da92 nfrd960.sys IBM Corp 1e4c4ab5c9b8dd13179bbdc75a2a01f7 npfs.sys Microsoft Corporation e7f5ae18af4168178a642a9247c63001 nsiproxy.sys Microsoft Corporation 378e0e0dfea67d98ae6ea53adbbd76bc ntfs.sys Microsoft Corporation 9899284589f75fa8724ff3d16aed75c1 null.sys Microsoft Corporation 270d7cd42d6e3979f6dd0146650f0e05 NV_AGP.SYS Microsoft Corporation a4d9c9a608a97f59307c2f2600edc6a4 nvraid.sys NVIDIA Corporation 6c1d5f70e7a6a3fd1c90d840edc048b9 nvstor.sys NVIDIA Corporation 1ea3749c4114db3e3161156ffffa6b33 nwifi.sys Microsoft Corporation 3589478e4b22ce21b41fa1bfc0b8b8a0 ohci1394.sys Microsoft Corporation ee992183bd8eaefd9973f352e587a299 pacer.sys Microsoft Corporation 0086431c29c35be1dbc43f52cc273887 parport.sys Microsoft Corporation 7daa117143316c4a1537e074a5a9eaf0 partmgr.sys Microsoft Corporation b5b8b5ef2e5cb34df8dcf8831e3534fa pciide.sys Microsoft Corporation 144497daa145ba0f7be896064146c058 pciidex.sys Microsoft Corporation f36f6504009f2fb0dfd1b17a116ad74b pci.sys Microsoft Corporation b2e81d4e87ce48589f98cb8c05b01f2f pcmcia.sys Microsoft Corporation d6b9c2e1a11a3a4b26a182ffef18f603 pcw.sys Microsoft Corporation 68769c3356b3be5d1c732c97b9a80d6e PEAuth.sys Microsoft Corporation 32e11315b5126921ffd9074840ef13d3 portcls.sys Microsoft Corporation 0d922e23c041efb1c3fac2a6f943c9bf processr.sys Microsoft Corporation a53a15a11ebfd21077463ee2c7afeef0 ql2300.sys QLogic Corporation 4f6d12b51de1aaeff7dc58c4d75423c8 ql40xx.sys QLogic Corporation 76707bb36430888d9ce9d705398adb6c qwavedrv.sys Microsoft Corporation 5a0da8ad5762fa2d91678a8a01311704 rasacd.sys Microsoft Corporation 87a6e852a22991580d6d39adc4790463 rasl2tp.sys Microsoft Corporation 855c9b1cd4756c5e9a2aa58a15f58c25 raspppoe.sys Microsoft Corporation 27cc19e81ba5e3403c48302127bda717 raspptp.sys Microsoft Corporation e8b1e447b008d07ff47d016c2b0eeecb rassstp.sys Microsoft Corporation 3bac8142102c15d59a87757c1d41dce5 rdbss.sys Microsoft Corporation 302da2a0539f2cf54d7c6cc30c1f2d8d rdpbus.sys Microsoft Corporation cea6cc257fc9b7715f1c2b4849286d24 RDPCDD.sys Microsoft Corporation 9706b84dbabfc4b4ca46c5a82b14dfa3 rdpdr.sys Microsoft Corporation bb5971a4f00659529a5c44831af22365 RDPENCDD.sys Microsoft Corporation 216f3fa57533d98e1f74ded70113177a RDPREFMP.sys Microsoft Corporation 074ac702d8b8b660b0e1371555995386 rdpwd.sys Microsoft Corporation 634b9a2181d98f15941236886164ec8b rdyboost.sys Microsoft Corporation 77b3b747eb2413072b8e4306018d0c9b rmcast.sys Microsoft Corporation fc6d5c50d846b795335deb3fce8b33f3 RNDISMP.sys Microsoft Corporation 388d3dd1a6457280f3badba9f3acd6b1 rootmdm.sys Microsoft Corporation ddc86e4f8e7456261e637e3552e804ff rspndr.sys Microsoft Corporation 68dd0457d18fccef7384ae84022f0c86 Rtnic64.sys Realtek Semiconductor