|
Plagegeister aller Art und deren Bekämpfung: Skype TrojanerWindows 7 Wenn Du nicht sicher bist, ob Du dir Malware oder Trojaner eingefangen hast, erstelle hier ein Thema. Ein Experte wird sich mit weiteren Anweisungen melden und Dir helfen die Malware zu entfernen oder Unerwünschte Software zu deinstallieren bzw. zu löschen. Bitte schildere dein Problem so genau wie möglich. Sollte es ein Trojaner oder Viren Problem sein wird ein Experte Dir bei der Beseitigug der Infektion helfen. |
07.10.2012, 17:32 | #1 |
| Skype Trojaner Hallo, Ich habe folgendes Problem, vor ein paar Tagen ging ja diese/r Skype meldung/Trojaner um mit dem hey sind das deine Bilder.... kennt ja jeder :/. Nun schlau wie ich war hab ich natürlich auf den Link geklickt aber nichts herunter geladen!!! und sofort Avira durchlaufen lassen (hat nichts gefunden). Danach hab ich mir malwarebytes Anti-Malware runtergeladen, dieser hat dann drei Dateien gelöscht. Hier die Dateien. C:\Users\Mustermann\Downloads\CoreTemp\coretemp_rc3_1236.exe (PUP.BundleOffers.IIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt. C:\Windows\System32\cmdow.exe (PUP.Tool) -> Erfolgreich gelöscht und in Quarantäne gestellt. D:\Programme & Treiber\CoreTemp\coretemp_rc3_1236.exe (PUP.BundleOffers.IIQ) -> Erfolgreich gelöscht und in Quarantäne gestellt. Nun hab ich ja mittlerweile sicherheitshalber alle passwörter mal abgeändert (von meinem Handy aus) und online Banking seit diesem Tag nichtmehr benutzt. Da ich viel Skype benutze bekomme ich seid geraumer zeit immer wieder die Meldung von Malwarebytes dass skype blockiert wurde, des letzte mal heute. Hier die logs dazu: 2012/10/07 08:59:36 +0200 Mustermann (null) MESSAGE Executing scheduled update: Daily 2012/10/07 08:59:42 +0200 Mustermann (null) MESSAGE Scheduled update executed successfully: database updated from version v2012.10.06.01 to version v2012.10.07.01 2012/10/07 09:00:27 +0200 Mustermann Mustermann MESSAGE Starting protection 2012/10/07 09:00:27 +0200 Mustermann Mustermann MESSAGE Protection started successfully 2012/10/07 09:00:27 +0200 Mustermann Mustermann MESSAGE Starting IP protection 2012/10/07 09:00:27 +0200 Mustermann Mustermann MESSAGE IP Protection started successfully 2012/10/07 09:00:27 +0200 Mustermann Mustermann MESSAGE Starting database refresh 2012/10/07 09:00:27 +0200 Mustermann Mustermann MESSAGE Stopping IP protection 2012/10/07 09:00:27 +0200 Mustermann Mustermann MESSAGE IP Protection stopped successfully 2012/10/07 09:00:29 +0200 Mustermann Mustermann MESSAGE Database refreshed successfully 2012/10/07 09:00:29 +0200 Mustermann Mustermann MESSAGE Starting IP protection 2012/10/07 09:00:29 +0200 Mustermann Mustermann MESSAGE IP Protection started successfully 2012/10/07 15:19:12 +0200 Mustermann Mustermann IP-BLOCK 218.10.199.29 (Type: outgoing, Port: 47674, Process: skype.exe) 2012/10/07 15:44:33 +0200 Mustermann Mustermann IP-BLOCK 212.113.45.243 (Type: outgoing, Port: 47674, Process: skype.exe) Seid dem ich auf diesen Link geklickt habe, hab ich immer wieder paar Threads gelesen. Bin aber leider nicht schlau geworden ob ich den Trojaner jetzt habe oder nicht (weil ich ja nur auf den Link geklickt habe aber nichts gedownloadet oder bestätigt hab). Avira und Maleware finden seid dem ersten Fund nix mehr, wobei Avira gar nix gefunden hat. Deinstallen von Windows wär nich schlimm hab erst vor kurzen n neues System bekommen. Danke schonmal im vorraus und hoffe natürlich dass ich den Trojaner nicht drauf habe ^^ Mfg Woerna |
08.10.2012, 15:39 | #2 |
/// TB-Ausbilder | Skype TrojanerMein Name ist Matthias und ich werde dir bei der Bereinigung deines Computers helfen. Bitte beachte folgende Hinweise:
Ohne Logdateien kann ich dir nicht sagen, ob dein Rechner infiziert ist oder nicht. Schritt 1 Lade Dir bitte OTL von Oldtimer herunter und speichere es auf Deinem Desktop (falls noch nicht vorhanden).
Code:
ATTFilter activex netsvcs msconfig drivers32 safebootminimal safebootnetwork CREATERESTOREPOINT
Schritt 2 Downloade Dir bitte defogger von jpshortstuff auf Deinem Desktop.
Klicke den Re-enable Button nicht ohne Anweisung. Schritt 3 Downloade dir bitte aswMBR.exe und speichere die Datei auf deinem Desktop.
Wichtig: Drücke keinesfalls einen der Fix Buttons ohne Anweisung Hinweis: Sollte der Scan Button ausgeblendet sein, schließe das Tool und starte es erneut. Sollte es erneut nicht klappen teile mir das bitte mit. Schritt 4 Lese bitte folgende Anweisungen genau. Wir wollen hier noch nichts "fixen" sondern nur einen Scan Report sehen. Downloade dir bitte TDSSKiller.exe und speichere diese Datei auf dem Desktop
Bitte poste mit deiner nächsten Antwort
|
08.10.2012, 17:35 | #3 |
| Skype Trojaner Hallo Matthias,
__________________danke für die schnelle Antwort! Ich habe alles soweit erledigt und hier kommen die Logs: Otl: Kann die Datei nur anhängen die is zu groß um es hier einzufügen. Otl Extra: Code:
ATTFilter OTL Extras logfile created on: 08.10.2012 17:32:24 - Run 1 OTL by OldTimer - Version 3.2.69.0 Folder = C:\Users\***\Desktop 64bit- Home Premium Edition Service Pack 1 (Version = 6.1.7601) - Type = NTWorkstation Internet Explorer (Version = 9.0.8112.16421) Locale: 00000407 | Country: Deutschland | Language: DEU | Date Format: dd.MM.yyyy 7,90 Gb Total Physical Memory | 6,32 Gb Available Physical Memory | 79,97% Memory free 15,79 Gb Paging File | 13,90 Gb Available in Paging File | 88,03% Paging File free Paging file location(s): ?:\pagefile.sys [binary data] %SystemDrive% = C: | %SystemRoot% = C:\Windows | %ProgramFiles% = C:\Program Files (x86) Drive C: | 150,16 Gb Total Space | 67,85 Gb Free Space | 45,18% Space Free | Partition Type: NTFS Drive D: | 781,25 Gb Total Space | 763,27 Gb Free Space | 97,70% Space Free | Partition Type: NTFS Computer Name: *** | User Name: *** | Logged in as Administrator. Boot Mode: Normal | Scan Mode: All users | Include 64bit Scans Company Name Whitelist: Off | Skip Microsoft Files: Off | No Company Name Whitelist: On | File Age = 30 Days ========== Extra Registry (SafeList) ========== ========== File Associations ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .url[@ = InternetShortcut] -- C:\Windows\SysNative\rundll32.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<extension>] .cpl [@ = cplfile] -- C:\Windows\SysWow64\control.exe (Microsoft Corporation) [HKEY_USERS\S-1-5-21-970831620-1735327978-479233646-1000\SOFTWARE\Classes\<extension>] .html [@ = FirefoxHTML] -- C:\Program Files (x86)\Mozilla Firefox\firefox.exe (Mozilla Corporation) ========== Shell Spawning ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) InternetShortcut [open] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\ieframe.dll",OpenURL %l (Microsoft Corporation) InternetShortcut [print] -- "C:\Windows\System32\rundll32.exe" "C:\Windows\System32\mshtml.dll",PrintHTML "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) [HKEY_LOCAL_MACHINE\SOFTWARE\Classes\<key>\shell\[command]\command] batfile [open] -- "%1" %* cmdfile [open] -- "%1" %* comfile [open] -- "%1" %* cplfile [cplopen] -- %SystemRoot%\System32\control.exe "%1",%* (Microsoft Corporation) exefile [open] -- "%1" %* helpfile [open] -- Reg Error: Key error. inffile [install] -- %SystemRoot%\System32\InfDefaultInstall.exe "%1" (Microsoft Corporation) piffile [open] -- "%1" %* regfile [merge] -- Reg Error: Key error. scrfile [config] -- "%1" scrfile [install] -- rundll32.exe desk.cpl,InstallScreenSaver %l scrfile [open] -- "%1" /S txtfile [edit] -- Reg Error: Key error. Unknown [openas] -- %SystemRoot%\system32\rundll32.exe %SystemRoot%\system32\shell32.dll,OpenAs_RunDLL %1 Directory [cmd] -- cmd.exe /s /k pushd "%V" (Microsoft Corporation) Directory [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [open] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) Folder [explore] -- Reg Error: Value error. Drive [find] -- %SystemRoot%\Explorer.exe (Microsoft Corporation) ========== Security Center Settings ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] "cval" = 1 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Monitoring] 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] "VistaSp1" = 28 4D B2 76 41 04 CA 01 [binary data] "AntiVirusOverride" = 0 "AntiSpywareOverride" = 0 "FirewallOverride" = 0 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc\Vol] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center] [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Security Center\Svc] ========== Firewall Settings ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\DomainProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\StandardProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\PublicProfile] "EnableFirewall" = 1 "DisableNotifications" = 0 ========== Authorized Applications List ========== ========== Vista Active Open Ports Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] ========== Vista Active Application Exception List ========== [HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Services\SharedAccess\Parameters\FirewallPolicy\FirewallRules] "{0AA4C28D-0647-40FA-9BEC-3FD9BF9DB201}" = dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{1904AEFD-0473-4CA4-BC97-CABB78896C34}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{2EAC8F9B-5DE8-46CA-A16F-9E5C199AA37A}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | "{31804BCC-2C45-49C8-800C-30C8EB21F09D}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{31C47021-C0DD-4E3D-98F4-565FD395BE04}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steam.exe | "{401A2FCB-A231-48F9-A64D-CCD3CCFDA821}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{409A422C-2570-444A-9A3B-F220C6DD77E8}" = protocol=6 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | "{45A9DF14-B552-48E9-81B8-F9508A91E761}" = dir=in | app=c:\program files (x86)\skype\phone\skype.exe | "{62BB7594-D5C0-410B-ABBA-112472047528}" = protocol=6 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | "{67DA2724-9B85-4017-8822-CE7C83AC9696}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | "{711CA91E-735F-4FBE-AE3A-BF5B1497D05F}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{744336EA-1BE2-4674-8E6C-82D57A743312}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | "{84B67FB0-A457-4FEC-A778-5D9E3B291F2F}" = protocol=17 | dir=in | app=c:\program files (x86)\origin games\battlefield 3\bf3.exe | "{9331B291-3C0C-4BB5-BC01-9644A0B9A15F}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1040\agent.exe | "{A63C362D-3B4A-4A87-9D1A-C2B28B469FE5}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstrb.exe | "{B7E86C88-CC73-4628-8079-58CF297F812A}" = protocol=17 | dir=in | app=c:\program files (x86)\battlelog web plugins\sonar\0.70.4\sonarhost.exe | "{C29A3CA1-185F-46ED-8702-0083E6177911}" = protocol=17 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | "{C3D4C030-51DF-4CEC-A43D-54CEC942642E}" = protocol=6 | dir=in | app=c:\programdata\battle.net\agent\agent.1267\agent.exe | "{D138DE0B-E31E-444C-9F37-5FEB758027FB}" = protocol=17 | dir=in | app=c:\programdata\battle.net\agent\agent.1363\agent.exe | "{DAF03F56-258E-4AEE-9A6C-CEADF2CF605B}" = protocol=17 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{EB559C25-F4EF-4AA2-B565-279A70C1C86A}" = protocol=6 | dir=in | app=c:\program files (x86)\pando networks\media booster\pmb.exe | "{F040267B-F61B-44FD-84CC-81570A9E3DE8}" = protocol=6 | dir=in | app=c:\program files (x86)\steam\steamapps\common\counter-strike global offensive\csgo.exe | "{F0A63537-C791-4628-80E3-2DD7576072F2}" = protocol=17 | dir=in | app=c:\program files (x86)\steam\steam.exe | "{FBDF8B56-4F1A-41BE-9FAF-CB5C88939430}" = protocol=6 | dir=in | app=c:\windows\syswow64\pnkbstra.exe | ========== HKEY_LOCAL_MACHINE Uninstall List ========== 64bit: [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{09536BA1-E498-4CC3-B834-D884A67D7E34}" = Intel® Trusted Connect Service Client "{0E3DAF3D-FF69-345A-A99E-1FED304CA083}" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "{23170F69-40C1-2702-0922-000001000000}" = 7-Zip 9.22 (x64 edition) "{26A24AE4-039D-4CA4-87B4-2F86417007FF}" = Java 7 Update 7 (64-bit) "{54F8B6C7-9B25-4E85-A1E0-26CFB80DE787}" = Intel(R) Smart Connect Technology 2.0 x64 "{5FCE6D76-F5DC-37AB-B2B8-22AB8CEDB1D4}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.6161 "{8220EEFE-38CD-377E-8595-13398D740ACE}" = Microsoft Visual C++ 2008 Redistributable - x64 9.0.30729.17 "{89F4137D-6C26-4A84-BDB8-2E5A4BB71E00}" = Microsoft Silverlight "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.3DVision" = NVIDIA 3D Vision Treiber 306.23 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.ControlPanel" = NVIDIA Systemsteuerung 306.23 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Driver" = NVIDIA Grafiktreiber 306.23 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.NVIRUSB" = NVIDIA 3D Vision Controller-Treiber 306.23 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.PhysX" = NVIDIA PhysX-Systemsoftware 9.12.0604 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_Display.Update" = NVIDIA Update 1.10.8 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_HDAudio.Driver" = NVIDIA HD-Audiotreiber 1.3.18.0 "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_installer" = NVIDIA Install Application "{B2FE1952-0186-46C3-BAEC-A80AA35AC5B8}_NVIDIA.Update" = NVIDIA Update Components "{DA5E371C-6333-3D8A-93A4-6FD5B20BCC6E}" = Microsoft Visual C++ 2010 x64 Redistributable - 10.0.30319 "{F5B09CFD-F0B2-36AF-8DF4-1DF6B63FC7B4}" = Microsoft .NET Framework 4 Client Profile "ASRock App Charger_is1" = ASRock App Charger v1.0.5 "CCleaner" = CCleaner "Microsoft .NET Framework 4 Client Profile" = Microsoft .NET Framework 