e3bbb89983daf5622c1d50cf49f28227 sbp2port.sys Microsoft Corporation c94da20c7e3ba1dca269bc8460d98387 scfilter.sys Microsoft Corporation ad3a6838a059d65fb55d2f61cf0a6c1f scsiport.sys Microsoft Corporation 3ea8a16169c26afbeb544e0e48421186 secdrv.sys Macrovision Corporation cb624c0035412af0debec78c41f5ca1b serenum.sys Microsoft Corporation c1d8e28b2c2adfaec4ba89e9fda69bd6 serial.sys Microsoft Corporation 1c545a7d0691cc4a027396535691c3e3 sermouse.sys Microsoft Corporation a554811bcd09279536440c964ae35bbf sffdisk.sys Microsoft Corporation ff414f0baefeba59bc6c04b3db0b87bf sffp_mmc.sys Microsoft Corporation 5588b8c6193eb1522490c122eb94dffa sffp_sd.sys Microsoft Corporation a9d601643a1647211a1ee2ec4e433ff4 sfloppy.sys Microsoft Corporation 843caf1e5fde1ffd5ff768f23a51e2e1 sisraid2.sys Silicon Integrated Systems 6a6c106d42e9ffff8b9fcb4f754f6da4 sisraid4.sys Silicon Integrated Systems 548260a7b8654e024dc30bf8a7c5baa4 smb.sys Microsoft Corporation a80348ba03e96c70852959655ca3e084 smclib.sys Microsoft Corporation e7eea18ccd746ccb2eee66d3c82909e0 smsbda.sys tHVS_VERSION_INFO?bazStringFileInfoVB,CompanyNameSianoRFileDescriptionsmsbdadevicedriverTFileVersion...builtby:WinDDKvInternalNamesmsbda.sysx*LegalCop yrightCopyright(c)Siano.Allrightsreserved.>vOriginalFilenamesmsbda.sysDProductNameSMSDigitalVideotProductVersion...DVarFileInfo$Translationt<`hHX c1fbba8be73a2b9a581a2c58d14e2726 sncduvc.sys HVS_VERSION_INFOaa?btStringFileInfoPbCommentsCompanyNameTFileDescriptionUSBCAMDforSonixUVCbFileVersion...InternalNameLLegalCopyrightCopyright-(LegalTrademarks(OriginalFilenamePrivateBuildLProductNameUSBCAMDforSonixUVCbProductVersion...SpecialBuildDVarFileInfo$Translationt` 84de101b4fa40cd28b84637924c060ce snp2uvc.sys ?bStringFileInfobCommentsCompanyName`FileDescriptionUVCCameraStreamingDriver>FileVersion,,,InternalNameLLegalCopyrightCopyright-(LegalTrademarks(OriginalFilenameDPrivateBuildNoI,v...nProductNameHPWebcamBProductVersion,,,:rSpecialBuildPureVersionDVarFileInfo$Translationt* b9e31e5cacdfe584f34f730a677803f9 spldr.sys Microsoft Corporation fff95479c7ab1550f0750a5d01744211 spsys.sys Microsoft Corporation 76548f7b818881b47d8d1ae1be9c11f8 srv2.sys Microsoft Corporation 0af6e19d39c70844c5caa8fb0183c36e srvnet.sys Microsoft Corporation 2408c0366d96bcdf63e8f1c78e4a29c5 srv.sys Microsoft Corporation f3817967ed533d08327dc73bc4d5542a stexstor.sys Promise Technology cfd8802cac57d3afe0c687786e9e55f8 storport.sys Microsoft Corporation 8fccbefc5c440b3c23454656e551b09a storvsc.sys Microsoft Corporation 001cc10fa5e71ae1119115e126c8750d stream.sys Microsoft Corporation d01ec09b6711a5f8e7e6564a4d0fbc90 swenum.sys Microsoft Corporation 6e316c01cba8b785fe495f5cc4f48c6f tape.sys Microsoft Corporation 76d078af6f587b162d50210f761eb9ed