4 Client Profile "Microsoft .NET Framework 4 Client Profile DEU Language Pack" = Microsoft .NET Framework 4 Client Profile DEU Language Pack "TeamSpeak 3 Client" = TeamSpeak 3 Client "ZoneAlarm LTD Toolbar" = ZoneAlarm LTD Toolbar [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Uninstall] "{048298C9-A4D3-490B-9FF9-AB023A9238F3}" = Steam "{240C3DDD-C5E9-4029-9DF7-95650D040CF2}" = Intel(R) USB 3.0 eXtensible Host Controller Driver "{2FDD750F-49B7-40C1-9D5E-D2955BC0E2D8}" = NVIDIA PhysX "{3E29EE6C-963A-4aae-86C1-DC237C4A49FC}" = Intel(R) Rapid Storage Technology "{61942EF5-2CD8-47D4-869C-2E9A8BB085F1}" = Asmedia ASM106x SATA Host Controller Driver "{65153EA5-8B6E-43B6-857B-C6E4FC25798A}" = Intel(R) Management Engine Components "{6F03FF16-24BF-4887-9EBA-280CF7657A54}" = COMPUTERBILD-Abzockschutz "{76285C16-411A-488A-BCE3-C83CB933D8CF}" = Battlefield 3™ "{8833FFB6-5B0C-4764-81AA-06DFEED9A476}" = Realtek Ethernet Controller Driver "{90110407-6000-11D3-8CFE-0150048383C9}" = Microsoft Office Professional Edition 2003 "{90140000-2005-0000-0000-0000000FF1CE}" = Microsoft Office File Validation Add-In "{92606477-9366-4D3B-8AE3-6BE4B29727AB}" = League of Legends "{980A182F-E0A2-4A40-94C1-AE0C1235902E}" = Pando Media Booster "{9A25302D-30C0-39D9-BD6F-21E6EC160475}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.17 "{9BE518E6-ECC6-35A9-88E4-87755C07200F}" = Microsoft Visual C++ 2008 Redistributable - x86 9.0.30729.6161 "{A6C48A9F-694A-4234-B3AA-62590B668927}" = Intel(R) Manageability Engine Firmware Recovery Agent "{AC76BA86-7AD7-1031-7B44-AA1000000001}" = Adobe Reader X (10.1.4) - Deutsch "{EE7257A2-39A2-4D2F-9DAC-F9F25B8AE1D8}" = Skype™ 5.10 "{F0C3E5D1-1ADE-321E-8167-68EF0DE699A5}" = Microsoft Visual C++ 2010 x86 Redistributable - 10.0.40219 "{F0E3AD40-2BBD-4360-9C76-B9AC9A5886EA}" = Intel(R) Processor Graphics "{F132AF7F-7BCA-4EDE-8A7C-958108FE7DBC}" = Realtek High Definition Audio Driver "{F40BBEC7-C2A4-4A00-9B24-7A055A2C5262}" = Microsoft Office Live Add-in 1.5 "{F8A9085D-4C7A-41a9-8A77-C8998A96C421}" = Intel(R) Control Center "{FCB3772C-B7D0-4933-B1A9-3707EBACC573}" = Intel(R) OpenCL CPU Runtime "Adobe Flash Player Plugin" = Adobe Flash Player 11 Plugin "Avira AntiVir Desktop" = Avira Free Antivirus "Battlelog Web Plugins" = Battlelog Web Plugins "ESN Sonar-0.70.4" = ESN Sonar "KLiteCodecPack_is1" = K-Lite Codec Pack 9.2.0 (Full) "Malwarebytes' Anti-Malware_is1" = Malwarebytes Anti-Malware Version 1.65.0.1400 "Mozilla Firefox 15.0.1 (x86 de)" = Mozilla Firefox 15.0.1 (x86 de) "MozillaMaintenanceService" = Mozilla Maintenance Service "NVIDIAStereo" = NVIDIA Stereoscopic 3D Driver "Origin" = Origin "PunkBusterSvc" = PunkBuster Services "Steam App 10" = Counter-Strike "Steam App 730" = Counter-Strike: Global Offensive "World of Warcraft" = World of Warcraft ========== Last 20 Event Log Errors ========== [ Application Events ] Error - 06.10.2012 12:26:27 | Computer Name = *** | Source = ISCT Agent | ID = 1003 Description = Error - 06.10.2012 12:28:11 | Computer Name = *** | Source = WinMgmt | ID = 10 Description = Error - 07.10.2012 02:59:34 | Computer Name = *** | Source = ISCT Agent | ID = 1003 Description = Error - 07.10.2012 03:01:18 | Computer Name = *** | Source = WinMgmt | ID = 10 Description = Error - 07.10.2012 16:22:02 | Computer Name = *** | Source = ISCT Agent | ID = 1003 Description = Error - 07.10.2012 16:23:47 | Computer Name = *** | Source = WinMgmt | ID = 10 Description = Error - 08.10.2012 05:23:37 | Computer Name = *** | Source = ISCT Agent | ID = 1003 Description = Error - 08.10.2012 05:25:20 | Computer Name = *** | Source = WinMgmt | ID = 10 Description = Error - 08.10.2012 09:10:16 | Computer Name = *** | Source = ISCT Agent | ID = 1003 Description = Error - 08.10.2012 09:11:59 | Computer Name = *** | Source = WinMgmt | ID = 10 Description = [ System Events ] Error - 15.09.2012 10:52:00 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7034 Description = Dienst "Intel(R) Management and Security Application User Notification Service" wurde unerwartet beendet. Dies ist bereits 1 Mal passiert. Error - 15.09.2012 10:53:13 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7023 Description = Der Dienst "Windows Modules Installer" wurde mit folgendem Fehler beendet: %%16405 Error - 15.09.2012 10:56:08 | Computer Name = ***-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 Description = Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80242016 fehlgeschlagen: Sicherheitsupdate für Internet Explorer 8 unter Windows 7 für x64-basierte Systeme (KB2544521) Error - 15.09.2012 10:56:08 | Computer Name = ***-PC | Source = Microsoft-Windows-WindowsUpdateClient | ID = 20 Description = Installationsfehler: Die Installation des folgenden Updates ist mit Fehler 0x80242016 fehlgeschlagen: Update für die Kompatibilitätsansichtsliste für Internet Explorer*8 für Windows 7 für x64-basierte Systeme (KB2598845) Error - 15.09.2012 11:30:12 | Computer Name = ***-PC | Source = Ntfs | ID = 262281 Description = Auf dem Volume "G:" konnte der Transaktionsressourcen-Manager aufgrund eines nicht wiederholbaren Fehlers nicht gestartet werden. Der Fehlercode ist in den Daten enthalten. Error - 16.09.2012 07:34:55 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7009 Description = Das Zeitlimit (30000 ms) wurde beim Verbindungsversuch mit dem Dienst Steam Client Service erreicht. Error - 16.09.2012 07:34:55 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7000 Description = Der Dienst "Steam Client Service" wurde aufgrund folgenden Fehlers nicht gestartet: %%1053 Error - 17.09.2012 13:22:38 | Computer Name = ***-PC | Source = Service Control Manager | ID = 7030 Description = Der Dienst "TrueVector Internet Monitor" ist als interaktiver Dienst gekennzeichnet. Das System wurde jedoch so konfiguriert, dass interaktive Dienste nicht möglich sind. Der Dienst wird möglicherweise nicht richtig funktionieren. Error - 18.09.2012 05:43:52 | Computer Name = *** | Source = volsnap | ID = 393252 Description = Die Schattenkopien von Volume "C:" wurden abgebrochen, weil der Schattenkopiespeicher nicht auf ein benutzerdefiniertes Limit vergrößert werden konnte. Error - 20.09.2012 06:00:38 | Computer Name = *** | Source = EventLog | ID = 6008 Description = Das System wurde zuvor am ?20.?09.?2012 um 11:56:38 unerwartet heruntergefahren. < End of report > aswMBR: Code:
ATTFilter aswMBR version 0.9.9.1665 Copyright(c) 2011 AVAST Software Run date: 2012-10-08 17:42:30 ----------------------------- 17:42:30.145 OS Version: Windows x64 6.1.7601 Service Pack 1 17:42:30.145 Number of processors: 4 586 0x3A09 17:42:30.146 ComputerName: *** UserName: 17:42:30.574 Initialize success 17:44:08.976 AVAST engine defs: 12100800 17:44:35.362 Disk 0 (boot) \Device\Harddisk0\DR0 -> \Device\Ide\IAAStorageDevice-1 17:44:35.363 Disk 0 Vendor: ST1000DM 1AJ1 Size: 953869MB BusType: 3 17:44:35.372 Disk 0 MBR read successfully 17:44:35.373 Disk 0 MBR scan 17:44:35.376 Disk 0 Windows 7 default MBR code 17:44:35.386 Disk 0 Partition 1 80 (A) 07 HPFS/NTFS NTFS 100 MB offset 2048 17:44:35.392 Disk 0 Partition 2 00 07 HPFS/NTFS NTFS 153767 MB offset 206848 17:44:35.410 Disk 0 Partition 3 00 07 HPFS/NTFS NTFS 799999 MB offset 315121664 17:44:35.435 Disk 0 scanning C:\Windows\system32\drivers 17:44:40.599 Service scanning 17:44:52.173 Modules scanning 17:44:52.177 Disk 0 trace - called modules: 17:44:52.188 ntoskrnl.exe CLASSPNP.SYS disk.sys ACPI.sys iaStor.sys hal.dll 17:44:52.512 1 nt!IofCallDriver -> \Device\Harddisk0\DR0[0xfffffa8009d77060] 17:44:52.515 3 CLASSPNP.SYS[fffff8800147543f] -> nt!IofCallDriver -> [0xfffffa800747b980] 17:44:52.517 5 ACPI.sys[fffff88000fb37a1] -> nt!IofCallDriver -> \Device\Ide\IAAStorageDevice-1[0xfffffa800747e050] 17:44:52.891 AVAST engine scan C:\Windows 17:44:53.761 AVAST engine scan C:\Windows\system32 17:46:29.229 AVAST engine scan C:\Windows\system32\drivers 17:46:35.134 AVAST engine scan C:\Users\*** 17:46:53.869 AVAST engine scan C:\ProgramData 17:47:05.717 Scan finished successfully 17:47:31.211 Disk 0 MBR has been saved successfully to "C:\Users\***\Desktop\MBR.dat" 17:47:31.213 The log file has been saved successfully to "C:\Users\***\Desktop\aswMBR.txt" TDSSKiller: Code:
ATTFilter 17:49:14.0324 3276 TDSS rootkit removing tool 2.8.10.0 Sep 17 2012 19:23:24 17:49:14.0511 3276 ============================================================ 17:49:14.0511 3276 Current date / time: 2012/10/08 17:49:14.0511 17:49:14.0511 3276 SystemInfo: 17:49:14.0511 3276 17:49:14.0511 3276 OS Version: 6.1.7601 ServicePack: 1.0 17:49:14.0511 3276 Product type: Workstation 17:49:14.0511 3276 ComputerName: *** 17:49:14.0511 3276 UserName: *** 17:49:14.0511 3276 Windows directory: C:\Windows 17:49:14.0511 3276 System windows directory: C:\Windows 17:49:14.0511 3276 Running under WOW64 17:49:14.0511 3276 Processor architecture: Intel x64 17:49:14.0511 3276 Number of processors: 4 17:49:14.0511 3276 Page size: 0x1000 17:49:14.0511 3276 Boot type: Normal boot 17:49:14.0511 3276 ============================================================ 17:49:14.0786 3276 Drive \Device\Harddisk0\DR0 - Size: 0xE8E0DB6000 (931.51 Gb), SectorSize: 0x200, Cylinders: 0x1DB01, SectorsPerTrack: 0x3F, TracksPerCylinder: 0xFF, Type 'K0', Flags 0x00000040 17:49:14.0793 3276 ============================================================ 17:49:14.0793 3276 \Device\Harddisk0\DR0: 17:49:14.0793 3276 MBR partitions: 17:49:14.0793 3276 \Device\Harddisk0\DR0\Partition1: MBR, Type 0x7, StartLBA 0x800, BlocksNum 0x32000 17:49:14.0793 3276 \Device\Harddisk0\DR0\Partition2: MBR, Type 0x7, StartLBA 0x32800, BlocksNum 0x12C53800 17:49:14.0793 3276 \Device\Harddisk0\DR0\Partition3: MBR, Type 0x7, StartLBA 0x12C86000, BlocksNum 0x61A7F800 17:49:14.0793 3276 ============================================================ 17:49:14.0814 3276 C: <-> \Device\Harddisk0\DR0\Partition2 17:49:14.0842 3276 D: <-> \Device\Harddisk0\DR0\Partition3 17:49:14.0842 3276 ============================================================ 17:49:14.0842 3276 Initialize success 17:49:14.0842 3276 ============================================================ 17:49:26.0070 4856 ============================================================ 17:49:26.0070 4856 Scan started 17:49:26.0070 4856 Mode: Manual; 17:49:26.0070 4856 ============================================================ 17:49:26.0269 4856 ================ Scan system memory ======================== 17:49:26.0269 4856 System memory - ok 17:49:26.0269 4856 ================ Scan services ============================= 17:49:26.0389 4856 [ A87D604AEA360176311474C87A63BB88 ] 1394ohci C:\Windows\system32\drivers\1394ohci.sys 17:49:26.0390 4856 1394ohci - ok 17:49:26.0416 4856 [ D81D9E70B8A6DD14D42D7B4EFA65D5F2 ] ACPI C:\Windows\system32\drivers\ACPI.sys 17:49:26.0418 4856 ACPI - ok 17:49:26.0426 4856 [ 99F8E788246D495CE3794D7E7821D2CA ] AcpiPmi C:\Windows\system32\drivers\acpipmi.sys 17:49:26.0426 4856 AcpiPmi - ok 17:49:26.0508 4856 [ D19C4EE2AC7C47B8F5F84FFF1A789D8A ] AdobeARMservice C:\Program Files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe 17:49:26.0508 4856 AdobeARMservice - ok 17:49:26.0566 4856 [ B2B64AF436FACCFA854DD397027C5360 ] AdobeFlashPlayerUpdateSvc C:\Windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe 17:49:26.0567 4856 AdobeFlashPlayerUpdateSvc - ok 17:49:26.0581 4856 [ 2F6B34B83843F0C5118B63AC634F5BF4 ] adp94xx C:\Windows\system32\drivers\adp94xx.sys 17:49:26.0585 4856 adp94xx - ok 17:49:26.0597 4856 [ 597F78224EE9224EA1A13D6350CED962 ] adpahci C:\Windows\system32\drivers\adpahci.sys 17:49:26.0599 4856 adpahci - ok 17:49:26.0608 4856 [ E109549C90F62FB570B9540C4B148E54 ] adpu320 C:\Windows\system32\drivers\adpu320.sys 17:49:26.0609 4856 adpu320 - ok 17:49:26.0626 4856 [ 4B78B431F225FD8624C5655CB1DE7B61 ] AeLookupSvc C:\Windows\System32\aelupsvc.dll 17:49:26.0626 4856 AeLookupSvc - ok 17:49:26.0652 4856 [ 1C7857B62DE5994A75B054A9FD4C3825 ] AFD C:\Windows\system32\drivers\afd.sys 17:49:26.0655 4856 AFD - ok 17:49:26.0664 4856 [ 608C14DBA7299D8CB6ED035A68A15799 ] agp440 C:\Windows\system32\drivers\agp440.sys 17:49:26.0664 4856 agp440 - ok 17:49:26.0667 4856 [ 3290D6946B5E30E70414990574883DDB ] ALG C:\Windows\System32\alg.exe 17:49:26.0667 4856 ALG - ok 17:49:26.0689 4856 [ 5812713A477A3AD7363C7438CA2EE038 ] aliide C:\Windows\system32\drivers\aliide.sys 17:49:26.0689 4856 aliide - ok 17:49:26.0742 4856 ALSysIO - ok 17:49:26.0751 4856 [ 1FF8B4431C353CE385C875F194924C0C ] amdide C:\Windows\system32\drivers\amdide.sys 17:49:26.0752 4856 amdide - ok 17:49:26.0754 4856 [ 7024F087CFF1833A806193EF9D22CDA9 ] AmdK8 C:\Windows\system32\drivers\amdk8.sys 17:49:26.0754 4856 AmdK8 - ok 17:49:26.0756 4856 [ 1E56388B3FE0D031C44144EB8C4D6217 ] AmdPPM C:\Windows\system32\drivers\amdppm.sys 17:49:26.0756 4856 AmdPPM - ok 17:49:26.0779 4856 [ D4121AE6D0C0E7E13AA221AA57EF2D49 ] amdsata C:\Windows\system32\drivers\amdsata.sys 17:49:26.0779 4856 amdsata - ok 17:49:26.0803 4856 [ F67F933E79241ED32FF46A4F29B5120B ] amdsbs C:\Windows\system32\drivers\amdsbs.sys 17:49:26.0804 4856 amdsbs - ok 17:49:26.0814 4856 [ 540DAF1CEA6094886D72126FD7C33048 ] amdxata C:\Windows\system32\drivers\amdxata.sys 17:49:26.0814 4856 amdxata - ok 17:49:26.0874 4856 [ 466A0D95960DAD3222C896D2CEA99993 ] AntiVirSchedulerService C:\Program Files (x86)\Avira\AntiVir Desktop\sched.exe 17:49:26.0875 4856 AntiVirSchedulerService - ok 17:49:26.0894 4856 [ A489BE6BB0AA1FF406B488B60542314B ] AntiVirService C:\Program Files (x86)\Avira\AntiVir Desktop\avguard.exe 17:49:26.0895 4856 AntiVirService - ok 17:49:26.0910 4856 [ 89A69C3F2F319B43379399547526D952 ] AppID