tcpipreg.sys Microsoft Corporation f18f56efc0bfb9c87ba01c37b27f4da5 tcpip.sys Microsoft Corporation 0ca6fe26acc7ffee1bd0463f40835f32 tdi.sys Microsoft Corporation 3371d21011695b16333a3934340c4e7c tdpipe.sys Microsoft Corporation 7518f7bcfd4b308abc9192bacaf6c970 tdtcp.sys Microsoft Corporation 079125c4b17b01fcaeebce0bcb290c0f tdx.sys Microsoft Corporation c448651339196c0e869a355171875522 termdd.sys Microsoft Corporation 61b96c26131e37b24e93327a0bd1fb95 tssecsrv.sys Microsoft Corporation 3836171a2cdf3af8ef10856db9835a70 tunnel.sys Microsoft Corporation b4dd609bd7e282bfc683cec7eaaaad67 UAGP35.SYS Microsoft Corporation d47baead86c65d4f4069d7ce0a4edceb udfs.sys Microsoft Corporation 4bfe1bc28391222894cbf1e7d0e42320 ULIAGPKX.SYS Microsoft Corporation eab6c35e62b1b0db0d1b48b671d3a117 umbus.sys Microsoft Corporation b2e8e8cb557b156da5493bbddcc1474d umpass.sys Microsoft Corporation d0fe8cb5f84303e73ff0754437fad3d1 usb8023.sys Microsoft Corporation faec06c1d24e2770ecc4f7c37659824d USBCAMD2.sys Microsoft Corporation 7b6a127c93ee590e4d79a5f2a76fe46f usbccgp.sys Microsoft Corporation af0892a803fdda7492f595368e3b68e7 usbcir.sys Microsoft Corporation 70b5a5a7e0ddd5ebaf6e35b7257a6b9d usbd.sys Microsoft Corporation 92969ba5ac44e229c55a332864f79677 usbehci.sys Microsoft Corporation e7df1cfd28ca86b35ef5add0735ceef3 usbhub.sys Microsoft Corporation f1bb1e55f1e7a65c5839ccc7b36d773e usbohci.sys Microsoft Corporation bbf36eb7117f6b976975c9d8d877df18 usbport.sys Microsoft Corporation 73188f58fb384e75c4063d29413cee3d usbprint.sys Microsoft Corporation 8f0d9d2ea6cfed2730b5bafb9b5b11c2 usbrpm.sys Microsoft Corporation aaa2513c8aed8b54b189fd0c6b1634c0 usbscan.sys Microsoft Corporation f39983647bc1f3e6100778ddfe9dce29 USBSTOR.SYS Microsoft Corporation bc3070350a491d84b518d7cca9abd36f usbuhci.sys Microsoft Corporation 7cb8c573c6e4a2714402cc0a36eab4fe usbvideo.sys Microsoft Corporation c5c876ccfc083ff3b128f933823e87bd vdrvroot.sys Microsoft Corporation da4da3f5e02943c2dc8c6ed875de68dd vgapnp.sys Microsoft Corporation 53e92a310193cb3c03bea963de7d9cfc vga.sys Microsoft Corporation c82e748660f62a242b2dfac1442f22a4 vhdmp.sys Microsoft Corporation e5689d93ffe4e5d66c0178761240dd54 viaide.sys VIA Technologies e7353d59c9842bc7299faeb7e7e09340 videoprt.sys Microsoft Corporation ae10c35761889e65a6f7176937c5592c VMBusHID.sys Microsoft Corporation 1501699d7eda984abc4155a7da5738d1 vmbus.sys Microsoft Corporation 88af6e02ab19df7fd07ecdf9c91e9af6 vms3cap.sys Microsoft Corporation ffd7a6f15b14234b5b0e5d49e7961895 vmstorfl.sys Microsoft Corporation 2b1a3dae2b4e70dbba822b7a03fbd4a3 volmgr.sys Microsoft Corporation 99b0cbb569ca79acaed8c91461d765fb volmgrx.sys Microsoft Corporation 58f82eed8ca24b461441f9c3e4f0bf5c volsnap.sys