C:\Windows\system32\drivers\appid.sys 17:49:26.0911 4856 AppID - ok 17:49:26.0919 4856 [ 0BC381A15355A3982216F7172F545DE1 ] AppIDSvc C:\Windows\System32\appidsvc.dll 17:49:26.0919 4856 AppIDSvc - ok 17:49:26.0930 4856 [ 3977D4A871CA0D4F2ED1E7DB46829731 ] Appinfo C:\Windows\System32\appinfo.dll 17:49:26.0930 4856 Appinfo - ok 17:49:26.0943 4856 [ C484F8CEB1717C540242531DB7845C4E ] arc C:\Windows\system32\drivers\arc.sys 17:49:26.0944 4856 arc - ok 17:49:26.0946 4856 [ 019AF6924AEFE7839F61C830227FE79C ] arcsas C:\Windows\system32\drivers\arcsas.sys 17:49:26.0947 4856 arcsas - ok 17:49:26.0976 4856 [ 4DFF4312661F54EE87DC9A13CAEE60E0 ] asahci64 C:\Windows\system32\DRIVERS\asahci64.sys 17:49:26.0976 4856 asahci64 - ok 17:49:26.0993 4856 [ E1AFEE1584C74050DE0DD16DE2A54BF3 ] AsrAppCharger C:\Windows\system32\DRIVERS\AsrAppCharger.sys 17:49:26.0994 4856 AsrAppCharger - ok 17:49:27.0007 4856 [ 769765CE2CC62867468CEA93969B2242 ] AsyncMac C:\Windows\system32\DRIVERS\asyncmac.sys 17:49:27.0008 4856 AsyncMac - ok 17:49:27.0018 4856 [ 02062C0B390B7729EDC9E69C680A6F3C ] atapi C:\Windows\system32\drivers\atapi.sys 17:49:27.0018 4856 atapi - ok 17:49:27.0031 4856 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioEndpointBuilder C:\Windows\System32\Audiosrv.dll 17:49:27.0035 4856 AudioEndpointBuilder - ok 17:49:27.0042 4856 [ F23FEF6D569FCE88671949894A8BECF1 ] AudioSrv C:\Windows\System32\Audiosrv.dll 17:49:27.0044 4856 AudioSrv - ok 17:49:27.0057 4856 [ 26E38B5A58C6C55FAFBC563EEDDB0867 ] avgntflt C:\Windows\system32\DRIVERS\avgntflt.sys 17:49:27.0057 4856 avgntflt - ok 17:49:27.0112 4856 [ 9D1F00BEFF84CBBF46D7F052BC7E0565 ] avipbb C:\Windows\system32\DRIVERS\avipbb.sys 17:49:27.0113 4856 avipbb - ok 17:49:27.0125 4856 [ 248DB59FC86DE44D2779F4C7FB1A567D ] avkmgr C:\Windows\system32\DRIVERS\avkmgr.sys 17:49:27.0126 4856 avkmgr - ok 17:49:27.0147 4856 [ A6BF31A71B409DFA8CAC83159E1E2AFF ] AxInstSV C:\Windows\System32\AxInstSV.dll 17:49:27.0148 4856 AxInstSV - ok 17:49:27.0169 4856 [ 3E5B191307609F7514148C6832BB0842 ] b06bdrv C:\Windows\system32\drivers\bxvbda.sys 17:49:27.0172 4856 b06bdrv - ok 17:49:27.0185 4856 [ B5ACE6968304A3900EEB1EBFD9622DF2 ] b57nd60a C:\Windows\system32\DRIVERS\b57nd60a.sys 17:49:27.0186 4856 b57nd60a - ok 17:49:27.0196 4856 [ FDE360167101B4E45A96F939F388AEB0 ] BDESVC C:\Windows\System32\bdesvc.dll 17:49:27.0197 4856 BDESVC - ok 17:49:27.0219 4856 [ 16A47CE2DECC9B099349A5F840654746 ] Beep C:\Windows\system32\drivers\Beep.sys 17:49:27.0219 4856 Beep - ok 17:49:27.0253 4856 [ 82974D6A2FD19445CC5171FC378668A4 ] BFE C:\Windows\System32\bfe.dll 17:49:27.0258 4856 BFE - ok 17:49:27.0292 4856 [ 1EA7969E3271CBC59E1730697DC74682 ] BITS C:\Windows\System32\qmgr.dll 17:49:27.0299 4856 BITS - ok 17:49:27.0310 4856 [ 61583EE3C3A17003C4ACD0475646B4D3 ] blbdrive C:\Windows\system32\DRIVERS\blbdrive.sys 17:49:27.0310 4856 blbdrive - ok 17:49:27.0345 4856 [ 6C02A83164F5CC0A262F4199F0871CF5 ] bowser C:\Windows\system32\DRIVERS\bowser.sys 17:49:27.0345 4856 bowser - ok 17:49:27.0347 4856 [ F09EEE9EDC320B5E1501F749FDE686C8 ] BrFiltLo C:\Windows\system32\drivers\BrFiltLo.sys 17:49:27.0347 4856 BrFiltLo - ok 17:49:27.0349 4856 [ B114D3098E9BDB8BEA8B053685831BE6 ] BrFiltUp C:\Windows\system32\drivers\BrFiltUp.sys 17:49:27.0349 4856 BrFiltUp - ok 17:49:27.0365 4856 [ 05F5A0D14A2EE1D8255C2AA0E9E8E694 ] Browser C:\Windows\System32\browser.dll 17:49:27.0366 4856 Browser - ok 17:49:27.0391 4856 [ 43BEA8D483BF1870F018E2D02E06A5BD ] Brserid C:\Windows\System32\Drivers\Brserid.sys 17:49:27.0393 4856 Brserid - ok 17:49:27.0395 4856 [ A6ECA2151B08A09CACECA35C07F05B42 ] BrSerWdm C:\Windows\System32\Drivers\BrSerWdm.sys 17:49:27.0395 4856 BrSerWdm - ok 17:49:27.0397 4856 [ B79968002C277E869CF38BD22CD61524 ] BrUsbMdm C:\Windows\System32\Drivers\BrUsbMdm.sys 17:49:27.0397 4856 BrUsbMdm - ok 17:49:27.0406 4856 [ A87528880231C54E75EA7A44943B38BF ] BrUsbSer C:\Windows\System32\Drivers\BrUsbSer.sys 17:49:27.0407 4856 BrUsbSer - ok 17:49:27.0409 4856 [ 9DA669F11D1F894AB4EB69BF546A42E8 ] BTHMODEM C:\Windows\system32\drivers\bthmodem.sys 17:49:27.0409 4856 BTHMODEM - ok 17:49:27.0433 4856 [ 95F9C2976059462CBBF227F7AAB10DE9 ] bthserv C:\Windows\system32\bthserv.dll 17:49:27.0434 4856 bthserv - ok 17:49:27.0447 4856 [ B8BD2BB284668C84865658C77574381A ] cdfs C:\Windows\system32\DRIVERS\cdfs.sys 17:49:27.0448 4856 cdfs - ok 17:49:27.0460 4856 [ F036CE71586E93D94DAB220D7BDF4416 ] cdrom C:\Windows\system32\DRIVERS\cdrom.sys 17:49:27.0461 4856 cdrom - ok 17:49:27.0477 4856 [ F17D1D393BBC69C5322FBFAFACA28C7F ] CertPropSvc C:\Windows\System32\certprop.dll 17:49:27.0478 4856 CertPropSvc - ok 17:49:27.0479 4856 [ D7CD5C4E1B71FA62050515314CFB52CF ] circlass C:\Windows\system32\drivers\circlass.sys 17:49:27.0480 4856 circlass - ok 17:49:27.0495 4856 [ FE1EC06F2253F691FE36217C592A0206 ] CLFS C:\Windows\system32\CLFS.sys 17:49:27.0497 4856 CLFS - ok 17:49:27.0542 4856 [ D88040F816FDA31C3B466F0FA0918F29 ] clr_optimization_v2.0.50727_32 C:\Windows\Microsoft.NET\Framework\v2.0.50727\mscorsvw.exe 17:49:27.0542 4856 clr_optimization_v2.0.50727_32 - ok 17:49:27.0572 4856 [ D1CEEA2B47CB998321C579651CE3E4F8 ] clr_optimization_v2.0.50727_64 C:\Windows\Microsoft.NET\Framework64\v2.0.50727\mscorsvw.exe 17:49:27.0573 4856 clr_optimization_v2.0.50727_64 - ok 17:49:27.0621 4856 [ C5A75EB48E2344ABDC162BDA79E16841 ] clr_optimization_v4.0.30319_32 C:\Windows\Microsoft.NET\Framework\v4.0.30319\mscorsvw.exe 17:49:27.0621 4856 clr_optimization_v4.0.30319_32 - ok 17:49:27.0641 4856 [ C6F9AF94DCD58122A4D7E89DB6BED29D ] clr_optimization_v4.0.30319_64 C:\Windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe 17:49:27.0641 4856 clr_optimization_v4.0.30319_64 - ok 17:49:27.0652 4856 [ 0840155D0BDDF1190F84A663C284BD33 ] CmBatt C:\Windows\system32\drivers\CmBatt.sys 17:49:27.0652 4856 CmBatt - ok 17:49:27.0659 4856 [ E19D3F095812725D88F9001985B94EDD ] cmdide C:\Windows\system32\drivers\cmdide.sys 17:49:27.0659 4856 cmdide - ok 17:49:27.0684 4856 [ 9AC4F97C2D3E93367E2148EA940CD2CD ] CNG C:\Windows\system32\Drivers\cng.sys 17:49:27.0687 4856 CNG - ok 17:49:27.0700 4856 [ 102DE219C3F61415F964C88E9085AD14 ] Compbatt C:\Windows\system32\drivers\compbatt.sys 17:49:27.0700 4856 Compbatt - ok 17:49:27.0715 4856 [ 03EDB043586CCEBA243D689BDDA370A8 ] CompositeBus C:\Windows\system32\DRIVERS\CompositeBus.sys 17:49:27.0715 4856 CompositeBus - ok 17:49:27.0717 4856 COMSysApp - ok 17:49:27.0749 4856 [ AA7A157729FB504E1EED535F2F6AD1C0 ] cphs C:\Windows\SysWow64\IntelCpHeciSvc.exe 17:49:27.0751 4856 cphs - ok 17:49:27.0760 4856 [ 1C827878A998C18847245FE1F34EE597 ] crcdisk C:\Windows\system32\drivers\crcdisk.sys 17:49:27.0760 4856 crcdisk - ok 17:49:27.0792 4856 [ 4F5414602E2544A4554D95517948B705 ] CryptSvc C:\Windows\system32\cryptsvc.dll 17:49:27.0793 4856 CryptSvc - ok 17:49:27.0813 4856 [ 5C627D1B1138676C0A7AB2C2C190D123 ] DcomLaunch C:\Windows\system32\rpcss.dll 17:49:27.0817 4856 DcomLaunch - ok 17:49:27.0845 4856 [ 3CEC7631A84943677AA8FA8EE5B6B43D ] defragsvc C:\Windows\System32\defragsvc.dll 17:49:27.0846 4856 defragsvc - ok 17:49:27.0854 4856 [ 9BB2EF44EAA163B29C4A4587887A0FE4 ] DfsC C:\Windows\system32\Drivers\dfsc.sys 17:49:27.0855 4856 DfsC - ok 17:49:27.0872 4856 [ 43D808F5D9E1A18E5EEB5EBC83969E4E ] Dhcp C:\Windows\system32\dhcpcore.dll 17:49:27.0874 4856 Dhcp - ok 17:49:27.0880 4856 [ 13096B05847EC78F0977F2C0F79E9AB3 ] discache C:\Windows\system32\drivers\discache.sys 17:49:27.0881 4856 discache - ok 17:49:27.0907 4856 [ 9819EEE8B5EA3784EC4AF3B137A5244C ] Disk C:\Windows\system32\drivers\disk.sys 17:49:27.0907 4856 Disk - ok 17:49:27.0922 4856 [ 16835866AAA693C7D7FCEBA8FFF706E4 ] Dnscache C:\Windows\System32\dnsrslvr.dll 17:49:27.0923 4856 Dnscache - ok 17:49:27.0940 4856 [ B1FB3DDCA0FDF408750D5843591AFBC6 ] dot3svc C:\Windows\System32\dot3svc.dll 17:49:27.0941 4856 dot3svc - ok 17:49:27.0944 4856 [ B26F4F737E8F9DF4F31AF6CF31D05820 ] DPS C:\Windows\system32\dps.dll 17:49:27.0945 4856 DPS - ok 17:49:27.0963 4856 [ 9B19F34400D24DF84C858A421C205754 ] drmkaud C:\Windows\system32\drivers\drmkaud.sys 17:49:27.0963 4856 drmkaud - ok 17:49:27.0990 4856 [ F5BEE30450E18E6B83A5012C100616FD ] DXGKrnl C:\Windows\System32\drivers\dxgkrnl.sys 17:49:27.0994 4856 DXGKrnl - ok 17:49:28.0015 4856 [ E2DDA8726DA9CB5B2C4000C9018A9633 ] EapHost C:\Windows\System32\eapsvc.dll 17:49:28.0015 4856 EapHost - ok 17:49:28.0058 4856 [ DC5D737F51BE844D8C82C695EB17372F ] ebdrv C:\Windows\system32\drivers\evbda.sys 17:49:28.0082 4856 ebdrv - ok 17:49:28.0091 4856 [ C118A82CD78818C29AB228366EBF81C3 ] EFS C:\Windows\System32\lsass.exe 17:49:28.0092 4856 EFS - ok 17:49:28.0132 4856 [ C4002B6B41975F057D98C439030CEA07 ] ehRecvr C:\Windows\ehome\ehRecvr.exe 17:49:28.0135 4856 ehRecvr - ok 17:49:28.0160 4856 [ 4705E8EF9934482C5BB488CE28AFC681 ] ehSched C:\Windows\ehome\ehsched.exe 17:49:28.0160 4856 ehSched - ok 17:49:28.0184 4856 [ 0E5DA5369A0FCAEA12456DD852545184 ] elxstor C:\Windows\system32\drivers\elxstor.sys 17:49:28.0188 4856 elxstor - ok 17:49:28.0203 4856 [ 34A3C54752046E79A126E15C51DB409B ] ErrDev C:\Windows\system32\drivers\errdev.sys 17:49:28.0203 4856 ErrDev - ok 17:49:28.0223 4856 [ 4166F82BE4D24938977DD1746BE9B8A0 ] EventSystem C:\Windows\system32\es.dll 17:49:28.0226 4856 EventSystem - ok 17:49:28.0229 4856 [ A510C654EC00C1E9BDD91EEB3A59823B ] exfat C:\Windows\system32\drivers\exfat.sys 17:49:28.0230 4856 exfat - ok 17:49:28.0233 4856 [ 0ADC83218B66A6DB380C330836F3E36D ] fastfat C:\Windows\system32\drivers\fastfat.sys 17:49:28.0234 4856 fastfat - ok 17:49:28.0291 4856 [ DBEFD454F8318A0EF691FDD2EAAB44EB ] Fax C:\Windows\system32\fxssvc.exe 17:49:28.0296 4856 Fax - ok 17:49:28.0298 4856 [ D765D19CD8EF61F650C384F62FAC00AB ] fdc C:\Windows\system32\drivers\fdc.sys 17:49:28.0298 4856 fdc - ok 17:49:28.0320 4856 [ 0438CAB2E03F4FB61455A7956026FE86 ] fdPHost C:\Windows\system32\fdPHost.dll 17:49:28.0320 4856 fdPHost - ok 17:49:28.0332 4856 [ 802496CB59A30349F9A6DD22D6947644 ] FDResPub C:\Windows\system32\fdrespub.dll 17:49:28.0332 4856 FDResPub - ok 17:49:28.0340 4856 [ 655661BE46B5F5F3FD454E2C3095B930 ] FileInfo C:\Windows\system32\drivers\fileinfo.sys 17:49:28.0340 4856 FileInfo - ok 17:49:28.0347 4856 [ 5F671AB5BC87EEA04EC38A6CD5962A47 ] Filetrace C:\Windows\system32\drivers\filetrace.sys 17:49:28.0348 4856 Filetrace - ok 17:49:28.0367 4856 [ C172A0F53008EAEB8EA33FE10E177AF5 ] flpydisk C:\Windows\system32\drivers\flpydisk.sys 17:49:28.0367 4856 flpydisk - ok 17:49:28.0371 4856 [ DA6B67270FD9DB3697B20FCE94950741 ] FltMgr C:\Windows\system32\drivers\fltmgr.sys 17:49:28.0373 4856 FltMgr - ok 17:49:28.0407 4856 [ 5C4CB4086FB83115B153E47ADD961A0C ] FontCache C:\Windows\system32\FntCache.dll 17:49:28.0415 4856 FontCache - ok 17:49:28.0454 4856 [ A8B7F3818AB65695E3A0BB3279F6DCE6 ] FontCache3.0.0.0 C:\Windows\Microsoft.Net\Framework64\v3.0\WPF\PresentationFontCache.exe 17:49:28.0454 4856 FontCache3.0.0.0 - ok 17:49:28.0456 4856 [ D43703496149971890703B4B1B723EAC ] FsDepends C:\Windows\system32\drivers\FsDepends.sys 17:49:28.0457 4856 FsDepends - ok 17:49:28.0496 4856 [ 6BD9295CC032DD3077C671FCCF579A7B ] Fs_Rec C:\Windows\system32\drivers\Fs_Rec.sys 17:49:28.0497 4856 Fs_Rec - ok 17:49:28.0508 4856 [ 1F7B25B858FA27015169FE95E54108ED ] fvevol C:\Windows\system32\DRIVERS\fvevol.sys 17:49:28.0509 4856 fvevol - ok 17:49:28.0522 4856 [ 8C778D335C9D272CFD3298AB02ABE3B6 ] gagp30kx C:\Windows\system32\drivers\gagp30kx.sys 17:49:28.0522 4856 gagp30kx - ok 17:49:28.0541 4856 [ 277BBC7E1AA1EE957F573A10ECA7EF3A ] gpsvc C:\Windows\System32\gpsvc.dll 17:49:28.0547 4856 gpsvc - ok 17:49:28.0569 4856 [ F2523EF6460FC42405B12248338AB2F0 ] hcw85cir C:\Windows\system32\drivers\hcw85cir.sys 17:49:28.0569 4856 hcw85cir - ok 17:49:28.0589 4856 [ 975761C778E33CD22498059B91E7373A ] HdAudAddService C:\Windows\system32\drivers\HdAudio.sys 17:49:28.0592 4856 HdAudAddService - ok 17:49:28.0616 4856 [ 97BFED39B6B79EB12CDDBFEED51F56BB ] HDAudBus C:\Windows\system32\DRIVERS\HDAudBus.sys 17:49:28.0616 4856 HDAudBus - ok 17:49:28.0637 4856 [ 78E86380454A7B10A5EB255DC44A355F ] HidBatt C:\Windows\system32\drivers\HidBatt.sys 17:49:28.0637 4856 HidBatt - ok 17:49:28.0640 4856 [ 7FD2A313F7AFE5C4DAB14798C48DD104 ] HidBth C:\Windows\system32\drivers\hidbth.sys 17:49:28.0640 4856 HidBth - ok 17:49:28.0649 4856 [ 0A77D29F311B88CFAE3B13F9C1A73825 ] HidIr C:\Windows\system32\drivers\hidir.sys 17:49:28.0650 4856 HidIr - ok 17:49:28.0661 4856 [ BD9EB3958F213F96B97B1D897DEE006D ] hidserv C:\Windows\system32\hidserv.dll 17:49:28.0661 4856 hidserv - ok 17:49:28.0676 4856 [ 9592090A7E2B61CD582B612B6DF70536 ] HidUsb C:\Windows\system32\DRIVERS\hidusb.sys 17:49:28.0676 4856 HidUsb - ok 17:49:28.0703 4856 [ 387E72E739E15E3D37907A86D9FF98E2 ] hkmsvc C:\Windows\system32\kmsvc.dll 17:49:28.0704 4856 hkmsvc - ok 17:49:28.0725 4856 [ EFDFB3DD38A4376F93E7985173813ABD ] HomeGroupListener C:\Windows\system32\ListSvc.dll 17:49:28.0726 4856 HomeGroupListener - ok 17:49:28.0744 4856 [ 908ACB1F594274965A53926B10C81E89 ] HomeGroupProvider C:\Windows\system32\provsvc.dll 17:49:28.0745 4856 HomeGroupProvider - ok 17:49:28.0760 4856 [ 39D2ABCD392F3D8A6DCE7B60AE7B8EFC ] HpSAMD C:\Windows\system32\drivers\HpSAMD.sys 17:49:28.0761 4856 HpSAMD - ok 17:49:28.0786 4856 [ 0EA7DE1ACB728DD5A369FD742D6EEE28 ] HTTP C:\Windows\system32\drivers\HTTP.sys 17:49:28.0791 4856 HTTP - ok 17:49:28.0804 4856 [ A5462BD6884960C9DC85ED49D34FF392 ] hwpolicy C:\Windows\system32\drivers\hwpolicy.sys 17:49:28.0805 4856 hwpolicy - ok 17:49:28.0824 4856 [ FA55C73D4AFFA7EE23AC4BE53B4592D3 ] i8042prt C:\Windows\system32\drivers\i8042prt.sys 17:49:28.0825 4856 i8042prt - ok 17:49:28.0866 4856 [ C224331A54571C8C9162F7714400BBBD ] iaStor C:\Windows\system32\DRIVERS\iaStor.sys 17:49:28.0868 4856 iaStor - ok 17:49:28.0989 4856 [ 7D4B9A48430ED57ACA6373B71D5904CA ] IAStorDataMgrSvc C:\Program Files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe 17:49:28.0990 4856 IAStorDataMgrSvc - ok 17:49:29.0013 4856 [ AAAF44DB3BD0B9D1FB6969B23ECC8366 ] iaStorV C:\Windows\system32\drivers\iaStorV.sys 17:49:29.0015 4856 iaStorV - ok 17:49:29.0042 4856 [ 5988FC40F8DB5B0739CD1E3A5D0D78BD ] idsvc C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\infocard.exe 17:49:29.0045 4856 idsvc - ok 17:49:29.0207 4856 [ 371D7F91C0D2314EB984A4A6CBEABC92 ] igfx C:\Windows\system32\DRIVERS\igdkmd64.sys 17:49:29.0311 4856 igfx - ok 17:49:29.0325 4856 [ 5C18831C61933628F5BB0EA2675B9D21 ] iirsp C:\Windows\system32\drivers\iirsp.sys 17:49:29.0326 4856 iirsp - ok 17:49:29.0348 4856 [ 67999A9D34A0B2479381E7A61AFC37AB ] ikbevent C:\Windows\system32\DRIVERS\ikbevent.sys 17:49:29.0349 4856 ikbevent - ok 17:49:29.0373 4856 [ FCD84C381E0140AF901E58D48882D26B ] IKEEXT C:\Windows\System32\ikeext.dll 17:49:29.0379 4856 IKEEXT - ok 17:49:29.0386 4856 [ DDAE90DD5BDAC53C8C5CD5B82FC1F1B4 ] imsevent C:\Windows\system32\DRIVERS\imsevent.sys 17:49:29.0387 4856 imsevent - ok 17:49:29.0432 4856 [ F2744FD54BE1580BE05916D1C755C92A ] IntcAzAudAddService C:\Windows\system32\drivers\RTKVHD64.sys 17:49:29.0442 4856 IntcAzAudAddService - ok 17:49:29.0483 4856 [ 6C9FFFECA9FED31347D211C5D1FFBD2D ] IntcDAud C:\Windows\system32\DRIVERS\IntcDAud.sys 17:49:29.0486 4856 IntcDAud - ok 17:49:29.0558 4856 [ 832CE330DD987227B7DEA8C03F22AEFA ] Intel(R) Capability Licensing Service Interface C:\Program Files\Intel\iCLS Client\HeciServer.exe 17:49:29.0561 4856 Intel(R) Capability Licensing Service Interface - ok 17:49:29.0607 4856 [ 709C8623721A1F1EF388EA75A07EC33B ] Intel(R) ME Service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe 17:49:29.0608 4856 Intel(R) ME Service - ok 17:49:29.0619 4856 [ F00F20E70C6EC3AA366910083A0518AA ] intelide C:\Windows\system32\drivers\intelide.sys 17:49:29.0620 4856 intelide - ok 17:49:29.0632 4856 [ ADA036632C664CAA754079041CF1F8C1 ] intelppm C:\Windows\system32\DRIVERS\intelppm.sys 17:49:29.0632 4856 intelppm - ok 17:49:29.0655 4856 [ 098A91C54546A3B878DAD6A7E90A455B ] IPBusEnum C:\Windows\system32\ipbusenum.dll 17:49:29.0656 4856 IPBusEnum - ok 17:49:29.0675 4856 [ C9F0E1BD74365A8771590E9008D22AB6 ] IpFilterDriver C:\Windows\system32\DRIVERS\ipfltdrv.sys 17:49:29.0676 4856 IpFilterDriver - ok 17:49:29.0696 4856 [ A34A587FFFD45FA649FBA6D03784D257 ] iphlpsvc C:\Windows\System32\iphlpsvc.dll 17:49:29.0700 4856 iphlpsvc - ok 17:49:29.0702 4856 [ 0FC1AEA580957AA8817B8F305D18CA3A ] IPMIDRV C:\Windows\system32\drivers\IPMIDrv.sys 17:49:29.0703 4856 IPMIDRV - ok 17:49:29.0712 4856 [ AF9B39A7E7B6CAA203B3862582E9F2D0 ] IPNAT C:\Windows\system32\drivers\ipnat.sys 17:49:29.0712 4856 IPNAT - ok 17:49:29.0729 4856 [ 3ABF5E7213EB28966D55D58B515D5CE9 ] IRENUM C:\Windows\system32\drivers\irenum.sys 17:49:29.0730 4856 IRENUM - ok 17:49:29.0748 4856 [ 2F7B28DC3E1183E5EB418DF55C204F38 ] isapnp C:\Windows\system32\drivers\isapnp.sys 17:49:29.0748 4856 isapnp - ok 17:49:29.0769 4856 [ D931D7309DEB2317035B07C9F9E6B0BD ] iScsiPrt C:\Windows\system32\drivers\msiscsi.sys 17:49:29.0771 4856 iScsiPrt - ok 17:49:29.0784 4856 [ 970995B7C36F4408ED31C3BF204FE1F5 ] ISCT C:\Windows\system32\DRIVERS\ISCTD64.sys 17:49:29.0784 4856 ISCT - ok 17:49:29.0812 4856 [ 6F60B7AD044924B8C1E32D692C593612 ] ISCTAgent C:\Program Files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe 17:49:29.0813 4856 ISCTAgent - ok 17:49:29.0845 4856 [ 6BCEF45131C8B8E1C558BE540B190B3C ] iusb3hcs C:\Windows\system32\DRIVERS\iusb3hcs.sys 17:49:29.0845 4856 iusb3hcs - ok 17:49:29.0866 4856 [ F080EADA8715F811B58BD35BB774F2F9 ] iusb3hub C:\Windows\system32\DRIVERS\iusb3hub.sys 17:49:29.0867 4856 iusb3hub - ok 17:49:29.0880 4856 [ 0F1756D9396740F053221FA6260FCE66 ] iusb3xhc C:\Windows\system32\DRIVERS\iusb3xhc.sys 17:49:29.0883 4856 iusb3xhc - ok 17:49:29.0919 4856 [ C44B44E24B929631D9D7368F5B2B40CF ] jhi_service C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe 17:49:29.0919 4856 jhi_service - ok 17:49:29.0933 4856 [ BC02336F1CBA7DCC7D1213BB588A68A5 ] kbdclass C:\Windows\system32\DRIVERS\kbdclass.sys 17:49:29.0933 4856 kbdclass - ok 17:49:29.0950 4856 [ 0705EFF5B42A9DB58548EEC3B26BB484 ] kbdhid C:\Windows\system32\DRIVERS\kbdhid.sys 17:49:29.0951 4856 kbdhid - ok 17:49:29.0971 4856 [ C118A82CD78818C29AB228366EBF81C3 ] KeyIso C:\Windows\system32\lsass.exe 17:49:29.0971 4856 KeyIso - ok 17:49:29.0992 4856 [ 97A7070AEA4C058B6418519E869A63B4 ] KSecDD C:\Windows\system32\Drivers\ksecdd.sys 17:49:29.0993 4856 KSecDD - ok 17:49:30.0004 4856 [ 26C43A7C2862447EC59DEDA188D1DA07 ] KSecPkg C:\Windows\system32\Drivers\ksecpkg.sys 17:49:30.0005 4856 KSecPkg - ok 17:49:30.0010 4856 [ 6869281E78CB31A43E969F06B57347C4 ] ksthunk C:\Windows\system32\drivers\ksthunk.sys 17:49:30.0011 4856 ksthunk - ok 17:49:30.0031 4856 [ 6AB66E16AA859232F64DEB66887A8C9C ] KtmRm C:\Windows\system32\msdtckrm.dll 17:49:30.0034 4856 KtmRm - ok 17:49:30.0056 4856 [ D9F42719019740BAA6D1C6D536CBDAA6 ] LanmanServer C:\Windows\system32\srvsvc.dll 17:49:30.0058 4856 LanmanServer - ok 17:49:30.0081 4856 [ 851A1382EED3E3A7476DB004F4EE3E1A ] LanmanWorkstation C:\Windows\System32\wkssvc.dll 17:49:30.0082 4856 LanmanWorkstation - ok 17:49:30.0127 4856 [ 1538831CF8AD2979A04C423779465827 ] lltdio C:\Windows\system32\DRIVERS\lltdio.sys 17:49:30.0127 4856 lltdio - ok 17:49:30.0158 4856 [ C1185803384AB3FEED115F79F109427F ] lltdsvc C:\Windows\System32\lltdsvc.dll 17:49:30.0161 4856 lltdsvc - ok 17:49:30.0170 4856 [ F993A32249B66C9D622EA5592A8B76B8 ] lmhosts C:\Windows\System32\lmhsvc.dll 17:49:30.0171 4856 lmhosts - ok 17:49:30.0201 4856 [ 75F29D77B0540FCF47EE3BE000BBABDA ] LMS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\LMS\LMS.exe 17:49:30.0202 4856 LMS - ok 17:49:30.0217 4856 [ 1A93E54EB0ECE102495A51266DCDB6A6 ] LSI_FC C:\Windows\system32\drivers\lsi_fc.sys 17:49:30.0218 4856 LSI_FC - ok 17:49:30.0228 4856 [ 1047184A9FDC8BDBFF857175875EE810 ] LSI_SAS C:\Windows\system32\drivers\lsi_sas.sys 17:49:30.0229 4856 LSI_SAS - ok 17:49:30.0241 4856 [ 30F5C0DE1EE8B5BC9306C1F0E4A75F93 ] LSI_SAS2 C:\Windows\system32\drivers\lsi_sas2.sys 17:49:30.0241 4856 LSI_SAS2 - ok 17:49:30.0254 4856 [ 0504EACAFF0D3C8AED161C4B0D369D4A ] LSI_SCSI C:\Windows\system32\drivers\lsi_scsi.sys 17:49:30.0254 4856 LSI_SCSI - ok 17:49:30.0262 4856 [ 43D0F98E1D56CCDDB0D5254CFF7B356E ] luafv C:\Windows\system32\drivers\luafv.sys 17:49:30.0262 4856 luafv - ok 17:49:30.0289 4856 [ B9FC4CCE5758B816F27DD4D1EED11841 ] MBAMProtector C:\Windows\system32\drivers\mbam.sys 17:49:30.0289 4856 MBAMProtector - ok 17:49:30.0312 4856 [ 0DCF16B1449811EFA47AB52CAC84093C ] MBAMScheduler C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe 17:49:30.0314 4856 MBAMScheduler - ok 17:49:30.0326 4856 [ 9EAABA4D601004BEA4DAA6E146E19A96 ] MBAMService C:\Program Files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe 17:49:30.0328 4856 MBAMService - ok 17:49:30.0356 4856 [ 8FF2D95CBA49B405C5DE27039FF0BF35 ] MBfilt C:\Windows\system32\drivers\MBfilt64.sys 17:49:30.0356 4856 MBfilt - ok 17:49:30.0381 4856 [ 0BE09CD858ABF9DF6ED259D57A1A1663 ] Mcx2Svc C:\Windows\system32\Mcx2Svc.dll 17:49:30.0382 4856 Mcx2Svc - ok 17:49:30.0392 4856 [ A55805F747C6EDB6A9080D7C633BD0F4 ] megasas C:\Windows\system32\drivers\megasas.sys 17:49:30.0392 4856 megasas - ok 17:49:30.0401 4856 [ BAF74CE0072480C3B6B7C13B2A94D6B3 ] MegaSR C:\Windows\system32\drivers\MegaSR.sys 17:49:30.0403 4856 MegaSR - ok 17:49:30.0409 4856 [ 6B01B7414A105B9E51652089A03027CF ] MEIx64 C:\Windows\system32\DRIVERS\HECIx64.sys 17:49:30.0410 4856 MEIx64 - ok 17:49:30.0425 4856 [ E40E80D0304A73E8D269F7141D77250B ] MMCSS C:\Windows\system32\mmcss.dll 17:49:30.0426 4856 MMCSS - ok 17:49:30.0437 4856 [ 800BA92F7010378B09F9ED9270F07137 ] Modem C:\Windows\system32\drivers\modem.sys 17:49:30.0437 4856 Modem - ok 17:49:30.0452 4856 [ B03D591DC7DA45ECE20B3B467E6AADAA ] monitor C:\Windows\system32\DRIVERS\monitor.sys 17:49:30.0453 4856 monitor - ok 17:49:30.0502 4856 [ 7D27EA49F3C1F687D357E77A470AEA99 ] mouclass C:\Windows\system32\DRIVERS\mouclass.sys 17:49:30.0502 4856 mouclass - ok 17:49:30.0518 4856 [ D3BF052C40B0C4166D9FD86A4288C1E6 ] mouhid C:\Windows\system32\DRIVERS\mouhid.sys 17:49:30.0518 4856 mouhid - ok 17:49:30.0525 4856 [ 32E7A3D591D671A6DF2DB515A5CBE0FA ] mountmgr C:\Windows\system32\drivers\mountmgr.sys 17:49:30.0525 4856 mountmgr - ok 17:49:30.0577 4856 [ CB8AF049AC9BE419A77ADAE288673359 ] MozillaMaintenance C:\Program Files (x86)\Mozilla Maintenance Service\maintenanceservice.exe 17:49:30.0578 4856 MozillaMaintenance - ok 17:49:30.0581 4856 [ A44B420D30BD56E145D6A2BC8768EC58 ] mpio C:\Windows\system32\drivers\mpio.sys 17:49:30.0582 4856 mpio - ok 17:49:30.0616 4856 [ 6C38C9E45AE0EA2FA5E551F2ED5E978F ] mpsdrv C:\Windows\system32\drivers\mpsdrv.sys 17:49:30.0617 4856 mpsdrv - ok 17:49:30.0636 4856 [ 54FFC9C8898113ACE189D4AA7199D2C1 ] MpsSvc C:\Windows\system32\mpssvc.dll 17:49:30.0641 4856 MpsSvc - ok 17:49:30.0658 4856 [ DC722758B8261E1ABAFD31A3C0A66380 ] MRxDAV C:\Windows\system32\drivers\mrxdav.sys 17:49:30.0659 4856 MRxDAV - ok 17:49:30.0682 4856 [ A5D9106A73DC88564C825D317CAC68AC ] mrxsmb C:\Windows\system32\DRIVERS\mrxsmb.sys 17:49:30.0682 4856 mrxsmb - ok 17:49:30.0692 4856 [ D711B3C1D5F42C0C2415687BE09FC163 ] mrxsmb10 C:\Windows\system32\DRIVERS\mrxsmb10.sys 17:49:30.0694 4856 mrxsmb10 - ok 17:49:30.0702 4856 [ 9423E9D355C8D303E76B8CFBD8A5C30C ] mrxsmb20 C:\Windows\system32\DRIVERS\mrxsmb20.sys 17:49:30.0702 4856 mrxsmb20 - ok 17:49:30.0714 4856 [ C25F0BAFA182CBCA2DD3C851C2E75796 ] msahci C:\Windows\system32\drivers\msahci.sys 17:49:30.0715 4856 msahci - ok 17:49:30.0721 4856 [ DB801A638D011B9633829EB6F663C900 ] msdsm C:\Windows\system32\drivers\msdsm.sys 17:49:30.0721 4856 msdsm - ok 17:49:30.0733 4856 [ DE0ECE52236CFA3ED2DBFC03F28253A8 ] MSDTC C:\Windows\System32\msdtc.exe 17:49:30.0734 4856 MSDTC - ok 17:49:30.0749 4856 [ AA3FB40E17CE1388FA1BEDAB50EA8F96 ] Msfs C:\Windows\system32\drivers\Msfs.sys 17:49:30.0750 4856 Msfs - ok 17:49:30.0764 4856 [ F9D215A46A8B9753F61767FA72A20326 ] mshidkmdf C:\Windows\System32\drivers\mshidkmdf.sys 17:49:30.0764 4856 mshidkmdf - ok 17:49:30.0769 4856 [ D916874BBD4F8B07BFB7FA9B3CCAE29D ] msisadrv C:\Windows\system32\drivers\msisadrv.sys 17:49:30.0769 4856 msisadrv - ok 17:49:30.0799 4856 [ 808E98FF49B155C522E6400953177B08 ] MSiSCSI C:\Windows\system32\iscsiexe.dll 17:49:30.0800 4856 MSiSCSI - ok 17:49:30.0802 4856 msiserver - ok 17:49:30.0812 4856 [ 49CCF2C4FEA34FFAD8B1B59D49439366 ] MSKSSRV C:\Windows\system32\drivers\MSKSSRV.sys 17:49:30.0812 4856 MSKSSRV - ok 17:49:30.0818 4856 [ BDD71ACE35A232104DDD349EE70E1AB3 ] MSPCLOCK C:\Windows\system32\drivers\MSPCLOCK.sys 17:49:30.0819 4856 MSPCLOCK - ok 17:49:30.0836 4856 [ 4ED981241DB27C3383D72092B618A1D0 ] MSPQM C:\Windows\system32\drivers\MSPQM.sys 17:49:30.0836 4856 MSPQM - ok 17:49:30.0851 4856 [ 759A9EEB0FA9ED79DA1FB7D4EF78866D ] MsRPC C:\Windows\system32\drivers\MsRPC.sys 17:49:30.0853 4856 MsRPC - ok 17:49:30.0864 4856 [ 0EED230E37515A0EAEE3C2E1BC97B288 ] mssmbios C:\Windows\system32\DRIVERS\mssmbios.sys 17:49:30.0865 4856 mssmbios - ok 17:49:30.0887 4856 [ 2E66F9ECB30B4221A318C92AC2250779 ] MSTEE C:\Windows\system32\drivers\MSTEE.sys 17:49:30.0887 4856 MSTEE - ok 17:49:30.0891 4856 [ 7EA404308934E675BFFDE8EDF0757BCD ] MTConfig C:\Windows\system32\drivers\MTConfig.sys 17:49:30.0891 4856 MTConfig - ok 17:49:30.0909 4856 [ F9A18612FD3526FE473C1BDA678D61C8 ] Mup C:\Windows\system32\Drivers\mup.sys 17:49:30.0910 4856 Mup - ok 17:49:30.0929 4856 [ 582AC6D9873E31DFA28A4547270862DD ] napagent C:\Windows\system32\qagentRT.dll 17:49:30.0932 4856 napagent - ok 17:49:30.0968 4856 [ 1EA3749C4114DB3E3161156FFFFA6B33 ] NativeWifiP C:\Windows\system32\DRIVERS\nwifi.sys 17:49:30.0969 4856 NativeWifiP - ok 17:49:31.0006 4856 [ 760E38053BF56E501D562B70AD796B88 ] NDIS C:\Windows\system32\drivers\ndis.sys 17:49:31.0012 4856 NDIS - ok 17:49:31.0022 4856 [ 9F9A1F53AAD7DA4D6FEF5BB73AB811AC ] NdisCap C:\Windows\system32\DRIVERS\ndiscap.sys 17:49:31.0022 4856 NdisCap - ok 17:49:31.0036 4856 [ 30639C932D9FEF22B31268FE25A1B6E5 ] NdisTapi C:\Windows\system32\DRIVERS\ndistapi.sys 17:49:31.0036 4856 NdisTapi - ok 17:49:31.0038 4856 [ 136185F9FB2CC61E573E676AA5402356 ] Ndisuio C:\Windows\system32\DRIVERS\ndisuio.sys 17:49:31.0038 4856 Ndisuio - ok 17:49:31.0041 4856 [ 53F7305169863F0A2BDDC49E116C2E11 ] NdisWan C:\Windows\system32\DRIVERS\ndiswan.sys 17:49:31.0042 4856 NdisWan - ok 17:49:31.0064 4856 [ 015C0D8E0E0421B4CFD48CFFE2825879 ] NDProxy C:\Windows\system32\drivers\NDProxy.sys 17:49:31.0064 4856 NDProxy - ok 17:49:31.0077 4856 [ 86743D9F5D2B1048062B14B1D84501C4 ] NetBIOS C:\Windows\system32\DRIVERS\netbios.sys 17:49:31.0078 4856 NetBIOS - ok 17:49:31.0089 4856 [ 09594D1089C523423B32A4229263F068 ] NetBT C:\Windows\system32\DRIVERS\netbt.sys 17:49:31.0090 4856 NetBT - ok 17:49:31.0097 4856 [ C118A82CD78818C29AB228366EBF81C3 ] Netlogon C:\Windows\system32\lsass.exe 17:49:31.0097 4856 Netlogon - ok 17:49:31.0124 4856 [ 847D3AE376C0817161A14A82C8922A9E ] Netman C:\Windows\System32\netman.dll 17:49:31.0126 4856 Netman - ok 17:49:31.0135 4856 [ 5F28111C648F1E24F7DBC87CDEB091B8 ] netprofm C:\Windows\System32\netprofm.dll 17:49:31.0137 4856 netprofm - ok 17:49:31.0156 4856 [ 3E5A36127E201DDF663176B66828FAFE ] NetTcpPortSharing C:\Windows\Microsoft.NET\Framework64\v3.0\Windows Communication Foundation\SMSvcHost.exe 17:49:31.0160 4856 NetTcpPortSharing - ok 17:49:31.0172 4856 [ 77889813BE4D166CDAB78DDBA990DA92 ] nfrd960 C:\Windows\system32\drivers\nfrd960.sys 17:49:31.0173 4856 nfrd960 - ok 17:49:31.0183 4856 [ 1EE99A89CC788ADA662441D1E9830529 ] NlaSvc C:\Windows\System32\nlasvc.dll 17:49:31.0185 4856 NlaSvc - ok 17:49:31.0190 4856 [ 1E4C4AB5C9B8DD13179BBDC75A2A01F7 ] Npfs C:\Windows\system32\drivers\Npfs.sys 17:49:31.0191 4856 Npfs - ok 17:49:31.0207 4856 [ D54BFDF3E0C953F823B3D0BFE4732528 ] nsi C:\Windows\system32\nsisvc.dll 17:49:31.0207 4856 nsi - ok 17:49:31.0217 4856 [ E7F5AE18AF4168178A642A9247C63001 ] nsiproxy C:\Windows\system32\drivers\nsiproxy.sys 17:49:31.0217 4856 nsiproxy - ok 17:49:31.0254 4856 [ A2F74975097F52A00745F9637451FDD8 ] Ntfs C:\Windows\system32\drivers\Ntfs.sys 17:49:31.0266 4856 Ntfs - ok 17:49:31.0273 4856 [ 9899284589F75FA8724FF3D16AED75C1 ] Null C:\Windows\system32\drivers\Null.sys 17:49:31.0273 4856 Null - ok 17:49:31.0294 4856 [ 1F07B814C0BB5AABA703ABFF1F31F2E8 ] NVHDA C:\Windows\system32\drivers\nvhda64v.sys 17:49:31.0294 4856 NVHDA - ok 17:49:31.0459 4856 [ BF7A24A71E1932200D864BC1CE15E596 ] nvlddmkm C:\Windows\system32\DRIVERS\nvlddmkm.sys 17:49:31.0502 4856 nvlddmkm - ok 17:49:31.0518 4856 [ 0A92CB65770442ED0DC44834632F66AD ] nvraid C:\Windows\system32\drivers\nvraid.sys 17:49:31.0519 4856 nvraid - ok 17:49:31.0538 4856 [ DAB0E87525C10052BF65F06152F37E4A ] nvstor C:\Windows\system32\drivers\nvstor.sys 17:49:31.0538 4856 nvstor - ok 17:49:31.0566 4856 [ 43F91595049DE14C4B61D1E76436164F ] nvsvc C:\Windows\system32\nvvsvc.exe 17:49:31.0571 4856 nvsvc - ok 17:49:31.0601 4856 [ 322B69422836F97B76F4AA59B47507BA ] nvUpdatusService C:\Program Files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe 17:49:31.0605 4856 nvUpdatusService - ok 17:49:31.0619 4856 [ 270D7CD42D6E3979F6DD0146650F0E05 ] nv_agp C:\Windows\system32\drivers\nv_agp.sys 17:49:31.0620 4856 nv_agp - ok 17:49:31.0638 4856 [ 3589478E4B22CE21B41FA1BFC0B8B8A0 ] ohci1394 C:\Windows\system32\drivers\ohci1394.sys 17:49:31.0639 4856 ohci1394 - ok 17:49:31.0670 4856 [ 7A56CF3E3F12E8AF599963B16F50FB6A ] ose C:\Program Files (x86)\Common Files\Microsoft Shared\Source Engine\OSE.EXE 17:49:31.0671 4856 ose - ok 17:49:31.0695 4856 [ 3EAC4455472CC2C97107B5291E0DCAFE ] p2pimsvc C:\Windows\system32\pnrpsvc.dll 17:49:31.0697 4856 p2pimsvc - ok 17:49:31.0713 4856 [ 927463ECB02179F88E4B9A17568C63C3 ] p2psvc C:\Windows\system32\p2psvc.dll 17:49:31.0716 4856 p2psvc - ok 17:49:31.0726 4856 [ 0086431C29C35BE1DBC43F52CC273887 ] Parport C:\Windows\system32\DRIVERS\parport.sys 17:49:31.0727 4856 Parport - ok 17:49:31.0743 4856 [ E9766131EEADE40A27DC27D2D68FBA9C ] partmgr C:\Windows\system32\drivers\partmgr.sys 17:49:31.0744 4856 partmgr - ok 17:49:31.0747 4856 [ 3AEAA8B561E63452C655DC0584922257 ] PcaSvc C:\Windows\System32\pcasvc.dll 17:49:31.0748 4856 PcaSvc - ok 17:49:31.0762 4856 [ 94575C0571D1462A0F70BDE6BD6EE6B3 ] pci C:\Windows\system32\drivers\pci.sys 17:49:31.0763 4856 pci - ok 17:49:31.0777 4856 [ B5B8B5EF2E5CB34DF8DCF8831E3534FA ] pciide C:\Windows\system32\drivers\pciide.sys 17:49:31.0777 4856 pciide - ok 17:49:31.0790 4856 [ B2E81D4E87CE48589F98CB8C05B01F2F ] pcmcia C:\Windows\system32\drivers\pcmcia.sys 17:49:31.0791 4856 pcmcia - ok 17:49:31.0803 4856 [ D6B9C2E1A11A3A4B26A182FFEF18F603 ] pcw C:\Windows\system32\drivers\pcw.sys 17:49:31.0803 4856 pcw - ok 17:49:31.0817 4856 [ 68769C3356B3BE5D1C732C97B9A80D6E ] PEAUTH C:\Windows\system32\drivers\peauth.sys 17:49:31.0821 4856 PEAUTH - ok 17:49:31.0880 4856 [ E495E408C93141E8FC72DC0C6046DDFA ] PerfHost C:\Windows\SysWow64\perfhost.exe 17:49:31.0881 4856 PerfHost - ok 17:49:31.0913 4856 [ C7CF6A6E137463219E1259E3F0F0DD6C ] pla C:\Windows\system32\pla.dll 17:49:31.0923 4856 pla - ok 17:49:31.0970 4856 [ 25FBDEF06C4D92815B353F6E792C8129 ] PlugPlay C:\Windows\system32\umpnpmgr.dll 17:49:31.0973 4856 PlugPlay - ok 17:49:31.0975 4856 PnkBstrA - ok 17:49:31.0980 4856 [ 7195581CEC9BB7D12ABE54036ACC2E38 ] PNRPAutoReg C:\Windows\system32\pnrpauto.dll 17:49:31.0980 4856 PNRPAutoReg - ok 17:49:31.0985 4856 [ 3EAC4455472CC2C97107B5291E0DCAFE ] PNRPsvc C:\Windows\system32\pnrpsvc.dll 17:49:31.0986 4856 PNRPsvc - ok 17:49:32.0014 4856 [ 4F15D75ADF6156BF56ECED6D4A55C389 ] PolicyAgent C:\Windows\System32\ipsecsvc.dll 17:49:32.0017 4856 PolicyAgent - ok 17:49:32.0032 4856 [ 6BA9D927DDED70BD1A9CADED45F8B184 ] Power C:\Windows\system32\umpo.dll 17:49:32.0033 4856 Power - ok 17:49:32.0050 4856 [ F92A2C41117A11A00BE01CA01A7FCDE9 ] PptpMiniport C:\Windows\system32\DRIVERS\raspptp.sys 17:49:32.0050 4856 PptpMiniport - ok 17:49:32.0061 4856 [ 0D922E23C041EFB1C3FAC2A6F943C9BF ] Processor C:\Windows\system32\drivers\processr.sys 17:49:32.0061 4856 Processor - ok 17:49:32.0092 4856 [ 53E83F1F6CF9D62F32801CF66D8352A8 ] ProfSvc C:\Windows\system32\profsvc.dll 17:49:32.0093 4856 ProfSvc - ok 17:49:32.0098 4856 [ C118A82CD78818C29AB228366EBF81C3 ] ProtectedStorage C:\Windows\system32\lsass.exe 17:49:32.0099 4856 ProtectedStorage - ok 17:49:32.0116 4856 [ 0557CF5A2556BD58E26384169D72438D ] Psched C:\Windows\system32\DRIVERS\pacer.sys 17:49:32.0117 4856 Psched - ok 17:49:32.0144 4856 [ A53A15A11EBFD21077463EE2C7AFEEF0 ] ql2300 C:\Windows\system32\drivers\ql2300.sys 17:49:32.0155 4856 ql2300 - ok 17:49:32.0162 4856 [ 4F6D12B51DE1AAEFF7DC58C4D75423C8 ] ql40xx C:\Windows\system32\drivers\ql40xx.sys 17:49:32.0162 4856 ql40xx - ok 17:49:32.0183 4856 [ 906191634E99AEA92C4816150BDA3732 ] QWAVE C:\Windows\system32\qwave.dll 17:49:32.0185 4856 QWAVE - ok 17:49:32.0198 4856 [ 76707BB36430888D9CE9D705398ADB6C ] QWAVEdrv C:\Windows\system32\drivers\qwavedrv.sys 17:49:32.0199 4856 QWAVEdrv - ok 17:49:32.0207 4856 [ 5A0DA8AD5762FA2D91678A8A01311704 ] RasAcd C:\Windows\system32\DRIVERS\rasacd.sys 17:49:32.0208 4856 RasAcd - ok 17:49:32.0222 4856 [ 7ECFF9B22276B73F43A99A15A6094E90 ] RasAgileVpn C:\Windows\system32\DRIVERS\AgileVpn.sys 17:49:32.0223 4856 RasAgileVpn - ok 17:49:32.0229 4856 [ 8F26510C5383B8DBE976DE1CD00FC8C7 ] RasAuto C:\Windows\System32\rasauto.dll 17:49:32.0230 4856 RasAuto - ok 17:49:32.0238 4856 [ 471815800AE33E6F1C32FB1B97C490CA ] Rasl2tp C:\Windows\system32\DRIVERS\rasl2tp.sys 17:49:32.0239 4856 Rasl2tp - ok 17:49:32.0247 4856 [ EE867A0870FC9E4972BA9EAAD35651E2 ] RasMan C:\Windows\System32\rasmans.dll 17:49:32.0250 4856 RasMan - ok 17:49:32.0264 4856 [ 855C9B1CD4756C5E9A2AA58A15F58C25 ] RasPppoe C:\Windows\system32\DRIVERS\raspppoe.sys 17:49:32.0264 4856 RasPppoe - ok 17:49:32.0271 4856 [ E8B1E447B008D07FF47D016C2B0EEECB ] RasSstp C:\Windows\system32\DRIVERS\rassstp.sys 17:49:32.0271 4856 RasSstp - ok 17:49:32.0275 4856 [ 77F665941019A1594D887A74F301FA2F ] rdbss C:\Windows\system32\DRIVERS\rdbss.sys 17:49:32.0277 4856 rdbss - ok 17:49:32.0283 4856 [ 302DA2A0539F2CF54D7C6CC30C1F2D8D ] rdpbus C:\Windows\system32\drivers\rdpbus.sys 17:49:32.0284 4856 rdpbus - ok 17:49:32.0295 4856 [ CEA6CC257FC9B7715F1C2B4849286D24 ] RDPCDD C:\Windows\system32\DRIVERS\RDPCDD.sys 17:49:32.0295 4856 RDPCDD - ok 17:49:32.0315 4856 [ BB5971A4F00659529A5C44831AF22365 ] RDPENCDD C:\Windows\system32\drivers\rdpencdd.sys 17:49:32.0316 4856 RDPENCDD - ok 17:49:32.0322 4856 [ 216F3FA57533D98E1F74DED70113177A ] RDPREFMP C:\Windows\system32\drivers\rdprefmp.sys 17:49:32.0323 4856 RDPREFMP - ok 17:49:32.0338 4856 [ E61608AA35E98999AF9AAEEEA6114B0A ] RDPWD C:\Windows\system32\drivers\RDPWD.sys 17:49:32.0339 4856 RDPWD - ok 17:49:32.0347 4856 [ 34ED295FA0121C241BFEF24764FC4520 ] rdyboost C:\Windows\system32\drivers\rdyboost.sys 17:49:32.0348 4856 rdyboost - ok 17:49:32.0365 4856 [ 254FB7A22D74E5511C73A3F6D802F192 ] RemoteAccess C:\Windows\System32\mprdim.dll 17:49:32.0366 4856 RemoteAccess - ok 17:49:32.0387 4856 [ E4D94F24081440B5FC5AA556C7C62702 ] RemoteRegistry C:\Windows\system32\regsvc.dll 17:49:32.0388 4856 RemoteRegistry - ok 17:49:32.0397 4856 [ E4DC58CF7B3EA515AE917FF0D402A7BB ] RpcEptMapper C:\Windows\System32\RpcEpMap.dll 17:49:32.0398 4856 RpcEptMapper - ok 17:49:32.0408 4856 [ D5BA242D4CF8E384DB90E6A8ED850B8C ] RpcLocator C:\Windows\system32\locator.exe 17:49:32.0409 4856 RpcLocator - ok 17:49:32.0425 4856 [ 5C627D1B1138676C0A7AB2C2C190D123 ] RpcSs C:\Windows\system32\rpcss.dll 17:49:32.0427 4856 RpcSs - ok 17:49:32.0443 4856 [ DDC86E4F8E7456261E637E3552E804FF ] rspndr C:\Windows\system32\DRIVERS\rspndr.sys 17:49:32.0444 4856 rspndr - ok 17:49:32.0464 4856 [ 9140DB0911DE035FED0A9A77A2D156EA ] RTL8167 C:\Windows\system32\DRIVERS\Rt64win7.sys 17:49:32.0466 4856 RTL8167 - ok 17:49:32.0468 4856 [ C118A82CD78818C29AB228366EBF81C3 ] SamSs C:\Windows\system32\lsass.exe 17:49:32.0469 4856 SamSs - ok 17:49:32.0480 4856 [ AC03AF3329579FFFB455AA2DAABBE22B ] sbp2port C:\Windows\system32\drivers\sbp2port.sys 17:49:32.0480 4856 sbp2port - ok 17:49:32.0496 4856 [ 9B7395789E3791A3B6D000FE6F8B131E ] SCardSvr C:\Windows\System32\SCardSvr.dll 17:49:32.0498 4856 SCardSvr - ok 17:49:32.0504 4856 [ 253F38D0D7074C02FF8DEB9836C97D2B ] scfilter C:\Windows\system32\DRIVERS\scfilter.sys 17:49:32.0505 4856 scfilter - ok 17:49:32.0522 4856 [ 262F6592C3299C005FD6BEC90FC4463A ] Schedule C:\Windows\system32\schedsvc.dll 17:49:32.0529 4856 Schedule - ok 17:49:32.0544 4856 [ F17D1D393BBC69C5322FBFAFACA28C7F ] SCPolicySvc C:\Windows\System32\certprop.dll 17:49:32.0544 4856 SCPolicySvc - ok 17:49:32.0552 4856 [ 6EA4234DC55346E0709560FE7C2C1972 ] SDRSVC C:\Windows\System32\SDRSVC.dll 17:49:32.0553 4856 SDRSVC - ok 17:49:32.0564 4856 [ 3EA8A16169C26AFBEB544E0E48421186 ] secdrv C:\Windows\system32\drivers\secdrv.sys 17:49:32.0564 4856 secdrv - ok 17:49:32.0569 4856 [ BC617A4E1B4FA8DF523A061739A0BD87 ] seclogon C:\Windows\system32\seclogon.dll 17:49:32.0569 4856 seclogon - ok 17:49:32.0580 4856 [ C32AB8FA018EF34C0F113BD501436D21 ] SENS C:\Windows\System32\sens.dll 17:49:32.0581 4856 SENS - ok 17:49:32.0602 4856 [ 0336CFFAFAAB87A11541F1CF1594B2B2 ] SensrSvc C:\Windows\system32\sensrsvc.dll 17:49:32.0603 4856 SensrSvc - ok 17:49:32.0614 4856 [ CB624C0035412AF0DEBEC78C41F5CA1B ] Serenum C:\Windows\system32\DRIVERS\serenum.sys 17:49:32.0614 4856 Serenum - ok 17:49:32.0636 4856 [ C1D8E28B2C2ADFAEC4BA89E9FDA69BD6 ] Serial C:\Windows\system32\DRIVERS\serial.sys 17:49:32.0636 4856 Serial - ok 17:49:32.0643 4856 [ 1C545A7D0691CC4A027396535691C3E3 ] sermouse C:\Windows\system32\drivers\sermouse.sys 17:49:32.0643 4856 sermouse - ok 17:49:32.0654 4856 [ 0B6231BF38174A1628C4AC812CC75804 ] SessionEnv C:\Windows\system32\sessenv.dll 17:49:32.0655 4856 SessionEnv - ok 17:49:32.0657 4856 [ A554811BCD09279536440C964AE35BBF ] sffdisk C:\Windows\system32\drivers\sffdisk.sys 17:49:32.0658 4856 sffdisk - ok 17:49:32.0660 4856 [ FF414F0BAEFEBA59BC6C04B3DB0B87BF ] sffp_mmc C:\Windows\system32\drivers\sffp_mmc.sys 17:49:32.0660 4856 sffp_mmc - ok 17:49:32.0662 4856 [ DD85B78243A19B59F0637DCF284DA63C ] sffp_sd C:\Windows\system32\drivers\sffp_sd.sys 17:49:32.0662 4856 sffp_sd - ok 17:49:32.0664 4856 [ A9D601643A1647211A1EE2EC4E433FF4 ] sfloppy C:\Windows\system32\drivers\sfloppy.sys 17:49:32.0664 4856 sfloppy - ok 17:49:32.0678 4856 [ B95F6501A2F8B2E78C697FEC401970CE ] SharedAccess C:\Windows\System32\ipnathlp.dll 17:49:32.0680 4856 SharedAccess - ok 17:49:32.0700 4856 [ AAF932B4011D14052955D4B212A4DA8D ] ShellHWDetection C:\Windows\System32\shsvcs.dll 17:49:32.0702 4856 ShellHWDetection - ok 17:49:32.0724 4856 [ 843CAF1E5FDE1FFD5FF768F23A51E2E1 ] SiSRaid2 C:\Windows\system32\drivers\SiSRaid2.sys 17:49:32.0724 4856 SiSRaid2 - ok 17:49:32.0735 4856 [ 6A6C106D42E9FFFF8B9FCB4F754F6DA4 ] SiSRaid4 C:\Windows\system32\drivers\sisraid4.sys 17:49:32.0736 4856 SiSRaid4 - ok 17:49:32.0777 4856 [ F07AF60B152221472FBDB2FECEC4896D ] SkypeUpdate C:\Program Files (x86)\Skype\Updater\Updater.exe 17:49:32.0777 4856 SkypeUpdate - ok 17:49:32.0797 4856 [ 548260A7B8654E024DC30BF8A7C5BAA4 ] Smb C:\Windows\system32\DRIVERS\smb.sys 17:49:32.0798 4856 Smb - ok 17:49:32.0816 4856 [ 6313F223E817CC09AA41811DAA7F541D ] SNMPTRAP C:\Windows\System32\snmptrap.exe 17:49:32.0817 4856 SNMPTRAP - ok 17:49:32.0822 4856 [ B9E31E5CACDFE584F34F730A677803F9 ] spldr C:\Windows\system32\drivers\spldr.sys 17:49:32.0823 4856 spldr - ok 17:49:32.0848 4856 [ 85DAA09A98C9286D4EA2BA8D0E644377 ] Spooler C:\Windows\System32\spoolsv.exe 17:49:32.0851 4856 Spooler - ok 17:49:32.0894 4856 [ E17E0188BB90FAE42D83E98707EFA59C ] sppsvc C:\Windows\system32\sppsvc.exe 17:49:32.0918 4856 sppsvc - ok 17:49:32.0941 4856 [ 93D7D61317F3D4BC4F4E9F8A96A7DE45 ] sppuinotify C:\Windows\system32\sppuinotify.dll 17:49:32.0942 4856 sppuinotify - ok 17:49:32.0952 4856 [ 441FBA48BFF01FDB9D5969EBC1838F0B ] srv C:\Windows\system32\DRIVERS\srv.sys 17:49:32.0955 4856 srv - ok 17:49:32.0968 4856 [ B4ADEBBF5E3677CCE9651E0F01F7CC28 ] srv2 C:\Windows\system32\DRIVERS\srv2.sys 17:49:32.0969 4856 srv2 - ok 17:49:32.0981 4856 [ 27E461F0BE5BFF5FC737328F749538C3 ] srvnet C:\Windows\system32\DRIVERS\srvnet.sys 17:49:32.0981 4856 srvnet - ok 17:49:33.0005 4856 [ 51B52FBD583CDE8AA9BA62B8B4298F33 ] SSDPSRV C:\Windows\System32\ssdpsrv.dll 17:49:33.0006 4856 SSDPSRV - ok 17:49:33.0015 4856 [ AB7AEBF58DAD8DAAB7A6C45E6A8885CB ] SstpSvc C:\Windows\system32\sstpsvc.dll 17:49:33.0016 4856 SstpSvc - ok 17:49:33.0034 4856 Steam Client Service - ok 17:49:33.0088 4856 [ A766CCAD980235FF34E7F8089D3175A3 ] Stereo Service C:\Program Files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe 17:49:33.0090 4856 Stereo Service - ok 17:49:33.0112 4856 [ F3817967ED533D08327DC73BC4D5542A ] stexstor C:\Windows\system32\drivers\stexstor.sys 17:49:33.0112 4856 stexstor - ok 17:49:33.0137 4856 [ 8DD52E8E6128F4B2DA92CE27402871C1 ] stisvc C:\Windows\System32\wiaservc.dll 17:49:33.0142 4856 stisvc - ok 17:49:33.0144 4856 [ D01EC09B6711A5F8E7E6564A4D0FBC90 ] swenum