Microsoft Corporation 5e2016ea6ebaca03c04feac5f330d997 vsmraid.sys VIA Technologies 0c4540311e11664b245a263e1154cef8 VSTAZL6.SYS Conexant 18e40c245dbfaf36fd0134a7ef2df396 VSTCNXT6.SYS Conexant 02071d207a9858fbe3a48cbfd59c4a04 VSTDPV6.SYS Conexant 36d4720b72b5c5d9cb2b9c29e9df67a1 vwifibus.sys Microsoft Corporation 6a3d66263414ff0d6fa754c646612f3f vwififlt.sys Microsoft Corporation 6a638fc4bfddc4d9b186c28c91bd1a01 vwifimp.sys Microsoft Corporation 4e9440f4f152a7b944cb1663d3935a3e wacompen.sys Microsoft Corporation 47ca49400643effd3f1c9a27e1d69324 wanarp.sys Microsoft Corporation fc438d1430b28618e2d0c7c332a710ad watchdog.sys Microsoft Corporation 441bd2d7b4f98134c3a4f9fa570fd250 Wdf01000.sys Microsoft Corporation 1b409454d7a00110fdb06f7e0f155a88 WdfLdr.sys Microsoft Corporation 72889e16ff12ba0f235467d6091b17dc wd.sys Microsoft Corporation 611b23304bf067451a9fdee01fbdd725 wfplwf.sys Microsoft Corporation 05ecaec3e4529a7153b3136ceb49f0ec wimmount.sys Microsoft Corporation aaefb9193b31d7eb2425dd3fb6766640 winhv.sys Microsoft Corporation f6ff8944478594d0e414d3f048f0d778 wmiacpi.sys Microsoft Corporation fc146f46872d4c5b529b89a5131fd1e6 wmilib.sys Microsoft Corporation 6bcc1d7d2fd2453957c5479a32364e52 ws2ifsl.sys Microsoft Corporation 7cadc74271dd6461c452c271b30bd378 WUDFPf.sys Microsoft Corporation 3b197af0fff08aa66b6b2241ca538d64 WUDFRd.sys Microsoft Corporation e8f3fa126a06f8e7088f63757112a186 XAudio64.sys Conexant 741d9bbfe2a392031157a39d921ce052 zghsmdm.sys tHVS_VERSION_INFObbbb?nStringFileInfobBCompanyNameZTEIncorporatedfFileDescriptionUSBModem/SerialDeviceDrivervFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver:vProductVersion...bbtCompanyNameZTEInc.fFileDescriptionUSBModem/SerialDeviceDrivervFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFileXProductNameZTEUSBModem/SerialDriver:vProductVersion...HVarFileInfo(bTranslationt 31db70a61814e4f33181d48190d46845 ZTEusbmdm6k.sys tHDVS_VERSION_INFObvbv?StringFileInfobBCompanyNameZTEIncorporatedfFileDescriptionUSBModem/SerialDeviceDriverbFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver<bProductVersion...tbtCompanyNameZTEInc.fFileDescriptionUSBModem/SerialDeviceDriverbFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver<bProductVersion...HVarFileInfo(bTranslationt 01cbeea25aa78c0f0272654048d61f34 ZTEusbnet.sys ttb[aMOFDATANDISMOFRESOURCEVS_VERSION_INFObb?StringFileInfobComments@CompanyNameZTECorporationZFileDescriptionUSBNDISMiniportDrivervFileVersion...nInterna lNamezteusbnetRLegalCopyrightCopyright(C)-(LegalTrademarksDOriginalFilenamezteusbnet.sysPrivateBuild@*ProductNameZTECorporation:vProductVersion...SpecialBuildbCommentsBCompanyNameZTECorporatio