C:\Windows\system32\DRIVERS\swenum.sys 17:49:33.0144 4856 swenum - ok 17:49:33.0154 4856 [ E08E46FDD841B7184194011CA1955A0B ] swprv C:\Windows\System32\swprv.dll 17:49:33.0158 4856 swprv - ok 17:49:33.0185 4856 [ BF9CCC0BF39B418C8D0AE8B05CF95B7D ] SysMain C:\Windows\system32\sysmain.dll 17:49:33.0196 4856 SysMain - ok 17:49:33.0216 4856 [ E3C61FD7B7C2557E1F1B0B4CEC713585 ] TabletInputService C:\Windows\System32\TabSvc.dll 17:49:33.0218 4856 TabletInputService - ok 17:49:33.0232 4856 [ 40F0849F65D13EE87B9A9AE3C1DD6823 ] TapiSrv C:\Windows\System32\tapisrv.dll 17:49:33.0235 4856 TapiSrv - ok 17:49:33.0243 4856 [ 1BE03AC720F4D302EA01D40F588162F6 ] TBS C:\Windows\System32\tbssvc.dll 17:49:33.0244 4856 TBS - ok 17:49:33.0290 4856 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] Tcpip C:\Windows\system32\drivers\tcpip.sys 17:49:33.0303 4856 Tcpip - ok 17:49:33.0327 4856 [ F782CAD3CEDBB3F9FFE3BF2775D92DDC ] TCPIP6 C:\Windows\system32\DRIVERS\tcpip.sys 17:49:33.0334 4856 TCPIP6 - ok 17:49:33.0370 4856 [ DF687E3D8836BFB04FCC0615BF15A519 ] tcpipreg C:\Windows\system32\drivers\tcpipreg.sys 17:49:33.0371 4856 tcpipreg - ok 17:49:33.0377 4856 [ 3371D21011695B16333A3934340C4E7C ] TDPIPE C:\Windows\system32\drivers\tdpipe.sys 17:49:33.0378 4856 TDPIPE - ok 17:49:33.0402 4856 [ 51C5ECEB1CDEE2468A1748BE550CFBC8 ] TDTCP C:\Windows\system32\drivers\tdtcp.sys 17:49:33.0402 4856 TDTCP - ok 17:49:33.0421 4856 [ DDAD5A7AB24D8B65F8D724F5C20FD806 ] tdx C:\Windows\system32\DRIVERS\tdx.sys 17:49:33.0422 4856 tdx - ok 17:49:33.0435 4856 [ 561E7E1F06895D78DE991E01DD0FB6E5 ] TermDD C:\Windows\system32\DRIVERS\termdd.sys 17:49:33.0436 4856 TermDD - ok 17:49:33.0449 4856 [ 2E648163254233755035B46DD7B89123 ] TermService C:\Windows\System32\termsrv.dll 17:49:33.0454 4856 TermService - ok 17:49:33.0463 4856 [ F0344071948D1A1FA732231785A0664C ] Themes C:\Windows\system32\themeservice.dll 17:49:33.0464 4856 Themes - ok 17:49:33.0472 4856 [ E40E80D0304A73E8D269F7141D77250B ] THREADORDER C:\Windows\system32\mmcss.dll 17:49:33.0472 4856 THREADORDER - ok 17:49:33.0492 4856 [ 7E7AFD841694F6AC397E99D75CEAD49D ] TrkWks C:\Windows\System32\trkwks.dll 17:49:33.0493 4856 TrkWks - ok 17:49:33.0551 4856 [ 773212B2AAA24C1E31F10246B15B276C ] TrustedInstaller C:\Windows\servicing\TrustedInstaller.exe 17:49:33.0552 4856 TrustedInstaller - ok 17:49:33.0564 4856 [ CE18B2CDFC837C99E5FAE9CA6CBA5D30 ] tssecsrv C:\Windows\system32\DRIVERS\tssecsrv.sys 17:49:33.0565 4856 tssecsrv - ok 17:49:33.0587 4856 [ D11C783E3EF9A3C52C0EBE83CC5000E9 ] TsUsbFlt C:\Windows\system32\drivers\tsusbflt.sys 17:49:33.0588 4856 TsUsbFlt - ok 17:49:33.0590 4856 [ 9CC2CCAE8A84820EAECB886D477CBCB8 ] TsUsbGD C:\Windows\system32\drivers\TsUsbGD.sys 17:49:33.0591 4856 TsUsbGD - ok 17:49:33.0613 4856 [ 3566A8DAAFA27AF944F5D705EAA64894 ] tunnel C:\Windows\system32\DRIVERS\tunnel.sys 17:49:33.0614 4856 tunnel - ok 17:49:33.0625 4856 [ B4DD609BD7E282BFC683CEC7EAAAAD67 ] uagp35 C:\Windows\system32\drivers\uagp35.sys 17:49:33.0625 4856 uagp35 - ok 17:49:33.0637 4856 [ FF4232A1A64012BAA1FD97C7B67DF593 ] udfs C:\Windows\system32\DRIVERS\udfs.sys 17:49:33.0639 4856 udfs - ok 17:49:33.0661 4856 [ 3CBDEC8D06B9968ABA702EBA076364A1 ] UI0Detect C:\Windows\system32\UI0Detect.exe 17:49:33.0662 4856 UI0Detect - ok 17:49:33.0672 4856 [ 4BFE1BC28391222894CBF1E7D0E42320 ] uliagpkx C:\Windows\system32\drivers\uliagpkx.sys 17:49:33.0672 4856 uliagpkx - ok 17:49:33.0674 4856 [ DC54A574663A895C8763AF0FA1FF7561 ] umbus C:\Windows\system32\DRIVERS\umbus.sys 17:49:33.0675 4856 umbus - ok 17:49:33.0685 4856 [ B2E8E8CB557B156DA5493BBDDCC1474D ] UmPass C:\Windows\system32\drivers\umpass.sys 17:49:33.0685 4856 UmPass - ok 17:49:33.0733 4856 [ 193AD338F2A64D17300AD640ADFA5D0A ] UNS C:\Program Files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe 17:49:33.0735 4856 UNS - ok 17:49:33.0757 4856 [ D47EC6A8E81633DD18D2436B19BAF6DE ] upnphost C:\Windows\System32\upnphost.dll 17:49:33.0760 4856 upnphost - ok 17:49:33.0779 4856 [ 82E8F44688E6FAC57B5B7C6FC7ADBC2A ] usbaudio C:\Windows\system32\drivers\usbaudio.sys 17:49:33.0780 4856 usbaudio - ok 17:49:33.0812 4856 [ 6F1A3157A1C89435352CEB543CDB359C ] usbccgp C:\Windows\system32\DRIVERS\usbccgp.sys 17:49:33.0812 4856 usbccgp - ok 17:49:33.0825 4856 [ AF0892A803FDDA7492F595368E3B68E7 ] usbcir C:\Windows\system32\drivers\usbcir.sys 17:49:33.0825 4856 usbcir - ok 17:49:33.0837 4856 [ C025055FE7B87701EB042095DF1A2D7B ] usbehci C:\Windows\system32\drivers\usbehci.sys 17:49:33.0838 4856 usbehci - ok 17:49:33.0854 4856 [ 287C6C9410B111B68B52CA298F7B8C24 ] usbhub C:\Windows\system32\DRIVERS\usbhub.sys 17:49:33.0855 4856 usbhub - ok 17:49:33.0873 4856 [ 9840FC418B4CBD632D3D0A667A725C31 ] usbohci C:\Windows\system32\drivers\usbohci.sys 17:49:33.0873 4856 usbohci - ok 17:49:33.0887 4856 [ 73188F58FB384E75C4063D29413CEE3D ] usbprint C:\Windows\system32\drivers\usbprint.sys 17:49:33.0887 4856 usbprint - ok 17:49:33.0894 4856 [ FED648B01349A3C8395A5169DB5FB7D6 ] USBSTOR C:\Windows\system32\DRIVERS\USBSTOR.SYS 17:49:33.0894 4856 USBSTOR - ok 17:49:33.0902 4856 [ 62069A34518BCF9C1FD9E74B3F6DB7CD ] usbuhci C:\Windows\system32\drivers\usbuhci.sys 17:49:33.0902 4856 usbuhci - ok 17:49:33.0915 4856 [ EDBB23CBCF2CDF727D64FF9B51A6070E ] UxSms C:\Windows\System32\uxsms.dll 17:49:33.0916 4856 UxSms - ok 17:49:33.0928 4856 [ C118A82CD78818C29AB228366EBF81C3 ] VaultSvc C:\Windows\system32\lsass.exe 17:49:33.0929 4856 VaultSvc - ok 17:49:33.0940 4856 [ C5C876CCFC083FF3B128F933823E87BD ] vdrvroot C:\Windows\system32\drivers\vdrvroot.sys 17:49:33.0941 4856 vdrvroot - ok 17:49:33.0951 4856 [ 8D6B481601D01A456E75C3210F1830BE ] vds C:\Windows\System32\vds.exe 17:49:33.0955 4856 vds - ok 17:49:33.0975 4856 [ DA4DA3F5E02943C2DC8C6ED875DE68DD ] vga C:\Windows\system32\DRIVERS\vgapnp.sys 17:49:33.0976 4856 vga - ok 17:49:33.0983 4856 [ 53E92A310193CB3C03BEA963DE7D9CFC ] VgaSave C:\Windows\System32\drivers\vga.sys 17:49:33.0983 4856 VgaSave - ok 17:49:33.0993 4856 [ 2CE2DF28C83AEAF30084E1B1EB253CBB ] vhdmp C:\Windows\system32\drivers\vhdmp.sys 17:49:33.0994 4856 vhdmp - ok 17:49:34.0004 4856 [ E5689D93FFE4E5D66C0178761240DD54 ] viaide C:\Windows\system32\drivers\viaide.sys 17:49:34.0005 4856 viaide - ok 17:49:34.0030 4856 [ D2AAFD421940F640B407AEFAAEBD91B0 ] volmgr C:\Windows\system32\drivers\volmgr.sys 17:49:34.0030 4856 volmgr - ok 17:49:34.0044 4856 [ A255814907C89BE58B79EF2F189B843B ] volmgrx C:\Windows\system32\drivers\volmgrx.sys 17:49:34.0046 4856 volmgrx - ok 17:49:34.0055 4856 [ 0D08D2F3B3FF84E433346669B5E0F639 ] volsnap C:\Windows\system32\drivers\volsnap.sys 17:49:34.0057 4856 volsnap - ok 17:49:34.0060 4856 [ 5E2016EA6EBACA03C04FEAC5F330D997 ] vsmraid C:\Windows\system32\drivers\vsmraid.sys 17:49:34.0061 4856 vsmraid - ok 17:49:34.0083 4856 [ B60BA0BC31B0CB414593E169F6F21CC2 ] VSS C:\Windows\system32\vssvc.exe 17:49:34.0093 4856 VSS - ok 17:49:34.0103 4856 [ 36D4720B72B5C5D9CB2B9C29E9DF67A1 ] vwifibus C:\Windows\System32\drivers\vwifibus.sys 17:49:34.0103 4856 vwifibus - ok 17:49:34.0134 4856 [ 1C9D80CC3849B3788048078C26486E1A ] W32Time C:\Windows\system32\w32time.dll 17:49:34.0137 4856 W32Time - ok 17:49:34.0148 4856 [ 4E9440F4F152A7B944CB1663D3935A3E ] WacomPen C:\Windows\system32\drivers\wacompen.sys 17:49:34.0148 4856 WacomPen - ok 17:49:34.0165 4856 [ 356AFD78A6ED4457169241AC3965230C ] WANARP C:\Windows\system32\DRIVERS\wanarp.sys 17:49:34.0166 4856 WANARP - ok 17:49:34.0171 4856 [ 356AFD78A6ED4457169241AC3965230C ] Wanarpv6 C:\Windows\system32\DRIVERS\wanarp.sys 17:49:34.0171 4856 Wanarpv6 - ok 17:49:34.0192 4856 [ 78F4E7F5C56CB9716238EB57DA4B6A75 ] wbengine C:\Windows\system32\wbengine.exe 17:49:34.0203 4856 wbengine - ok 17:49:34.0209 4856 [ 3AA101E8EDAB2DB4131333F4325C76A3 ] WbioSrvc C:\Windows\System32\wbiosrvc.dll 17:49:34.0211 4856 WbioSrvc - ok 17:49:34.0215 4856 [ 7368A2AFD46E5A4481D1DE9D14848EDD ] wcncsvc C:\Windows\System32\wcncsvc.dll 17:49:34.0218 4856 wcncsvc - ok 17:49:34.0230 4856 [ 20F7441334B18CEE52027661DF4A6129 ] WcsPlugInService C:\Windows\System32\WcsPlugInService.dll 17:49:34.0231 4856 WcsPlugInService - ok 17:49:34.0245 4856 [ 72889E16FF12BA0F235467D6091B17DC ] Wd C:\Windows\system32\drivers\wd.sys 17:49:34.0245 4856 Wd - ok 17:49:34.0264 4856 [ 441BD2D7B4F98134C3A4F9FA570FD250 ] Wdf01000 C:\Windows\system32\drivers\Wdf01000.sys 17:49:34.0269 4856 Wdf01000 - ok 17:49:34.0282 4856 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiServiceHost C:\Windows\system32\wdi.dll 17:49:34.0283 4856 WdiServiceHost - ok 17:49:34.0285 4856 [ BF1FC3F79B863C914687A737C2F3D681 ] WdiSystemHost C:\Windows\system32\wdi.dll 17:49:34.0286 4856 WdiSystemHost - ok 17:49:34.0295 4856 [ 3DB6D04E1C64272F8B14EB8BC4616280 ] WebClient C:\Windows\System32\webclnt.dll 17:49:34.0297 4856 WebClient - ok 17:49:34.0313 4856 [ C749025A679C5103E575E3B48E092C43 ] Wecsvc C:\Windows\system32\wecsvc.dll 17:49:34.0315 4856 Wecsvc - ok 17:49:34.0325 4856 [ 7E591867422DC788B9E5BD337A669A08 ] wercplsupport C:\Windows\System32\wercplsupport.dll 17:49:34.0326 4856 wercplsupport - ok 17:49:34.0339 4856 [ 6D137963730144698CBD10F202E9F251 ] WerSvc C:\Windows\System32\WerSvc.dll 17:49:34.0340 4856 WerSvc - ok 17:49:34.0345 4856 [ 611B23304BF067451A9FDEE01FBDD725 ] WfpLwf C:\Windows\system32\DRIVERS\wfplwf.sys 17:49:34.0345 4856 WfpLwf - ok 17:49:34.0354 4856 [ 05ECAEC3E4529A7153B3136CEB49F0EC ] WIMMount C:\Windows\system32\drivers\wimmount.sys 17:49:34.0354 4856 WIMMount - ok 17:49:34.0364 4856 WinDefend - ok 17:49:34.0366 4856 WinHttpAutoProxySvc - ok 17:49:34.0412 4856 [ 19B07E7E8915D701225DA41CB3877306 ] Winmgmt C:\Windows\system32\wbem\WMIsvc.dll 17:49:34.0414 4856 Winmgmt - ok 17:49:34.0449 4856 [ BCB1310604AA415C4508708975B3931E ] WinRM C:\Windows\system32\WsmSvc.dll 17:49:34.0465 4856 WinRM - ok 17:49:34.0513 4856 [ 4FADA86E62F18A1B2F42BA18AE24E6AA ] Wlansvc C:\Windows\System32\wlansvc.dll 17:49:34.0519 4856 Wlansvc - ok 17:49:34.0521 4856 [ F6FF8944478594D0E414D3F048F0D778 ] WmiAcpi C:\Windows\system32\drivers\wmiacpi.sys 17:49:34.0521 4856 WmiAcpi - ok 17:49:34.0532 4856 [ 38B84C94C5A8AF291ADFEA478AE54F93 ] wmiApSrv C:\Windows\system32\wbem\WmiApSrv.exe 17:49:34.0533 4856 wmiApSrv - ok 17:49:34.0545 4856 WMPNetworkSvc - ok 17:49:34.0558 4856 [ 96C6E7100D724C69FCF9E7BF590D1DCA ] WPCSvc C:\Windows\System32\wpcsvc.dll 17:49:34.0559 4856 WPCSvc - ok 17:49:34.0567 4856 [ 93221146D4EBBF314C29B23CD6CC391D ] WPDBusEnum C:\Windows\system32\wpdbusenum.dll 17:49:34.0568 4856 WPDBusEnum - ok 17:49:34.0584 4856 [ 7CA09731EB7FC99B910C7F239E57720F ] WPRO_41_2001 C:\Windows\system32\drivers\WPRO_41_2001.sys 17:49:34.0584 4856 WPRO_41_2001 - ok 17:49:34.0596 4856 [ 6BCC1D7D2FD2453957C5479A32364E52 ] ws2ifsl C:\Windows\system32\drivers\ws2ifsl.sys 17:49:34.0596 4856 ws2ifsl - ok 17:49:34.0607 4856 [ E8B1FE6669397D1772D8196DF0E57A9E ] wscsvc C:\Windows\System32\wscsvc.dll 17:49:34.0608 4856 wscsvc - ok 17:49:34.0609 4856 WSearch - ok 17:49:34.0644 4856 [ D9EF901DCA379CFE914E9FA13B73B4C4 ] wuauserv C:\Windows\system32\wuaueng.dll 17:49:34.0662 4856 wuauserv - ok 17:49:34.0669 4856 [ D3381DC54C34D79B22CEE0D65BA91B7C ] WudfPf C:\Windows\system32\drivers\WudfPf.sys 17:49:34.0670 4856 WudfPf - ok 17:49:34.0688 4856 [ CF8D590BE3373029D57AF80914190682 ] WUDFRd C:\Windows\system32\DRIVERS\WUDFRd.sys 17:49:34.0689 4856 WUDFRd - ok 17:49:34.0702 4856 [ 7A95C95B6C4CF292D689106BCAE49543 ] wudfsvc C:\Windows\System32\WUDFSvc.dll 17:49:34.0703 4856 wudfsvc - ok 17:49:34.0711 4856 [ 9A3452B3C2A46C073166C5CF49FAD1AE ] WwanSvc C:\Windows\System32\wwansvc.dll 17:49:34.0713 4856 WwanSvc - ok 17:49:34.0715 4856 ================ Scan global =============================== 17:49:34.0727 4856 [ BA0CD8C393E8C9F83354106093832C7B ] C:\Windows\system32\basesrv.dll 17:49:34.0745 4856 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll 17:49:34.0749 4856 [ EB6A48CC998E1090E44E8E7F1009A640 ] C:\Windows\system32\winsrv.dll 17:49:34.0762 4856 [ D6160F9D869BA3AF0B787F971DB56368 ] C:\Windows\system32\sxssrv.dll 17:49:34.0782 4856 [ 24ACB7E5BE595468E3B9AA488B9B4FCB ] C:\Windows\system32\services.exe 17:49:34.0784 4856 [Global] - ok 17:49:34.0784 4856 ================ Scan MBR ================================== 17:49:34.0790 4856 [ A36C5E4F47E84449FF07ED3517B43A31 ] \Device\Harddisk0\DR0 17:49:34.0898 4856 \Device\Harddisk0\DR0 - ok 17:49:34.0898 4856 ================ Scan VBR ================================== 17:49:34.0899 4856 [ 66480A23C5835B9FAC34DD70F30BC4CA ] \Device\Harddisk0\DR0\Partition1 17:49:34.0900 4856 \Device\Harddisk0\DR0\Partition1 - ok 17:49:34.0909 4856 [ 135ABAC90B16B8C8349944BE1F614C30 ] \Device\Harddisk0\DR0\Partition2 17:49:34.0910 4856 \Device\Harddisk0\DR0\Partition2 - ok 17:49:34.0919 4856 [ BC4502841277788C51ED35763BBB4E82 ] \Device\Harddisk0\DR0\Partition3 17:49:34.0920 4856 \Device\Harddisk0\DR0\Partition3 - ok 17:49:34.0920 4856 ============================================================ 17:49:34.0920 4856 Scan finished 17:49:34.0920 4856 ============================================================ 17:49:34.0925 3588 Detected object count: 0 17:49:34.0925 3588 Actual detected object count: 0 17:49:49.0266 4492 Deinitialize success Gruß Woerna |
08.10.2012, 18:44 | #4 | |
/// TB-Ausbilder | Skype Trojaner Servus, Schritt 1 Ich sehe, dass du sog. Registry Cleaner auf dem System hast. In deinem Fall CCleaner. Wir empfehlen auf keinen Fall jegliche Art von Registry Cleaner. Der Grund ist ganz einfach: Die Registry ist das Hirn des Systems. Funktioniert das Hirn nicht, funktioniert der Rest nicht mehr wirklich. Wir lesen oft genug von Hilfesuchenden, dass deren System nach der Nutzung von Registry Cleanern nicht mehr booted.
Zerstörst Du die Registry, zerstörst Du Windows. Ich empfehle dir hiermit die oben genannte Software zu deinstallieren und in Zukunft auf solche Art von Software zu verzichten. Schritt 2 Downloade Dir bitte AdwCleaner auf deinen Desktop.
Schritt 3 Combofix sollte ausschließlich ausgeführt werden, wenn dies von einem Teammitglied angewiesen wurde!Downloade dir bitte Combofix vom folgenden Downloadspiegel Link 1 WICHTIG - Speichere Combofix auf deinem Desktop
Wenn Combofix fertig ist, wird es eine Logfile erstellen. Bitte poste die C:\Combofix.txt in deiner nächsten Antwort. Hinweis: Solltest du nach dem Neustart folgende Fehlermeldung erhalten Zitat:
Bitte poste mit deiner nächsten Antwort
|
08.10.2012, 19:52 | #5 |
| Skype Trojaner Servus, so also hab CCleaner entfernt, wusste gar nich dass ich den drauf hab . Hier sind die Logs: AdwCleaner: Code:
ATTFilter # AdwCleaner v2.004 - Datei am 08/10/2012 um 20:29:21 erstellt # Aktualisiert am 06/10/2012 von Xplode # Betriebssystem : Windows 7 Home Premium Service Pack 1 (64 bits) # Benutzer : *** - *** # Bootmodus : Normal # Ausgeführt unter : C:\Users\***\Desktop\adwcleaner.exe # Option [Löschen] **** [Dienste] **** ***** [Dateien / Ordner] ***** Datei Gelöscht : C:\user.js Ordner Gelöscht : C:\ProgramData\Babylon Ordner Gelöscht : C:\Users\***\AppData\Roaming\Babylon ***** [Registrierungsdatenbank] ***** Schlüssel Gelöscht : HKCU\Software\AppDataLow\Software\PriceGong Schlüssel Gelöscht : HKCU\Software\DataMngr Schlüssel Gelöscht : HKCU\Software\DataMngr_Toolbar Schlüssel Gelöscht : HKCU\Software\Microsoft\Windows\CurrentVersion\Ext\Settings\{98889811-442D-49DD-99D7-DC866BE87DBC} Schlüssel Gelöscht : HKCU\Software\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Schlüssel Gelöscht : HKLM\Software\Babylon Schlüssel Gelöscht : HKLM\Software\BabylonToolbar Schlüssel Gelöscht : HKLM\Software\BrowserMngr Schlüssel Gelöscht : HKLM\SOFTWARE\Classes\AppID\{BDB69379-802F-4EAF-B541-F8DE92DD98DB} Schlüssel Gelöscht : HKLM\Software\DataMngr Schlüssel Gelöscht : HKLM\Software\Freeze.com Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Schlüssel Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Explorer\Browser Helper Objects\{2EECD738-5844-4A99-B4B6-146BF802613B} Schlüssel Gelöscht : HKLM\SOFTWARE\Microsoft\Internet Explorer\SearchScopes\{0633EE93-D776-472f-A0FF-E1416B8B2E3A} Wert Gelöscht : HKLM\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Toolbar [{98889811-442D-49DD-99D7-DC866BE87DBC}] ***** [Internet Browser] ***** -\\ Internet Explorer v9.0.8112.16421 [OK] Die Registrierungsdatenbank ist sauber. -\\ Mozilla Firefox v15.0.1 (de) Profilname : default Datei : C:\Users\***\AppData\Roaming\Mozilla\Firefox\Profiles\94q1vlf9.default\prefs.js [OK] Die Datei ist sauber. ************************* AdwCleaner[S1].txt - [2127 octets] - [08/10/2012 20:29:21] ########## EOF - C:\AdwCleaner[S1].txt - [2187 octets] ########## ComboFix: Code:
ATTFilter ComboFix 12-10-08.02 - *** 08.10.2012 20:38:57.1.4 - x64 Microsoft Windows 7 Home Premium 6.1.7601.1.1252.49.1031.18.8087.6527 [GMT 2:00] ausgeführt von:: c:\users\***\Desktop\ComboFix.exe AV: Avira Desktop *Disabled/Updated* {F67B4DE5-C0B4-6C3F-0EFF-6C83BD5D0C2C} SP: Avira Desktop *Disabled/Updated* {4D1AAC01-E68E-63B1-344F-57F1C6DA4691} SP: Windows Defender *Disabled/Updated* {D68DDC3A-831F-4fae-9E44-DA132C1ACF46} . . ((((((((((((((((((((((( Dateien erstellt von 2012-09-08 bis 2012-10-08 )))))))))))))))))))))))))))))) . . 2012-10-08 18:41 . 2012-10-08 18:41 -------- d-----w- c:\users\Default\AppData\Local\temp 2012-10-03 16:10 . 2012-10-03 16:10 -------- d-----w- c:\program files (x86)\Common Files\Skype 2012-10-03 11:27 . 2012-10-03 11:27 -------- d-----w- c:\program files (x86)\Malwarebytes' Anti-Malware 2012-10-03 11:27 . 2012-10-03 11:27 -------- d-----w- c:\programdata\Malwarebytes 2012-10-03 11:27 . 2012-09-07 15:04 25928 ----a-w- c:\windows\system32\drivers\mbam.sys 2012-09-29 11:55 . 2012-08-21 21:01 245760 ----a-w- c:\windows\system32\OxpsConverter.exe 2012-09-19 18:03 . 2012-09-23 16:53 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.xtr 2012-09-19 18:03 . 2012-09-19 18:03 -------- d-----w- c:\program files (x86)\Battlelog Web Plugins 2012-09-19 14:59 . 2012-09-20 06:15 -------- d-----w- c:\programdata\EA Logs 2012-09-19 14:59 . 2012-09-19 14:59 -------- d-----w- c:\programdata\EA Core 2012-09-19 14:56 . 2012-09-19 14:56 -------- d--h--w- c:\program files (x86)\Common Files\EAInstaller 2012-09-19 14:56 . 2012-09-23 16:53 280904 ----a-w- c:\windows\SysWow64\PnkBstrB.exe 2012-09-19 14:56 . 2012-09-23 10:50 281520 ----a-w- c:\windows\SysWow64\PnkBstrB.ex0 2012-09-19 14:56 . 2012-09-20 15:31 76888 ----a-w- c:\windows\SysWow64\PnkBstrA.exe 2012-09-19 07:40 . 2012-09-19 08:58 -------- d-----w- c:\program files (x86)\Origin Games 2012-09-19 07:38 . 2012-09-21 06:46 -------- d-----w- c:\programdata\Origin 2012-09-19 07:38 . 2012-09-19 14:59 -------- d-----w- c:\programdata\Electronic Arts 2012-09-19 07:38 . 2012-09-21 06:46 -------- d-----w- c:\program files (x86)\Origin 2012-09-18 15:49 . 2012-09-18 15:49 -------- d-----w- c:\program files\TeamSpeak 3 Client 2012-09-18 08:56 . 2008-07-12 06:18 467984 ----a-w- c:\windows\SysWow64\d3dx10_39.dll 2012-09-18 08:56 . 2008-07-12 06:18 1493528 ----a-w- c:\windows\SysWow64\D3DCompiler_39.dll 2012-09-18 08:56 . 2008-07-12 06:18 3851784 ----a-w- c:\windows\SysWow64\D3DX9_39.dll 2012-09-18 08:53 . 2012-09-18 08:54 -------- d-----w- c:\program files (x86)\Riot Games 2012-09-18 08:40 . 2012-09-07 18:26 98848 ----a-w- c:\windows\system32\drivers\avgntflt.sys 2012-09-18 08:40 . 2012-09-07 18:26 27760 ----a-w- c:\windows\system32\drivers\avkmgr.sys 2012-09-18 08:40 . 2012-09-07 18:26 132832 ----a-w- c:\windows\system32\drivers\avipbb.sys 2012-09-18 08:40 . 2012-09-18 08:40 -------- d-----w- c:\programdata\Avira 2012-09-18 08:40 . 2012-09-18 08:40 -------- d-----w- c:\program files (x86)\Avira 2012-09-17 22:30 . 2012-10-08 18:30 94656 ----a-w- c:\windows\system32\WPRO_41_2001woem.tmp 2012-09-17 21:26 . 2012-09-18 08:53 -------- d-----w- c:\program files (x86)\League of Legends 2012-09-17 21:24 . 2012-10-07 15:21 -------- d-----w- c:\programdata\PMB Files 2012-09-17 21:23 . 2012-09-17 21:23 -------- d-----w- c:\program files (x86)\Pando Networks 2012-09-17 17:22 . 2012-09-17 22:32 -------- dc----w- c:\windows\system32\DRVSTORE 2012-09-17 17:16 . 2012-09-17 17:16 -------- d-----w- c:\programdata\CheckPoint 2012-09-17 17:10 . 2012-10-03 16:10 -------- d-----r- c:\program files (x86)\Skype 2012-09-17 17:10 . 2012-10-03 16:10 -------- d-----w- c:\programdata\Skype 2012-09-16 11:45 . 2012-10-03 18:21 -------- d-----w- c:\program files (x86)\World of Warcraft 2012-09-16 11:45 . 2012-09-16 11:45 -------- d-----w- c:\programdata\Blizzard Entertainment 2012-09-16 11:45 . 2012-09-16 11:45 -------- d-----w- c:\program files (x86)\Common Files\Blizzard Entertainment 2012-09-16 11:44 . 2012-09-16 11:44 -------- d-----w- c:\programdata\Battle.net 2012-09-16 11:34 . 2012-09-16 12:37 -------- d-----w- c:\program files (x86)\Common Files\Steam 2012-09-16 11:34 . 2012-10-07 15:22 -------- d-----w- c:\program files (x86)\Steam 2012-09-15 20:23 . 2012-09-15 19:35 -------- d-----w- c:\windows\Panther 2012-09-15 19:42 . 2012-09-15 19:42 -------- d-----w- c:\windows\SysWow64\RTCOM 2012-09-15 19:42 . 2012-09-15 19:42 -------- d-----w- c:\program files\Realtek 2012-09-15 19:40 . 2012-09-15 19:40 -------- d-----w- c:\program files\Common Files\Intel 2012-09-15 19:37 . 2012-09-15 13:47 -------- d-----w- c:\program files (x86)\Intel 2012-09-15 19:37 . 2011-12-06 07:55 53248 ----a-r- c:\windows\SysWow64\CSVer.dll 2012-09-15 19:37 . 2012-09-15 19:39 -------- d-----w- C:\Intel 2012-09-15 16:42 . 2012-09-15 17:07 -------- d-----w- c:\program files\Core Temp 2012-09-15 16:14 . 2012-09-15 16:14 -------- d-----w- c:\program files (x86)\Microsoft 2012-09-15 16:01 . 2012-09-15 16:01 -------- d-----w- c:\windows\PCHEALTH 2012-09-15 15:18 . 2012-09-15 15:18 -------- d-----w- c:\program files\7-Zip 2012-09-15 15:13 . 2012-09-15 15:13 -------- d-----w- c:\program files\Microsoft Silverlight 2012-09-15 15:13 . 2012-09-15 15:13 -------- d-----w- c:\program files (x86)\Microsoft Silverlight 2012-09-15 15:13 . 2012-05-04 11:00 366592 ----a-w- c:\windows\system32\qdvd.dll 2012-09-15 15:13 . 2012-05-04 09:59 514560 ----a-w- c:\windows\SysWow64\qdvd.dll 2012-09-15 15:13 . 2011-02-19 12:05 1139200 ----a-w- c:\windows\system32\FntCache.dll 2012-09-15 15:13 . 2011-02-19 12:04 902656 ----a-w- c:\windows\system32\d2d1.dll 2012-09-15 15:13 . 2011-02-19 06:30 739840 ----a-w- c:\windows\SysWow64\d2d1.dll 2012-09-15 15:09 . 2012-06-09 17:21 178688 ----a-w- c:\windows\SysWow64\unrar.dll 2012-09-15 15:09 . 2012-09-15 15:09 -------- d-----w- c:\program files (x86)\K-Lite Codec Pack 2012-09-15 15:09 . 2012-09-15 15:08 916456 ----a-w- c:\windows\system32\deployJava1.dll 2012-09-15 15:09 . 2012-09-15 15:08 289768 ----a-w- c:\windows\system32\javaws.exe 2012-09-15 15:09 . 2012-09-15 15:08 1034216 ----a-w- c:\windows\system32\npDeployJava1.dll 2012-09-15 15:08 . 2012-09-15 15:08 108008 ----a-w- c:\windows\system32\WindowsAccessBridge-64.dll 2012-09-15 15:08 . 2012-09-15 15:08 189416 ----a-w- c:\windows\system32\javaw.exe 2012-09-15 15:08 . 2012-09-15 15:08 188904 ----a-w- c:\windows\system32\java.exe 2012-09-15 15:08 . 2012-09-15 15:08 -------- d-----w- c:\program files\Java 2012-09-15 15:08 . 2012-09-15 15:08 -------- d-----w- c:\program files (x86)\Common Files\Adobe 2012-09-15 15:07 . 2012-09-15 15:07 73416 ----a-w- c:\windows\SysWow64\FlashPlayerCPLApp.cpl 2012-09-15 15:07 . 2012-09-15 15:07 696520 ----a-w- c:\windows\SysWow64\FlashPlayerApp.exe 2012-09-15 15:07 . 2012-09-15 15:07 -------- d-----w- c:\windows\SysWow64\Macromed 2012-09-15 15:07 . 2012-09-15 15:07 -------- d-----w- c:\windows\system32\Macromed 2012-09-15 15:07 . 2012-09-15 15:07 -------- d-----w- c:\program files (x86)\COMPUTERBILD-Abzockschutz 2012-09-15 14:54 . 2012-09-17 22:29 -------- d-----w- c:\program files (x86)\Mozilla Maintenance Service 2012-09-15 14:51 . 2012-09-15 14:51 -------- d-----w- c:\windows\SysWow64\wbem\en-US 2012-09-15 14:51 . 2012-09-15 14:51 -------- d-----w- c:\windows\system32\wbem\en-US 2012-09-15 14:38 . 2010-02-23 08:16 294912 ----a-w- c:\windows\system32\browserchoice.exe 2012-09-15 14:35 . 2012-08-27 23:49 9310152 ----a-w- c:\programdata\Microsoft\Windows Defender\Definition Updates\{A139537D-AA11-469B-8FC1-3BB7576A8196}\mpengine.dll 2012-09-15 14:35 . 2012-08-30 22:43 64462936 ----a-w- c:\windows\system32\MRT.exe 2012-09-15 14:34 . 2012-03-01 06:46 23408 ----a-w- c:\windows\system32\drivers\fs_rec.sys 2012-09-15 14:34 . 2012-03-01 06:38 220672 ----a-w- c:\windows\system32\wintrust.dll 2012-09-15 14:34 . 2012-03-01 06:33 81408 ----a-w- c:\windows\system32\imagehlp.dll 2012-09-15 14:34 . 2012-03-01 06:28 5120 ----a-w- c:\windows\system32\wmi.dll 2012-09-15 14:34 . 2012-03-01 05:37 172544 ----a-w- c:\windows\SysWow64\wintrust.dll 2012-09-15 14:34 . 2012-03-01 05:33 159232 ----a-w- c:\windows\SysWow64\imagehlp.dll 2012-09-15 14:34 . 2012-03-01 05:29 5120 ----a-w- c:\windows\SysWow64\wmi.dll 2012-09-15 14:32 . 2011-12-16 08:46 634880 ----a-w- c:\windows\system32\msvcrt.dll 2012-09-15 14:32 . 2011-12-16 07:52 690688 ----a-w- c:\windows\SysWow64\msvcrt.dll 2012-09-15 14:32 . 2011-05-03 05:29 976896 ----a-w- c:\windows\system32\inetcomm.dll 2012-09-15 14:32 . 2011-05-03 04:30 741376 ----a-w- c:\windows\SysWow64\inetcomm.dll 2012-09-15 14:32 . 2011-02-12 11:34 267776 ----a-w- c:\windows\system32\FXSCOVER.exe 2012-09-15 14:32 . 2012-05-14 05:26 956928 ----a-w- c:\windows\system32\localspl.dll 2012-09-15 14:32 . 2011-02-23 04:55 90624 ----a-w- c:\windows\system32\drivers\bowser.sys 2012-09-15 14:29 . 2012-06-02 22:19 2428952 ----a-w- c:\windows\system32\wuaueng.dll 2012-09-15 14:29 . 2012-06-02 22:19 57880 ----a-w- c:\windows\system32\wuauclt.exe 2012-09-15 14:29 . 2012-06-02 22:19 44056 ----a-w- c:\windows\system32\wups2.dll 2012-09-15 14:29 . 2012-06-02 22:15 2622464 ----a-w- c:\windows\system32\wucltux.dll 2012-09-15 14:29 . 2012-06-02 22:19 38424 ----a-w- c:\windows\system32\wups.dll 2012-09-15 14:29 . 2012-06-02 22:19 701976 ----a-w- c:\windows\system32\wuapi.dll 2012-09-15 14:29 . 2012-06-02 22:15 99840 ----a-w- c:\windows\system32\wudriver.dll 2012-09-15 14:29 . 2012-06-02 13:19 186752 ----a-w- c:\windows\system32\wuwebv.dll 2012-09-15 14:29 . 2012-06-02 13:15 36864 ----a-w- c:\windows\system32\wuapp.exe 2012-09-15 14:06 . 2012-09-15 15:55 -------- d-sha-r- c:\programdata\Key-Base 2012-09-15 13:58 . 2012-09-15 13:58 -------- d-----w- C:\NVIDIA 2012-09-15 13:53 . 2012-09-15 13:53 -------- d-----w- c:\program files (x86)\Common Files\Intel Corporation 2012-09-15 13:50 . 2012-09-15 13:50 -------- d-----w- c:\program files\ASRock Utility 2012-09-15 13:50 . 2011-05-10 14:28 17192 ----a-w- c:\windows\system32\drivers\AsrAppCharger.sys 2012-09-15 13:49 . 2012-10-08 18:30 34752 ----a-w- c:\windows\system32\drivers\WPRO_41_2001.sys 2012-09-15 13:48 . 2012-09-15 13:48 -------- d-----w- c:\program files (x86)\ASM106xSATA 2012-09-15 13:48 . 2012-01-26 17:39 16152 ----a-w- c:\windows\system32\drivers\iusb3hcs.sys 2012-09-15 13:48 . 2012-01-26 17:39 356120 ----a-w- c:\windows\system32\drivers\iusb3hub.sys 2012-09-15 13:47 . 2012-01-26 17:39 787736 ----a-w- c:\windows\system32\drivers\iusb3xhc.sys 2012-09-15 13:46 . 2012-02-07 15:40 15128 ----a-w- c:\windows\system32\drivers\IntelMEFWVer.dll 2012-09-15 13:46 . 2012-09-15 14:06 -------- d-----w- c:\programdata\Intel 2012-09-15 13:46 . 2012-09-15 13:49 -------- d-----w- c:\program files\Intel 2012-09-15 13:45 . 2012-10-03 16:10 -------- d-sh--w- c:\windows\Installer 2012-09-15 13:45 . 2012-09-15 13:45 -------- d-----w- c:\program files (x86)\Common Files\postureAgent 2012-09-15 13:45 . 2011-11-09 23:04 60184 ----a-w- c:\windows\system32\drivers\HECIx64.sys 2012-09-15 13:44 . 2011-11-29 17:40 568600 ----a-w- c:\windows\system32\drivers\iaStor.sys 2012-09-15 13:43 . 