n.ZFileDescriptionUSBNDISMiniportDrivervFileVersion...nInternalNamezteusbnetRLegalCopyrightCopyright(C)-(LegalTrademarksDOriginalFilenamezteusbnet.sysPrivateBuild@*ProductNameZTECorporation:vProductVersion...SpecialBuildHVarFileInfo(bTranslation c9ada887bf326d8413e81fe80b1be7eb ZTEusbnmea.sys tH`EVS_VERSION_INFObvbv?StringFileInfobBCompanyNameZTEIncorporatedfFileDescriptionUSBModem/SerialDeviceDriverbFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver<bProductVersion...tbtCompanyNameZTEInc.fFileDescriptionUSBModem/SerialDeviceDriverbFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver<bProductVersion...HVarFileInfo(bTranslationt 31db70a61814e4f33181d48190d46845 ZTEusbser6k.sys tHDVS_VERSION_INFObvbv?StringFileInfobBCompanyNameZTEIncorporatedfFileDescriptionUSBModem/SerialDeviceDriverbFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver<bProductVersion...tbtCompanyNameZTEInc.fFileDescriptionUSBModem/SerialDeviceDriverbFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver<bProductVersion...HVarFileInfo(bTranslationt c9ada887bf326d8413e81fe80b1be7eb zteusbvoice.sys tH`EVS_VERSION_INFObvbv?StringFileInfobBCompanyNameZTEIncorporatedfFileDescriptionUSBModem/SerialDeviceDriverbFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver<bProductVersion...tbtCompanyNameZTEInc.fFileDescriptionUSBModem/SerialDeviceDriverbFileVersion...BInternalNameZTEUsbDriverFileTLegalCopyrightCopyright(C)-JOriginalFilenameZTEUsbDriverFilef#ProductNameZTEUSBModem/SerialDeviceDriver<bProductVersion...HVarFileInfo(bTranslationt Geändert von PAUI (06.06.2012 um 16:12 Uhr) |
|
06.06.2012, 16:57
| #58 |
| /// Selecta Jahrusso   | svhost Trojan.Sirefef.BR Hy Wie vertraut bist du mit Linux ? Knoppix sollte ja auch eine Art Terminal haben oder. Lass mich mal was versuchen hier. Drucke dir ggf folgende Anweisungen aus. Ich will das du nach dem OTL Fix offline bleibst. Downloade dir bitte procmon von hier Process Monitor Entpacke das Archiv auf deinem Desktop.
Code:
ATTFilter :otl
IE - HKCU\Software\Microsoft\Windows\CurrentVersion\Internet Settings: "ProxyServer" = http=127.0.0.1:60465
FF - prefs.js..network.proxy.http: "127.0.0.1"
FF - prefs.js..network.proxy.http_port: 60465
FF - prefs.js..network.proxy.type: 0
NetSvcs:64bit: stac97 - C:\Windows\SysNative\stac97.dll (Iomega)
NetSvcs:64bit: svchost
NetSvcs:64bit: ASNDIS5 - C:\Windows\SysNative\ASNDIS5.dll (Iomega)
NetSvcs:64bit: cwafadmincontroller - C:\Windows\SysNative\cwafadmincontroller.dll (Iomega)
NetSvcs:64bit: belmonitorservice - C:\Windows\SysNative\belmonitorservice.dll (Iomega)
NetSvcs:64bit: om518p - C:\Windows\SysNative\om518p.dll (Iomega)
NetSvcs:64bit: pfc - C:\Windows\SysNative\pfc.dll (Iomega)
NetSvcs:64bit: bobo - C:\Windows\SysNative\bobo.dll (Iomega)
NetSvcs:64bit: BVRPMPR5 - C:\Windows\SysNative\BVRPMPR5.dll (Iomega)