2011-08-23 13:57 74272 ----a-w- c:\windows\system32\RtNicProp64.dll 2012-09-15 13:43 . 2011-08-23 13:57 565352 ----a-w- c:\windows\system32\drivers\Rt64win7.sys 2012-09-15 13:43 . 2011-08-23 13:57 107552 ----a-w- c:\windows\system32\RTNUninst64.dll . . . (((((((((((((((((((((((((((((((((((( Find3M Bericht )))))))))))))))))))))))))))))))))))))))))))))))))))))) . 2012-08-30 08:40 . 2012-08-30 08:40 429416 ----a-w- c:\windows\SysWow64\nvStreaming.exe . . (((((((((((((((((((((((((((( Autostartpunkte der Registrierung )))))))))))))))))))))))))))))))))))))))) . . *Hinweis* leere Einträge & legitime Standardeinträge werden nicht angezeigt. REGEDIT4 . [HKEY_CURRENT_USER\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "Sidebar"="c:\program files\Windows Sidebar\sidebar.exe" [2010-11-21 1475584] . [HKEY_LOCAL_MACHINE\SOFTWARE\Wow6432Node\Microsoft\Windows\CurrentVersion\Run] "IAStorIcon"="c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorIcon.exe" [2011-11-29 284440] "USB3MON"="c:\program files (x86)\Intel\Intel(R) USB 3.0 eXtensible Host Controller Driver\Application\iusb3mon.exe" [2012-01-26 291608] "Adobe ARM"="c:\program files (x86)\Common Files\Adobe\ARM\1.0\AdobeARM.exe" [2012-07-27 919008] "avgnt"="c:\program files (x86)\Avira\AntiVir Desktop\avgnt.exe" [2012-09-07 348664] . [HKEY_LOCAL_MACHINE\software\microsoft\windows\currentversion\policies\system] "ConsentPromptBehaviorAdmin"= 5 (0x5) "ConsentPromptBehaviorUser"= 3 (0x3) "EnableUIADesktopToggle"= 0 (0x0) . [HKEY_LOCAL_MACHINE\software\wow6432node\microsoft\windows nt\currentversion\windows] "LoadAppInit_DLLs"=1 (0x1) . R2 clr_optimization_v4.0.30319_64;Microsoft .NET Framework NGEN v4.0.30319_X64;c:\windows\Microsoft.NET\Framework64\v4.0.30319\mscorsvw.exe [2010-03-18 138576] R2 Intel(R) ME Service;Intel(R) ME Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\FWService\IntelMeFWService.exe [2012-02-07 121344] R2 MBAMService;MBAMService;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamservice.exe [2012-09-07 676936] R2 SkypeUpdate;Skype Updater;c:\program files (x86)\Skype\Updater\Updater.exe [2012-07-13 160944] R3 AdobeFlashPlayerUpdateSvc;Adobe Flash Player Update Service;c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-15 250568] R3 ALSysIO;ALSysIO;c:\users\***\AppData\Local\Temp\ALSysIO64.sys [x] R3 cphs;Intel(R) Content Protection HECI Service;c:\windows\SysWow64\IntelCpHeciSvc.exe [2012-03-22 276248] R3 MBAMProtector;MBAMProtector;c:\windows\system32\drivers\mbam.sys [2012-09-07 25928] R3 MozillaMaintenance;Mozilla Maintenance Service;c:\program files (x86)\Mozilla Maintenance Service\maintenanceservice.exe [2012-09-06 114144] R3 TsUsbFlt;TsUsbFlt;c:\windows\system32\drivers\tsusbflt.sys [2010-11-21 59392] R3 TsUsbGD;Remote Desktop Generic USB Device;c:\windows\system32\drivers\TsUsbGD.sys [2010-11-21 31232] S0 asahci64;asahci64;c:\windows\system32\DRIVERS\asahci64.sys [2011-09-21 49760] S0 iusb3hcs;Intel(R) USB 3.0 Hostcontroller-Switchtreiber;c:\windows\system32\DRIVERS\iusb3hcs.sys [2012-01-26 16152] S1 AsrAppCharger;AsrAppCharger;c:\windows\system32\DRIVERS\AsrAppCharger.sys [2011-05-10 17192] S1 avkmgr;avkmgr;c:\windows\system32\DRIVERS\avkmgr.sys [2012-09-07 27760] S2 AdobeARMservice;Adobe Acrobat Update Service;c:\program files (x86)\Common Files\Adobe\ARM\1.0\armsvc.exe [2012-07-27 63960] S2 AntiVirSchedulerService;Avira Planer;c:\program files (x86)\Avira\AntiVir Desktop\sched.exe [2012-09-07 86224] S2 IAStorDataMgrSvc;Intel(R) Rapid Storage Technology;c:\program files (x86)\Intel\Intel(R) Rapid Storage Technology\IAStorDataMgrSvc.exe [2011-11-29 13592] S2 Intel(R) Capability Licensing Service Interface;Intel(R) Capability Licensing Service Interface;c:\program files\Intel\iCLS Client\HeciServer.exe [2012-02-02 628448] S2 ISCTAgent;ISCT Always Updated Agent;c:\program files\Intel\Intel(R) Smart Connect Technology Agent\iSCTAgent.exe [2012-02-09 133632] S2 jhi_service;Intel(R) Dynamic Application Loader Host Interface Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\DAL\jhi_service.exe [2012-02-07 161560] S2 MBAMScheduler;MBAMScheduler;c:\program files (x86)\Malwarebytes' Anti-Malware\mbamscheduler.exe [2012-09-07 399432] S2 nvUpdatusService;NVIDIA Update Service Daemon;c:\program files (x86)\NVIDIA Corporation\NVIDIA Update Core\daemonu.exe [2012-08-30 1258856] S2 Stereo Service;NVIDIA Stereoscopic 3D Driver Service;c:\program files (x86)\NVIDIA Corporation\3D Vision\nvSCPAPISvr.exe [2012-08-30 382312] S2 UNS;Intel(R) Management and Security Application User Notification Service;c:\program files (x86)\Intel\Intel(R) Management Engine Components\UNS\UNS.exe [2012-02-07 363800] S3 ikbevent;Intel Upper keyboard Class Filter Driver;c:\windows\system32\DRIVERS\ikbevent.sys [2012-02-09 25536] S3 imsevent;Intel Upper Mouse Class Filter Driver;c:\windows\system32\DRIVERS\imsevent.sys [2012-02-09 25536] S3 IntcDAud;Intel(R) Display-Audio;c:\windows\system32\DRIVERS\IntcDAud.sys [2011-12-05 331264] S3 ISCT;Intel(R) Smart Connect Technology Device Driver;c:\windows\system32\DRIVERS\ISCTD64.sys [2012-02-09 44992] S3 iusb3hub;Intel(R) USB 3.0-Hubtreiber;c:\windows\system32\DRIVERS\iusb3hub.sys [2012-01-26 356120] S3 iusb3xhc;Intel(R) USB 3.0 eXtensible-Hostcontrollertreiber;c:\windows\system32\DRIVERS\iusb3xhc.sys [2012-01-26 787736] S3 MBfilt;MBfilt;c:\windows\system32\drivers\MBfilt64.sys [2009-11-17 32344] S3 MEIx64;Intel(R) Management Engine Interface ;c:\windows\system32\DRIVERS\HECIx64.sys [2011-11-09 60184] S3 NVHDA;Service for NVIDIA High Definition Audio Driver;c:\windows\system32\drivers\nvhda64v.sys [2012-07-03 189288] S3 RTL8167;Realtek 8167 NT Driver;c:\windows\system32\DRIVERS\Rt64win7.sys [2011-08-23 565352] S3 WPRO_41_2001;WinPcap Packet Driver (WPRO_41_2001);c:\windows\system32\drivers\WPRO_41_2001.sys [2012-10-08 34752] . . Inhalt des "geplante Tasks" Ordners . 2012-10-08 c:\windows\Tasks\Adobe Flash Player Updater.job - c:\windows\SysWOW64\Macromed\Flash\FlashPlayerUpdateService.exe [2012-09-15 15:07] . 2012-10-08 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d-Logon.job - c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 11:41] . 2012-10-08 c:\windows\Tasks\ISM-UpdateService-4e00205a-2ab1-4423-8f77-cc25b82cde1d.job - c:\program files (x86)\Intel\Intel(R) ME FW Recovery Agent\bin\Bootstrap.exe [2011-11-25 11:41] . . --------- X64 Entries ----------- . . [HKEY_LOCAL_MACHINE\SOFTWARE\Microsoft\Windows\CurrentVersion\Run] "IgfxTray"="c:\windows\system32\igfxtray.exe" [2012-03-22 170264] "HotKeysCmds"="c:\windows\system32\hkcmd.exe" [2012-03-22 398616] "Persistence"="c:\windows\system32\igfxpers.exe" [2012-03-22 439064] "RTHDVCPL"="c:\program files\Realtek\Audio\HDA\RAVCpl64.exe" [2011-10-17 13307496] . ------- Zusätzlicher Suchlauf ------- . uLocal Page = c:\windows\system32\blank.htm mLocal Page = c:\windows\SysWOW64\blank.htm IE: Nach Microsoft &Excel exportieren - c:\progra~2\MICROS~2\OFFICE11\EXCEL.EXE/3000 TCP: DhcpNameServer = 192.168.1.1 FF - ProfilePath - c:\users\***\AppData\Roaming\Mozilla\Firefox\Profiles\94q1vlf9.default\ FF - prefs.js: browser.startup.homepage - google.de . - - - - Entfernte verwaiste Registrierungseinträge - - - - . Wow6432Node-HKLM-Run-ZoneAlarm Installer - c:\program files (x86)\CheckPoint\Install\Launcher.exe AddRemove-MozillaMaintenanceService - c:\program files (x86)\Mozilla Maintenance Service\uninstall.exe . . . --------------------- Gesperrte Registrierungsschluessel --------------------- . [HKEY_LOCAL_MACHINE\SYSTEM\ControlSet001\Control\PCW\Security] @Denied: (Full) (Everyone) . Zeit der Fertigstellung: 2012-10-08 20:43:08 ComboFix-quarantined-files.txt 2012-10-08 18:43 . Vor Suchlauf: 9 Verzeichnis(se), 72.505.212.928 Bytes frei Nach Suchlauf: 12 Verzeichnis(se), 72.484.261.888 Bytes frei . - - End Of File - - 2BB3DCF0193D7C558D93379079E0323B Wie siehts jetzt allgemein mit dem Rechner aus? Passt wieder alles oder muss ich Windows neu installen? Edit: Combofix wollte keinen Neustart. Ist des normal? gruß Woerna |
09.10.2012, 09:25 | #6 | |
/// TB-Ausbilder | Skype Trojaner Servus, Zitat:
Bevor wir weitermachen: Wie läuft dein Rechner derzeit? Gibt es Probleme? Wenn ja, welche? Passt so. |
09.10.2012, 10:33 | #7 |
| Skype Trojaner Servus, Also momentan läuft er eigentlich ganz gut, hab den erst neu bekommen und hab deshalb noch nicht allzuviel drauf gepackt. Er bootet genauso schnell wie vor 2 wochen (wo der trojaner noch nich rumging). Beim Spielen läuft er auch super, hab bisher keinen unterschied gemerkt. Nur einmal hat ich 1-2 mal paar ruckler im spiel, was nicht normal war. Da dachte ich mir dass es evtl an Malewarebytes liegen könnte und habs kurz geschlossen und wieder angemacht. Aber momentan läuft er wieder stabil und hab keinerlei Probleme mit rucklern Darf ich bei Defogger den Re-enable button drücken oder wird des automatisch gemacht? Oder soll ich noch warten? gruß Woerna |
09.10.2012, 13:32 | #8 | |
/// TB-Ausbilder | Skype Trojaner Servus, Zitat:
Du hast es bald geschafft. Schritt 1
Schritt 2 ESET Online Scanner
Schritt 3 Downloade Dir bitte SecurityCheck
Bitte poste mit deiner nächsten Antwort
|
09.10.2012, 16:16 | #9 |
| Skype Trojaner Servus, danke, des hört sich ja schon mal gut an Hier sind die nächste logs: MBAM: Code:
ATTFilter Malwarebytes Anti-Malware (Test) 1.65.0.1400 www.malwarebytes.org Datenbank Version: v2012.10.09.07 Windows 7 Service Pack 1 x64 NTFS Internet Explorer 9.0.8112.16421 *** :: *** [Administrator] Schutz: Aktiviert 09.10.2012 16:31:04 mbam-log-2012-10-09 (16-31-04).txt Art des Suchlaufs: Quick-Scan Aktivierte Suchlaufeinstellungen: Speicher | Autostart | Registrierung | Dateisystem | Heuristiks/Extra | HeuristiKs/Shuriken | PUP | PUM Deaktivierte Suchlaufeinstellungen: P2P Durchsuchte Objekte: 219491 Laufzeit: 1 Minute(n), 9 Sekunde(n) Infizierte Speicherprozesse: 0 (Keine bösartigen Objekte gefunden) Infizierte Speichermodule: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungsschlüssel: 0 (Keine bösartigen Objekte gefunden) Infizierte Registrierungswerte: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateiobjekte der Registrierung: 0 (Keine bösartigen Objekte gefunden) Infizierte Verzeichnisse: 0 (Keine bösartigen Objekte gefunden) Infizierte Dateien: 0 (Keine bösartigen Objekte gefunden) (Ende) SecurityCheck: Code:
ATTFilter Results of screen317's Security Check version 0.99.51 Windows 7 Service Pack 1 x64 (UAC is enabled) Internet Explorer 9 ``````````````Antivirus/Firewall Check:`````````````` Avira Desktop Antivirus up to date! `````````Anti-malware/Other Utilities Check:````````` Malwarebytes Anti-Malware Version 1.65.0.1400 Adobe Flash Player 11.4.402.287 Adobe Reader X (10.1.4) Mozilla Firefox (15.0.1) ````````Process Check: objlist.exe by Laurent```````` Avira Antivir avgnt.exe Avira Antivir avguard.exe Malwarebytes' Anti-Malware mbamscheduler.exe `````````````````System Health check````````````````` Total Fragmentation on Drive C: ````````````````````End of Log`````````````````````` |
09.10.2012, 18:57 | #10 | |
/// TB-Ausbilder | Skype Trojaner Servus, Zitat:
Wenn du keine Probleme mehr hast, dann sind wir hier fertig. Deine Logdateien sind sauber. Zum Schluss müssen wir noch ein paar abschließende Schritte unternehmen, um deinen Pc aufzuräumen und abzusichern. Schritt 1 Starte DeFogger und klicke auf Re-enable. Gegebenenfalls muss dein Rechner neu gestartet werden. Schritt 2 Ich würde dir empfehlen, 1 mal pro Woche auch mit diesem Scanner dein System zu prüfen. Möchtest Du ESET denoch deinstallieren, Drücke bitte die + R Taste und kopiere folgenden Text in das Ausführen Fenster. Code:
ATTFilter "%PROGRAMFILES(X86)%\Eset\Eset Online Scanner\OnlineScannerUninstaller.exe" Schritt 3 Bitte vor der folgenden Aktion wieder temporär Antivirus-Programm, evtl. vorhandenes Skript-Blocking und Anti-Malware Programme deaktivieren. Windows-Taste + R drücke. Kopiere nun folgende Zeile in die Kommandozeile und klicke OK. Code:
ATTFilter Combofix /Uninstall Damit wird Combofix komplett entfernt und der Cache der Systemwiederherstellung geleert, damit auch aus dieser die Schädlinge verschwinden. Nun die eben deaktivierten Programme wieder aktivieren. Schritt 4
Schritt 5 Starte bitte OTL und klicke auf Bereinigung. Dies wird die meisten Tools entfernen, die wir zur Bereinigung benötigt haben. Sollte etwas bestehen bleiben, bitte mit Rechtsklick --> Löschen entfernen. Schritt 6 Hier noch ein paar Tipps zur Absicherung deines Systems. Ich kann garnicht zu oft erwähnen, wie wichtig es ist, dass dein System Up to Date ist.
Anti- Viren Software
Zusätzlicher Schutz
Sicheres Browsen
Alternative Browser Andere Browser tendieren zu etwas mehr Sicherheit als der IE, da diese keine Active X Elemente verwenden. Diese können von Spyware zur Infektion deines Systems missbraucht werden.
Performance Bereinige regelmäßig deine Temp Files. Ich empfehle hierzu TFC Halte dich fern von jedlichen Registry Cleanern. Diese Schaden deinem System mehr als sie helfen. Hier ein paar ( englishe ) Links Miekemoes Blogspot ( MVP ) Bill Castner ( MVP ) Don'ts
Hinweis: Bitte gib mir eine kurze Rückmeldung wenn alles erledigt ist und keine Fragen mehr vorhanden sind, so dass ich diesen Thread aus meinen Abos löschen kann. |
09.10.2012, 19:21 | #11 |
| Skype Trojaner Servus, Perfekt danke für deine hilfe echt top!!! Hab alles erledigt und hoffe dass ich jetzt in nächster zeit keine probleme mehr haben werde schönen Abend noch und nochmal Danke! gruß Woerna |
09.10.2012, 19:30 | #12 |
/// TB-Ausbilder | Skype Trojaner Ich bin froh, dass wir helfen konnten Dieses Thema scheint erledigt und wird aus meinen Abos gelöscht. Solltest Du das Thema erneut brauchen, schicke mir bitte eine PM. Jeder andere bitte hier klicken und einen eigenen Thread erstellen. |
Themen zu Skype Trojaner |
anti-malware, avira, blockiert, dateien, folge, handy, link, link geklickt, maleware, malwarebytes, neues, nichts, online, online banking, passwörter, port, problem, programme, pup.tool, quarantäne, system, system32, treiber, trojaner, update, version, windows |