NetSvcs:64bit: se2Eunic - C:\Windows\SysNative\se2Eunic.dll (Iomega)
NetSvcs:64bit: backupexecnamingservice - C:\Windows\SysNative\backupexecnamingservice.dll (Iomega)
NetSvcs:64bit: HPSLPSVC - C:\Windows\SysNative\HPSLPSVC.dll (Iomega)
NetSvcs:64bit: cdmservice - C:\Windows\SysNative\cdmservice.dll (Iomega)
NetSvcs:64bit: diskperf - C:\Windows\SysNative\diskperf.exe (Microsoft Corporation)
NetSvcs:64bit: dlaudf_m - C:\Windows\SysNative\dlaudf_m.dll (Iomega)
NetSvcs:64bit: wintrust - C:\Windows\SysNative\wintrust.dll (Microsoft Corporation)
NetSvcs:64bit: ssm_mdm - C:\Windows\SysNative\ssm_mdm.dll (Iomega)
NetSvcs:64bit: naimagent32 - C:\Windows\SysNative\naimagent32.dll (Iomega)
NetSvcs:64bit: starwindserviceae - C:\Windows\SysNative\starwindserviceae.dll (Iomega)
NetSvcs:64bit: VRFIL - C:\Windows\SysNative\VRFIL.dll (Iomega)
NetSvcs:64bit: fsbwsys - C:\Windows\SysNative\fsbwsys.dll (Iomega)
NetSvcs:64bit: sdhelper - C:\Windows\SysNative\sdhelper.dll (Iomega)
NetSvcs:64bit: StMp3Rec - C:\Windows\SysNative\StMp3Rec.dll (Iomega)
NetSvcs:64bit: nvnetbus - C:\Windows\SysNative\nvnetbus.dll (Iomega)
NetSvcs:64bit: {95808DC4-FA4A-4c74-92FE-5B863F82066B} - C:\Windows\SysNative\{95808DC4-FA4A-4c74-92FE-5B863F82066B}.dll (Iomega)
NetSvcs:64bit: w810mgmt - C:\Windows\SysNative\w810mgmt.dll (Iomega)
NetSvcs:64bit: opcenum - C:\Windows\SysNative\opcenum.dll (Iomega)
NetSvcs:64bit: cq_mem - C:\Windows\SysNative\cq_mem.dll (Iomega)
NetSvcs:64bit: MSSQL$MSSMLBIZ - C:\Windows\SysNative\MSSQL$MSSMLBIZ.dll (Iomega)
NetSvcs:64bit: wacomvhid - C:\Windows\SysNative\wacomvhid.dll (Iomega)
NetSvcs:64bit: NICM - C:\Windows\SysNative\NICM.dll (Iomega)
NetSvcs:64bit: pdlnsx25 - C:\Windows\SysNative\pdlnsx25.dll (Iomega)
NetSvcs:64bit: VRADFIL - C:\Windows\SysNative\VRADFIL.dll (Iomega)
NetSvcs:64bit: nwlnkipx - C:\Windows\SysNative\nwlnkipx.dll (Iomega)
NetSvcs:64bit: TPM - C:\Windows\SysNative\tpm.msc ()
NetSvcs:64bit: sgectl - C:\Windows\SysNative\sgectl.dll (Iomega)
NetSvcs:64bit: tones - C:\Windows\SysNative\tones.dll (Iomega)
NetSvcs:64bit: mwsarcpkt - C:\Windows\SysNative\mwsarcpkt.dll (Iomega)
NetSvcs:64bit: Spsmqvsm - C:\Windows\SysNative\Spsmqvsm.dll (Iomega)
NetSvcs:64bit: autostore - C:\Windows\SysNative\autostore.dll (Iomega)
NetSvcs:64bit: symtdi - C:\Windows\SysNative\symtdi.dll (Iomega)
NetSvcs:64bit: epfw - C:\Windows\SysNative\epfw.dll (Iomega)
NetSvcs:64bit: vmount2 - C:\Windows\SysNative\vmount2.dll (Iomega)
NetSvcs:64bit: xpadminserver - C:\Windows\SysNative\xpadminserver.dll (Iomega)
NetSvcs:64bit: imonitor - C:\Windows\SysNative\imonitor.dll (Iomega)
NetSvcs:64bit: ulcdrhlp - C:\Windows\SysNative\ulcdrhlp.dll (Iomega)
NetSvcs:64bit: filemon701 - C:\Windows\SysNative\filemon701.dll (Iomega)
NetSvcs:64bit: nicconfigsvc - C:\Windows\SysNative\nicconfigsvc.dll (Iomega)
NetSvcs:64bit: tsmservice - C:\Windows\SysNative\tsmservice.dll (Iomega)
NetSvcs:64bit: CTEDSPIO.DLL - C:\Windows\SysNative\CTEDSPIO.DLL.dll (Iomega)
NetSvcs:64bit: SQLAgent$MICROSOFTSMLBIZ - C:\Windows\SysNative\SQLAgent$MICROSOFTSMLBIZ.dll (Iomega)
NetSvcs:64bit: icepack - C:\Windows\SysNative\icepack.dll (Iomega)
NetSvcs:64bit: AtiHdmiService - C:\Windows\SysNative\AtiHdmiService.dll (Iomega)
NetSvcs:64bit: w300bus - C:\Windows\SysNative\w300bus.dll (Iomega)
NetSvcs:64bit: hcf_msft - C:\Windows\SysNative\hcf_msft.dll (Iomega)
NetSvcs:64bit: GMSIPCI - C:\Windows\SysNative\GMSIPCI.dll (Iomega)
NetSvcs:64bit: avsinc - C:\Windows\SysNative\avsinc.dll (Iomega)
NetSvcs:64bit: rrrspy - C:\Windows\SysNative\rrrspy.dll (Iomega)
NetSvcs:64bit: Wbutton - C:\Windows\SysNative\Wbutton.dll (Iomega)
NetSvcs:64bit: backupclientsvc - C:\Windows\SysNative\backupclientsvc.dll (Iomega)
NetSvcs:64bit: navex15 - C:\Windows\SysNative\navex15.dll (Iomega)
NetSvcs:64bit: PAR1284 - C:\Windows\SysNative\PAR1284.dll (Iomega)
NetSvcs:64bit: vmusb - C:\Windows\SysNative\vmusb.dll (Iomega)
:commands
[reboot]
Starte bitte die procmon.exe Klicke im ersten Fenster einfach nur OK. Nun oben auf Options und setze einen Haken bei Enable Boot Logging. Starte den PC neu auf. Nach dem Neustart, starte procmon erneut. Es wird dir mitteilen, dass eine Datei erstellt wurde. Bestätige das Speichern mit OK und speichere diese als boot.pml auf deinem Desktop. Es werden 2 .pml Dateien auf deinem Desktop erstellt. Zippe diese und hänge sie bitte in deiner nächsten Antwort an. Mal sehen ob das mehr aufzeigt
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
06.06.2012, 18:04
| #59 |
| | svhost Trojan.Sirefef.BR Also hab nen eigenen Debian Server. hab das ja mit der driver.sh ja hingekriegt. also grundlegende sachen kenn ich mich aus. der laptop ist immer offline. |
|
06.06.2012, 18:49
| #60 |
| /// Selecta Jahrusso | svhost Trojan.Sirefef.BR Folge trotzdem den Schritten. Ich muss sehen, was die Einträge erstellt bzw wieso die Dateien dann immer wieder auf dein System kommen. 
__________________ mfg, Daniel ASAP & UNITE Member Alliance of Security Analysis Professionals Unified Network of Instructors and Trusted Eliminators Lerne, zurück zu schlagen und unterstütze uns! TB Akademie |
|
| Themen zu svhost Trojan.Sirefef.BR |
| abgesicherten, anwendung, bitdefender, boot, boot menu, control, defender, dienste, internet, komplett, konfiguration, laptop, melde, modus, netzwerk, neu, online, scan, security, service, system, system32, trojan dropper win32 sirefef.b, trojaner, verbindung, windows, windows 7 |
Textbox.
Linear-Darstellung
